motionspec 1.0.3 → 1.0.5

package/bin/sbom-check.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+"use strict";
+/*
+ * SBOM-Werkzeug (TASK-021, Audit-Befund #13). Zero-dep, CJS.
+ *
+ * Hintergrund: `npm sbom --omit dev` laesst hier 9 Laufzeit-Pakete aus
+ * (cross-spawn, debug, ms, which, isexe, path-key, shebang-command,
+ * shebang-regex, fast-deep-equal) — sie haengen am Prod-Baum von
+ * @modelcontextprotocol/sdk, werden aber, weil sie ZUSAETZLICH ueber einen
+ * dev-Pfad (eslint) erreichbar sind, von npm faelschlich weggeschnitten. Das
+ * Lizenz-Gate war dadurch lueckenhaft. Gleichzeitig darf die SBOM keine reinen
+ * dev-Pakete (wrangler/eslint/…) enthalten, weil deren Lizenzen das Gate sonst
+ * (zu Recht) rot faerben und nicht ausgeliefert werden.
+ *
+ * Loesung: die VOLLE SBOM erzeugen und auf die LAUFZEIT-Pakete filtern
+ * (Quelle der Wahrheit: package-lock.json, top-level node_modules/* mit
+ * dev!==true). Das ergibt eine vollstaendige UND ausschliesslich-Laufzeit-SBOM.
+ *
+ * Modi:
+ *   --filter   liest eine volle CycloneDX-SBOM von stdin, schreibt die
+ *              Laufzeit-gefilterte SBOM nach stdout (genutzt vom `sbom`-Script).
+ *   (default)  prueft sbom.cdx.json: jedes Laufzeit-Paket MUSS als Komponente
+ *              vorhanden sein; fehlt eines -> Liste + exit 1, sonst exit 0.
+ */
+const fs = require("fs");
+const path = require("path");
+
+const ROOT = path.join(__dirname, "..");
+const LOCK = path.join(ROOT, "package-lock.json");
+const SBOM = path.join(ROOT, "sbom.cdx.json");
+
+/* Laufzeit-Pakete laut Lockfile: top-level node_modules/<name>, dev !== true.
+ * Liefert ein Set voller Namen (inkl. @scope). */
+function runtimeNames() {
+  const lock = JSON.parse(fs.readFileSync(LOCK, "utf8"));
+  const names = new Set();
+  for (const key of Object.keys(lock.packages || {})) {
+    const m = /^node_modules\/(@[^/]+\/[^/]+|[^/]+)$/.exec(key);
+    if (!m) continue;                       // nur top-level (keine verschachtelten Dubletten)
+    if (lock.packages[key].dev === true) continue;  // reine dev-Pakete weglassen
+    names.add(m[1]);
+  }
+  return names;
+}
+
+/* Voller Name einer CycloneDX-Komponente (npm legt @scope direkt in name, aber
+ * group wird defensiv mitgenommen, falls ein Generator es doch trennt). */
+function compName(c) {
+  return c.group ? c.group + "/" + c.name : c.name;
+}
+
+function readStdin() {
+  return fs.readFileSync(0, "utf8");
+}
+
+function filterMode() {
+  const full = JSON.parse(readStdin());
+  const runtime = runtimeNames();
+  const keep = (full.components || []).filter((c) => runtime.has(compName(c)));
+  const keptRefs = new Set(keep.map((c) => c["bom-ref"]).filter(Boolean));
+  full.components = keep;
+  /* Abhaengigkeits-Graph auf behaltene Komponenten beschneiden, damit keine
+   * baumelnden Referenzen zurueckbleiben (die Wurzel-Komponente bleibt). */
+  if (Array.isArray(full.dependencies)) {
+    const rootRef = full.metadata && full.metadata.component && full.metadata.component["bom-ref"];
+    full.dependencies = full.dependencies
+      .filter((d) => d.ref === rootRef || keptRefs.has(d.ref))
+      .map((d) => Array.isArray(d.dependsOn)
+        ? Object.assign({}, d, { dependsOn: d.dependsOn.filter((r) => r === rootRef || keptRefs.has(r)) })
+        : d);
+  }
+  process.stdout.write(JSON.stringify(full, null, 2) + "\n");
+}
+
+function checkMode() {
+  if (!fs.existsSync(SBOM)) { console.error("Keine sbom.cdx.json — erst `npm run sbom`."); process.exit(1); }
+  const sbom = JSON.parse(fs.readFileSync(SBOM, "utf8"));
+  const present = new Set((sbom.components || []).map(compName));
+  const missing = [...runtimeNames()].filter((n) => !present.has(n)).sort();
+  if (missing.length) {
+    console.error("SBOM unvollstaendig — " + missing.length + " Laufzeit-Paket(e) fehlen:");
+    missing.forEach((n) => console.error("  - " + n));
+    console.error("Fix: `npm run sbom` neu erzeugen (vollstaendige Laufzeit-SBOM).");
+    process.exit(1);
+  }
+  console.error("SBOM OK — alle " + present.size + " Komponenten decken die Laufzeit-Pakete ab.");
+}
+
+if (process.argv.includes("--filter")) filterMode();
+else checkMode();

