Backend architecture.
Build the right boundaries first.

ClearLend.slnx
  src/
    ClearLend.Domain/          business concepts and invariants
    ClearLend.Application/     commands, queries and ports
    ClearLend.Infrastructure/  EF Core and external adapters
    ClearLend.Contracts/       public request and response types
    ClearLend.Api/             HTTP, auth and composition root
  tests/
    ClearLend.Domain.Tests/
    ClearLend.Application.Tests/
    ClearLend.Architecture.Tests/
    ClearLend.Api.IntegrationTests/
  docs/decisions/

Application/Applications/CreateDraft/
  CreateDraftCommand.cs
  CreateDraftHandler.cs
  CreateDraftResult.cs
Application/Applications/GetDraft/
  GetDraftQuery.cs
  GetDraftHandler.cs
  DraftDetails.cs
Api/Features/Applications/
  CreateDraftEndpoint.cs
  GetDraftEndpoint.cs

namespace ClearLend.Domain.Examples;

public sealed class DomainRuleException(string code, string message)
    : Exception(message)
{
    public string Code { get; } = code;
}

public readonly record struct BorrowerId(Guid Value);
public readonly record struct LenderId(Guid Value);
public readonly record struct LoanId(Guid Value);

public sealed record Money
{
    public decimal Amount { get; }
    public string Currency { get; }

    private Money(decimal amount, string currency)
        => (Amount, Currency) = (amount, currency);

    public static Money Create(decimal amount, string currency)
    {
        if (amount < 0)
            throw new DomainRuleException("money.negative", "Amount cannot be negative.");
        if (string.IsNullOrWhiteSpace(currency))
            throw new DomainRuleException("money.currency", "Currency is required.");

        var code = currency.Trim().ToUpperInvariant();
        if (code.Length != 3 || code.Any(c => c is < 'A' or > 'Z'))
            throw new DomainRuleException("money.currency", "Use a three-letter currency code.");

        return new Money(amount, code);
    }

    public Money Subtract(Money other)
    {
        ArgumentNullException.ThrowIfNull(other);
        if (Currency != other.Currency)
            throw new DomainRuleException("money.currency_mismatch", "Currencies must match.");
        if (other.Amount > Amount)
            throw new DomainRuleException("money.insufficient", "Amount exceeds the balance.");
        return Create(Amount - other.Amount, Currency);
    }
}

namespace ClearLend.Domain.Examples;

public enum BorrowerStatus { PendingVetting, Vetted, Suspended }

public sealed class Borrower
{
    public BorrowerId Id { get; }
    public string LegalName { get; private set; }
    public BorrowerStatus Status { get; private set; }
    public Money? ApprovedLimit { get; private set; }
    public string? VettingDecisionReference { get; private set; }
    public DateTimeOffset? VettedAt { get; private set; }
    public string? SuspensionReason { get; private set; }
    public DateTimeOffset RegisteredAt { get; }
    public DateTimeOffset LastChangedAt { get; private set; }

    private Borrower(BorrowerId id, string legalName, DateTimeOffset registeredAt)
    {
        Id = id;
        LegalName = legalName;
        Status = BorrowerStatus.PendingVetting;
        RegisteredAt = LastChangedAt = registeredAt;
    }

    public static Borrower Register(
        BorrowerId id, string legalName, DateTimeOffset registeredAt)
    {
        if (id.Value == Guid.Empty)
            throw new DomainRuleException("borrower.id", "Borrower ID is required.");
        if (registeredAt == default)
            throw new DomainRuleException("borrower.time", "Registration time is required.");
        return new Borrower(id, RequireName(legalName), registeredAt);
    }

    public void CorrectLegalName(string legalName, DateTimeOffset changedAt)
    {
        EnsureTime(changedAt);
        if (Status != BorrowerStatus.PendingVetting)
            throw new DomainRuleException("borrower.name_locked", "A vetted name needs a new review.");
        LegalName = RequireName(legalName);
        LastChangedAt = changedAt;
    }

    public void ApproveVetting(
        Money approvedLimit, string decisionReference, DateTimeOffset decidedAt)
    {
        EnsureTime(decidedAt);
        ArgumentNullException.ThrowIfNull(approvedLimit);
        if (Status != BorrowerStatus.PendingVetting || approvedLimit.Amount <= 0)
            throw new DomainRuleException("borrower.vetting", "Pending review and a positive limit are required.");
        if (string.IsNullOrWhiteSpace(decisionReference))
            throw new DomainRuleException("borrower.decision", "A decision reference is required.");

        ApprovedLimit = approvedLimit;
        VettingDecisionReference = decisionReference.Trim();
        VettedAt = LastChangedAt = decidedAt;
        Status = BorrowerStatus.Vetted;
    }

    public void Suspend(string reason, DateTimeOffset changedAt)
    {
        EnsureTime(changedAt);
        if (Status == BorrowerStatus.Suspended || string.IsNullOrWhiteSpace(reason))
            throw new DomainRuleException("borrower.suspension", "A new suspension needs a reason.");
        SuspensionReason = reason.Trim();
        Status = BorrowerStatus.Suspended;
        LastChangedAt = changedAt;
    }

    public void ReopenVetting(DateTimeOffset changedAt)
    {
        EnsureTime(changedAt);
        if (Status != BorrowerStatus.Suspended)
            throw new DomainRuleException("borrower.reopen", "Only a suspended borrower can reopen review.");
        Status = BorrowerStatus.PendingVetting;
        ApprovedLimit = null;
        VettingDecisionReference = null;
        VettedAt = null;
        SuspensionReason = null;
        LastChangedAt = changedAt;
    }

    public bool CanRequest(Money amount)
    {
        ArgumentNullException.ThrowIfNull(amount);
        return Status == BorrowerStatus.Vetted
            && ApprovedLimit is not null
            && amount.Amount > 0
            && amount.Currency == ApprovedLimit.Currency
            && amount.Amount <= ApprovedLimit.Amount;
    }

    private void EnsureTime(DateTimeOffset at)
    {
        if (at < LastChangedAt)
            throw new DomainRuleException("borrower.time", "A change cannot predate the last change.");
    }

    private static string RequireName(string value)
    {
        if (string.IsNullOrWhiteSpace(value))
            throw new DomainRuleException("borrower.name", "Legal name is required.");
        return value.Trim();
    }
}

namespace ClearLend.Domain.Examples;

public enum LenderStatus { PendingVetting, Active, Suspended }

public sealed class Lender
{
    public LenderId Id { get; }
    public string RegisteredName { get; }
    public LenderStatus Status { get; private set; }
    public Money? SingleCommitmentLimit { get; private set; }
    public string? VettingDecisionReference { get; private set; }
    public DateTimeOffset? ApprovedAt { get; private set; }
    public string? SuspensionReason { get; private set; }
    public DateTimeOffset RegisteredAt { get; }
    public DateTimeOffset LastChangedAt { get; private set; }

