@kevinrabun/judges 1.2.0 → 1.3.0

package/dist/evaluators/configuration-management.js

@@ -0,0 +1,76 @@
+import { getLineNumbers } from "./shared.js";
+export function analyzeConfigurationManagement(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "CFG";
+    // Hardcoded secrets / credentials
+    const secretPattern = /(?:password|passwd|secret|api_?key|token|private_?key)\s*[:=]\s*["'`][^"'`]{3,}/gi;
+    const secretLines = getLineNumbers(code, secretPattern);
+    if (secretLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Secrets hardcoded in source code",
+            description: `Found ${secretLines.length} instance(s) of hardcoded secrets. Secrets in code are exposed in version control, CI logs, and error traces. They cannot be rotated without redeployment.`,
+            lineNumbers: secretLines,
+            recommendation: "Store secrets in a secrets manager (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault). Inject via environment variables at runtime. Never commit secrets.",
+            reference: "OWASP: Secrets Management / 12-Factor App: Config",
+        });
+    }
+    // Hardcoded configuration values
+    const hardcodedConfigPattern = /(?:const|let|var)\s+(?:PORT|HOST|DATABASE|REDIS|MONGO|API_URL|BASE_URL|TIMEOUT|INTERVAL)\s*=\s*(?:["'`]\w|[0-9])/gi;
+    const hardcodedConfigLines = getLineNumbers(code, hardcodedConfigPattern);
+    if (hardcodedConfigLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Configuration values hardcoded instead of externalized",
+            description: `Found ${hardcodedConfigLines.length} hardcoded configuration value(s). These values need to change between environments (dev, staging, prod) and should be externalized.`,
+            lineNumbers: hardcodedConfigLines,
+            recommendation: "Read configuration from environment variables (process.env.PORT). Use a config library (convict, dotenv, django-environ) to validate and provide defaults.",
+            reference: "12-Factor App: Config (Factor III)",
+        });
+    }
+    // No environment variable usage
+    const hasEnvVars = /process\.env|os\.environ|os\.Getenv|Environment\.GetEnvironmentVariable|System\.getenv|ENV\[/gi.test(code);
+    const hasConfig = /(?:port|host|database|url|key|secret|token)\s*[:=]\s*["'`0-9]/gi.test(code);
+    if (!hasEnvVars && hasConfig && code.split("\n").length > 30) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "No environment variable usage detected",
+            description: "Configuration values are present but no environment variable reads are visible. The application cannot be configured differently per environment without code changes.",
+            recommendation: "Read all configuration from environment variables. Provide sensible defaults for development. Validate required config at startup and fail fast if missing.",
+            reference: "12-Factor App: Config (Factor III)",
+        });
+    }
+    // Config validation at startup
+    const hasConfigValidation = /(?:assert|require|throw|exit|fatal|Error)\s*.*(?:missing|required|not set|undefined|config)/gi.test(code);
+    if (hasConfig && !hasConfigValidation && code.split("\n").length > 30) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "No configuration validation at startup",
+            description: "Configuration values are used but never validated at startup. Missing or invalid configuration will cause runtime failures instead of clear startup errors.",
+            recommendation: "Validate all required configuration at application startup. Fail fast with a clear error message listing which config is missing or invalid.",
+            reference: "Fail-Fast Principle / 12-Factor App",
+        });
+    }
+    // .env file committed (detected by its presence in code)
+    const dotenvCommitPattern = /\.env\b(?!\.example|\.sample|\.template|\.schema)/gi;
+    const hasGitignore = /\.gitignore/gi.test(code);
+    const hasEnvFile = /dotenv|\.env\b/gi.test(code);
+    // This is a heuristic — can't truly check .gitignore from code alone
+    if (hasEnvFile && code.split("\n").length > 10) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "info",
+            title: ".env usage detected — ensure it is not committed",
+            description: ".env files are useful for development but must not be committed to version control. Ensure .env is listed in .gitignore and provide a .env.example template instead.",
+            recommendation: "Add .env to .gitignore. Create a .env.example with placeholder values documenting required environment variables. Use CI/CD variables for deployment.",
+            reference: "12-Factor App: Config / dotenv Best Practices",
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=configuration-management.js.map