package/bin/worker-smoke.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+"use strict";
+/*
+ * worker-smoke.js — Post-Deploy-Smoke fuer den motionspec-mcp Worker.
+ * ------------------------------------------------------------------
+ * Der Worker ist "all private": ALLE Routen ausser /dashboard sitzen hinter dem
+ * Key-Gate (worker/index.mjs). Daher zwei Modi:
+ *
+ *   - Mit Key (env MOTIONSPEC_KEY oder MCP_SHARED_SECRET): GET /health mit
+ *     Header x-motionspec-key. Verlangt 200 + ok:true und prueft catalogVersion
+ *     gegen den lokalen Pin (Byte-Identitaet local==hosted, vgl. CLAUDE.md).
+ *
+ *   - Ohne Key: ungated Liveness gegen /dashboard (HTML 200). Reicht als
+ *     Post-Deploy-Lebenszeichen; der Catalog-Pin wird dann NICHT geprueft und
+ *     das ausdruecklich vermerkt.
+ *
+ * Idempotent: nur read-only GETs, kein State. Exit 1 bei jedem Mismatch.
+ * Ziel-URL ueberschreibbar via WORKER_URL (Default = Hosted Prod).
+ */
+const SECRET_HEADER = "x-motionspec-key";
+const BASE = (process.env.WORKER_URL || "https://motionspec-mcp.froeba-kevin.workers.dev")
+  .replace(/\/+$/, "");
+const KEY = process.env.MOTIONSPEC_KEY || process.env.MCP_SHARED_SECRET || "";
+
+function localCatalogPin() {
+  try {
+    // Lokaler Pin aus den primitives/ (loadCatalog) — derselbe Hash, den der
+    // Worker aus dem gebundelten Katalog rechnet (vgl. worker/index.mjs).
+    const { loadCatalog, catalogVersion } = require("../src/compiler/catalog.js");
+    return catalogVersion(loadCatalog());
+  } catch {
+    return null;
+  }
+}
+
+function fail(label, problems) {
+  console.error("Smoke FAIL — " + label + ":");
+  problems.forEach((p) => console.error("  - " + p));
+  process.exit(1);
+}
+
+async function gatedHealth() {
+  const url = BASE + "/health";
+  let res, body;
+  try {
+    res = await fetch(url, {
+      headers: { "user-agent": "motionspec-smoke", [SECRET_HEADER]: KEY },
+    });
+    body = await res.json();
+  } catch (e) {
+    fail(url, ["nicht erreichbar (" + e.message + ")"]);
+  }
+
+  const problems = [];
+  if (res.status !== 200) problems.push("HTTP " + res.status + " (erwartet 200)");
+  if (!body || body.ok !== true) problems.push("ok !== true im Body: " + JSON.stringify(body));
+
+  const pin = localCatalogPin();
+  if (pin && body && body.catalogVersion && body.catalogVersion !== pin) {
+    problems.push(
+      "catalogVersion hosted=" + body.catalogVersion + " != local=" + pin +
+      " (Engine NICHT byte-identisch)"
+    );
+  }
+  if (problems.length) fail(url, problems);
+
+  console.error(
+    "Smoke OK (gated /health) — " + url + " | version=" + body.version +
+    " catalogVersion=" + body.catalogVersion + " primitives=" + body.primitives
+  );
+}
+
+async function ungatedLiveness() {
+  const url = BASE + "/dashboard";
+  let res, text;
+  try {
+    res = await fetch(url, { headers: { "user-agent": "motionspec-smoke" } });
+    text = await res.text();
+  } catch (e) {
+    fail(url, ["nicht erreichbar (" + e.message + ")"]);
+  }
+
+  const problems = [];
+  if (res.status !== 200) problems.push("HTTP " + res.status + " (erwartet 200)");
+  const ct = res.headers.get("content-type") || "";
+  if (!/text\/html/i.test(ct)) problems.push("content-type nicht text/html: " + ct);
+  if (!text || !/<!doctype html|<html/i.test(text)) problems.push("kein HTML-Body");
+  if (problems.length) fail(url, problems);
+
+  console.error(
+    "Smoke OK (ungated /dashboard liveness) — " + url +
+    "\n  Hinweis: kein MOTIONSPEC_KEY/MCP_SHARED_SECRET gesetzt -> Catalog-Pin NICHT geprueft."
+  );
+}
+
+async function main() {
+  if (KEY) await gatedHealth();
+  else await ungatedLiveness();
+}
+
+main();