    private Lender(LenderId id, string registeredName, DateTimeOffset registeredAt)
    {
        Id = id;
        RegisteredName = registeredName;
        Status = LenderStatus.PendingVetting;
        RegisteredAt = LastChangedAt = registeredAt;
    }

    public static Lender Register(
        LenderId id, string registeredName, DateTimeOffset registeredAt)
    {
        if (id.Value == Guid.Empty)
            throw new DomainRuleException("lender.id", "Lender ID is required.");
        if (string.IsNullOrWhiteSpace(registeredName) || registeredAt == default)
            throw new DomainRuleException("lender.registration", "Name and time are required.");
        return new Lender(id, registeredName.Trim(), registeredAt);
    }

    public void ApproveForLending(
        Money singleCommitmentLimit, string decisionReference, DateTimeOffset decidedAt)
    {
        EnsureTime(decidedAt);
        ArgumentNullException.ThrowIfNull(singleCommitmentLimit);
        if (Status != LenderStatus.PendingVetting || singleCommitmentLimit.Amount <= 0)
            throw new DomainRuleException("lender.vetting", "Pending review and a positive limit are required.");
        if (string.IsNullOrWhiteSpace(decisionReference))
            throw new DomainRuleException("lender.decision", "A decision reference is required.");

        SingleCommitmentLimit = singleCommitmentLimit;
        VettingDecisionReference = decisionReference.Trim();
        ApprovedAt = LastChangedAt = decidedAt;
        Status = LenderStatus.Active;
    }

    public void Suspend(string reason, DateTimeOffset changedAt)
    {
        EnsureTime(changedAt);
        if (Status == LenderStatus.Suspended || string.IsNullOrWhiteSpace(reason))
            throw new DomainRuleException("lender.suspension", "A new suspension needs a reason.");
        SuspensionReason = reason.Trim();
        Status = LenderStatus.Suspended;
        LastChangedAt = changedAt;
    }

    public void ReopenVetting(DateTimeOffset changedAt)
    {
        EnsureTime(changedAt);
        if (Status != LenderStatus.Suspended)
            throw new DomainRuleException("lender.reopen", "Only a suspended lender can reopen review.");
        Status = LenderStatus.PendingVetting;
        SingleCommitmentLimit = null;
        VettingDecisionReference = null;
        ApprovedAt = null;
        SuspensionReason = null;
        LastChangedAt = changedAt;
    }

    public bool AllowsSingleCommitment(Money amount)
    {
        ArgumentNullException.ThrowIfNull(amount);
        return Status == LenderStatus.Active
            && SingleCommitmentLimit is not null
            && amount.Amount > 0
            && amount.Currency == SingleCommitmentLimit.Currency
            && amount.Amount <= SingleCommitmentLimit.Amount;
    }

    private void EnsureTime(DateTimeOffset at)
    {
        if (at < LastChangedAt)
            throw new DomainRuleException("lender.time", "A change cannot predate the last change.");
    }
}

namespace ClearLend.Domain.Examples;

public enum LoanStatus { Active, PrincipalCleared }

public sealed class Loan
{
    public LoanId Id { get; }
    public BorrowerId BorrowerId { get; }
    public LenderId LenderId { get; }
    public Guid AcceptedOfferId { get; }
    public Money Principal { get; }
    public decimal FixedNominalAnnualRatePercent { get; }
    public int TermMonths { get; }
    public string FundingConfirmationReference { get; }
    public DateTimeOffset FundedAt { get; }
    public Money OutstandingPrincipal { get; private set; }
    public LoanStatus Status { get; private set; }
    public DateTimeOffset? PrincipalClearedAt { get; private set; }

    private Loan(
        LoanId id, BorrowerId borrowerId, LenderId lenderId,
        Guid acceptedOfferId, Money principal, decimal annualRatePercent,
        int termMonths, string fundingReference, DateTimeOffset fundedAt)
    {
        Id = id;
        BorrowerId = borrowerId;
        LenderId = lenderId;
        AcceptedOfferId = acceptedOfferId;
        Principal = OutstandingPrincipal = principal;
        FixedNominalAnnualRatePercent = annualRatePercent;
        TermMonths = termMonths;
        FundingConfirmationReference = fundingReference;
        FundedAt = fundedAt;
        Status = LoanStatus.Active;
    }

    public static Loan OpenFromConfirmedFunding(
        LoanId id, BorrowerId borrowerId, LenderId lenderId,
        Guid acceptedOfferId, Money principal, decimal annualRatePercent,
        int termMonths, string fundingReference, DateTimeOffset fundedAt)
    {
        ArgumentNullException.ThrowIfNull(principal);
        if (id.Value == Guid.Empty || borrowerId.Value == Guid.Empty
            || lenderId.Value == Guid.Empty || acceptedOfferId == Guid.Empty)
            throw new DomainRuleException("loan.identity", "Loan and party IDs are required.");
        if (principal.Amount <= 0 || annualRatePercent < 0 || termMonths <= 0)
            throw new DomainRuleException("loan.terms", "Positive principal, nonnegative rate and term are required.");
        if (string.IsNullOrWhiteSpace(fundingReference) || fundedAt == default)
            throw new DomainRuleException("loan.funding", "Confirmed funding reference and time are required.");

        return new Loan(id, borrowerId, lenderId, acceptedOfferId, principal,
            annualRatePercent, termMonths, fundingReference.Trim(), fundedAt);
    }

    public void ApplyConfirmedPrincipal(
        Money principalPaid, DateTimeOffset confirmedAt)
    {
        ArgumentNullException.ThrowIfNull(principalPaid);
        if (Status != LoanStatus.Active)
            throw new DomainRuleException("loan.principal_cleared", "A principal-cleared loan cannot receive more principal.");
        if (principalPaid.Amount <= 0 || confirmedAt < FundedAt)
            throw new DomainRuleException("loan.allocation", "Positive principal and a valid time are required.");

        OutstandingPrincipal = OutstandingPrincipal.Subtract(principalPaid);
        if (OutstandingPrincipal.Amount == 0)
        {
            Status = LoanStatus.PrincipalCleared;
            PrincipalClearedAt = confirmedAt;
        }
    }
}

src/ClearLend.Application/
  Abstractions/
    ICurrentActor.cs                 trusted borrower identity
    IBorrowerEligibility.cs          Onboarding decision contract
    ILoanApplicationIds.cs           deterministic ID creation
  Applications/
    Shared/
      AppResult.cs                   typed use-case outcomes
      IDraftWriter.cs                aggregate write port
      IDraftReader.cs                owned read projection port
    CreateDraft/
      CreateDraftCommand.cs
      CreateDraftHandler.cs
      CreatedDraft.cs
    ChangeDraftAmount/
      ChangeDraftAmountCommand.cs
      ChangeDraftAmountHandler.cs
      ChangedDraft.cs
    GetDraft/
      GetDraftQuery.cs
      GetDraftHandler.cs
      DraftDetails.cs
tests/ClearLend.Application.Tests/Applications/
  CreateDraft/  ChangeDraftAmount/  GetDraft/

namespace ClearLend.Domain.Examples;

public readonly record struct LoanApplicationId(Guid Value);
public enum DraftStatus { Draft, Submitted }

