@testsmith/api-spector 0.4.8 → 0.5.0

package/out/main/chunks/{snapshots-CtYxkSLz.js → snapshots-BJiZNuRN.js}

@@ -3,9 +3,10 @@ const promises = require("fs/promises");
 const path = require("path");
 const crypto = require("crypto");
 const undici = require("undici");
-const requestExec = require("./request-exec-BH-M3KqZ.js");
+const requestExec = require("./request-exec-D_xyyt3_.js");
 const Ajv = require("ajv");
 const jsYaml = require("js-yaml");
+require("http");
 const MATCH_KEY = "__match";
 function isMatcher$1(node) {
   return typeof node === "object" && node !== null && !Array.isArray(node) && typeof node[MATCH_KEY] === "string";
@@ -706,9 +707,23 @@ function validateBody(schema, bodyText) {
   }
   return violations;
 }
-async function executeContract(req, vars) {
-  const url = requestExec.buildUrl(req.url, req.params, vars);
+async function executeContract(req, vars, providerBaseUrl) {
+  const url = requestExec.rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), providerBaseUrl);
   const start = Date.now();
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(url)) {
+    return {
+      requestId: req.id,
+      requestName: req.name,
+      method: req.method,
+      url,
+      passed: false,
+      violations: [{
+        type: "status_mismatch",
+        message: `Request URL "${url}" has no host. Set a base URL to send it against, or set a {{baseUrl}} variable in the active environment.`
+      }],
+      durationMs: Date.now() - start
+    };
+  }
   try {
     const headers = new undici.Headers();
     for (const h of req.headers) {
@@ -759,11 +774,11 @@ async function executeContract(req, vars) {
     };
   }
 }
-async function runConsumerContracts(requests, envVars, collectionVars = {}) {
+async function runConsumerContracts(requests, envVars, collectionVars = {}, providerBaseUrl) {
   const vars = { ...envVars, ...collectionVars };
   const contractRequests = requests.filter((r) => !r.disabled && hasContract(r.contract));
   const start = Date.now();
-  const results = await Promise.all(contractRequests.map((r) => executeContract(r, vars)));
+  const results = await Promise.all(contractRequests.map((r) => executeContract(r, vars, providerBaseUrl)));
   const passed = results.filter((r) => r.passed).length;
   return {
     mode: "consumer",
@@ -937,19 +952,6 @@ async function runProviderVerification(requests, envVars, collectionVars = {}, s
     durationMs: Date.now() - start
   };
 }
-function rebaseUrl(fullUrl, providerBaseUrl) {
-  if (!providerBaseUrl) return fullUrl;
-  try {
-    const orig = new URL(fullUrl, "http://placeholder.invalid");
-    const base = new URL(providerBaseUrl);
-    const basePath = base.pathname.replace(/\/$/, "");
-    base.pathname = (basePath + orig.pathname).replace(/\/{2,}/g, "/");
-    base.search = orig.search;
-    return base.toString();
-  } catch {
-    return fullUrl;
-  }
-}
 async function setupState(stateHandlerUrl, state, action) {
   if (!stateHandlerUrl) {
     return {
@@ -982,7 +984,7 @@ async function setupState(stateHandlerUrl, state, action) {
   }
 }
 async function verifyInteraction(req, vars, providerBaseUrl, stateHandlerUrl) {
-  const url = rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), providerBaseUrl);
+  const url = requestExec.rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), providerBaseUrl);
   const start = Date.now();
   const violations = [];
   const states = req.contract?.providerStates ?? [];
@@ -1788,7 +1790,7 @@ async function runFuzz(opts) {
         params: c.params,
         body: c.bodyJson !== void 0 ? { mode: "json", json: c.bodyJson } : req.body
       };
-      const resolvedUrl = rebaseUrl(requestExec.buildUrl(fuzzReq.url, fuzzReq.params, vars), opts.providerBaseUrl);
