specshield 3.2.1 → 3.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specshield",
-  "version": "3.2.1",
+  "version": "3.2.3",
   "description": "CLI for OpenAPI breaking change detection and bi-directional contract verification — with can-i-deploy gating, GitHub PR checks, and a first-run setup wizard.",
   "main": "src/cli.js",
   "bin": {
@@ -54,6 +54,9 @@
     "LICENSE"
   ],
   "dependencies": {
+    "@apidevtools/swagger-parser": "^10.1.1",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
     "axios": "^1.6.7",
     "chalk": "^4.1.2",
     "commander": "^12.0.0",

package/src/cli.js

@@ -9,6 +9,7 @@ const logoutCommand = require('./commands/logout');
 const bdctCommand = require('./commands/bdct');
 const historyCommand = require('./commands/history');
 const shareCommand = require('./commands/share');
+const whoamiCommand = require('./commands/whoami');
 
 const program = new Command();
 
@@ -28,6 +29,7 @@ program.addCommand(logoutCommand);
 program.addCommand(bdctCommand);
 program.addCommand(historyCommand);
 program.addCommand(shareCommand);
+program.addCommand(whoamiCommand);
 
 program.parseAsync(process.argv).catch((err) => {
   const logger = require('./utils/logger');

package/src/commands/bdct.js

@@ -41,7 +41,7 @@ function withProjectDefaults(opts, command) {
   try {
     applyBdctDefaults(opts, command);
   } catch (err) {
-    if (err.code === 'MISSING_REQUIRED_OPTIONS') {
+    if (err.code === 'MISSING_REQUIRED_OPTIONS' || err.code === 'UNRESOLVED_PLACEHOLDER') {
       logger.error(err.message);
       process.exit(2);
     }
@@ -689,6 +689,164 @@ const listConsumersCommand = new Command('list-consumers')
     }
   });
 
