mythik 0.0.1 → 0.1.0

package/dist/auth/types.d.ts

@@ -0,0 +1,89 @@
+import type { StateStore } from '../state/store.js';
+export interface AuthUser {
+    id: string;
+    email: string;
+    name?: string;
+    avatar?: string;
+    /** Primary role — backward compat with existing canAccess/evaluatePermission */
+    role: string;
+    /** All roles — enables multi-role access checks */
+    roles: string[];
+    metadata?: Record<string, unknown>;
+}
+export interface AuthResult {
+    token: string;
+    refreshToken?: string;
+    /** Token lifetime in seconds. Used for proactive refresh scheduling. */
+    expiresIn?: number;
+    /** Absolute expiry timestamp (ms since epoch). Preferred over expiresIn when provider knows exact expiry (e.g., JWT decode). Engine falls back to Date.now() + expiresIn * 1000 if absent. */
+    expiresAt?: number;
+    user: AuthUser;
+}
+export type AuthEvent = {
+    type: 'SIGNED_IN';
+    user: AuthUser;
+} | {
+    type: 'SIGNED_OUT';
+} | {
+    type: 'TOKEN_REFRESHED';
+    token: string;
+} | {
+    type: 'SESSION_EXPIRED';
+} | {
+    type: 'AUTH_ERROR';
+    error: string;
+};
+export interface AuthProvider {
+    login(credentials: Record<string, unknown>): Promise<AuthResult>;
+    logout(): Promise<void>;
+    refresh(refreshToken: string): Promise<AuthResult>;
+    getUser(token: string): Promise<AuthUser>;
+    /** Optional: listen for external auth state changes (e.g., OAuth redirect completion) */
+    onAuthStateChange?(callback: (event: AuthEvent) => void): () => void;
+}
+export interface AuthEngineConfig {
+    provider: AuthProvider;
+    store: StateStore;
+    config: {
+        loginScreen: string;
+        protectedScreens: string[];
+        roleAccess: Record<string, string[]>;
+        persistence: 'local' | 'session' | 'memory';
+        tokenRefresh: boolean;
+        /** Domains where auth headers (Bearer token) are auto-injected into fetch requests. Requests to non-listed domains go without auth headers. Prevents token leakage to third-party URLs. */
+        authDomains: string[];
+        sessionExpiredMessage?: string;
+    };
+}
+export interface AuthEngine {
+    /** Authenticate with credentials. Writes safe derived data to state. */
+    login(credentials: Record<string, unknown>): Promise<void>;
+    /** Clear session, tokens, state. Navigate to loginScreen. */
+    logout(): Promise<void>;
+    /** Manual refresh trigger. */
+    refreshSession(): Promise<void>;
+    /** Initialize engine: restore session, setup listeners. */
+    mount(): Promise<void>;
+    /** Cleanup: cancel timers, close channels, clear tokens. */
+    destroy(): void;
+    /** Get access token from closure (for framework fetch interceptor). */
+    getAccessToken(): string | null;
+    /** Check if currently authenticated. */
+    isAuthenticated(): boolean;
+    /** Get current auth config. */
+    getConfig(): AuthEngineConfig['config'];
+}
+export interface MockAuthProviderConfig {
+    user: AuthUser;
+    /** Simulate login failure. */
+    shouldFail?: boolean;
+    /** Simulate refresh failure. */
+    shouldFailRefresh?: boolean;
+    /** Error message on failure. */
+    errorMessage?: string;
+    /** Simulated delay in ms. */
+    delay?: number;
+    /** Token lifetime in seconds. Default: 3600. */
+    expiresIn?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIpD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAID,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8LAA8L;IAC9L,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAID,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAI1C,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,yFAAyF;IACzF,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACtE;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrC,WAAW,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC;QAC5C,YAAY,EAAE,OAAO,CAAC;QACtB,2LAA2L;QAC3L,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAID,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,6DAA6D;IAC7D,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,8BAA8B;IAC9B,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,2DAA2D;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,4DAA4D;IAC5D,OAAO,IAAI,IAAI,CAAC;IAChB,uEAAuE;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,wCAAwC;IACxC,eAAe,IAAI,OAAO,CAAC;IAC3B,+BAA+B;IAC/B,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;CACzC;AAID,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,QAAQ,CAAC;IACf,8BAA8B;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gCAAgC;IAChC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gCAAgC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":""}