+      const resolvedUrl = requestExec.rebaseUrl(requestExec.buildUrl(fuzzReq.url, fuzzReq.params, vars), opts.providerBaseUrl);
       let sentSnapshot = { method: req.method, url: resolvedUrl, headers: {} };
       try {
         const ex = await requestExec.performHttpExchange({
@@ -1846,7 +1848,7 @@ async function runFuzz(opts) {
       requestId: req.id,
       requestName: req.name,
       method: req.method,
-      url: rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), opts.providerBaseUrl),
+      url: requestExec.rebaseUrl(requestExec.buildUrl(req.url, req.params, vars), opts.providerBaseUrl),
       cases: cases.length,
       findings,
       trace

package/out/main/chunks/{soap-handler-BXx842MN.js → soap-handler-BYkE6MyE.js}

@@ -1,5 +1,5 @@
 "use strict";
-const handle = require("./handle-rimXXdJH.js");
+const handle = require("./handle-b6bp3fb0.js");
 const https = require("https");
 const http = require("http");
 const xmldom = require("@xmldom/xmldom");
@@ -315,7 +315,7 @@ function registerSoapHandlers(ipc) {
   handle.handleIpc(ipc, handle.IPC.wsdl.import, async (_event, opts) => {
     const { validateWsdlImport } = await Promise.resolve().then(() => require("./ipc-validate-k6KI8adf.js"));
     validateWsdlImport(opts);
-    const { importWsdl } = await Promise.resolve().then(() => require("./import-DcenB5Q_.js"));
+    const { importWsdl } = await Promise.resolve().then(() => require("./import-BeY7gjWL.js"));
     const wsdlText = opts.xml ?? (opts.url ? await fetchUrl(opts.url) : "");
     if (!wsdlText) throw new Error("wsdl:import requires either `url` or `xml`");
     return importWsdl(wsdlText, { name: opts.name, existingMockPorts: opts.existingMockPorts });

package/out/main/compare.js

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+"use strict";
+const promises = require("fs/promises");
+const jsYaml = require("js-yaml");
+const undici = require("undici");
+const coverage = require("./chunks/coverage-C54mZEh_.js");
+const cliCommon = require("./chunks/cli-common-BKYgsbGB.js");
+require("path");
+require("crypto");
+const HTTP_METHODS = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
+function resolveRef(spec, ref) {
+  const parts = ref.replace(/^#\//, "").split("/");
+  return parts.reduce((o, k) => o?.[decodeURIComponent(k.replace(/~1/g, "/").replace(/~0/g, "~"))], spec);
+}
+function deref(spec, node, depth = 0, seen = /* @__PURE__ */ new Set()) {
+  if (!node || typeof node !== "object" || depth > 8) return node;
+  if (Array.isArray(node)) return node.map((n) => deref(spec, n, depth + 1, seen));
+  if ("$ref" in node) {
+    const target = resolveRef(spec, node.$ref);
+    if (!target || seen.has(target)) return {};
+    return deref(spec, target, depth + 1, /* @__PURE__ */ new Set([...seen, target]));
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(node)) out[k] = deref(spec, v, depth + 1, seen);
+  return out;
+}
+function walk(schema, prefix, depth, types, required) {
+  if (!schema || typeof schema !== "object" || depth > 8) return;
+  const type = Array.isArray(schema.type) ? schema.type[0] : schema.type;
+  if (type === "object" || schema.properties) {
+    const req = schema.required ?? [];
+    for (const [name, sub] of Object.entries(schema.properties ?? {})) {
+      const p = prefix ? `${prefix}.${name}` : name;
+      const subType = (Array.isArray(sub?.type) ? sub.type[0] : sub?.type) ?? (sub?.properties ? "object" : "any");
+      types.set(p, subType);
+      if (req.includes(name)) required.add(p);
+      walk(sub, p, depth + 1, types, required);
+    }
+  } else if (type === "array" && schema.items) {