+// ─── capture (Fix 2 — turn recorded traffic into a consumer contract) ────────
+// Reads a HAR file (any browser/Cypress/Playwright/k6 can export one) and
+// emits an OpenAPI 3.0 consumer-contract subset describing only the
+// endpoints/fields the consumer actually called/read. Pure local CLI work —
+// no API token required.
+
+const captureFromHarCommand = new Command('from-har')
+  .description('Generate a consumer OpenAPI contract from a recorded HAR file')
+  .requiredOption('--in <path>',          'Input HAR file (HTTP Archive 1.2)')
+  .option('--out <path>',                 'Output file (default: write to stdout)')
+  .option('--base-url <url>',             'Keep only entries matching this URL prefix (e.g. https://api.acme.com or https://api.acme.com/v1)')
+  .option('--method <verbs>',             'Comma-separated methods to include (e.g. GET,POST). Default: all')
+  .option('--title <title>',              'OpenAPI info.title', 'Captured consumer contract')
+  .option('--version <ver>',              'OpenAPI info.version', '0.1.0')
+  .option('--format <fmt>',               'Output format: yaml | json', 'yaml')
+  .option('--include-non-json',           'Keep entries with non-JSON bodies (default: drop them)')
+  .action(async (opts) => {
+    const { captureFromHarFile } = require('../core/har');
+    const inputPath = path.resolve(opts.in);
+    if (!fsExtra.existsSync(inputPath)) {
+      logger.error(`HAR file not found: ${inputPath}`);
+      process.exit(2);
+    }
+    const methods = opts.method
+      ? opts.method.split(',').map(s => s.trim()).filter(Boolean)
+      : undefined;
+
+    let result;
+    try {
+      result = captureFromHarFile(inputPath, {
+        baseUrl: opts.baseUrl,
+        methods,
+        onlyJson: !opts.includeNonJson,
+        title: opts.title,
+        version: opts.version,
+        format: opts.format,
+      });
+    } catch (err) {
+      logger.error(err.message);
+      process.exit(1);
+    }
+
+    if (opts.out) {
+      const outPath = path.resolve(opts.out);
+      fsExtra.outputFileSync(outPath, result.text);
+      process.stderr.write(chalk.green('✔ ') +
+        `Wrote ${chalk.cyan(opts.out)}  ` +
+        chalk.gray(`(${result.summary.endpoints} endpoints, ${result.summary.operations} ops from ${result.summary.recordsKept}/${result.summary.harEntries} entries)`) + '\n');
+    } else {
+      process.stdout.write(result.text);
+      process.stderr.write(chalk.gray(
+        `# ${result.summary.endpoints} endpoints, ${result.summary.operations} ops from ${result.summary.recordsKept}/${result.summary.harEntries} HAR entries\n`
+      ));
+    }
+  });
+
+const captureCommand = new Command('capture')
+  .description('Capture a consumer OpenAPI contract from observed traffic (currently: HAR ingest)');
+captureCommand.addCommand(captureFromHarCommand);
+
+// ─── verify-provider (Fix 3 — spec-vs-production conformance) ─────────────────
+// Fires probes derived from the OpenAPI spec at the running provider and
+// validates that every response body actually matches its documented schema.
+// Pure local CLI work (calls the customer's service directly); no API token.
+// Safe-by-default: only GET/HEAD/OPTIONS unless --include-mutating.
+
+const verifyProviderCommand = new Command('verify-provider')
+  .description('Check that a running provider service matches its OpenAPI spec')
+  .requiredOption('--spec <path>',         'Path to the provider OpenAPI spec (YAML or JSON)')
+  .requiredOption('--base-url <url>',      'Base URL of the running provider, e.g. https://staging.payments.acme.com')
+  .option('--include-mutating',            'Also probe POST/PUT/PATCH/DELETE (off by default for safety)')
+  .option('--path-params <kvList>',        'Resolve path params: name=val,other=val (overrides spec examples)', collectPathParams, {})
+  .option('--header <header>',             'Extra request header to send, e.g. "Authorization: Bearer X" (repeatable)', collectHeaders, {})
+  .option('--timeout-ms <ms>',             'Per-request timeout in ms', v => parseInt(v, 10), 8000)
+  .option('--json',                        'Output raw JSON instead of the human report')
+  .action(async (opts) => {
+    const { verifyProvider } = require('../core/conformance');
+    const specPath = path.resolve(opts.spec);
+    if (!fsExtra.existsSync(specPath)) {
+      logger.error(`Spec file not found: ${specPath}`);
+      process.exit(2);
+    }
+    const spinner = opts.json ? null : ora('Probing provider…').start();
+    let report;
+    try {
+      report = await verifyProvider({
+        spec: specPath,
+        baseUrl: opts.baseUrl,
+        includeMutating: !!opts.includeMutating,
+        pathParams: opts.pathParams,
+        headers: opts.header,
+        timeoutMs: opts.timeoutMs,
+      });
+    } catch (err) {
+      if (spinner) spinner.fail('Conformance run failed');
+      logger.error(err.message);
+      process.exit(1);
+    }
+    if (spinner) spinner.stop();
+
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+      process.exit(report.summary.fail + report.summary.error > 0 ? 1 : 0);
+    }
+
+    // Human report.
+    process.stdout.write('\n' + chalk.bold('  Provider conformance — spec vs ') + chalk.cyan(opts.baseUrl) + '\n');
+    process.stdout.write('  ' + '─'.repeat(60) + '\n');
+    for (const r of report.results) {
+      const label = `${r.method.padEnd(6)} ${r.routePath}`;
+      const tag =
+        r.status === 'PASS'    ? chalk.green('  PASS  ') :
+        r.status === 'FAIL'    ? chalk.red('  FAIL  ')   :
+        r.status === 'ERROR'   ? chalk.red(' ERROR  ')   :
+                                  chalk.yellow(' SKIP   ');
+      process.stdout.write(`  ${tag} ${label}` +
+        (r.httpStatus ? chalk.gray(`  (${r.httpStatus})`) : '') + '\n');
+      if (r.status === 'FAIL' && r.mismatches && r.mismatches.length > 0) {
+        for (const m of r.mismatches.slice(0, 5)) {
+          process.stdout.write(chalk.gray(`           ${m.path || '(root)'}: ${m.message}\n`));
+        }
+        if (r.mismatches.length > 5) {
+          process.stdout.write(chalk.gray(`           …and ${r.mismatches.length - 5} more\n`));
+        }
+      } else if (r.status === 'FAIL' && r.reason) {
+        process.stdout.write(chalk.gray(`           ${r.reason}\n`));
+      } else if (r.status === 'ERROR') {
+        process.stdout.write(chalk.gray(`           ${r.error}\n`));
+      } else if (r.status === 'SKIPPED') {
+        process.stdout.write(chalk.gray(`           ${r.reason}: ${r.skipReason}\n`));
+      }
+    }
+    const s = report.summary;
+    process.stdout.write('  ' + '─'.repeat(60) + '\n');
+    process.stdout.write(`  ${s.pass} pass · ${s.fail} fail · ${s.error} error · ${s.skipped} skip   (${s.total} probes)\n\n`);
+    process.exit(s.fail + s.error > 0 ? 1 : 0);
+  });
+
+// Repeatable --header parser: collects into a map.
+function collectHeaders(val, acc) {
+  const idx = val.indexOf(':');
+  if (idx < 0) return acc;
+  const k = val.slice(0, idx).trim();
+  const v = val.slice(idx + 1).trim();
+  if (k) acc[k] = v;
+  return acc;
+}
+
+// --path-params name=val,name=val parser: merges into the accumulator so the
+// flag can be passed multiple times.
+function collectPathParams(val, acc) {
+  for (const pair of String(val).split(',')) {
+    const [k, ...rest] = pair.split('=');
+    if (k && k.trim()) acc[k.trim()] = rest.join('=').trim();
+  }
+  return acc;
+}
+
 // ─── Parent bdct command ──────────────────────────────────────────────────────
 
