@planu/cli 0.97.2 → 0.98.0

package/dist/config/license-plans.json

@@ -87,7 +87,8 @@
     "check_spec_lock",
     "configure_desktop_notifications",
     "desktop_notification_status",
-    "test_notification"
+    "test_notification",
+    "tdd_scaffold"
   ],
   "proTools": [
     "audit",
@@ -273,7 +274,10 @@
     "configure_compliance",
     "apply_spec_template",
     "publish_spec_template",
-    "search_spec_templates"
+    "search_spec_templates",
+    "validate_api_contract",
+    "coverage_gap_analyzer",
+    "run_mutation_hints"
   ],
   "alwaysAllowed": [
     "activate_license",

package/dist/config/mobile-ci-templates/android-github-actions.yml

@@ -0,0 +1,149 @@
+name: Android CI/CD
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  workflow_dispatch:
+
+jobs:
+
+  android-test:
+    name: Android — Gradle Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup JDK
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: temurin
+
+      - name: Cache Gradle packages
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: ${{ runner.os }}-gradle-
+
+      - name: Grant Gradle execute permission
+        run: chmod +x gradlew
+
+      - name: Run unit tests
+        run: ./gradlew :{{module}}:testDebugUnitTest
+
+      - name: Upload test reports
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results
+          path: '{{module}}/build/reports/tests/'
+          if-no-files-found: warn
+
+  android-sign:
+    name: Android — Sign Release AAB
+    runs-on: ubuntu-latest
+    needs: android-test
+    if: github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main'
+    env:
+      KEYSTORE_FILE: ${{ secrets.KEYSTORE_FILE }}
+      KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+      KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+      KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup JDK
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: temurin
+
+      - name: Cache Gradle packages
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: ${{ runner.os }}-gradle-
+
+      - name: Grant Gradle execute permission
+        run: chmod +x gradlew
+
+      - name: Decode keystore
+        run: echo "$KEYSTORE_FILE" | base64 --decode > keystore.jks
+        env:
+          KEYSTORE_FILE: ${{ secrets.KEYSTORE_FILE }}
+
+      - name: Build signed release AAB
+        run: |
+          ./gradlew :{{module}}:bundleRelease \
+            -Pandroid.injected.signing.store.file=$(pwd)/keystore.jks \
+            -Pandroid.injected.signing.store.password="$KEYSTORE_PASSWORD" \
+            -Pandroid.injected.signing.key.alias="$KEY_ALIAS" \
+            -Pandroid.injected.signing.key.password="$KEY_PASSWORD"
+        env:
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+
+      - name: Upload signed AAB
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-aab
+          path: '{{module}}/build/outputs/bundle/release/*.aab'
+
+  android-deploy:
+    name: Android — Play Console Deploy
+    runs-on: ubuntu-latest
+    needs: android-sign
+    if: github.ref == 'refs/heads/main'
+    env:
+      PLAY_STORE_JSON_KEY: ${{ secrets.PLAY_STORE_JSON_KEY }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Download signed AAB
+        uses: actions/download-artifact@v4
+        with:
+          name: release-aab
+          path: ./release
+
+      - name: Setup Ruby for Fastlane
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 'bundler-cache: true'
+
+      - name: Install Fastlane
+        run: gem install fastlane --no-document
+
+      - name: Decode Play Store JSON key
+        run: echo "$PLAY_STORE_JSON_KEY" > play-store-key.json
+        env:
+          PLAY_STORE_JSON_KEY: ${{ secrets.PLAY_STORE_JSON_KEY }}
+
+      - name: Upload to Play Console (internal track)
+        run: |
+          fastlane supply \
+            --aab ./release/{{module}}/build/outputs/bundle/release/*.aab \
+            --package_name "{{bundleId}}" \
+            --track internal \
+            --json_key ./play-store-key.json
+
+# Required GitHub Secrets:
+#   KEYSTORE_FILE        — Base64-encoded .jks keystore file
+#   KEYSTORE_PASSWORD    — Password for the keystore file
+#   KEY_ALIAS            — Alias of the signing key in the keystore
+#   KEY_PASSWORD         — Password for the signing key
+#   PLAY_STORE_JSON_KEY  — JSON content of the Google Play service account key
+#
+# Placeholders:
+#   {{module}}           — Gradle module name (e.g. app)
+#   {{bundleId}}         — Android application ID (e.g. com.example.myapp)

