@testsmith/api-spector 0.3.5 → 0.3.7

package/out/main/chunks/snapshots-NGkGQNZ4.js

@@ -0,0 +1,1658 @@
+"use strict";
+const undici = require("undici");
+const requestExec = require("./request-exec-AQD6cEgT.js");
+const promises = require("fs/promises");
+const path = require("path");
+const Ajv = require("ajv");
+const jsYaml = require("js-yaml");
+const crypto = require("crypto");
+const MATCH_KEY = "__match";
+function isMatcher(node) {
+  return typeof node === "object" && node !== null && !Array.isArray(node) && typeof node[MATCH_KEY] === "string";
+}
+function compileMatcher(m) {
+  switch (m[MATCH_KEY]) {
+    case "type":
+      return compileMatcherExample(m.value, false);
+    case "integer":
+      return { type: "integer" };
+    case "decimal":
+    case "number":
+      return { type: "number" };
+    case "boolean":
+      return { type: "boolean" };
+    case "string":
+      return { type: "string" };
+    case "null":
+      return { type: "null" };
+    case "regex":
+      return { type: "string", pattern: m.regex ?? ".*" };
+    case "datetime":
+    case "timestamp":
+      return { type: "string", format: "date-time" };
+    case "date":
+      return { type: "string", format: "date" };
+    case "time":
+      return { type: "string", format: "time" };
+    case "eachLike": {
+      const schema = { type: "array", items: compileMatcherExample(m.value, false) };
+      schema["minItems"] = typeof m.min === "number" ? m.min : 1;
+      return schema;
+    }
+    default:
+      return {};
+  }
+}
+function compileMatcherExample(node, exact = true) {
+  if (isMatcher(node)) return compileMatcher(node);
+  if (node === null) return { type: "null" };
+  const t = typeof node;
+  if (t === "boolean") return exact ? { const: node } : { type: "boolean" };
+  if (t === "number") return exact ? { const: node } : Number.isInteger(node) ? { type: "integer" } : { type: "number" };
+  if (t === "string") return exact ? { const: node } : { type: "string" };
+  if (Array.isArray(node)) {
+    if (node.length === 0) return { type: "array" };
+    const schema = { type: "array", items: node.map((n) => compileMatcherExample(n, exact)) };
+    if (exact) schema["minItems"] = node.length;
+    return schema;
+  }
+  if (t === "object") {
+    const obj = node;
+    const properties = {};
+    const required = [];
+    for (const [key, value] of Object.entries(obj)) {
+      properties[key] = compileMatcherExample(value, exact);
+      required.push(key);
+    }
+    return { type: "object", properties, required, additionalProperties: true };
+  }
+  return {};
+}
+const ajv$2 = new Ajv({ allErrors: true, strict: false });
+function hasContract(contract) {
+  return !!contract && (contract.statusCode !== void 0 || !!contract.bodySchema || !!contract.bodyMatcher || !!contract.headers?.length);
+}
+function validateConsumerResponse(contract, actualStatus, actualHeaders, bodyText) {
+  const violations = [];
+  if (contract.statusCode !== void 0 && actualStatus !== contract.statusCode) {
+    violations.push({
+      type: "status_mismatch",
+      message: `Expected status ${contract.statusCode}, got ${actualStatus}`,
+      expected: String(contract.statusCode),
+      actual: String(actualStatus)
+    });
+  }
+  for (const expected of contract.headers ?? []) {
+    if (!expected.required) continue;
+    const actual = actualHeaders[expected.key.toLowerCase()];
+    if (actual === void 0) {
+      violations.push({
+        type: "missing_header",
+        message: `Required header "${expected.key}" is absent`,
+        expected: expected.value || "(any)",
+        actual: "(absent)"
+      });
+    } else if (expected.value && actual.split(";")[0].trim().toLowerCase() !== expected.value.split(";")[0].trim().toLowerCase()) {
+      violations.push({
+        type: "missing_header",
+        message: `Header "${expected.key}" has unexpected value`,
+        expected: expected.value,
+        actual
+      });
+    }
+  }
+  if (contract.bodySchema?.trim()) {
+    let schema;
+    try {
+      schema = JSON.parse(contract.bodySchema);
+    } catch {
+      violations.push({
+        type: "schema_violation",
+        message: "Contract bodySchema is not valid JSON"
+      });
+      return violations;
+    }
+    violations.push(...validateBody(schema, bodyText));
+  }
+  if (contract.bodyMatcher?.trim()) {
+    let example;
+    try {
+      example = JSON.parse(contract.bodyMatcher);
+    } catch {
+      violations.push({
+        type: "schema_violation",
+        message: "Contract bodyMatcher is not valid JSON"
+      });
+      return violations;
+    }
+    violations.push(...validateBody(compileMatcherExample(example), bodyText));
+  }
+  return violations;
+}
+function validateBody(schema, bodyText) {
+  const violations = [];
+  let data;
+  try {
+    data = JSON.parse(bodyText);
+  } catch {
+    violations.push({
+      type: "schema_violation",
+      message: "Response body is not valid JSON - cannot validate against schema"
+    });
+    return violations;
+  }
+  try {
+    const validate = ajv$2.compile(schema);
+    if (!validate(data)) {
+      for (const err of validate.errors ?? []) {
+        violations.push({
+          type: "schema_violation",
+          message: err.message ?? "Schema violation",
+          path: err.instancePath || "/"
+        });
+      }
+    }
+  } catch (e) {
+    violations.push({
+      type: "schema_violation",
+      message: `Schema compile error: ${e instanceof Error ? e.message : String(e)}`
+    });
+  }
+  return violations;
+}
+async function executeContract(req, vars) {
+  const url = requestExec.buildUrl(req.url, req.params, vars);
+  const start = Date.now();
+  try {
+    const headers = new undici.Headers();
+    for (const h of req.headers) {
+      if (h.enabled && h.key) headers.set(requestExec.interpolate(h.key, vars), requestExec.interpolate(h.value, vars));
+    }
+    const authHeaders = await requestExec.buildAuthHeaders(req.auth, vars);
+    for (const [k, v] of Object.entries(authHeaders)) headers.set(k, v);
+    let body;
+    if (req.body.mode === "json" && req.body.json) {
+      body = requestExec.interpolate(req.body.json, vars);
+      if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
+    } else if (req.body.mode === "raw" && req.body.raw) {
+      body = requestExec.interpolate(req.body.raw, vars);
+    }
+    const resp = await undici.fetch(url, {
+      method: req.method,
+      headers,
+      body: !["GET", "HEAD"].includes(req.method) ? body : void 0
+    });
+    const bodyText = await resp.text();
+    const rawHeaders = {};
+    resp.headers.forEach((v, k) => {
+      rawHeaders[k] = v;
+    });
+    const violations = validateConsumerResponse(req.contract, resp.status, rawHeaders, bodyText);
+    return {
+      requestId: req.id,
+      requestName: req.name,
+      method: req.method,
+      url,
+      passed: violations.length === 0,
+      violations,
+      durationMs: Date.now() - start,
+      actualStatus: resp.status
+    };
+  } catch (err) {
+    return {
+      requestId: req.id,
+      requestName: req.name,
+      method: req.method,
+      url,
+      passed: false,
+      violations: [{
+        type: "status_mismatch",
+        message: `Request failed: ${err instanceof Error ? err.message : String(err)}`
+      }],
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function runConsumerContracts(requests, envVars, collectionVars = {}) {
+  const vars = { ...envVars, ...collectionVars };
+  const contractRequests = requests.filter((r) => !r.disabled && hasContract(r.contract));
+  const start = Date.now();
+  const results = await Promise.all(contractRequests.map((r) => executeContract(r, vars)));
+  const passed = results.filter((r) => r.passed).length;
+  return {
+    mode: "consumer",
+    total: results.length,
+    passed,
+    failed: results.length - passed,
+    results,
+    durationMs: Date.now() - start
+  };
+}
+const ajv$1 = new Ajv({ allErrors: true, strict: false });
+async function loadSpec(specUrl, specPath) {
+  if (specUrl) {
+    const resp = await undici.fetch(specUrl);
+    if (!resp.ok) throw new Error(`HTTP ${resp.status} loading spec from ${specUrl}`);
+    const text = await resp.text();
+    const ct = resp.headers.get("content-type") ?? "";
+    return ct.includes("yaml") || specUrl.endsWith(".yaml") || specUrl.endsWith(".yml") ? jsYaml.load(text) : JSON.parse(text);
+  }
+  if (specPath) {
+    const raw = await promises.readFile(specPath, "utf8");
