@kevinrabun/judges-cli 3.124.0

package/dist/evaluators/backwards-compatibility.js

@@ -0,0 +1,168 @@
+import { getLineNumbers, getLangLineNumbers, getLangFamily, testCode } from "./shared.js";
+import * as LP from "../language-patterns.js";
+export function analyzeBackwardsCompatibility(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "COMPAT";
+    const _lang = getLangFamily(language);
+    // No API versioning (multi-language route detection)
+    const routeLines = getLangLineNumbers(code, language, LP.HTTP_ROUTE);
+    const hasApiRoutes = routeLines.length > 0 && /\/api\//i.test(code);
+    const hasVersioning = testCode(code, /\/api\/v\d|\/v\d\/|api-version|x-api-version|accept-version/gi);
+    if (hasApiRoutes && !hasVersioning) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "API endpoints without versioning",
+            description: "API routes are defined under /api/ without a version prefix (e.g., /api/v1/). Without versioning, any changes to the API risk breaking existing consumers.",
+            recommendation: "Add version prefixes to API routes: /api/v1/users. This allows old and new versions to coexist during migration. Use URL, header, or query param versioning.",
+            reference: "API Versioning Best Practices / RESTful API Design",
+            suggestedFix: "Replace `/api/` prefixes with `/api/v1/` in all route definitions and add a versioning middleware or router namespace.",
+            confidence: 0.7,
+        });
+    }
+    // Deprecated API indicators without deprecation headers
+    const hasDeprecated = testCode(code, /deprecated|@deprecated|obsolete|legacy/gi);
+    const hasDeprecationHeader = testCode(code, /Deprecation|Sunset|X-Deprecated/gi);
+    if (hasDeprecated && !hasDeprecationHeader) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Deprecated code without API deprecation headers",
+            description: "Code is marked as deprecated in comments or annotations but no HTTP deprecation headers (Deprecation, Sunset) are set. API consumers won't know features are being retired.",
+            recommendation: "Set HTTP Deprecation and Sunset headers on deprecated endpoints. Document alternatives. Communicate timeline to consumers.",
+            reference: "RFC 8594: The Sunset HTTP Header / API Lifecycle Management",
+            suggestedFix: "Add `res.set('Deprecation', 'true')` and `res.set('Sunset', '<date>')` headers to each deprecated endpoint's response.",
+            confidence: 0.75,
+        });
+    }
+    // Direct field deletion in response objects
+    const deleteFieldPattern = /delete\s+\w+\.\w+/gi;
+    const deleteLines = getLineNumbers(code, deleteFieldPattern);
+    if (deleteLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Field deletion could break consumers",
+            description: "Fields are deleted from objects before sending responses. If this is an API response, removing previously available fields is a breaking change.",
+            lineNumbers: deleteLines,
+            recommendation: "Instead of deleting fields, use a response DTO/mapper that explicitly selects which fields to include. Version the API when removing fields.",
+            reference: "Backwards-Compatible API Evolution",
+            suggestedFix: "Replace `delete obj.field` with a DTO mapper (e.g., `pick(obj, ['allowed', 'fields'])`) so removed fields are controlled by the versioned schema.",
+            confidence: 0.8,
+        });
+    }
+    // Response type changes (sending different structures)
+    const _mixedResponsePattern = /res\.json\s*\(\s*(?:\{|\[)/g;
+    const responseLines = getLineNumbers(code, /res\.json\s*\(/g);
+    if (responseLines.length > 2) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "info",
+            title: "Multiple response formats — verify contract consistency",
+            description: `Found ${responseLines.length} response points. Verify that all endpoints follow a consistent response envelope (e.g., { data, error, meta }). Inconsistent response shapes are a compatibility hazard.`,
+            lineNumbers: responseLines.slice(0, 5),
+            recommendation: "Use a consistent response envelope across all endpoints. Define response schemas (OpenAPI/Swagger) to enforce contracts.",
+            reference: "API Contract Design / JSON:API Specification",
+            suggestedFix: "Wrap all `res.json()` calls in a shared helper like `sendResponse(res, { data, meta })` to enforce a uniform envelope.",