// A compact collaborator for this chapter; Step 3 will build the real aggregate.
public sealed class LoanApplication
{
    public LoanApplicationId Id { get; }
    public BorrowerId BorrowerId { get; }
    public Money RequestedAmount { get; private set; }
    public DraftStatus Status { get; private set; }
    public DateTimeOffset UpdatedAt { get; private set; }

    private LoanApplication(LoanApplicationId id, BorrowerId borrowerId,
        Money requestedAmount, DateTimeOffset now)
    {
        Id = id;
        BorrowerId = borrowerId;
        RequestedAmount = requestedAmount;
        Status = DraftStatus.Draft;
        UpdatedAt = now;
    }

    public static LoanApplication CreateDraft(LoanApplicationId id,
        BorrowerId borrowerId, Money requestedAmount, DateTimeOffset now)
    {
        ArgumentNullException.ThrowIfNull(requestedAmount);
        if (id.Value == Guid.Empty || borrowerId.Value == Guid.Empty
            || requestedAmount.Amount <= 0 || now == default)
            throw new DomainRuleException("draft.creation", "A draft needs valid identity, amount and time.");
        return new LoanApplication(id, borrowerId, requestedAmount, now);
    }

    // Repository reconstitution; the real Step 3 aggregate will validate
    // every field required by each persisted status before returning.
    public static LoanApplication Rehydrate(LoanApplicationId id,
        BorrowerId borrowerId, Money requestedAmount,
        DraftStatus status, DateTimeOffset updatedAt)
    {
        if (!Enum.IsDefined(status))
            throw new DomainRuleException("draft.status", "Stored status is unknown.");
        var application = CreateDraft(id, borrowerId, requestedAmount, updatedAt);
        application.Status = status;
        return application;
    }

    public void ChangeRequestedAmount(Money requestedAmount, DateTimeOffset now)
    {
        ArgumentNullException.ThrowIfNull(requestedAmount);
        if (Status != DraftStatus.Draft)
            throw new DomainRuleException("draft.not_editable", "Only a draft can change amount.");
        if (requestedAmount.Amount <= 0 || now < UpdatedAt
            || requestedAmount.Currency != RequestedAmount.Currency)
            throw new DomainRuleException("draft.amount", "Amount and currency must remain valid.");
        RequestedAmount = requestedAmount;
        UpdatedAt = now;
    }
}

using ClearLend.Domain.Examples;

namespace ClearLend.Application.Examples;

public enum FailureKind { Unauthenticated, Invalid, Ineligible, NotFound, Conflict }
public sealed record AppFailure(FailureKind Kind, string Code, string Message);

public sealed class AppResult<T>
{
    public T? Value { get; }
    public AppFailure? Failure { get; }
    public bool Succeeded => Failure is null;

    private AppResult(T? value, AppFailure? failure)
        => (Value, Failure) = (value, failure);

    public static AppResult<T> Ok(T value) => new(value, null);
    public static AppResult<T> Fail(FailureKind kind, string code, string message)
        => new(default, new AppFailure(kind, code, message));
}

// The API constructs this from validated authentication, never from request JSON.
public interface ICurrentActor
{
    BorrowerId? BorrowerId { get; }
}

// An Onboarding module contract; no direct read of its tables.
public interface IBorrowerEligibility
{
    Task<bool> CanStartDraftAsync(BorrowerId borrowerId, Money amount,
        CancellationToken cancellationToken);
}

public interface ILoanApplicationIds
{
    LoanApplicationId NewLoanApplicationId();
}

public sealed record LoadedDraft(LoanApplication Draft, string Version);
public sealed record SavedDraft(bool Saved, string? NewVersion);

// Implemented by Infrastructure. Save uses ID + owner + expected version.
public interface IDraftWriter
{
    Task<string> AddAsync(LoanApplication draft, CancellationToken cancellationToken);
    Task<LoadedDraft?> FindOwnedForChangeAsync(LoanApplicationId id,
        BorrowerId borrowerId, CancellationToken cancellationToken);
    Task<SavedDraft> SaveAsync(LoanApplication draft, string expectedVersion,
        CancellationToken cancellationToken);
}

public sealed record DraftDetails(LoanApplicationId Id, decimal RequestedAmount,
    string Currency, string Status, DateTimeOffset UpdatedAt, string Version);

// A direct owned projection; it need not materialize the aggregate.
public interface IDraftReader
{
    Task<DraftDetails?> ReadOwnedAsync(LoanApplicationId id, BorrowerId borrowerId,
        CancellationToken cancellationToken);
}

public static class RequestedMoney
{
    public static Money? TryCreate(decimal amount, string? currency)
    {
        if (amount <= 0 || string.IsNullOrWhiteSpace(currency)) return null;
        var code = currency.Trim().ToUpperInvariant();
        if (code.Length != 3 || code.Any(c => c is < 'A' or > 'Z')) return null;
        return Money.Create(amount, code); // Domain remains the final guard.
    }
}

using ClearLend.Domain.Examples;

namespace ClearLend.Application.Examples;

public sealed record CreateDraftCommand(decimal RequestedAmount, string Currency);
public sealed record CreatedDraft(LoanApplicationId Id, string Version);

public sealed class CreateDraftHandler(
    ICurrentActor actor,
    IBorrowerEligibility eligibility,
    IDraftWriter writer,
    ILoanApplicationIds ids,
    TimeProvider clock)
{
    public async Task<AppResult<CreatedDraft>> Handle(
        CreateDraftCommand command, CancellationToken cancellationToken)
    {
        var borrowerId = actor.BorrowerId;
        if (borrowerId is null)
            return AppResult<CreatedDraft>.Fail(FailureKind.Unauthenticated,
                "actor.missing", "A borrower sign-in is required.");

        var amount = RequestedMoney.TryCreate(command.RequestedAmount, command.Currency);
        if (amount is null)
            return AppResult<CreatedDraft>.Fail(FailureKind.Invalid,
                "draft.amount", "Enter a positive amount and a three-letter currency.");

        if (!await eligibility.CanStartDraftAsync(borrowerId.Value, amount, cancellationToken))
            return AppResult<CreatedDraft>.Fail(FailureKind.Ineligible,
                "borrower.ineligible", "Borrower is not approved for this request.");