package/dist/config/mobile-ci-templates/ios-github-actions.yml

@@ -0,0 +1,120 @@
+name: iOS CI/CD
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  workflow_dispatch:
+
+jobs:
+
+  ios-test:
+    name: iOS — Xcode Build & Test
+    runs-on: macos-latest
+    env:
+      APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+      APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
+      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Select Xcode version
+        run: sudo xcode-select -s /Applications/Xcode.app
+
+      - name: Build and test (Xcode)
+        run: |
+          xcodebuild clean build test \
+            -scheme "{{scheme}}" \
+            -destination 'platform=iOS Simulator,name=iPhone 15,OS=latest' \
+            CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO \
+            | xcpretty && exit "${PIPESTATUS[0]}"
+
+  ios-testflight:
+    name: iOS — TestFlight Upload
+    runs-on: macos-latest
+    needs: ios-test
+    if: github.ref == 'refs/heads/develop'
+    env:
+      APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+      APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
+      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Select Xcode version
+        run: sudo xcode-select -s /Applications/Xcode.app
+
+      - name: Setup Ruby for Fastlane
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 'bundler-cache: true'
+
+      - name: Install Fastlane
+        run: gem install fastlane --no-document
+
+      - name: Build IPA
+        run: |
+          fastlane gym \
+            --scheme "{{scheme}}" \
+            --export_method app-store \
+            --output_directory ./build
+        env:
+          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+
+      - name: Upload to TestFlight
+        run: fastlane pilot upload --ipa ./build/*.ipa --skip_waiting_for_build_processing true
+
+  ios-appstore:
+    name: iOS — App Store Submission
+    runs-on: macos-latest
+    needs: ios-test
+    if: github.ref == 'refs/heads/main'
+    env:
+      APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+      APPLE_API_ISSUER_ID: ${{ secrets.APPLE_API_ISSUER_ID }}
+      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Select Xcode version
+        run: sudo xcode-select -s /Applications/Xcode.app
+
+      - name: Setup Ruby for Fastlane
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 'bundler-cache: true'
+
+      - name: Install Fastlane
+        run: gem install fastlane --no-document
+
+      - name: Build IPA (production)
+        run: |
+          fastlane gym \
+            --scheme "{{scheme}}" \
+            --configuration Release \
+            --export_method app-store \
+            --output_directory ./build
+        env:
+          MATCH_PASSWORD: ${{ secrets.MATCH_PASSWORD }}
+
+      - name: Submit to App Store
+        run: |
+          fastlane deliver \
+            --ipa ./build/*.ipa \
+            --submit_for_review false \
+            --automatic_release false
+
+# Required GitHub Secrets:
+#   APPLE_API_KEY        — Base64-encoded .p8 private key from App Store Connect
+#   APPLE_API_ISSUER_ID  — Issuer ID from App Store Connect API keys page
+#   APPLE_API_KEY_ID     — Key ID from App Store Connect API keys page
+#   MATCH_PASSWORD       — Encryption passphrase for Fastlane Match certificates
+#
+# Placeholders:
+#   {{scheme}}           — Replace with your Xcode scheme name (e.g. MyApp)

package/dist/engine/api-validation/graphql-schema-validator.d.ts

@@ -0,0 +1,3 @@
+import type { ApiContractReport } from '../../types/index.js';
+export declare function validateGraphQLSchema(schemaPath: string, projectPath: string): Promise<ApiContractReport>;
+//# sourceMappingURL=graphql-schema-validator.d.ts.map

package/dist/engine/api-validation/graphql-schema-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql-schema-validator.d.ts","sourceRoot":"","sources":["../../../src/engine/api-validation/graphql-schema-validator.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,iBAAiB,EAIlB,MAAM,sBAAsB,CAAC;AAuF9B,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAgD5B"}

