micro-contracts 0.9.0

package/dist/guardrails/security.js

@@ -0,0 +1,181 @@
+/**
+ * Security consistency check for guardrails
+ *
+ * Verifies that security declarations in OpenAPI specs (x-auth, x-authz, x-middleware)
+ * have corresponding implementations.
+ */
+import fs from 'fs';
+import path from 'path';
+import yaml from 'js-yaml';
+import { glob } from 'glob';
+/**
+ * Extract exported function names from TypeScript files
+ */
+export async function getImplementedOverlays(overlayDir) {
+    const implemented = new Set();
+    if (!fs.existsSync(overlayDir)) {
+        return implemented;
+    }
+    const files = await glob('**/*.ts', { cwd: overlayDir });
+    for (const file of files) {
+        const fullPath = path.join(overlayDir, file);
+        const content = fs.readFileSync(fullPath, 'utf-8');
+        // Extract exported function names
+        const exportMatches = content.matchAll(/export\s+(?:async\s+)?function\s+(\w+)/g);
+        for (const match of exportMatches) {
+            implemented.add(match[1]);
+        }
+        // Also check for exported const functions
+        const constMatches = content.matchAll(/export\s+const\s+(\w+)\s*=/g);
+        for (const match of constMatches) {
+            implemented.add(match[1]);
+        }
+    }
+    return implemented;
+}
+/**
+ * Check a single OpenAPI spec for security consistency
+ */
+export function checkSecurityConsistency(specPath, spec, implementedOverlays) {
+    const issues = [];
+    for (const [pathKey, pathItem] of Object.entries(spec.paths)) {
+        for (const method of ['get', 'post', 'put', 'patch', 'delete']) {
+            const operation = pathItem[method];
+            if (!operation)
+                continue;
+            // Check x-auth requirement
+            const xAuth = operation['x-auth'];
+            if (xAuth === 'required') {
+                // Should have requireAuth in middleware
+                const middlewares = operation['x-middleware'] || [];
+                if (!middlewares.includes('requireAuth') && !implementedOverlays.has('requireAuth')) {
+                    // Only warn if requireAuth is not implemented at all
+                    // The check is more lenient - just verify the middleware exists
+                }
+            }
+            // Check all declared middlewares are implemented
+            const middlewares = operation['x-middleware'] || [];
+            for (const mw of middlewares) {
+                if (!implementedOverlays.has(mw)) {
+                    issues.push({
+                        spec: specPath,
+                        path: pathKey,
+                        method: method.toUpperCase(),
+                        issue: `Middleware "${mw}" declared but not implemented`,
+                    });
+                }
+            }
+            // Check x-authz scopes (if requireAuth is used, should have x-auth: required)
+            const xAuthz = operation['x-authz'];
+            if (xAuthz && xAuthz.length > 0) {
+                if (!xAuth || xAuth === 'none') {
+                    issues.push({
+                        spec: specPath,
+                        path: pathKey,
+                        method: method.toUpperCase(),
+                        issue: `Has x-authz scopes but x-auth is not "required"`,
+                    });
+                }
+            }
+        }
+    }
+    return issues;
+}
+/**
+ * Find overlay implementation directories
+ */
+export async function findOverlayDirs() {
+    const dirs = [];
+    // Check common locations
+    const candidates = [
+        'server/src/_shared/overlays',
+        'server/src/core/overlays',
+        'src/_shared/overlays',
+        'src/overlays',
+    ];
+    for (const candidate of candidates) {
+        if (fs.existsSync(candidate)) {
+            dirs.push(candidate);
+        }
+    }
+    // Also find module-specific overlays
+    const moduleOverlays = await glob('server/src/*/overlays', { nodir: false });
+    dirs.push(...moduleOverlays.filter(d => fs.existsSync(d)));
+    return [...new Set(dirs)];
+}
+/**
+ * Run security consistency check
+ */
+export async function runSecurityCheck(options) {
+    const start = Date.now();
+    try {
+        // Find overlay implementations
+        const overlayDirs = await findOverlayDirs();
+        const implementedOverlays = new Set();
+        for (const dir of overlayDirs) {
+            const overlays = await getImplementedOverlays(dir);
+            for (const overlay of overlays) {
+                implementedOverlays.add(overlay);
+            }
+        }
+        if (implementedOverlays.size === 0) {
+            return {
+                name: 'security',
+                status: 'skip',
+                duration: Date.now() - start,
+                message: 'No overlay implementations found',
+            };
+        }
+        // Find OpenAPI specs
+        const specFiles = await glob('spec/**/openapi/*.yaml', {
+            ignore: ['**/*.overlay.yaml'],
+        });
+        if (specFiles.length === 0) {
+            return {
+                name: 'security',
+                status: 'skip',
+                duration: Date.now() - start,
+                message: 'No OpenAPI specs found',
+            };
+        }
+        const allIssues = [];
+        for (const specFile of specFiles) {
+            try {
+                const content = fs.readFileSync(specFile, 'utf-8');
+                const spec = yaml.load(content);
+                if (!spec || !spec.paths)
+                    continue;
+                const issues = checkSecurityConsistency(specFile, spec, implementedOverlays);
+                allIssues.push(...issues);
+            }
+            catch {
+                // Skip files that can't be parsed
+            }
+        }
+        if (allIssues.length > 0) {
+            const details = allIssues.map(i => `  ${i.spec} - ${i.method} ${i.path}: ${i.issue}`);
+            return {
+                name: 'security',
+                status: 'fail',
+                duration: Date.now() - start,
+                message: `${allIssues.length} security consistency issue(s)`,
+                details,
+            };
+        }
+        return {
+            name: 'security',
+            status: 'pass',
+            duration: Date.now() - start,
+            message: `Security declarations verified (${implementedOverlays.size} overlays, ${specFiles.length} specs)`,
+        };
+    }
+    catch (error) {
+        return {
+            name: 'security',
+            status: 'fail',
+            duration: Date.now() - start,
+            message: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+//# sourceMappingURL=security.js.map