        var draft = LoanApplication.CreateDraft(ids.NewLoanApplicationId(),
            borrowerId.Value, amount, clock.GetUtcNow());
        var version = await writer.AddAsync(draft, cancellationToken);
        return AppResult<CreatedDraft>.Ok(new CreatedDraft(draft.Id, version));
    }
}

using ClearLend.Domain.Examples;

namespace ClearLend.Application.Examples;

public sealed record ChangeDraftAmountCommand(LoanApplicationId Id,
    decimal RequestedAmount, string Currency, string ExpectedVersion);
public sealed record ChangedDraft(LoanApplicationId Id, string Version);

public sealed class ChangeDraftAmountHandler(
    ICurrentActor actor, IDraftWriter writer, TimeProvider clock)
{
    public async Task<AppResult<ChangedDraft>> Handle(
        ChangeDraftAmountCommand command, CancellationToken cancellationToken)
    {
        var borrowerId = actor.BorrowerId;
        if (borrowerId is null)
            return AppResult<ChangedDraft>.Fail(FailureKind.Unauthenticated,
                "actor.missing", "A borrower sign-in is required.");
        if (command.Id.Value == Guid.Empty || string.IsNullOrWhiteSpace(command.ExpectedVersion))
            return AppResult<ChangedDraft>.Fail(FailureKind.Invalid,
                "draft.identity", "Draft ID and expected version are required.");

        var amount = RequestedMoney.TryCreate(command.RequestedAmount, command.Currency);
        if (amount is null)
            return AppResult<ChangedDraft>.Fail(FailureKind.Invalid,
                "draft.amount", "Enter a positive amount and a three-letter currency.");

        var loaded = await writer.FindOwnedForChangeAsync(command.Id,
            borrowerId.Value, cancellationToken);
        if (loaded is null)
            return AppResult<ChangedDraft>.Fail(FailureKind.NotFound,
                "draft.not_found", "Draft was not found.");
        if (!StringComparer.Ordinal.Equals(loaded.Version, command.ExpectedVersion))
            return AppResult<ChangedDraft>.Fail(FailureKind.Conflict,
                "draft.stale", "Reload the draft before saving changes.");

        try
        {
            loaded.Draft.ChangeRequestedAmount(amount, clock.GetUtcNow());
        }
        catch (DomainRuleException error) when (
            error.Code is "draft.not_editable" or "draft.amount")
        {
            return AppResult<ChangedDraft>.Fail(FailureKind.Conflict,
                error.Code, error.Message);
        }

        // The adapter compares the expected version again in SQL. A second
        // writer can win after our read; a failed compare must not overwrite it.
        var saved = await writer.SaveAsync(loaded.Draft,
            command.ExpectedVersion, cancellationToken);
        if (!saved.Saved || saved.NewVersion is null)
            return AppResult<ChangedDraft>.Fail(FailureKind.Conflict,
                "draft.stale", "Reload the draft before saving changes.");

        return AppResult<ChangedDraft>.Ok(new ChangedDraft(command.Id, saved.NewVersion));
    }
}

using ClearLend.Domain.Examples;

namespace ClearLend.Application.Examples;

public sealed record GetDraftQuery(LoanApplicationId Id);

public sealed class GetDraftHandler(ICurrentActor actor, IDraftReader reader)
{
    public async Task<AppResult<DraftDetails>> Handle(
        GetDraftQuery query, CancellationToken cancellationToken)
    {
        var borrowerId = actor.BorrowerId;
        if (borrowerId is null)
            return AppResult<DraftDetails>.Fail(FailureKind.Unauthenticated,
                "actor.missing", "A borrower sign-in is required.");
        if (query.Id.Value == Guid.Empty)
            return AppResult<DraftDetails>.Fail(FailureKind.Invalid,
                "draft.id", "Draft ID is required.");

        // Reader filters by both ID and borrower. Missing and unowned drafts
        // are intentionally indistinguishable to this caller.
        var draft = await reader.ReadOwnedAsync(query.Id,
            borrowerId.Value, cancellationToken);
        return draft is null
            ? AppResult<DraftDetails>.Fail(FailureKind.NotFound,
                "draft.not_found", "Draft was not found.")
            : AppResult<DraftDetails>.Ok(draft);
    }
}

src/ClearLend.Infrastructure/
  DependencyInjection/InfrastructureRegistration.cs
  Persistence/
    ClearLendDbContext.cs
    Applications/
      DraftRow.cs
      DraftRowMap.cs
      DraftMapping.cs
      DraftVersionCodec.cs
      EfDraftWriter.cs
      EfDraftReader.cs
    Migrations/
      20xx..._InitialDrafts.cs
  Integrations/
    Onboarding/            eligibility adapter when its contract is real
    Documents/             storage adapter when evidence is in scope
    Notifications/         sender and outbox worker in a later step
tests/ClearLend.Infrastructure.IntegrationTests/
  DraftPersistenceTests.cs
  DraftConcurrencyTests.cs

using ClearLend.Domain.Examples;
using Microsoft.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore.Metadata.Builders;

namespace ClearLend.Infrastructure.Examples;

// Persistence shape stays in Infrastructure; it is never returned by the API.
public sealed class DraftRow
{
    public Guid Id { get; set; }
    public Guid BorrowerId { get; set; }
    public decimal RequestedAmount { get; set; }
    public string Currency { get; set; } = string.Empty;
    public DraftStatus Status { get; set; }
    public DateTimeOffset UpdatedAt { get; set; }
    public byte[] Version { get; set; } = [];
}

public sealed class ClearLendDbContext(DbContextOptions<ClearLendDbContext> options)
    : DbContext(options)
{
    internal DbSet<DraftRow> Drafts => Set<DraftRow>();

    protected override void OnModelCreating(ModelBuilder modelBuilder)
        => modelBuilder.ApplyConfiguration(new DraftRowMap());
}

internal sealed class DraftRowMap : IEntityTypeConfiguration<DraftRow>
{
    public void Configure(EntityTypeBuilder<DraftRow> row)
    {
        row.ToTable("LoanApplications", "applications", table =>
        {
            table.HasCheckConstraint("CK_Draft_Amount", "[RequestedAmount] > 0");
            table.HasCheckConstraint("CK_Draft_Status",
                "[Status] IN ('Draft', 'Submitted')");
        });
        row.HasKey(x => x.Id);
        row.Property(x => x.BorrowerId).IsRequired().IsConcurrencyToken();
        row.Property(x => x.RequestedAmount).HasPrecision(28, 10);
        row.Property(x => x.Currency).HasColumnType("char(3)").IsRequired();
        row.Property(x => x.Status).HasConversion<string>()
            .HasMaxLength(24).IsRequired();
        row.Property(x => x.UpdatedAt).IsRequired();
        row.Property(x => x.Version).IsRowVersion();
    }
}