package/dist/engine/api-validation/graphql-schema-validator.js

@@ -0,0 +1,134 @@
+// engine/api-validation/graphql-schema-validator.ts — Validate GraphQL schema vs resolvers (SPEC-322)
+import { readFile } from 'node:fs/promises';
+import { glob } from 'glob';
+// ---------------------------------------------------------------------------
+// GraphQL SDL parser (minimal — extracts Query/Mutation/Subscription fields)
+// ---------------------------------------------------------------------------
+const OPERATION_TYPE_REGEX = /type\s+(Query|Mutation|Subscription)\s*\{([^}]+)\}/gs;
+const FIELD_NAME_REGEX = /^\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*(?:\([^)]*\))?\s*:/m;
+function parseGraphQLOperations(sdl) {
+    const operations = [];
+    let typeMatch;
+    const typeRegex = new RegExp(OPERATION_TYPE_REGEX.source, OPERATION_TYPE_REGEX.flags);
+    while ((typeMatch = typeRegex.exec(sdl)) !== null) {
+        const kind = typeMatch[1];
+        const body = typeMatch[2] ?? '';
+        const lines = body.split('\n');
+        for (const line of lines) {
+            const fieldMatch = FIELD_NAME_REGEX.exec(line);
+            if (fieldMatch?.[1]) {
+                operations.push({ name: fieldMatch[1], kind });
+            }
+        }
+    }
+    return operations;
+}
+// ---------------------------------------------------------------------------
+// Resolver scanner
+// ---------------------------------------------------------------------------
+const RESOLVER_PATTERNS = [
+    // Apollo: { Query: { resolverName() } }
+    /['"`]([a-zA-Z_][a-zA-Z0-9_]*)['"`]\s*:\s*(?:async\s+)?(?:function|\(|[a-zA-Z_])/g,
+    // Direct assignment: const resolverNameResolver = async () =>
+    /(?:const|let)\s+([a-zA-Z_][a-zA-Z0-9_]*Resolver)\s*=/g,
+    // Object method shorthand: resolverName(parent, args, ctx)
+    /\b([a-zA-Z_][a-zA-Z0-9_]*)\s*\(\s*(?:parent|root|_),?\s*(?:args|_args)/g,
+];
+async function scanSourceFilesForResolvers(projectPath) {
+    const patterns = [
+        `${projectPath}/**/*.ts`,
+        `${projectPath}/**/*.tsx`,
+        `${projectPath}/**/*.js`,
+        `${projectPath}/**/*.jsx`,
+    ];
+    const ignores = ['**/node_modules/**', '**/dist/**', '**/.next/**', '**/build/**'];
+    const resolvers = [];
+    const seen = new Set();
+    const files = await glob(patterns, { ignore: ignores });
+    for (const file of files) {
+        const content = await readFile(file, 'utf-8').catch(() => '');
+        if (!content) {
+            continue;
+        }
+        if (!content.includes('resolver') &&
+            !content.includes('Query') &&
+            !content.includes('Mutation')) {
+            continue;
+        }
+        for (const pattern of RESOLVER_PATTERNS) {
+            const re = new RegExp(pattern.source, pattern.flags);
+            let match;
+            while ((match = re.exec(content)) !== null) {
+                const name = match[1];
+                if (name && !seen.has(name)) {
+                    seen.add(name);
+                    resolvers.push({ name, file });
+                }
+            }
+        }
+    }
+    return resolvers;
+}
+// ---------------------------------------------------------------------------
+// Main validator
+// ---------------------------------------------------------------------------
+export async function validateGraphQLSchema(schemaPath, projectPath) {
+    const sdl = await readFile(schemaPath, 'utf-8');
+    const operations = parseGraphQLOperations(sdl);
+    const resolvers = await scanSourceFilesForResolvers(projectPath);
+    const resolverNames = new Set(resolvers.map((r) => r.name));
+    const missingEndpoints = [];
+    const undocumentedEndpoints = [];
+    for (const op of operations) {
+        if (!resolverNames.has(op.name)) {
+            missingEndpoints.push({
+                path: `${op.kind}.${op.name}`,
+                method: op.kind,
+                severity: 'critical',
+                message: `GraphQL ${op.kind} "${op.name}" is defined in the schema but no resolver implementation was detected in the project source files.`,
+            });
+        }
+    }
+    const opNames = new Set(operations.map((o) => o.name));
+    for (const resolver of resolvers) {
+        if (!opNames.has(resolver.name) && isLikelyOperationResolver(resolver.name)) {
+            undocumentedEndpoints.push({
+                path: resolver.name,
+                method: 'resolver',
+                severity: 'info',
+                message: `Resolver "${resolver.name}" found in ${resolver.file} does not correspond to any operation in the GraphQL schema.`,
+            });
+        }
+    }
+    const findings = [...missingEndpoints, ...undocumentedEndpoints];
+    return {
+        contractFormat: 'graphql',
+        contractVersion: 'SDL',
+        contractTitle: 'GraphQL Schema',
+        totalContractEndpoints: operations.length,
+        totalImplEndpoints: resolvers.length,
+        missingEndpoints,
+        undocumentedEndpoints,
+        schemaDrift: [],
+        breakingChanges: [],
+        findings,
+        summary: buildSummary(missingEndpoints.length, undocumentedEndpoints.length),
+    };
+}
+function isLikelyOperationResolver(name) {
+    return /^(?:get|create|update|delete|list|find|add|remove|fetch|load|save|set)[A-Z]/.test(name);
+}
+function buildSummary(missing, undocumented) {
+    if (missing === 0 && undocumented === 0) {
+        return 'GraphQL schema and resolver implementations are fully aligned.';
+    }
+    const parts = [];
+    if (missing > 0) {
+        parts.push(`${missing} operation(s) in schema have no resolver implementation`);
+    }
+    if (undocumented > 0) {
+        parts.push(`${undocumented} resolver(s) found that are not in the schema`);
+    }
+    return parts.join('; ') + '.';
+}
+//# sourceMappingURL=graphql-schema-validator.js.map