 const bdct = new Command('bdct')
@@ -702,5 +860,7 @@ bdct.addCommand(listCommand);
 bdct.addCommand(matrixCommand);
 bdct.addCommand(listProvidersCommand);
 bdct.addCommand(listConsumersCommand);
+bdct.addCommand(captureCommand);
+bdct.addCommand(verifyProviderCommand);
 
 module.exports = bdct;

package/src/commands/init.js

@@ -25,6 +25,17 @@ const DEFAULT_SERVER = 'https://specshield.io';
 
 // ─── Helpers ───────────────────────────────────────────────────────────────
 
+const PLACEHOLDER = '<replace-me>';
+
+// Skippable text fields in the interactive wizard. Empty values for these
+// become PLACEHOLDER tokens in the generated config; non-skippable fields
+// (kind, contractFormat, environment which has a default) are not in this list.
+const PLACEHOLDER_FIELDS = [
+  'providerName', 'specPath',
+  'consumerName', 'consumerProvider', 'contractPath',
+  'org',
+];
+
 function abortIfCancelled(answers, keys) {
   // `prompts` returns undefined values when the user hits Ctrl-C.
   for (const k of keys) {
@@ -35,6 +46,42 @@ function abortIfCancelled(answers, keys) {
   }
 }
 
+/**
+ * Replace empty answers with the PLACEHOLDER token so the generated config
+ * makes the gap visible (vs writing an empty string the user might miss).
+ * Only operates on the fields listed in PLACEHOLDER_FIELDS — required
+ * non-text choices like `kind` are left untouched.
+ */
+function fillPlaceholders(answers) {
+  for (const f of PLACEHOLDER_FIELDS) {
+    if (answers[f] === '' || answers[f] === null || answers[f] === undefined) continue;
+    // Keep the value the user entered.
+  }
+  for (const f of PLACEHOLDER_FIELDS) {
+    if (answers[f] === '' || answers[f] === null) answers[f] = PLACEHOLDER;
+  }
+}
+
+/**
+ * Walk a built config object and return a list of `{ path, value }` for every
+ * leaf whose value equals PLACEHOLDER. The `path` is the dotted YAML path
+ * (e.g. `bdct.org`, `bdct.provider.spec`) — same form the user sees when
+ * editing the .specshield.yml file.
+ */
+function collectPlaceholders(cfg) {
+  const out = [];
+  const walk = (obj, prefix) => {
+    if (!obj || typeof obj !== 'object') return;
+    for (const [k, v] of Object.entries(obj)) {
+      const p = prefix ? `${prefix}.${k}` : k;
+      if (v === PLACEHOLDER) out.push({ path: p, value: v });
+      else if (v && typeof v === 'object') walk(v, p);
+    }
+  };
+  walk(cfg, '');
+  return out;
+}
+
 async function validateApiKey(server, key) {
   try {
     const res = await axios.post(`${server.replace(/\/$/, '')}/auth/validate-api-key`,
@@ -156,12 +203,21 @@ async function interactiveFlow(detected, opts) {
   const wantsProvider = k.kind === 'provider' || k.kind === 'both';
   const wantsConsumer = k.kind === 'consumer' || k.kind === 'both';
 
