@ccslabs/xtend 0.1.0-rc.1

package/CHANGELOG.md

@@ -0,0 +1,65 @@
+# Changelog
+
+Alle sichtbaren Produktaenderungen werden in diesem Dokument gesammelt. XTend ist fuer RC1-Publish-Prep auf `private: false` geoeffnet; der eigentliche Publish-Befehl bleibt ein separater manueller Owner-Schritt.
+
+## 0.1.0-rc.1 Test-Build - 2026-05-16
+
+- Ersten lokalen RC1-Test-Build-Schnitt unter `xtend.rc1.test-build-handoff.v1` dokumentiert.
+- Handoff in `development/XTend-RC1-Test-Build-Handoff.md` mit Datum, Commit-Basis `4e0ae07`, Gate-Reports, Pack Dry Run Evidence und offenen Owner-Entscheidungen ergaenzt.
+- RMT vNext Reference Demo und XTendRMT Bestcase Demo als Test-Build-Referenzpfade aufgenommen.
+- RC1-Publish-Prep ist auf Version `0.1.0-rc.1` umgestellt: `package.json`, `package-lock.json` und die XTendRMT VS-Code-Bridge tragen die RC-Version; `private: false` ist gesetzt, `npm publish` wurde noch nicht ausgefuehrt.
+- Netzwerkpflichtige Audit-/SBOM-Evidence im Owner-Publish-Schritt ausgefuehrt und akzeptiert: Audit meldet 0 Vulnerabilities, SBOM liegt als CycloneDX `1.5` mit `Apache-2.0` License Evidence vor.
+- Release Owner Test-Build Acceptance unter `xtend.rc1.test-build-owner-acceptance.v1` dokumentiert: interne Testnutzung akzeptiert, `npm publish` und automatische Publish-Freigaben bleiben blockiert.
+- Separaten Owner-Publish-Entscheid unter `xtend.rc1.release-owner-publish-decision.v1` auf `accepted-for-publish-prep` gestellt; Version, License, Audit/SBOM und Package Boundary sind akzeptiert, der eigentliche Publish-Befehl bleibt manuell.
+- Apache License 2.0 als Projektlizenz fuer den kompletten XTend-Stack gesetzt: Root-Manifest, XTendRMT VS-Code-Bridge, `LICENSE`, Supply-Chain-Policy und Owner-Publish-Decision sind auf `Apache-2.0` aktualisiert.
+- Scoped Release-Matrix ergaenzt: Root-Package `@ccslabs/xtend` sowie Teilpakete `@ccslabs/xtend-rmt`, `@ccslabs/xtend-fabric`, `@ccslabs/xtend-cli` und `@ccslabs/xtend-compiler` sind ueber Root-Workspaces und untergeordnete Manifests abgebildet.
+
+## Enterprise-Readiness Baseline - 2026-05-06
+
+- Package-Export-Strategie unter `xtend.package-export.release-strategy.v1` vorbereitet.
+- Kanonische Package-Subpaths fuer Loader, API, Komponentenmanifest, Fabric, Fabric/RMT Lane Mapping, XTendRMT Runtime und Scaffold CLI festgelegt.
+- Release-Gates `release:check`, `release:report` und `pack:dry-run` in `package.json` ergaenzt.
+- Supply-Chain-Gate-Plan unter `xtend.security.supply-chain-gate-plan.v1` mit Offline-Verify, License Policy, Vulnerability Policy und CI-Audit-Handoff ergaenzt.
+- Lokale Gates `test:supply-chain` und `supply-chain:verify` ergaenzt.
+- Performance Measurements unter `xtend.performance.measurement.v1` fuer Loader, Hydration, Render und Route Render ergaenzt.
+- Lokales Gate `test:fabric-performance` ergaenzt.
+- Performance Regression Gate unter `xtend.performance.regression-gate.v1` mit deterministischer Baseline und `test:performance` ergaenzt.
+- Hydration Policies unter `xtend.fabric.hydration-policy.v1` fuer visible, idle und lazy Hydration mit `test:hydration-policy` ergaenzt.
+- Performance-Autorendoku und Scaffold Policy `xtend.scaffold.performance-policy.v1` fuer Component-Profile ergaenzt.
+- Browsernahe A11y-Fokus-/Keyboard-Smokes unter `xtend.a11y.browser-keyboard-smoke.v1` fuer Routing, Overlay, Form/Input und Tabs ergaenzt.
+- Screenreader-Signal-Contracts unter `xtend.a11y.screenreader-signals.v1` fuer `aria-live`, Statusregionen, Errorregionen und Announcements mit `test:screenreader-signals` ergaenzt.
+- Motion-/Contrast-Policy unter `xtend.a11y.motion-contrast-policy.v1` fuer `prefers-reduced-motion`, `forced-colors`, Fokus und Nicht-Farbstatus mit `test:motion-contrast` ergaenzt.
+- Manifest-/Dynamic-Import-Policy unter `xtend.security.manifest-import-gate.v1` mit Loader-Refusals und lokalem Gate ergaenzt.
+- Component Catalog Coverage Matrix unter `xtend.catalog.component-coverage-matrix.v1` mit `test:catalog-coverage`, Package-Export und Handoff an Catalog-Folgepakete ergaenzt.