package/dist/evaluators/configuration-management.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-management.js","sourceRoot":"","sources":["../../src/evaluators/configuration-management.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,UAAU,8BAA8B,CAAC,IAAY,EAAE,QAAgB;IAC3E,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,KAAK,CAAC;IAErB,kCAAkC;IAClC,MAAM,aAAa,GAAG,mFAAmF,CAAC;IAC1G,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,SAAS,WAAW,CAAC,MAAM,4JAA4J;YACpM,WAAW,EAAE,WAAW;YACxB,cAAc,EAAE,gKAAgK;YAChL,SAAS,EAAE,mDAAmD;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,iCAAiC;IACjC,MAAM,sBAAsB,GAAG,oHAAoH,CAAC;IACpJ,MAAM,oBAAoB,GAAG,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC1E,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,wDAAwD;YAC/D,WAAW,EAAE,SAAS,oBAAoB,CAAC,MAAM,sIAAsI;YACvL,WAAW,EAAE,oBAAoB;YACjC,cAAc,EAAE,4JAA4J;YAC5K,SAAS,EAAE,oCAAoC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,MAAM,UAAU,GAAG,gGAAgG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/H,MAAM,SAAS,GAAG,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,IAAI,CAAC,UAAU,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,wKAAwK;YACrL,cAAc,EAAE,6JAA6J;YAC7K,SAAS,EAAE,oCAAoC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,MAAM,mBAAmB,GAAG,+FAA+F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvI,IAAI,SAAS,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,6JAA6J;YAC1K,cAAc,EAAE,8IAA8I;YAC9J,SAAS,EAAE,qCAAqC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,MAAM,mBAAmB,GAAG,qDAAqD,CAAC;IAClF,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,qEAAqE;IACrE,IAAI,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,kDAAkD;YACzD,WAAW,EAAE,sKAAsK;YACnL,cAAc,EAAE,uJAAuJ;YACvK,SAAS,EAAE,+CAA+C;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/evaluators/database.d.ts

@@ -0,0 +1,3 @@
+import { Finding } from "../types.js";
+export declare function analyzeDatabase(code: string, language: string): Finding[];
+//# sourceMappingURL=database.d.ts.map

package/dist/evaluators/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/evaluators/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CAkIzE"}

package/dist/evaluators/database.js

@@ -0,0 +1,125 @@
+import { getLineNumbers } from "./shared.js";
+export function analyzeDatabase(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "DB";
+    // SQL injection via string concatenation
+    const sqlInjectionPattern = /(?:execute|query|raw|prepare)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|['"][^'"]*['"]\s*\.\s*concat)/gi;
+    const sqlInjectionLines = getLineNumbers(code, sqlInjectionPattern);
+    if (sqlInjectionLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "SQL injection via string concatenation",
+            description: `Found ${sqlInjectionLines.length} instance(s) of SQL queries built with string concatenation or template literals containing user input. This is the most common and dangerous database vulnerability.`,
+            lineNumbers: sqlInjectionLines,
+            recommendation: "Use parameterized queries (placeholders) or prepared statements. ORMs handle this automatically. Never concatenate user input into SQL strings.",
+            reference: "OWASP SQL Injection Prevention Cheat Sheet / CWE-89",
+        });
+    }
+    // SELECT * usage
+    const selectStarPattern = /SELECT\s+\*/gi;
+    const selectStarLines = getLineNumbers(code, selectStarPattern);
+    if (selectStarLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "SELECT * retrieves unnecessary columns",
+            description: `Found ${selectStarLines.length} SELECT * query/queries. Selecting all columns transfers unnecessary data, breaks when schema changes, and prevents index-only scans.`,
+            lineNumbers: selectStarLines,
+            recommendation: "Select only the columns you need: SELECT id, name, email FROM users. This reduces network transfer, memory usage, and improves query plan optimization.",
+            reference: "SQL Performance Best Practices",
+        });
+    }
+    // N+1 query pattern (query in a loop)
+    const lines = code.split("\n");
+    const n1Lines = [];
+    let inLoop = false;
+    let loopDepth = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (/\b(?:for|while|forEach|\.map|\.each)\b/.test(line)) {
+            inLoop = true;
+            loopDepth++;
+        }
+        if (inLoop && /(?:await\s+)?(?:db\.|query|find|findOne|findMany|execute|select|fetch)\s*\(/.test(line)) {
+            n1Lines.push(i + 1);
+        }
+        if (inLoop) {
+            const opens = (line.match(/\{/g) || []).length;
+            const closes = (line.match(/\}/g) || []).length;
+            loopDepth += opens - closes;
+            if (loopDepth <= 0) {
+                inLoop = false;
+                loopDepth = 0;
+            }
+        }
+    }
+    if (n1Lines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "N+1 query pattern detected",
+            description: `Found ${n1Lines.length} database query/queries inside loops. This creates N+1 queries: 1 for the list + N for each item. Performance degrades linearly with data volume.`,
+            lineNumbers: n1Lines,
+            recommendation: "Use batch queries (WHERE id IN (...)), JOINs, or ORM eager loading (include/populate) to fetch related data in a single query.",
+            reference: "N+1 Query Problem / ORM Performance Patterns",
+        });
+    }
+    // No connection pooling
+    const hasDbConnection = /createConnection|new\s+Client|new\s+Pool|mongoose\.connect|createPool|DataSource|DriverManager|SqlConnection/gi.test(code);
+    const hasPooling = /pool|Pool|connectionPool|poolSize|max_connections|maxPoolSize|connectionLimit/gi.test(code);
+    if (hasDbConnection && !hasPooling) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Database connection without pooling",
+            description: "Database connection created without visible connection pooling. Creating a new connection per request is expensive and unsustainable under load.",
+            recommendation: "Use connection pooling (e.g., pg.Pool, mysql2.createPool, mongoose connection pooling). Configure pool size based on expected concurrent connections.",
+            reference: "Database Connection Pooling Best Practices",
+        });
+    }
+    // Raw SQL queries (no ORM/query builder)
+    const rawSqlPattern = /(?:execute|query)\s*\(\s*["'`]\s*(?:SELECT|INSERT|UPDATE|DELETE|CREATE|ALTER|DROP)\b/gi;
+    const rawSqlLines = getLineNumbers(code, rawSqlPattern);
+    if (rawSqlLines.length > 2) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Extensive raw SQL without query builder or ORM",
+            description: `Found ${rawSqlLines.length} raw SQL statements. Extensive raw SQL increases injection risk, reduces portability, and lacks type safety.`,
+            lineNumbers: rawSqlLines.slice(0, 5),
+            recommendation: "Consider using a query builder (Knex, Prisma, Drizzle, SQLAlchemy) or ORM for type safety, parameterization, and database portability.",
+            reference: "ORM vs Raw SQL Best Practices",
+        });
+    }
+    // No transaction handling
+    const hasMutations = /INSERT|UPDATE|DELETE|db\.(?:create|update|delete|save|remove)/gi.test(code);
+    const hasTransactions = /transaction|BEGIN|COMMIT|ROLLBACK|startTransaction|withTransaction/gi.test(code);
+    if (hasMutations && !hasTransactions && code.split("\n").length > 30) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Data mutations without transaction handling",
+            description: "Data is modified (INSERT/UPDATE/DELETE) without transaction wrappers. If an error occurs mid-operation, data could be left in an inconsistent state.",
+            recommendation: "Wrap multi-step data mutations in transactions. Use BEGIN/COMMIT/ROLLBACK or ORM transaction APIs to ensure atomicity.",
+            reference: "ACID Properties / Database Transaction Best Practices",
+        });
+    }
+    // Hardcoded connection strings
+    const connStringPattern = /(?:postgres|mysql|mongodb|redis|mssql):\/\/[^"'`\s]{10,}/gi;
+    const connStringLines = getLineNumbers(code, connStringPattern);
+    if (connStringLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Hardcoded database connection string",
+            description: "Database connection string is hardcoded in source code, exposing credentials and making it impossible to use different databases per environment.",
+            lineNumbers: connStringLines,
+            recommendation: "Use environment variables for connection strings. Store credentials in a secrets manager. Use different connection strings per environment.",
+            reference: "12-Factor App: Config / OWASP Secrets Management",
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=database.js.map

