# Architecture

The shell lazy-loads a React workbench. Pure core modules parse and validate
JSON-like values, hold a named in-memory document map, resolve only relative
local references, collect OpenAPI HTTP operations or AsyncAPI channels,
send/receive operations and messages, derive bounded examples, compare
operation contracts and summarize saved exchanges. OpenAPI 3.2 fixed `query`
and bounded custom `additionalOperations` method tokens are retained. OpenAPI
3.1/3.2 webhook Path Items are inventoried and compared as receiver operations;
their names do not declare real delivery URLs, so examples use an explicit
placeholder and HAR matching excludes them. AsyncAPI 3.x root
operation/channel/message references and the older 2.x
publish/subscribe channel shape have separate, explicit adapters. HAR validation matches
captured URLs to the most specific path template, checks required parameters,
status and media declarations, and applies a bounded JSON Schema subset to
available JSON bodies. It emits only locations and messages: captured header
and body values never enter the report. No module exposes a request executor.

JSON uses hardened shared helpers. YAML is converted with bounded alias count
and then recursively checked for depth, node count, dangerous keys and plain
JSON values. Rendering uses React text nodes and read-only textareas. The
same-origin service worker caches only packaged application resources.

Contract checking is limited to 2,000 exchanges, 100,000 schema evaluation
steps, 5,000 diagnostics, 2 MiB per decoded JSON body, local references, and a
focused type/composition/object/array/scalar subset. It is evidence and coverage
analysis rather than a claim of complete OpenAPI conformance. AsyncAPI bindings,
traits, correlation expressions and multi-format schemas are inventoried as
inert data; only JSON-Schema-like payload/header objects receive heuristic
sample generation.