flowstride 1.0.20 → 1.0.22

package/dist/native/runtime.js

@@ -0,0 +1,160 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NativeRuntime = void 0;
+const zod_1 = require("zod");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_crypto_1 = require("node:crypto");
+const validation_1 = require("./validation");
+const projectPaths_1 = require("../utils/projectPaths");
+const events_1 = require("./events");
+const functions_1 = require("./functions");
+const components_1 = require("./components");
+const assertions_1 = require("./assertions");
+const accessibility_1 = require("./accessibility");
+class NativeRuntime {
+    web;
+    config;
+    events;
+    lastAssertion;
+    assertionGeneration = 0;
+    functions = new functions_1.NativeFunctions();
+    components;
+    constructor(web, config) {
+        this.web = web;
+        this.config = config;
+        this.events = new events_1.NativeEvents(web, config);
+        this.components = new components_1.NativeComponents(config);
+    }
+    async execute(command, input = {}) {
+        this.lastAssertion = undefined;
+        const generation = ++this.assertionGeneration;
+        const report = result => { if (generation === this.assertionGeneration)
+            this.lastAssertion = result; };
+        const [area, action, extra] = command.split('.');
+        if (!action || extra)
+            throw new Error(`Unknown native command: flow.${command}`);
+        if (area === 'browser') {
+            if (action === 'create') {
+                const data = zod_1.z.object({ name: validation_1.name, options: zod_1.z.unknown().optional() }).strict().parse(input);
+                (0, validation_1.validateContextOptions)(data.options, this.config.browser, this.config.projectRoot);
+                await this.web.createProfile(data.name, data.options);
+                return;
+            }
+            if (action === 'use' || action === 'close') {
+                const data = zod_1.z.object({ name: validation_1.name }).strict().parse(input);
+                if (action === 'use')
+                    await this.web.useProfile(data.name);
+                else {
+                    if (data.name === 'default')
+                        throw new Error('The default profile stays available until file completion.');
+                    await this.events.disposeProfile(data.name);
+                    await this.web.closeProfile(data.name);
+                }
+                return;
+            }
+            if (action === 'list') {
+                zod_1.z.object({}).strict().parse(input);
+                return this.web.profileNames();
+            }
+            if (action === 'offline') {
+                const data = zod_1.z.object({ value: zod_1.z.boolean() }).strict().parse(input);
+                await this.web.getContext().setOffline(data.value);
+                return;
+            }
+            if (action === 'permissions') {
+                const data = zod_1.z.object({ permissions: zod_1.z.array(zod_1.z.string()), origin: zod_1.z.string().url().optional() }).strict().parse(input);
+                await this.web.getContext().grantPermissions(data.permissions, { origin: data.origin });
+                return;
+            }
+            if (action === 'clearPermissions') {
+                zod_1.z.object({}).strict().parse(input);
+                await this.web.getContext().clearPermissions();
+                return;
+            }
+            if (action === 'geolocation') {
+                const data = zod_1.z.object({ latitude: zod_1.z.number().min(-90).max(90), longitude: zod_1.z.number().min(-180).max(180), accuracy: zod_1.z.number().nonnegative().optional() }).strict().parse(input);
+                await this.web.getContext().setGeolocation(data);
+                return;
+            }
+            throw new Error(`Unknown browser action: ${action}`);
+        }
+        if (area === 'assert') {
+            if (action !== 'that')
+                throw new Error(`Unknown assertion action: ${action}`);
+            return (0, assertions_1.assertBrowser)(this.web.getPage(), input, this.config.timeout, report);