+            confidence: 0.75,
+        });
+    }
+    // No semver in package version
+    const packageVersionPattern = /"version"\s*:\s*"(?:0\.0\.|[^"]*-alpha|[^"]*-beta)/gi;
+    const packageVersionLines = getLineNumbers(code, packageVersionPattern);
+    if (packageVersionLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "info",
+            title: "Pre-release version — backwards compatibility expectations unclear",
+            description: "Package version indicates a pre-release or 0.x version. Consumers may not know what compatibility guarantees exist.",
+            lineNumbers: packageVersionLines,
+            recommendation: "Document backwards compatibility policy. Use semver: major bumps for breaking changes, minor for features, patch for fixes.",
+            reference: "Semantic Versioning (semver.org)",
+            suggestedFix: "Promote the version to a stable `1.0.0` (or higher) once the API is production-ready, and add a CHANGELOG documenting compatibility guarantees.",
+            confidence: 0.9,
+        });
+    }
+    // Renamed or removed exports
+    const commentedExportPattern = /\/\/\s*export\s+(?:function|class|const|let|type|interface)\s+\w+/g;
+    const commentedExportLines = getLineNumbers(code, commentedExportPattern, { skipComments: false });
+    if (commentedExportLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Commented-out exports may indicate removed API surface",
+            description: `Found ${commentedExportLines.length} commented-out export(s). If these were previously published, removing them is a breaking change for consumers.`,
+            lineNumbers: commentedExportLines,
+            recommendation: "Re-export removed symbols as deprecated wrappers. Mark them @deprecated with a migration guide. Remove only in the next major version.",
+            reference: "Semantic Versioning / API Deprecation Lifecycle",
+            suggestedFix: "Uncomment the export and re-export it as a thin deprecated wrapper (e.g., `/** @deprecated Use newName instead */ export const oldName = newName;`).",
+            confidence: 0.8,
+        });
+    }
+    // Changed function signatures — optional to required parameter
+    const requiredAfterOptionalPattern = /\w+\?:\s*\w+[^)]*,\s*\w+\s*:\s*\w+/g;
+    const sigChangeLines = getLineNumbers(code, requiredAfterOptionalPattern);
+    if (sigChangeLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Function signature with required params after optional — potential breaking change",
+            description: "Required parameters placed after optional parameters can break callers who relied on positional arguments.",
+            lineNumbers: sigChangeLines,
+            recommendation: "Keep required parameters before optional ones. Use options objects for functions with many parameters to allow adding fields without breaking callers.",
+            reference: "API Design: Function Signature Evolution",
+            suggestedFix: "Reorder parameters so all required params precede optional ones, or refactor to accept a single options object (e.g., `fn(opts: { required: string; optional?: number })`).",
+            confidence: 0.75,
+        });
+    }
+    // Enum/union type removals
+    const enumPattern = /enum\s+\w+\s*\{[^}]*\}/g;
+    const enumMatches = code.match(enumPattern) || [];
+    const hasDeprecatedEnumComment = testCode(code, /\/\/.*deprecated.*enum|\/\*.*removed.*value/gi);
+    if (enumMatches.length > 0 && hasDeprecatedEnumComment) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Enum value changes may break consumers",
+            description: "Enums with deprecated or removed values detected. Removing enum values is a breaking change for anything serializing or deserializing these values.",
+            recommendation: "Never remove enum values in minor releases. Mark values as deprecated. If numeric, keep the slot allocated. Provide migration mapping for removed values.",
+            reference: "Breaking Changes in Enums / Protocol Buffers Reserved Fields",
+            suggestedFix: "Keep the deprecated enum value with a `/** @deprecated */` annotation and add a `reserved` comment for its numeric slot instead of deleting it.",
+            confidence: 0.75,
+        });
+    }
+    // Changing HTTP methods on endpoints (POST mapping doing DELETE work, etc.)