+    walk(schema.items, `${prefix}[]`, depth + 1, types, required);
+  }
+}
+function schemaInfo(spec, schema) {
+  const types = /* @__PURE__ */ new Map();
+  const required = /* @__PURE__ */ new Set();
+  if (schema) walk(deref(spec, schema), "", 0, types, required);
+  return { types, required };
+}
+function requestSchema(spec, op) {
+  return deref(spec, op?.requestBody)?.content?.["application/json"]?.schema;
+}
+function successResponseSchema(spec, op) {
+  const responses = op?.responses ?? {};
+  const code = Object.keys(responses).filter((c) => /^2\d\d$/.test(c)).sort()[0];
+  return code ? deref(spec, responses[code])?.content?.["application/json"]?.schema : void 0;
+}
+function paramRequired(spec, pathItem, op) {
+  const raw = [...pathItem?.parameters ?? [], ...op?.parameters ?? []].map((p) => deref(spec, p));
+  const m = /* @__PURE__ */ new Map();
+  for (const p of raw) if (p?.name && p?.in) m.set(`${p.in}:${p.name}`, !!p.required);
+  return m;
+}
+function operations(spec) {
+  const map = /* @__PURE__ */ new Map();
+  for (const [path, item] of Object.entries(spec?.paths ?? {})) {
+    if (!item || typeof item !== "object") continue;
+    for (const [method, op] of Object.entries(item)) {
+      if (!HTTP_METHODS.includes(method.toLowerCase())) continue;
+      map.set(`${method.toUpperCase()} ${path}`, { method: method.toUpperCase(), path, pathItem: item, op });
+    }
+  }
+  return map;
+}
+function diffSpecs(oldSpec, newSpec) {
+  const oldOps = operations(oldSpec);
+  const newOps = operations(newSpec);
+  const changes = [];
+  for (const [key, o] of oldOps) {
+    if (!newOps.has(key)) {
+      changes.push({ kind: "operation-removed", breaking: true, method: o.method, path: o.path, detail: `Operation ${key} was removed` });
+    }
+  }
+  for (const [key, n] of newOps) {
+    if (!oldOps.has(key)) {
+      changes.push({ kind: "operation-added", breaking: false, method: n.method, path: n.path, detail: `Operation ${key} was added` });
+      continue;
+    }
+    const o = oldOps.get(key);
+    const label = `${n.method} ${n.path}`;
+    const oReq = schemaInfo(oldSpec, requestSchema(oldSpec, o.op));
+    const nReq = schemaInfo(newSpec, requestSchema(newSpec, n.op));
+    for (const p of nReq.required) {
+      if (!oReq.required.has(p)) {
+        changes.push({ kind: "request-required-added", breaking: true, method: n.method, path: n.path, detail: `${label}: request field "${p}" is now required` });
+      }
+    }
+    for (const [p, t] of nReq.types) {
+      const ot = oReq.types.get(p);
+      if (ot && ot !== t) {
+        changes.push({ kind: "request-type-changed", breaking: true, method: n.method, path: n.path, detail: `${label}: request field "${p}" type ${ot} -> ${t}` });
+      }
+    }
+    const oRes = schemaInfo(oldSpec, successResponseSchema(oldSpec, o.op));
+    const nRes = schemaInfo(newSpec, successResponseSchema(newSpec, n.op));
+    for (const [p, t] of oRes.types) {
+      if (!nRes.types.has(p)) {
+        changes.push({ kind: "response-removed", breaking: true, method: n.method, path: n.path, detail: `${label}: response field "${p}" was removed` });
+      } else if (nRes.types.get(p) !== t) {
+        changes.push({ kind: "response-type-changed", breaking: true, method: n.method, path: n.path, detail: `${label}: response field "${p}" type ${t} -> ${nRes.types.get(p)}` });
+      }
+    }
+    const oParams = paramRequired(oldSpec, o.pathItem, o.op);
+    const nParams = paramRequired(newSpec, n.pathItem, n.op);
+    for (const [k, req] of nParams) {
+      if (req && !oParams.get(k)) {
+        changes.push({ kind: "param-required-added", breaking: true, method: n.method, path: n.path, detail: `${label}: parameter "${k}" is now required` });