+        }
+        if (area === 'network')
+            return this.events.network(action, input, report);
+        if (area === 'download')
+            return this.events.download(action, input, report);
+        if (area === 'stub')
+            return this.functions.execute(this.web.getPage(), action, input, this.config.timeout, report);
+        if (area === 'component')
+            return this.components.execute(this.web.getPage(), action, input);
+        if (area === 'a11y')
+            return (0, accessibility_1.accessibility)(this.web.getPage(), this.config, action, input, report);
+        if (area === 'clock') {
+            const clock = this.web.getPage().clock;
+            if (action === 'install') {
+                const data = zod_1.z.object({ time: zod_1.z.union([zod_1.z.string(), zod_1.z.number()]).optional() }).strict().parse(input);
+                await clock.install(data);
+                return;
+            }
+            if (action === 'resume') {
+                zod_1.z.object({}).strict().parse(input);
+                await clock.resume();
+                return;
+            }
+            if (['pauseAt', 'setFixedTime', 'setSystemTime'].includes(action)) {
+                const data = zod_1.z.object({ time: zod_1.z.union([zod_1.z.string().min(1), zod_1.z.number().finite()]) }).strict().parse(input);
+                if (typeof data.time === 'string' && !Number.isFinite(Date.parse(data.time)))
+                    throw new Error('Clock time must be a valid date.');
+                await clock[action](data.time);
+                return;
+            }
+            if (['runFor', 'fastForward'].includes(action)) {
+                const data = zod_1.z.object({ milliseconds: zod_1.z.number().int().min(0).max(86400000) }).strict().parse(input);
+                await clock[action](data.milliseconds);
+                return;
+            }
+            throw new Error(`Unknown clock action: ${action}`);
+        }
+        if (area === 'trace') {
+            if (action === 'start') {
+                const data = zod_1.z.object({ name: validation_1.name.optional() }).strict().parse(input);
+                await this.web.beginTrace(undefined, data.name ? `${data.name}-trace.zip` : undefined);
+                return;
+            }
+            if (action === 'stop') {
+                zod_1.z.object({}).strict().parse(input);
+                return this.web.endTrace();
+            }
+            throw new Error(`Unknown trace action: ${action}`);
+        }
+        if (area === 'har') {
+            if (action === 'replay') {
+                const data = zod_1.z.object({ file: zod_1.z.string().min(1), url: zod_1.z.string().optional(), notFound: zod_1.z.enum(['abort', 'fallback']).default('abort') }).strict().parse(input);
+                (0, validation_1.readProjectFile)(this.config, data.file, 100 * 1024 * 1024);
+                await this.web.getContext().routeFromHAR((0, projectPaths_1.projectPath)(this.config.projectRoot || process.cwd(), data.file), { url: data.url, notFound: data.notFound, update: false });
+                return;
+            }
+            throw new Error(`Unknown HAR action: ${action}. Enable har in configuration before browser creation to record.`);
+        }
+        throw new Error(`Unknown native command: flow.${command}`);
+    }
+    async captureDOM(step) {
+        if (!this.config.domSnapshots)
+            return;
+        const page = this.web.getPage();
+        // Saved HTML is diagnostic data. It is never injected into an executable frame.
+        const html = await page.content();
+        const file = (0, validation_1.evidencePath)(this.config, `${validation_1.name.parse(step)}-${(0, node_crypto_1.randomUUID)()}.dom.html`);
+        node_fs_1.default.writeFileSync(file, html, { mode: 0o600 });
+        return file;
+    }
+    async dispose() { this.assertionGeneration++; this.lastAssertion = undefined; await this.events.dispose(); await this.functions.dispose(); await this.components.dispose(); }
+}
+exports.NativeRuntime = NativeRuntime;