package/dist/contract/endpoint-map.d.ts

@@ -0,0 +1,20 @@
+import type { EndpointInfo } from './types.js';
+interface ApiSpecInput {
+    id: string;
+    spec: Record<string, unknown>;
+}
+export interface EndpointMapResult {
+    endpoints: Map<string, EndpointInfo>;
+    catalogs: Set<string>;
+    policies: Map<string, {
+        roles: string[];
+    }>;
+    authConfigured: boolean;
+}
+/**
+ * Build a consolidated endpoint map from one or more api-specs.
+ * CRUD endpoints generate POST, PUT/:id, DELETE/:id entries.
+ */
+export declare function buildEndpointMap(apiSpecs: ApiSpecInput[]): EndpointMapResult;
+export {};
+//# sourceMappingURL=endpoint-map.d.ts.map

package/dist/contract/endpoint-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-map.d.ts","sourceRoot":"","sources":["../../src/contract/endpoint-map.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,UAAU,YAAY;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC3C,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,iBAAiB,CA0D5E"}

package/dist/contract/endpoint-map.js

@@ -0,0 +1,57 @@
+/**
+ * Build a consolidated endpoint map from one or more api-specs.
+ * CRUD endpoints generate POST, PUT/:id, DELETE/:id entries.
+ */
+export function buildEndpointMap(apiSpecs) {
+    const endpoints = new Map();
+    const catalogs = new Set();
+    const policies = new Map();
+    let authConfigured = false;
+    for (const { id: source, spec } of apiSpecs) {
+        // Catalogs
+        const specCatalogs = spec.catalogs;
+        if (specCatalogs) {
+            for (const name of Object.keys(specCatalogs)) {
+                catalogs.add(name);
+            }
+        }
+        // Auth policies
+        const auth = spec.auth;
+        if (auth) {
+            authConfigured = true;
+            const specPolicies = auth.policies;
+            if (specPolicies) {
+                for (const [name, policy] of Object.entries(specPolicies)) {
+                    policies.set(name, policy);
+                }
+            }
+        }
+        // Endpoints
+        const specEndpoints = spec.endpoints;
+        if (!specEndpoints)
+            continue;
+        for (const [, ep] of Object.entries(specEndpoints)) {
+            const path = ep.path;
+            const method = (ep.method ?? 'GET').toUpperCase();
+            const params = ep.params ?? {};
+            const policy = ep.policy;
+            const crud = ep.crud;
+            const baseInfo = {
+                params,
+                policy,
+                source,
+                crud: crud ? { insertable: crud.insertable, updatable: crud.updatable } : undefined,
+            };
+            if (ep.query || ep.handler) {
+                endpoints.set(`${method} ${path}`, { ...baseInfo, path, method });
+            }
+            if (crud) {
+                endpoints.set(`POST ${path}`, { ...baseInfo, path, method: 'POST' });
+                endpoints.set(`PUT ${path}/:id`, { ...baseInfo, path: `${path}/:id`, method: 'PUT' });
+                endpoints.set(`DELETE ${path}/:id`, { ...baseInfo, path: `${path}/:id`, method: 'DELETE' });
+            }
+        }
+    }
+    return { endpoints, catalogs, policies, authConfigured };
+}
+//# sourceMappingURL=endpoint-map.js.map

package/dist/contract/endpoint-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-map.js","sourceRoot":"","sources":["../../src/contract/endpoint-map.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAwB;IACvD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IACxD,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC5C,WAAW;QACX,MAAM,YAAY,GAAG,IAAI,CAAC,QAA+C,CAAC;QAC1E,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,IAA2C,CAAC;QAC9D,IAAI,IAAI,EAAE,CAAC;YACT,cAAc,GAAG,IAAI,CAAC;YACtB,MAAM,YAAY,GAAG,IAAI,CAAC,QAA2D,CAAC;YACtF,IAAI,YAAY,EAAE,CAAC;gBACjB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC1D,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,YAAY;QACZ,MAAM,aAAa,GAAG,IAAI,CAAC,SAAgE,CAAC;QAC5F,IAAI,CAAC,aAAa;YAAE,SAAS;QAE7B,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAc,CAAC;YAC/B,MAAM,MAAM,GAAG,CAAE,EAAE,CAAC,MAAiB,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,MAAM,GAAI,EAAE,CAAC,MAA2C,IAAI,EAAE,CAAC;YACrE,MAAM,MAAM,GAAG,EAAE,CAAC,MAA4B,CAAC;YAC/C,MAAM,IAAI,GAAG,EAAE,CAAC,IAAoG,CAAC;YAErH,MAAM,QAAQ,GAA0C;gBACtD,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;aACpF,CAAC;YAEF,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;gBAC3B,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,IAAI,EAAE,CAAC;gBACT,SAAS,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrE,SAAS,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtF,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AAC3D,CAAC"}