package/dist/evaluators/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/evaluators/database.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB;IAC5D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,IAAI,CAAC;IAEpB,yCAAyC;IACzC,MAAM,mBAAmB,GAAG,wGAAwG,CAAC;IACrI,MAAM,iBAAiB,GAAG,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACpE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,SAAS,iBAAiB,CAAC,MAAM,uKAAuK;YACrN,WAAW,EAAE,iBAAiB;YAC9B,cAAc,EAAE,iJAAiJ;YACjK,SAAS,EAAE,qDAAqD;SACjE,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB;IACjB,MAAM,iBAAiB,GAAG,eAAe,CAAC;IAC1C,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,SAAS,eAAe,CAAC,MAAM,uIAAuI;YACnL,WAAW,EAAE,eAAe;YAC5B,cAAc,EAAE,yJAAyJ;YACzK,SAAS,EAAE,gCAAgC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,sCAAsC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,IAAI,CAAC;YACd,SAAS,EAAE,CAAC;QACd,CAAC;QACD,IAAI,MAAM,IAAI,6EAA6E,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAC/C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YAChD,SAAS,IAAI,KAAK,GAAG,MAAM,CAAC;YAC5B,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,MAAM,GAAG,KAAK,CAAC;gBACf,SAAS,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,SAAS,OAAO,CAAC,MAAM,mJAAmJ;YACvL,WAAW,EAAE,OAAO;YACpB,cAAc,EAAE,gIAAgI;YAChJ,SAAS,EAAE,8CAA8C;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,MAAM,eAAe,GAAG,gHAAgH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpJ,MAAM,UAAU,GAAG,iFAAiF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChH,IAAI,eAAe,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EAAE,kJAAkJ;YAC/J,cAAc,EAAE,uJAAuJ;YACvK,SAAS,EAAE,4CAA4C;SACxD,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,MAAM,aAAa,GAAG,wFAAwF,CAAC;IAC/G,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,gDAAgD;YACvD,WAAW,EAAE,SAAS,WAAW,CAAC,MAAM,8GAA8G;YACtJ,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACpC,cAAc,EAAE,wIAAwI;YACxJ,SAAS,EAAE,+BAA+B;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,MAAM,eAAe,GAAG,sEAAsE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1G,IAAI,YAAY,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,6CAA6C;YACpD,WAAW,EAAE,sJAAsJ;YACnK,cAAc,EAAE,wHAAwH;YACxI,SAAS,EAAE,uDAAuD;SACnE,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,MAAM,iBAAiB,GAAG,4DAA4D,CAAC;IACvF,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,sCAAsC;YAC7C,WAAW,EAAE,mJAAmJ;YAChK,WAAW,EAAE,eAAe;YAC5B,cAAc,EAAE,6IAA6I;YAC7J,SAAS,EAAE,kDAAkD;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/evaluators/error-handling.d.ts