+- Visual-/Browser-Regression-Prioritaetsplan unter `xtend.catalog.component-regression-priority-plan.v1` mit `test:regression-priority`, Package-Export und CI-Handoff ergaenzt.
+- CI Default Gates unter `xtend.ci.default-gates.v1` mit GitHub-Actions-Workflow, Node `26.x`, `npm run test:report` und Artifact `xtend-test-report-node-26` ergaenzt.
+- CI Gate Matrix unter `xtend.ci.gate-matrix.v1` mit `test:pr`, `test:pr:report`, `test:release:full`, `test:release:full:report`, PR-Fast-Artifact und Full-Release-Artifact ergaenzt.
+- Release Checklist und SemVer Policy unter `xtend.release.checklist-semver-policy.v1` mit `xtend.releaseChecklist`, Candidate Gates, Conditional Network Gates, Breaking-Change-Pflichten, Migration Notes, Artifact-Checklist und Release-Owner-Publish-Boundary ergaenzt.
+- Enterprise Adoption Guide unter `xtend.docs.enterprise-adoption.v1` mit `xtend.enterpriseAdoption`, Loader-, Fabric-, RMT-, Security-, A11y-, Performance-, CI- und Release-Readiness-Pfad ergaenzt.
+- RC0 Gate Matrix und RC0 Adoption Guide unter `xtend.epic12.rc0-gate-matrix.v1` und `xtend.epic12.docs-adoption.v1` mit `test:rc0-gate-matrix`, `test:epic12-docs-adoption`, Migration Notes, Known Residual Policy und Publish Boundary ergaenzt.
+- Epic 12 RC0 Handoff unter `xtend.epic12.rc0-handoff.v1` mit `test:epic12-rc0-handoff`, Owner Review Inputs, Conditional Network Gate Status, Known Residual Policy und Status `ready-for-release-owner-review-not-publish` ergaenzt.
+- Epic 13 RC1 Readiness Model unter `xtend.epic13.rc1-production-readiness.v1` mit `test:epic13-rc1-readiness`, RC0-zu-RC1-Gate-Abgleich, Feature-Drift-Bereinigung und Workpackages fuer Production Readiness vorbereitet.
+- Epic 13 Release Owner Acceptance Contract unter `xtend.epic13.release-owner-acceptance.v1` mit `test:epic13-release-owner-acceptance`, Owner Checklist, `accepted`/`deferred`/`blocked` Statuswerten, blockierter `automatic-publish-approval` und Handoff an `WP-E13-03` ergaenzt.
+- Epic 13 Conditional Network Evidence unter `xtend.epic13.conditional-network-evidence.v1` mit `test:epic13-conditional-network-evidence`, Audit-/SBOM-Artefaktpfaden, `xtend.epic13.conditional-network-deferral.v1` und lokal netzwerkfreiem Owner-Deferral-Modell ergaenzt.
+- Epic 13 Package Export Lock unter `xtend.epic13.package-export-lock.v1` mit `test:epic13-package-export-lock`, `pack:dry-run:report`, `.xtend-test-results/xtend-pack-dry-run.json`, `.xtend-test-results/xtend-package-export-surface-lock.json` und Drift-Check gegen `package.json#exports` ergaenzt.
+- Epic 13 Known Residual Triage unter `xtend.epic13.known-residual-triage.v1` mit `test:epic13-known-residual-triage`, Boundary-Schliessungen fuer `xstate`/`x-utils` und `xtend.component.hydrate` als WP-E13-06 Watchpoint ergaenzt.
+- Epic 13 Hydration Performance Closure unter `xtend.epic13.hydration-performance-closure.v1` mit `test:epic13-hydration-performance-closure`, `xtend.component.hydrate` bei `31ms / 32ms`, `warnCount === 0` und Handoff nach `WP-E13-09` ergaenzt.
+- Epic 13 PROD Browser CSP Smoke unter `xtend.epic13.prod-browser-csp-smoke.v1` mit `test:epic13-prod-browser-csp-smoke`, `dev:local:csp`, Nonce, same-origin Manifest, lokalem CSP Header und `tests/browser/fixtures/epic13-prod-csp-smoke.html` ergaenzt.
+- Epic 13 Visual Owner Artifact unter `xtend.epic13.visual-owner-artifact.v1` mit `test:epic13-visual-owner-artifact`, Manifest `tests/browser/visual-baselines/rc1-visual-owner-artifact.manifest.json`, deterministischen Viewports und optionalem Screenshot-/Pixel-Artefaktpfad ergaenzt.
+- Epic 13 RMT Production Readiness unter `xtend.epic13.rmt-production-readiness.v1` mit `test:epic13-rmt-production-readiness`, RMT-first App Shell, Routing, Components, Fabric/Lanes, Lifecycle Telemetry, Diagnostics und Artifact Parity als RC1-Buendel ergaenzt.
+- Epic 13 Docs RMT Production Hardening unter `xtend.epic13.docs-rmt-production-hardening.v1` mit `test:epic13-docs-rmt-production-hardening`, stabilen Docs-App Extension-Slots, Parsedown-Host-Boundary, Rich-HTML-/XPlayer-Schedules und Diagnostics ergaenzt.