package/dist/guardrails/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/guardrails/security.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAW5B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAkB;IAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAEzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEnD,kCAAkC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;QAClF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QAED,0CAA0C;QAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;QACrE,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,IAAiB,EACjB,mBAAgC;IAEhC,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,EAAE,CAAC;YACxE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAIhC,CAAC;YACF,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,2BAA2B;YAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;gBACzB,wCAAwC;gBACxC,MAAM,WAAW,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBACpD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;oBACpF,qDAAqD;oBACrD,gEAAgE;gBAClE,CAAC;YACH,CAAC;YAED,iDAAiD;YACjD,MAAM,WAAW,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACpD,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;gBAC7B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;wBAC5B,KAAK,EAAE,eAAe,EAAE,gCAAgC;qBACzD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,8EAA8E;YAC9E,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;wBAC5B,KAAK,EAAE,iDAAiD;qBACzD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,yBAAyB;IACzB,MAAM,UAAU,GAAG;QACjB,6BAA6B;QAC7B,0BAA0B;QAC1B,sBAAsB;QACtB,cAAc;KACf,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAqB;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,IAAI,CAAC;QACH,+BAA+B;QAC/B,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;QAC5C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE9C,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,IAAI,mBAAmB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC5B,OAAO,EAAE,kCAAkC;aAC5C,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE;YACrD,MAAM,EAAE,CAAC,mBAAmB,CAAC;SAC9B,CAAC,CAAC;QAEH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC5B,OAAO,EAAE,wBAAwB;aAClC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAoB,EAAE,CAAC;QAEtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgB,CAAC;gBAE/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;oBAAE,SAAS;gBAEnC,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;gBAC7E,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAChC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAClD,CAAC;YAEF,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC5B,OAAO,EAAE,GAAG,SAAS,CAAC,MAAM,gCAAgC;gBAC5D,OAAO;aACR,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC5B,OAAO,EAAE,mCAAmC,mBAAmB,CAAC,IAAI,cAAc,SAAS,CAAC,MAAM,SAAS;SAC5G,CAAC;IAEJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC5B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/guardrails/typecheck.d.ts

