specforge-mcp 0.1.0

package/dist/engine/supply-chain/sbom-checker.js

@@ -0,0 +1,171 @@
+// engine/supply-chain/sbom-checker.ts — SPEC-046
+// Detects SBOM presence, format, and validates CISA Minimum Elements.
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { glob } from 'glob';
+// SBOM file patterns
+const SBOM_GLOBS = [
+    '**/*.spdx',
+    '**/*.sbom.json',
+    '**/bom.xml',
+    '**/sbom.spdx.json',
+    '**/sbom.json',
+    '**/bom.json',
+];
+// CI-based SBOM generators
+const SBOM_CI_PATTERNS = [
+    'trivy sbom',
+    'syft',
+    'cyclonedx',
+    '@cyclonedx',
+    'cyclonedx-npm',
+    'cyclonedx-bom',
+    'cyclonedx-gomod',
+    'cyclonedx-maven',
+    'cargo-sbom',
+];
+// CISA Minimum Elements (2025) that must be present in a valid SBOM
+const CISA_MINIMUM_FIELDS = [
+    'supplier',
+    'author',
+    'timestamp',
+    'name',
+    'version',
+    'serialNumber',
+    'dependencies',
+];
+const SBOM_REFS = [
+    'https://www.cisa.gov/resources-tools/resources/software-bill-materials-sbom',
+    'https://cyclonedx.org/specification/overview/',
+    'https://spdx.dev/',
+];
+/** Find all SBOM files in the project. */
+async function findSbomFiles(projectPath) {
+    try {
+        const files = await glob(SBOM_GLOBS, {
+            cwd: projectPath,
+            nodir: true,
+            maxDepth: 5,
+            ignore: ['node_modules/**', 'vendor/**', '.git/**'],
+        });
+        return files.map((f) => join(projectPath, f));
+    }
+    catch {
+        return [];
+    }
+}
+/** Detect SBOM format from file content. */
+function detectSbomFormat(content, fileName) {
+    // SPDX detection takes priority (check before CycloneDX to avoid sbom.spdx false-positive)
+    if (content.includes('SPDXVersion') || content.includes('spdxId') || fileName.includes('.spdx')) {
+        return 'SPDX-2.3';
+    }
+    // CycloneDX detection — match file basename only (avoid sbom.spdx matching /bom./)
+    const baseName = fileName.split('/').pop() ?? fileName;
+    if (content.includes('cyclonedx') ||
+        content.includes('CycloneDX') ||
+        baseName === 'bom.xml' ||
+        baseName === 'bom.json') {
+        return 'CycloneDX-1.6';
+    }
+    return 'other';
+}
+/** Validate a CycloneDX/SPDX SBOM against CISA Minimum Elements. */
+function validateSbomContent(content) {
+    const lower = content.toLowerCase();
+    // Check that all 7 CISA minimum fields are present
+    return CISA_MINIMUM_FIELDS.every((field) => lower.includes(field.toLowerCase()));
+}
+/** Check if CI workflows contain SBOM generation commands. */
+async function hasSbomInCi(projectPath) {
+    try {
+        const workflowFiles = await glob(['.github/workflows/*.yml', '.github/workflows/*.yaml'], {
+            cwd: projectPath,
+            nodir: true,
+            absolute: false,
+        });
+        for (const f of workflowFiles) {
+            try {
+                const content = await readFile(join(projectPath, f), 'utf-8');
+                if (SBOM_CI_PATTERNS.some((p) => content.toLowerCase().includes(p.toLowerCase()))) {
+                    return true;
+                }
+            }
+            catch {
+                // Skip unreadable files
+            }
+        }
+    }
+    catch {
+        // No .github/workflows directory
+    }
+    return false;
+}
+/**
+ * Detect SBOM presence and validate its content.
+ * Returns SbomCheckResult with format, validity, and CI integration status.