public static class DraftMapping
{
    public static DraftRow ToRow(LoanApplication draft) => new()
    {
        Id = draft.Id.Value,
        BorrowerId = draft.BorrowerId.Value,
        RequestedAmount = draft.RequestedAmount.Amount,
        Currency = draft.RequestedAmount.Currency,
        Status = draft.Status,
        UpdatedAt = draft.UpdatedAt
    };

    public static LoanApplication ToDomain(DraftRow row)
        => LoanApplication.Rehydrate(new LoanApplicationId(row.Id),
            new BorrowerId(row.BorrowerId),
            Money.Create(row.RequestedAmount, row.Currency),
            row.Status, row.UpdatedAt);
}

public static class DraftVersionCodec
{
    public static string Encode(byte[] version) => Convert.ToBase64String(version);

    public static bool TryDecode(string? encoded, out byte[] version)
    {
        version = [];
        if (string.IsNullOrWhiteSpace(encoded)) return false;
        try
        {
            var decoded = Convert.FromBase64String(encoded);
            if (decoded.Length != 8) return false; // SQL Server rowversion is 8 bytes.
            version = decoded;
            return true;
        }
        catch (FormatException) { return false; }
    }
}

using Microsoft.EntityFrameworkCore.Migrations;

namespace ClearLend.Infrastructure.Examples;

// Representative migration; generate and review the real migration in Step 4.
public sealed class InitialDrafts : Migration
{
    protected override void Up(MigrationBuilder migrationBuilder)
    {
        migrationBuilder.EnsureSchema(name: "applications");
        migrationBuilder.CreateTable(
            name: "LoanApplications",
            schema: "applications",
            columns: table => new
            {
                Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
                BorrowerId = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
                RequestedAmount = table.Column<decimal>(type: "decimal(28,10)", nullable: false),
                Currency = table.Column<string>(type: "char(3)", nullable: false),
                Status = table.Column<string>(type: "nvarchar(24)", maxLength: 24, nullable: false),
                UpdatedAt = table.Column<DateTimeOffset>(type: "datetimeoffset", nullable: false),
                Version = table.Column<byte[]>(type: "rowversion", rowVersion: true, nullable: false)
            },
            constraints: table =>
            {
                table.PrimaryKey("PK_LoanApplications", x => x.Id);
                table.CheckConstraint("CK_Draft_Amount", "[RequestedAmount] > 0");
                table.CheckConstraint("CK_Draft_Status", "[Status] IN ('Draft', 'Submitted')");
            });
    }

    protected override void Down(MigrationBuilder migrationBuilder)
        => migrationBuilder.DropTable(name: "LoanApplications", schema: "applications");
}

using ClearLend.Application.Examples;
using ClearLend.Domain.Examples;
using Microsoft.EntityFrameworkCore;

namespace ClearLend.Infrastructure.Examples;

public sealed class EfDraftWriter(ClearLendDbContext db) : IDraftWriter
{
    public async Task<string> AddAsync(LoanApplication draft,
        CancellationToken cancellationToken)
    {
        var row = DraftMapping.ToRow(draft);
        db.Drafts.Add(row);
        await db.SaveChangesAsync(cancellationToken);
        return DraftVersionCodec.Encode(row.Version); // Returned after commit.
    }

    public async Task<LoadedDraft?> FindOwnedForChangeAsync(
        LoanApplicationId id, BorrowerId borrowerId,
        CancellationToken cancellationToken)
    {
        var row = await db.Drafts.AsNoTracking().SingleOrDefaultAsync(
            x => x.Id == id.Value && x.BorrowerId == borrowerId.Value,
            cancellationToken);
        return row is null ? null : new LoadedDraft(
            DraftMapping.ToDomain(row), DraftVersionCodec.Encode(row.Version));
    }

    public async Task<SavedDraft> SaveAsync(LoanApplication draft,
        string expectedVersion, CancellationToken cancellationToken)
    {
        if (!DraftVersionCodec.TryDecode(expectedVersion, out var originalVersion))
            return new SavedDraft(false, null);

        var row = DraftMapping.ToRow(draft);
        row.Version = originalVersion;
        db.Drafts.Attach(row);
        var entry = db.Entry(row);
        entry.Property(x => x.BorrowerId).OriginalValue = draft.BorrowerId.Value;
        entry.Property(x => x.Version).OriginalValue = originalVersion;
        entry.Property(x => x.RequestedAmount).IsModified = true;
        entry.Property(x => x.Currency).IsModified = true;
        entry.Property(x => x.Status).IsModified = true;
        entry.Property(x => x.UpdatedAt).IsModified = true;

        try
        {
            await db.SaveChangesAsync(cancellationToken);
            return new SavedDraft(true, DraftVersionCodec.Encode(row.Version));
        }
        catch (DbUpdateConcurrencyException)
        {
            entry.State = EntityState.Detached;
            return new SavedDraft(false, null);
        }
    }
}

using ClearLend.Application.Examples;
using ClearLend.Domain.Examples;
using Microsoft.EntityFrameworkCore;

namespace ClearLend.Infrastructure.Examples;

public sealed class EfDraftReader(ClearLendDbContext db) : IDraftReader
{
    public async Task<DraftDetails?> ReadOwnedAsync(LoanApplicationId id,
        BorrowerId borrowerId, CancellationToken cancellationToken)
    {
        var row = await db.Drafts.AsNoTracking()
            .Where(x => x.Id == id.Value && x.BorrowerId == borrowerId.Value)
            .Select(x => new
            {
                x.Id, x.RequestedAmount, x.Currency,
                x.Status, x.UpdatedAt, x.Version
            })
            .SingleOrDefaultAsync(cancellationToken);

        return row is null ? null : new DraftDetails(
            new LoanApplicationId(row.Id), row.RequestedAmount,
            row.Currency, row.Status.ToString(), row.UpdatedAt,
            DraftVersionCodec.Encode(row.Version));
    }
}

using ClearLend.Application.Examples;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.DependencyInjection;

namespace ClearLend.Infrastructure.Examples;

public static class InfrastructureRegistration
{
    public static IServiceCollection AddClearLendInfrastructure(
        this IServiceCollection services, string connectionString)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(connectionString);
        services.AddDbContext<ClearLendDbContext>(options =>
            options.UseSqlServer(connectionString));
        services.AddScoped<IDraftWriter, EfDraftWriter>();
        services.AddScoped<IDraftReader, EfDraftReader>();
        return services;
    }
}

src/
  ClearLend.Contracts/
    Applications/V1/
      CreateDraftRequest.cs
      ChangeDraftAmountRequest.cs
      CreatedDraftResponse.cs
      DraftResponse.cs
  ClearLend.Api/
    Features/Applications/V1/DraftEndpoints.cs
    Http/DraftEtags.cs
    Http/ApiFailures.cs
    Security/HttpCurrentActor.cs
    Program.cs
tests/
  ClearLend.Api.IntegrationTests/
    Applications/DraftContractTests.cs
    Security/BorrowerBoundaryTests.cs
    Resilience/RequestLimitTests.cs

using System.ComponentModel.DataAnnotations;

namespace ClearLend.Contracts.Examples;