+- Epic 13 Trusted DOM Boundary unter `xtend.epic13.trusted-dom-boundary.v1` mit `test:epic13-trusted-dom-boundary`, Sanitizer `xtend.security.trusted-dom-sanitizer.v1`, browsernaher Fixture `tests/browser/fixtures/epic13-trusted-dom-boundary-smoke.html` und Package-Metadaten `xtend.epic13TrustedDomBoundary` ergaenzt.
+- Epic 13 RC1 Migration Notes unter `xtend.epic13.rc1-migration-notes-semver.v1` mit `test:epic13-rc1-migration-notes`, vorgeschlagener Version `0.1.0-rc.1`, Migration Notes, SemVer Decision, Changelog-Pflichten und Package-Metadaten `xtend.epic13Rc1MigrationNotes` ergaenzt.
+- Epic 13 RC1 Gate Matrix und CI-Handoff unter `xtend.epic13.rc1-gate-matrix-ci-handoff.v1` mit `test:epic13-rc1-gate-matrix-ci-handoff`, CI Lanes, Report-Artefakten, Referenzpfaden und Package-Metadaten `xtend.epic13Rc1GateMatrixCiHandoff` ergaenzt.
+- Release Report und Pack Dry Run Evidence unter `xtend.epic13.release-report-pack-dry-run-evidence.v1` mit `test:epic13-release-report-pack-dry-run-evidence`, reproduzierbaren Owner-Artefakten, `pack:dry-run` Capture-Pfad und Package-Metadaten `xtend.epic13ReleaseReportPackDryRunEvidence` ergaenzt.
+- Conditional Network Evidence CI unter `xtend.epic13.conditional-network-evidence-ci.v1` mit `test:epic13-conditional-network-evidence-ci`, `conditional-network:evidence`, CI-Upload-Artefakten und Package-Metadaten `xtend.epic13ConditionalNetworkEvidenceCi` ergaenzt.
+- Docs-App RMT Parsedown Scheduling Pilot unter `xtend.docs.parsedown-rmt-pilot.v1` auf Shell-first erweitert: `docs.app.shell`, `docs.header.search`, `docs.media.lazy`, `xtend.docsRmtPilot`, `docs/xtendrmt-parsedown-docs.rmt`, per-page Host-Metadaten und `test:docs-rmt-pilot` sind gatebar.
+- Docs-App UX-Hardening fuer `x-header`/`x-hero` ergaenzt: strukturierte Docs-Navigation, `search`-/`actions`-Slotmodell, kontraststarke Header-Shell, themenfaehiger Hero und leichte Route-Mikrointeraktionen ohne Docs-App-Monkeypatching.
+- XRouter Scroll-Boundary-Normalisierung unter `xtend.router.scroll-boundary.v1` ergaenzt, damit Route-Wechsel von langen auf kurze Seiten keine stale Scrollpositionen oder Deadzones unterhalb des Contentbereichs hinterlassen.
+- Form-Control-Shell-Sizing fuer `x-form` und `x-input` gehaertet, damit Header-Suchen und kompakte Form-Slots Padding, Border und Control-Breite ohne horizontales Herausragen berechnen.
+- Header-Navigation als fixed Full-Width-Overlay gehaertet und XRouter Overlay-Cleanup unter `xtend.router.closedNavigationOverlays` ergaenzt, damit geoeffnete Menues beim Route-Wechsel keine Deadzones oder lange Scrollbereiche erzeugen.
+- Docs-App Parsedown SafeMode-Nachbearbeitung fuer Inline-Code ergaenzt, damit Komponenten-Namen wie `<x-code>` nicht als doppelt escapete Entities angezeigt werden und die Trusted-DOM-Boundary trotzdem erhalten bleibt.
+- Docs-App Navigation von flacher Linkliste auf kaskadierende Artikelhierarchie mit `id`, `group`, `parent`, `tier` und PageRank-artigem `rank` umgestellt, sodass Basics zuerst sichtbar sind und Spezialthemen als Deep Dives aufklappen.
+- `x-icon` als RMT-kompatible XTend-Komponente ergaenzt: lokale Core-Icons, lokaler Lucide-Adapter, globale `window.XTend.icons` Registry, Public Types, Component-Suite, Fixture und Docs-App-Menue-Ikonographie ohne CDN-Abhaengigkeit.
+- npm Provenance fuer spaetere Releases vorbereitet.
+- Root-README fuer Package-Konsumenten und lokale Enterprise-Entwicklung ergaenzt.

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!) The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,184 @@
+# XTend
+
+- Status: Enterprise Readiness / RC1 scoped publish prep
+- Package contract: `xtend.package-export.release-strategy.v1`
+- Release checklist: `xtend.release.checklist-semver-policy.v1`
+- Root package: `@ccslabs/xtend`
+- Canonical loader: `xtend-loader.js`
+
+XTend ist ein Web-Component-Framework fuer lokale, CDN-freie Entwicklung. Die aktuelle Enterprise-Reife-Strecke trennt XTend UI als Component-/UI-Builder-Produkt von XTendRMT als framework-agnostischem Scheduler und Templating Kernel.