+    const deleteViaPostPattern = /app\.post\s*\([^)]*(?:delete|remove|destroy)/gi;
+    const deleteViaPostLines = getLineNumbers(code, deleteViaPostPattern);
+    if (deleteViaPostLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "HTTP method mismatch — destructive action via POST",
+            description: "Destructive operations (delete, remove) are exposed via POST instead of DELETE. If these were originally DELETE endpoints, the method change breaks REST clients.",
+            lineNumbers: deleteViaPostLines,
+            recommendation: "Use appropriate HTTP methods: DELETE for removal, PUT/PATCH for updates. If migrating methods, keep the old method working during a deprecation period.",
+            reference: "RESTful API Design / HTTP Method Semantics",
+            suggestedFix: "Change `app.post('/resource', deleteHandler)` to `app.delete('/resource', deleteHandler)` and keep the old POST route temporarily for backwards compatibility.",
+            confidence: 0.8,
+        });
+    }
+    // Breaking serialization changes (renaming JSON fields)
+    const fieldRenamePattern = /\/\/\s*(?:renamed|was|previously|old name|formerly)\s*[:=]?\s*\w+/gi;
+    const fieldRenameLines = getLineNumbers(code, fieldRenamePattern, { skipComments: false });
+    if (fieldRenameLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Possible field rename — breaking serialization change",
+            description: `Found ${fieldRenameLines.length} comment(s) suggesting renamed fields. Renaming JSON response fields breaks API clients that depend on the old names.`,
+            lineNumbers: fieldRenameLines,
+            recommendation: "Include both old and new field names during a transition period. Mark the old field as deprecated. Remove only in the next major version.",
+            reference: "API Versioning / Backwards-Compatible JSON Evolution",
+            suggestedFix: "Emit both the old and new field names in responses (e.g., `{ oldName: value, newName: value }`) until the next major version removes the old name.",
+            confidence: 0.75,
+        });
+    }
+    return findings;
+}

package/dist/evaluators/caching.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeCaching(code: string, language: string): Finding[];

package/dist/evaluators/caching.js

@@ -0,0 +1,171 @@
+import { getLineNumbers, getLangLineNumbers, getLangFamily, isIaCTemplate, testCode } from "./shared.js";
+import * as LP from "../language-patterns.js";
+export function analyzeCaching(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "CACHE";
+    const _lang = getLangFamily(language);
+    // Unbounded in-memory cache
+    const inMemoryCachePattern = /(?:const|let|var)\s+\w*[Cc]ache\w*\s*[:=]\s*(?:new\s+Map|\{\}|\[\])/gi;
+    const inMemoryCacheLines = getLineNumbers(code, inMemoryCachePattern);
+    if (inMemoryCacheLines.length >= 8) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Unbounded in-memory cache detected",
+            description: "In-memory cache without size limits or eviction policy. This will grow indefinitely and eventually cause out-of-memory errors under production load.",
+            lineNumbers: inMemoryCacheLines,
+            recommendation: "Use a bounded cache with an eviction policy (LRU, TTL). Consider libraries like lru-cache, node-cache, or a distributed cache (Redis, Memcached) for multi-instance deployments.",
+            reference: "Caching Best Practices / LRU Cache Pattern",
+            suggestedFix: "Replace the raw Map/object with a bounded LRU cache, e.g. `const cache = new LRUCache({ max: 500, ttl: 1000 * 60 * 5 })`.",
+            confidence: 0.85,
+        });
+    }
+    // No caching for expensive operations (multi-language)
+    const dbQueryLines = getLangLineNumbers(code, language, LP.DB_QUERY);
+    const fetchLines = getLangLineNumbers(code, language, LP.HTTP_CLIENT);
+    const expensiveOpLines = [...dbQueryLines, ...fetchLines];
+    const hasCaching = /cache|Cache|redis|memcache|lru|ttl|stale|expires|ETag|If-None-Match|If-Modified-Since/gi.test(code);
+    const iacTemplate = isIaCTemplate(code);
+    if (expensiveOpLines.length >= 3 && !hasCaching && !iacTemplate && code.split("\n").length > 30) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No caching strategy for expensive operations",
+            description: "Code performs database queries or external API calls without any caching layer. Every request triggers a full backend operation even for data that rarely changes.",
+            lineNumbers: expensiveOpLines.slice(0, 5),
+            recommendation: "Implement cache-aside (lazy loading) for read-heavy operations. Use Redis or Memcached for shared caching. Set appropriate TTLs based on data freshness requirements.",