@@ -0,0 +1,15 @@
+/**
+ * TypeScript type check for guardrails
+ *
+ * Runs tsc --noEmit to verify TypeScript compilation.
+ */
+import type { CheckResult, CheckOptions } from './types.js';
+/**
+ * Find tsconfig.json files
+ */
+export declare function findTsConfigs(baseDir?: string): string[];
+/**
+ * Run TypeScript type check
+ */
+export declare function runTypecheckCheck(options: CheckOptions): Promise<CheckResult>;
+//# sourceMappingURL=typecheck.d.ts.map

package/dist/guardrails/typecheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typecheck.d.ts","sourceRoot":"","sources":["../../src/guardrails/typecheck.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5D;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,MAAY,GAAG,MAAM,EAAE,CAmB7D;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA2EnF"}

package/dist/guardrails/typecheck.js

@@ -0,0 +1,104 @@
+/**
+ * TypeScript type check for guardrails
+ *
+ * Runs tsc --noEmit to verify TypeScript compilation.
+ */
+import { execSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+/**
+ * Find tsconfig.json files
+ */
+export function findTsConfigs(baseDir = '.') {
+    const configs = [];
+    // Check common locations
+    const candidates = [
+        'tsconfig.json',
+        'packages/contract/tsconfig.json',
+        'server/tsconfig.json',
+        'frontend/tsconfig.json',
+    ];
+    for (const candidate of candidates) {
+        const fullPath = path.join(baseDir, candidate);
+        if (fs.existsSync(fullPath)) {
+            configs.push(fullPath);
+        }
+    }
+    return configs;
+}
+/**
+ * Run TypeScript type check
+ */
+export async function runTypecheckCheck(options) {
+    const start = Date.now();
+    try {
+        // Find tsconfig files
+        const tsconfigs = findTsConfigs();
+        if (tsconfigs.length === 0) {
+            return {
+                name: 'typecheck',
+                status: 'skip',
+                duration: Date.now() - start,
+                message: 'No tsconfig.json found',
+            };
+        }
+        const errors = [];
+        let hasErrors = false;
+        for (const tsconfig of tsconfigs) {
+            try {
+                // Run tsc --noEmit
+                execSync(`npx tsc --noEmit -p "${tsconfig}"`, {
+                    encoding: 'utf8',
+                    stdio: ['pipe', 'pipe', 'pipe'],
+                });
+            }
+            catch (error) {
+                hasErrors = true;
+                if (error && typeof error === 'object' && 'stdout' in error) {
+                    const output = error.stdout;
+                    if (output) {
+                        errors.push(`${tsconfig}:`);
+                        // Parse tsc output for specific errors
+                        const lines = output.split('\n').filter(line => line.includes('error TS'));
+                        for (const line of lines.slice(0, 10)) { // Limit to first 10 errors
+                            errors.push(`  ${line.trim()}`);
+                        }
+                        if (lines.length > 10) {
+                            errors.push(`  ... and ${lines.length - 10} more errors`);
+                        }
+                    }
+                }
+                else if (error && typeof error === 'object' && 'stderr' in error) {
+                    const stderr = error.stderr;
+                    if (stderr) {
+                        errors.push(`${tsconfig}: ${stderr.trim()}`);
+                    }
+                }
+            }
+        }
+        if (hasErrors) {
+            return {
+                name: 'typecheck',
+                status: 'fail',
+                duration: Date.now() - start,
+                message: `Type errors in ${errors.length > 0 ? 'config(s)' : 'project'}`,
+                details: errors,
+            };
+        }
+        return {
+            name: 'typecheck',
+            status: 'pass',
+            duration: Date.now() - start,
+            message: `${tsconfigs.length} project(s) passed type check`,
+        };
+    }
+    catch (error) {
+        return {
+            name: 'typecheck',
+            status: 'fail',
+            duration: Date.now() - start,
+            message: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+//# sourceMappingURL=typecheck.js.map