+
+## Scoped Packages
+
+Anwender koennen entweder das Gesamtpaket oder einzelne Laufzeit-/Tooling-Pakete installieren:
+
+| Package | Inhalt | Manifest |
+|---------|--------|----------|
+| `@ccslabs/xtend` | kompletter XTend Stack mit UI, Fabric, RMT, CLI, Compiler, Security und Docs | `package.json` |
+| `@ccslabs/xtend-rmt` | XTendRMT Runtime, Browser Bundle, Core Types und RMT Schema | `xtendrmt/package.json` |
+| `@ccslabs/xtend-fabric` | Fabric Runtime, Hydration Policy und RMT Lane Mapping | `fabric/package.json` |
+| `@ccslabs/xtend-cli` | Scaffold-/Builder-CLI mit `xt`, `xtend` und `xtend-scaffold` | `xtend-builder/package.json` |
+| `@ccslabs/xtend-compiler` | RMT vNext Compiler, Parser, Linter und Language-Server Tooling | `tools/package.json` |
+
+## Einstiegspunkte
+
+| Zweck | Pfad |
+|-------|------|
+| Kanonischer Browser Loader | `xtend-loader.js` |
+| Legacy Loader Stub | `xtend-dev.js` |
+| UI API | `api.js` |
+| Komponentenmanifest | `components/manifest.json` |
+| XTend-Fabric Runtime | `fabric/xtend-fabric.js` |
+| Fabric/RMT Lane Mapping | `fabric/rmt-lane-mapping.js` |
+| Performance fuer Komponentenautoren | `docs/performance.md` |
+| Performance Measurements | `docs/performance-measurements.md` |
+| Performance Regression | `docs/performance-regression.md` |
+| Hydration Policies | `docs/hydration-policies.md` |
+| Hydration Performance Closure | `docs/hydration-performance-closure.md` |
+| PROD Browser CSP Smokes | `docs/prod-browser-csp-smokes.md` |
+| Visual Owner Artifacts | `docs/visual-owner-artifacts.md` |
+| Trusted DOM Boundary Proof | `docs/trusted-dom-boundary-browser-proof.md` |
+| RC1 Migration Notes | `docs/rc1-migration-notes.md` |
+| RC1 Gate Matrix und CI-Handoff | `docs/rc1-gate-matrix-ci-handoff.md` |
+| Release Report und Pack Dry Run Evidence | `docs/release-report-pack-dry-run-evidence.md` |
+| A11y Keyboard Smokes | `docs/a11y-keyboard-smokes.md` |
+| Screenreader Signals | `docs/screenreader-signals.md` |
+| Motion und Contrast | `docs/motion-contrast.md` |
+| Manifest Import Policy | `security/manifest-import-policy.js` |
+| Conditional Network Evidence CI | `docs/conditional-network-evidence-ci.md` |
+| Component Catalog Coverage | `catalog/component-catalog-coverage.js` |
+| Visual/Browser Regression Priority | `catalog/component-regression-priority.js` |
+| Enterprise Adoption Guide | `docs/enterprise-adoption.md` |
+| RC0 Adoption Guide | `docs/rc0-adoption-guide.md` |
+| RC0 Gate Matrix | `development/XTend-RC0-Gate-Matrix.md` |
+| Docs RMT Parsedown Pilot | `docs/xtendrmt-parsedown-docs.rmt` |
+| CI Default Gates | `.github/workflows/xtend-default-gates.yml` |
+| CI Gate Matrix | `development/XTend-CI-Gate-Matrix.md` |
+| Release Checklist und SemVer | `development/XTend-Release-Checklist-und-SemVer-Policy.md` |
+| XTendRMT ESM Runtime | `xtendrmt/rmt-runtime.esm.js` |
+| XTendRMT Browser Runtime | `xtendrmt/rmt-runtime.browser.js` |
+| Scaffold CLI | `xt`, `xtend`, `xtend-scaffold`, `xtend-builder/scaffold.js` |
+| Supply-Chain Policy | `security/supply-chain-gate-policy.js` |
+
+## Lokale Entwicklung
+
+```bash
+npm run dev:local
+npm test
+xt validate --json
+npm run test:fabric-performance
+npm run test:performance
+npm run test:hydration-policy
+npm run test:screenreader-signals
+npm run test:motion-contrast
+npm run test:catalog-coverage
+npm run test:regression-priority
+npm run test:report
+npm run test:pr
+npm run test:release:full
+npm run test:manifest-policy
+npm run test:supply-chain
+npm run test:rc0-gate-matrix
+npm run test:epic12-docs-adoption
+npm run test:epic13-package-export-lock
+npm run test:epic13-prod-browser-csp-smoke
+npm run test:epic13-visual-owner-artifact
+npm run test:epic13-trusted-dom-boundary
+npm run test:epic13-rc1-migration-notes
+npm run test:epic13-rc1-gate-matrix-ci-handoff
+npm run test:epic13-release-report-pack-dry-run-evidence
+npm run test:epic13-conditional-network-evidence-ci
+npm run conditional-network:evidence
+npm run dev:local:csp
+npm run test:docs-rmt-pilot
+npm run release:check
+npm run pack:dry-run:report
+npm run pack:dry-run
+```
+
+`npm publish` bleibt ein Owner-kontrollierter Schritt. Root bleibt fuer RC1-Publish-Prep auf `private: false`; der aktive GitHub-Actions-Workflow kann diesen Schritt ueber `workflow_dispatch` mit `publish_to_npm=true` oder automatisch nach einem `release: published` Event fahren: Vor dem Publish laufen Full Release Gates, `release:report`, Package Dry Run, Publish Dry Run und Audit/SBOM Evidence erneut; der finale Befehl ist `npm publish --tag next --provenance --access public`.