package/catalog.lock.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-06-15",
+  "generatedAt": "2026-06-29",
   "note": "Released catalog baseline for ADR-0001 D2 SemVer gate. Relock at release time.",
   "primitives": {
     "counterUp": {
@@ -70,6 +70,33 @@
         }
       }
     },
+    "floatLoop": {
+      "version": "1.0.0",
+      "output": "css",
+      "params": {
+        "axis": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": "^(x|y)$"
+        },
+        "distance": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": "^[0-9]*\\.?[0-9]+(px|rem|%)$"
+        },
+        "duration": {
+          "type": "number",
+          "required": false,
+          "min": 1,
+          "max": 10,
+          "pattern": null
+        }
+      }
+    },
     "marquee": {
       "version": "1.0.0",
       "output": "css",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "motionspec",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "mcpName": "io.github.MasterPlayspots/motionspec",
   "description": "MotionSpec — a formal intermediate language for scroll-driven web motion. A small model writes schema-validated specs; a deterministic compiler emits GSAP/CSS, hallucination-proof by construction with enforced reduced-motion fallbacks.",
   "license": "MIT",
@@ -21,7 +21,7 @@
     "type": "git",
     "url": "git+https://github.com/MasterPlayspots/motionspec.git"
   },
-  "homepage": "https://github.com/MasterPlayspots/motionspec#readme",
+  "homepage": "https://www.npmjs.com/package/motionspec",
   "bugs": {
     "url": "https://github.com/MasterPlayspots/motionspec/issues"
   },
@@ -38,10 +38,11 @@
     "catalog.lock.json"
   ],
   "scripts": {
-    "test": "node --test test/validate.test.js test/compile.test.js test/specversion-v1.test.js test/route.test.js test/route-live.test.js test/catalog-wave1.test.js test/catalog-semver.test.js test/schema-parity.test.js test/catalog-pin.test.js test/css-safety.test.js test/fuzz.test.js test/hardening.test.js test/cache.test.js test/errorcodes.test.js test/catalog-integrity.test.js test/discover.test.js test/telemetry-sink.test.js test/worker-contract.test.mjs test/analytics-engine-sink.test.mjs test/canary.test.mjs test/dashboard.test.mjs test/mcp.test.mjs test/cli-output.test.mjs",
+    "test": "node --test test/validate.test.js test/compile.test.js test/specversion-v1.test.js test/route.test.js test/route-live.test.js test/catalog-wave1.test.js test/catalog-semver.test.js test/schema-parity.test.js test/catalog-pin.test.js test/css-safety.test.js test/csstransition-validation.test.js test/safety-parity.test.js test/fuzz.test.js test/hardening.test.js test/cache.test.js test/errorcodes.test.js