+ */
+export async function checkSbom(projectPath) {
+    const sbomFiles = await findSbomFiles(projectPath);
+    const sbomInCi = await hasSbomInCi(projectPath);
+    if (sbomFiles.length === 0 && !sbomInCi) {
+        return {
+            sbomPresent: false,
+            sbomValid: false,
+            sbomFormat: null,
+            sbomInCi: false,
+        };
+    }
+    // If no file on disk but CI generates it — mark as present but not locally validatable
+    if (sbomFiles.length === 0) {
+        return {
+            sbomPresent: true,
+            sbomValid: false, // Cannot validate without the file
+            sbomFormat: null,
+            sbomInCi: true,
+        };
+    }
+    // Validate the first SBOM file found
+    const firstFile = sbomFiles[0];
+    if (!firstFile) {
+        return { sbomPresent: false, sbomValid: false, sbomFormat: null, sbomInCi };
+    }
+    try {
+        const content = await readFile(firstFile, 'utf-8');
+        const format = detectSbomFormat(content, firstFile);
+        const valid = validateSbomContent(content);
+        return { sbomPresent: true, sbomValid: valid, sbomFormat: format, sbomInCi };
+    }
+    catch {
+        return { sbomPresent: true, sbomValid: false, sbomFormat: null, sbomInCi };
+    }
+}
+/**
+ * Build SBOM gaps from check results.
+ */
+export function buildSbomGaps(result, isGovernmentOrEnterprise) {
+    const gaps = [];
+    if (!result.sbomPresent) {
+        const severity = isGovernmentOrEnterprise ? 'critical' : 'warning';
+        gaps.push({
+            category: 'sbom',
+            severity,
+            message: 'No SBOM detected — project does not generate a Software Bill of Materials',
+            fix: 'Add SBOM generation to CI using syft, cyclonedx-npm, or equivalents; publish alongside artifacts',
+            references: SBOM_REFS,
+        });
+        return gaps;
+    }
+    // result.sbomPresent is always true here (early return above handles the false case)
+    if (!result.sbomValid) {
+        gaps.push({
+            category: 'sbom',
+            severity: 'warning',
+            message: 'SBOM found but missing CISA Minimum Elements (2025): supplier, author, timestamp, name, version, serialNumber, dependencies',
+            fix: 'Regenerate SBOM with a tool that includes all 7 CISA Minimum Elements (CycloneDX v1.6+ recommended)',
+            references: SBOM_REFS,
+        });
+    }
+    return gaps;
+}
+//# sourceMappingURL=sbom-checker.js.map

package/dist/engine/supply-chain/sbom-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-checker.js","sourceRoot":"","sources":["../../../src/engine/supply-chain/sbom-checker.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,sEAAsE;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,qBAAqB;AACrB,MAAM,UAAU,GAAG;IACjB,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,mBAAmB;IACnB,cAAc;IACd,aAAa;CACd,CAAC;AAEF,2BAA2B;AAC3B,MAAM,gBAAgB,GAAG;IACvB,YAAY;IACZ,MAAM;IACN,WAAW;IACX,YAAY;IACZ,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,YAAY;CACb,CAAC;AAEF,oEAAoE;AACpE,MAAM,mBAAmB,GAAG;IAC1B,UAAU;IACV,QAAQ;IACR,WAAW;IACX,MAAM;IACN,SAAS;IACT,cAAc;IACd,cAAc;CACf,CAAC;AAEF,MAAM,SAAS,GAAG;IAChB,6EAA6E;IAC7E,+CAA+C;IAC/C,mBAAmB;CACpB,CAAC;AAEF,0CAA0C;AAC1C,KAAK,UAAU,aAAa,CAAC,WAAmB;IAC9C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;YACnC,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,CAAC,iBAAiB,EAAE,WAAW,EAAE,SAAS,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,4CAA4C;AAC5C,SAAS,gBAAgB,CAAC,OAAe,EAAE,QAAgB;IACzD,2FAA2F;IAC3F,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChG,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,mFAAmF;IACnF,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;IACvD,IACE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,UAAU,EACvB,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,mDAAmD;IACnD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,WAAW,CAAC,WAAmB;IAC5C,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,EAAE;YACxF,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC9D,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;oBAClF,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,WAAmB;IACjD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;IAEhD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO;YACL,WAAW,EAAE,KAAK;YAClB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,KAAK,EAAE,mCAAmC;YACrD,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAuB,EACvB,wBAAiC;IAEjC,MAAM,IAAI,GAAqB,EAAE,CAAC;IAElC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,QAAQ;YACR,OAAO,EAAE,2EAA2E;YACpF,GAAG,EAAE,kGAAkG;YACvG,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,SAAS;YACnB,OAAO,EACL,6HAA6H;YAC/H,GAAG,EAAE,qGAAqG;YAC1G,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/engine/supply-chain/slsa-checker.d.ts

@@ -0,0 +1,30 @@
+import type { SlsaLevel, SupplyChainGap, NpmProvenanceResult, SlsaProvenanceFormat } from '../../types/index.js';
+export type { NpmProvenanceResult, SlsaProvenanceFormat } from '../../types/index.js';
+/**
+ * Detect the SLSA level of the project based on CI configuration.