+
+Der aktive GitHub-Actions-Workflow `.github/workflows/xtend-default-gates.yml` nutzt Node `26.x` und trennt Pull-Request-Feedback von Full-Release-Gates: `npm run test:pr:report` laedt `xtend-pr-gate-report-node-26`, `npm run test:release:full:report` laedt `xtend-release-gate-report-node-26`, `package-structure` laedt `xtend-package-structure-node-26`.
+
+Release-Kandidaten folgen `xtend.release.checklist-semver-policy.v1`. `package.json` spiegelt die Pflichten unter `xtend.releaseChecklist`; die RC1-Publish-Prep-Boundary ist durch den Release Owner geoeffnet.
+
+## Lizenz
+
+XTend und der komplette XTendRMT-Stack stehen unter der Apache License 2.0. Die vollstaendige Lizenz liegt in `LICENSE`; die Package-Manifeste nutzen `Apache-2.0`.
+
+Enterprise-Teams starten mit `docs/enterprise-adoption.md`. Der Guide verbindet Loader, lokalen Dev Server, XTend UI, XTend-Fabric, XTendRMT, Security, A11y, Performance, CI Gates und Release Readiness zu einem operativen Einfuehrungspfad. Die zugehoerige Package-Metadatenflaeche liegt unter `xtend.enterpriseAdoption`.
+
+`WP-E12-15` ergaenzt den RC0 Adoption Guide unter `docs/rc0-adoption-guide.md`. Der Guide verbindet Long-Tail Runtime Closure, DOM-first Visual Snapshots, Design Tokens, RMT DSL Authoring Polish, Known Residual Policy und RC0 Gate Matrix fuer Component Authors, App Authors und Release Owner. Die Package-Metadatenflaeche liegt unter `xtend.epic12DocsAdoption`.
+
+`WP-E12-16` schliesst Epic 12 mit dem RC0 Handoff unter `docs/epic12-rc0-handoff.md` ab. Der Handoff verbindet die Gate-Matrix, Migration Notes, Known Residual Policy, Conditional Network Gates, Package Dry Run und Publish Boundary fuer Release Owner. Die Package-Metadatenflaeche liegt unter `xtend.epic12Rc0Handoff`; der Status ist `ready-for-release-owner-review-not-publish`.
+
+`WP-E13-01` startet den RC0-zu-RC1-Transfer mit dem RC1 Readiness Model unter `docs/rc1-readiness.md`. Der Gate-Abgleich verbindet vorhandene RC0-Gates mit den noch offenen PROD-Readiness-Luecken fuer Release Owner Acceptance, Network Evidence, Package Dry Run Export Lock, Known Residuals, PROD-nahe Browser-/CSP-Smokes, RMT Production Readiness und Migration Notes. Die Package-Metadatenflaeche liegt unter `xtend.epic13Rc1Readiness`.
+
+`WP-E13-02` definiert den Release Owner Acceptance Contract unter `docs/release-owner-acceptance.md`. Die Owner Checklist nutzt `accepted`, `deferred` und `blocked`, blockiert `automatic-publish-approval` und haelt `private-until-release-owner-acceptance` aktiv. Die Package-Metadatenflaeche liegt unter `xtend.epic13ReleaseOwnerAcceptance`; nach `WP-E13-09` zeigt der Handoff auf `WP-E13-10`.
+
+`WP-E13-03` definiert die Conditional Network Evidence unter `docs/conditional-network-evidence.md`. `npm audit --audit-level=moderate` und `npm sbom --sbom-format=cyclonedx --json` besitzen erwartete `.xtend-test-results/` Artefakte, waehrend lokale Default-Gates netzwerkfrei bleiben und strukturierte Deferrals wie `network-restricted-local-default` erzeugen koennen. Die Package-Metadatenflaeche liegt unter `xtend.epic13ConditionalNetworkEvidence`.
+
+`WP-E13-04` definiert den Package Export Lock unter `docs/package-export-lock.md`. `npm run pack:dry-run:report` erzeugt `.xtend-test-results/xtend-pack-dry-run.json`, `.xtend-test-results/xtend-package-export-surface-lock.json` und `.xtend-test-results/xtend-package-export-lock-report.json`. Die Package-Metadatenflaeche liegt unter `xtend.epic13PackageExportLock`.
+
+`WP-E13-05` definiert die Known Residual Triage unter `docs/known-residual-triage.md`. `xstate` und `x-utils` sind fuer RC1 als Boundary-Contracts geschlossen, waehrend `xtend.component.hydrate` als einziger Watchpoint nach `WP-E13-06` ging. Die Package-Metadatenflaeche liegt unter `xtend.epic13KnownResidualTriage`.
