)

* feat(frontend): v1 scaffold, strict TypeScript and import boundary (UN-4270)

Adds frontend/src/v1/ as an isolated tree for the v1 frontend (P0-T01):

- Folder taxonomy from the spec, a public entry (src/v1/index.ts, imported
  by v0 as `@v1`) and a cloud overlay placeholder.
- src/v1/tsconfig.json: strict, no JS, unused locals/params are errors,
  `@v1` alias only. v0's tsconfig/jsconfig exclude src/v1.
- Biome overrides for the two-way import boundary and v1 bans (no `../`,
  `@/`, prop-types, antd, component CSS; noExplicitAny).
- scripts/check-v1.mjs for what Biome cannot express: TypeScript-only
  files, the folder taxonomy and import contract, PropTypes, `ant-`.
- typecheck:v1, lint:v1 and test:v1 scripts; v0 scripts are unchanged.
- test-fixtures/v1-boundary/ proves each rule fails and passes as
  specified, run with node --test so the v0 vitest suite never sees it.
- .gitignore re-includes src/v1/lib/ (the Python `lib/` rule matched it).

v0 build output, test counts, typecheck and Biome results are unchanged.

* fix(frontend): close v1 guardrail bypasses found in self-review (UN-4270)

check-v1.mjs:
- Scan comments with a string/template-aware tokenizer; a `/*` or `//`
  inside a string or line comment no longer hides the imports after it.
- Read template-literal specifiers, import.meta.glob and `import(..., opts)`.
- Flag specifiers that leave src/v1 (`/`, `..`, `@/`, `src/`) itself, not
  only via Biome, which skips template literals.
- Check `@import`/`url()` and `ant-` in styles/ CSS; report symlinks;
  catch built `ant-` names; treat .test/.spec .mts/.cts as test files;
  ignore .DS_Store; drop the unused --root option.

biome.json: also ban `..`, `./../**`, `/**`, `antd/**`, `prop-types/**`.
tsconfig: skipLibCheck off so v1's own .d.ts files are checked.
.gitignore: re-include lib/ at any depth under src/v1.

Fixtures: a generated matrix over every folder-contract pair, every import
form, every outside spelling, a symlink case, and cases for each new rule;
tsc cases assert error codes; output matching excludes the command text and
spawn errors fail loudly. Comment and README corrections.

* feat(frontend): run v1 checks in CI and tighten what pages may import (UN-4270)

- ci-frontend-lint: the typecheck job also runs `typecheck:v1` and
  `lint:v1`, so the strict v1 tsconfig and the scripts/check-v1.mjs checks
  (folder contract, TypeScript-only files, PropTypes, `ant-`) gate PRs now
  rather than from P0-T10.
- Pages may no longer import app/, test/ or the v1 entry, only the shared
  folders (components, shell, services, stores, hooks, lib, styles,
  plugins). Test files in a page may still import test/. Contract table,
  README and the fixture matrix updated together.

* refactor(frontend): address SonarCloud findings on the v1 guardrails (UN-4270)

check-v1.mjs: split the comment scanner into small helpers (cognitive
complexity 40 -> under 15), drop the nested ternary and nested template
literal, use String.raw for the import regexes, keep CLI flags in a Set.

Fixture runner:
- Cases and the expected folder contract are parsed text tables instead of
  repeated object literals (the 10% duplication).
- Sorts use an explicit localeCompare comparator.
- The contract matrix is built by a helper.
- Spawns /bin/sh by absolute path and no longer needs `git init` (Biome only
  needs the ignore file). The git check-ignore call keeps a PATH lookup, with
  the reason and a NOSONAR marker.

Fixture cases: re-exports rewritten as small functions and read-only props,
without changing what each case exercises.

* refactor(frontend): split the contract-matrix builder to cut its complexity (UN-4270)

* fix(frontend): check every glob pattern and v0 -> v1 imports Biome cannot see (UN-4270)

Addresses Greptile review on #2380:
- import.meta.glob([...]): every pattern in the array is checked, not only
  the first, so an allowed first pattern no longer hides a forbidden one.
- check-v1 --code also scans v0 (src/ outside v1, including the cloud
  src/plugins overlay) for template-literal imports, globs, require(),
  @/v1, src/v1, relative paths and CSS @import that reach into v1 other
  than through `@v1`. Biome still covers plain imports.