package/dist/contract/engine.d.ts

@@ -0,0 +1,12 @@
+import type { ContractResult } from './types.js';
+export interface RunContractInput {
+    app?: Record<string, unknown>;
+    screens: Record<string, Record<string, unknown>>;
+    apis: Array<{
+        id: string;
+        spec: Record<string, unknown>;
+    }>;
+    baseUrl?: string;
+}
+export declare function runContract(input: RunContractInput): ContractResult;
+//# sourceMappingURL=engine.d.ts.map

package/dist/contract/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/contract/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAkD,MAAM,YAAY,CAAC;AAejG,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,IAAI,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,cAAc,CAmEnE"}

package/dist/contract/engine.js

@@ -0,0 +1,80 @@
+import { extractFetchReferences } from './extractor.js';
+import { buildEndpointMap } from './endpoint-map.js';
+import { endpointsExistRule } from './rules/endpoints-exist.js';
+import { fieldsValidRule } from './rules/fields-valid.js';
+import { paramsMatchRule } from './rules/params-match.js';
+import { permissionsConsistentRule } from './rules/permissions-consistent.js';
+const RULES = [
+    endpointsExistRule,
+    fieldsValidRule,
+    paramsMatchRule,
+    permissionsConsistentRule,
+];
+export function runContract(input) {
+    const { app, screens, apis, baseUrl } = input;
+    // 1. Build endpoint map from all api-specs
+    const { endpoints, catalogs, policies, authConfigured } = buildEndpointMap(apis);
+    // 2. Extract fetch references from all screens
+    const fetches = Object.entries(screens).flatMap(([screenId, spec]) => extractFetchReferences(screenId, spec, baseUrl));
+    // 3. Extract roleAccess from AppSpec
+    const nav = app?.navigation;
+    const auth = nav?.auth;
+    const roleAccess = auth?.roleAccess;
+    // 4. Build context
+    const context = {
+        endpoints,
+        catalogs,
+        policies,
+        fetches,
+        roleAccess,
+        authConfigured,
+    };
+    // 5. Collect findings
+    const rawFindings = [];
+    // 5a. Warn if absolute URLs detected without baseUrl
+    if (!baseUrl) {
+        const hasAbsoluteUrls = fetches.some(f => (f.rawUrl.startsWith('http://') || f.rawUrl.startsWith('https://')) && !f.rawUrl.includes('${'));
+        if (hasAbsoluteUrls) {
+            rawFindings.push({
+                level: 'warning',
+                rule: 'contract',
+                message: 'Absolute URLs detected in screen specs but no --base-url provided. Endpoint matching may fail for absolute URLs. Use: mythik contract --base-url http://your-server:port',
+            });
+        }
+    }
+    // 5b. Run all rules
+    rawFindings.push(...RULES.flatMap(rule => rule.check(context)));
+    // 6. Deduplicate findings by rule + screen + message
+    const findings = deduplicateFindings(rawFindings);
+    const errors = findings.filter(f => f.level === 'error').length;
+    const warnings = findings.filter(f => f.level === 'warning').length;
+    // Count unique endpoints covered by fetches
+    const coveredEndpoints = new Set(fetches.map(f => `${f.method} ${f.path}`));
+    return {
+        valid: errors === 0,
+        findings,
+        summary: {
+            screens: Object.keys(screens).length,
+            fetchReferences: fetches.length,
+            endpointsCovered: coveredEndpoints.size,
+            rulesRun: RULES.length,
+            errors,
+            warnings,
+        },
+    };
+}
+function deduplicateFindings(findings) {
+    const seen = new Map();
+    for (const f of findings) {
+        const key = `${f.level}|${f.rule}|${f.screen ?? ''}|${f.message}`;
+        const existing = seen.get(key);
+        if (existing) {
+            existing.count = (existing.count ?? 1) + 1;
+        }
+        else {
+            seen.set(key, { ...f, count: 1 });
+        }
+    }
+    return Array.from(seen.values());
+}
+//# sourceMappingURL=engine.js.map