test/catalog-integrity.test.js test/discover.test.js test/telemetry-sink.test.js test/worker-contract.test.mjs test/worker-keys.test.mjs test/worker-abuse-alert.test.mjs test/worker-preauth-ratelimit.test.mjs test/analytics-engine-sink.test.mjs test/canary.test.mjs test/dashboard.test.mjs test/mcp.test.mjs test/cli-output.test.mjs test/waapi-lowering.test.js test/forge-prioritize.test.js test/forge-promote-gate.test.js test/forge-generate.test.js test/forge-workflow-guard.test.js test/canonical-guard.test.js",
     "coverage": "node --test --experimental-test-coverage --test-coverage-exclude=test/** --test-coverage-exclude=bin/** --test-coverage-lines=90 --test-coverage-functions=90 --test-coverage-branches=75 test/*.test.js test/*.test.mjs",
     "e2e": "playwright test",
-    "sbom": "npm sbom --sbom-format cyclonedx --omit dev > sbom.cdx.json",
+    "sbom": "npm sbom --sbom-format cyclonedx | node bin/sbom-check.js --filter > sbom.cdx.json",
+    "sbom:check": "node bin/sbom-check.js",
     "catalog-lock": "node bin/catalog-lock.js",
     "catalog-lock:check": "node bin/catalog-lock.js --check",
     "mcp": "node src/mcp/server.mjs",
@@ -51,20 +52,31 @@
     "pipeline": "node bin/motion.js pipeline",
     "catalog": "node bin/motion.js catalog",
     "stats": "node bin/motion.js stats",
-    "prepublishOnly": "npm test && npm run catalog-lock:check && npm run sbom && node bin/license-check.js",
-    "lint": "eslint ."
+    "assert-canonical": "node bin/assert-canonical.js",
+    "prepublishOnly": "npm run assert-canonical && npm test && npm run catalog-lock:check && npm run sbom && npm run sbom:check && node bin/license-check.js && node -e \"if(!require('fs').existsSync('CHANGELOG.md'))throw new Error('CHANGELOG.md fehlt')\"",
+    "predeploy:worker": "npm run assert-canonical",
+    "deploy:worker": "wrangler deploy",
+    "smoke:worker": "node bin/worker-smoke.js",
+    "release": "npm run assert-canonical && npm test && npm run catalog-lock:check && npm run sbom && npm run sbom:check && node bin/license-check.js && npm publish",
+    "release:worker": "npm run assert-canonical && npm run deploy:worker && npm run smoke:worker",
+    "lint": "eslint .",
+    "prepare": "husky"
   },
   "engines": {
     "node": ">=18"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.29.0",
-    "zod": "^4.4.3"
+    "zod": "4.4.3"
   },
   "devDependencies": {
+    "@commitlint/cli": "^21.0.2",
+    "@commitlint/config-conventional": "^21.0.2",
     "@eslint/js": "^10.0.1",
     "@playwright/test": "^1.50.0",
     "eslint": "^10.5.0",
-    "globals": "^17.6.0"
+    "globals": "^17.6.0",
+    "husky": "^9.1.7",
+    "wrangler": "4.105.0"
   }
 }