@@ -0,0 +1,3 @@
+import { Finding } from "../types.js";
+export declare function analyzeErrorHandling(code: string, language: string): Finding[];
+//# sourceMappingURL=error-handling.d.ts.map

package/dist/evaluators/error-handling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handling.d.ts","sourceRoot":"","sources":["../../src/evaluators/error-handling.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CAiI9E"}

package/dist/evaluators/error-handling.js

@@ -0,0 +1,123 @@
+import { getLineNumbers } from "./shared.js";
+export function analyzeErrorHandling(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "ERR";
+    // Empty catch blocks
+    const emptyCatchPattern = /catch\s*\([^)]*\)\s*\{\s*\}/g;
+    const emptyCatchLines = getLineNumbers(code, emptyCatchPattern);
+    if (emptyCatchLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Empty catch block swallows errors",
+            description: `Found ${emptyCatchLines.length} empty catch block(s). Silently swallowing errors hides bugs, makes debugging impossible, and can leave the application in an inconsistent state.`,
+            lineNumbers: emptyCatchLines,
+            recommendation: "Log the error with context, re-throw it, or handle it meaningfully. If intentionally ignoring, add a comment explaining why.",
+            reference: "ESLint no-empty / Error Handling Best Practices",
+        });
+    }
+    // Catch with no error parameter
+    const catchNoParamPattern = /catch\s*\(\s*\)\s*\{/g;
+    const catchNoParamLines = getLineNumbers(code, catchNoParamPattern);
+    if (catchNoParamLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Catch block discards error object",
+            description: "Catch block does not capture the error object. The error details (message, stack trace, type) are lost, making debugging impossible.",
+            lineNumbers: catchNoParamLines,
+            recommendation: "Capture the error parameter: catch(error) { ... } and use it for logging, error classification, or re-throwing.",
+            reference: "Error Handling Best Practices",
+        });
+    }
+    // No global error handler / middleware
+    const hasGlobalHandler = /app\.use\s*\(\s*(?:function\s*)?\(\s*err/gi.test(code) ||
+        /process\.on\s*\(\s*['"](?:uncaughtException|unhandledRejection)['"]/gi.test(code) ||
+        /window\.onerror|window\.addEventListener\s*\(\s*['"]error['"]/gi.test(code) ||
+        /app\.use\s*\(\s*errorHandler\b/gi.test(code);
+    const hasServerCode = /app\.(listen|use|get|post|put|delete|patch)|createServer|express\(\)|new\s+Hono/gi.test(code);
+    if (hasServerCode && !hasGlobalHandler && code.split("\n").length > 30) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "No global error handler detected",
+            description: "Server code without a global error handler. Unhandled errors will crash the process or return raw stack traces to clients.",
+            recommendation: "Add Express error middleware (app.use((err, req, res, next) => { ... })), process.on('uncaughtException'), and process.on('unhandledRejection') handlers.",
+            reference: "Express Error Handling / Node.js Best Practices",
+        });
+    }
+    // Generic error responses
+    const genericErrorPattern = /res\.(status|json|send)\s*\([^)]*(?:["'`](?:Error|Something went wrong|Internal server error|Server error|An error occurred)["'`])/gi;
+    const genericErrorLines = getLineNumbers(code, genericErrorPattern);
+    if (genericErrorLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "Generic error messages returned to clients",
+            description: "Generic error messages like 'Internal server error' or 'Something went wrong' don't help API consumers understand or fix the issue.",
+            lineNumbers: genericErrorLines,
+            recommendation: "Return structured error responses with error codes, human-readable messages, and suggested actions. Use a consistent error response schema.",
+            reference: "RFC 7807 (Problem Details for HTTP APIs)",
+        });
+    }
+    // Async function without try/catch or .catch
+    const asyncFuncPattern = /async\s+(?:function\s+\w+|\([^)]*\)\s*=>|\w+\s*=\s*async)/g;
+    const hasTryCatch = /try\s*\{/g;
+    const asyncMatches = code.match(asyncFuncPattern)?.length || 0;
+    const tryCatchMatches = code.match(hasTryCatch)?.length || 0;
+    if (asyncMatches > 0 && tryCatchMatches === 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Async functions without error handling",
+            description: `Found ${asyncMatches} async function(s) but no try/catch blocks. Unhandled promise rejections can crash the process in Node.js.`,
+            recommendation: "Wrap async operations in try/catch or use .catch() on promises. Consider a global unhandledRejection handler as a safety net.",
+            reference: "Node.js Unhandled Rejections / Async Error Handling",
+        });
+    }
+    // Callback without error check (Node.js pattern)
+    const callbackNoErrPattern = /(?:callback|cb|done|next)\s*\(\s*(?:null|undefined)\s*[,)]/gi;
+    const callbackErrPattern = /(?:if\s*\(\s*err|if\s*\(\s*error)/gi;
+    const hasCallbacks = /function\s*\([^)]*(?:err|error|cb|callback|done)[^)]*\)/gi.test(code);
+    if (hasCallbacks && !callbackErrPattern.test(code) && code.split("\n").length > 20) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Callback pattern without error checking",
+            description: "Code uses callbacks but doesn't appear to check for errors. In Node.js, the error-first callback pattern requires checking the error parameter.",
+            recommendation: "Always check the error parameter first in callbacks: if (err) { return handleError(err); }",
+            reference: "Node.js Error-First Callbacks",
+        });
+    }
+    // Throwing strings instead of Error objects
+    const throwStringPattern = /throw\s+["'`]/g;
+    const throwStringLines = getLineNumbers(code, throwStringPattern);
+    if (throwStringLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Throwing string literals instead of Error objects",
+            description: "Throwing strings instead of Error objects loses the stack trace and makes error handling inconsistent.",
+            lineNumbers: throwStringLines,
+            recommendation: "Always throw Error objects: throw new Error('message') or custom error classes that extend Error.",
+            reference: "ESLint no-throw-literal / JavaScript Error Handling",
+        });
+    }
+    // process.exit() without error handling
+    const processExitPattern = /process\.exit\s*\(/g;
+    const processExitLines = getLineNumbers(code, processExitPattern);
+    if (processExitLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "process.exit() used instead of proper error handling",
+            description: "process.exit() immediately terminates the process, skipping cleanup handlers, dropping in-flight requests, and potentially corrupting data.",
+            lineNumbers: processExitLines,
+            recommendation: "Use proper error propagation instead of process.exit(). In HTTP servers, return error responses. Let the process shutdown gracefully.",
+            reference: "Node.js Graceful Shutdown Best Practices",
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=error-handling.js.map