// Only client-editable fields appear in a request. Owner, status and version
// are deliberately absent: they come from identity, domain and HTTP headers.
public sealed record CreateDraftRequest(
    [property: Range(typeof(decimal), "0.01", "999999999999.99")]
    decimal RequestedAmount,
    [property: Required, RegularExpression("^[A-Z]{3}$")]
    string Currency);

public sealed record ChangeDraftAmountRequest(
    [property: Range(typeof(decimal), "0.01", "999999999999.99")]
    decimal RequestedAmount,
    [property: Required, RegularExpression("^[A-Z]{3}$")]
    string Currency);

public sealed record CreatedDraftResponse(Guid Id);
public sealed record DraftResponse(Guid Id, decimal RequestedAmount,
    string Currency, string Status, DateTimeOffset UpdatedAt);

using System.Security.Claims;
using ClearLend.Application.Examples;
using ClearLend.Domain.Examples;

namespace ClearLend.Api.Examples;

// Scoped to one request. Only the configured authentication handler establishes
// trust; decoding an arbitrary JWT yourself would not establish identity.
public sealed class HttpCurrentActor(IHttpContextAccessor accessor) : ICurrentActor
{
    public BorrowerId? BorrowerId => ReadBorrower(accessor.HttpContext?.User);

    public static BorrowerId? ReadBorrower(ClaimsPrincipal? user)
    {
        if (user?.Identity?.IsAuthenticated != true) return null;
        var claims = user.FindAll("borrower_id").ToArray();
        return claims.Length == 1
            && Guid.TryParse(claims[0].Value, out var id) && id != Guid.Empty
            ? new BorrowerId(id) : null;
    }
}

using ClearLend.Application.Examples;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;

namespace ClearLend.Api.Examples;

public static class ApiFailures
{
    public static IResult From(AppFailure failure, HttpContext http)
    {
        // Let the configured bearer handler issue the mandatory challenge.
        if (failure.Kind == FailureKind.Unauthenticated) return Results.Challenge();
        var (status, title) = failure switch
        {
            { Kind: FailureKind.Unauthenticated } => (401, "Authentication required"),
            { Kind: FailureKind.Invalid } => (400, "Invalid request"),
            { Kind: FailureKind.Ineligible } => (403, "Action not permitted"),
            { Kind: FailureKind.NotFound } => (404, "Draft not found"),
            { Code: "draft.stale" } => (412, "Draft has changed"),
            { Kind: FailureKind.Conflict } => (409, "Draft state conflict"),
            _ => (500, "Unexpected error")
        };

        // Detail is a curated application message, never an exception body.
        var problem = new ProblemDetails
        {
            Type = "about:blank",
            Title = title,
            Status = status,
            Detail = status == 500 ? null : failure.Message,
            Instance = http.Request.Path
        };
        problem.Extensions["code"] = failure.Code;
        problem.Extensions["traceId"] = http.TraceIdentifier;
        return Results.Problem(problem);
    }

    public static IResult MissingIfMatch(HttpContext http)
        => Problem(http, 428, "precondition.required",
            "Send the ETag from the latest draft as If-Match.");

    public static IResult InvalidIfMatch(HttpContext http)
        => Problem(http, 400, "precondition.invalid",
            "If-Match must contain one strong draft ETag.");

    private static IResult Problem(HttpContext http, int status,
        string code, string message)
    {
        var problem = new ProblemDetails
        {
            Type = "about:blank",
            Title = status == 428 ? "Precondition required" : "Invalid precondition",
            Status = status,
            Detail = message,
            Instance = http.Request.Path
        };
        problem.Extensions["code"] = code;
        problem.Extensions["traceId"] = http.TraceIdentifier;
        return Results.Problem(problem);
    }
}

using Microsoft.Extensions.Primitives;

namespace ClearLend.Api.Examples;

// A strong ETag wraps the opaque Base64 storage version. A future provider
// can change its bytes while clients still treat this value as an opaque tag.
public static class DraftEtags
{
    public static string Write(string version) => string.Concat((char)34, version, (char)34);

    public static bool TryRead(StringValues header, out string version)
    {
        version = string.Empty;
        if (header.Count != 1) return false;
        var value = header[0];
        if (value is null || value.Length is < 3 or > 174
            || value[0] != '"' || value[^1] != '"') return false;

        var candidate = value[1..^1];
        Span<byte> decoded = stackalloc byte[128];
        if (!Convert.TryFromBase64String(candidate, decoded, out var bytesWritten)
            || bytesWritten == 0) return false;
        if (Convert.ToBase64String(decoded[..bytesWritten]) != candidate) return false;
        version = candidate;
        return true;
    }
}

GET /api/v1/applications/11111111-1111-4111-8111-111111111111
Authorization: Bearer <access-token>

HTTP/1.1 200 OK
ETag: "AAAAAAAAAAE="
Cache-Control: no-store
Content-Type: application/json

{"id":"11111111-1111-4111-8111-111111111111","requestedAmount":25000,
 "currency":"GBP","status":"Draft","updatedAt":"2026-10-08T09:00:00Z"}

PATCH /api/v1/applications/11111111-1111-4111-8111-111111111111
Authorization: Bearer <access-token>
Content-Type: application/json
If-Match: "AAAAAAAAAAE="

{"requestedAmount":30000,"currency":"GBP"}

HTTP/1.1 204 No Content
ETag: "AAAAAAAAAAI="
Cache-Control: no-store

# A later edit with the old tag receives 412, not a silent overwrite.

using ClearLend.Application.Examples;
using ClearLend.Contracts.Examples;
using ClearLend.Domain.Examples;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Routing;

namespace ClearLend.Api.Examples;

public static class DraftEndpoints
{
    public static RouteGroupBuilder MapDraftEndpoints(this IEndpointRouteBuilder routes)
    {
        var group = routes.MapGroup("/api/v1/applications")
            .WithTags("Applications")
            .RequireAuthorization()
            .RequireRateLimiting("borrower");