package/dist/native/validation.d.ts

@@ -0,0 +1,107 @@
+import { z } from 'zod';
+import type { BrowserContextOptions } from 'playwright';
+import type { FlowstrideConfig } from '../types';
+export declare const name: z.ZodString;
+export declare const positive: z.ZodNumber;
+export declare const headers: z.ZodRecord<z.ZodString, z.ZodString>;
+export declare const contextOptions: z.ZodObject<{
+    acceptDownloads: z.ZodOptional<z.ZodBoolean>;
+    strictSelectors: z.ZodOptional<z.ZodBoolean>;
+    clientCertificates: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        origin: z.ZodString;
+        certPath: z.ZodOptional<z.ZodString>;
+        keyPath: z.ZodOptional<z.ZodString>;
+        pfxPath: z.ZodOptional<z.ZodString>;
+        passphrase: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    storageState: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        cookies: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+            domain: z.ZodString;
+            path: z.ZodString;
+            expires: z.ZodNumber;
+            httpOnly: z.ZodBoolean;
+            secure: z.ZodBoolean;
+            sameSite: z.ZodEnum<{
+                Strict: "Strict";
+                Lax: "Lax";
+                None: "None";
+            }>;
+        }, z.core.$strict>>;
+        origins: z.ZodArray<z.ZodObject<{
+            origin: z.ZodString;
+            localStorage: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strict>>;
+            indexedDB: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>>;
+    baseURL: z.ZodOptional<z.ZodString>;
+    bypassCSP: z.ZodOptional<z.ZodBoolean>;
+    colorScheme: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        light: "light";
+        dark: "dark";
+        "no-preference": "no-preference";
+    }>>>;
+    contrast: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        "no-preference": "no-preference";
+        more: "more";
+    }>>>;
+    deviceScaleFactor: z.ZodOptional<z.ZodNumber>;
+    extraHTTPHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    forcedColors: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        none: "none";
+        active: "active";
+    }>>>;
+    hasTouch: z.ZodOptional<z.ZodBoolean>;
+    httpCredentials: z.ZodOptional<z.ZodObject<{
+        username: z.ZodString;
+        password: z.ZodString;
+        origin: z.ZodOptional<z.ZodString>;
+        send: z.ZodOptional<z.ZodEnum<{
+            always: "always";
+            unauthorized: "unauthorized";
+        }>>;
+    }, z.core.$strict>>;
+    geolocation: z.ZodOptional<z.ZodObject<{
+        latitude: z.ZodNumber;
+        longitude: z.ZodNumber;
+        accuracy: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    ignoreHTTPSErrors: z.ZodOptional<z.ZodBoolean>;
+    isMobile: z.ZodOptional<z.ZodBoolean>;
+    javaScriptEnabled: z.ZodOptional<z.ZodBoolean>;
+    locale: z.ZodOptional<z.ZodString>;
+    offline: z.ZodOptional<z.ZodBoolean>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    proxy: z.ZodOptional<z.ZodObject<{
+        server: z.ZodString;
+        bypass: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        password: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    reducedMotion: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        reduce: "reduce";
+        "no-preference": "no-preference";
+    }>>>;
+    screen: z.ZodOptional<z.ZodObject<{
+        width: z.ZodNumber;
+        height: z.ZodNumber;
+    }, z.core.$strict>>;
+    serviceWorkers: z.ZodOptional<z.ZodEnum<{
+        allow: "allow";
+        block: "block";
+    }>>;
+    timezoneId: z.ZodOptional<z.ZodString>;
+    userAgent: z.ZodOptional<z.ZodString>;
+    viewport: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        width: z.ZodNumber;
+        height: z.ZodNumber;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export declare function validateContextOptions(value: unknown, browser?: string, root?: string): BrowserContextOptions;
+export declare function evidencePath(config: FlowstrideConfig, file: string): string;
+export declare function readProjectFile(config: FlowstrideConfig, file: string, maxSize?: number): Buffer;
+export declare function poll(read: () => Promise<boolean>, timeout: number, label: string): Promise<void>;