package/primitives/cssTransition.json

@@ -1,17 +1,19 @@
 {
   "name": "cssTransition",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "purpose": "Einfache Hover-Mikrointeraktion ganz ohne JavaScript.",
   "output": "css",
   "engine": "native-css",
   "paramSchema": {
     "property": {
       "type": "string",
-      "default": "transform"
+      "default": "transform",
+      "pattern": "^(transform|opacity|color|background-color|border-color|filter|width|height)$"
     },
     "hoverValue": {
       "type": "string",
-      "default": "translateY(-4px)"
+      "default": "translateY(-4px)",
+      "pattern": "^[A-Za-z0-9#%.,()-]+( [A-Za-z0-9#%.,()-]+)?( [A-Za-z0-9#%.,()-]+)?$"
     },
     "duration": {
       "type": "number",
@@ -21,7 +23,8 @@
     },
     "easing": {
       "type": "string",
-      "default": "ease-out"
+      "default": "ease-out",
+      "pattern": "^(ease|ease-in|ease-out|ease-in-out|linear|step-start|step-end|cubic-bezier\\([-0-9., ]{1,40}\\))$"
     }
   },
   "triggerDefaults": {},

package/primitives/floatLoop.json

@@ -0,0 +1,44 @@
+{
+  "name": "floatLoop",
+  "version": "1.0.0",
+  "purpose": "Sanftes, endloses Schweben dekorativer Elemente — kontinuierliche Loop-Bewegung entlang einer Achse (compositor-guenstig).",
+  "output": "css",
+  "engine": "native-css",
+  "paramSchema": {
+    "distance": {
+      "type": "string",
+      "default": "8px",
+      "pattern": "^[0-9]*\\.?[0-9]+(px|rem|%)$"
+    },
+    "duration": {
+      "type": "number",
+      "default": 3,
+      "min": 1,
+      "max": 10
+    },
+    "axis": {
+      "type": "string",
+      "default": "y",
+      "pattern": "^(x|y)$"
+    }
+  },
+  "triggerDefaults": {},
+  "performance": {
+    "verified": true,
+    "lcpSafe": true,
+    "cost": 1,
+    "verifiedAt": "2026-06-29"
+  },
+  "a11y": {
+    "reducedMotionFallback": "static"
+  },
+  "template": "{{css target}} { animation: motion-floatLoop-{{css id}} {{css params.duration}}s ease-in-out infinite alternate; }\n@keyframes motion-floatLoop-{{css id}} { from { transform: translate{{css params.axis}}(0) } to { transform: translate{{css params.axis}}(-{{css params.distance}}) } }",
+  "demo": {
+    "html": "<div class=\"float-box d-floatLoop\" style=\"display:inline-flex;align-items:center;justify-content:center;width:6rem;height:6rem;border:1px solid #8886;border-radius:14px\">FLOAT</div>",
+    "params": {
+      "distance": "10px",
+      "duration": 3,
+      "axis": "y"
+    }
+  }
+}

package/primitives/pinnedSection.json

@@ -1,13 +1,14 @@
 {
   "name": "pinnedSection",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "purpose": "Sektion fixieren, waehrend der Inhalt hindurchscrollt.",
   "output": "js",
   "engine": "gsap.ScrollTrigger",
   "paramSchema": {
     "distance": {
       "type": "string",
-      "default": "+=100%"
+      "default": "+=100%",
+      "pattern": "^\\+=[0-9]{1,6}(\\.[0-9]{1,3})?(px|%|vh|vw|em|rem)?$"
     },
     "pinSpacing": {
       "type": "boolean",

package/primitives/scrollReveal.json

@@ -1,6 +1,6 @@
 {
   "name": "scrollReveal",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "purpose": "Element blendet beim Eintritt in den Viewport ein.",
   "output": "js",
   "engine": "gsap.ScrollTrigger",
@@ -17,7 +17,8 @@
     },
     "ease": {
       "type": "string",
-      "default": "power3.out"
+      "default": "power3.out",
+      "pattern": "^[A-Za-z0-9.()]{1,40}$"
     },
     "stagger": {
       "type": "number",