+  // Optional-by-default prompts. Pressing Enter on any text field is OK
+  // and produces a "<replace-me>" placeholder in the generated config —
+  // surfaced at the end of the wizard and refused by any bdct command
+  // that later tries to use it. Lets a user explore the wizard without
+  // having to know their org key or provider name up front.
+  const skipHint = chalk.gray('(press Enter to skip — fill in later)');
+
   if (wantsProvider) {
     const provQs = [
-      { type: 'text', name: 'providerName', message: 'Provider name', initial: detected.serviceName },
-      { type: 'text', name: 'specPath',     message: 'Path to provider OpenAPI spec',
-        initial: detected.spec || 'api/openapi.yaml',
-        validate: (v) => v ? true : 'Required',
+      { type: 'text', name: 'providerName',
+        message: `Provider name ${skipHint}`,
+        initial: detected.serviceName },
+      { type: 'text', name: 'specPath',
+        message: `Path to provider OpenAPI spec ${skipHint}`,
+        initial: detected.spec || 'openapi.yaml',
       },
     ];
     const r = await prompts(provQs);
@@ -171,15 +227,14 @@ async function interactiveFlow(detected, opts) {
 
   if (wantsConsumer) {
     const consQs = [
-      { type: 'text', name: 'consumerName',     message: 'Consumer name',
+      { type: 'text', name: 'consumerName',
+        message: `Consumer name ${skipHint}`,
         initial: detected.serviceName },
-      { type: 'text', name: 'consumerProvider', message: 'Provider this consumer talks to',
-        validate: (v) => v ? true : 'Required',
-      },
-      { type: 'text', name: 'contractPath',     message: 'Path to consumer contract',
-        initial: 'contracts/contract.yaml',
-        validate: (v) => v ? true : 'Required',
-      },
+      { type: 'text', name: 'consumerProvider',
+        message: `Provider this consumer talks to ${skipHint}` },
+      { type: 'text', name: 'contractPath',
+        message: `Path to consumer contract ${skipHint}`,
+        initial: 'contracts/contract.yaml' },
       { type: 'select', name: 'contractFormat', message: 'Contract format',
         choices: [
           { title: 'OpenAPI', value: 'OPENAPI' },
@@ -243,8 +298,8 @@ async function interactiveFlow(detected, opts) {
       });
       abortIfCancelled(r, ['org']);
       if (r.org === '__manual__') {
-        const m = await prompts({ type: 'text', name: 'org', message: 'Org key',
-          validate: (v) => v ? true : 'Required' });
+        const m = await prompts({ type: 'text', name: 'org',
+          message: `Org key ${skipHint}` });
         abortIfCancelled(m, ['org']);
         answers.org = m.org;
       } else {
@@ -252,8 +307,8 @@ async function interactiveFlow(detected, opts) {
       }
     } else {
       const r = await prompts({
-        type: 'text', name: 'org', message: 'Org key',
-        validate: (v) => v ? true : 'Required',
+        type: 'text', name: 'org',
+        message: `Org key ${skipHint}`,
       });
       abortIfCancelled(r, ['org']);
       answers.org = r.org;
@@ -409,6 +464,11 @@ const initCommand = new Command('init')
       if (answers === null) return;     // user said "don't overwrite"
     }
 