package/dist/native/validation.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.contextOptions = exports.headers = exports.positive = exports.name = void 0;
+exports.validateContextOptions = validateContextOptions;
+exports.evidencePath = evidencePath;
+exports.readProjectFile = readProjectFile;
+exports.poll = poll;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const zod_1 = require("zod");
+const projectPaths_1 = require("../utils/projectPaths");
+exports.name = zod_1.z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,79}$/, 'Use a simple name without path separators.');
+exports.positive = zod_1.z.number().int().min(1).max(2147483647);
+exports.headers = zod_1.z.record(zod_1.z.string(), zod_1.z.string());
+const size = zod_1.z.object({ width: exports.positive, height: exports.positive }).strict();
+// File-bearing options are handled explicitly; evidence paths cannot bypass project containment.
+exports.contextOptions = zod_1.z.object({
+    acceptDownloads: zod_1.z.boolean().optional(), strictSelectors: zod_1.z.boolean().optional(),
+    clientCertificates: zod_1.z.array(zod_1.z.object({ origin: zod_1.z.string().url(), certPath: zod_1.z.string().optional(), keyPath: zod_1.z.string().optional(), pfxPath: zod_1.z.string().optional(), passphrase: zod_1.z.string().optional() }).strict()).optional(),
+    storageState: zod_1.z.union([zod_1.z.string(), zod_1.z.object({ cookies: zod_1.z.array(zod_1.z.object({ name: zod_1.z.string(), value: zod_1.z.string(), domain: zod_1.z.string(), path: zod_1.z.string(), expires: zod_1.z.number(), httpOnly: zod_1.z.boolean(), secure: zod_1.z.boolean(), sameSite: zod_1.z.enum(['Strict', 'Lax', 'None']) }).strict()), origins: zod_1.z.array(zod_1.z.object({ origin: zod_1.z.string().url(), localStorage: zod_1.z.array(zod_1.z.object({ name: zod_1.z.string(), value: zod_1.z.string() }).strict()), indexedDB: zod_1.z.array(zod_1.z.unknown()).optional() }).strict()) }).strict()]).optional(),
+    baseURL: zod_1.z.string().url().optional(),
+    bypassCSP: zod_1.z.boolean().optional(), colorScheme: zod_1.z.enum(['light', 'dark', 'no-preference']).nullable().optional(),
+    contrast: zod_1.z.enum(['no-preference', 'more']).nullable().optional(),
+    deviceScaleFactor: zod_1.z.number().positive().optional(), extraHTTPHeaders: exports.headers.optional(),
+    forcedColors: zod_1.z.enum(['active', 'none']).nullable().optional(), hasTouch: zod_1.z.boolean().optional(),
+    httpCredentials: zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string(), origin: zod_1.z.string().url().optional(), send: zod_1.z.enum(['always', 'unauthorized']).optional() }).strict().optional(),
+    geolocation: zod_1.z.object({ latitude: zod_1.z.number().min(-90).max(90), longitude: zod_1.z.number().min(-180).max(180), accuracy: zod_1.z.number().nonnegative().optional() }).strict().optional(),
+    ignoreHTTPSErrors: zod_1.z.boolean().optional(), isMobile: zod_1.z.boolean().optional(), javaScriptEnabled: zod_1.z.boolean().optional(),
+    locale: zod_1.z.string().min(1).optional(), offline: zod_1.z.boolean().optional(), permissions: zod_1.z.array(zod_1.z.string()).optional(),
+    proxy: zod_1.z.object({ server: zod_1.z.string().min(1), bypass: zod_1.z.string().optional(), username: zod_1.z.string().optional(), password: zod_1.z.string().optional() }).strict().optional(),
+    reducedMotion: zod_1.z.enum(['reduce', 'no-preference']).nullable().optional(), screen: size.optional(),
+    serviceWorkers: zod_1.z.enum(['allow', 'block']).optional(), timezoneId: zod_1.z.string().optional(),
+    userAgent: zod_1.z.string().optional(), viewport: size.nullable().optional(),
+}).strict();
+function validateContextOptions(value, browser = 'chromium', root = process.cwd()) {
+    const parsed = exports.contextOptions.parse(value ?? {});
+    if (typeof parsed.storageState === 'string')
+        parsed.storageState = (0, projectPaths_1.projectPath)(root, parsed.storageState);
+    for (const certificate of parsed.clientCertificates || [])
+        for (const key of ['certPath', 'keyPath', 'pfxPath'])
+            if (certificate[key])
+                certificate[key] = (0, projectPaths_1.projectPath)(root, certificate[key]);
+    if (browser === 'firefox' && parsed.isMobile)
+        throw new Error('Firefox does not support mobile emulation; use viewport and touch options instead.');
+    return parsed;
+}
+function evidencePath(config, file) {
+    const safe = exports.name.parse(file);
+    const root = config.projectRoot || process.cwd();
+    const dir = (0, projectPaths_1.projectPath)(root, config.artifactsDir || 'flowstride-artifacts');
+    node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    return (0, projectPaths_1.projectPath)(root, node_path_1.default.join(dir, (0, projectPaths_1.artifactPrefix)(config.testFile) + safe));
+}
+function readProjectFile(config, file, maxSize = 20 * 1024 * 1024) {
+    const absolute = (0, projectPaths_1.projectPath)(config.projectRoot || process.cwd(), file);
+    if (!node_fs_1.default.statSync(absolute).isFile() || node_fs_1.default.statSync(absolute).size > maxSize)
+        throw new Error('Fixture must be a regular project file within the size limit.');
+    return node_fs_1.default.readFileSync(absolute);
+}
+async function poll(read, timeout, label) {
+    const deadline = Date.now() + exports.positive.parse(timeout);
+    let last;
+    for (;;) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            throw new Error(`Assertion timed out: ${label}`, { cause: last });
+        let timer;
+        try {
+            const ok = await Promise.race([read(), new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('Read timed out')), remaining); })]);
+            if (ok)
+                return;
+        }
+        catch (error) {
+            last = error;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        await new Promise(resolve => setTimeout(resolve, Math.min(50, Math.max(0, deadline - Date.now()))));
+    }
+}