+            reference: "Cache-Aside Pattern / AWS Caching Best Practices",
+            suggestedFix: "Wrap expensive DB/API calls with a cache-aside helper: check cache first, return on hit, otherwise fetch, store with a TTL, and return.",
+            confidence: 0.7,
+        });
+    }
+    // No HTTP caching headers
+    const hasHttpResponse = testCode(code, /res\.(json|send|render|set|header)\s*\(/gi);
+    const hasCacheHeaders = testCode(code, /Cache-Control|ETag|Last-Modified|Expires|max-age|s-maxage|must-revalidate|no-cache|no-store/gi);
+    if (hasHttpResponse && !hasCacheHeaders && code.split("\n").length > 50) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "No HTTP caching headers set",
+            description: "HTTP responses are sent without Cache-Control, ETag, or Last-Modified headers. Clients and CDNs cannot cache responses, increasing server load and latency.",
+            recommendation: "Set appropriate Cache-Control headers for static and semi-static responses. Use ETags for conditional requests. Configure CDN caching rules.",
+            reference: "RFC 7234: HTTP Caching / MDN Cache-Control",
+            suggestedFix: "Add `res.set('Cache-Control', 'public, max-age=300')` (or an appropriate directive) before sending responses for cacheable endpoints.",
+            confidence: 0.7,
+        });
+    }
+    // Cache without invalidation strategy
+    const cacheSetPattern = /cache\.set|cache\.put|setCache|redis\.set|\.setex|memcache\.set/gi;
+    const cacheSetLines = getLineNumbers(code, cacheSetPattern);
+    const hasInvalidation = /cache\.del|cache\.delete|cache\.invalidate|cache\.clear|cache\.flush|redis\.del|cache\.remove|bust.*cache/gi.test(code);
+    if (cacheSetLines.length > 0 && !hasInvalidation) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Cache writes without invalidation strategy",
+            description: "Data is cached but no invalidation logic is visible. Stale cache entries will serve outdated data indefinitely unless TTLs are set.",
+            lineNumbers: cacheSetLines,
+            recommendation: "Implement cache invalidation when underlying data changes. Use TTLs as a safety net. Consider write-through or write-behind patterns for consistency.",
+            reference: "Cache Invalidation Strategies",
+            suggestedFix: "Add a `cache.del(key)` call in every write/update/delete path that mutates the underlying data, and set a TTL on each `cache.set` as a safety net.",
+            confidence: 0.7,
+        });
+    }
+    // Global mutable object used as cache
+    const globalMutableCachePattern = /(?:let|var)\s+\w*[Cc]ache\w*\s*[:=]\s*\{\}/gi;
+    const globalCacheLines = getLineNumbers(code, globalMutableCachePattern);
+    if (globalCacheLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Mutable global object used as cache",
+            description: "A mutable global object ({}) is used as a cache. This pattern has no TTL, no eviction, no size limit, doesn't work across instances, and is prone to memory leaks.",
+            lineNumbers: globalCacheLines,
+            recommendation: "Replace with a proper caching library (node-cache, lru-cache) or a distributed cache (Redis). These provide TTL, eviction policies, and memory limits.",
+            reference: "In-Memory Caching Best Practices",
+            suggestedFix: "Replace `let cache = {}` with a library like `const cache = new NodeCache({ stdTTL: 600, maxKeys: 1000 })` to get automatic eviction and TTL support.",
+            confidence: 0.85,
+        });
+    }
+    // Cache key collision risk — simple string concatenation keys
+    const cacheKeyPattern = /cache\.(?:set|get|has)\s*\(\s*(?:["'`][^"'`]{1,10}["'`]|`\$\{)/gi;
+    const cacheKeyLines = getLineNumbers(code, cacheKeyPattern);
+    if (cacheKeyLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Simple cache keys risk collisions",
+            description: `Found ${cacheKeyLines.length} cache operation(s) with short or interpolated keys. Without namespace prefixes or hashing, keys from different features can collide.`,
+            lineNumbers: cacheKeyLines,
+            recommendation: "Use namespaced, structured cache keys: 'users:byId:${id}'. Include version or tenant info for multi-tenant apps. Consider hashing complex keys.",
+            reference: "Cache Key Design Best Practices",
+            suggestedFix: "Prefix cache keys with a namespace and version, e.g. `cache.set(`v1:users:byId:${userId}`, data)`, to prevent collisions across features.",
+            confidence: 0.75,
+        });
+    }
+    // Thundering herd / cache stampede — multiple concurrent fetches on miss
+    const cacheGetPattern = /cache\.get\s*\(/gi;
+    const cacheGetLines = getLineNumbers(code, cacheGetPattern);