+    // Empty answers from the interactive flow → "<replace-me>" placeholders.
+    // The end-of-wizard summary lists every placeholder by path so users
+    // don't accidentally commit them.
+    fillPlaceholders(answers);
+
     const cfg  = buildConfig(answers, detected);
     const yaml = render(cfg);
 
@@ -435,10 +495,29 @@ const initCommand = new Command('init')
         providerName:        answers.providerName,
         consumerName:        answers.consumerName,
         providerForConsumer: answers.consumerProvider,
+        org:                 answers.org,
+        specPath:            answers.specPath,
+        contractPath:        answers.contractPath,
+        environment:         answers.environment,
       }, cwd);
       ok(`Wrote ${chalk.white(path.relative(cwd, workflowPath))}`);
     }
 
+    // Placeholders summary — if the user pressed Enter on any prompt,
+    // surface what's still missing so they can fill it in before running
+    // any bdct command. Pre-flight checks in bdct.js will block commands
+    // that hit a literal "<replace-me>" value at runtime.
+    const placeholders = collectPlaceholders(cfg);
+    if (placeholders.length > 0) {
+      fmtSection('Placeholders to fill in');
+      placeholders.forEach(p =>
+        warn(`${chalk.yellow(p.path)} = ${chalk.gray('<replace-me>')}`));
+      warn(chalk.yellow(
+        `Edit ${path.relative(cwd, target) || '.specshield.yml'} ` +
+        `to replace ${placeholders.length} placeholder${placeholders.length === 1 ? '' : 's'} ` +
+        `before running bdct commands.`));
+    }
+
     fmtSection('Next steps');
     if (answers.kind !== 'skip') {
       info(`Try: ${chalk.white('specshield bdct list-providers')}`);
@@ -449,3 +528,6 @@ const initCommand = new Command('init')
   });
 
 module.exports = initCommand;
+
+// Exposed for unit tests — keep usage internal to the init module otherwise.
+module.exports.__test__ = { fillPlaceholders, collectPlaceholders, PLACEHOLDER };