package/dist/parser/assertion_contract.d.ts

@@ -0,0 +1,12 @@
+export declare const expectationTypes: Set<string>;
+export declare const apiAssertionConditions: Set<string>;
+export declare function validateExpectationType(type: unknown): void;
+/** Templates are checked after interpolation; literal thresholds fail at parse time. */
+export declare function validateResponseTimeThreshold(value: unknown, allowTemplate?: boolean): number | undefined;
+export declare function validateApiAssertions(assertions: unknown): asserts assertions is {
+    condition: string;
+    value: string;
+}[];
+/** And remains limited to assertions and existing custom assertion plugins. */
+export declare const nativeAssertionCommands: Set<string>;
+export declare function isAssertionStep(action: string, payload: any): boolean;

package/dist/parser/assertion_contract.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeAssertionCommands = exports.apiAssertionConditions = exports.expectationTypes = void 0;
+exports.validateExpectationType = validateExpectationType;
+exports.validateResponseTimeThreshold = validateResponseTimeThreshold;
+exports.validateApiAssertions = validateApiAssertions;
+exports.isAssertionStep = isAssertionStep;
+exports.expectationTypes = new Set([
+    'status', 'responseTime', 'resBody', 'resHeader', 'cookie',
+    'visible', 'text', 'value', 'attribute', 'transcript',
+]);
+exports.apiAssertionConditions = new Set([
+    'equals', 'contains', 'to.be', 'to.not.be', 'is', 'is.not',
+    'type.of', 'format', 'matches', 'lessthan', 'greaterthan',
+    'length', 'length.greaterthan', 'length.lessthan',
+    'includes', 'does.not.include', 'has.key', 'does.not.have.key',
+    'is.empty', 'not.empty',
+]);
+function validateExpectationType(type) {
+    if (typeof type !== 'string' || !exports.expectationTypes.has(type)) {
+        throw new Error(`Unsupported flow.expect modifier: ${String(type)}.`);
+    }
+}
+/** Templates are checked after interpolation; literal thresholds fail at parse time. */
+function validateResponseTimeThreshold(value, allowTemplate = false) {
+    if (allowTemplate && typeof value === 'string' &&
+        /\{\{env\.[^}]+\}\}|(?:@|\$)(?:global\[[^\]]+\]|[a-zA-Z_]\w*)/.test(value))
+        return;
+    if ((typeof value !== 'string' && typeof value !== 'number') ||
+        (typeof value === 'string' && value.trim() === '')) {
+        throw new Error('API responseTime threshold must be a finite nonnegative number.');
+    }
+    const threshold = Number(value);
+    if (!Number.isFinite(threshold) || threshold < 0) {
+        throw new Error('API responseTime threshold must be a finite nonnegative number.');
+    }
+    return threshold;
+}
+function validateApiAssertions(assertions) {
+    if (!Array.isArray(assertions) || assertions.length === 0) {
+        throw new Error('API assertion requires at least one supported condition.');
+    }
+    for (const assertion of assertions) {
+        if (!assertion || !exports.apiAssertionConditions.has(assertion.condition)) {
+            throw new Error(`Unsupported API assertion condition: ${String(assertion?.condition)}.`);
+        }
+        if (!['is.empty', 'not.empty'].includes(assertion.condition) && typeof assertion.value !== 'string') {
+            throw new Error(`API assertion ${assertion.condition} requires an expected string.`);
+        }
+    }
+}
+/** And remains limited to assertions and existing custom assertion plugins. */
+exports.nativeAssertionCommands = new Set(['assert.that', 'network.expect', 'download.expect', 'stub.expect', 'a11y.scan', 'a11y.match']);
+function isAssertionStep(action, payload) {
+    return action === 'expect' || action === 'plugin' || action === 'native' && exports.nativeAssertionCommands.has(payload?.pluginMethod);
+}