+    return specPath.endsWith(".yaml") || specPath.endsWith(".yml") ? jsYaml.load(raw) : JSON.parse(raw);
+  }
+  throw new Error("Either specUrl or specPath must be provided");
+}
+function resolveRef(spec, ref) {
+  const parts = ref.replace(/^#\//, "").split("/");
+  return parts.reduce((obj, key) => obj?.[key], spec);
+}
+function resolveSchema(spec, obj, seen = /* @__PURE__ */ new Set()) {
+  if (!obj || typeof obj !== "object") return obj;
+  if (seen.has(obj)) return {};
+  if (Array.isArray(obj)) {
+    seen.add(obj);
+    return obj.map((i) => resolveSchema(spec, i, seen));
+  }
+  const o = obj;
+  if ("$ref" in o) {
+    const target = resolveRef(spec, o["$ref"]);
+    return resolveSchema(spec, target, seen);
+  }
+  seen.add(obj);
+  return Object.fromEntries(Object.entries(o).map(([k, v]) => [k, resolveSchema(spec, v, seen)]));
+}
+function getServerBases(spec) {
+  const servers = spec["servers"] ?? [];
+  if (!servers.length) return [""];
+  return servers.map((s) => {
+    const raw = s.url ?? "";
+    try {
+      return new URL(raw).pathname.replace(/\/$/, "");
+    } catch {
+      return raw.replace(/\/$/, "");
+    }
+  });
+}
+function urlPathname(raw, baseUrl) {
+  try {
+    const pathname = new URL(raw).pathname;
+    if (baseUrl) {
+      try {
+        const basePath = new URL(baseUrl).pathname.replace(/\/$/, "");
+        if (basePath && pathname.startsWith(basePath)) return pathname.slice(basePath.length) || "/";
+      } catch {
+      }
+    }
+    return pathname;
+  } catch {
+    return raw.split("?")[0];
+  }
+}
+function pathTemplateToRegex(base, template) {
+  const combined = (base + template).replace(/\/+/g, "/");
+  const pattern = combined.replace(/\{[^}]+\}/g, "[^/]+");
+  return new RegExp("^" + pattern + "/?$");
+}
+function findOperation(spec, method, reqUrl, requestBaseUrl) {
+  const bases = getServerBases(spec);
+  const pathname = urlPathname(reqUrl, requestBaseUrl);
+  const paths = spec["paths"] ?? {};
+  for (const [template, pathItem] of Object.entries(paths)) {
+    const resolved = resolveSchema(spec, pathItem);
+    for (const base of bases) {
+      if (pathTemplateToRegex(base, template).test(pathname)) {
+        const op = resolved[method.toLowerCase()];
+        return op ? { pathTemplate: template, operation: op } : null;
+      }
+    }
+  }
+  return null;
+}
+function validateRequestAgainstSpec(spec, req, envVars, requestBaseUrl) {
+  const violations = [];
+  const vars = envVars;
+  const url = req.url.replace(/\{\{([^}]+)\}\}/g, (_, k) => vars[k] ?? `{{${k}}}`);
+  const match = findOperation(spec, req.method, url, requestBaseUrl);
+  if (!match) {
+    violations.push({
+      type: "unknown_path",
+      message: `No operation found in spec for ${req.method} ${url}`
+    });
+    return violations;
+  }
+  const { operation } = match;
+  if (req.body.mode === "json" && req.body.json?.trim()) {
+    const requestBody = resolveSchema(spec, operation["requestBody"]);
+    const content = requestBody?.["content"] ?? {};
+    const jsonContent = content["application/json"];
+    if (jsonContent?.["schema"]) {
+      try {
+        const data = JSON.parse(requestExec.interpolate(req.body.json, vars));
+        const schema = resolveSchema(spec, jsonContent["schema"]);
+        const validate = ajv$1.compile(schema);
+        if (!validate(data)) {
+          for (const err of validate.errors ?? []) {
+            violations.push({
+              type: "request_body_invalid",
+              message: err.message ?? "Request body schema violation",
+              path: err.instancePath || "/"
+            });
+          }
+        }
+      } catch (e) {
+        violations.push({
+          type: "request_body_invalid",
+          message: `Could not validate request body: ${e instanceof Error ? e.message : String(e)}`
+        });
+      }
+    }
+  }
+  const parameters = resolveSchema(spec, operation["parameters"] ?? []);
+  for (const param of parameters) {
+    const p = param;
+    if (p["in"] === "query" && p["required"] === true) {
+      const name = p["name"];
+      if (!req.params.some((kv) => kv.enabled && kv.key === name)) {
+        violations.push({
+          type: "request_body_invalid",
+          message: `Required query parameter "${name}" is missing`,
+          path: `query.${name}`
+        });
+      }
+    }
+  }
+  return violations;
+}
+async function runProviderVerification(requests, envVars, collectionVars = {}, specUrl, specPath, requestBaseUrl) {
+  const spec = await loadSpec(specUrl, specPath);
+  const vars = { ...envVars, ...collectionVars };
+  const start = Date.now();
+  const activeRequests = requests.filter((r) => !r.disabled);
+  const results = activeRequests.map((req) => {
+    const violations = validateRequestAgainstSpec(spec, req, vars, requestBaseUrl);
+    const url = req.url.replace(/\{\{([^}]+)\}\}/g, (_, k) => vars[k] ?? `{{${k}}}`);
+    return {
+      requestId: req.id,
+      requestName: req.name,
+      method: req.method,
+      url,
+      passed: violations.length === 0,
+      violations
+    };
+  });
+  const passed = results.filter((r) => r.passed).length;
+  return {
+    mode: "provider",
+    total: results.length,
+    passed,
+    failed: results.length - passed,
+    results,
+    durationMs: Date.now() - start
+  };
+}
+function rebaseUrl(fullUrl, providerBaseUrl) {
+  if (!providerBaseUrl) return fullUrl;
+  try {
+    const orig = new URL(fullUrl, "http://placeholder.invalid");
+    const base = new URL(providerBaseUrl);
+    const basePath = base.pathname.replace(/\/$/, "");
+    base.pathname = (basePath + orig.pathname).replace(/\/{2,}/g, "/");
+    base.search = orig.search;
+    return base.toString();
+  } catch {
+    return fullUrl;
+  }
+}
+async function setupState(stateHandlerUrl, state, action) {
+  if (!stateHandlerUrl) {
+    return {
+      type: "provider_state_failed",
+      message: `Interaction requires provider state "${state}" but no --states-url / stateHandlerUrl was configured`,
+      expected: state
+    };
+  }
+  try {
+    const resp = await undici.fetch(stateHandlerUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ state, action })
+    });
+    if (!resp.ok) {
+      return {
+        type: "provider_state_failed",
+        message: `State handler returned HTTP ${resp.status} setting up "${state}"`,
+        expected: state,
+        actual: String(resp.status)
+      };
+    }
+    return null;
+  } catch (err) {
+    return {
+      type: "provider_state_failed",
+      message: `State handler unreachable for "${state}": ${err instanceof Error ? err.message : String(err)}`,
+      expected: state
+    };
+  }
+}
+async function verifyInteraction(req, vars, providerBaseUrl, stateHandlerUrl) {
+  const url = rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), providerBaseUrl);
+  const start = Date.now();
+  const violations = [];
+  const states = req.contract?.providerStates ?? [];
+  for (const state of states) {
+    const v = await setupState(stateHandlerUrl, state, "setup");
+    if (v) violations.push(v);
+  }
+  if (violations.length > 0) {
+    return { requestId: req.id, requestName: req.name, method: req.method, url, passed: false, violations, durationMs: Date.now() - start };
+  }
+  try {
+    const headers = new undici.Headers();
+    for (const h of req.headers) {
+      if (h.enabled && h.key) headers.set(requestExec.interpolate(h.key, vars), requestExec.interpolate(h.value, vars));
+    }
+    const authHeaders = await requestExec.buildAuthHeaders(req.auth, vars);
+    for (const [k, v] of Object.entries(authHeaders)) headers.set(k, v);
+    let body;
+    if (req.body.mode === "json" && req.body.json) {
+      body = requestExec.interpolate(req.body.json, vars);
+      if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
+    } else if (req.body.mode === "raw" && req.body.raw) {
+      body = requestExec.interpolate(req.body.raw, vars);
+    }
+    const resp = await undici.fetch(url, {
+      method: req.method,
+      headers,
+      body: !["GET", "HEAD"].includes(req.method) ? body : void 0
+    });
+    const bodyText = await resp.text();
+    const rawHeaders = {};
+    resp.headers.forEach((v, k) => {
+      rawHeaders[k] = v;
+    });
+    violations.push(...validateConsumerResponse(req.contract, resp.status, rawHeaders, bodyText));
+    return {
+      requestId: req.id,
+      requestName: req.name,
+      method: req.method,
+      url,
+      passed: violations.length === 0,