+    const hasStampedeProtection = testCode(code, /lock|mutex|singleflight|coalesce|dedupe|p-memoize/gi);
+    if (cacheGetLines.length > 0 && !hasStampedeProtection) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "No thundering herd protection on cache misses",
+            description: "Cache reads without stampede protection. When a popular cache entry expires, many concurrent requests will all miss and hit the backend simultaneously.",
+            recommendation: "Implement request coalescing (singleflight pattern) so only one request fetches on a miss. Use stale-while-revalidate or lock-based refresh.",
+            reference: "Cache Stampede / Thundering Herd Problem",
+            suggestedFix: "Wrap the cache-miss fetch in a singleflight/coalescing helper so concurrent callers share one in-flight request instead of each hitting the backend.",
+            confidence: 0.7,
+        });
+    }
+    // Caching secrets or tokens
+    const cacheSecretPattern = /cache\.(?:set|put)\s*\([^)]*(?:token|secret|password|credential|apikey|api_key)/gi;
+    const cacheSecretLines = getLineNumbers(code, cacheSecretPattern);
+    if (cacheSecretLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Secrets or tokens stored in cache",
+            description: "Sensitive values (tokens, secrets, passwords) are cached. Cached secrets may persist beyond their intended lifetime and can be exposed via cache inspection.",
+            lineNumbers: cacheSecretLines,
+            recommendation: "Never cache secrets or authentication tokens. Use a dedicated secrets manager with built-in rotation. If token caching is necessary, encrypt values and set strict TTLs.",
+            reference: "OWASP Secrets Management / Cache Security",
+            suggestedFix: "Remove secrets from the cache and retrieve them from a secrets manager (e.g. AWS Secrets Manager, Azure Key Vault) at runtime instead.",
+            confidence: 0.95,
+        });
+    }
+    // Stale data served without revalidation
+    const hasCacheRead = testCode(code, /cache\.get|cache\.fetch|getFromCache|getCached/gi);
+    const hasRevalidation = /revalidate|stale-while-revalidate|refresh|ETag|If-None-Match|If-Modified-Since|304/gi.test(code);
+    if (hasCacheRead && !hasRevalidation && cacheSetLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Cached data served without revalidation mechanism",
+            description: "Data is cached and served without any revalidation strategy. Clients may receive stale data indefinitely until the TTL expires.",
+            recommendation: "Implement stale-while-revalidate: serve stale data immediately while refreshing in the background. Use ETags or Last-Modified for conditional fetches.",
+            reference: "HTTP Stale-While-Revalidate / RFC 5861",
+            suggestedFix: "Add a stale-while-revalidate wrapper: return cached data immediately and trigger an async background refresh when the entry is near expiry.",
+            confidence: 0.7,
+        });
+    }
+    // No cache warming strategy
+    const hasStartup = testCode(code, /listen\s*\(|bootstrap|main\s*\(|init\s*\(/gi);
+    const hasCacheWarm = testCode(code, /warm|preheat|preload|seed.*cache|cache.*seed|cache.*warm/gi);
+    if (hasStartup && hasCacheRead && !hasCacheWarm && code.split("\n").length > 100) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "info",
+            title: "No cache warming strategy for cold starts",
+            description: "Application uses caching but has no visible cache warming on startup. After deployments or restarts, all requests will miss the cache and hit backends simultaneously.",
+            recommendation: "Implement cache warming on startup for critical data. Pre-populate frequently accessed keys during deployment. Consider gradual traffic ramp-up after deploys.",
+            reference: "Cache Warming / Blue-Green Deployment Best Practices",
+            suggestedFix: "Add a `warmCache()` function that pre-populates critical keys at startup, and call it from your init/bootstrap routine before accepting traffic.",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    return findings;
+}

package/dist/evaluators/ci-cd.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeCiCd(code: string, language: string): Finding[];

package/dist/evaluators/ci-cd.js

@@ -0,0 +1,218 @@
+import { getLineNumbers, getLangLineNumbers, getLangFamily, testCode, classifyFile, isLikelyAnalysisCode, isLikelyCLI, } from "./shared.js";
+import * as LP from "../language-patterns.js";
+export function analyzeCiCd(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "CICD";
+    const _lang = getLangFamily(language);
+    // Analysis code references linter-disable/suppression patterns in regex
+    // for detection purposes — these are not actual suppressions.