Fixtures: Greptile's example as a case, a glob array with a forbidden later
pattern, and a generated test of every v0 -> v1 form (denied and allowed).
The v0 scan reports nothing on the current tree.

* fix(frontend): typecheck v1 tests that import vitest; skip cloud plugins in the ignore check (UN-4270)

Reported by Athul while building #2394/#2395 on this branch:
- src/v1/tsconfig.json: skipLibCheck back on, as in tsconfig.json. Off, tsc
  also checked third-party typings, and @types/chai 5.2.3 and vitest 3.2.6
  both declare `containSubset`, so any v1 test importing vitest failed
  typecheck:v1. A fixture test now imports vitest to keep this covered.
- The "no v1 file is git-ignored" check skips src/v1/plugins/<id>/: cloud
  plugins copied there are git-ignored on purpose (#2394).

* fix(frontend): close v1 guardrail gaps from team review (UN-4270)

From Ali's, Athul's and Vishnu's reviews on #2380, each reproduced first:

- tsconfig/jsconfig map `@v1/*` too: once v0 imports the entry, tsc follows
  it into src/v1, where cross-folder `@v1/...` imports must resolve
  (would break `bun run typecheck` at UN-4271). Lint keeps v0 on `@v1`.
- check-v1 scanner tracks regex literals, so a `/*` inside one no longer
  hides the rest of the file; CSS blanks only block comments (`//` is URL).
- Imports are read by argument: literals, templates by their fixed prefix,
  every glob pattern, and new URL(..., import.meta.url). In v1 an import the
  guard cannot read fails closed; a computed v1 path is allowed only in
  folders that may import everything (the lazy route registry in app/).
- v0 specifiers are normalized before the check (/src/v1, @/./v1, ...).
- v1 styles may not @import antd packages.
- Biome's v0 rule matches only alias spellings of src/v1, so `uuid/v1` or
  `@/api/v1` no longer fail; relative spellings are check-v1's (in CI).
- CI runs `test:v1` (fixtures) on Node 22; setup-biome pinned to a SHA
  (SonarCloud S7637).

Fixtures assert the exact message and count per form, cover each fix, and
check that comments, JSX and look-alike class names stay quiet. Against the
previous guard, 9 of the new tests fail.

* feat(frontend): add an assets/ folder to the v1 taxonomy (UN-4270)

Static files (icons, logos, images) get one home, src/v1/assets/, imported
as @v1/assets/... (e.g. logo.svg?react). v1 cannot reach v0's src/assets/.
Raised by Ali on #2380: Lane I's P1-T22 needs SVG icons and provider logos,
and a .svg outside the taxonomy failed --files.

components/ui, components/patterns, shell, pages and styles may import
assets/; assets/ imports nothing but itself (room for a generated icon map).
README, contract table and the fixture matrix updated together;
v1-allowed-imports imports an SVG as a React component under typecheck:v1.

* fix(frontend): find v1 imports only in executable code, not in strings (UN-4270)

Greptile on #2380: `export const example = "import(name)";` failed lint:v1,
because the call matcher also ran over string contents. Static import text
in a string ('import x from "@/helpers/x"') and in templates or regexes was
read as an import too.

The comment scanner now also returns a code-only view (string, template
and regex bodies blanked, offsets kept). Statements and calls are located
there; the specifier is read from the real text at the same offset. The
import-form test gains a quiet case with import text in a string, a
template and a regex; it fails against the previous guard.

* fix(frontend): don't read JSX apostrophes as strings in the v1 scanner (UN-4270)

Greptile P1 on #2380, introduced by 3889a34: the code-only view blanked
string bodies, and the apostrophe in JSX text (`It's`, `{name}'s`) opened a
"string" that ran to the end of the line, hiding a forbidden import after
it.