        // Draft data is private; browsers and shared caches must not retain it.
        group.AddEndpointFilter(async (context, next) =>
        {
            context.HttpContext.Response.Headers.CacheControl = "no-store";
            return await next(context);
        });

        group.MapPost("/drafts", Create)
            .WithName("CreateDraft")
            .RequireAuthorization("BorrowerWrite")
            .Produces<CreatedDraftResponse>(201)
            .ProducesProblem(400).ProducesProblem(401).ProducesProblem(403)
            .ProducesProblem(429);
        group.MapGet("/{id:guid}", Get)
            .WithName("GetDraft")
            .RequireAuthorization("BorrowerRead")
            .Produces<DraftResponse>(200)
            .ProducesProblem(400).ProducesProblem(401).ProducesProblem(403)
            .ProducesProblem(404).ProducesProblem(429);
        group.MapPatch("/{id:guid}", ChangeAmount)
            .WithName("ChangeDraftAmount")
            .RequireAuthorization("BorrowerWrite")
            .Produces(204)
            .ProducesProblem(400).ProducesProblem(401).ProducesProblem(403).ProducesProblem(404)
            .ProducesProblem(409).ProducesProblem(412).ProducesProblem(428)
            .ProducesProblem(429);
        return group;
    }

    private static async Task<IResult> Create(CreateDraftRequest request,
        CreateDraftHandler handler, HttpContext http, CancellationToken ct)
    {
        var result = await handler.Handle(new CreateDraftCommand(
            request.RequestedAmount, request.Currency), ct);
        if (!result.Succeeded) return ApiFailures.From(result.Failure!, http);

        var created = result.Value!;
        http.Response.Headers.ETag = DraftEtags.Write(created.Version);
        return TypedResults.Created($"/api/v1/applications/{created.Id.Value}",
            new CreatedDraftResponse(created.Id.Value));
    }

    private static async Task<IResult> Get(Guid id, GetDraftHandler handler,
        HttpContext http, CancellationToken ct)
    {
        var result = await handler.Handle(
            new GetDraftQuery(new LoanApplicationId(id)), ct);
        if (!result.Succeeded) return ApiFailures.From(result.Failure!, http);

        var draft = result.Value!;
        http.Response.Headers.ETag = DraftEtags.Write(draft.Version);
        return TypedResults.Ok(new DraftResponse(draft.Id.Value,
            draft.RequestedAmount, draft.Currency, draft.Status, draft.UpdatedAt));
    }

    private static async Task<IResult> ChangeAmount(Guid id,
        ChangeDraftAmountRequest request, ChangeDraftAmountHandler handler,
        HttpContext http, CancellationToken ct)
    {
        if (!http.Request.Headers.TryGetValue("If-Match", out var header))
            return ApiFailures.MissingIfMatch(http);
        if (!DraftEtags.TryRead(header, out var version))
            return ApiFailures.InvalidIfMatch(http);

        var result = await handler.Handle(new ChangeDraftAmountCommand(
            new LoanApplicationId(id), request.RequestedAmount,
            request.Currency, version), ct);
        if (!result.Succeeded) return ApiFailures.From(result.Failure!, http);

        http.Response.Headers.ETag = DraftEtags.Write(result.Value!.Version);
        return TypedResults.NoContent();
    }
}

using System.Globalization;
using System.Threading.RateLimiting;
using ClearLend.Api.Examples;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Tokens;
using Microsoft.AspNetCore.Authorization;
using ClearLend.Application.Examples;

var builder = WebApplication.CreateBuilder(args);
var authority = builder.Configuration["Authentication:Authority"]
    ?? throw new InvalidOperationException("Authentication authority is required.");
var audience = builder.Configuration["Authentication:Audience"]
    ?? throw new InvalidOperationException("API audience is required.");
var origins = builder.Configuration.GetSection("Web:AllowedOrigins").Get<string[]>()
    ?? throw new InvalidOperationException("Allowed browser origins are required.");
if (origins.Length == 0) throw new InvalidOperationException("Set an allowed origin.");

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = authority;      // Trusted issuer and signing keys.
        options.Audience = audience;        // Token must target this API.
        options.RequireHttpsMetadata = true;
        options.MapInboundClaims = false; // Keep sub and scope names unchanged.
        options.IncludeErrorDetails = false;
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true, ValidateAudience = true,
            ValidateLifetime = true, ValidateIssuerSigningKey = true
        };
    });
builder.Services.AddAuthorizationBuilder()
    .SetFallbackPolicy(new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build())
    .AddPolicy("BorrowerRead", policy => policy.RequireAuthenticatedUser()
        .RequireAssertion(context => HttpCurrentActor.ReadBorrower(context.User) is not null)
        .RequireAssertion(context => context.User.FindAll("scope")
            .SelectMany(c => c.Value.Split(' ', StringSplitOptions.RemoveEmptyEntries))
            .Contains("applications.read")))
    .AddPolicy("BorrowerWrite", policy => policy.RequireAuthenticatedUser()
        .RequireAssertion(context => HttpCurrentActor.ReadBorrower(context.User) is not null)
        .RequireAssertion(context => context.User.FindAll("scope")
            .SelectMany(c => c.Value.Split(' ', StringSplitOptions.RemoveEmptyEntries))
            .Contains("applications.write")));

builder.Services.AddCors(options => options.AddPolicy("ClearLendWeb", policy =>
    policy.WithOrigins(origins)
        .WithMethods("GET", "POST", "PATCH")
        .WithHeaders("Authorization", "Content-Type", "If-Match")
        .WithExposedHeaders("ETag", "Location", "Retry-After")));
builder.Services.AddProblemDetails(options => options.CustomizeProblemDetails = context =>
    context.ProblemDetails.Extensions["traceId"] = context.HttpContext.TraceIdentifier);
builder.Services.AddValidation();
builder.Services.AddOpenApi();
builder.Services.AddHttpContextAccessor();
builder.Services.AddScoped<ICurrentActor, HttpCurrentActor>();
builder.Services.AddScoped<CreateDraftHandler>();
builder.Services.AddScoped<ChangeDraftAmountHandler>();
builder.Services.AddScoped<GetDraftHandler>();
builder.Services.AddSingleton(TimeProvider.System);
builder.WebHost.ConfigureKestrel(options => options.Limits.MaxRequestBodySize = 16 * 1024);

builder.Services.AddRateLimiter(options =>
{
    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
    options.GlobalLimiter = PartitionedRateLimiter.Create<HttpContext, string>(http =>
        RateLimitPartition.GetFixedWindowLimiter(
            "edge:" + (http.Connection.RemoteIpAddress?.ToString() ?? "unknown"),
            _ => new FixedWindowRateLimiterOptions
            {
                PermitLimit = 120, Window = TimeSpan.FromMinutes(1),
                QueueLimit = 0, AutoReplenishment = true
            }));
    options.AddPolicy("borrower", http => RateLimitPartition.GetTokenBucketLimiter(
        "actor:" + (HttpCurrentActor.ReadBorrower(http.User)?.Value.ToString()
            ?? http.Connection.RemoteIpAddress?.ToString() ?? "unknown"),
        _ => new TokenBucketRateLimiterOptions
        {
            TokenLimit = 30, TokensPerPeriod = 30,
            ReplenishmentPeriod = TimeSpan.FromMinutes(1),
            QueueLimit = 0, AutoReplenishment = true
        }));
    options.OnRejected = async (context, _) =>
    {
        var http = context.HttpContext;
        http.Response.StatusCode = StatusCodes.Status429TooManyRequests;
        if (context.Lease.TryGetMetadata(MetadataName.RetryAfter, out var delay))
            http.Response.Headers.RetryAfter = Math.Ceiling(delay.TotalSeconds)
                .ToString(CultureInfo.InvariantCulture);
        await Results.Problem(statusCode: 429, title: "Too many requests",
            type: "about:blank",
            extensions: new Dictionary<string, object?>
            { ["code"] = "request.rate_limited", ["traceId"] = http.TraceIdentifier })
            .ExecuteAsync(http);
    };
});