package/dist/evaluators/error-handling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handling.js","sourceRoot":"","sources":["../../src/evaluators/error-handling.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,QAAgB;IACjE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,KAAK,CAAC;IAErB,qBAAqB;IACrB,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;IACzD,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,SAAS,eAAe,CAAC,MAAM,mJAAmJ;YAC/L,WAAW,EAAE,eAAe;YAC5B,cAAc,EAAE,8HAA8H;YAC9I,SAAS,EAAE,iDAAiD;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;IACpD,MAAM,iBAAiB,GAAG,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACpE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,sIAAsI;YACnJ,WAAW,EAAE,iBAAiB;YAC9B,cAAc,EAAE,iHAAiH;YACjI,SAAS,EAAE,+BAA+B;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9E,uEAAuE,CAAC,IAAI,CAAC,IAAI,CAAC;QAClF,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5E,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,mFAAmF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrH,IAAI,aAAa,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,4HAA4H;YACzI,cAAc,EAAE,2JAA2J;YAC3K,SAAS,EAAE,iDAAiD;SAC7D,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,MAAM,mBAAmB,GAAG,sIAAsI,CAAC;IACnK,MAAM,iBAAiB,GAAG,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACpE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,4CAA4C;YACnD,WAAW,EAAE,qIAAqI;YAClJ,WAAW,EAAE,iBAAiB;YAC9B,cAAc,EAAE,6IAA6I;YAC7J,SAAS,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;IACtF,MAAM,WAAW,GAAG,WAAW,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IAC7D,IAAI,YAAY,GAAG,CAAC,IAAI,eAAe,KAAK,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,SAAS,YAAY,4GAA4G;YAC9I,cAAc,EAAE,+HAA+H;YAC/I,SAAS,EAAE,qDAAqD;SACjE,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,MAAM,oBAAoB,GAAG,8DAA8D,CAAC;IAC5F,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;IACjE,MAAM,YAAY,GAAG,2DAA2D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,IAAI,YAAY,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,yCAAyC;YAChD,WAAW,EAAE,iJAAiJ;YAC9J,cAAc,EAAE,4FAA4F;YAC5G,SAAS,EAAE,+BAA+B;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;IAC5C,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,mDAAmD;YAC1D,WAAW,EAAE,wGAAwG;YACrH,WAAW,EAAE,gBAAgB;YAC7B,cAAc,EAAE,mGAAmG;YACnH,SAAS,EAAE,qDAAqD;SACjE,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;IACjD,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,sDAAsD;YAC7D,WAAW,EAAE,6IAA6I;YAC1J,WAAW,EAAE,gBAAgB;YAC7B,cAAc,EAAE,uIAAuI;YACvJ,SAAS,EAAE,0CAA0C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/evaluators/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evaluators/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EAGhB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAKL,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAwBrB;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,eAAe,CAwEjB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,eAAe,CAsCjB;AAID,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evaluators/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EAGhB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAKL,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AAoCrB;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,eAAe,CA4GjB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,eAAe,CAsCjB;AAID,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,CAAC"}