+      }
+    }
+    const oCodes = Object.keys(o.op?.responses ?? {}).filter((c) => /^2\d\d$/.test(c));
+    const nCodes = new Set(Object.keys(n.op?.responses ?? {}));
+    for (const c of oCodes) {
+      if (!nCodes.has(c)) {
+        changes.push({ kind: "success-code-removed", breaking: true, method: n.method, path: n.path, detail: `${label}: success response ${c} was removed` });
+      }
+    }
+  }
+  return changes;
+}
+function summarizeDiff(changes) {
+  return {
+    breaking: changes.filter((c) => c.breaking).length,
+    nonBreaking: changes.filter((c) => !c.breaking).length
+  };
+}
+async function loadSpec(source) {
+  const isUrl = /^https?:\/\//i.test(source);
+  const raw = isUrl ? await (async () => {
+    const r = await undici.fetch(source);
+    if (!r.ok) throw new Error(`HTTP ${r.status} fetching ${source}`);
+    return r.text();
+  })() : await promises.readFile(source, "utf8");
+  return /\.ya?ml$/i.test(source) || !isUrl && !raw.trim().startsWith("{") ? jsYaml.load(raw) : JSON.parse(raw);
+}
+async function analyseImpact(changes, wsPath) {
+  const { workspace, dir } = await cliCommon.loadWorkspace(wsPath);
+  const collections = await cliCommon.loadCollections(workspace, dir);
+  const reqs = [];
+  for (const col of collections) {
+    for (const r of Object.values(col.requests ?? {})) {
+      if (r.disabled) continue;
+      reqs.push({ name: `${col.name} / ${r.name}`, method: r.method, url: r.url });
+    }
+  }
+  return changes.filter((c) => c.breaking && c.method).map((change) => ({
+    change,
+    tests: reqs.filter((r) => r.method.toUpperCase() === change.method && coverage.pathMatches(r.url, change.path)).map((r) => r.name)
+  }));
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  const positional = argv.filter((a) => !a.startsWith("--"));
+  const args = cliCommon.parseArgs(argv);
+  if (args.help || args.h || positional.length < 2) {
+    console.log("\nUsage:\n  api-spector compare <old-spec> <new-spec> [--workspace <path>] [--fail-on-breaking] [--json]\n");
+    process.exit(positional.length < 2 && !args.help && !args.h ? 2 : 0);
+  }
+  const [oldSource, newSource] = positional;
+  let changes;
+  try {
+    const [oldSpec, newSpec] = await Promise.all([loadSpec(oldSource), loadSpec(newSource)]);
+    changes = diffSpecs(oldSpec, newSpec);
+  } catch (err) {
+    console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(2);
+  }
+  const impact = args.workspace ? await analyseImpact(changes, args.workspace) : null;
+  const { breaking, nonBreaking } = summarizeDiff(changes);
+  if (args.json) {
+    console.log(JSON.stringify({ changes, impact, summary: { breaking, nonBreaking } }, null, 2));
+  } else {
+    console.log("");
+    if (breaking) {
+      console.log(cliCommon.color("  BREAKING CHANGES", cliCommon.C.bold, cliCommon.C.red));
+      for (const c of changes.filter((c2) => c2.breaking)) console.log(`  ${cliCommon.color("✗", cliCommon.C.red)} ${c.detail}`);
+      console.log("");
+    }
+    if (nonBreaking) {
+      console.log(cliCommon.color("  NON-BREAKING", cliCommon.C.bold, cliCommon.C.green));
+      for (const c of changes.filter((c2) => !c2.breaking)) console.log(`  ${cliCommon.color("✓", cliCommon.C.green)} ${c.detail}`);
+      console.log("");
+    }
+    if (!changes.length) console.log(cliCommon.color("  No differences.\n", cliCommon.C.gray));
+    if (impact) {
+      const hit = impact.filter((a) => a.tests.length > 0);
+      const totalTests = new Set(hit.flatMap((a) => a.tests)).size;
+      console.log(cliCommon.color("  IMPACT", cliCommon.C.bold, cliCommon.C.white));
+      if (!breaking) {
+        console.log(cliCommon.color("  No breaking changes. Safe to deploy.\n", cliCommon.C.green));