// Design excerpt: register IDraftWriter, IDraftReader, IBorrowerEligibility
// and ILoanApplicationIds before running the real host in Step 2/5.
var app = builder.Build();
app.UseExceptionHandler();
app.UseStatusCodePages(); // Problem Details for otherwise empty error responses.
app.Use(async (http, next) =>
{
    if (http.Request.Path.StartsWithSegments("/api"))
        http.Response.Headers.CacheControl = "no-store";
    await next(http);
});
app.UseHttpsRedirection();
app.UseRouting();
app.UseCors("ClearLendWeb");
app.UseAuthentication();
app.UseRateLimiter();
app.UseAuthorization();
if (app.Environment.IsDevelopment()) app.MapOpenApi().AllowAnonymous();
app.MapDraftEndpoints();
app.Run();

using NetArchTest.Rules;

namespace ClearLend.ArchitectureTests;

public sealed class DependencyTests
{
    private static readonly Assembly Domain = typeof(LoanApplication).Assembly;
    private static readonly Assembly Application = typeof(CreateDraftHandler).Assembly;

    [Fact]
    public void Domain_does_not_depend_on_outer_layers()
    {
        var result = Types.InAssembly(Domain)
            .ShouldNot()
            .HaveDependencyOnAny(
                "ClearLend.Application",
                "ClearLend.Infrastructure",
                "ClearLend.Api",
                "Microsoft.EntityFrameworkCore")
            .GetResult();

        Assert.True(result.IsSuccessful,
            string.Join(Environment.NewLine,
                result.FailingTypeNames ?? Array.Empty<string>()));
    }

    [Fact]
    public void Application_does_not_depend_on_technical_adapters()
    {
        var result = Types.InAssembly(Application)
            .ShouldNot()
            .HaveDependencyOnAny(
                "ClearLend.Infrastructure",
                "ClearLend.Api",
                "Microsoft.EntityFrameworkCore")
            .GetResult();

        Assert.True(result.IsSuccessful);
    }
}

// SQL Server integration test: two independent units of work hold version A.
var id = await fixture.CreateDraftAsync(borrowerA, 25_000m, "GBP");

await using var firstScope = fixture.Services.CreateAsyncScope();
await using var secondScope = fixture.Services.CreateAsyncScope();
var first = firstScope.ServiceProvider.GetRequiredService<IDraftWriter>();
var second = secondScope.ServiceProvider.GetRequiredService<IDraftWriter>();

var a = await first.LoadOwnedAsync(id, borrowerA, ct);
var b = await second.LoadOwnedAsync(id, borrowerA, ct);
Assert.Equal(a!.Version, b!.Version);

a.Aggregate.ChangeRequestedAmount(Money.Create(30_000m, "GBP"), now);
b.Aggregate.ChangeRequestedAmount(Money.Create(35_000m, "GBP"), now);

var firstSave = await first.SaveAsync(a.Aggregate, borrowerA, a.Version, ct);
var secondSave = await second.SaveAsync(b.Aggregate, borrowerA, b.Version, ct);

Assert.True(firstSave.Succeeded);
Assert.Equal(SaveOutcome.Conflict, secondSave.Outcome);
Assert.Equal(30_000m, (await fixture.ReadDraftAsync(id, borrowerA)).RequestedAmount);

public sealed class DraftContractTests(ClearLendApiFactory factory)
    : IClassFixture<ClearLendApiFactory>
{
    [Fact]
    public async Task Another_borrowers_draft_looks_missing()
    {
        var id = await factory.SeedDraftAsync(Borrowers.A, 25_000m, "GBP");
        using var client = factory.CreateBorrowerClient(Borrowers.B,
            scopes: ["applications.read", "applications.write"]);

        var response = await client.GetAsync($"/api/v1/applications/{id}");
        var problem = await response.Content.ReadFromJsonAsync<ProblemDetails>();

        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
        Assert.Equal("draft.not_found", problem!.Extensions["code"]?.ToString());
        Assert.Equal("no-store", response.Headers.CacheControl?.ToString());
    }

    [Fact]
    public async Task Stale_edit_returns_precondition_failed()
    {
        using var client = factory.CreateBorrowerClient(Borrowers.A,
            scopes: ["applications.read", "applications.write"]);
        var created = await factory.CreateDraftThroughApiAsync(client);
        var staleTag = created.ETag;

        await factory.ChangeAmountThroughApiAsync(client, created.Id, 30_000m, staleTag);
        var stale = await factory.ChangeAmountThroughApiAsync(
            client, created.Id, 35_000m, staleTag);

        Assert.Equal(HttpStatusCode.PreconditionFailed, stale.StatusCode);
    }
}

builder.Services.AddOpenTelemetry()
    .ConfigureResource(resource => resource.AddService("ClearLend.Api"))
    .WithTracing(tracing => tracing
        .AddAspNetCoreInstrumentation(options =>
        {
            options.RecordException = true;
            options.Filter = http => !http.Request.Path.StartsWithSegments("/health/live");
        })
        .AddHttpClientInstrumentation()
        .AddEntityFrameworkCoreInstrumentation()
        .AddOtlpExporter())
    .WithMetrics(metrics => metrics
        .AddAspNetCoreInstrumentation()
        .AddHttpClientInstrumentation()
        .AddRuntimeInstrumentation()
        .AddOtlpExporter());

// Business-safe dimensions: no borrower ID, application ID, token or evidence.
private static readonly Counter<long> DraftOutcomes =
    Meter.CreateCounter<long>("clearlend.draft.outcomes");

DraftOutcomes.Add(1,
    new("operation", "change_amount"),
    new("outcome", result.Code));

name: backend-evidence

on:
  pull_request:
  push:
    branches: [main]

jobs:
  verify:
    runs-on: ubuntu-latest
    services:
      sql:
        image: mcr.microsoft.com/mssql/server:2022-latest
        env:
          ACCEPT_EULA: Y
          MSSQL_SA_PASSWORD: ${{ secrets.TEST_SQL_PASSWORD }}
        ports: [1433:1433]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 10.0.x
      - run: dotnet restore --locked-mode
      - run: dotnet build --no-restore --configuration Release
      - run: dotnet test --no-build --configuration Release
          --collect:"XPlat Code Coverage"
      - run: dotnet publish src/ClearLend.Api --no-build
          --configuration Release --output artifacts/api