package/dist/evaluators/index.js

@@ -23,6 +23,18 @@ import { analyzeInternationalization } from "./internationalization.js";
 import { analyzeDependencyHealth } from "./dependency-health.js";
 import { analyzeConcurrency } from "./concurrency.js";
 import { analyzeEthicsBias } from "./ethics-bias.js";
+import { analyzeMaintainability } from "./maintainability.js";
+import { analyzeErrorHandling } from "./error-handling.js";
+import { analyzeAuthentication } from "./authentication.js";
+import { analyzeDatabase } from "./database.js";
+import { analyzeCaching } from "./caching.js";
+import { analyzeConfigurationManagement } from "./configuration-management.js";
+import { analyzeBackwardsCompatibility } from "./backwards-compatibility.js";
+import { analyzePortability } from "./portability.js";
+import { analyzeUx } from "./ux.js";
+import { analyzeLoggingPrivacy } from "./logging-privacy.js";
+import { analyzeRateLimiting } from "./rate-limiting.js";
+import { analyzeCiCd } from "./ci-cd.js";
 // ─── Evaluation Engine ──────────────────────────────────────────────────────
 /**
  * Run a single judge against the provided code.
@@ -84,6 +96,42 @@ export function evaluateWithJudge(judge, code, language, context) {
         case "ethics-bias":
             findings.push(...analyzeEthicsBias(code, language));
             break;
+        case "maintainability":
+            findings.push(...analyzeMaintainability(code, language));
+            break;
+        case "error-handling":
+            findings.push(...analyzeErrorHandling(code, language));
+            break;
+        case "authentication":
+            findings.push(...analyzeAuthentication(code, language));
+            break;
+        case "database":
+            findings.push(...analyzeDatabase(code, language));
+            break;
+        case "caching":
+            findings.push(...analyzeCaching(code, language));
+            break;
+        case "configuration-management":
+            findings.push(...analyzeConfigurationManagement(code, language));
+            break;
+        case "backwards-compatibility":
+            findings.push(...analyzeBackwardsCompatibility(code, language));
+            break;
+        case "portability":
+            findings.push(...analyzePortability(code, language));
+            break;
+        case "ux":
+            findings.push(...analyzeUx(code, language));
+            break;
+        case "logging-privacy":
+            findings.push(...analyzeLoggingPrivacy(code, language));
+            break;
+        case "rate-limiting":
+            findings.push(...analyzeRateLimiting(code, language));
+            break;
+        case "ci-cd":
+            findings.push(...analyzeCiCd(code, language));
+            break;
     }
     const score = calculateScore(findings);
     const verdict = deriveVerdict(findings, score);

package/dist/evaluators/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/evaluators/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,2EAA2E;AAC3E,iFAAiF;AASjF,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,gFAAgF;AAChF,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAErB,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAsB,EACtB,IAAY,EACZ,QAAgB,EAChB,OAAgB;IAEhB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,QAAQ,KAAK,CAAC,EAAE,EAAE,CAAC;QACjB,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtD,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,oBAAoB;YACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3D,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM;QACR,KAAK,iBAAiB;YACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,oBAAoB;YACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3D,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,YAAY;YACf,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnD,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM;QACR,KAAK,YAAY;YACf,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpD,MAAM;QACR,KAAK,SAAS;YACZ,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjD,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,sBAAsB;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9D,MAAM;QACR,KAAK,mBAAmB;YACtB,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC1D,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpD,MAAM;IACV,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAE9D,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,OAAO;QACP,KAAK;QACL,OAAO;QACP,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,QAAgB,EAChB,OAAgB;IAEhB,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACvC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAClD,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAC7B,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CACtE,CAAC;IAEF,MAAM,cAAc,GAAY,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;QAC3E,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;YAClD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC;IAEX,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CACjC,CAAC,MAAM,CAAC;IACT,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAE1E,MAAM,OAAO,GAAG,oBAAoB,CAClC,WAAW,EACX,cAAc,EACd,YAAY,EACZ,aAAa,EACb,SAAS,CACV,CAAC;IAEF,OAAO;QACL,cAAc;QACd,YAAY;QACZ,OAAO;QACP,WAAW;QACX,aAAa;QACb,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/evaluators/index.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,2EAA2E;AAC3E,iFAAiF;AASjF,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,gFAAgF;AAChF,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAErB,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAsB,EACtB,IAAY,EACZ,QAAgB,EAChB,OAAgB;IAEhB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,QAAQ,KAAK,CAAC,EAAE,EAAE,CAAC;QACjB,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtD,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,oBAAoB;YACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3D,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM;QACR,KAAK,iBAAiB;YACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,oBAAoB;YACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3D,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,YAAY;YACf,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnD,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM;QACR,KAAK,YAAY;YACf,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpD,MAAM;QACR,KAAK,SAAS;YACZ,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjD,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,sBAAsB;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9D,MAAM;QACR,KAAK,mBAAmB;YACtB,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC1D,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpD,MAAM;QACR,KAAK,iBAAiB;YACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACzD,MAAM;QACR,KAAK,gBAAgB;YACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,MAAM;QACR,KAAK,gBAAgB;YACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,UAAU;YACb,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClD,MAAM;QACR,KAAK,SAAS;YACZ,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjD,MAAM;QACR,KAAK,0BAA0B;YAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,8BAA8B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjE,MAAM;QACR,KAAK,yBAAyB;YAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAChE,MAAM;QACR,KAAK,aAAa;YAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM;QACR,KAAK,IAAI;YACP,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC5C,MAAM;QACR,KAAK,iBAAiB;YACpB,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtD,MAAM;QACR,KAAK,OAAO;YACV,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9C,MAAM;IACV,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAE9D,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,OAAO;QACP,KAAK;QACL,OAAO;QACP,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,QAAgB,EAChB,OAAgB;IAEhB,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACvC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAClD,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAC7B,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CACtE,CAAC;IAEF,MAAM,cAAc,GAAY,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;QAC3E,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;YAClD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC;IAEX,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CACjC,CAAC,MAAM,CAAC;IACT,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAE1E,MAAM,OAAO,GAAG,oBAAoB,CAClC,WAAW,EACX,cAAc,EACd,YAAY,EACZ,aAAa,EACb,SAAS,CACV,CAAC;IAEF,OAAO;QACL,cAAc;QACd,YAAY;QACZ,OAAO;QACP,WAAW;QACX,aAAa;QACb,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,CAAC"}