+    if (isLikelyAnalysisCode(code))
+        return findings;
+    // CI/CD absence rules (no tests, no lint, no build script) are project-level
+    // concerns — they belong in config/manifest files (package.json, Cargo.toml),
+    // not in individual application source files. Skip them on server/utility code.
+    const fileCategory = classifyFile(code, language);
+    const isAppSourceFile = fileCategory === "server" || fileCategory === "utility";
+    // No test script (multi-language test detection)
+    const hasTestScript = testCode(code, /["']test["']\s*:\s*["'][^"']+["']/gi) ||
+        getLangLineNumbers(code, language, LP.TEST_FUNCTION).length > 0 ||
+        testCode(code, /jest|mocha|vitest|unittest|pytest|xunit|nunit/gi);
+    const isSourceCode = /(?:function|class|const|let|var|import|export|def |public\s+class)/gi.test(code);
+    // HTML/markup files are not application source code — skip CI/CD rules
+    // that assume testable imperative logic.
+    const isMarkupFile = /^\s*<(!DOCTYPE|html|head|body|meta|link)/im.test(code);
+    if (!isAppSourceFile && isSourceCode && !isMarkupFile && !hasTestScript && code.split("\n").length > 40) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No test infrastructure detected",
+            description: "Source code without any testing framework, test scripts, or test functions. CI pipelines need tests to provide value — without them, CI is just 'continuous building.'",
+            recommendation: "Add a test framework (Jest, Vitest, pytest, JUnit). Write tests alongside code. Configure test scripts in package.json or equivalent.",
+            reference: "Continuous Integration Best Practices",
+            suggestedFix: 'Add a `"test": "jest"` (or equivalent) script to `package.json` and create a first test file, e.g., `src/__tests__/example.test.ts`.',
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // No lint configuration
+    const hasLint = testCode(code, /eslint|prettier|tslint|stylelint|rubocop|pylint|flake8|black|rustfmt|clippy|biome/gi);
+    if (!isAppSourceFile && isSourceCode && !hasLint && code.split("\n").length > 40) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "No linting/formatting configuration detected",
+            description: "No linter or formatter configuration found. Without automated code quality checks, inconsistent code style and common mistakes slip through.",
+            recommendation: "Configure ESLint + Prettier (JS/TS), Black + Ruff (Python), or equivalent tools. Add lint scripts and run them in CI.",
+            reference: "CI/CD Pipeline Best Practices",
+            suggestedFix: 'Add a `"lint": "eslint ."` script to `package.json` and create an `.eslintrc` (or `eslint.config.js`) configuration file.',
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // Hard process exit in application code (multi-language)
+    const processExitLines = getLangLineNumbers(code, language, LP.PANIC_UNWRAP);
+    if (processExitLines.length > 0 && !isLikelyCLI(code)) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Hard process termination hinders graceful CI/CD lifecycle",
+            description: `Found ${processExitLines.length} hard exit call(s) (e.g., process.exit, sys.exit, panic!, System.exit, os.Exit). Hard exits prevent proper shutdown, skip cleanup hooks, and can cause deployment health checks to fail.`,
+            lineNumbers: processExitLines,
+            recommendation: "Use proper error propagation instead of hard exits. In production, handle SIGTERM gracefully. Let the runtime manage process lifecycle.",
+            reference: "12-Factor App: Disposability / Kubernetes Pod Lifecycle",
+            suggestedFix: "Replace `process.exit(1)` with `throw new Error('reason')` and register a `process.on('SIGTERM', …)` handler for graceful shutdown.",
+            confidence: 0.85,
+        });
+    }
+    // Static analysis suppression comments (multi-language)
+    const tsNoCheckLines = getLangLineNumbers(code, language, LP.LINTER_DISABLE, { skipComments: false });
+    if (tsNoCheckLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Static analysis suppression comments detected",
+            description: `Found ${tsNoCheckLines.length} instance(s) of disabled type checking or linting. Suppression comments defeat the purpose of static analysis in CI.`,
+            lineNumbers: tsNoCheckLines,
+            recommendation: "Fix the underlying issues instead of suppressing them. If suppression is necessary, add a comment explaining why and create a tracking issue to resolve it.",