+ * Returns the SLSA level and whether CI workflows exist.
+ */
+export declare function detectSlsaLevel(projectPath: string): Promise<{
+    level: SlsaLevel;
+    hasCi: boolean;
+    isPublishing: boolean;
+    hasOidc: boolean;
+}>;
+/**
+ * Detect which SLSA provenance format is declared in the project's attestation files.
+ * SLSA v1.1 (April 2025) uses `slsa.dev/provenance/v1`.
+ * Legacy projects may still use `slsa.dev/provenance/v0.2`.
+ * Both are valid; v1 is preferred going forward.
+ */
+export declare function detectSlsaProvenanceFormat(projectPath: string): Promise<SlsaProvenanceFormat>;
+/**
+ * Detect npm native provenance via `npm publish --provenance` + `actions/attest-build-provenance`.
+ * When both are present, the project achieves SLSA L2 without external tooling.
+ * Reference: https://docs.npmjs.com/generating-provenance-statements
+ */
+export declare function detectNpmProvenance(projectPath: string, workflowFiles?: string[]): Promise<NpmProvenanceResult>;
+/**
+ * Build SLSA gaps from detection results.
+ */
+export declare function buildSlsaGaps(level: SlsaLevel, isPublishing: boolean, hasOidc: boolean): SupplyChainGap[];
+//# sourceMappingURL=slsa-checker.d.ts.map

package/dist/engine/supply-chain/slsa-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slsa-checker.d.ts","sourceRoot":"","sources":["../../../src/engine/supply-chain/slsa-checker.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,SAAS,EACT,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AA2B9B,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AA4FtF;;;GAGG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0BxF;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,CAAC,CAyB/B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC,mBAAmB,CAAC,CA8B9B;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,SAAS,EAChB,YAAY,EAAE,OAAO,EACrB,OAAO,EAAE,OAAO,GACf,cAAc,EAAE,CAyClB"}

package/dist/engine/supply-chain/slsa-checker.js

@@ -0,0 +1,245 @@
+// engine/supply-chain/slsa-checker.ts — SPEC-046
+// Detects SLSA provenance level (L0..L3) from CI workflows and project files.
+// TD-P15-01: SLSA v1.1 format detection (slsa.dev/provenance/v1 + legacy v0.2)
+// TD-P15-02: npm provenance via actions/attest-build-provenance (native SLSA L2)
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { glob } from 'glob';
+// SLSA GitHub Generator workflow action
+const SLSA_GENERATOR_ACTION = 'slsa-framework/slsa-github-generator';
+// Actions/tools that provide SLSA L2 provenance
+const SLSA_L2_PATTERNS = ['actions/attest-build-provenance', 'sigstore/cosign-installer', 'cosign'];
+// CI files that indicate at least L1 (scripted build)
+const CI_WORKFLOW_GLOBS = ['.github/workflows/*.yml', '.github/workflows/*.yaml'];
+// Publish-indicating script patterns
+const PUBLISH_PATTERNS = ['npm publish', 'twine upload', 'cargo publish', 'mvn deploy'];
+// SLSA references
+const SLSA_REFS = [
+    'https://slsa.dev/spec/v1.0/',
+    'https://github.com/slsa-framework/slsa-github-generator',
+    'https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds',
+];
+// SLSA v1.1 provenance format (April 2025) — replaces v0.2
+// Both formats are valid; v1 is preferred for new setups.