package/dist/evaluators/logging-privacy.d.ts

@@ -0,0 +1,3 @@
+import { Finding } from "../types.js";
+export declare function analyzeLoggingPrivacy(code: string, language: string): Finding[];
+//# sourceMappingURL=logging-privacy.d.ts.map

package/dist/evaluators/logging-privacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-privacy.d.ts","sourceRoot":"","sources":["../../src/evaluators/logging-privacy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CA8G/E"}

package/dist/evaluators/logging-privacy.js

@@ -0,0 +1,105 @@
+import { getLineNumbers } from "./shared.js";
+export function analyzeLoggingPrivacy(code, language) {
+    const findings = [];
+    let ruleNum = 1;
+    const prefix = "LOGPRIV";
+    // Logging authorization/token headers
+    const logAuthPattern = /console\.(?:log|info|warn|error|debug)\s*\([^)]*(?:authorization|bearer|token|auth)/gi;
+    const logAuthLines = getLineNumbers(code, logAuthPattern);
+    if (logAuthLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Authentication tokens logged",
+            description: `Found ${logAuthLines.length} instance(s) where authentication tokens or authorization headers are logged. Tokens in logs can be used for session hijacking.`,
+            lineNumbers: logAuthLines,
+            recommendation: "Never log authentication tokens, Authorization headers, or session IDs. If request logging is needed, redact sensitive headers before logging.",
+            reference: "OWASP Logging Cheat Sheet / CWE-532",
+        });
+    }
+    // Logging passwords
+    const logPasswordPattern = /console\.(?:log|info|warn|error|debug)\s*\([^)]*(?:password|passwd|pwd|secret|credential)/gi;
+    const logPasswordLines = getLineNumbers(code, logPasswordPattern);
+    if (logPasswordLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Passwords/secrets logged",
+            description: `Found ${logPasswordLines.length} instance(s) where passwords or secrets appear in log statements. This exposes credentials in log files, monitoring systems, and SIEM tools.`,
+            lineNumbers: logPasswordLines,
+            recommendation: "Never log passwords, credentials, or secrets. Implement a log sanitizer that redacts sensitive fields automatically.",
+            reference: "OWASP Logging Cheat Sheet / GDPR Art. 5(1)(f)",
+        });
+    }
+    // Logging PII (email, name, SSN, phone)
+    const logPiiPattern = /console\.(?:log|info|warn|error|debug)\s*\([^)]*(?:email|ssn|phone|address|name|firstName|lastName|dateOfBirth|dob|social.?security)/gi;
+    const logPiiLines = getLineNumbers(code, logPiiPattern);
+    if (logPiiLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Personally Identifiable Information (PII) in logs",
+            description: `Found ${logPiiLines.length} instance(s) where PII may be logged. PII in logs violates data minimization principles and may breach GDPR/CCPA requirements.`,
+            lineNumbers: logPiiLines,
+            recommendation: "Redact PII before logging. Use anonymized identifiers. Implement a log redaction filter that automatically masks sensitive fields.",
+            reference: "GDPR Article 5: Data Minimization / OWASP Logging Cheat Sheet",
+        });
+    }
+    // Logging full request/response bodies
+    const logBodyPattern = /console\.(?:log|info|warn|error|debug)\s*\([^)]*(?:req\.body|request\.body|res\.body|response\.body|JSON\.stringify\s*\(\s*req)/gi;
+    const logBodyLines = getLineNumbers(code, logBodyPattern);
+    if (logBodyLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "high",
+            title: "Full request/response bodies logged",
+            description: "Full request or response bodies are logged, which may contain sensitive user data, credentials, or PII that should not appear in logs.",
+            lineNumbers: logBodyLines,
+            recommendation: "Log only necessary metadata (method, URL, status, duration). If body logging is needed, implement a whitelist of safe fields and redact everything else.",
+            reference: "Log Sanitization Best Practices",
+        });
+    }
+    // Logging financial data
+    const logFinancePattern = /console\.(?:log|info|warn|error|debug)\s*\([^)]*(?:card.?number|credit.?card|cvv|expir|bank.?account|routing.?number|iban|swift)/gi;
+    const logFinanceLines = getLineNumbers(code, logFinancePattern);
+    if (logFinanceLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "critical",
+            title: "Financial data logged",
+            description: "Credit card numbers, CVVs, or bank account details appear in log statements. This is a PCI DSS violation and a data breach risk.",
+            lineNumbers: logFinanceLines,
+            recommendation: "Never log financial data. Mask card numbers (show only last 4 digits). PCI DSS prohibits storing CVV data in any form.",
+            reference: "PCI DSS Requirement 3: Protect Stored Data",
+        });
+    }
+    // Console.log used instead of proper logger (with privacy context)
+    const consoleLogCount = (code.match(/console\.(log|info|warn|error|debug)\s*\(/g) || []).length;
+    const hasProperLogger = /winston|pino|bunyan|log4j|serilog|NLog|structuredLog|logger\./gi.test(code);
+    if (consoleLogCount > 3 && !hasProperLogger) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "medium",
+            title: "Console.log lacks redaction capabilities",
+            description: `Found ${consoleLogCount} console.log statements. Console.log has no built-in redaction, log level filtering, or structured output — making it impossible to automatically strip sensitive data.`,
+            recommendation: "Use a structured logging library (pino, winston) that supports field-level redaction, log level filtering, and structured output for automated sensitivity scanning.",
+            reference: "Structured Logging / Log Redaction Patterns",
+        });
+    }
+    // String concatenation in logs (prevents redaction)
+    const logConcatPattern = /console\.(?:log|info|warn|error|debug)\s*\([^)]*\+/g;
+    const logConcatLines = getLineNumbers(code, logConcatPattern);
+    if (logConcatLines.length > 0) {
+        findings.push({
+            ruleId: `${prefix}-${String(ruleNum++).padStart(3, "0")}`,
+            severity: "low",
+            title: "String concatenation in log statements",
+            description: `Found ${logConcatLines.length} log statement(s) using string concatenation. Concatenated logs are unstructured and make it impossible to apply field-level redaction.`,
+            lineNumbers: logConcatLines.slice(0, 5),
+            recommendation: "Use structured logging with named fields: logger.info({ userId, action }, 'User action performed'). This allows automated redaction of specific fields.",
+            reference: "Structured Logging Best Practices",
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=logging-privacy.js.map