package/primitives/staggerReveal.json

@@ -1,6 +1,6 @@
 {
   "name": "staggerReveal",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "purpose": "Mehrere Kind-Elemente gestaffelt nacheinander einblenden.",
   "output": "js",
   "engine": "gsap.ScrollTrigger",
@@ -17,7 +17,8 @@
     },
     "ease": {
       "type": "string",
-      "default": "power2.out"
+      "default": "power2.out",
+      "pattern": "^[A-Za-z0-9.()]{1,40}$"
     },
     "stagger": {
       "type": "number",

package/schema/motionspec.schema.json

@@ -35,9 +35,9 @@
         "additionalProperties": false,
         "required": ["id", "primitive", "target"],
         "properties": {
-          "id": { "type": "string", "minLength": 1 },
+          "id": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[A-Za-z0-9_-]{1,64}$" },
           "primitive": { "type": "string", "description": "Muss ein Name aus dem Primitive-Katalog sein. Allow-List, zur Laufzeit geprueft." },
-          "target": { "type": "string", "minLength": 1 },
+          "target": { "type": "string", "minLength": 1, "maxLength": 200 },
           "params": { "type": "object" },
           "trigger": {
             "type": "object",

package/src/compiler/catalog.js

@@ -91,4 +91,30 @@ function catalogVersion(catalog) {
   return crypto.createHash("sha256").update(stable).digest("hex").slice(0, 16);
 }
 
-module.exports = { loadCatalog, buildCatalog, catalogVersion, checkPrimitive };
+/* Gemeinsame Katalog-Zusammenfassung (TASK-026, Audit #23). Vorher gab es zwei
+ * divergierende Implementierungen (prompt.js 4 Felder, register-tools.js 8). Eine
+ * Quelle: Default sind alle 8 Felder; ein optionales fields-Subset liefert weniger
+ * (z.B. fuer einen schlankeren Prompt). Primitive nach Namen sortiert. */
+function catalogSummary(catalog, fields) {
+  const ALL = ["name", "version", "purpose", "engine", "cost", "paramSchema", "triggerDefaults", "reducedMotionFallback"];
+  const pick = Array.isArray(fields) ? fields : ALL;
+  return Object.keys(catalog).sort().map((name) => {
+    const p = catalog[name];
+    const full = {
+      name,
+      version: p.version,
+      purpose: p.purpose,
+      engine: p.engine,
+      cost: (p.performance && p.performance.cost) || 0,
+      paramSchema: p.paramSchema || {},
+      triggerDefaults: p.triggerDefaults || {},
+      reducedMotionFallback: (p.a11y && p.a11y.reducedMotionFallback) || null,
+    };
+    if (pick === ALL) return full;
+    const o = {};
+    pick.forEach((f) => { o[f] = full[f]; });
+    return o;
+  });
+}
+
+module.exports = { loadCatalog, buildCatalog, catalogVersion, checkPrimitive, catalogSummary, screenPattern };

package/src/compiler/compile.js

@@ -14,11 +14,13 @@
  *
  * Ablauf: Trust Boundary -> Defaults -> Templates -> Gates -> Report.
  */
-const { validateSpec, unsafeToken } = require("./validate.js");
+const { validateSpec } = require("./validate.js");
+/* CSS-Rohtext-Screening + Default-Fuellung kommen aus der geteilten Quelle
+ * (safety.js) — byte-identisch genutzt vom WAAPI-Lowering (lower-waapi.js). */
+const { cssRaw, withDefaults } = require("./safety.js");
 const VERSION = require("../../package.json").version;
 
 const BUDGET = 10; /* Performance-Budget: Summe der Primitiv-Kosten */
-const CSS_SAFE_RE = /^[A-Za-z0-9 _\-#.:,()>+~*=%[\]"|^$]{0,200}$/;
 
 function resolvePath(ctx, expr) {
   return expr.split(".").reduce(
@@ -33,14 +35,6 @@ function jsLiteral(v) {
   return JSON.stringify(v); /* Strings UND Objekte: immer korrekt escaped */
 }
 