+const SLSA_PROVENANCE_V1_FORMAT = 'slsa.dev/provenance/v1';
+const SLSA_PROVENANCE_V02_FORMAT = 'slsa.dev/provenance/v0.2';
+/** Read a file and return its content, or empty string on error. */
+async function readFileSafe(filePath) {
+    try {
+        return await readFile(filePath, 'utf-8');
+    }
+    catch {
+        return '';
+    }
+}
+/** Find all GitHub Actions workflow files. */
+async function findWorkflowFiles(projectPath) {
+    try {
+        const files = await glob(CI_WORKFLOW_GLOBS, {
+            cwd: projectPath,
+            nodir: true,
+            absolute: false,
+        });
+        return files.map((f) => join(projectPath, f));
+    }
+    catch {
+        return [];
+    }
+}
+/** Check if any workflow file contains a SLSA L3 generator action. */
+async function hasSlsaGeneratorWorkflow(workflowFiles) {
+    for (const file of workflowFiles) {
+        const content = await readFileSafe(file);
+        if (content.includes(SLSA_GENERATOR_ACTION)) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Check if any workflow file contains SLSA L2 patterns (cosign/attestation). */
+async function hasSlsaL2Workflow(workflowFiles) {
+    for (const file of workflowFiles) {
+        const content = await readFileSafe(file);
+        if (SLSA_L2_PATTERNS.some((p) => content.includes(p))) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Check if the project has evidence of publishing artifacts. */
+async function hasPublishEvidence(projectPath, workflowFiles) {
+    // Check package.json scripts
+    try {
+        const pkg = await readFile(join(projectPath, 'package.json'), 'utf-8');
+        const scripts = JSON.parse(pkg).scripts ?? {};
+        if (Object.values(scripts).some((s) => s.includes('npm publish'))) {
+            return true;
+        }
+    }
+    catch {
+        // No package.json
+    }
+    // Check CI workflows for publish patterns
+    for (const file of workflowFiles) {
+        const content = await readFileSafe(file);
+        if (PUBLISH_PATTERNS.some((p) => content.includes(p))) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Check if any workflow file has the OIDC id-token permission for signing. */
+async function hasOidcPermission(workflowFiles) {
+    for (const file of workflowFiles) {
+        const content = await readFileSafe(file);
+        if (content.includes('id-token: write')) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Check if signing artifacts (.sigstore) are present in CI. */
+async function hasSigningArtifacts(workflowFiles) {
+    for (const file of workflowFiles) {
+        const content = await readFileSafe(file);
+        if (content.includes('.sigstore') || content.includes('sigstore')) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Detect the SLSA level of the project based on CI configuration.
+ * Returns the SLSA level and whether CI workflows exist.
+ */
+export async function detectSlsaLevel(projectPath) {
+    const workflowFiles = await findWorkflowFiles(projectPath);
+    const hasCi = workflowFiles.length > 0;
+    if (!hasCi) {
+        return { level: 'L0', hasCi: false, isPublishing: false, hasOidc: false };
+    }
+    const [hasL3, hasL2, isPublishing, hasOidc] = await Promise.all([
+        hasSlsaGeneratorWorkflow(workflowFiles),
+        hasSlsaL2Workflow(workflowFiles),
+        hasPublishEvidence(projectPath, workflowFiles),
+        hasOidcPermission(workflowFiles),
+    ]);
+    // hasCi is always true here (early return above handles the false case)
+    let level;
+    if (hasL3) {
+        level = 'L3';
+    }
+    else if (hasL2 || (hasOidc && (await hasSigningArtifacts(workflowFiles)))) {
+        level = 'L2';
+    }
+    else {
+        level = 'L1';
+    }
+    return { level, hasCi, isPublishing, hasOidc };
+}
+/**
+ * Detect which SLSA provenance format is declared in the project's attestation files.