+
+`WP-E13-06` definiert die Hydration Performance Closure unter `docs/hydration-performance-closure.md`. `xtend.component.hydrate` liegt mit `31ms` unter dem unveraenderten `32ms` Budget, die RC1-Baseline meldet `warnCount === 0`, und es bleibt kein Owner-Residual fuer Hydration uebrig. Die Package-Metadatenflaeche liegt unter `xtend.epic13HydrationPerformanceClosure`.
+
+`WP-E13-07` definiert die PROD Browser CSP Smokes unter `docs/prod-browser-csp-smokes.md`. `xtend.epic13.prod-browser-csp-smoke.v1` beschreibt same-origin Manifest, Nonce, root-lokalen Loader, lokalen CSP Header und `tests/browser/fixtures/epic13-prod-csp-smoke.html`. Die Package-Metadatenflaeche liegt unter `xtend.epic13ProdBrowserCspSmoke`.
+
+`WP-E13-08` definiert die Visual Owner Artifacts unter `docs/visual-owner-artifacts.md`. `xtend.epic13.visual-owner-artifact.v1` beschreibt Manifest, deterministische Viewports, `.xtend-test-results/visual-snapshots/rc1/{family}/{viewport}/{theme}/{density}/{motion}.png` und den lokalen DOM-first Gate ohne verpflichtenden Browser-Treiber. Die Package-Metadatenflaeche liegt unter `xtend.epic13VisualOwnerArtifact`.
+
+`WP-E13-09` definiert die RMT Production Readiness unter `docs/rmt-production-readiness.md`. `xtend.epic13.rmt-production-readiness.v1` buendelt RMT-first App Shell, Routing, Components, Fabric/Lanes, Lifecycle Telemetry, Diagnostics und Artifact Parity als RC1-Gate. Die Package-Metadatenflaeche liegt unter `xtend.epic13RmtProductionReadiness`.
+
+`WP-E13-10` definiert das Docs RMT Production Hardening unter `docs/docs-rmt-production-hardening.md`. `xtend.epic13.docs-rmt-production-hardening.v1` stabilisiert die Docs-App als Shell-first RMT/Parsedown-Pfad mit Extension-Slots fuer `parsedownHtml`, `richHtml`, `xplayerTutorial` und Diagnostics. Die Package-Metadatenflaeche liegt unter `xtend.epic13DocsRmtProductionHardening`.
+
+`WP-E13-11` definiert den Trusted DOM Boundary Browser Proof unter `docs/trusted-dom-boundary-browser-proof.md`. `xtend.epic13.trusted-dom-boundary.v1` prueft Parsedown HTML, RMT `html_fragment`, `dom_descriptor`-Praeferenz, Sanitizer `xtend.security.trusted-dom-sanitizer.v1`, CSP-Anschluss und die Fixture `tests/browser/fixtures/epic13-trusted-dom-boundary-smoke.html`. Die Package-Metadatenflaeche liegt unter `xtend.epic13TrustedDomBoundary`.
+
+`WP-E13-12` definiert die RC1 Migration Notes unter `docs/rc1-migration-notes.md`. `xtend.epic13.rc1-migration-notes-semver.v1` dokumentiert den SemVer-Entscheid fuer `0.1.0-rc.1`, Consumer-Migrationen fuer Loader, RMT, Docs, Trusted DOM, Fabric, Typing, Visual Owner Artifacts und Supply Chain sowie den Handoff nach `WP-E13-13`. Die Package-Metadatenflaeche liegt unter `xtend.epic13Rc1MigrationNotes`.
+
+`WP-E13-13` definiert die RC1 Gate Matrix und den CI-Handoff unter `docs/rc1-gate-matrix-ci-handoff.md`. `xtend.epic13.rc1-gate-matrix-ci-handoff.v1` registriert Epic-13-Source-Gates, CI Lanes, Report-Artefakte, Referenzpfade und den Handoff nach `WP-E13-14`. Die Package-Metadatenflaeche liegt unter `xtend.epic13Rc1GateMatrixCiHandoff`.
+
+`DPF-WP-02` definiert die Release Report und Pack Dry Run Evidence unter `docs/release-report-pack-dry-run-evidence.md`. `xtend.epic13.release-report-pack-dry-run-evidence.v1` macht `npm run release:report` und `npm run pack:dry-run` zu reproduzierbaren Owner-Artefakten; der lokale Gate ist `npm run test:epic13-release-report-pack-dry-run-evidence`. Die Package-Metadatenflaeche liegt unter `xtend.epic13ReleaseReportPackDryRunEvidence`.
+
+`DPF-WP-03` definiert die Conditional Network Evidence CI unter `docs/conditional-network-evidence-ci.md`. `xtend.epic13.conditional-network-evidence-ci.v1` macht `npm run conditional-network:evidence`, den CI-Job `conditional-network-evidence` und Audit-/SBOM-Deferrals fuer Release Owner sichtbar. Die Package-Metadatenflaeche liegt unter `xtend.epic13ConditionalNetworkEvidenceCi`.
