@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/116-runtime-contract-capture.js

@@ -0,0 +1,274 @@
+/**
+ * Runtime Contract Capture (Agent #116) — the runtime counterpart to #113.
+ *
+ * #113 reads source statically and infers the response shape a handler
+ * *builds*. This agent probes a RUNNING server, captures the *actual* JSON
+ * responses, and diffs them against the OpenAPI/Swagger contract. A live
+ * response is ground truth — it sees fields a serializer adds, fields a
+ * `select *` leaks, and shape changes a static read would miss.
+ *
+ * Strictly opt-in (`config.runtimeContract.enabled`, default false) so a
+ * normal/CI run never touches the network. Only **GET** routes with no path
+ * parameters are probed (safe, deterministic, non-mutating). The HTTP client
+ * is injectable (`agent._fetch`) so tests run without a real server.
+ *
+ * Findings (per route):
+ *   - 116-runtime-undeclared-field      medium  infra-issue       live response
+ *       returns a field the contract never declares.
+ *   - 116-runtime-undeclared-sensitive  high    code-bug-security undeclared field
+ *       looks sensitive (password / token / secret …) — live data exposure.
+ *   - 116-runtime-missing-required      medium  infra-issue       contract requires
+ *       a field the live response omits (single-schema paths only).
+ *   - 116-runtime-unexpected-status     medium  infra-issue       documented route
+ *       answered with a non-2xx status.
+ *   - 116-runtime-non-json              low     infra-issue       documented JSON
+ *       route answered with a non-JSON body.
+ *   - 116-disabled / 116-no-spec / 116-unreachable / 116-clean / 116-summary  info
+ *
+ * Persists `evidence/runtime-contract-capture.json`. Sequential (owns
+ * network I/O); never run in parallel.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { findSpecFile, normalisePath } from './95-contract-drift.js';
+import { parseSpecDocument, declaredShapesByPath, SENSITIVE_RE, } from './113-response-contract-auditor.js';
+function defaultFetch() {
+    const f = globalThis.fetch;
+    return typeof f === 'function' ? f.bind(globalThis) : null;
+}
+export function auditRuntimeContract(doc, captures) {
+    const shapes = declaredShapesByPath(doc);
+    const drift = [];
+    if (shapes.size === 0)
+        return drift;
+    const seen = new Set();
+    const add = (d) => {
+        const id = `${d.kind}:${d.path}:${d.field}`;
+        if (seen.has(id))
+            return;
+        seen.add(id);
+        drift.push(d);
+    };
+    for (const cap of captures) {
+        const declared = shapes.get(normalisePath(cap.path));
+        if (!declared)
+            continue; // route not in the contract → #95's concern, not ours
+        const is2xx = cap.status >= 200 && cap.status < 300;
+        if (!is2xx) {
+            add({ kind: 'runtime-unexpected-status', path: cap.path, field: String(cap.status), status: cap.status });
+            continue;
+        }
+        if (!cap.isJson) {
+            add({ kind: 'runtime-non-json', path: cap.path, field: '(body)', status: cap.status });
+            continue;
+        }
+        if (declared.open || declared.properties.size === 0 || cap.bodyKeys === null)
+            continue;
+        for (const key of cap.bodyKeys) {
+            if (declared.properties.has(key))
+                continue;
+            add({
+                kind: SENSITIVE_RE.test(key) ? 'runtime-undeclared-sensitive' : 'runtime-undeclared-field',
+                path: cap.path,
+                field: key,
+                status: cap.status,
+            });
+        }
+        if (declared.requiredSingle) {
+            for (const req of declared.requiredSingle) {
+                if (!cap.bodyKeys.includes(req)) {
+                    add({ kind: 'runtime-missing-required', path: cap.path, field: req, status: cap.status });
+                }
+            }
+        }
+    }
+    return drift;
+}
+/** Pull top-level object keys out of a raw response body string. */
+export function jsonKeysOf(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return { isJson: false, bodyKeys: null };
+    }
+    if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+        return { isJson: true, bodyKeys: Object.keys(parsed) };
+    }
+    // Valid JSON, but not an object (array / scalar) → JSON, no top-level keys.