package/dist/engine/api-validation/graphql-schema-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql-schema-validator.js","sourceRoot":"","sources":["../../../src/engine/api-validation/graphql-schema-validator.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAEtG,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,sDAAsD,CAAC;AACpF,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAE9E,SAAS,sBAAsB,CAAC,GAAW;IACzC,MAAM,UAAU,GAA6B,EAAE,CAAC;IAChD,IAAI,SAAiC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAEtF,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAmC,CAAC;QAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,iBAAiB,GAAsB;IAC3C,wCAAwC;IACxC,kFAAkF;IAClF,8DAA8D;IAC9D,uDAAuD;IACvD,2DAA2D;IAC3D,yEAAyE;CAC1E,CAAC;AAEF,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IAC5D,MAAM,QAAQ,GAAG;QACf,GAAG,WAAW,UAAU;QACxB,GAAG,WAAW,WAAW;QACzB,GAAG,WAAW,UAAU;QACxB,GAAG,WAAW,WAAW;KAC1B,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,oBAAoB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;IAEnF,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC7B,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1B,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC7B,CAAC;YACD,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACf,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,WAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,MAAM,gBAAgB,GAAyB,EAAE,CAAC;IAClD,MAAM,qBAAqB,GAAyB,EAAE,CAAC;IAEvD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,gBAAgB,CAAC,IAAI,CAAC;gBACpB,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE;gBAC7B,MAAM,EAAE,EAAE,CAAC,IAAI;gBACf,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,WAAW,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,qGAAqG;aAC7I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,qBAAqB,CAAC,IAAI,CAAC;gBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,cAAc,QAAQ,CAAC,IAAI,8DAA8D;aAC7H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAyB,CAAC,GAAG,gBAAgB,EAAE,GAAG,qBAAqB,CAAC,CAAC;IAEvF,OAAO;QACL,cAAc,EAAE,SAAS;QACzB,eAAe,EAAE,KAAK;QACtB,aAAa,EAAE,gBAAgB;QAC/B,sBAAsB,EAAE,UAAU,CAAC,MAAM;QACzC,kBAAkB,EAAE,SAAS,CAAC,MAAM;QACpC,gBAAgB;QAChB,qBAAqB;QACrB,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,EAAE;QACnB,QAAQ;QACR,OAAO,EAAE,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,OAAO,6EAA6E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,YAAoB;IACzD,IAAI,OAAO,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,gEAAgE,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,yDAAyD,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,+CAA+C,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;AAChC,CAAC"}

package/dist/engine/api-validation/index.d.ts

@@ -0,0 +1,3 @@
+export { validateOpenApiContract } from './openapi-impl-validator.js';
+export { validateGraphQLSchema } from './graphql-schema-validator.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/engine/api-validation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/engine/api-validation/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/engine/api-validation/index.js

@@ -0,0 +1,4 @@
+// engine/api-validation/index.ts — Barrel export (SPEC-322)
+export { validateOpenApiContract } from './openapi-impl-validator.js';
+export { validateGraphQLSchema } from './graphql-schema-validator.js';
+//# sourceMappingURL=index.js.map

package/dist/engine/api-validation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/engine/api-validation/index.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAE5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/engine/api-validation/openapi-impl-validator.d.ts