package/dist/contract/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/contract/engine.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,MAAM,KAAK,GAAmB;IAC5B,kBAAkB;IAClB,eAAe;IACf,eAAe;IACf,yBAAyB;CAC1B,CAAC;AASF,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAE9C,2CAA2C;IAC3C,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEjF,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CACnE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAChD,CAAC;IAEF,qCAAqC;IACrC,MAAM,GAAG,GAAG,GAAG,EAAE,UAAiD,CAAC;IACnE,MAAM,IAAI,GAAG,GAAG,EAAE,IAA2C,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,EAAE,UAAkD,CAAC;IAE5E,mBAAmB;IACnB,MAAM,OAAO,GAAoB;QAC/B,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,UAAU;QACV,cAAc;KACf,CAAC;IAEF,sBAAsB;IACtB,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,qDAAqD;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACvC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChG,CAAC;QACF,IAAI,eAAe,EAAE,CAAC;YACpB,WAAW,CAAC,IAAI,CAAC;gBACf,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,0KAA0K;aACpL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEhE,qDAAqD;IACrD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAElD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAEpE,4CAA4C;IAC5C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE5E,OAAO;QACL,KAAK,EAAE,MAAM,KAAK,CAAC;QACnB,QAAQ;QACR,OAAO,EAAE;YACP,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;YACpC,eAAe,EAAE,OAAO,CAAC,MAAM;YAC/B,gBAAgB,EAAE,gBAAgB,CAAC,IAAI;YACvC,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,MAAM;YACN,QAAQ;SACT;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA2B;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEhD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/contract/extractor.d.ts

@@ -0,0 +1,7 @@
+import type { FetchReference } from './types.js';
+/**
+ * Extract all fetch/submitForm/dataSource references from a screen spec.
+ * Resolves $template URLs, strips base URL, extracts query params and body fields.
+ */
+export declare function extractFetchReferences(screenId: string, spec: Record<string, unknown>, baseUrl?: string): FetchReference[];
+//# sourceMappingURL=extractor.d.ts.map

package/dist/contract/extractor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/contract/extractor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,MAAM,GACf,cAAc,EAAE,CAkDlB"}