+      violations,
+      durationMs: Date.now() - start,
+      actualStatus: resp.status
+    };
+  } catch (err) {
+    violations.push({
+      type: "status_mismatch",
+      message: `Request failed: ${err instanceof Error ? err.message : String(err)}`
+    });
+    return { requestId: req.id, requestName: req.name, method: req.method, url, passed: false, violations, durationMs: Date.now() - start };
+  } finally {
+    for (const state of states) await setupState(stateHandlerUrl, state, "teardown");
+  }
+}
+async function runLiveProviderVerification(requests, envVars, collectionVars = {}, providerBaseUrl, stateHandlerUrl) {
+  const vars = { ...envVars, ...collectionVars };
+  const start = Date.now();
+  const contractRequests = requests.filter((r) => !r.disabled && hasContract(r.contract));
+  const results = [];
+  for (const req of contractRequests) {
+    results.push(await verifyInteraction(req, vars, providerBaseUrl, stateHandlerUrl));
+  }
+  const passed = results.filter((r) => r.passed).length;
+  return {
+    mode: "provider-live",
+    total: results.length,
+    passed,
+    failed: results.length - passed,
+    results,
+    durationMs: Date.now() - start
+  };
+}
+function checkSchemaCompatibility(consumerSchema, providerSchema, path2 = "") {
+  const violations = [];
+  if (!consumerSchema || !providerSchema) return violations;
+  const typesOf = (s) => {
+    const t = s["type"];
+    const list = Array.isArray(t) ? t.filter((x) => typeof x === "string") : typeof t === "string" ? [t] : [];
+    if (s["nullable"] === true && !list.includes("null")) list.push("null");
+    return list;
+  };
+  const cTypes = typesOf(consumerSchema);
+  const pTypes = typesOf(providerSchema);
+  if (cTypes.length && pTypes.length) {
+    const compatible = (ct, pt) => ct === pt || ct === "integer" && pt === "number" || ct === "number" && pt === "integer";
+    const ok = cTypes.every((ct) => pTypes.some((pt) => compatible(ct, pt)));
+    if (!ok) {
+      violations.push({
+        type: "schema_incompatible",
+        message: `Type mismatch${path2 ? ` at "${path2}"` : ""}: consumer expects "${cTypes.join(",")}", provider offers "${pTypes.join(",")}"`,
+        path: path2 || "/",
+        expected: cTypes.join(","),
+        actual: pTypes.join(",")
+      });
+      return violations;
+    }
+  }
+  if (cTypes.includes("array") || Array.isArray(consumerSchema["items"])) {
+    const cItems = consumerSchema["items"];
+    const pItems = providerSchema["items"];
+    if (cItems && pItems) {
+      violations.push(...checkSchemaCompatibility(cItems, pItems, path2 ? `${path2}[]` : "[]"));
+    }
+    return violations;
+  }
+  if (cTypes.includes("object") || consumerSchema["properties"]) {
+    const cProps = consumerSchema["properties"] ?? {};
+    const pProps = providerSchema["properties"] ?? {};
+    const cRequired = consumerSchema["required"] ?? [];
+    for (const field of cRequired) {
+      const fieldPath = path2 ? `${path2}.${field}` : field;
+      if (!(field in pProps)) {
+        violations.push({
+          type: "schema_incompatible",
+          message: `Consumer requires field "${fieldPath}" which is not defined in provider schema`,
+          path: fieldPath,
+          expected: "(defined)",
+          actual: "(absent)"
+        });
+      }
+    }
+    for (const [field, cPropSchema] of Object.entries(cProps)) {
+      if (field in pProps) {
+        const fieldPath = path2 ? `${path2}.${field}` : field;
+        violations.push(...checkSchemaCompatibility(
+          cPropSchema,
+          pProps[field],
+          fieldPath
+        ));
+      }
+    }
+  }
+  return violations;
+}
+function getProviderResponseSchema(spec, req, envVars, statusCode, requestBaseUrl) {
+  const url = req.url.replace(/\{\{([^}]+)\}\}/g, (_, k) => envVars[k] ?? `{{${k}}}`);
+  const match = findOperation(spec, req.method, url, requestBaseUrl);
+  if (!match) return null;
+  const responses = match.operation["responses"] ?? {};
+  const candidates = [String(statusCode), `${String(statusCode)[0]}xx`, "2XX", "2xx", "default"];
+  for (const candidate of candidates) {
+    const resp = responses[candidate];
+    if (resp) {
+      const resolved = resolveSchema(spec, resp);
+      const content = resolved["content"] ?? {};
+      const json = content["application/json"];
+      if (json?.["schema"]) {
+        return resolveSchema(spec, json["schema"]);
+      }
+    }
+  }
+  return null;
+}
+async function executeRequest(req, vars) {
+  const url = requestExec.buildUrl(req.url, req.params, vars);
+  const start = Date.now();
+  try {
+    const headers = new undici.Headers();
+    for (const h of req.headers) {
+      if (h.enabled && h.key) headers.set(requestExec.interpolate(h.key, vars), requestExec.interpolate(h.value, vars));
+    }
+    const authHeaders = await requestExec.buildAuthHeaders(req.auth, vars);
+    for (const [k, v] of Object.entries(authHeaders)) headers.set(k, v);
+    let body;
+    if (req.body.mode === "json" && req.body.json) {
+      body = requestExec.interpolate(req.body.json, vars);
+      if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
+    }
+    const resp = await undici.fetch(url, {
+      method: req.method,
+      headers,
+      body: !["GET", "HEAD"].includes(req.method) ? body : void 0
+    });
+    const bodyText = await resp.text();
+    const rawHdrs = {};
+    resp.headers.forEach((v, k) => {
+      rawHdrs[k] = v;
+    });
+    return { status: resp.status, headers: rawHdrs, body: bodyText, durationMs: Date.now() - start };
+  } catch (err) {
+    return err instanceof Error ? err : new Error(String(err));
+  }
+}
+async function runBidirectional(requests, envVars, collectionVars = {}, specUrl, specPath, requestBaseUrl) {
+  const spec = await loadSpec(specUrl, specPath);
+  const vars = { ...envVars, ...collectionVars };
+  const start = Date.now();
+  const contractRequests = requests.filter((r) => !r.disabled && hasContract(r.contract));
+  const results = await Promise.all(contractRequests.map(async (req) => {
+    const url = requestExec.buildUrl(req.url, req.params, vars);
+    const violations = [];
+    const expectedStatus = req.contract.statusCode ?? 200;
+    let consumerSchema = null;
+    if (req.contract.bodySchema) {
+      try {
+        consumerSchema = JSON.parse(req.contract.bodySchema);
+      } catch {
+      }
+    } else if (req.contract.bodyMatcher?.trim()) {
+      try {
+        consumerSchema = compileMatcherExample(JSON.parse(req.contract.bodyMatcher), false);
+      } catch {
+      }
+    }
+    if (consumerSchema) {
+      const providerSchema = getProviderResponseSchema(spec, req, vars, expectedStatus, requestBaseUrl);
+      if (!providerSchema) {
+        violations.push({
+          type: "schema_incompatible",
+          message: `No response schema found in spec for ${req.method} ${url} → ${expectedStatus}`
+        });
+      } else {
+        violations.push(...checkSchemaCompatibility(consumerSchema, providerSchema));
+      }
+    }
+    const result = await executeRequest(req, vars);
+    if (result instanceof Error) {
+      violations.push({ type: "status_mismatch", message: `Request failed: ${result.message}` });
+      return { requestId: req.id, requestName: req.name, method: req.method, url, passed: false, violations };
+    }
+    const liveViolations = validateConsumerResponse(
+      req.contract,
+      result.status,
+      result.headers,
+      result.body
+    );
+    violations.push(...liveViolations);
+    return {
+      requestId: req.id,
+      requestName: req.name,
+      method: req.method,
+      url,
+      passed: violations.length === 0,
+      violations,
+      durationMs: result.durationMs,
+      actualStatus: result.status
+    };
+  }));
+  const passed = results.filter((r) => r.passed).length;
+  return {
+    mode: "bidirectional",
+    total: results.length,
+    passed,
+    failed: results.length - passed,
+    results,
+    durationMs: Date.now() - start
+  };
+}
+const RESULTS_DIR = "contracts/results";
+function safe(part) {
+  return part.trim().replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
+}
+function resultPath(dir, pacticipant, version) {
+  return path.join(dir, RESULTS_DIR, safe(pacticipant), `${safe(version)}.json`);
+}
+async function recordResult(dir, pacticipant, version, report, now) {
+  const file = resultPath(dir, pacticipant, version);
+  await promises.mkdir(path.join(dir, RESULTS_DIR, safe(pacticipant)), { recursive: true });