+    return { isJson: true, bodyKeys: null };
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Agent
+// ─────────────────────────────────────────────────────────────────────────
+const KIND_META = {
+    'runtime-undeclared-sensitive': { severity: 'high', type: 'code-bug-security' },
+    'runtime-undeclared-field': { severity: 'medium', type: 'infra-issue' },
+    'runtime-missing-required': { severity: 'medium', type: 'infra-issue' },
+    'runtime-unexpected-status': { severity: 'medium', type: 'infra-issue' },
+    'runtime-non-json': { severity: 'low', type: 'infra-issue' },
+};
+function describe(d) {
+    switch (d.kind) {
+        case 'runtime-undeclared-sensitive':
+            return `Live response for ${d.path} returns sensitive-looking field "${d.field}" not declared in the contract — real data exposure. Strip it or document it intentionally.`;
+        case 'runtime-undeclared-field':
+            return `Live response for ${d.path} returns field "${d.field}" not declared in the response schema — runtime contract drift.`;
+        case 'runtime-missing-required':
+            return `Contract marks "${d.field}" required for ${d.path} but the live response omits it — breaks clients.`;
+        case 'runtime-unexpected-status':
+            return `Documented route ${d.path} answered with status ${d.status} (expected 2xx).`;
+        case 'runtime-non-json':
+            return `Documented JSON route ${d.path} answered with a non-JSON body (status ${d.status}).`;
+    }
+}
+export class RuntimeContractCaptureAgent extends BaseAgent {
+    agentId = 116;
+    agentName = 'Runtime Contract Capture';
+    /** Injectable HTTP client (defaults to global fetch). Overridden in tests. */
+    _fetch = defaultFetch();
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    resolveBaseUrl() {
+        const rc = this.config.runtimeContract;
+        if (rc?.baseUrl)
+            return rc.baseUrl.replace(/\/$/, '');
+        const env = this.config.environments?.[this.phase];
+        return env?.baseUrl ? env.baseUrl.replace(/\/$/, '') : null;
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const rc = this.config.runtimeContract;
+        if (!rc?.enabled) {
+            findings.push(this.info('disabled', 'Runtime contract capture is opt-in — set `runtimeContract.enabled: true` to probe a running server.'));
+            return findings;
+        }
+        const specFile = findSpecFile(projectRoot);
+        if (!specFile) {
+            findings.push(this.info('no-spec', 'No OpenAPI/Swagger spec found — runtime capture needs a contract to diff live responses against.'));
+            return findings;
+        }
+        let doc;
+        try {
+            doc = parseSpecDocument(fs.readFileSync(specFile, 'utf-8'), specFile);
+        }
+        catch (err) {
+            findings.push(this.info('spec-unreadable', `Spec ${specFile} could not be parsed: ${err instanceof Error ? err.message : String(err)}`, 'high'));
+            return findings;
+        }
+        const baseUrl = this.resolveBaseUrl();
+        if (!baseUrl) {
+            findings.push(this.info('no-base-url', 'No baseUrl to probe — set `runtimeContract.baseUrl` or `environments[phase].baseUrl`.'));
+            return findings;
+        }
+        if (!this._fetch) {
+            findings.push(this.info('no-fetch', 'No fetch implementation available in this runtime — cannot capture live responses.', 'high'));
+            return findings;
+        }
+        // GET routes with no path parameters are the only safe, deterministic probes.
+        let routes = [];
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            routes = map.routes
+                .filter((r) => r.framework !== 'unknown')
+                .filter((r) => r.method === 'GET' || r.method === 'ALL')
+                .filter((r) => !/[:{}]/.test(r.path))
+                .map((r) => ({ method: 'GET', path: r.path }));
+        }
+        catch {
+            routes = [];
+        }
+        // De-dup by path.