+      } else if (totalTests === 0) {
+        console.log(`  ${breaking} breaking change(s), but no test in this workspace exercises the affected operations.`);
+        console.log(cliCommon.color("  Recommendation: add tests for those operations, then re-check.\n", cliCommon.C.yellow));
+      } else {
+        for (const a of hit) {
+          console.log(`  ${cliCommon.color(a.change.detail, cliCommon.C.yellow)}`);
+          for (const t of a.tests) console.log(cliCommon.color(`      - ${t}`, cliCommon.C.gray));
+        }
+        console.log("");
+        console.log(cliCommon.color(`  BLOCK DEPLOYMENT: ${breaking} breaking change(s) affect ${totalTests} test(s).`, cliCommon.C.bold, cliCommon.C.red));
+        console.log("");
+      }
+    }
+  }
+  if (args["fail-on-breaking"] && breaking > 0) process.exit(1);
+}
+main().catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(2);
+});

package/out/main/contract.js

@@ -1,30 +1,8 @@
 #!/usr/bin/env node
 "use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 const promises = require("fs/promises");
 const path = require("path");
-const snapshots = require("./chunks/snapshots-CtYxkSLz.js");
+const snapshots = require("./chunks/snapshots-BJiZNuRN.js");
 const crypto = require("crypto");
 const undici = require("undici");
 const os = require("os");
@@ -32,9 +10,13 @@ const cliCommon = require("./chunks/cli-common-BKYgsbGB.js");
 const child_process = require("child_process");
 const jsYaml = require("js-yaml");
 const environments = require("./chunks/environments-iM3SUM-4.js");
-require("./chunks/request-exec-BH-M3KqZ.js");
+require("./chunks/request-exec-D_xyyt3_.js");
 require("tls");
-require("./chunks/handle-rimXXdJH.js");
+require("./chunks/handle-b6bp3fb0.js");
+require("node:fs");
+require("node:os");
+require("node:path");
+require("node:crypto");
 require("dayjs");
 require("vm");
 require("tv4");
@@ -151,71 +133,6 @@ async function fireWebhooks(hooks, payload, env = process.env, log = console.log
     }
   }));
 }
-function snapshotState(results, envs) {
-  const state = { results: {}, deployments: {} };
-  for (const r of results) state.results[`${r.pacticipant}@@${r.version}`] = r.recordedAt;
-  for (const e of envs) {
-    for (const [p, d] of Object.entries(e.deployed)) {
-      state.deployments[`${e.name}@@${p}`] = `${d.version}@@${d.recordedAt}`;
-    }
-  }
-  return state;
-}
-function diffState(prev, next, results) {
-  const events = [];
-  for (const [key, recordedAt] of Object.entries(next.results)) {
-    if (prev.results[key] === recordedAt) continue;
-    const [pacticipant, version] = key.split("@@");
-    const rec = results.find((r) => r.pacticipant === pacticipant && r.version === version);
-    events.push({
-      event: "result-recorded",
-      pacticipant,
-      version,
-      passed: rec?.passed,
-      recordedAt
-    });
-  }
-  for (const [key, value] of Object.entries(next.deployments)) {
-    if (prev.deployments[key] === value) continue;
-    const [environment, pacticipant] = key.split("@@");
-    const [version, recordedAt] = value.split("@@");
-    events.push({
-      event: "deployment-recorded",
-      pacticipant,
-      version,
-      environment,
-      recordedAt
-    });
-  }
-  return events;
-}
-function watchContractEvents(dir, hooks, intervalMs = 1e4, log = console.log) {
-  let prev = null;
-  let running = false;
-  const tick = async () => {
-    if (running) return;
-    running = true;
-    try {
-      const [results, envs] = await Promise.all([snapshots.listResults(dir), snapshots.listEnvironments(dir)]);
-      const next = snapshotState(results, envs);
-      if (prev !== null) {