+  const record = {
+    pacticipant,
+    version,
+    recordedAt: now,
+    passed: report.failed === 0,
+    report
+  };
+  await promises.writeFile(file, JSON.stringify(record, null, 2), "utf8");
+  return file;
+}
+async function listResults(dir) {
+  const root = path.join(dir, RESULTS_DIR);
+  const out = [];
+  let pacticipants;
+  try {
+    pacticipants = await promises.readdir(root);
+  } catch {
+    return out;
+  }
+  for (const p of pacticipants) {
+    let files;
+    try {
+      files = await promises.readdir(path.join(root, p));
+    } catch {
+      continue;
+    }
+    for (const f of files) {
+      if (!f.endsWith(".json")) continue;
+      try {
+        out.push(JSON.parse(await promises.readFile(path.join(root, p, f), "utf8")));
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+async function canIDeploy(dir, pacticipant, version, env) {
+  const file = resultPath(dir, pacticipant, version);
+  let currentlyDeployed;
+  if (env) {
+    const state = await loadEnvironment(dir, env);
+    currentlyDeployed = state?.deployed[pacticipant];
+  }
+  let record;
+  try {
+    record = JSON.parse(await promises.readFile(file, "utf8"));
+  } catch {
+    return {
+      deployable: false,
+      reason: `No verification result recorded for ${pacticipant}@${version}. Run \`contract run … --record --pacticipant ${pacticipant} --app-version ${version}\` first.`,
+      currentlyDeployed
+    };
+  }
+  if (record.passed) {
+    return {
+      deployable: true,
+      reason: `${pacticipant}@${version} passed all ${record.report.total} contract checks (verified ${record.recordedAt}).`,
+      record,
+      currentlyDeployed
+    };
+  }
+  return {
+    deployable: false,
+    reason: `${pacticipant}@${version} has ${record.report.failed}/${record.report.total} failing contract checks (verified ${record.recordedAt}).`,
+    record,
+    currentlyDeployed
+  };
+}
+const ENV_DIR = "contracts/environments";
+function envPath(dir, env) {
+  return path.join(dir, ENV_DIR, `${safe(env)}.json`);
+}
+async function loadEnvironment(dir, env) {
+  try {
+    return JSON.parse(await promises.readFile(envPath(dir, env), "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function recordDeployment(dir, env, pacticipant, version, now) {
+  const state = await loadEnvironment(dir, env) ?? { name: env, deployed: {} };
+  const previous = state.deployed[pacticipant];
+  state.deployed[pacticipant] = { version, recordedAt: now };
+  await promises.mkdir(path.join(dir, ENV_DIR), { recursive: true });
+  const file = envPath(dir, env);
+  await promises.writeFile(file, JSON.stringify(state, null, 2), "utf8");
+  return { file, previous };
+}
+async function listEnvironments(dir) {
+  const root = path.join(dir, ENV_DIR);
+  let files;
+  try {
+    files = await promises.readdir(root);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const f of files) {
+    if (!f.endsWith(".json")) continue;
+    try {
+      out.push(JSON.parse(await promises.readFile(path.join(root, f), "utf8")));
+    } catch {
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function makeRng(seed) {
+  let a = seed >>> 0;
+  return () => {
+    a |= 0;
+    a = a + 1831565813 | 0;
+    let t = Math.imul(a ^ a >>> 15, 1 | a);
+    t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
+    return ((t ^ t >>> 14) >>> 0) / 4294967296;
+  };
+}
+function schemaType(schema) {
+  const t = schema["type"];
+  if (Array.isArray(t)) return t.find((x) => x !== "null");
+  return typeof t === "string" ? t : void 0;
+}
+function buildBaseline(schema, rng) {
+  if (!schema || typeof schema !== "object") return "x";
+  if (Array.isArray(schema["enum"]) && schema["enum"].length) return schema["enum"][0];
+  if ("const" in schema) return schema["const"];
+  const type = schemaType(schema);
+  switch (type) {
+    case "object": {
+      const props = schema["properties"] ?? {};
+      const required = new Set(schema["required"] ?? []);
+      const out = {};
+      for (const [key, propSchema] of Object.entries(props)) {
+        if (required.has(key) || rng() > 0.3) out[key] = buildBaseline(propSchema, rng);
+      }
+      for (const key of required) if (!(key in out)) out[key] = "x";
+      return out;
+    }
+    case "array": {
+      const items = schema["items"];
+      const min = typeof schema["minItems"] === "number" ? schema["minItems"] : 1;
+      const n = Math.max(1, min);
+      return Array.from({ length: n }, () => buildBaseline(items, rng));
+    }
+    case "integer":
+    case "number": {
+      const min = schema["minimum"];
+      const max = schema["maximum"];
+      if (min !== void 0 && max !== void 0) return type === "integer" ? Math.floor((min + max) / 2) : (min + max) / 2;
+      if (min !== void 0) return min;
+      if (max !== void 0) return max;
+      return type === "integer" ? 1 : 1.5;
+    }
+    case "boolean":
+      return true;
+    case "null":
+      return null;
+    case "string":
+    default:
+      return baselineString(schema);
+  }
+}
+function baselineString(schema) {
+  const format = schema["format"];
+  switch (format) {
+    case "email":
+      return "user@example.com";
+    case "uuid":
+      return "00000000-0000-4000-8000-000000000000";
+    case "date-time":
+      return "2020-01-01T00:00:00Z";
+    case "date":
+      return "2020-01-01";
+    case "uri":
+    case "url":
+      return "https://example.com";
+    case "ipv4":
+      return "127.0.0.1";
+  }
+  const min = schema["minLength"];
+  if (min && min > 1) return "x".repeat(min);
+  return "x";
+}
+const ADVERSARIAL_STRINGS = [
+  ["very-long", "A".repeat(1e4)],
+  ["empty", ""],
+  ["unicode", "𝔘🙈\0�"],
+  ["whitespace", "   "]
+];
+function clone(v) {
+  return JSON.parse(JSON.stringify(v));
+}
+function setAtPath(root, path2, value) {
+  if (path2.length === 0) return value;
+  const copy = clone(root);
+  let cur = copy;
+  for (let i = 0; i < path2.length - 1; i++) cur = cur[path2[i]];
+  cur[path2[path2.length - 1]] = value;
+  return copy;
+}
+function deleteAtPath(root, path2) {
+  const copy = clone(root);
+  let cur = copy;
+  for (let i = 0; i < path2.length - 1; i++) cur = cur[path2[i]];
+  delete cur[path2[path2.length - 1]];
+  return copy;
+}
+function mutate(baseline, schema, label) {
+  const cases = [];
+  const walk = (schemaNode, path2) => {
+    const target = [label, ...path2].join(".");
+    const type = schemaNode ? schemaType(schemaNode) : void 0;
+    if (type === "object" && schemaNode) {
+      const props = schemaNode["properties"] ?? {};
+      const required = schemaNode["required"] ?? [];
+      const current = getAtPath(baseline, path2);
+      for (const key of required) {
+        if (current && key in current) {
+          cases.push({
+            mutation: { target: `${target}.${key}`, kind: "missing-required", description: `omit required field "${key}"` },
+            value: deleteAtPath(baseline, [...path2, key])
+          });
+        }
+      }
+      if (schemaNode["additionalProperties"] === false && current) {
+        cases.push({
+          mutation: { target: `${target}.__fuzz_extra`, kind: "unexpected-field", description: "add a field the schema forbids" },
+          value: setAtPath(baseline, [...path2, "__fuzz_extra"], "unexpected")
+        });
+      }
+      for (const [key, propSchema] of Object.entries(props)) {
+        if (current && key in current) walk(propSchema, [...path2, key]);
+      }
+      return;
+    }
+    if (type === "array" && schemaNode) {
+      const items = schemaNode["items"];
+      const arr = getAtPath(baseline, path2);
+      if (arr && arr.length) walk(items, [...path2, "0"]);
+      cases.push({
+        mutation: { target, kind: "type:array→string", description: "send a string where an array is expected" },
+        value: setAtPath(baseline, path2, "not-an-array")
+      });
+      return;
+    }
+    if (type === "string" || type === void 0) {
+      cases.push({
+        mutation: { target, kind: "type:string→number", description: "send a number where a string is expected" },
+        value: setAtPath(baseline, path2, 123456)
+      });
+      const format = schemaNode?.["format"];
+      if (format) {
+        cases.push({
+          mutation: { target, kind: `bad-format:${format}`, description: `violate the "${format}" format` },
+          value: setAtPath(baseline, path2, "not-a-" + format)
+        });
+      }
+      if (Array.isArray(schemaNode?.["enum"])) {
+        cases.push({