package/dist/guardrails/typecheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typecheck.js","sourceRoot":"","sources":["../../src/guardrails/typecheck.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAGxB;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,GAAG;IACjD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,yBAAyB;IACzB,MAAM,UAAU,GAAG;QACjB,eAAe;QACf,iCAAiC;QACjC,sBAAsB;QACtB,wBAAwB;KACzB,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAqB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,IAAI,CAAC;QACH,sBAAsB;QACtB,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAElC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC5B,OAAO,EAAE,wBAAwB;aAClC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,mBAAmB;gBACnB,QAAQ,CAAC,wBAAwB,QAAQ,GAAG,EAAE;oBAC5C,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;oBAC5D,MAAM,MAAM,GAAI,KAA4B,CAAC,MAAM,CAAC;oBACpD,IAAI,MAAM,EAAE,CAAC;wBACX,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;wBAC5B,uCAAuC;wBACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;wBAC3E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,2BAA2B;4BAClE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAClC,CAAC;wBACD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;4BACtB,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,MAAM,GAAG,EAAE,cAAc,CAAC,CAAC;wBAC5D,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;oBACnE,MAAM,MAAM,GAAI,KAA4B,CAAC,MAAM,CAAC;oBACpD,IAAI,MAAM,EAAE,CAAC;wBACX,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC5B,OAAO,EAAE,kBAAkB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE;gBACxE,OAAO,EAAE,MAAM;aAChB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC5B,OAAO,EAAE,GAAG,SAAS,CAAC,MAAM,+BAA+B;SAC5D,CAAC;IAEJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC5B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/guardrails/types.d.ts