package/src/commands/whoami.js

@@ -0,0 +1,105 @@
+'use strict';
+
+/**
+ * `specshield whoami` — print the active customer's identity and the list of
+ * organizations they can use as `--org` values. Reuses /auth/validate-api-key
+ * (for the customer summary) and /me/orgs (for the org list) — the same two
+ * endpoints the init wizard hits.
+ *
+ * Why it exists: the dashboard now surfaces orgKey, but terminal-native users
+ * and CI engineers shouldn't have to open a browser to discover what their
+ * org_key is. This command makes it a one-line lookup.
+ *
+ * Resolves the API token the same way every other command does:
+ *   --api-token flag  >  $SPECSHIELD_API_KEY  >  stored ~/.specshield/config.json
+ */
+
+const { Command } = require('commander');
+const chalk = require('chalk');
+const axios = require('axios');
+const logger = require('../utils/logger');
+const { getStoredApiKey } = require('../config/localConfig');
+
+const DEFAULT_SERVER = 'https://specshield.io';
+
+const whoami = new Command('whoami');
+
+whoami
+  .description('Show the signed-in customer and the orgKeys you can use as --org')
+  .option('--api-token <key>', 'Override stored / env API token for this call')
+  .option('--server <url>',    'Override the SpecShield server URL', DEFAULT_SERVER)
+  .option('--json',            'Output machine-readable JSON instead of a table')
+  .action(async (opts) => {
+    const token = opts.apiToken
+      || process.env.SPECSHIELD_API_KEY
+      || (await getStoredApiKey());
+    if (!token) {
+      logger.error('Not logged in. Run: specshield login --api-key <KEY>');
+      process.exit(2);
+    }
+
+    const server = (opts.server || DEFAULT_SERVER).replace(/\/$/, '');
+    const headers = { 'X-Api-Key': token, 'X-SpecShield-Client': 'cli' };
+
+    let me, orgs;
+    try {
+      const meRes = await axios.post(`${server}/auth/validate-api-key`, {}, { headers, timeout: 8000 });
+      if (!meRes.data || !meRes.data.valid) {
+        logger.error('API key did not validate against ' + server);
+        process.exit(2);
+      }
+      me = meRes.data;
+    } catch (err) {
+      logger.error(err.response
+        ? `Failed to validate token: ${err.response.status} ${JSON.stringify(err.response.data)}`
+        : `Could not reach ${server}: ${err.message}`);
+      process.exit(2);
+    }
+
+    try {
+      const orgsRes = await axios.get(`${server}/me/orgs`, { headers, timeout: 8000 });
+      orgs = Array.isArray(orgsRes.data) ? orgsRes.data : (orgsRes.data?.orgs || []);
+    } catch (err) {
+      // Org fetch is best-effort; the customer info already printed below
+      // is the more important part.
+      orgs = [];
+    }
+
+    if (opts.json) {
+      process.stdout.write(JSON.stringify({
+        customer: { name: me.name, email: me.email, plan: me.plan, customerId: me.customerId },
+        server,
+        orgs: orgs.map(o => ({ orgKey: o.orgKey, name: o.name, role: o.myRole || o.role || null })),
+      }, null, 2) + '\n');
+      return;
+    }
+
+    // Human-readable output. Two sections — identity, then orgs table.
+    process.stdout.write('\n');
+    process.stdout.write(`  ${chalk.bold('Logged in as:')} ${me.name || '(no name)'} `);
+    if (me.email) process.stdout.write(chalk.gray(`(${me.email})`));
+    process.stdout.write(`   ${chalk.gray('· plan:')} ${chalk.cyan(me.plan || 'FREE')}\n`);
+    process.stdout.write(`  ${chalk.gray('Server:')}       ${server}\n`);
+    process.stdout.write('\n');
+
+    if (orgs.length === 0) {
+      process.stdout.write(chalk.yellow('  You are not a member of any organization yet.\n'));
+      process.stdout.write(chalk.gray(`  Create one at ${server}/account/team to get an org_key.\n\n`));
+      return;
+    }
+
+    process.stdout.write(`  ${chalk.bold('Organizations you can use as --org:')}\n`);
+    process.stdout.write(chalk.gray('  ─────────────────────────────────────────────────────\n'));
+    const widestKey = Math.max(...orgs.map(o => (o.orgKey || '').length), 8);
+    for (const o of orgs) {
+      const key  = (o.orgKey || '').padEnd(widestKey);
+      const role = o.myRole || o.role || '';
+      process.stdout.write(
+        `    ${chalk.cyan(key)}   ${o.name || ''}` +
+        (role ? `   ${chalk.gray('(' + role + ')')}` : '') + '\n');
+    }
+    process.stdout.write('\n');
+    process.stdout.write(chalk.gray(`  Tip: paste an org_key into --org on CLI commands or bdct.org in .specshield.yml\n\n`));
+  });
+
+module.exports = whoami;

package/src/core/configWriter.js

@@ -137,10 +137,32 @@ function writeProjectConfig(config, cwd = process.cwd()) {
 /**
  * Render a starter GitHub Actions workflow that uses
  * `specshield26/bdct-action@v1`. Optional output of the wizard.
+ *
+ * Every input forwarded to the action MUST be present in the rendered YAML
+ * — including org. A missing org renders `--org ""` on the CLI invocation
+ * and the action fails with a cryptic "expected value" error from commander.
+ *
+ * spec/contract paths come from detection (or the user's --spec / --contract
+ * flag). They are NOT hardcoded — a previous version assumed every project
+ * stored its spec at `api/openapi.yaml`, which broke every project that
+ * keeps the spec at the repo root.
  */
-function renderWorkflow({ kind, providerName, consumerName, providerForConsumer }) {
+function renderWorkflow({
+  kind,
+  providerName,
+  consumerName,
+  providerForConsumer,
+  org,
+  specPath,
+  contractPath,
+  environment,
+}) {
   const isProvider = kind === 'provider' || kind === 'both';
   const isConsumer = kind === 'consumer' || kind === 'both';
+  const env = environment || 'production';
+  const orgLine = org ? `          org: ${org}` : '          org: <replace-me>';
+  const spec    = specPath     || 'openapi.yaml';
+  const contract = contractPath || 'contracts/contract.yaml';
 