-function cssRaw(v, expr) {
-  const s = String(v);
-  const bad = unsafeToken(s); /* defense in depth: never emit javascript:/expression(/url( ... */
-  if (bad || !CSS_SAFE_RE.test(s) || s.includes("/*") || s.includes("*/"))
-    throw new Error('CSS-Interpolation abgelehnt fuer "' + expr + '": Wert "' + s + '"' + (bad ? ' enthaelt gefaehrliches Token "' + bad + '"' : " verletzt die CSS-Allow-List") + ".");
-  return s;
-}
-
 function fill(tpl, ctx) {
   return tpl.replace(/\{\{([^}]+)\}\}/g, (_, raw) => {
     const expr = raw.trim();
@@ -52,20 +46,35 @@ function fill(tpl, ctx) {
   });
 }
 
-function withDefaults(schema, given) {
-  const out = {};
-  Object.keys(schema).forEach((k) => {
-    out[k] = given && Object.prototype.hasOwnProperty.call(given, k)
-      ? given[k]
-      : schema[k].default;
-  });
-  return out;
-}
-
-/*
- * compileSpec(spec, catalog, opts) -> {
- *   ok, errors?, js?, css?, report: { motions, jsCount, cssCount,
- *   cost, budget, budgetOk, reducedMotion } }
+/**
+ * @typedef {Object} CompileReport
+ * @property {number} motions - Anzahl kompilierter Motions
+ * @property {number} jsCount - Anzahl JS-Ausgaben
+ * @property {number} cssCount - Anzahl CSS-Ausgaben
+ * @property {number} cost - Summe der Primitiv-Kosten
+ * @property {number} budget - Performance-Budget (Default BUDGET)
+ * @property {boolean} budgetOk - true wenn cost <= budget
+ * @property {boolean} reducedMotion - ob ein prefers-reduced-motion-Guard emittiert wird
+ * @property {boolean} reducedMotionOverriddenOff - true wenn die Spec den Guard explizit abschaltet
+ * @property {string} specVersion - specVersion der Quelle
+ * @property {Array<{code:string,message:string}>} deprecations - Deprecation-Hinweise (ADR-0001 D4)
+ */
+/**
+ * @typedef {Object} CompileResult
+ * @property {boolean} ok - true bei Erfolg, false fail-closed (keine Teil-Ausgabe)
+ * @property {string[]} [errors] - Fehler mit [MS-XXX]-Praefix, nur wenn ok=false
+ * @property {string|null} [js] - generiertes JS (null wenn keine JS-Motions)
+ * @property {string|null} [css] - generiertes CSS (null wenn keine CSS-Motions)
+ * @property {CompileReport} [report] - Report, nur wenn ok=true
+ */
+/**
+ * Validiert (fail-closed) und kompiliert eine MotionSpec deterministisch zu GSAP/CSS.
+ * Dieselbe Spec ergibt immer denselben Code; bei Validierungs- oder CSS-Fehlern
+ * wird nichts emittiert.
+ * @param {Object} spec - die MotionSpec
+ * @param {Object} catalog - geladener Primitiv-Katalog
+ * @param {{specName?: string, budget?: number}} [opts] - optionaler Artefakt-Name + Budget
+ * @returns {CompileResult}
  */
 function compileSpec(spec, catalog, opts) {
   const o = opts || {};
@@ -77,7 +86,7 @@ function compileSpec(spec, catalog, opts) {
    * so validate-only callers and the compile report agree. */
   const deprecations = v.deprecations || [];
 