+          mutation: { target, kind: "enum-violation", description: "send a value outside the allowed enum" },
+          value: setAtPath(baseline, path2, "__not_in_enum__")
+        });
+      }
+      const maxLen = schemaNode?.["maxLength"];
+      if (typeof maxLen === "number") {
+        cases.push({
+          mutation: { target, kind: "maxLength+1", description: `exceed maxLength (${maxLen})` },
+          value: setAtPath(baseline, path2, "x".repeat(maxLen + 1))
+        });
+      }
+      for (const [name, str] of ADVERSARIAL_STRINGS) {
+        cases.push({
+          mutation: { target, kind: `adversarial:${name}`, description: `inject a ${name} string` },
+          value: setAtPath(baseline, path2, str)
+        });
+      }
+    } else if (type === "integer" || type === "number") {
+      cases.push({
+        mutation: { target, kind: "type:number→string", description: "send a string where a number is expected" },
+        value: setAtPath(baseline, path2, "not-a-number")
+      });
+      const min = schemaNode?.["minimum"];
+      const max = schemaNode?.["maximum"];
+      if (typeof min === "number") {
+        cases.push({
+          mutation: { target, kind: "below-minimum", description: `send a value below minimum (${min})` },
+          value: setAtPath(baseline, path2, min - 1)
+        });
+      }
+      if (typeof max === "number") {
+        cases.push({
+          mutation: { target, kind: "above-maximum", description: `send a value above maximum (${max})` },
+          value: setAtPath(baseline, path2, max + 1)
+        });
+      }
+      cases.push({
+        mutation: { target, kind: "extreme", description: "send an extreme numeric value" },
+        value: setAtPath(baseline, path2, 1e308)
+      });
+    } else if (type === "boolean") {
+      cases.push({
+        mutation: { target, kind: "type:boolean→string", description: "send a string where a boolean is expected" },
+        value: setAtPath(baseline, path2, "not-a-bool")
+      });
+    }
+    const nullable = schemaNode?.["nullable"] === true || Array.isArray(schemaNode?.["type"]) && schemaNode["type"].includes("null");
+    if (!nullable) {
+      cases.push({
+        mutation: { target, kind: "null-injection", description: "send null into a non-nullable field" },
+        value: setAtPath(baseline, path2, null)
+      });
+    }
+  };
+  walk(schema, []);
+  return cases;
+}
+function getAtPath(root, path2) {
+  let cur = root;
+  for (const seg of path2) {
+    if (cur == null) return void 0;
+    cur = cur[seg];
+  }
+  return cur;
+}
+const QUERY_ADVERSARIAL = [
+  ["empty", ""],
+  ["very-long", "A".repeat(4096)],
+  ["unicode", "𝔘🙈 �"],
+  ["whitespace", "   "],
+  ["sql", "' OR '1'='1"],
+  ["xss", "<script>alert(1)<\/script>"],
+  ["traversal", "../../../../etc/passwd"],
+  ["null-byte", "x\0y"]
+];
+function setParam(base, key, value) {
+  return base.map((p) => p.key === key ? { ...p, value } : p);
+}
+function dropParam(base, key) {
+  return base.filter((p) => p.key !== key);
+}
+function mutateQueryParams(base, schemas = [], label = "query") {
+  const cases = [];
+  const schemaByName = new Map(schemas.map((s) => [s.name, s]));
+  const target = (name) => `${label}.${name}`;
+  for (const s of schemas) {
+    if (s.required && base.some((p) => p.enabled && p.key === s.name)) {
+      cases.push({
+        mutation: { target: target(s.name), kind: "missing-required", description: `omit required query param "${s.name}"` },
+        params: dropParam(base, s.name)
+      });
+    }
+  }
+  for (const p of base) {
+    if (!p.enabled || !p.key) continue;
+    const schema = schemaByName.get(p.key)?.schema;
+    const t = target(p.key);
+    if (schema && Array.isArray(schema["enum"])) {
+      cases.push({ mutation: { target: t, kind: "enum-violation", description: "query value outside the allowed enum" }, params: setParam(base, p.key, "__not_in_enum__") });
+    }
+    if (schema?.["format"]) {
+      const format = schema["format"];
+      cases.push({ mutation: { target: t, kind: `bad-format:${format}`, description: `violate the "${format}" format` }, params: setParam(base, p.key, `not-a-${format}`) });
+    }
+    const stype = schema ? schemaType(schema) : void 0;
+    if (stype === "integer" || stype === "number") {
+      cases.push({ mutation: { target: t, kind: "not-a-number", description: "non-numeric value for a numeric query param" }, params: setParam(base, p.key, "not-a-number") });
+      const min = schema?.["minimum"];
+      const max = schema?.["maximum"];
+      if (typeof min === "number") cases.push({ mutation: { target: t, kind: "below-minimum", description: `value below minimum (${min})` }, params: setParam(base, p.key, String(min - 1)) });
+      if (typeof max === "number") cases.push({ mutation: { target: t, kind: "above-maximum", description: `value above maximum (${max})` }, params: setParam(base, p.key, String(max + 1)) });
+    }
+    for (const [name, val] of QUERY_ADVERSARIAL) {
+      cases.push({ mutation: { target: t, kind: `adversarial:${name}`, description: `inject a ${name} value` }, params: setParam(base, p.key, val) });
+    }
+  }
+  cases.push({
+    mutation: { target: `${label}.__fuzz`, kind: "unexpected-param", description: "add a query param the endpoint does not declare" },
+    params: [...base, { key: "__fuzz", value: "1", enabled: true }]
+  });
+  return cases;
+}
+function inferSchema(value) {
+  if (value === null) return { type: "null" };
+  if (Array.isArray(value)) {
+    return { type: "array", items: value.length ? inferSchema(value[0]) : { type: "string" } };
+  }
+  switch (typeof value) {
+    case "object": {
+      const props = {};
+      const required = [];
+      for (const [k, v] of Object.entries(value)) {
+        props[k] = inferSchema(v);
+        required.push(k);
+      }
+      return { type: "object", properties: props, required };
+    }
+    case "number":
+      return { type: Number.isInteger(value) ? "integer" : "number" };
+    case "boolean":
+      return { type: "boolean" };
+    default:
+      return { type: "string" };
+  }
+}
+function sampleApplied(arr, n, rng) {
+  if (arr.length <= n) return arr;
+  const a = [...arr];
+  for (let i = a.length - 1; i > 0; i--) {
+    const j = Math.floor(rng() * (i + 1));
+    [a[i], a[j]] = [a[j], a[i]];
+  }
+  return a.slice(0, n);
+}
+const ajv = new Ajv({ allErrors: true, strict: false });
+const WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+function specContextFor(spec, req, vars, requestBaseUrl) {
+  if (!spec) return null;
+  const url = req.url.replace(/\{\{([^}]+)\}\}/g, (_, k) => vars[k] ?? `{{${k}}}`);
+  const match = findOperation(spec, req.method, url, requestBaseUrl);
+  if (!match) return null;
+  const op = match.operation;
+  const requestBody = resolveSchema(spec, op["requestBody"]);
+  const jsonContent = requestBody?.["content"]?.["application/json"];
+  const requestBodySchema = jsonContent?.["schema"] ? resolveSchema(spec, jsonContent["schema"]) : void 0;
+  const parameters = resolveSchema(spec, op["parameters"] ?? []);
+  const queryParams = [];
+  for (const param of parameters) {
+    const p = resolveSchema(spec, param);
+    if (p["in"] !== "query" || typeof p["name"] !== "string") continue;
+    queryParams.push({
+      name: p["name"],
+      required: p["required"] === true,
+      schema: p["schema"] ? resolveSchema(spec, p["schema"]) : void 0
+    });
+  }
+  const responses = op["responses"] ?? {};
+  const documentedStatuses = [];
+  const responseSchemas = {};
+  for (const [code, respVal] of Object.entries(responses)) {
+    const n = Number(code);
+    if (!Number.isNaN(n)) documentedStatuses.push(n);
+    const resp = resolveSchema(spec, respVal);
+    const schema = resp?.["content"]?.["application/json"]?.["schema"];
+    if (schema) responseSchemas[code] = resolveSchema(spec, schema);
+  }
+  return { requestBodySchema, queryParams, documentedStatuses, responseSchemas };
+}
+function statusDocumented(status, documented) {
+  if (documented.includes(status)) return true;
+  if (documented.length === 0) return true;
+  return false;
+}
+function judge(status, responseBody, bodyIsSchemaInvalid, spec, opts) {
+  if (status >= 500) {
+    return { oracle: "never-5xx", message: `Server returned ${status} on a malformed request (should reject with 4xx, not crash)` };
+  }
+  if (spec && bodyIsSchemaInvalid && status >= 200 && status < 300) {
+    return { oracle: "accepted-invalid", message: `Server accepted a schema-invalid request with ${status} (missing input validation)` };