+ * SLSA v1.1 (April 2025) uses `slsa.dev/provenance/v1`.
+ * Legacy projects may still use `slsa.dev/provenance/v0.2`.
+ * Both are valid; v1 is preferred going forward.
+ */
+export async function detectSlsaProvenanceFormat(projectPath) {
+    const workflowFiles = await findWorkflowFiles(projectPath);
+    let hasV1 = false;
+    let hasV02 = false;
+    for (const file of workflowFiles) {
+        const content = await readFileSafe(file);
+        if (content.includes(SLSA_PROVENANCE_V1_FORMAT)) {
+            hasV1 = true;
+        }
+        if (content.includes(SLSA_PROVENANCE_V02_FORMAT)) {
+            hasV02 = true;
+        }
+    }
+    if (hasV1 && hasV02) {
+        return 'both';
+    }
+    if (hasV1) {
+        return 'v1';
+    }
+    if (hasV02) {
+        return 'v0.2';
+    }
+    return 'none';
+}
+/**
+ * Detect npm native provenance via `npm publish --provenance` + `actions/attest-build-provenance`.
+ * When both are present, the project achieves SLSA L2 without external tooling.
+ * Reference: https://docs.npmjs.com/generating-provenance-statements
+ */
+export async function detectNpmProvenance(projectPath, workflowFiles) {
+    const files = workflowFiles ?? (await findWorkflowFiles(projectPath));
+    let hasNpmProvenanceScript = false;
+    let hasAttestAction = false;
+    // Check package.json scripts for `npm publish --provenance`
+    try {
+        const pkg = await readFile(join(projectPath, 'package.json'), 'utf-8');
+        const scripts = JSON.parse(pkg).scripts ?? {};
+        hasNpmProvenanceScript = Object.values(scripts).some((s) => s.includes('npm publish') && s.includes('--provenance'));
+    }
+    catch {
+        // No package.json — not an npm project
+    }
+    // Check if any workflow uses actions/attest-build-provenance
+    for (const file of files) {
+        const content = await readFileSafe(file);
+        if (content.includes('actions/attest-build-provenance')) {
+            hasAttestAction = true;
+            break;
+        }
+    }
+    return {
+        hasNpmProvenanceScript,
+        hasAttestAction,
+        isNativeSlsaL2: hasNpmProvenanceScript && hasAttestAction,
+    };
+}
+/**
+ * Build SLSA gaps from detection results.
+ */
+export function buildSlsaGaps(level, isPublishing, hasOidc) {
+    const gaps = [];
+    if (level === 'L0' && isPublishing) {
+        gaps.push({
+            category: 'slsa',
+            severity: 'critical',
+            message: 'Project publishes artifacts but has no SLSA provenance (L0) — cannot verify build integrity',
+            fix: 'Add `actions/attest-build-provenance` to your release workflow to achieve SLSA L2',
+            references: SLSA_REFS,
+        });
+    }
+    else if (level === 'L0') {
+        gaps.push({
+            category: 'slsa',
+            severity: 'warning',
+            message: 'No CI detected — build is not scripted (SLSA L0)',
+            fix: 'Add GitHub Actions or equivalent CI to script the build (achieves SLSA L1)',
+            references: [SLSA_REFS[0] ?? ''],
+        });
+    }
+    else if (level === 'L1' && isPublishing) {
+        gaps.push({
+            category: 'slsa',
+            severity: 'warning',
+            message: 'Project publishes artifacts but only achieves SLSA L1 — no signed provenance',
+            fix: 'Add `actions/attest-build-provenance` with `permissions: id-token: write` to achieve SLSA L2',
+            references: SLSA_REFS,
+        });
+    }
+    if ((level === 'L1' || level === 'L2') && !hasOidc && isPublishing) {
+        gaps.push({
+            category: 'slsa',
+            severity: 'warning',
+            message: 'Release workflow missing `permissions: id-token: write` — OIDC signing not enabled',
+            fix: 'Add `permissions: id-token: write` to the job in your release workflow',
+            references: [SLSA_REFS[2] ?? ''],
+        });
+    }
+    return gaps;
+}
+//# sourceMappingURL=slsa-checker.js.map