+        const uniquePaths = [...new Set(routes.map((r) => r.path))];
+        if (uniquePaths.length === 0) {
+            findings.push(this.info('no-routes', 'No parameter-free GET routes found in the connection map to probe.'));
+            return findings;
+        }
+        const captures = [];
+        let reachedAny = false;
+        const timeoutMs = rc.timeoutMs ?? 5000;
+        for (const routePath of uniquePaths) {
+            const cap = await this.probe(baseUrl, routePath, timeoutMs);
+            if (cap) {
+                reachedAny = true;
+                captures.push(cap);
+            }
+        }
+        if (!reachedAny) {
+            findings.push(this.info('unreachable', `Could not reach any route at ${baseUrl} — is the server running? Skipped runtime capture.`));
+            this.persistAudit(baseUrl, captures, []);
+            return findings;
+        }
+        const drift = auditRuntimeContract(doc, captures);
+        this.persistAudit(baseUrl, captures, drift);
+        if (drift.length === 0) {
+            findings.push(this.info('clean', `Probed ${captures.length} route(s) at ${baseUrl} — live responses match the contract.`));
+            return findings;
+        }
+        for (const d of drift.slice(0, 100)) {
+            const meta = KIND_META[d.kind];
+            findings.push({
+                id: `${this.agentId}-${d.kind}-${d.path.replace(/[^\w]/g, '_')}-${d.field.replace(/[^\w]/g, '_')}`,
+                type: meta.type,
+                severity: meta.severity,
+                agentId: this.agentId,
+                module: 'runtime-contract-capture',
+                description: describe(d),
+            });
+        }
+        findings.push(this.info('summary', `Runtime capture: ${captures.length} route(s) probed at ${baseUrl}; ${drift.length} drift(s).`));
+        return findings;
+    }
+    async probe(baseUrl, routePath, timeoutMs) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const res = await this._fetch(`${baseUrl}${routePath}`, { signal: controller.signal });
+            const contentType = res.headers.get('content-type') ?? '';
+            const body = await res.text();
+            const looksJson = /json/i.test(contentType) || /^\s*[[{]/.test(body);
+            const { isJson, bodyKeys } = looksJson ? jsonKeysOf(body) : { isJson: false, bodyKeys: null };
+            return { path: routePath, method: 'GET', status: res.status, isJson, bodyKeys };
+        }
+        catch {
+            return null; // unreachable / aborted — treated as "not reached"
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    info(suffix, description, severity = 'info') {
+        return {
+            id: `${this.agentId}-${suffix}`,
+            type: 'infra-issue',
+            severity,
+            agentId: this.agentId,
+            module: 'runtime-contract-capture',
+            description,
+        };
+    }
+    persistAudit(baseUrl, captures, drift) {
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'runtime-contract-capture.json'), JSON.stringify({ version: 1, generatedAt: new Date().toISOString(), baseUrl, captures, drift }, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/runtime-contract-capture.json',
+                description: `Runtime contract capture: ${captures.length} route(s), ${drift.length} drift(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=116-runtime-contract-capture.js.map

package/dist/agents/116-runtime-contract-capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"116-runtime-contract-capture.js","sourceRoot":"","sources":["../../agents/116-runtime-contract-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,GAEb,MAAM,iCAAiC,CAAC;AAezC,SAAS,YAAY;IACnB,MAAM,CAAC,GAAI,UAAuC,CAAC,KAAK,CAAC;IACzD,OAAO,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AA8BD,MAAM,UAAU,oBAAoB,CAAC,GAAS,EAAE,QAAwB;IACtE,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAe,EAAQ,EAAE;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QACzB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,sDAAsD;QAE/E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1G,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QAEvF,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC/B,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC3C,GAAG,CAAC;gBACF,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,0BAA0B;gBAC1F,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,GAAG,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5F,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,4EAA4E;IAC5E,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,QAAQ;AACR,4EAA4E;AAE5E,MAAM,SAAS,GAAuF;IACpG,8BAA8B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC/E,0BAA0B,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE;IACvE,0BAA0B,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE;IACvE,2BAA2B,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE;IACxE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE;CAC7D,CAAC;AAEF,SAAS,QAAQ,CAAC,CAAe;IAC/B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,8BAA8B;YACjC,OAAO,qBAAqB,CAAC,CAAC,IAAI,qCAAqC,CAAC,CAAC,KAAK,6FAA6F,CAAC;QAC9K,KAAK,0BAA0B;YAC7B,OAAO,qBAAqB,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,KAAK,iEAAiE,CAAC;QAChI,KAAK,0BAA0B;YAC7B,OAAO,mBAAmB,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,IAAI,mDAAmD,CAAC;QAC/G,KAAK,2BAA2B;YAC9B,OAAO,oBAAoB,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC,MAAM,kBAAkB,CAAC;QACvF,KAAK,kBAAkB;YACrB,OAAO,yBAAyB,CAAC,CAAC,IAAI,0CAA0C,CAAC,CAAC,MAAM,IAAI,CAAC;IACjG,CAAC;AACH,CAAC;AAED,MAAM,OAAO,2BAA4B,SAAQ,SAAS;IAC/C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,0BAA0B,CAAC;IAEhD,8EAA8E;IAC9E,MAAM,GAAwB,YAAY,EAAE,CAAC;IAEnC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QACvC,IAAI,EAAE,EAAE,OAAO;YAAE,