A quote now starts a string only in expression position (after an operator,
`(`, `,`, `=`, `[`, `{` or a keyword such as return/case/import/from) and only
if it closes on its line, as JS strings must; otherwise it is JSX text. The
regex-literal check shares the same token test.

Fixtures: Greptile's example and the `{name}'s` form each must report the
import; a JSX attribute and quoted JSX text stay quiet. A differential run
over the 409 real v0 files finds no real import hidden by the code-only view.

* fix(frontend): read v1 imports from a Babel AST, not a hand-written tokenizer (UN-4270)

The tokenizer guessed regex vs division and string vs JSX text from the
previous token. JSX text such as `{done}/{total}`, `files/*.ts`, a stray
backtick, a multi-line attribute or `range.from / x` flipped it into a state
that never closed, and check-v1 then passed the rest of the file.

check-v1 now parses with @babel/parser (TypeScript 7 has no JS parser API)
and walks import/export statements, import(), require(), import.meta.glob,
new URL(..., import.meta.url), `typeof import()` and `import x = require()`.
Escapes are decoded and methods named import/require are not imports.

Also:
- v1 rejects concatenated specifiers, template prefixes with no `/`, a
  non-literal new URL and files that do not parse; v0 reports a template or
  glob prefix that could grow into src/v1.
- v1 styles: check @reference/@plugin/@config and the folder contract.
- Biome: relative v0 -> v1 spellings are back in the v0 group.
- A `../` that stays inside v1 is reported as such, not as "outside".
- v0 symlinks into src/v1 are reported; file symlinks are scanned.
- README: name what Biome covers; asset placement is convention.
- Fixtures for every reported repro and the remaining #5 branches; drop the
  unused src/v1/plugins/<id> ignore filter.

* fix(frontend): read v1 import specifiers through TypeScript assertions (UN-4270)

`import("@v1/x" as const)` wrapped the specifier in a TSAsExpression, so
v0 treated it as opaque and skipped it. Unwrap as/satisfies/<T>x/x! first.
Also share one helper between the outside and climbs tests.

* fix(frontend): close v1 boundary gaps from the daa1a18 review (UN-4270)

- import.meta.glob: resolve relative patterns against the `base` option; a
  base that is not a string literal is unanalysable in v1.
- See through TypeScript wrappers on the import markers too
  (`import.meta.url as string`, `(import.meta.glob as any)()`,
  `(require as ...)()`, `new (URL as ...)()`, a glob array `as const`).
- v0: judge a `+` chain or `.concat()` by the string it starts with, as
  Vite globs it, and a conditional by both branches.
- Report a `..` after the first wildcard or `${}`, in v1 and v0.
- Read stylesheets with PostCSS: case-insensitive at-rules, `@import"x"`
  with no space, and `/*` inside strings.
- Root tsconfig includes vite-env.d.ts, so v1 assets, CSS and
  import.meta.env reached through `@v1` typecheck in the v0 lane.
- Parse .d.ts files in declaration mode.
- Split nodes() and checkV0() into helpers (Sonar S3776).

* fix(frontend): read CSS image-set() and escaped url()s; allowlist v1 file types (UN-4270)

- CSS values are read with postcss-value-parser: every url() and every
  string inside image-set() / -webkit-image-set(), with backslash escapes
  removed as Vite does. @import targets use the same parser; an unreadable
  one is unanalysable.
- v1 holds only code, styles (in styles/), Vite asset types, JSON, Markdown
  and .gitkeep; --files reports any other type. STYLE_EXT and the Biome
  component-style group cover all of Vite's CSS languages.
- --code reads every non-asset file in v1 and v0, parsing an unknown type
  as code (Vite can load any file with ?worker), and checks style files
  wherever they are, so --code alone catches what --files rejects.

* chore: git-ignore cloud v1 plugins copied into src/v1/plugins/ (UN-4270)

The cloud build copies its v1 plugins into src/v1/plugins/<id>/, as it
does v0 plugins into src/plugins/. Ignore them, keeping only the public
placeholder manifest.ts tracked, so cloud code cannot be committed here.

The ignore-check test skips a local copy of those plugins, and a new test
asserts they are ignored while manifest.ts is not.