The per-service YAML specs (docs/api/*Service.openapi.yaml) and the served
bundle (worldmonitor.openapi.yaml → public/openapi.yaml) carried only the
entitlement 403s from the injector chain — never the auth half the per-service
JSON specs already have. PR #4602 deferred per-op YAML auth surgery, and the
sibling injectors (#4621/#4623/#4625/#4626) that later reached the YAML never
backfilled it.

This generalizes the bundle-only top-level insertion into a reusable
injectYamlAuthContract() applied to BOTH the per-service YAML loop and the
bundle, reaching full parity with injectJson():
- top-level securitySchemes (2 API-key, or 3 incl. BearerAuth when the artifact
  has a bearer-capable op — mirrors expectedSchemesForSpec)
- root API-key security requirement
- UnauthorizedError schema
- per-operation 401 on authenticated ops (185), security:[] opt-outs on the 7
  public RPCs, and BearerAuth stamping on the ~19 entitlement/premium ops

Reuses the entitlement pass's YAML range-finders; js-yaml is used read-only to
enumerate operation paths (handling the one multi-method path,
/api/v2/shipping/webhooks); all writes stay formatting-preserving and
additions-only. The narrower injectBundle() is removed.

Scope note: widened from the plan's bundle-only DoD to all 34 per-service YAML
after discovering they shared the identical gap (confirmed with the user).

Verified: 401 parity 185 (per-service YAML) / 185 (bundle); idempotent (full
Makefile injector chain re-run = 0 drift); per-service JSON byte-unchanged;
395 contract tests pass (incl. mcp-api-parity, doc-parity, deploy-config).

Claude-Session: https://claude.ai/code/session_01EsjtheWqt8GxEZfd3DyTMu

…e + per-service parity (#4650) (#4654)

* fix(api): extend OpenAPI auth injection to all YAML artifacts (#4650)

The per-service YAML specs (docs/api/*Service.openapi.yaml) and the served
bundle (worldmonitor.openapi.yaml → public/openapi.yaml) carried only the
entitlement 403s from the injector chain — never the auth half the per-service
JSON specs already have. PR #4602 deferred per-op YAML auth surgery, and the
sibling injectors (#4621/#4623/#4625/#4626) that later reached the YAML never
backfilled it.

This generalizes the bundle-only top-level insertion into a reusable
injectYamlAuthContract() applied to BOTH the per-service YAML loop and the
bundle, reaching full parity with injectJson():
- top-level securitySchemes (2 API-key, or 3 incl. BearerAuth when the artifact
  has a bearer-capable op — mirrors expectedSchemesForSpec)
- root API-key security requirement
- UnauthorizedError schema
- per-operation 401 on authenticated ops (185), security:[] opt-outs on the 7
  public RPCs, and BearerAuth stamping on the ~19 entitlement/premium ops

Reuses the entitlement pass's YAML range-finders; js-yaml is used read-only to
enumerate operation paths (handling the one multi-method path,
/api/v2/shipping/webhooks); all writes stay formatting-preserving and
additions-only. The narrower injectBundle() is removed.

Scope note: widened from the plan's bundle-only DoD to all 34 per-service YAML
after discovering they shared the identical gap (confirmed with the user).

Verified: 401 parity 185 (per-service YAML) / 185 (bundle); idempotent (full
Makefile injector chain re-run = 0 drift); per-service JSON byte-unchanged;
395 contract tests pass (incl. mcp-api-parity, doc-parity, deploy-config).

Claude-Session: https://claude.ai/code/session_01EsjtheWqt8GxEZfd3DyTMu

* fix(api): close JSON/YAML parity gaps in OpenAPI auth injector

Follow-up hardening on the YAML auth-contract injector so it fully
mirrors injectJson and stays convergent under source-of-truth edits:

- Per-method entitlement stamping: injectYamlEntitlementContract now
  iterates every HTTP method of a gated path (via enumerateYamlOperations)
  instead of only the first, so a multi-method entitlement path gets the
  403 + PRO-gated note on all methods, matching the JSON sibling.
- Skip public paths in the entitlement pass, mirroring injectJson's
  isPublic-first branch (a public+entitlement overlap no longer stamps a
  stray ForbiddenError 403 on the YAML).
- Auth pass now removes stale operation-level artifacts: a public op drops
  a leftover 401 (removeYamlUnauthorizedResponse), and a non-bearer op
  strips a leftover BearerAuth security block (removeYamlOperationSecurity),
  matching injectJson's delete-op.security / delete-op.responses['401'].
- Fail closed when a path appears in both ENDPOINT_ENTITLEMENTS and
  PUBLIC_FORBIDDEN_GATES, which would otherwise oscillate the 403 body on
  every run and permanently break the pre-push freshness gate.

Removed the now-unused first-method-only findYamlOperationRange. All fixes
target latent reclassification cases; the 34 committed YAML artifacts +
bundle are byte-unchanged (make-generate idempotent, --check clean) and
all 246 contract tests pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_014Ua87UaGSbnHspLCZwfNZK

* fix(api): close residual JSON/YAML parity gaps found in adversarial review

Follow-up to the parity fixes, closing three latent divergences surfaced
by adversarial validation (all dormant under the current config; the 34
YAML artifacts + bundle stay byte-unchanged and --check is clean):

- Quoted-scalar descriptions: appendNoteToYamlScalar now inserts the
  entitlement/gate note INSIDE a single- or double-quoted description scalar
  instead of after the closing quote, which previously produced unparseable
  YAML for any gated op whose description the generator chose to quote (e.g.
  one containing ": "). The per-method stamping had widened this pre-existing
  hazard's blast radius.
- ForbiddenError schema parity: set matchedEntitlementPath before the
  public-path opt-out so a spec whose only entitlement path is also public
  still emits the ForbiddenError schema, matching injectJson's
  public-agnostic hasEntitlementPath.
- Public-forbidden-gate parity: skip non-public gate paths in the gate loop,
  mirroring injectJson which applies the bot-verification 403 only inside its
  isPublic branch (a non-public gate path now takes the authenticated 401
  path instead of getting a stray bot 403).

Validated end-to-end against synthetic fixtures (quoted single/double
scalars, public-only entitlement spec, non-public gate path): output is
valid YAML, idempotent, and matches the JSON contract. 246 contract tests
still pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_014Ua87UaGSbnHspLCZwfNZK

---------

Co-authored-by: Claude <[email protected]>