+  }
+  if (opts.strictStatus && spec && !statusDocumented(status, spec.documentedStatuses)) {
+    return { oracle: "undocumented-status", message: `Response status ${status} is not documented in the spec for this operation` };
+  }
+  if (opts.checkResponses && spec && status >= 200 && status < 300) {
+    const schema = spec.responseSchemas[String(status)] ?? spec.responseSchemas["default"];
+    if (schema) {
+      try {
+        const validate = ajv.compile(schema);
+        if (!validate(JSON.parse(responseBody))) {
+          return { oracle: "response-schema", message: `2xx response body does not match the documented schema: ${ajv.errorsText(validate.errors)}` };
+        }
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+async function runFuzz(opts) {
+  const spec = opts.specUrl || opts.specPath ? await loadSpec(opts.specUrl, opts.specPath) : null;
+  const seed = opts.seed ?? 1;
+  const casesPerOp = opts.casesPerOperation ?? 40;
+  const vars = requestExec.mergeVars(opts.envVars, opts.collectionVars ?? {}, {}, {}, await requestExec.buildDynamicVars());
+  const dispatcher = await requestExec.buildDispatcher(void 0, void 0);
+  const start = Date.now();
+  const results = [];
+  let totalCases = 0;
+  let totalFindings = 0;
+  let skippedWrites = 0;
+  let skippedNoBody = 0;
+  const active = opts.requests.filter((r) => !r.disabled);
+  let done = 0;
+  for (const req of active) {
+    opts.onProgress?.(done++, active.length, req.name);
+    if (WRITE_METHODS.has(req.method) && !opts.includeWrites) {
+      skippedWrites++;
+      continue;
+    }
+    const specCtx = specContextFor(spec, req, vars, opts.requestBaseUrl);
+    let baselineBody;
+    let bodySchema;
+    if (specCtx?.requestBodySchema) {
+      bodySchema = specCtx.requestBodySchema;
+      baselineBody = buildBaseline(bodySchema, makeRng(seed));
+    } else if (req.body.mode === "json" && req.body.json?.trim()) {
+      try {
+        baselineBody = JSON.parse(requestExec.interpolate(req.body.json, vars));
+        bodySchema = inferSchema(baselineBody);
+      } catch {
+      }
+    }
+    const hasBody = bodySchema !== void 0;
+    const baselineBodyJson = hasBody ? JSON.stringify(baselineBody) : void 0;
+    const baselineParams = req.params.filter((p) => p.enabled && p.key).map((p) => ({ ...p }));
+    for (const qp of specCtx?.queryParams ?? []) {
+      if (qp.required && !baselineParams.some((p) => p.key === qp.name)) {
+        baselineParams.push({ key: qp.name, value: String(buildBaseline(qp.schema, makeRng(seed)) ?? "1"), enabled: true });
+      }
+    }
+    const canFuzzQuery = baselineParams.length > 0 || (specCtx?.queryParams.length ?? 0) > 0;
+    if (!hasBody && !canFuzzQuery) {
+      skippedNoBody++;
+      continue;
+    }
+    const applied = [];
+    if (hasBody) {
+      for (const c of mutate(baselineBody, bodySchema, "body")) {
+        applied.push({ mutation: c.mutation, bodyJson: JSON.stringify(c.value), bodyValue: c.value, params: baselineParams, isBody: true });
+      }
+    }
+    for (const c of mutateQueryParams(baselineParams, specCtx?.queryParams ?? [], "query")) {
+      applied.push({ mutation: c.mutation, bodyJson: baselineBodyJson, params: c.params, isBody: false });
+    }
+    const cases = sampleApplied(applied, casesPerOp, makeRng(seed + 1));
+    const findings = [];
+    const trace = opts.trace ? [] : void 0;
+    const validateBody2 = specCtx?.requestBodySchema ? (() => {
+      try {
+        return ajv.compile(specCtx.requestBodySchema);
+      } catch {
+        return null;
+      }
+    })() : null;
+    for (const c of cases) {
+      const fuzzReq = {
+        ...req,
+        params: c.params,
+        body: c.bodyJson !== void 0 ? { mode: "json", json: c.bodyJson } : req.body
+      };
+      const resolvedUrl = rebaseUrl(requestExec.buildUrl(fuzzReq.url, fuzzReq.params, vars), opts.providerBaseUrl);
+      let sentSnapshot = { method: req.method, url: resolvedUrl, headers: {} };
+      try {
+        const ex = await requestExec.performHttpExchange({
+          req: fuzzReq,
+          vars,
+          resolvedUrl,
+          dispatcher,
+          onSent: (s) => {
+            sentSnapshot = { method: s.method, url: s.url, headers: s.headers, body: s.body };
+          }
+        });
+        const bodyIsSchemaInvalid = c.isBody && validateBody2 ? !validateBody2(c.bodyValue) : false;
+        const verdict = judge(ex.status, ex.responseBody, bodyIsSchemaInvalid, specCtx, opts);
+        if (verdict) {
+          findings.push({
+            oracle: verdict.oracle,
+            message: verdict.message,
+            status: ex.status,
+            mutation: c.mutation,
+            request: sentSnapshot,
+            responseSample: ex.responseBody.slice(0, 400)
+          });
+        }
+        trace?.push({
+          mutation: c.mutation,
+          status: ex.status,
+          finding: Boolean(verdict),
+          request: { method: sentSnapshot.method, url: sentSnapshot.url, body: sentSnapshot.body },
+          responseSample: ex.responseBody.slice(0, 2e3)
+        });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        const dropped = /socket hang up|ECONNRESET|other side closed/i.test(msg);
+        if (dropped) {
+          findings.push({
+            oracle: "never-5xx",
+            message: `Connection dropped on a malformed request: ${msg}`,
+            status: 0,
+            mutation: c.mutation,
+            request: sentSnapshot
+          });
+        }
+        trace?.push({
+          mutation: c.mutation,
+          status: 0,
+          finding: dropped,
+          request: { method: sentSnapshot.method, url: sentSnapshot.url, body: sentSnapshot.body },
+          responseSample: `(transport error) ${msg}`.slice(0, 300)
+        });
+      }
+    }
+    totalCases += cases.length;
+    totalFindings += findings.length;
+    results.push({
+      requestId: req.id,
+      requestName: req.name,
+      method: req.method,
+      url: rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), opts.providerBaseUrl),
+      cases: cases.length,
+      findings,
+      trace
+    });
+  }
+  opts.onProgress?.(active.length, active.length, "done");
+  return {
+    inputSource: spec ? "spec" : "request",
+    oracleUsesContracts: false,
+    seed,
+    totalCases,
+    totalFindings,
+    results,
+    durationMs: Date.now() - start,
+    skippedWrites,
+    skippedNoBody
+  };
+}
+function esc(s) {
+  return String(s ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function modeLabel(mode) {
+  if (mode === "bidirectional") return "Bi-directional";
+  if (mode === "provider-live") return "Provider (live)";
+  return mode.charAt(0).toUpperCase() + mode.slice(1);
+}
+const STYLE = `
+:root { color-scheme: dark; }
+* { box-sizing: border-box; }
+body { margin: 0; font: 14px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
+  background: #272630; color: #e4e3ea; }
+.wrap { max-width: 960px; margin: 0 auto; padding: 32px 24px 64px; }
+.brand { display: flex; align-items: center; gap: 8px; margin-bottom: 20px; color: #9d9aa8; font-size: 12px; font-weight: 600; letter-spacing: .06em; text-transform: uppercase; }
+.brand .dot { width: 10px; height: 10px; border-radius: 3px; background: #205d96; box-shadow: 0 0 0 2px rgba(32,93,150,.35); }
+h1 { font-size: 20px; margin: 0 0 4px; }
+.sub { color: #9d9aa8; font-size: 13px; margin: 0 0 24px; }
+.meta { display: flex; flex-wrap: wrap; gap: 8px 20px; color: #9d9aa8; font-size: 12px; margin-bottom: 12px; }
+.meta b { color: #c4c2cb; font-weight: 600; }
+.headline { font-size: 24px; font-weight: 700; }
+.headline.ok { color: #9fc93c; } .headline.bad { color: #f87171; }
+.bar { display: flex; height: 10px; border-radius: 6px; overflow: hidden; background: #3d3b48; margin: 14px 0 6px; }
+.bar > i { display: block; height: 100%; }
+.bar .ok { background: #9fc93c; } .bar .bad { background: #f87171; }
+.cards { display: flex; flex-direction: column; gap: 10px; margin-top: 24px; }
+.card { border: 1px solid #3d3b48; border-radius: 10px; overflow: hidden; background: #312f3b; }
+.card.fail { border-color: #7f1d1d; }
+.row { display: flex; align-items: center; gap: 12px; padding: 12px 16px; }
+.card.fail summary .row { background: rgba(127,29,29,.18); }
+.pill { font-size: 10px; font-weight: 700; padding: 2px 8px; border-radius: 5px; flex-shrink: 0; letter-spacing: .03em; }
+.pill.ok { background: #2d3a12; color: #9fc93c; }