package/dist/contract/extractor.js

@@ -0,0 +1,133 @@
+/**
+ * Extract all fetch/submitForm/dataSource references from a screen spec.
+ * Resolves $template URLs, strips base URL, extracts query params and body fields.
+ */
+export function extractFetchReferences(screenId, spec, baseUrl) {
+    const refs = [];
+    // 1. initialActions
+    const initialActions = spec.initialActions;
+    if (initialActions) {
+        for (const action of initialActions) {
+            extractFromAction(action, screenId, baseUrl, refs);
+        }
+    }
+    // 2. dataSources
+    const dataSources = spec.dataSources;
+    if (dataSources) {
+        for (const [, ds] of Object.entries(dataSources)) {
+            const url = resolveUrl(ds.url);
+            if (url) {
+                const parsed = parseUrl(url, baseUrl);
+                refs.push({
+                    screen: screenId,
+                    path: parsed.path,
+                    method: (ds.method ?? 'GET').toUpperCase(),
+                    queryParams: parsed.queryParams,
+                    bodyFields: [],
+                    rawUrl: url,
+                });
+            }
+        }
+    }
+    // 3. Walk all elements for on.* event handlers
+    const elements = spec.elements;
+    if (elements) {
+        for (const [elementId, element] of Object.entries(elements)) {
+            const on = element.on;
+            if (!on)
+                continue;
+            for (const [, binding] of Object.entries(on)) {
+                if (Array.isArray(binding)) {
+                    for (const action of binding) {
+                        extractFromAction(action, screenId, baseUrl, refs, elementId);
+                    }
+                }
+                else {
+                    extractFromAction(binding, screenId, baseUrl, refs, elementId);
+                }
+            }
+        }
+    }
+    return refs;
+}
+function extractFromAction(action, screenId, baseUrl, refs, elementId) {
+    if (!action || typeof action !== 'object')
+        return;
+    const a = action;
+    const actionType = a.action;
+    if (actionType === 'fetch' || actionType === 'submitForm') {
+        const params = a.params;
+        if (!params)
+            return;
+        const url = resolveUrl(params.url);
+        if (!url)
+            return;
+        const parsed = parseUrl(url, baseUrl);
+        const body = params.body;
+        refs.push({
+            screen: screenId,
+            path: parsed.path,
+            method: (params.method ?? 'GET').toUpperCase(),
+            queryParams: parsed.queryParams,
+            bodyFields: body ? Object.keys(body) : [],
+            rawUrl: url,
+            elementId,
+        });
+    }
+    if (actionType === 'transaction') {
+        const params = a.params;
+        if (!params)
+            return;
+        for (const key of ['confirm', 'onSuccess', 'onError']) {
+            const steps = params[key];
+            if (steps) {
+                for (const step of steps) {
+                    extractFromAction(step, screenId, baseUrl, refs, elementId);
+                }
+            }
+        }
+    }
+}
+/** Resolve a URL value — handles strings and $template expressions */
+function resolveUrl(urlValue) {
+    if (typeof urlValue === 'string')
+        return urlValue;
+    if (urlValue && typeof urlValue === 'object') {
+        const tmpl = urlValue['$template'];
+        if (typeof tmpl === 'string')
+            return tmpl;
+    }
+    return null;
+}
+/** Parse a URL: strip base URL, replace ${...} with :param, extract query params */
+function parseUrl(url, baseUrl) {
+    // Replace ${...} template expressions with :param placeholder
+    const normalized = url.replace(/\$\{[^}]+\}/g, ':param');
+    // Handle domain-as-template: http://:param/api/items → /api/items
+    // Also handles port: https://:param:8080/api/items → /api/items
+    let workUrl = normalized;
+    const domainTemplateMatch = workUrl.match(/^https?:\/\/:param(:\d+)?(\/.*)/);
+    if (domainTemplateMatch) {
+        workUrl = domainTemplateMatch[2];
+    }
+    if (baseUrl && workUrl.startsWith(baseUrl)) {
+        workUrl = workUrl.slice(baseUrl.length);
+        if (!workUrl.startsWith('/'))
+            workUrl = '/' + workUrl;
+    }
+    // Split path from query string
+    const [pathPart, queryPart] = workUrl.split('?');
+    const path = pathPart.replace(/\/+$/, '') || '/'; // normalize trailing slash
+    // Extract query param names (skip template-derived :param values)
+    const queryParams = [];
+    if (queryPart) {
+        for (const pair of queryPart.split('&')) {
+            const name = pair.split('=')[0];
+            if (name && !name.startsWith(':')) {
+                queryParams.push(name);
+            }
+        }
+    }
+    return { path, queryParams };
+}
+//# sourceMappingURL=extractor.js.map

package/dist/contract/extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractor.js","sourceRoot":"","sources":["../../src/contract/extractor.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,IAA6B,EAC7B,OAAgB;IAEhB,MAAM,IAAI,GAAqB,EAAE,CAAC;IAElC,oBAAoB;IACpB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAuC,CAAC;IACpE,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAkE,CAAC;IAC5F,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC;oBACR,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,CAAE,EAAE,CAAC,MAAiB,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;oBACtD,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,UAAU,EAAE,EAAE;oBACd,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA+D,CAAC;IACtF,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAyC,CAAC;YAC7D,IAAI,CAAC,EAAE;gBAAE,SAAS;YAElB,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;wBAC7B,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAe,EACf,QAAgB,EAChB,OAA2B,EAC3B,IAAsB,EACtB,SAAkB;IAElB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO;IAClD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,MAAM,UAAU,GAAG,CAAC,CAAC,MAAgB,CAAC;IAEtC,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,CAAC,CAAC,MAA6C,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAA2C,CAAC;QAEhE,IAAI,CAAC,IAAI,CAAC;YACR,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,CAAE,MAAM,CAAC,MAAiB,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;YAC1D,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YACzC,MAAM,EAAE,GAAG;YACX,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAA6C,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAA0B,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,QAAiB;IACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAI,QAAoC,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,oFAAoF;AACpF,SAAS,QAAQ,CAAC,GAAW,EAAE,OAAgB;IAC7C,8DAA8D;IAC9D,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAEzD,kEAAkE;IAClE,gEAAgE;IAChE,IAAI,OAAO,GAAG,UAAU,CAAC;IACzB,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC7E,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC;IACxD,CAAC;IAED,+BAA+B;IAC/B,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,2BAA2B;IAE7E,kEAAkE;IAClE,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC"}

