@gate-forge/http-contract 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 UKD
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,73 @@
+# @gate-forge/http-contract
+
+Framework-neutral canonical HTTP contract for Gateforge (ADR 0004): the
+strict `HttpContractFact` schema, typed outcome codes, canonical
+path/method normalization, and the deterministic frontend-call ↔
+server-route join engine.
+
+This package owns **no framework parsing** (detector packs own that) and
+**no classification** (`@gate-forge/core` owns that). Every export is a pure
+function; identical inputs produce byte-identical outputs under any input
+permutation.
+
+## Contract facts
+
+A fact is one discovered HTTP surface, serialized by detector packs as
+GPP/3 resources of kind `http.contract` (evidence-only; never classified
+directly, never a business resource):
+
+```ts
+interface HttpContractFact {
+  schemaVersion: 1;
+  role: 'server-route' | 'frontend-call';
+  method: 'GET'|'HEAD'|'POST'|'PUT'|'PATCH'|'DELETE'|'OPTIONS'|'ANY';
+  normalizedPath: string;   // canonical positional form
+  rawPath: string;          // exactly as written in source
+  framework: string;        // 'fastapi' | 'fetch' | 'axios' | ...
+  handlerSymbol?: string;   // server routes
+  requestSchemaSymbols?: string[];
+  responseSchemaSymbols?: string[];
+  callsites?: string[];     // frontend calls
+  source: { file: string; line: number; col: number };
+}
+```
+
+## Canonical normalization (ADR 0004 D2)
+
+`normalizeHttpPath` strips query/fragment, collapses slashes, converts
+`${expr}` and FastAPI `{name}` / `{name:type}` to `{}`, `{name:path}`
+converters and `*` catch-alls to `{*}`, and canonicalizes absolute URLs
+only for configured same-origin hosts. Parameter names are **never** part
+of an identity. Unresolvable shapes return `HTTP_PATH_DYNAMIC` — never a
+guess.
+
+`normalizeHttpMethod` uppercases concrete verbs and returns `null` for
+dynamic methods (callers must emit `HTTP_METHOD_DYNAMIC`; defaulting to
+`GET` is forbidden).
+
+## Join engine (ADR 0004 D3, phase 3 literal precedence)
+
+`joinFrontendCalls(routes, calls)` implements exactly-one cardinality:
+equal method, equal segment count, position-wise match where a frontend
+`{}` matches any single route segment and a route `{*}` matches one or
+more trailing segments.
+
+Candidates are then partitioned by match quality before the exactly-one
+check (**literal precedence**): a match is *literal* when it consumed no
+slot generality — every position is exact segment equality, counting a
+route `{}` mirrored by the call's own `{}` — and *parameter* otherwise
+(route `{}` absorbing a call literal, a call `{}` relaxed onto a route
+literal, or any `{*}` absorption; a wildcard match is never literal). If
+any literal matches exist they are THE candidates; parameter-only matches
+are considered only when zero literal matches exist.
+
+Why: routers resolve literal path segments before parameterized ones at
+runtime (FastAPI included), so `/messages/search` never reaches
+`/messages/{}` with `id="search"`. The static join mirrors that runtime
+truth: a template call `/messages/${id}` joins `/messages/{}` despite
+literal siblings, and a literal call joins the literal route.
+
+Zero matches → `FRONTEND_ROUTE_UNWIRED`; more than one distinct surviving
+candidate (in either tier) → `FRONTEND_ROUTE_AMBIGUOUS`. There is no
+scoring and no first-match-wins beyond the documented partition. Duplicate
+identical routes collapse into one endpoint carrying every source.

package/dist/codes.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Typed outcome codes for the HTTP contract compiler (ADR 0004 D4).
+ *
+ * These codes are stable free-form strings, matching the existing
+ * unresolved/findings convention (`no_tablename_source`,
+ * `inherited_tablename_unresolved`, ...). Detectors emit them as
+ * `UnresolvedReason.code` / `Finding.code`; the verdict engine uses
+ * `HTTP_OBSERVATION_UNTRUSTED` as a verdict reason. They are deliberately
+ * NOT a closed core enum: adding a code is additive and versioned by the
+ * detector that emits it.