package/dist/engine/supply-chain/slsa-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slsa-checker.js","sourceRoot":"","sources":["../../../src/engine/supply-chain/slsa-checker.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AAEjF,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,wCAAwC;AACxC,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,gDAAgD;AAChD,MAAM,gBAAgB,GAAG,CAAC,iCAAiC,EAAE,2BAA2B,EAAE,QAAQ,CAAC,CAAC;AAEpG,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,CAAC,yBAAyB,EAAE,0BAA0B,CAAC,CAAC;AAElF,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;AAExF,kBAAkB;AAClB,MAAM,SAAS,GAAG;IAChB,6BAA6B;IAC7B,yDAAyD;IACzD,mHAAmH;CACpH,CAAC;AAEF,2DAA2D;AAC3D,0DAA0D;AAC1D,MAAM,yBAAyB,GAAG,wBAAwB,CAAC;AAC3D,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AAK9D,oEAAoE;AACpE,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8CAA8C;AAC9C,KAAK,UAAU,iBAAiB,CAAC,WAAmB;IAClD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE;YAC1C,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,wBAAwB,CAAC,aAAuB;IAC7D,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,iBAAiB,CAAC,aAAuB;IACtD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,kBAAkB,CAAC,WAAmB,EAAE,aAAuB;IAC5E,6BAA6B;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0C,CAAC,OAAO,IAAI,EAAE,CAAC;QACxF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IAED,0CAA0C;IAC1C,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAAC,aAAuB;IACtD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,mBAAmB,CAAC,aAAuB;IACxD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAmB;IAEnB,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAEvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9D,wBAAwB,CAAC,aAAa,CAAC;QACvC,iBAAiB,CAAC,aAAa,CAAC;QAChC,kBAAkB,CAAC,WAAW,EAAE,aAAa,CAAC;QAC9C,iBAAiB,CAAC,aAAa,CAAC;KACjC,CAAC,CAAC;IAEH,wEAAwE;IACxE,IAAI,KAAgB,CAAC;IACrB,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;SAAM,IAAI,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB;IAEnB,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAChD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YACjD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,aAAwB;IAExB,MAAM,KAAK,GAAG,aAAa,IAAI,CAAC,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;IACtE,IAAI,sBAAsB,GAAG,KAAK,CAAC;IACnC,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,4DAA4D;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0C,CAAC,OAAO,IAAI,EAAE,CAAC;QACxF,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAC/D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,6DAA6D;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CAAC,EAAE,CAAC;YACxD,eAAe,GAAG,IAAI,CAAC;YACvB,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO;QACL,sBAAsB;QACtB,eAAe;QACf,cAAc,EAAE,sBAAsB,IAAI,eAAe;KAC1D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAgB,EAChB,YAAqB,EACrB,OAAgB;IAEhB,MAAM,IAAI,GAAqB,EAAE,CAAC;IAElC,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,UAAU;YACpB,OAAO,EACL,6FAA6F;YAC/F,GAAG,EAAE,mFAAmF;YACxF,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,kDAAkD;YAC3D,GAAG,EAAE,4EAA4E;YACjF,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,8EAA8E;YACvF,GAAG,EAAE,8FAA8F;YACnG,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,oFAAoF;YAC7F,GAAG,EAAE,wEAAwE;YAC7E,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/engine/test-contract-generator.d.ts

@@ -0,0 +1,18 @@
+import type { ContractSpec, ContractValidation, ApiMockDefinition, ContractSpecEndpoint, ContractFormat } from '../types/index.js';
+/**
+ * Generate an API contract from spec endpoint information.
+ */
+export declare function generateContractFromSpec(specTitle: string, endpoints: ContractSpecEndpoint[], format: ContractFormat): ContractSpec;
+/**
+ * Generate API endpoint mocks for parallel frontend/backend development.
+ */
+export declare function generateMocksFromSpec(_specTitle: string, endpoints: ContractSpecEndpoint[]): ApiMockDefinition[];
+/**
+ * Generate an MSW (Mock Service Worker) handler file from mock definitions.