package/dist/parser/lexer.js

@@ -53,11 +53,22 @@ class Lexer {
                 let jsonStr = "";
                 let depth = 0;
                 let startLine = this.line;
+                let inString = false, escaped = false;
                 while (this.position < this.input.length) {
                     const c = this.input[this.position];
-                    if (c === "{")
+                    if (inString) {
+                        if (escaped)
+                            escaped = false;
+                        else if (c === "\\")
+                            escaped = true;
+                        else if (c === '"')
+                            inString = false;
+                    }
+                    else if (c === '"')
+                        inString = true;
+                    else if (c === "{")
                         depth++;
-                    if (c === "}")
+                    else if (c === "}")
                         depth--;
                     if (c === "\n")
                         this.line++;
@@ -217,7 +228,7 @@ class Lexer {
                         });
                         continue;
                     }
-                    else if (ident.includes(".") && !lowerIdent.startsWith("flow.")) {
+                    else if (/^flow\.(browser|assert|network|download|clock|stub|trace|har|a11y|component)\.[a-z]+$/i.test(ident) || (ident.includes(".") && !lowerIdent.startsWith("flow."))) {
                         tokens.push({
                             type: TokenType.ALIAS_COMMAND,
                             value: ident,
@@ -392,7 +403,7 @@ class Lexer {
                         line: this.line,
                     });
                 }
-                else if (ident.includes(".") && !lowerIdent.startsWith("flow.")) {
+                else if (/^flow\.(browser|assert|network|download|clock|stub|trace|har|a11y|component)\.[a-z]+$/i.test(ident) || (ident.includes(".") && !lowerIdent.startsWith("flow."))) {
                     tokens.push({
                         type: TokenType.ALIAS_COMMAND,
                         value: ident,