+ */
+/** A path expression the detector cannot resolve to positional shape. */
+export declare const HTTP_PATH_DYNAMIC = "HTTP_PATH_DYNAMIC";
+/** A method expression the detector cannot resolve to a concrete verb. */
+export declare const HTTP_METHOD_DYNAMIC = "HTTP_METHOD_DYNAMIC";
+/** A FastAPI router prefix/include prefix that is not a provable literal. */
+export declare const FASTAPI_PREFIX_UNRESOLVED = "FASTAPI_PREFIX_UNRESOLVED";
+/** A frontend call whose target (host/URL) cannot be resolved statically. */
+export declare const FRONTEND_CALL_TARGET_UNRESOLVED = "FRONTEND_CALL_TARGET_UNRESOLVED";
+/** A frontend call with no matching backend route. */
+export declare const FRONTEND_ROUTE_UNWIRED = "FRONTEND_ROUTE_UNWIRED";
+/**
+ * A frontend call matching more than one distinct backend route within the
+ * surviving literal-precedence tier (see `join.ts`): literal matches shadow
+ * parameter matches, and even after that partition the join refuses to
+ * guess between distinct survivors.
+ */
+export declare const FRONTEND_ROUTE_AMBIGUOUS = "FRONTEND_ROUTE_AMBIGUOUS";
+/** An endpoint whose business semantics no positive rule could decide. */
+export declare const ENDPOINT_SEMANTICS_UNRESOLVED = "ENDPOINT_SEMANTICS_UNRESOLVED";
+/** An endpoint that cannot be linked to exactly one business resource. */
+export declare const ENDPOINT_RESOURCE_LINK_UNRESOLVED = "ENDPOINT_RESOURCE_LINK_UNRESOLVED";
+/**
+ * A runtime HTTP observation that cannot be trusted (suite-submitted
+ * network record, missing run binding, wrong provenance).
+ */
+export declare const HTTP_OBSERVATION_UNTRUSTED = "HTTP_OBSERVATION_UNTRUSTED";
+/** Every typed outcome code defined by this package. */
+export declare const HTTP_BLOCK_CODES: readonly ["HTTP_PATH_DYNAMIC", "HTTP_METHOD_DYNAMIC", "FASTAPI_PREFIX_UNRESOLVED", "FRONTEND_CALL_TARGET_UNRESOLVED", "FRONTEND_ROUTE_UNWIRED", "FRONTEND_ROUTE_AMBIGUOUS", "ENDPOINT_SEMANTICS_UNRESOLVED", "ENDPOINT_RESOURCE_LINK_UNRESOLVED", "HTTP_OBSERVATION_UNTRUSTED"];
+export type HttpBlockCode = (typeof HTTP_BLOCK_CODES)[number];
+//# sourceMappingURL=codes.d.ts.map

package/dist/codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../src/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,6EAA6E;AAC7E,eAAO,MAAM,+BAA+B,oCAAoC,CAAC;AAEjF,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E,0EAA0E;AAC1E,eAAO,MAAM,iCAAiC,sCAAsC,CAAC;AAErF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,iRAUnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/codes.js

@@ -0,0 +1,50 @@
+/**
+ * Typed outcome codes for the HTTP contract compiler (ADR 0004 D4).
+ *
+ * These codes are stable free-form strings, matching the existing
+ * unresolved/findings convention (`no_tablename_source`,
+ * `inherited_tablename_unresolved`, ...). Detectors emit them as
+ * `UnresolvedReason.code` / `Finding.code`; the verdict engine uses
+ * `HTTP_OBSERVATION_UNTRUSTED` as a verdict reason. They are deliberately
+ * NOT a closed core enum: adding a code is additive and versioned by the
+ * detector that emits it.
+ */
+/** A path expression the detector cannot resolve to positional shape. */
+export const HTTP_PATH_DYNAMIC = 'HTTP_PATH_DYNAMIC';
+/** A method expression the detector cannot resolve to a concrete verb. */
+export const HTTP_METHOD_DYNAMIC = 'HTTP_METHOD_DYNAMIC';
+/** A FastAPI router prefix/include prefix that is not a provable literal. */
+export const FASTAPI_PREFIX_UNRESOLVED = 'FASTAPI_PREFIX_UNRESOLVED';
+/** A frontend call whose target (host/URL) cannot be resolved statically. */
+export const FRONTEND_CALL_TARGET_UNRESOLVED = 'FRONTEND_CALL_TARGET_UNRESOLVED';
+/** A frontend call with no matching backend route. */
+export const FRONTEND_ROUTE_UNWIRED = 'FRONTEND_ROUTE_UNWIRED';
+/**
+ * A frontend call matching more than one distinct backend route within the
+ * surviving literal-precedence tier (see `join.ts`): literal matches shadow
+ * parameter matches, and even after that partition the join refuses to
+ * guess between distinct survivors.