package/dist/evaluators/logging-privacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-privacy.js","sourceRoot":"","sources":["../../src/evaluators/logging-privacy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,SAAS,CAAC;IAEzB,sCAAsC;IACtC,MAAM,cAAc,GAAG,uFAAuF,CAAC;IAC/G,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,8BAA8B;YACrC,WAAW,EAAE,SAAS,YAAY,CAAC,MAAM,iIAAiI;YAC1K,WAAW,EAAE,YAAY;YACzB,cAAc,EAAE,gJAAgJ;YAChK,SAAS,EAAE,qCAAqC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB;IACpB,MAAM,kBAAkB,GAAG,6FAA6F,CAAC;IACzH,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,SAAS,gBAAgB,CAAC,MAAM,8IAA8I;YAC3L,WAAW,EAAE,gBAAgB;YAC7B,cAAc,EAAE,sHAAsH;YACtI,SAAS,EAAE,+CAA+C;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,MAAM,aAAa,GAAG,wIAAwI,CAAC;IAC/J,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,mDAAmD;YAC1D,WAAW,EAAE,SAAS,WAAW,CAAC,MAAM,gIAAgI;YACxK,WAAW,EAAE,WAAW;YACxB,cAAc,EAAE,oIAAoI;YACpJ,SAAS,EAAE,+DAA+D;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,MAAM,cAAc,GAAG,mIAAmI,CAAC;IAC3J,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EAAE,wIAAwI;YACrJ,WAAW,EAAE,YAAY;YACzB,cAAc,EAAE,0JAA0J;YAC1K,SAAS,EAAE,iCAAiC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,MAAM,iBAAiB,GAAG,oIAAoI,CAAC;IAC/J,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,kIAAkI;YAC/I,WAAW,EAAE,eAAe;YAC5B,cAAc,EAAE,wHAAwH;YACxI,SAAS,EAAE,4CAA4C;SACxD,CAAC,CAAC;IACL,CAAC;IAED,mEAAmE;IACnE,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,4CAA4C,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAChG,MAAM,eAAe,GAAG,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrG,IAAI,eAAe,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,0CAA0C;YACjD,WAAW,EAAE,SAAS,eAAe,yKAAyK;YAC9M,cAAc,EAAE,sKAAsK;YACtL,SAAS,EAAE,6CAA6C;SACzD,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,MAAM,gBAAgB,GAAG,qDAAqD,CAAC;IAC/E,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACzD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,wCAAwC;YAC/C,WAAW,EAAE,SAAS,cAAc,CAAC,MAAM,yIAAyI;YACpL,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;YACvC,cAAc,EAAE,yJAAyJ;YACzK,SAAS,EAAE,mCAAmC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/evaluators/maintainability.d.ts

@@ -0,0 +1,3 @@
+import { Finding } from "../types.js";
+export declare function analyzeMaintainability(code: string, language: string): Finding[];
+//# sourceMappingURL=maintainability.d.ts.map

package/dist/evaluators/maintainability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintainability.d.ts","sourceRoot":"","sources":["../../src/evaluators/maintainability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CAkJhF"}