+.pill.bad { background: rgba(127,29,29,.55); color: #f87171; }
+.pill.pend { background: rgba(180,83,9,.35); color: #fbbf24; }
+.card.pend { border-color: #92600a; }
+.method { font: 700 12px ui-monospace,SFMono-Regular,Menlo,monospace; width: 56px; flex-shrink: 0; color: #6aa3c8; }
+.name { flex: 1; color: #e4e3ea; font-weight: 500; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.url { color: #7a7785; font: 11px ui-monospace,monospace; max-width: 280px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.dur { color: #7a7785; font-size: 11px; }
+.code { font: 700 12px ui-monospace,monospace; }
+.code.s2 { color: #9fc93c; } .code.s3 { color: #fbbf24; } .code.s4, .code.s5 { color: #f87171; }
+.viol { padding: 14px 16px; border-top: 1px solid #3d3b48; display: flex; flex-direction: column; gap: 10px; }
+.v { border-left: 2px solid #dc2626; background: rgba(127,29,29,.12); border-radius: 0 6px 6px 0; padding: 8px 12px; }
+.v .t { font: 700 10px ui-monospace,monospace; color: #f87171; text-transform: uppercase; letter-spacing: .04em; }
+.v .path { font: 10px ui-monospace,monospace; color: #9d9aa8; background: #272630; padding: 1px 6px; border-radius: 4px; margin-left: 8px; }
+.v .m { color: #fecaca; font-size: 13px; margin: 4px 0 0; }
+.v .ea { font: 11px ui-monospace,monospace; margin-top: 4px; display: flex; gap: 18px; }
+.v .ea .lab { color: #7a7785; }
+.v .ea .exp { color: #9fc93c; } .v .ea .act { color: #f87171; }
+.pass-note { color: #9fc93c; font-size: 13px; padding: 12px 16px; border-top: 1px solid #3d3b48; }
+table { border-collapse: collapse; width: 100%; margin-top: 16px; font-size: 13px; }
+th, td { border: 1px solid #3d3b48; padding: 8px 12px; text-align: left; }
+th { background: #312f3b; color: #c4c2cb; font-weight: 600; }
+td.cell { text-align: center; }
+.b { display: inline-block; min-width: 56px; padding: 2px 8px; border-radius: 5px; font-size: 11px; font-weight: 700; }
+.b.ok { background: #2d3a12; color: #9fc93c; }
+.b.bad { background: rgba(127,29,29,.55); color: #f87171; }
+.b.na { background: #272630; color: #7a7785; }
+a.b { text-decoration: none; }
+a.b.ok:hover { background: #4a5e1d; } a.b.bad:hover { background: rgba(127,29,29,.8); }
+.foot { color: #7a7785; font-size: 11px; margin-top: 40px; text-align: center; }
+summary { cursor: pointer; list-style: none; }
+summary::-webkit-details-marker { display: none; }
+`;
+function page(title, body) {
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc(title)}</title>
+<style>${STYLE}</style>
+</head><body><div class="wrap">
+<div class="brand"><span class="dot"></span>API Spector</div>${body}
+<p class="foot">Generated by API Spector · contract reporting</p>
+</div></body></html>`;
+}
+function statusClass(code) {
+  if (code === void 0) return "";
+  return "s" + String(code)[0];
+}
+function violationHtml(r) {
+  if (r.violations.length === 0) return `<div class="pass-note">All expectations met.</div>`;
+  const items = r.violations.map((v) => {
+    const path2 = v.path ? `<span class="path">${esc(v.path)}</span>` : "";
+    const ea = v.expected || v.actual ? `<div class="ea">${v.expected ? `<span><span class="lab">expected </span><span class="exp">${esc(v.expected)}</span></span>` : ""}${v.actual ? `<span><span class="lab">actual </span><span class="act">${esc(v.actual)}</span></span>` : ""}</div>` : "";
+    return `<div class="v"><div><span class="t">${esc(v.type.replace(/_/g, " "))}</span>${path2}</div><p class="m">${esc(v.message)}</p>${ea}</div>`;
+  }).join("");
+  return `<div class="viol">${items}</div>`;
+}
+function cardHtml(r) {
+  const pill = r.passed ? `<span class="pill ok">PASS</span>` : r.pending ? `<span class="pill pend">PENDING</span>` : `<span class="pill bad">FAIL</span>`;
+  const status = r.actualStatus !== void 0 ? `<span class="code ${statusClass(r.actualStatus)}">${r.actualStatus}</span>` : "";
+  const dur = r.durationMs !== void 0 ? `<span class="dur">${r.durationMs}ms</span>` : "";
+  return `<details class="card ${r.passed ? "" : r.pending ? "pend" : "fail"}" ${r.passed ? "" : "open"}>
+  <summary><div class="row">${pill}<span class="method">${esc(r.method)}</span><span class="name">${esc(r.requestName)}</span><span class="url">${esc(r.url)}</span>${status}${dur}</div></summary>
+  ${violationHtml(r)}
+</details>`;
+}
+function reportToHtml(report, meta = {}) {
+  const okPct = report.total ? Math.round(report.passed / report.total * 100) : 100;
+  const badPct = 100 - okPct;
+  const headlineCls = report.failed === 0 ? "ok" : "bad";
+  const headline = report.failed === 0 ? "✓ All passed" : `✗ ${report.failed} failed`;
+  const metaRows = [
+    `<span><b>Mode</b> ${esc(modeLabel(report.mode))}</span>`,
+    meta.provider ? `<span><b>Provider</b> ${esc(meta.provider)}</span>` : "",
+    meta.consumer ? `<span><b>Consumer</b> ${esc(meta.consumer)}</span>` : "",
+    meta.spec ? `<span><b>Spec</b> ${esc(meta.spec)}</span>` : "",
+    `<span><b>Duration</b> ${report.durationMs}ms</span>`,
+    meta.generatedAt ? `<span><b>Generated</b> ${esc(meta.generatedAt)}</span>` : ""
+  ].filter(Boolean).join("");
+  const failed = report.results.filter((r) => !r.passed);
+  const passed = report.results.filter((r) => r.passed);
+  const cards = [...failed, ...passed].map(cardHtml).join("");
+  const body = `
+<h1>${esc(meta.title ?? "Contract Verification Report")}</h1>
+<p class="sub"><span class="headline ${headlineCls}">${esc(headline)}</span> &nbsp; ${report.passed} / ${report.total} interactions passed</p>
+<div class="meta">${metaRows}</div>
+<div class="bar"><i class="ok" style="width:${okPct}%"></i><i class="bad" style="width:${badPct}%"></i></div>
+<div class="cards">${cards || '<p class="sub">No interactions ran.</p>'}</div>`;
+  return page(meta.title ?? "Contract Verification Report", body);
+}
+function dashboardToHtml(records, generatedAt, opts = {}) {
+  const pacticipants = [...new Set(records.map((r) => r.pacticipant))].sort();
+  const versions = [...new Set(records.map((r) => r.version))].sort();
+  const byKey = new Map(records.map((r) => [`${r.pacticipant}@@${r.version}`, r]));
+  const header = `<tr><th>Pacticipant \\ Version</th>${versions.map((v) => `<th>${esc(v)}</th>`).join("")}</tr>`;
+  const rows = pacticipants.map((p) => {
+    const cells = versions.map((v) => {
+      const rec = byKey.get(`${p}@@${v}`);
+      if (!rec) return `<td class="cell"><span class="b na">-</span></td>`;
+      const cls = rec.passed ? "ok" : "bad";
+      const label = rec.passed ? `${rec.report.total}/${rec.report.total}` : `${rec.report.passed}/${rec.report.total}`;
+      const badge = opts.runLinkBase ? `<a class="b ${cls}" href="${esc(opts.runLinkBase)}/${encodeURIComponent(p)}/${encodeURIComponent(v)}">${esc(label)}</a>` : `<span class="b ${cls}">${esc(label)}</span>`;
+      return `<td class="cell" title="${esc(rec.recordedAt)}">${badge}</td>`;
+    }).join("");
+    return `<tr><td><b>${esc(p)}</b></td>${cells}</tr>`;
+  }).join("");
+  const totalPass = records.filter((r) => r.passed).length;
+  const envs = opts.environments ?? [];
+  const envSection = envs.length ? `
+<h2 style="font-size:16px;margin:36px 0 4px;">Environments</h2>
+<p class="sub">Recorded with <code>contract record-deployment</code></p>
+<table>
+<tr><th>Environment</th><th>Pacticipant</th><th>Deployed version</th><th>Verification</th><th>Since</th></tr>
+${envs.flatMap((e) => Object.entries(e.deployed).sort((a, b) => a[0].localeCompare(b[0])).map(([p, d]) => {
+    const rec = byKey.get(`${p}@@${d.version}`);
+    const badge = !rec ? `<span class="b na">not verified</span>` : opts.runLinkBase ? `<a class="b ${rec.passed ? "ok" : "bad"}" href="${esc(opts.runLinkBase)}/${encodeURIComponent(p)}/${encodeURIComponent(d.version)}">${rec.passed ? "passed" : "failed"}</a>` : `<span class="b ${rec.passed ? "ok" : "bad"}">${rec.passed ? "passed" : "failed"}</span>`;
+    return `<tr><td><b>${esc(e.name)}</b></td><td>${esc(p)}</td><td>${esc(d.version)}</td><td class="cell">${badge}</td><td>${esc(d.recordedAt.slice(0, 19).replace("T", " "))}</td></tr>`;
+  })).join("")}
+</table>` : "";
+  const body = `
+<h1>Contract Dashboard</h1>
+<p class="sub">${records.length} recorded verification${records.length === 1 ? "" : "s"} · ${totalPass} passing</p>
+<div class="meta">${generatedAt ? `<span><b>Generated</b> ${esc(generatedAt)}</span>` : ""}</div>
+${records.length ? `<table>${header}${rows}</table>` : '<p class="sub">No recorded results yet. Run a verification with <code>--record --app-version &lt;ver&gt;</code>.</p>'}
+${envSection}`;