+ */
+export const FRONTEND_ROUTE_AMBIGUOUS = 'FRONTEND_ROUTE_AMBIGUOUS';
+/** An endpoint whose business semantics no positive rule could decide. */
+export const ENDPOINT_SEMANTICS_UNRESOLVED = 'ENDPOINT_SEMANTICS_UNRESOLVED';
+/** An endpoint that cannot be linked to exactly one business resource. */
+export const ENDPOINT_RESOURCE_LINK_UNRESOLVED = 'ENDPOINT_RESOURCE_LINK_UNRESOLVED';
+/**
+ * A runtime HTTP observation that cannot be trusted (suite-submitted
+ * network record, missing run binding, wrong provenance).
+ */
+export const HTTP_OBSERVATION_UNTRUSTED = 'HTTP_OBSERVATION_UNTRUSTED';
+/** Every typed outcome code defined by this package. */
+export const HTTP_BLOCK_CODES = [
+    HTTP_PATH_DYNAMIC,
+    HTTP_METHOD_DYNAMIC,
+    FASTAPI_PREFIX_UNRESOLVED,
+    FRONTEND_CALL_TARGET_UNRESOLVED,
+    FRONTEND_ROUTE_UNWIRED,
+    FRONTEND_ROUTE_AMBIGUOUS,
+    ENDPOINT_SEMANTICS_UNRESOLVED,
+    ENDPOINT_RESOURCE_LINK_UNRESOLVED,
+    HTTP_OBSERVATION_UNTRUSTED,
+];
+//# sourceMappingURL=codes.js.map

package/dist/codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.js","sourceRoot":"","sources":["../src/codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAErE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AAEjF,sDAAsD;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAE7E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iCAAiC,GAAG,mCAAmC,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AAEvE,wDAAwD;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,iBAAiB;IACjB,mBAAmB;IACnB,yBAAyB;IACzB,+BAA+B;IAC/B,sBAAsB;IACtB,wBAAwB;IACxB,6BAA6B;IAC7B,iCAAiC;IACjC,0BAA0B;CAClB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `@gate-forge/http-contract` — framework-neutral canonical HTTP contract
+ * (ADR 0004): strict fact schemas, typed outcome codes, path/method
+ * normalization, and the deterministic frontend-call/server-route join.
+ *
+ * This package is deliberately narrow: no framework parsing (detectors own
+ * that), no classification (core owns that), no I/O. Everything is a pure
+ * function so identical inputs produce byte-identical outputs.
+ */
+export { FASTAPI_PREFIX_UNRESOLVED, FRONTEND_CALL_TARGET_UNRESOLVED, FRONTEND_ROUTE_AMBIGUOUS, FRONTEND_ROUTE_UNWIRED, ENDPOINT_RESOURCE_LINK_UNRESOLVED, ENDPOINT_SEMANTICS_UNRESOLVED, HTTP_METHOD_DYNAMIC, HTTP_OBSERVATION_UNTRUSTED, HTTP_PATH_DYNAMIC, HTTP_BLOCK_CODES, type HttpBlockCode, } from './codes.js';
+export { HTTP_CONTRACT_SCHEMA_VERSION, HTTP_CONTRACT_KIND, HTTP_ENDPOINT_KIND, HTTP_METHODS, HttpContractFactSchema, HttpContractRoleSchema, HttpContractSchemaVersionField, HttpLocationSchema, HttpMethodSchema, type HttpContractFact, type HttpContractRole, type HttpLocation, type HttpMethod, } from './schema.js';
+export { HTTP_CONTRACT_VERSION, } from './version.js';
+export { HTTP_PARAM_SLOT, HTTP_WILDCARD_SLOT, normalizeHttpMethod, normalizeHttpPath, pathSegments, type NormalizePathDynamic, type NormalizePathOk, type NormalizePathOptions, type NormalizePathResult, } from './normalize.js';
+export { canonicalEndpointIdentity, endpointResourceName, joinFrontendCalls, routeMatchKind, routeMatchesCall, type EndpointIdentity, type JoinBlock, type JoinedEndpoint, type JoinResult, type RouteMatchKind, } from './join.js';
+export { derivePathResourceName } from './linkage.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,wBAAwB,EACxB,sBAAsB,EACtB,iCAAiC,EACjC,6BAA6B,EAC7B,mBAAmB,EACnB,0BAA0B,EAC1B,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,16 @@
+/**
+ * `@gate-forge/http-contract` — framework-neutral canonical HTTP contract
+ * (ADR 0004): strict fact schemas, typed outcome codes, path/method
+ * normalization, and the deterministic frontend-call/server-route join.