package/dist/parser/parser.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Parser = void 0;
+const assertion_contract_1 = require("./assertion_contract");
 const lexer_1 = require("./lexer");
 class Parser {
     tokens;
@@ -99,8 +100,8 @@ class Parser {
                 declarations.push(this.parseDeclaration());
             }
             else if (token.type === lexer_1.TokenType.BLOCK) {
-                if (isLocked)
-                    throw new Error(`Line ${token.line}: Terminal Lock Violation. No steps allowed after Then.`);
+                if (isLocked && token.value.toLowerCase().replace(/^stop\./, '') !== 'and')
+                    throw new Error(`Line ${token.line}: Terminal Lock Violation. Only assertion And blocks are allowed after Then.`);
                 const blockToken = this.advance();
                 let rawBlockType = blockToken.value.toLowerCase();
                 if (rawBlockType.startsWith("stop.")) {
@@ -149,7 +150,7 @@ class Parser {
             }
             else if (token.type === lexer_1.TokenType.COMMAND ||
                 token.type === lexer_1.TokenType.ALIAS_COMMAND) {
-                if (isLocked && currentBlockType !== "then") {
+                if (isLocked && currentBlockType !== "then" && currentBlockType !== "and") {
                     throw new Error(`Line ${token.line}: Terminal Lock Violation.`);
                 }
                 const step = this.parseCommand();
@@ -157,8 +158,7 @@ class Parser {
                     step.isStop = true;
                 }
                 if (currentBlockType === "and" &&
-                    step.action !== "expect" &&
-                    step.action !== "plugin") {
+                    !(0, assertion_contract_1.isAssertionStep)(step.action, step.payload)) {
                     throw new Error(`Line ${token.line}: And blocks are strictly for assertions or custom assertion plugins.`);
                 }
                 steps.push(step);
@@ -242,7 +242,7 @@ class Parser {
             return {
                 id: `scenario_${this.scenarioCounter}_S${this.stepCounter++}`,
                 blockDescription: this.currentBlockDescription,
-                action: "plugin",
+                action: alias === "flow" ? "native" : "plugin",
                 payload: {
                     pluginAlias: alias,
                     pluginMethod: method,
@@ -371,7 +371,13 @@ class Parser {
                 const viaToken = this.consume(lexer_1.TokenType.PREPOSITION, 'Expected "via"');
                 if (viaToken.value.toLowerCase() !== "via")
                     throw new Error(`Line ${viaToken.line}: Expected 'via'`);
-                payload.verb = this.consume(lexer_1.TokenType.COMMAND, "Expected API verb (e.g. POST)").value.toLowerCase();
+                payload.verb = this.consume(lexer_1.TokenType.COMMAND, "Expected API verb (e.g. POST)").value.toLowerCase().replace(/^flow\./, '');
+                if (!['get', 'post', 'put', 'patch', 'delete'].includes(payload.verb)) {
+                    throw new Error('Authentication refresh requires an HTTP verb: get, post, put, patch or delete.');
+                }
+                if (!['401', '403'].includes(payload.targetStatus)) {
+                    throw new Error('Authentication refresh status must be 401 or 403.');
+                }
                 payload.url = this.consume(lexer_1.TokenType.STRING, "Endpoint URL expected").value;
                 payload.headers = [];
                 this.parseApiModifiers(payload);
@@ -507,6 +513,7 @@ class Parser {
                 if (mod.toLowerCase() === "responsetime" && mod !== "responseTime") {
                     throw new Error(`Syntax Error on line ${modToken.line}: Invalid keyword '${mod}'. Flowstride uses strict camelCase. Did you mean 'responseTime'?`);
                 }
+                (0, assertion_contract_1.validateExpectationType)(mod);
                 payload.type = mod;
                 if (mod === "status") {
                     payload.statusCode = this.consume(lexer_1.TokenType.STRING, 'Status code expected (e.g., "200")').value;
@@ -517,6 +524,7 @@ class Parser {
                         throw new Error(`Line ${modToken.line}: Expected 'lessThan' after responseTime`);
                     }
                     payload.threshold = this.consume(lexer_1.TokenType.STRING, "Time threshold expected").value;
+                    (0, assertion_contract_1.validateResponseTimeThreshold)(payload.threshold, true);
                 }
                 else if (mod === "resBody" ||
                     mod === "resHeader" ||

package/dist/reporting/assertion_result.d.ts

@@ -0,0 +1,36 @@
+export type AssertionCheckStatus = 'passed' | 'failed' | 'not_evaluated' | 'running';
+export interface AssertionCheck {
+    key: string;
+    label: string;
+    status: AssertionCheckStatus;
+    expected?: string;
+    actual?: string;
+    reason?: string;
+    children?: AssertionCheck[];
+}
+export interface AssertionResult {
+    command: string;
+    target: string;
+    status: 'passed' | 'failed' | 'running' | 'not_evaluated';
+    checks: AssertionCheck[];
+    timeout?: number;
+    elapsed?: number;
+    reason?: string;
+    sourceFile?: string;
+    sourceLine?: number;
+    profile?: string;
+}
+export type AssertionReporter = (result: AssertionResult) => void;
+/** Diagnostic text is bounded data, including in terminals and exported reports. */
+export declare function diagnosticValue(value: unknown): string;
+export declare function assertionCheck(key: string, label: string, matched: boolean, expected?: unknown, actual?: unknown): AssertionCheck;
+export declare function assertionText(result: AssertionResult): string;
+export declare class AssertionFailure extends Error {
+    readonly assertion: AssertionResult;
+    constructor(assertion: AssertionResult);
+}
+export declare function reportAssertion(command: string, target: string, checks: AssertionCheck[], reporter?: AssertionReporter, metadata?: Partial<AssertionResult>): AssertionResult;
+export declare function requireAssertion(command: string, target: string, checks: AssertionCheck[], reporter?: AssertionReporter, metadata?: Partial<AssertionResult>): void;
+export declare function failedAssertion(result: AssertionResult | undefined, reason: string): AssertionResult | undefined;
+export declare function commandLabel(action: string, payload: any): string;
+export declare function unexecutedAssertion(action: string, payload: any, reason?: string): AssertionResult | undefined;