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7D,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QAEvC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,qGAAqG,CAAC,CAAC,CAAC;YAC5I,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kGAAkG,CAAC,CAAC,CAAC;YACxI,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,GAAS,CAAC;QACd,IAAI,CAAC;YACH,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,QAAQ,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YACjJ,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,uFAAuF,CAAC,CAAC,CAAC;YACjI,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,oFAAoF,EAAE,MAAM,CAAC,CAAC,CAAC;YACnI,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,8EAA8E;QAC9E,IAAI,MAAM,GAA4C,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,MAAM,GAAG,GAAG,CAAC,MAAM;iBAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;iBACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;iBACvD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;iBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;QACD,kBAAkB;QAClB,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE5D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,oEAAoE,CAAC,CAAC,CAAC;YAC5G,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,IAAI,IAAI,CAAC;QAEvC,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YAC5D,IAAI,GAAG,EAAE,CAAC;gBACR,UAAU,GAAG,IAAI,CAAC;gBAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,gCAAgC,OAAO,oDAAoD,CAAC,CAAC,CAAC;YACrI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACzC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,QAAQ,CAAC,MAAM,gBAAgB,OAAO,uCAAuC,CAAC,CAAC,CAAC;YAC3H,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAClG,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,0BAA0B;gBAClC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;aACzB,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,QAAQ,CAAC,MAAM,uBAAuB,OAAO,KAAK,KAAK,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;QACpI,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,SAAiB,EAAE,SAAiB;QACvE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAO,CAAC,GAAG,OAAO,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACxF,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC9F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,mDAAmD;QAClE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,MAAc,EAAE,WAAmB,EAAE,WAAgC,MAAM;QACtF,OAAO;YACL,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE;YAC/B,IAAI,EAAE,aAAa;YACnB,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,0BAA0B;YAClC,WAAW;SACZ,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,OAAe,EAAE,QAAwB,EAAE,KAAqB;QACnF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,+BAA+B,CAAC,EACvD,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EACxG,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,wCAAwC;gBAC9C,WAAW,EAAE,6BAA6B,QAAQ,CAAC,MAAM,cAAc,KAAK,CAAC,MAAM,WAAW;aAC/F,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/117-aria-rule-engine.d.ts

@@ -0,0 +1,52 @@
+/**
+ * ARIA Rule Engine (Agent #117) — spec-driven WAI-ARIA conformance for
+ * JSX/TSX. The deep complement to #114 (which flags the obvious jsx-a11y
+ * issues): #117 validates `role` and `aria-*` usage against embedded
+ * WAI-ARIA 1.2 tables, which #114 deliberately doesn't.
+ *
+ * Rules:
+ *   - invalid-role         medium  role="…" value is not a real ARIA role.
+ *   - abstract-role        medium  role="…" is an ABSTRACT role (roletype,
+ *                                  widget, composite, …) — must not be used
+ *                                  in content.
+ *   - invalid-aria-attr    medium  an `aria-*` attribute that does not exist.
+ *   - invalid-aria-value   medium  a literal `aria-*` value outside the
+ *                                  attribute's allowed set (e.g.
+ *                                  aria-hidden="yes", aria-checked="maybe").
+ *   - required-aria-props  medium  a role missing the aria-* prop(s) the
+ *                                  spec requires (e.g. role="checkbox"
+ *                                  without aria-checked).
+ *   - 117-clean / 117-summary  info
+ *
+ * Only literal values are validated; `aria-*={expr}` and `role={expr}` are
+ * skipped (value unknown statically). Applies to both intrinsic and
+ * component tags (ARIA is valid on either). Reuses #114's `{…}`-aware tag
+ * reader.
+ *
+ * Persists `evidence/aria-audit.json`. Read-only, parallel-safe, static.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+interface ParsedAttr {
+    value: string | null;
+    isExpr: boolean;
+}
+export declare function parseAttributes(attrText: string): Map<string, ParsedAttr>;
+export type AriaRuleKind = 'invalid-role' | 'abstract-role' | 'invalid-aria-attr' | 'invalid-aria-value' | 'required-aria-props';
+export interface AriaHit {
+    rule: AriaRuleKind;
+    element: string;
+    detail: string;
+    line: number;
+    snippet: string;
+}
+export declare function scanAria(content: string): AriaHit[];
+export declare class AriaRuleEngineAgent extends BaseAgent {
+    readonly agentId = 117;
+    readonly agentName = "ARIA Rule Engine";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private persistAudit;
+}
+export {};
+//# sourceMappingURL=117-aria-rule-engine.d.ts.map

package/dist/agents/117-aria-rule-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"117-aria-rule-engine.d.ts","sourceRoot":"","sources":["../../agents/117-aria-rule-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAwHzC,UAAU,UAAU;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAoDzE;AAuBD,MAAM,MAAM,YAAY,GACpB,cAAc,GACd,eAAe,GACf,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAkEnD;AAcD,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,sBAAsB;cAExB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAuE7C,OAAO,CAAC,YAAY;CAkBrB"}