+
+`ER-WP-40` finalisiert den Enterprise-Reife-Paketlauf mit dem Docs-App RMT Parsedown Pilot. Das RMT-Dokument `docs/xtendrmt-parsedown-docs.rmt` beschreibt `xtend.docs.parsedown-rmt-pilot.v1` inzwischen Shell-first: `docs.app.shell` und `docs.header.search` werden als RMT-`dom_descriptor` gerendert, waehrend Parsedown, PHP und Sanitizing in der Docs-App Boundary bleiben. Die Package-Metadatenflaeche liegt unter `xtend.docsRmtPilot`.
+
+## Dokumentation
+
+- `docs/` enthaelt die offizielle Entwicklerdokumentation.
+- `development/XTend-Package-Export-und-Release-Strategie.md` beschreibt die Distribution- und Release-Entscheidung.
+- `docs/performance.md` beschreibt die Performance-Policy fuer Komponentenautoren.
+- `development/XTend-Performance-Messpunkte-und-Snapshots.md` beschreibt Loader-, Hydration-, Render- und Route-Messpunkte.
+- `development/XTend-Performance-Regression-Gate.md` beschreibt das deterministische Performance Regression Gate.
+- `development/XTend-Hydration-Policy-Contract.md` beschreibt Lazy/Idle/Visible Hydration Policies.
+- `development/XTend-Browsernaher-Fokus-und-Keyboard-Smoke-Plan.md` beschreibt browsernahe A11y-Fokus- und Keyboard-Smokes.
+- `development/XTend-Screenreader-Signal-Contract.md` beschreibt `xtend.a11y.screenreader-signals.v1` fuer Live-Regionen, Statusregionen, Errorregionen und Announcements.
+- `development/XTend-Motion-und-Contrast-Policy.md` beschreibt `xtend.a11y.motion-contrast-policy.v1` fuer Reduced Motion, High Contrast, Fokus und Nicht-Farbstatus.
+- `development/XTend-Manifest-und-Dynamic-Import-Policy.md` beschreibt Loader-, Manifest- und Dynamic-Import-Haertung.
+- `development/XTend-Supply-Chain-Gate-Plan.md` beschreibt Dependency-, License- und Vulnerability-Gates.
+- `development/XTend-Epic12-Abschluss-und-RC0-Handoff.md` beschreibt den RC0 Owner-Handoff und die Publish Boundary fuer Epic 12.
+- `development/XTend-Epic13-RC1-Readiness-Modell.md` beschreibt den RC0-zu-RC1-Transfer und die Gate-Luecken zur Production Readiness.
+- `development/XTend-Epic13-Release-Owner-Acceptance-Contract.md` beschreibt `xtend.epic13.release-owner-acceptance.v1`, Owner Inputs, Checklist-Statuswerte und die blockierte automatische Publish-Freigabe.
+- `development/XTend-Epic13-Conditional-Network-Evidence-Contract.md` beschreibt `xtend.epic13.conditional-network-evidence.v1`, Audit-/SBOM-Artefakte und strukturierte Offline-/Sandbox-Deferrals.
+- `development/XTend-Epic13-Package-Export-Lock-Contract.md` beschreibt `xtend.epic13.package-export-lock.v1`, Dry-Run-Artefakte und den Export-Surface-Lock.
+- `development/XTend-Epic13-Known-Residual-Triage-Contract.md` beschreibt `xtend.epic13.known-residual-triage.v1`, Boundary-Schliessungen fuer `xstate`/`x-utils` und den Hydration-Watchpoint.
+- `development/XTend-Epic13-Hydration-Performance-Closure-Contract.md` beschreibt `xtend.epic13.hydration-performance-closure.v1`, die owner-freie Schliessung von `xtend.component.hydrate` und den Handoff nach `WP-E13-09`.
+- `development/XTend-Epic13-PROD-Browser-CSP-Smoke-Contract.md` beschreibt `xtend.epic13.prod-browser-csp-smoke.v1`, Nonce, same-origin Manifest, lokalen CSP Header und die PROD-nahe Browser-Fixture.
+- `development/XTend-Epic13-Visual-Owner-Artifact-Contract.md` beschreibt `xtend.epic13.visual-owner-artifact.v1`, Manifest, Viewports und optionale Screenshot-/Pixel-Artefakte.
+- `development/XTend-Epic13-RMT-Production-Readiness-Contract.md` beschreibt `xtend.epic13.rmt-production-readiness.v1`, RMT-first App Shell, Routing, Components, Fabric/Lanes, Diagnostics, Artifact Parity und Kernel Boundary.
+- `development/XTend-Epic13-Docs-RMT-Production-Hardening-Contract.md` beschreibt `xtend.epic13.docs-rmt-production-hardening.v1`, Docs-App Extension-Slots, Parsedown-Host-Boundary, Rich-HTML-/XPlayer-Schedules und Diagnostics.
+- `development/XTend-Epic13-Trusted-DOM-Boundary-Contract.md` beschreibt `xtend.epic13.trusted-dom-boundary.v1`, Parsedown/RMT HTML Sanitizer, Browser-Fixture und Kernel Boundary.