@@ -0,0 +1,3 @@
+import type { ApiContractReport } from '../../types/index.js';
+export declare function validateOpenApiContract(contractPath: string, projectPath: string): Promise<ApiContractReport>;
+//# sourceMappingURL=openapi-impl-validator.d.ts.map

package/dist/engine/api-validation/openapi-impl-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-impl-validator.d.ts","sourceRoot":"","sources":["../../../src/engine/api-validation/openapi-impl-validator.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,iBAAiB,EAIlB,MAAM,sBAAsB,CAAC;AAsJ9B,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,CAAC,CA6D5B"}

package/dist/engine/api-validation/openapi-impl-validator.js

@@ -0,0 +1,205 @@
+// engine/api-validation/openapi-impl-validator.ts — Validate OpenAPI contract vs implementation (SPEC-322)
+import { readFile } from 'node:fs/promises';
+import { glob } from 'glob';
+// ---------------------------------------------------------------------------
+// Route pattern detectors
+// ---------------------------------------------------------------------------
+const ROUTE_PATTERNS = [
+    // Express: app.get('/path', ...) or router.post('/path')
+    {
+        regex: /(?:app|router)\.(get|post|put|patch|delete|head|options)\s*\(\s*['"`]([^'"`]+)['"`]/g,
+        framework: 'express',
+    },
+    // Fastify: fastify.get('/path')
+    {
+        regex: /fastify\.(get|post|put|patch|delete|head|options)\s*\(\s*['"`]([^'"`]+)['"`]/g,
+        framework: 'fastify',
+    },
+    // Next.js API routes: export async function GET/POST/PUT/DELETE
+    {
+        regex: /export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(/g,
+        framework: 'nextjs',
+    },
+    // FastAPI: @router.get('/path') or @app.get('/path')
+    {
+        regex: /@(?:router|app)\.(get|post|put|patch|delete|head|options)\s*\(\s*['"`]([^'"`]+)['"`]/g,
+        framework: 'fastapi',
+    },
+];
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function normalizeMethod(m) {
+    return m.toUpperCase();
+}
+function normalizePath(p) {
+    // Convert :param → {param} for comparison with OpenAPI style
+    return p.replace(/:([a-zA-Z_][a-zA-Z0-9_]*)/g, '{$1}');
+}
+function pathsMatch(contractPath, implPath) {
+    const norm = normalizePath(implPath);
+    if (contractPath === norm || contractPath === implPath) {
+        return true;
+    }
+    const contractParts = contractPath.split('/');
+    const implParts = norm.split('/');
+    if (contractParts.length !== implParts.length) {
+        return false;
+    }
+    return contractParts.every((part, i) => {
+        if (part.startsWith('{') && part.endsWith('}')) {
+            return true;
+        }
+        return part === implParts[i];
+    });
+}
+async function scanSourceFilesForRoutes(projectPath) {
+    const patterns = [
+        `${projectPath}/**/*.ts`,
+        `${projectPath}/**/*.tsx`,
+        `${projectPath}/**/*.js`,
+        `${projectPath}/**/*.jsx`,
+        `${projectPath}/**/*.py`,
+    ];
+    const ignores = ['**/node_modules/**', '**/dist/**', '**/.next/**', '**/build/**'];
+    const routes = [];
+    const files = await glob(patterns, { ignore: ignores });
+    for (const file of files) {
+        const content = await readFile(file, 'utf-8').catch(() => '');
+        if (!content) {
+            continue;
+        }
+        for (const { regex, framework } of ROUTE_PATTERNS) {
+            const re = new RegExp(regex.source, regex.flags);
+            let match;
+            while ((match = re.exec(content)) !== null) {
+                if (framework === 'nextjs') {
+                    const relPath = file
+                        .replace(projectPath, '')
+                        .replace(/\\/g, '/')
+                        .replace(/\/app\/|\/pages\/api\//, '/')
+                        .replace(/\/route\.(ts|js|tsx|jsx)$/, '')
+                        .replace(/\.(ts|js|tsx|jsx)$/, '');
+                    routes.push({
+                        method: normalizeMethod(match[1] ?? 'GET'),
+                        path: relPath || '/',
+                        framework,
+                        file,
+                    });
+                }
+                else {
+                    const rawMethod = match[1] ?? '';
+                    const rawPath = match[2] ?? '';
+                    if (rawMethod && rawPath) {
+                        routes.push({