-  const respectRM = !!(spec.globals && spec.globals.respectReducedMotion);
+  const respectRM = !(spec.globals && spec.globals.respectReducedMotion === false);
   const js = [], css = [];
   let cost = 0, nJs = 0, nCss = 0;
 
@@ -140,10 +149,13 @@ function compileSpec(spec, catalog, opts) {
       budget,
       budgetOk: cost <= budget,
       reducedMotion: respectRM,
+      reducedMotionOverriddenOff: !!(spec.globals && spec.globals.respectReducedMotion === false),
       specVersion: spec.specVersion,
       deprecations,
     },
   };
 }
 
-module.exports = { compileSpec, fill, withDefaults, BUDGET };
+/* withDefaults/cssRaw werden aus safety.js re-exportiert, damit der Parity-Test
+ * die Referenz-Identitaet beider Paesse gegen die EINE Quelle pruefen kann. */
+module.exports = { compileSpec, fill, withDefaults, cssRaw, BUDGET };

package/src/compiler/keyword-map.js

@@ -0,0 +1,27 @@
+"use strict";
+/*
+ * Gemeinsame Keyword->Primitiv-Heuristik (TASK-025, Audit #22).
+ *
+ * Vorher gab es ZWEI divergierende Tabellen: clients.js (mockClient, 5 Eintraege,
+ * mit target/params) und discover.js (Gap-Report, 8 Eintraege, ohne target). Dadurch
+ * fehlten counterUp/marquee/scaleOnScroll im Mock — der Repair-Loop lief gegen ein
+ * kuenstlich unvollstaendiges Modell. Eine Quelle der Wahrheit schliesst die Luecke.
+ *
+ * Quelle der Regex/Reihenfolge ist discover.js (der vollstaendigere 8er-Satz);
+ * target/params der fuenf bekannten Primitive stammen aus clients.js, fuer die drei
+ * neuen sind sinnvolle Default-Selektoren gesetzt. WICHTIG: Reihenfolge ist API —
+ * discover.mapIntent() liefert den ERSTEN Treffer, daher Eintraege nicht umsortieren.
+ */
+const KEYWORD_MAP = [
+  { re: /(stagger|nacheinander|gestaffelt|one after|cards?|karten|liste)/i, primitive: "staggerReveal", target: ".features .card", params: { from: { opacity: 0, y: 32 } } },
+  { re: /(z(ä|ae)hl|counter|hochz(ä|ae)hl|count up|nummer|zahl)/i, primitive: "counterUp", target: ".stats .num", params: {} },
+  { re: /(parallax|tiefe|depth|layer|ebene)/i, primitive: "parallaxLayer", target: ".hero .bg", params: { yPercent: -25 } },
+  { re: /(pin|fixier|sticky|festhalten|haften)/i, primitive: "pinnedSection", target: ".showcase", params: { distance: "+=100%" } },
+  { re: /(marquee|laufband|logo.?band|ticker|endlos)/i, primitive: "marquee", target: ".marquee-track", params: {} },
+  { re: /(schweb|schwebe|schweben|float|floating|bob|gleitet sanft|auf und ab)/i, primitive: "floatLoop", target: ".float", params: { distance: "8px", duration: 3, axis: "y" } },
+  { re: /(skalier|scale|zoom|gr(ö|oe)(ß|ss)er werden)/i, primitive: "scaleOnScroll", target: ".section", params: {} },
+  { re: /(hover|maus|cursor|button)/i, primitive: "cssTransition", target: ".cta-button", params: { hoverValue: "translateY(-4px)" } },
+  { re: /(reveal|einblend|fade|erscheinen|appear|headline|(ü|ue)berschrift|gleitet|scroll)/i, primitive: "scrollReveal", target: ".hero h1", params: { from: { opacity: 0, y: 48 } } },
+];
+
+module.exports = { KEYWORD_MAP };