-        for (const payload of diffState(prev, next, results)) {
-          await fireWebhooks(hooks, payload, process.env, log);
-        }
-      }
-      prev = next;
-    } catch (e) {
-      log(`  [webhook] scan failed: ${e instanceof Error ? e.message : String(e)}`);
-    } finally {
-      running = false;
-    }
-  };
-  void tick();
-  const timer = setInterval(() => {
-    void tick();
-  }, intervalMs);
-  return () => clearInterval(timer);
-}
 function brokerConfigFromEnv() {
   return {
     endpoint: (process.env["API_SPECTOR_CLOUD_ENDPOINT"] || "https://api-spector.dev").replace(/\/+$/, ""),
@@ -288,6 +205,30 @@ async function recordDeployment(cfg, input) {
   const r = await brokerFetch(cfg, path2, "POST", {});
   if (!r.ok) fail(r, "record-deployment failed");
 }
+async function checkCompatibility(cfg, input) {
+  const q = new URLSearchParams({ consumer: input.consumer, consumerVersion: input.consumerVersion, provider: input.provider, providerVersion: input.providerVersion }).toString();
+  const r = await brokerFetch(cfg, "/api/compatibility?" + q, "GET");
+  if (r.status !== 200 && r.status !== 409) fail(r, "Compatibility check failed");
+  return { compatible: r.json?.compatible === true, checks: r.json?.checks ?? [] };
+}
+async function fetchContracts(cfg, input = {}) {
+  const q = new URLSearchParams();
+  if (input.consumer) q.set("consumer", input.consumer);
+  if (input.provider) q.set("provider", input.provider);
+  const suffix = q.toString() ? "?" + q.toString() : "";
+  const r = await brokerFetch(cfg, "/api/contracts" + suffix, "GET");
+  if (!r.ok) fail(r, "Fetch contracts failed");
+  return r.json?.contracts ?? [];
+}
+async function publishVerification(cfg, input) {
+  const r = await brokerFetch(cfg, "/api/verifications", "POST", {
+    contractId: input.contractId,
+    providerVersion: input.providerVersion,
+    success: input.success,
+    ...input.buildUrl ? { buildUrl: input.buildUrl } : {}
+  });
+  if (!r.ok) fail(r, "Publish verification failed");
+}
 function resolveVersion(override) {
   if (override) return override;
   const env = process.env["GITHUB_SHA"] || process.env["CI_COMMIT_SHA"] || process.env["GIT_COMMIT"] || process.env["CIRCLE_SHA1"] || process.env["BUILD_SOURCEVERSION"] || process.env["BITBUCKET_COMMIT"];
@@ -467,7 +408,7 @@ async function cmdRun(args) {
   const modeValue = mode;
   switch (modeValue) {
     case "consumer":
-      report = await snapshots.runConsumerContracts(contractRequests, envVars, collectionVars);
+      report = await snapshots.runConsumerContracts(contractRequests, envVars, collectionVars, providerBaseUrl);
       break;
     case "provider":
       report = await snapshots.runProviderVerification(allRequests, envVars, collectionVars, specUrl, specPath, requestBaseUrl);
@@ -740,8 +681,8 @@ async function cmdWebhooks(args) {
     console.log("      ]");
     console.log("    }");
     console.log("");
-    console.log("  $NAME tokens are replaced from the serving process environment.");
-    console.log("  The dashboard (`contract report --serve`) fires them when new results appear.");
+    console.log("  $NAME tokens are replaced from the process environment.");
+    console.log("  Run `contract webhooks --test` to send a sample event to each configured URL.");
     return;
   }
   console.log("");
@@ -769,60 +710,6 @@ async function cmdReport(args) {
     process.exit(2);
   }
   const { dir } = await cliCommon.loadWorkspace(wsArg);
-  if (args["serve"]) {
-    const port = typeof args["port"] === "string" ? Number(args["port"]) : 8080;
-    if (!Number.isInteger(port) || port < 1 || port > 65535) {
-      console.error("  [error] --port must be a number between 1 and 65535");