+                            method: normalizeMethod(rawMethod),
+                            path: rawPath,
+                            framework,
+                            file,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    // Deduplicate by method+path (multiple patterns may match the same route)
+    const seen = new Set();
+    return routes.filter((r) => {
+        const key = `${r.method}:${r.path}`;
+        if (seen.has(key)) {
+            return false;
+        }
+        seen.add(key);
+        return true;
+    });
+}
+// ---------------------------------------------------------------------------
+// OpenAPI contract reader
+// ---------------------------------------------------------------------------
+async function readOpenApiDoc(contractPath) {
+    const content = await readFile(contractPath, 'utf-8');
+    if (contractPath.endsWith('.json')) {
+        return JSON.parse(content);
+    }
+    // Minimal YAML fallback: strip comments and attempt JSON parse
+    const stripped = content
+        .split('\n')
+        .filter((line) => !line.trim().startsWith('#'))
+        .join('\n');
+    try {
+        return JSON.parse(stripped);
+    }
+    catch {
+        return {};
+    }
+}
+// ---------------------------------------------------------------------------
+// Main validator
+// ---------------------------------------------------------------------------
+const HTTP_METHODS_LIST = ['get', 'post', 'put', 'patch', 'delete', 'head', 'options'];
+export async function validateOpenApiContract(contractPath, projectPath) {
+    const doc = await readOpenApiDoc(contractPath);
+    const implRoutes = await scanSourceFilesForRoutes(projectPath);
+    const contractEndpoints = [];
+    const paths = doc.paths ?? {};
+    for (const [apiPath, pathItem] of Object.entries(paths)) {
+        for (const method of HTTP_METHODS_LIST) {
+            if (pathItem[method] !== undefined) {
+                contractEndpoints.push({ path: apiPath, method: method.toUpperCase() });
+            }
+        }
+    }
+    const missingEndpoints = [];
+    for (const endpoint of contractEndpoints) {
+        const found = implRoutes.some((r) => r.method === endpoint.method && pathsMatch(endpoint.path, r.path));
+        if (!found) {
+            missingEndpoints.push({
+                path: endpoint.path,
+                method: endpoint.method,
+                severity: 'critical',
+                message: `Endpoint ${endpoint.method} ${endpoint.path} is documented in the contract but no implementation was found in the project source files.`,
+            });
+        }
+    }
+    const undocumentedEndpoints = [];
+    for (const route of implRoutes) {
+        const found = contractEndpoints.some((e) => e.method === route.method && pathsMatch(e.path, route.path));
+        if (!found) {
+            undocumentedEndpoints.push({
+                path: route.path,
+                method: route.method,
+                severity: 'warning',
+                message: `Endpoint ${route.method} ${route.path} is implemented (found in ${route.file}) but is not documented in the API contract.`,
+            });
+        }
+    }
+    const findings = [...missingEndpoints, ...undocumentedEndpoints];
+    const contractInfo = doc.info ?? {};
+    return {
+        contractFormat: 'openapi',
+        contractVersion: contractInfo.version ?? 'unknown',
+        contractTitle: contractInfo.title ?? 'Unknown API',
+        totalContractEndpoints: contractEndpoints.length,
+        totalImplEndpoints: implRoutes.length,
+        missingEndpoints,
+        undocumentedEndpoints,
+        schemaDrift: [],
+        breakingChanges: [],
+        findings,
+        summary: buildSummary(missingEndpoints.length, undocumentedEndpoints.length),
+    };
+}
+function buildSummary(missing, undocumented) {
+    if (missing === 0 && undocumented === 0) {
+        return 'Contract and implementation are fully aligned. No issues found.';
+    }
+    const parts = [];
+    if (missing > 0) {
+        parts.push(`${missing} endpoint(s) documented in the contract but missing from implementation`);
+    }
+    if (undocumented > 0) {
+        parts.push(`${undocumented} endpoint(s) implemented but not documented in the contract`);
+    }
+    return parts.join('; ') + '.';
+}
+//# sourceMappingURL=openapi-impl-validator.js.map