@@ -0,0 +1,196 @@
+/**
+ * Guardrails type definitions
+ *
+ * These types define the structure for AI-driven development guardrails
+ * that protect generated artifacts and enforce change policies.
+ */
+/**
+ * Guardrails configuration file structure (guardrails.yaml)
+ */
+export interface GuardrailsConfig {
+    /**
+     * Paths that can be edited in normal development PRs
+     * Supports glob patterns and negation (prefix with !)
+     */
+    allowed?: string[];
+    /**
+     * Paths that require special approval (e.g., security config, CI)
+     * Supports glob patterns and negation (prefix with !)
+     */
+    protected?: string[];
+    /**
+     * Paths for generated artifacts (committed but only modified via generate)
+     * Supports glob patterns and negation (prefix with !)
+     */
+    generated?: string[];
+    /**
+     * Check command configurations
+     * Define custom commands for each guardrail check
+     */
+    checks?: ChecksConfig;
+}
+/**
+ * Configuration for guardrail check commands
+ */
+export interface ChecksConfig {
+    /** Lint check configuration */
+    lint?: CheckCommandConfig;
+    /** TypeScript type check configuration */
+    typecheck?: CheckCommandConfig;
+    /** Documentation check configuration */
+    docs?: CheckCommandConfig;
+    /** Additional custom checks */
+    [key: string]: CheckCommandConfig | undefined;
+}
+/**
+ * Gate numbers for guardrail checks
+ *
+ * Gate 1: Change Allowlist (allowlist)
+ * Gate 2: OpenAPI Contract Validation (spec-lint, spec-breaking)
+ * Gate 3: Generated Artifact Integrity (drift, manifest)
+ * Gate 4: Code Quality (code-lint, code-typecheck, code-test)
+ * Gate 5: Doc Consistency & Static Analysis (docs-sync, docs-links, security)
+ */
+export type GateNumber = 1 | 2 | 3 | 4 | 5;
+/**
+ * Configuration for a single check command
+ */
+export interface CheckCommandConfig {
+    /**
+     * Command template to run.
+     * Supports placeholders:
+     * - {files} - space-separated list of target files (auto-detected)
+     * - {cwd} - current working directory
+     *
+     * @example
+     * command: "npx @stoplight/spectral-cli lint {files} --ruleset spec/spectral.yaml"
+     */
+    command: string;
+    /**
+     * Whether this check is enabled (default: true)
+     */
+    enabled?: boolean;
+    /**
+     * Gate number this check belongs to (1-5)
+     * Used with --gate option to run checks by gate
+     *
+     * Gate 1: Change Allowlist
+     * Gate 2: OpenAPI Contract Validation
+     * Gate 3: Generated Artifact Integrity
+     * Gate 4: Code Quality
+     * Gate 5: Doc Consistency & Static Analysis
+     */
+    gate?: GateNumber;
+}
+/**
+ * Result of allowlist verification
+ */
+export interface AllowlistResult {
+    valid: boolean;
+    violations: AllowlistViolation[];
+}
+/**
+ * A single allowlist violation
+ */
+export interface AllowlistViolation {
+    file: string;
+    reason: 'protected' | 'not-in-allowlist';
+}
+/**
+ * Result of drift check
+ */
+export interface DriftResult {
+    valid: boolean;
+    changedFiles: string[];
+    error?: string;
+}
+/**
+ * Generated artifact manifest structure
+ */
+export interface GeneratedManifest {
+    /** Manifest format version */
+    version: string;
+    /** Timestamp when manifest was generated */
+    generatedAt: string;
+    /** Version of micro-contracts that generated this */
+    generatorVersion: string;
+    /** Map of relative file paths to their metadata */
+    files: Record<string, GeneratedFileInfo>;
+}
+/**
+ * Metadata for a single generated file
+ */
+export interface GeneratedFileInfo {
+    /** SHA-256 hash of file content */
+    sha256: string;
+    /** Source file that generated this (e.g., OpenAPI spec path) */
+    source?: string;
+}
+/**
+ * Result of manifest verification
+ */
+export interface ManifestResult {
+    valid: boolean;
+    mismatches: ManifestMismatch[];
+    manifestPath?: string;
+}
+/**
+ * A single manifest mismatch
+ */
+export interface ManifestMismatch {
+    file: string;
+    reason: 'missing' | 'hash-mismatch' | 'extra';
+    expected?: string;
+    actual?: string;
+}
+/**
+ * Options for check command
+ */
+export interface CheckOptions {
+    /** Run specific checks only */
+    only?: string[];
+    /** Skip specific checks */
+    skip?: string[];
+    /** Run checks for specific gates only (1-5) */
+    gates?: GateNumber[];
+    /** Enable verbose output */
+    verbose?: boolean;
+    /** Enable auto-fix where possible */
+    fix?: boolean;
+    /** Path to guardrails.yaml */
+    guardrailsPath?: string;
+    /** Path to generated files directory */
+    generatedDir?: string;
+    /** File containing list of changed files (for CI) */
+    changedFilesPath?: string;
+}
+/**
+ * Result of a single check
+ */
+export interface CheckResult {
+    name: string;
+    status: 'pass' | 'fail' | 'skip';
+    duration: number;
+    message?: string;
+    details?: string[];
+}
+/**
+ * Overall check summary
+ */
+export interface CheckSummary {
+    passed: number;
+    failed: number;
+    skipped: number;
+    results: CheckResult[];
+}
+/**
+ * Check definition
+ */
+export interface CheckDefinition {
+    name: string;
+    description: string;
+    /** Gate number this check belongs to (1-5) */
+    gate?: GateNumber;
+    run: (options: CheckOptions) => Promise<CheckResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/guardrails/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/guardrails/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,0CAA0C;IAC1C,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,wCAAwC;IACxC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,+BAA+B;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;CAC/C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE3C;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,kBAAkB,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,GAAG,kBAAkB,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,eAAe,GAAG,OAAO,CAAC;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qCAAqC;IACrC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACtD"}

package/dist/guardrails/types.js

@@ -0,0 +1,8 @@
+/**
+ * Guardrails type definitions
+ *
+ * These types define the structure for AI-driven development guardrails
+ * that protect generated artifacts and enforce change policies.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/guardrails/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/guardrails/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * API Framework
+ * OpenAPI-first API framework with code generation for Fastify
+ */
+export * from './types.js';
+export * from './generator/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+/**
+ * API Framework
+ * OpenAPI-first API framework with code generation for Fastify
+ */
+export * from './types.js';
+export * from './generator/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,sBAAsB,CAAC"}