+ *
+ * This package is deliberately narrow: no framework parsing (detectors own
+ * that), no classification (core owns that), no I/O. Everything is a pure
+ * function so identical inputs produce byte-identical outputs.
+ */
+export { FASTAPI_PREFIX_UNRESOLVED, FRONTEND_CALL_TARGET_UNRESOLVED, FRONTEND_ROUTE_AMBIGUOUS, FRONTEND_ROUTE_UNWIRED, ENDPOINT_RESOURCE_LINK_UNRESOLVED, ENDPOINT_SEMANTICS_UNRESOLVED, HTTP_METHOD_DYNAMIC, HTTP_OBSERVATION_UNTRUSTED, HTTP_PATH_DYNAMIC, HTTP_BLOCK_CODES, } from './codes.js';
+export { HTTP_CONTRACT_SCHEMA_VERSION, HTTP_CONTRACT_KIND, HTTP_ENDPOINT_KIND, HTTP_METHODS, HttpContractFactSchema, HttpContractRoleSchema, HttpContractSchemaVersionField, HttpLocationSchema, HttpMethodSchema, } from './schema.js';
+export { HTTP_CONTRACT_VERSION, } from './version.js';
+export { HTTP_PARAM_SLOT, HTTP_WILDCARD_SLOT, normalizeHttpMethod, normalizeHttpPath, pathSegments, } from './normalize.js';
+export { canonicalEndpointIdentity, endpointResourceName, joinFrontendCalls, routeMatchKind, routeMatchesCall, } from './join.js';
+export { derivePathResourceName } from './linkage.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,wBAAwB,EACxB,sBAAsB,EACtB,iCAAiC,EACjC,6BAA6B,EAC7B,mBAAmB,EACnB,0BAA0B,EAC1B,iBAAiB,EACjB,gBAAgB,GAEjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,kBAAkB,EAClB,gBAAgB,GAKjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,GAKb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GAMjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC"}

package/dist/join.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Deterministic one-to-one join engine (ADR 0004 D3).
+ *
+ * A frontend consumption exists only when one frontend-call fact joins
+ * exactly one distinct backend route identity: equal uppercase method,
+ * position-wise segment match where a frontend `{}` matches any single
+ * route segment (param or literal) and a trailing route `{*}` matches one
+ * or more trailing call segments.
+ *
+ * LITERAL PRECEDENCE (phase 3 refinement). Positional candidates are
+ * partitioned by match quality before the exactly-one check:
+ *
+ *  - A match is *literal* when it consumed no slot generality: every
+ *    matched position is exact segment equality — literal==literal, or the
+ *    call's own `{}` mirrored by the route's `{}` (the route then declares
+ *    exactly the shape the call already has; nothing is absorbed beyond
+ *    what the call itself carries).
+ *  - A match is *parameter* otherwise: a route `{}` absorbed a call
+ *    literal, a call `{}` was relaxed onto a route literal, or any `{*}`
+ *    absorption happened. A wildcard match is never a literal match.
+ *
+ * If any literal matches exist they are THE candidates; parameter-only
+ * matches are considered only when zero literal matches exist. This
+ * mirrors runtime routing truth: FastAPI — like every major router —
+ * resolves literal path segments before parameterized ones, so a request
+ * to `/messages/search` always hits the literal route and never reaches
+ * `/messages/{}` with id="search". The static join must agree: a
+ * template call `/messages/${id}` joins `/messages/{}` despite literal
+ * siblings, and a literal call `/messages/unread-count` joins only the
+ * literal route.
+ *
+ * Never guess: zero selected candidates and multiple distinct selected
+ * candidates (in either tier) are typed blocks — there is no scoring, no
+ * fuzzy distance, and no first-match-wins beyond the documented partition.
+ *
+ * The result is a pure function of the input facts: identical inputs in
+ * any permutation produce byte-identical output (total order everywhere).
+ */
+import { FRONTEND_ROUTE_AMBIGUOUS, FRONTEND_ROUTE_UNWIRED, HTTP_METHOD_DYNAMIC } from './codes.js';
+import type { HttpContractFact, HttpLocation, HttpMethod } from './schema.js';
+/** Canonical identity of an endpoint: `<METHOD> <canonicalPath>`. */
+export type EndpointIdentity = string;
+/** Canonical identity string for a method/path pair. */
+export declare function canonicalEndpointIdentity(method: HttpMethod, canonicalPath: string): EndpointIdentity;
+/**
+ * Deterministic, collision-safe endpoint resource name (ADR 0004 D1):
+ * `http-<method>-<path-slug>-<sha8>`. The slug keeps reports readable; the
+ * identity hash suffix makes distinct endpoints collision-free even when
+ * sanitization would coincide (dot vs dash), and is invariant under
+ * parameter-name changes because it hashes the canonical form.