-      process.exit(2);
-    }
-    const { createServer } = await import("http");
-    const server = createServer(async (req, res) => {
-      try {
-        const url = req.url ?? "/";
-        if (url === "/healthz") {
-          res.writeHead(200, { "Content-Type": "text/plain" });
-          res.end("ok");
-          return;
-        }
-        const records2 = await snapshots.listResults(dir);
-        const runMatch = /^\/run\/([^/]+)\/([^/]+)$/.exec(url);
-        if (runMatch) {
-          const pacticipant = decodeURIComponent(runMatch[1]);
-          const version = decodeURIComponent(runMatch[2]);
-          const rec = records2.find((r) => r.pacticipant === pacticipant && r.version === version);
-          if (!rec) {
-            res.writeHead(404, { "Content-Type": "text/plain" });
-            res.end("No recorded result for that pacticipant/version");
-            return;
-          }
-          res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(snapshots.reportToHtml(rec.report, {
-            title: `${pacticipant} @ ${version}`,
-            generatedAt: rec.recordedAt
-          }));
-          return;
-        }
-        const environments22 = await snapshots.listEnvironments(dir);
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(snapshots.dashboardToHtml(records2, (/* @__PURE__ */ new Date()).toISOString(), { runLinkBase: "/run", environments: environments22 }));
-      } catch (e) {
-        res.writeHead(500, { "Content-Type": "text/plain" });
-        res.end(e instanceof Error ? e.message : String(e));
-      }
-    });
-    server.listen(port, () => {
-      console.log(`  Contract dashboard serving at http://localhost:${port}`);
-      console.log(`  Workspace: ${wsArg} (results re-read on every request)`);
-      console.log("  Read-only: record new results via `contract run --record`, then refresh.");
-    });
-    const hooks = await loadWebhookConfig(dir);
-    if (hooks.length > 0) {
-      const intervalMs = typeof args["webhook-interval"] === "string" ? Math.max(2, Number(args["webhook-interval"])) * 1e3 : 1e4;
-      watchContractEvents(dir, hooks, intervalMs);
-      console.log(`  Webhooks: ${hooks.length} configured (polling every ${intervalMs / 1e3}s)`);
-    }
-    return;
-  }
   const out = typeof args["html"] === "string" ? args["html"] : "contract-dashboard.html";
   const records = await snapshots.listResults(dir);
   const environments2 = await snapshots.listEnvironments(dir);
@@ -981,6 +868,40 @@ async function cmdCloudRecordDeployment(args) {
   await recordDeployment(brokerConfigFromEnv(), { pacticipant, version, environment });
   console.log(`  Recorded ${pacticipant}@${version.slice(0, 7)} deployed to ${environment}`);
 }
+async function cmdCheck(args) {
+  const consumer = str(args["consumer"]) ?? die("--consumer <name> is required");
+  const consumerVersion = str(args["consumer-version"]) ?? die("--consumer-version <ver> is required");
+  const provider = str(args["provider"]) ?? die("--provider <name> is required");
+  const providerVersion = str(args["provider-version"]) ?? die("--provider-version <ver> is required");
+  const { compatible, checks } = await checkCompatibility(brokerConfigFromEnv(), { consumer, consumerVersion, provider, providerVersion });
+  if (compatible) {
+    console.log(`  ✓ ${consumer}@${consumerVersion} is compatible with ${provider}@${providerVersion}`);
+    return;
+  }
+  console.error(`  ✗ ${consumer}@${consumerVersion} is INCOMPATIBLE with ${provider}@${providerVersion}`);
+  for (const c of checks.filter((c2) => !c2.passed)) {
+    console.error(`    ${c.interaction}`);