+  return page("Contract Dashboard", body);
+}
+const ORACLE_LABEL = {
+  "never-5xx": "server error",
+  "accepted-invalid": "accepted invalid",
+  "undocumented-status": "undocumented status",
+  "response-schema": "bad response body"
+};
+function fuzzReportToHtml(report, generatedAt) {
+  const clean = report.totalFindings === 0;
+  const headlineCls = clean ? "ok" : "bad";
+  const headline = clean ? "✓ No findings" : `✗ ${report.totalFindings} finding${report.totalFindings === 1 ? "" : "s"}`;
+  const metaRows = [
+    `<span><b>Input</b> ${report.inputSource === "spec" ? "OpenAPI spec" : "request bodies"}</span>`,
+    `<span><b>Cases</b> ${report.totalCases}</span>`,
+    `<span><b>Seed</b> ${report.seed}</span>`,
+    `<span><b>Duration</b> ${report.durationMs}ms</span>`,
+    report.skippedWrites ? `<span><b>Skipped writes</b> ${report.skippedWrites}</span>` : "",
+    report.skippedNoBody ? `<span><b>No body</b> ${report.skippedNoBody}</span>` : "",
+    generatedAt ? `<span><b>Generated</b> ${esc(generatedAt)}</span>` : ""
+  ].filter(Boolean).join("");
+  const withFindings = report.results.filter((r) => r.findings.length > 0);
+  const cleanOps = report.results.length - withFindings.length;
+  const hasTrace = report.results.some((r) => r.trace && r.trace.length > 0);
+  const traceSection = hasTrace ? `
+<h2 style="font-size:16px;margin:36px 0 8px;">All cases sent</h2>
+${report.results.filter((r) => r.trace?.length).map((op) => `
+<details class="card"><summary><div class="row"><span class="method">${esc(op.method)}</span><span class="name">${esc(op.requestName)}</span><span class="dur">${op.trace.length} cases</span></div></summary>
+<table><tr><th>Status</th><th>Field</th><th>Mutation</th><th>Request body</th><th>Response</th></tr>
+${op.trace.map((t) => `<tr><td class="cell"><span class="b ${t.finding ? "bad" : "ok"}">${t.status}</span></td><td>${esc(t.mutation.target)}</td><td>${esc(t.mutation.kind)}</td><td class="url" style="max-width:260px">${esc((t.request.body ?? "").slice(0, 200))}</td><td class="url" style="max-width:260px">${esc((t.responseSample ?? "").slice(0, 200))}</td></tr>`).join("")}
+</table></details>`).join("")}` : "";
+  const cards = withFindings.map((op) => {
+    const items = op.findings.map((f) => {
+      const oracle = ORACLE_LABEL[f.oracle] ?? f.oracle;
+      const reqBody = f.request.body ? `<div class="ea"><span class="lab">body </span><span class="path">${esc(f.request.body.slice(0, 300))}</span></div>` : "";
+      const respSample = f.responseSample ? `<div class="ea"><span class="lab">response </span><span class="path">${esc(f.responseSample.slice(0, 300))}</span></div>` : "";
+      return `<div class="v">
+        <div><span class="t">${esc(oracle)}</span><span class="path">${esc(f.mutation.target)} · ${esc(f.mutation.kind)}</span></div>
+        <p class="m">HTTP ${f.status}: ${esc(f.message)}</p>
+        <div class="ea"><span class="lab">mutation </span><span>${esc(f.mutation.description)}</span></div>
+        <div class="ea"><span class="lab">request </span><span class="path">${esc(f.request.method)} ${esc(f.request.url)}</span></div>
+        ${reqBody}${respSample}
+      </div>`;
+    }).join("");
+    return `<details class="card fail" open>
+      <summary><div class="row"><span class="pill bad">${op.findings.length}</span><span class="method">${esc(op.method)}</span><span class="name">${esc(op.requestName)}</span><span class="url">${esc(op.url)}</span><span class="dur">${op.cases} cases</span></div></summary>
+      <div class="viol">${items}</div>
+    </details>`;
+  }).join("");
+  const body = `
+<h1>Fuzz Report</h1>
+<p class="sub"><span class="headline ${headlineCls}">${esc(headline)}</span> &nbsp; ${report.totalCases} malformed cases across ${report.results.length} operation${report.results.length === 1 ? "" : "s"}</p>
+<div class="meta">${metaRows}</div>
+<div class="cards">${cards || '<p class="pass-note">All operations handled every malformed input safely.</p>'}</div>
+${traceSection}
+${cleanOps ? `<p class="foot">${cleanOps} operation${cleanOps === 1 ? "" : "s"} had no findings.</p>` : ""}`;
+  return page("Fuzz Report", body);
+}
+const SNAPSHOT_DIR = "contracts";
+function safeName(raw) {
+  return raw.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "spec";
+}
+function sha256(text) {
+  return crypto.createHash("sha256").update(text).digest("hex");
+}
+function detectFormat(source, contentType) {
+  const lc = source.toLowerCase();
+  if (lc.endsWith(".yaml") || lc.endsWith(".yml")) return "yaml";
+  if (lc.endsWith(".json")) return "json";
+  if (contentType.includes("yaml")) return "yaml";
+  return "json";
+}
+function tryExtractSpecVersion(specText, format) {
+  try {
+    const parsed = format === "yaml" ? jsYaml.load(specText) : JSON.parse(specText);
+    const info = parsed?.info;
+    if (info && typeof info.version === "string") return info.version;
+  } catch {
+  }
+  return void 0;
+}
+async function captureSnapshot(workspaceDir, opts) {
+  const { specUrl, specPath } = opts;
+  if (!specUrl && !specPath) throw new Error("captureSnapshot: specUrl or specPath is required");
+  let specText;
+  let format;
+  let source;
+  if (specUrl) {
+    const resp = await undici.fetch(specUrl);
+    if (!resp.ok) throw new Error(`HTTP ${resp.status} loading spec from ${specUrl}`);
+    specText = await resp.text();
+    format = detectFormat(specUrl, resp.headers.get("content-type") ?? "");
+    source = specUrl;
+  } else {
+    specText = await promises.readFile(specPath, "utf8");
+    format = detectFormat(specPath, "");
+    source = specPath;
+  }
+  const id = crypto.randomUUID();
+  const specVersion = tryExtractSpecVersion(specText, format);
+  let name = opts.name?.trim();
+  if (!name) {
+    try {
+      name = new URL(source).hostname;
+    } catch {
+      name = source.split(/[\\/]/).pop() ?? "spec";
+    }
+  }
+  if (specVersion && !name.includes(specVersion)) name = `${name} ${specVersion}`;
+  const snapshot = {
+    version: "1.0",
+    id,
+    name,
+    source,
+    capturedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    format,
+    specVersion,
+    spec: specText,
+    sha256: sha256(specText)
+  };
+  const relPath = path.join(SNAPSHOT_DIR, `${safeName(name)}-${id.slice(0, 8)}.contract.json`);
+  const absPath = path.resolve(workspaceDir, relPath);
+  await promises.mkdir(path.join(workspaceDir, SNAPSHOT_DIR), { recursive: true });
+  await promises.writeFile(absPath, JSON.stringify(snapshot, null, 2), "utf8");
+  Object.defineProperty(snapshot, "__relPath", { value: relPath, enumerable: false });
+  return snapshot;
+}
+function relPathOf(snapshot) {
+  const hidden = snapshot.__relPath;
+  return hidden;
+}
+async function loadSnapshot(workspaceDir, relPath) {
+  const raw = await promises.readFile(path.resolve(workspaceDir, relPath), "utf8");
+  return JSON.parse(raw);
+}
+async function listSnapshots(workspaceDir, registered = []) {
+  const seen = new Set(registered);
+  try {
+    const entries = await promises.readdir(path.join(workspaceDir, SNAPSHOT_DIR));
+    for (const f of entries) {
+      if (f.endsWith(".contract.json")) seen.add(path.join(SNAPSHOT_DIR, f));
+    }
+  } catch {
+  }
+  const out = [];
+  for (const relPath of seen) {
+    try {
+      const snapshot = await loadSnapshot(workspaceDir, relPath);
+      out.push({ relPath, snapshot });
+    } catch {
+    }
+  }
+  out.sort((a, b) => b.snapshot.capturedAt.localeCompare(a.snapshot.capturedAt));
+  return out;
+}
+async function deleteSnapshot(workspaceDir, relPath) {
+  try {
+    await promises.unlink(path.resolve(workspaceDir, relPath));
+  } catch {
+  }
+}
+exports.MATCH_KEY = MATCH_KEY;
+exports.canIDeploy = canIDeploy;
+exports.captureSnapshot = captureSnapshot;
+exports.dashboardToHtml = dashboardToHtml;
+exports.deleteSnapshot = deleteSnapshot;
+exports.fuzzReportToHtml = fuzzReportToHtml;
+exports.hasContract = hasContract;
+exports.listEnvironments = listEnvironments;
+exports.listResults = listResults;
+exports.listSnapshots = listSnapshots;
+exports.loadSnapshot = loadSnapshot;
+exports.recordDeployment = recordDeployment;
+exports.recordResult = recordResult;
+exports.relPathOf = relPathOf;
+exports.reportToHtml = reportToHtml;
+exports.runBidirectional = runBidirectional;
+exports.runConsumerContracts = runConsumerContracts;
+exports.runFuzz = runFuzz;
+exports.runLiveProviderVerification = runLiveProviderVerification;
+exports.runProviderVerification = runProviderVerification;