package/dist/contract/index.d.ts

@@ -0,0 +1,4 @@
+export { runContract } from './engine.js';
+export type { RunContractInput } from './engine.js';
+export type { ContractResult, ContractContext, ContractFinding, ContractRule, FetchReference, EndpointInfo, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/contract/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,YAAY,EACV,cAAc,EACd,eAAe,EACf,eAAe,EACf,YAAY,EACZ,cAAc,EACd,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/contract/index.js

@@ -0,0 +1,2 @@
+export { runContract } from './engine.js';
+//# sourceMappingURL=index.js.map

package/dist/contract/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/contract/matcher.d.ts

@@ -0,0 +1,13 @@
+import type { EndpointInfo } from './types.js';
+export interface MatchResult {
+    matched: boolean;
+    endpoint?: EndpointInfo;
+    matchType?: 'exact' | 'catalog' | 'builtin';
+    suggestion?: string;
+    availableCatalogs?: string[];
+}
+/**
+ * Match a fetch URL path + method against known endpoints, catalogs, and builtins.
+ */
+export declare function matchEndpoint(path: string, method: string, endpoints: Map<string, EndpointInfo>, catalogs: Set<string>, authConfigured: boolean): MatchResult;
+//# sourceMappingURL=matcher.d.ts.map

package/dist/contract/matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.d.ts","sourceRoot":"","sources":["../../src/contract/matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAKD;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,EACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EACrB,cAAc,EAAE,OAAO,GACtB,WAAW,CAwDb"}

package/dist/contract/matcher.js

@@ -0,0 +1,57 @@
+import { suggest } from '../utils/levenshtein.js';
+const BUILTIN_PATHS_AUTH = ['/api/auth/login', '/api/auth/refresh'];
+const BUILTIN_PATHS_SERVING = ['/api/screens/:id', '/api/app/:id'];
+/**
+ * Match a fetch URL path + method against known endpoints, catalogs, and builtins.
+ */
+export function matchEndpoint(path, method, endpoints, catalogs, authConfigured) {
+    const paramNormalized = path.replace(/:param/g, ':id');
+    // 1. Exact match: METHOD + path
+    const key = `${method} ${path}`;
+    if (endpoints.has(key)) {
+        return { matched: true, endpoint: endpoints.get(key), matchType: 'exact' };
+    }
+    // 2. Parameterized match: :param → :id
+    const paramKey = `${method} ${paramNormalized}`;
+    if (endpoints.has(paramKey)) {
+        return { matched: true, endpoint: endpoints.get(paramKey), matchType: 'exact' };
+    }
+    // 3. Catalog match: /api/catalogs/{name}
+    const catalogMatch = path.match(/^\/api\/catalogs\/(.+)$/);
+    if (catalogMatch) {
+        const catalogName = catalogMatch[1];
+        if (catalogs.has(catalogName)) {
+            return { matched: true, matchType: 'catalog' };
+        }
+        const suggested = suggest(catalogName, Array.from(catalogs));
+        return {
+            matched: false,
+            suggestion: suggested ? `Did you mean "${suggested}"?` : undefined,
+            availableCatalogs: Array.from(catalogs),
+        };
+    }
+    // 4. Builtin auth routes
+    if (authConfigured) {
+        for (const builtin of BUILTIN_PATHS_AUTH) {
+            if (path === builtin || paramNormalized === builtin) {
+                return { matched: true, matchType: 'builtin' };
+            }
+        }
+    }
+    // 5. Builtin spec serving routes (always available)
+    for (const builtin of BUILTIN_PATHS_SERVING) {
+        const builtinParam = builtin.replace(/:id/g, ':param');
+        if (path === builtin || path === builtinParam || paramNormalized === builtin) {
+            return { matched: true, matchType: 'builtin' };
+        }
+    }
+    // 6. No match — fuzzy suggestion from all endpoint paths
+    const allPaths = Array.from(endpoints.values()).map(e => e.path);
+    const uniquePaths = [...new Set(allPaths)];
+    const suggested = suggest(path, uniquePaths);
+    return {
+        matched: false,
+        suggestion: suggested ? `Did you mean "${suggested}"?` : undefined,
+    };
+}
+//# sourceMappingURL=matcher.js.map