+ */
+export declare function endpointResourceName(method: HttpMethod, canonicalPath: string): string;
+/** One joined endpoint: a route identity plus every fact on either side. */
+export interface JoinedEndpoint {
+    method: HttpMethod;
+    canonicalPath: string;
+    identity: EndpointIdentity;
+    /** Resource name for the compiled `http.endpoint` resource (ADR 0004 D1). */
+    resourceName: string;
+    /** Every distinct server-route fact carrying this identity (duplicates collapsed). */
+    routes: HttpContractFact[];
+    /** Every frontend-call fact joined to this identity, source order sorted. */
+    calls: HttpContractFact[];
+}
+/** A typed, source-located join failure. */
+export interface JoinBlock {
+    code: typeof FRONTEND_ROUTE_UNWIRED | typeof FRONTEND_ROUTE_AMBIGUOUS | typeof HTTP_METHOD_DYNAMIC;
+    detail: string;
+    location: HttpLocation;
+    /** Identity candidates for ambiguity blocks — the surviving
+     * literal-precedence tier, sorted; empty otherwise. */
+    candidates: EndpointIdentity[];
+}
+export interface JoinResult {
+    /** Joined endpoints, sorted by identity. */
+    endpoints: JoinedEndpoint[];
+    /** Typed blocks (unwired/ambiguous/dynamic-method), deterministically sorted. */
+    blocks: JoinBlock[];
+}
+/**
+ * Match-quality tier of one route/call pair (LITERAL PRECEDENCE).
+ *
+ * - `'literal'` — matched with zero slot generality: every matched position
+ *   is exact segment equality (literal==literal, or the call's own `{}`
+ *   mirrored by the route's `{}`; the route consumed nothing beyond what
+ *   the call itself declares).
+ * - `'parameter'` — matched, but at least one position exercised slot
+ *   generality: a route `{}` absorbed a call literal, a call `{}` was
+ *   relaxed onto a route literal, or the trailing route `{*}` absorbed one
+ *   or more call segments. A wildcard match is never a literal match.
+ * - `null` — no positional match at all.
+ */
+export type RouteMatchKind = 'literal' | 'parameter';
+/**
+ * Classifies one call/route pair by match quality, or returns `null` when
+ * the pair does not match under the documented positional rules. Pure and
+ * order-independent; `routeMatchesCall` is exactly `kind !== null`.
+ */
+export declare function routeMatchKind(route: HttpContractFact, call: HttpContractFact): RouteMatchKind | null;
+/** Whether one call fact can join one route fact at all. */
+export declare function routeMatchesCall(route: HttpContractFact, call: HttpContractFact): boolean;
+/**
+ * Joins frontend-call facts against server-route facts.
+ *
+ * Candidate selection applies LITERAL PRECEDENCE (see the module
+ * docstring): literal matches shadow parameter matches, mirroring how
+ * routers resolve literal segments before parameterized ones at runtime.
+ *
+ * `ANY` routes participate in the inventory (they carry exposure evidence)
+ * but never join: a catch-all registration cannot prove which concrete
+ * method the frontend exercised. Calls with a non-concrete method produce
+ * `HTTP_METHOD_DYNAMIC` blocks.
+ */
+export declare function joinFrontendCalls(routes: readonly HttpContractFact[], calls: readonly HttpContractFact[]): JoinResult;
+//# sourceMappingURL=join.d.ts.map

package/dist/join.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"join.d.ts","sourceRoot":"","sources":["../src/join.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAIH,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9E,qEAAqE;AACrE,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEtC,wDAAwD;AACxD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,gBAAgB,CAErG;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAkBtF;AAED,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,6EAA6E;IAC7E,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAED,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,OAAO,sBAAsB,GAAG,OAAO,wBAAwB,GAAG,OAAO,mBAAmB,CAAC;IACnG,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,YAAY,CAAC;IACvB;2DACuD;IACvD,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,iFAAiF;IACjF,MAAM,EAAE,SAAS,EAAE,CAAC;CACrB;AAmCD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,GAAG,cAAc,GAAG,IAAI,CAsBrG;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAEzF;AAQD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,KAAK,EAAE,SAAS,gBAAgB,EAAE,GACjC,UAAU,CAyFZ"}