+            reference: "TypeScript / ESLint Best Practices",
+            suggestedFix: "Remove the `// @ts-ignore` or `// eslint-disable` comment and fix the underlying type error or lint violation directly.",
+            confidence: 0.9,
+        });
+    }
+    // No build script
+    const hasBuildScript = testCode(code, /["']build["']\s*:\s*["']/gi) ||
+        testCode(code, /tsc|webpack|vite|rollup|esbuild|babel|make\s+build|gradle\s+build|mvn\s+package/gi);
+    if (!isAppSourceFile && isSourceCode && !hasBuildScript && code.split("\n").length > 40) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "info",
+            title: "No build script detected",
+            description: "No build script or build tool configuration found. CI pipelines need reproducible builds. Without a build script, builds rely on manual or undocumented steps.",
+            recommendation: "Define build scripts in package.json, Makefile, or equivalent. Ensure builds are reproducible from a clean checkout.",
+            reference: "Reproducible Builds / CI/CD Best Practices",
+            suggestedFix: 'Add a `"build": "tsc"` (or `vite build`, `webpack`, etc.) script to `package.json` so CI can run `npm run build`.',
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // Docker image using :latest tag
+    const latestTagPattern = /FROM\s+\w+(?:\/\w+)*:latest|image:\s*\w+:latest/gi;
+    const latestTagLines = getLineNumbers(code, latestTagPattern);
+    if (latestTagLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Docker image using :latest tag",
+            description: "Docker images reference :latest tag, which is mutable and makes builds non-reproducible. The same tag can point to different images over time.",
+            lineNumbers: latestTagLines,
+            recommendation: "Pin Docker images to specific versions or SHA digests: FROM node:20.11.0-alpine or FROM node@sha256:abc123...",
+            reference: "Docker Best Practices / Supply Chain Security",
+            suggestedFix: "Replace `FROM node:latest` with a pinned version such as `FROM node:20.11.0-alpine` or a SHA digest.",
+            confidence: 0.9,
+        });
+    }
+    // Dockerfile without .dockerignore
+    const hasDockerfile = /^FROM\s+/gim.test(code);
+    const hasDockerignore = testCode(code, /\.dockerignore/gi);
+    const copiesEverything = testCode(code, /COPY\s+\.\s+\.|ADD\s+\.\s+\./gi);
+    if (hasDockerfile && copiesEverything && !hasDockerignore) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Dockerfile copies everything without .dockerignore",
+            description: "COPY . . or ADD . . copies the entire build context including node_modules, .git, .env, and other unnecessary files. This bloats images and may expose secrets.",
+            recommendation: "Create a .dockerignore file excluding node_modules, .git, .env, test files, and build artifacts. Only copy files needed for production.",
+            reference: "Docker Best Practices: .dockerignore / Multi-Stage Builds",
+            suggestedFix: "Create a `.dockerignore` file containing `node_modules`, `.git`, `.env`, and `*.test.*` to exclude unnecessary files from the build context.",
+            confidence: 0.8,
+        });
+    }
+    // Dockerfile without HEALTHCHECK
+    if (hasDockerfile && !testCode(code, /HEALTHCHECK/gi)) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Dockerfile without HEALTHCHECK instruction",
+            description: "Docker container has no HEALTHCHECK defined. Without health checks, orchestrators (Docker Compose, Kubernetes) cannot detect unhealthy containers for restart.",
+            recommendation: "Add a HEALTHCHECK instruction: HEALTHCHECK --interval=30s CMD curl -f http://localhost:3000/health || exit 1. Or define health checks in docker-compose/k8s.",
+            reference: "Docker HEALTHCHECK / Container Health Best Practices",
+            suggestedFix: "Add `HEALTHCHECK --interval=30s CMD curl -f http://localhost:3000/health || exit 1` before the final `CMD` instruction in the Dockerfile.",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // No test coverage configuration
+    const hasTests = testCode(code, /test|jest|mocha|vitest|ava|tape|jasmine|karma/gi);
+    const hasCoverage = testCode(code, /coverage|istanbul|nyc|c8|--coverage|coverageThreshold|coverageDirectory|lcov/gi);
+    if (hasTests && !hasCoverage) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "info",
+            title: "Test configuration without coverage tracking",