+ */
+export declare function generateMockServerTemplate(mocks: ApiMockDefinition[]): string;
+/**
+ * Validate that implemented endpoints comply with the generated contract.
+ */
+export declare function validateContractCompliance(implementedEndpoints: string[], contract: ContractSpec): ContractValidation[];
+//# sourceMappingURL=test-contract-generator.d.ts.map

package/dist/engine/test-contract-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-contract-generator.d.ts","sourceRoot":"","sources":["../../src/engine/test-contract-generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EAEjB,oBAAoB,EACpB,cAAc,EACf,MAAM,mBAAmB,CAAC;AAkB3B;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,oBAAoB,EAAE,EACjC,MAAM,EAAE,cAAc,GACrB,YAAY,CAGd;AAiHD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,oBAAoB,EAAE,GAChC,iBAAiB,EAAE,CAErB;AA8BD;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAU7E;AAID;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,oBAAoB,EAAE,MAAM,EAAE,EAC9B,QAAQ,EAAE,YAAY,GACrB,kBAAkB,EAAE,CAUtB"}

package/dist/engine/test-contract-generator.js

@@ -0,0 +1,178 @@
+// engine/test-contract-generator.ts — SPEC-018 contract and mock generators
+// Generates API contracts (OpenAPI, GraphQL, Pact, tRPC) and API mocks from spec endpoints.
+// === Internal helpers ===
+function toPascal(str) {
+    return str
+        .replace(/[^a-zA-Z0-9\s]/g, '')
+        .split(/\s+/)
+        .map((w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase())
+        .join('');
+}
+function toSnake(str) {
+    return str.toLowerCase().replace(/[^a-z0-9]/g, '_');
+}
+// === Contract generation ===
+/**
+ * Generate an API contract from spec endpoint information.
+ */
+export function generateContractFromSpec(specTitle, endpoints, format) {
+    const content = buildContractContent(specTitle, endpoints, format);
+    return { format, content, endpoints };
+}
+function buildContractContent(title, endpoints, format) {
+    if (format === 'openapi') {
+        return buildOpenApiContent(title, endpoints);
+    }
+    if (format === 'graphql-schema') {
+        return buildGraphqlContent(title);
+    }
+    if (format === 'pact') {
+        return buildPactContent(title, endpoints);
+    }
+    return buildTrpcContent(title);
+}
+function buildOpenApiContent(title, endpoints) {
+    const paths = endpoints
+        .map((ep) => {
+        const method = ep.method.toLowerCase();
+        const statusLines = ep.statusCodes
+            .map((s) => `        '${s}':\n          description: "${s === 200 ? 'Success' : 'Error'}"`)
+            .join('\n');
+        return `  ${ep.path}:\n    ${method}:\n      summary: "${title} — ${ep.method} ${ep.path}"\n      responses:\n${statusLines}`;
+    })
+        .join('\n');
+    return `openapi: '3.0.3'\ninfo:\n  title: "${title} API Contract"\n  version: '1.0.0'\npaths:\n${paths}\n`;
+}
+function buildGraphqlContent(title) {
+    const typeName = toPascal(title);
+    return [
+        `# GraphQL schema for: ${title}`,
+        '# Generated by SpecForge SDD MCP Server',
+        '',
+        `type ${typeName} {`,
+        '  id: ID!',
+        '  # TODO: add fields',
+        '}',
+        '',
+        'type Query {',
+        `  get${typeName}(id: ID!): ${typeName}`,
+        `  list${typeName}s: [${typeName}!]!`,
+        '}',
+        '',
+        'type Mutation {',
+        `  create${typeName}(input: Create${typeName}Input!): ${typeName}!`,
+        `  update${typeName}(id: ID!, input: Update${typeName}Input!): ${typeName}!`,
+        `  delete${typeName}(id: ID!): Boolean!`,
+        '}',
+        '',
+        `input Create${typeName}Input {`,
+        '  # TODO: add fields',
+        '}',
+        '',
+        `input Update${typeName}Input {`,
+        '  # TODO: add fields',
+        '}',
+        '',
+    ].join('\n');
+}