   const lines = [
     '# .github/workflows/specshield-bdct.yml',
@@ -163,10 +185,11 @@ function renderWorkflow({ kind, providerName, consumerName, providerForConsumer
       '      - uses: specshield26/bdct-action@v1',
       '        with:',
       '          command: publish-provider',
+      orgLine,
       `          provider: ${providerName}`,
       '          version: ${{ github.sha }}',
-      '          spec: api/openapi.yaml',
-      '          env: production',
+      `          spec: ${spec}`,
+      `          env: ${env}`,
       '          api-token: ${{ secrets.SPECSHIELD_API_KEY }}',
       '',
       '  gate:',
@@ -176,9 +199,10 @@ function renderWorkflow({ kind, providerName, consumerName, providerForConsumer
       '      - uses: specshield26/bdct-action@v1',
       '        with:',
       '          command: can-i-deploy',
+      orgLine,
       `          service: ${providerName}`,
       '          version: ${{ github.sha }}',
-      '          env: production',
+      `          env: ${env}`,
       '          api-token: ${{ secrets.SPECSHIELD_API_KEY }}',
       '',
     );
@@ -193,10 +217,11 @@ function renderWorkflow({ kind, providerName, consumerName, providerForConsumer
       '      - uses: specshield26/bdct-action@v1',
       '        with:',
       '          command: publish-consumer',
+      orgLine,
       `          consumer: ${consumerName}`,
       `          provider: ${providerForConsumer}`,
       '          version: ${{ github.sha }}',
-      '          contract: contracts/contract.yaml',
+      `          contract: ${contract}`,
       '          api-token: ${{ secrets.SPECSHIELD_API_KEY }}',
       '',
     );

package/src/core/conformance/index.js

@@ -0,0 +1,52 @@
+'use strict';
+
+/**
+ * One-call orchestrator for `specshield bdct verify-provider` — the
+ * "spec-vs-production conformance" check (Fix 3 of the BDCT fidelity
+ * roadmap).
+ *
+ * Loads + dereferences an OpenAPI spec, derives a probe list (safe methods
+ * only by default), fires the probes at the running provider, validates
+ * each response body against the spec's schema for that status, and
+ * returns a structured result + summary.
+ *
+ * Defaults are deliberately conservative — this tool is pointed at REAL
+ * customer services (typically staging, sometimes prod), so:
+ *
+ *   - Only GET / HEAD / OPTIONS unless `includeMutating: true`.
+ *   - Probes whose path params can't be resolved are SKIPPED, not guessed.
+ *   - Network errors are reported as ERROR results — never thrown — so a
+ *     single flaky endpoint doesn't kill the whole run.
+ */
+
+const axios = require('axios');
+const SwaggerParser = require('@apidevtools/swagger-parser');
+const { buildProbes } = require('./probeBuilder');
+const { runProbes }   = require('./runner');
+
+async function verifyProvider(opts) {
+  const spec = await SwaggerParser.dereference(opts.spec);
+  const probes = buildProbes(spec, { includeMutating: !!opts.includeMutating });
+  const http = opts.http || defaultHttpAdapter;
+  return runProbes(spec, probes, {
+    baseUrl: opts.baseUrl,
+    pathParams: opts.pathParams,
+    headers: opts.headers,
+    timeoutMs: opts.timeoutMs,
+    http,
+  });
+}
+
+/** Default HTTP adapter (axios). Returns { status, body } and rejects only
+ *  on connection-level failures — HTTP error statuses come back as data. */
+async function defaultHttpAdapter(method, url, { headers, timeoutMs }) {
+  const res = await axios.request({
+    method, url, headers, timeout: timeoutMs,
+    validateStatus: () => true,    // never throw on 4xx/5xx; the validator decides
+    responseType: 'json',
+    transitional: { silentJSONParsing: true, forcedJSONParsing: true },
+  });
+  return { status: res.status, body: res.data };
+}
+
+module.exports = { verifyProvider, defaultHttpAdapter };