+            description: "Test tooling is referenced but no code coverage configuration is visible. Without coverage tracking, gaps in test coverage go undetected.",
+            recommendation: "Configure coverage reporting (jest --coverage, c8, nyc). Set minimum coverage thresholds. Integrate coverage reports into CI/CD pipeline.",
+            reference: "Jest Coverage / Istanbul.js",
+            suggestedFix: 'Add `--coverage` to the test script (e.g., `"test": "jest --coverage"`) and set a `coverageThreshold` in the Jest/Vitest config.',
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // npm install instead of npm ci in CI
+    const npmInstallPattern = /npm\s+install(?!\s+--save|\s+-[gDEOS]|\s+\w)/gi;
+    const npmInstallLines = getLineNumbers(code, npmInstallPattern);
+    const isCIConfig = testCode(code, /\.github\/workflows|\.gitlab-ci|jenkinsfile|\.circleci|pipeline|ci\s*:/gi);
+    if (npmInstallLines.length > 0 && isCIConfig) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Using 'npm install' instead of 'npm ci' in CI",
+            description: "CI configuration uses 'npm install' which may modify package-lock.json and install different versions than intended. This makes builds non-deterministic.",
+            lineNumbers: npmInstallLines,
+            recommendation: "Use 'npm ci' in CI/CD pipelines for clean, reproducible installs from the lockfile. Only use 'npm install' during local development.",
+            reference: "npm ci Documentation / Reproducible Builds",
+            suggestedFix: "Replace `npm install` with `npm ci` in the CI workflow step to ensure a clean, lockfile-based install.",
+            confidence: 0.9,
+        });
+    }
+    // Running as root in Docker
+    const _hasRootUser = testCode(code, /^USER\s+root/gim);
+    const hasNonRootUser = testCode(code, /^USER\s+(?!root)\w+/gim);
+    if (hasDockerfile && !hasNonRootUser) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+            severity: "high",
+            title: "Docker container runs as root user",
+            description: "No non-root USER instruction found in Dockerfile. Running as root inside containers increases the blast radius of container escape vulnerabilities.",
+            recommendation: "Add a non-root user: RUN addgroup -S app && adduser -S app -G app, then USER app. Use the --chown flag with COPY.",
+            reference: "Docker Security: Run as Non-Root / CIS Docker Benchmark",
+            suggestedFix: "Add `RUN addgroup -S app && adduser -S app -G app` then `USER app` before the `CMD` instruction in the Dockerfile.",
+            confidence: 0.7,
+            isAbsenceBased: true,
+        });
+    }
+    // Package manifest without CI/CD configuration (package.json, composer.json, etc.)
+    const isPackageManifest = /json/i.test(language) &&
+        /["']name["']\s*:/.test(code) &&
+        /["'](?:scripts|dependencies|devDependencies)["']\s*:/.test(code);
+    if (isPackageManifest) {
+        const hasTestScript = /["']test["']\s*:\s*["'][^"']*(?:jest|vitest|mocha|ava|tap|pytest|cargo\s+test|go\s+test)/i.test(code);
+        const hasGenericTestScript = /["']test["']\s*:\s*["'][^"']+["']/i.test(code);
+        const hasCiConfig = /["'](?:ci|precommit|prepush|postinstall)["']\s*:/i.test(code);
+        const hasCiReference = /github.?actions|gitlab.?ci|circleci|jenkins|travis|azure.?pipelines/i.test(code);
+        if (!hasTestScript && !hasGenericTestScript && !hasCiConfig && !hasCiReference) {
+            findings.push({
+                ruleId: `${prefix}-${String(ruleNum).padStart(3, "0")}`,
+                severity: "medium",
+                title: "Package manifest missing test and CI configuration",
+                description: "Project manifest defines scripts and dependencies but has no test script or CI/CD configuration. Tests and automation are essential for quality assurance.",
+                lineNumbers: getLineNumbers(code, /["']scripts["']\s*:/gi).slice(0, 3),
+                recommendation: 'Add a test script (e.g., "test": "jest" or "test": "vitest") and configure a CI pipeline (GitHub Actions, GitLab CI).',
+                reference: "Continuous Integration Best Practices",
+                suggestedFix: 'Add to scripts: "test": "jest --coverage", "lint": "eslint .". Add .github/workflows/ci.yml with build/test/lint steps.',
+                confidence: 0.7,
+            });
+        }
+    }
+    return findings;
+}

package/dist/evaluators/cloud-readiness.d.ts

@@ -0,0 +1,2 @@
+import type { Finding } from "../types.js";
+export declare function analyzeCloudReadiness(code: string, language: string): Finding[];