+- `development/XTend-Epic13-RC1-Migration-Notes-und-SemVer-Entscheid.md` beschreibt `xtend.epic13.rc1-migration-notes-semver.v1`, vorgeschlagene RC-Version `0.1.0-rc.1`, Migration Sections, Changelog-Pflichten und Handoff nach `WP-E13-13`.
+- `development/XTend-Epic13-RC1-Gate-Matrix-und-CI-Handoff.md` beschreibt `xtend.epic13.rc1-gate-matrix-ci-handoff.v1`, CI Lanes, Report-Artefakte, Referenzpfade und Handoff nach `WP-E13-14`.
+- `development/XTend-Epic13-Release-Report-und-Pack-Dry-Run-Evidence.md` beschreibt `xtend.epic13.release-report-pack-dry-run-evidence.v1`, Release Report, Pack Dry Run, Owner-Artefakte und Handoff nach `DPF-WP-03`.
+- `development/XTend-Epic13-Conditional-Network-Evidence-CI-Contract.md` beschreibt `xtend.epic13.conditional-network-evidence-ci.v1`, Audit/SBOM-CI-Evidence, Deferral-Artefakte und Handoff nach `DPF-WP-04`.
+- `development/XTend-Component-Catalog-Coverage-Matrix.md` beschreibt `xtend.catalog.component-coverage-matrix.v1` fuer Manifest-weite Component-Reife.
+- `development/XTend-Visuelle-und-Browsernahe-Regression-Prioritaetsplan.md` beschreibt `xtend.catalog.component-regression-priority-plan.v1` fuer Visual-/Browser-Regression.
+- `development/XTend-CI-Default-Gates-Workflow.md` beschreibt `xtend.ci.default-gates.v1` fuer den aktiven CI-Workflow.
+- `development/XTend-CI-Gate-Matrix.md` beschreibt `xtend.ci.gate-matrix.v1` fuer PR-Fast-, Full-Release- und Nightly-Gates.
+- `development/XTend-Release-Checklist-und-SemVer-Policy.md` beschreibt `xtend.release.checklist-semver-policy.v1` fuer Release-Kandidaten, SemVer, Breaking Changes, Migration Notes, Artifacts und Publish Boundary.
+- `docs/enterprise-adoption.md` beschreibt `xtend.docs.enterprise-adoption.v1` fuer Enterprise Adoption, Betriebsprofile, Gate-Reihenfolge und Release Readiness.
+- `docs/rc0-adoption-guide.md` beschreibt `xtend.epic12.docs-adoption.v1` fuer RC0 Migration Notes, Adoption Checks, Known Residuals und Publish Boundary.
+- `docs/xtendrmt-parsedown-scheduling.md` beschreibt `xtend.docs.parsedown-rmt-pilot.v1`, `docs.app.shell`, `docs.header.search`, `docs.media.lazy` und `xtend.docsRmtPilot` fuer den Shell-first Docs-App RMT Parsedown Scheduling Pilot.
+- `development/ROADMAP-XTend-Enterprise-Reife.md` fuehrt die Enterprise-Workpackages.

package/a11y/motion-contrast-policy.d.ts

@@ -0,0 +1,32 @@
+export * from '../fabric/xtend-policy-public-types';
+import type {
+  XtendPolicyConstant,
+  XtendPolicyOptions,
+  XtendPolicyReport
+} from '../fabric/xtend-policy-public-types';
+
+export interface XtendMotionContrastPolicy {
+  schema: string;
+  componentRef: string;
+  motion: Record<string, unknown>;
+  contrast: Record<string, unknown>;
+  fabric: Record<string, unknown>;
+  requiredCss: string[];
+  testRefs: string[];
+  boundaries: Record<string, unknown>;
+  [key: string]: unknown;
+}
+
+export declare const CONTRACTS: XtendPolicyConstant<Record<string, string>>;
+export declare const MOTION_CONTRAST_POLICY_SCHEMA: XtendPolicyConstant<string>;
+export declare const MOTION_POLICY_SCHEMA: XtendPolicyConstant<string>;
+export declare const CONTRAST_POLICY_SCHEMA: XtendPolicyConstant<string>;
+export declare const MOTION_CONTRAST_TEST_SCHEMA: XtendPolicyConstant<string>;
+export declare const MOTION_MEDIA_QUERY: XtendPolicyConstant<string>;
+export declare const CONTRAST_MEDIA_QUERY: XtendPolicyConstant<string>;
+export declare const PROFILE_POLICY_DEFAULTS: XtendPolicyConstant<Record<string, unknown>>;
+export declare const SYSTEM_COLOR_TOKENS: XtendPolicyConstant<string[]>;
+export declare const FABRIC_A11Y_PREFERENCE: XtendPolicyConstant<Record<string, unknown>>;
+export declare function createMotionContrastPolicy(options?: XtendPolicyOptions): XtendMotionContrastPolicy;
+export declare function normalizeMotionContrastPolicy(input?: XtendPolicyOptions | XtendMotionContrastPolicy): XtendMotionContrastPolicy;
+export declare function validateMotionContrastPolicy(input?: XtendPolicyOptions | XtendMotionContrastPolicy): XtendPolicyReport<XtendMotionContrastPolicy>;