package/dist/contract/matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../../src/contract/matcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAUlD,MAAM,kBAAkB,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;AACpE,MAAM,qBAAqB,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAEnE;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAc,EACd,SAAoC,EACpC,QAAqB,EACrB,cAAuB;IAEvB,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAEvD,gCAAgC;IAChC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAChC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC7E,CAAC;IAED,uCAAuC;IACvC,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,eAAe,EAAE,CAAC;IAChD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAClF,CAAC;IAED,yCAAyC;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC3D,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS;YAClE,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,IAAI,IAAI,KAAK,OAAO,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;gBACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,YAAY,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;YAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAE7C,OAAO;QACL,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC;AACJ,CAAC"}

package/dist/contract/rules/endpoints-exist.d.ts

@@ -0,0 +1,3 @@
+import type { ContractRule } from '../types.js';
+export declare const endpointsExistRule: ContractRule;
+//# sourceMappingURL=endpoints-exist.d.ts.map

package/dist/contract/rules/endpoints-exist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints-exist.d.ts","sourceRoot":"","sources":["../../../src/contract/rules/endpoints-exist.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAoC,MAAM,aAAa,CAAC;AAGlF,eAAO,MAAM,kBAAkB,EAAE,YAiChC,CAAC"}

package/dist/contract/rules/endpoints-exist.js

@@ -0,0 +1,29 @@
+import { matchEndpoint } from '../matcher.js';
+export const endpointsExistRule = {
+    name: 'endpoints-exist',
+    description: 'Every fetch URL in screen specs must match an endpoint in the api-spec',
+    check(context) {
+        const findings = [];
+        for (const fetch of context.fetches) {
+            const result = matchEndpoint(fetch.path, fetch.method, context.endpoints, context.catalogs, context.authConfigured);
+            if (!result.matched) {
+                const finding = {
+                    level: 'error',
+                    rule: 'endpoints-exist',
+                    message: `${fetch.method} ${fetch.path} — no endpoint found`,
+                    screen: fetch.screen,
+                    endpoint: fetch.path,
+                };
+                if (result.suggestion) {
+                    finding.suggestion = result.suggestion;
+                }
+                else if (result.availableCatalogs) {
+                    finding.suggestion = `Available catalogs: ${result.availableCatalogs.join(', ')}`;
+                }
+                findings.push(finding);
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=endpoints-exist.js.map

package/dist/contract/rules/endpoints-exist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints-exist.js","sourceRoot":"","sources":["../../../src/contract/rules/endpoints-exist.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,CAAC,MAAM,kBAAkB,GAAiB;IAC9C,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,wEAAwE;IAErF,KAAK,CAAC,OAAwB;QAC5B,MAAM,QAAQ,GAAsB,EAAE,CAAC;QAEvC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,aAAa,CAC1B,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CACtF,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAoB;oBAC/B,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,sBAAsB;oBAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,IAAI;iBACrB,CAAC;gBAEF,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBACtB,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBACzC,CAAC;qBAAM,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBACpC,OAAO,CAAC,UAAU,GAAG,uBAAuB,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpF,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/contract/rules/fields-valid.d.ts

@@ -0,0 +1,3 @@
+import type { ContractRule } from '../types.js';
+export declare const fieldsValidRule: ContractRule;
+//# sourceMappingURL=fields-valid.d.ts.map

package/dist/contract/rules/fields-valid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields-valid.d.ts","sourceRoot":"","sources":["../../../src/contract/rules/fields-valid.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAoC,MAAM,aAAa,CAAC;AAIlF,eAAO,MAAM,eAAe,EAAE,YAyC7B,CAAC"}