+    for (const m of c.mismatches ?? []) console.error(`      ${m.location}: consumer requires ${m.consumer}, provider ${m.provider}`);
+    if ((!c.mismatches || !c.mismatches.length) && c.error) console.error(`      ${c.error}`);
+  }
+  process.exit(1);
+}
+async function cmdPublishVerification(args) {
+  const consumer = str(args["consumer"]) ?? die("--consumer <name> is required");
+  const provider = str(args["provider"]) ?? die("--provider <name> is required");
+  const providerVersion = resolveVersion(str(args["provider-version"]) ?? str(args["version"]));
+  const successArg = str(args["success"]);
+  if (successArg === void 0) die("--success <true|false> is required");
+  const success = successArg === "true" || successArg === "1";
+  const buildUrl = str(args["build-url"]);
+  const consumerVersion = str(args["consumer-version"]);
+  const cfg = brokerConfigFromEnv();
+  const contracts = await fetchContracts(cfg, { consumer, provider });
+  const match = consumerVersion ? contracts.find((c) => c.consumerVersion === consumerVersion) : contracts[contracts.length - 1];
+  if (!match) die(`No published contract for ${consumer} -> ${provider}${consumerVersion ? "@" + consumerVersion : ""}.`);
+  await publishVerification(cfg, { contractId: match.id, providerVersion, success, buildUrl });
+  console.log(`  Published verification: ${provider}@${providerVersion.slice(0, 7)} -> ${consumer}@${match.consumerVersion} = ${success ? "passed" : "FAILED"}`);
+}
 async function main() {
   const [, , sub, ...rest] = process.argv;
   const args = cliCommon.parseArgs(rest);
@@ -991,6 +912,8 @@ async function main() {
   if (sub === "publish-spec") return wantsCloud(args) ? cmdPublishSpec(args) : cmdPublishSpecLocal(args);
   if (sub === "preview") return cmdPreview(args);
   if (sub === "deploy-check" || sub === "can-i-deploy") return wantsCloud(args) ? cmdCloudCanIDeploy(args) : cmdCanIDeploy(args);
+  if (sub === "check") return cmdCheck(args);
+  if (sub === "publish-verification") return cmdPublishVerification(args);
   if (sub === "record-deployment") return wantsCloud(args) ? cmdCloudRecordDeployment(args) : cmdRecordDeployment(args);
   if (sub === "environments") return cmdEnvironments(args);
   if (sub === "webhooks") return cmdWebhooks(args);
@@ -1003,7 +926,7 @@ async function main() {
   api-spector contract list          --workspace <path>
   api-spector contract pin           --workspace <path> --spec-url <url> | --spec-path <file> [--name <label>]
   api-spector contract run           --workspace <path> --mode <consumer|provider|provider-live|bidirectional> [options]
-  api-spector contract report        --workspace <path> [--html <path>] [--serve [--port <n>]]
+  api-spector contract report        --workspace <path> [--html <path>]
   api-spector contract deploy-check  --workspace <path> --pacticipant <name> --app-version <ver> [--to <env>]
   api-spector contract record-deployment --workspace <path> --pacticipant <name> --app-version <ver> --env <name>
   api-spector contract environments  --workspace <path>
@@ -1033,7 +956,8 @@ async function main() {
     --collection <name>       Filter to one collection
     --environment <name>      Environment for {{var}} resolution
     --request-base-url <url>  Strip this host before matching spec paths
-    --provider-base-url <url> (provider-live) rebase requests onto this origin
+    --provider-base-url <url> (provider-live, consumer) rebase requests onto
+                              this origin (lets host-less design contracts run)
     --states-url <url>        (provider-live) provider state handler endpoint
     --output <path>           Write ContractReport JSON here
     --junit <path>            Write JUnit XML here (for CI test reporters)