+function buildPactContent(title, endpoints) {
+    const interactions = endpoints.map((ep) => ({
+        description: `${ep.method} ${ep.path}`,
+        request: { method: ep.method, path: ep.path },
+        response: { status: ep.statusCodes[0] ?? 200, body: {} },
+    }));
+    return JSON.stringify({
+        consumer: { name: 'consumer' },
+        provider: { name: title.replace(/\s+/g, '-').toLowerCase() },
+        interactions,
+        metadata: { pactSpecification: { version: '2.0.0' } },
+    }, null, 2);
+}
+function buildTrpcContent(title) {
+    const routerName = toSnake(title);
+    return [
+        `// tRPC router contract for: ${title}`,
+        '// Generated by SpecForge SDD MCP Server',
+        "import { router, publicProcedure } from '../trpc';",
+        "import { z } from 'zod';",
+        '',
+        `export const ${routerName}Router = router({`,
+        '  getAll: publicProcedure.query(async () => {',
+        '    // TODO: implement',
+        '    return [];',
+        '  }),',
+        '  getById: publicProcedure.input(z.object({ id: z.string() })).query(async ({ input }) => {',
+        '    // TODO: implement',
+        '    return { id: input.id };',
+        '  }),',
+        '  create: publicProcedure',
+        '    .input(z.object({ /* TODO: add fields */ }))',
+        '    .mutation(async () => {',
+        '      // TODO: implement',
+        "      return { id: 'new-id' };",
+        '    }),',
+        '});',
+        '',
+    ].join('\n');
+}
+// === Mock generation ===
+/**
+ * Generate API endpoint mocks for parallel frontend/backend development.
+ */
+export function generateMocksFromSpec(_specTitle, endpoints) {
+    return endpoints.map((ep) => buildMockDefinition(ep));
+}
+function buildMockDefinition(ep) {
+    const errorResponses = [
+        { status: 400, body: { error: 'Bad Request', message: 'Invalid input provided' } },
+        { status: 404, body: { error: 'Not Found', message: 'Resource not found' } },
+        { status: 500, body: { error: 'Internal Server Error', message: 'Unexpected error' } },
+    ];
+    return {
+        endpoint: ep.path,
+        method: ep.method,
+        sampleData: buildSampleData(ep),
+        delayMs: 100,
+        errorResponses,
+    };
+}
+function buildSampleData(ep) {
+    if (ep.responseSchema && Object.keys(ep.responseSchema).length > 0) {
+        return ep.responseSchema;
+    }
+    return {
+        id: 'sample-id-001',
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+        data: {},
+    };
+}
+/**
+ * Generate an MSW (Mock Service Worker) handler file from mock definitions.
+ */
+export function generateMockServerTemplate(mocks) {
+    const handlers = mocks
+        .map((mock) => {
+        const method = mock.method.toLowerCase();
+        const responseBody = JSON.stringify(mock.sampleData, null, 4).replace(/^/gm, '    ');
+        return `  http.${method}('${mock.endpoint}', async () => {\n    await delay(${mock.delayMs});\n    return HttpResponse.json(\n${responseBody}\n    );\n  }),`;
+    })
+        .join('\n\n');
+    return `// MSW mock handlers — generated by SpecForge SDD MCP Server\nimport { http, HttpResponse, delay } from 'msw';\n\nexport const handlers = [\n${handlers}\n];\n`;
+}
+// === Contract validation ===
+/**
+ * Validate that implemented endpoints comply with the generated contract.
+ */
+export function validateContractCompliance(implementedEndpoints, contract) {
+    return contract.endpoints.map((ep) => {
+        const key = `${ep.method}:${ep.path}`;
+        const found = implementedEndpoints.includes(key);
+        return {
+            endpoint: key,
+            compliant: found,
+            issues: found ? [] : [`Endpoint ${ep.method} ${ep.path} not found in implementation`],
+        };
+    });
+}
+//# sourceMappingURL=test-contract-generator.js.map