@opensip-cli/checks-typescript 0.1.0

package/dist/checks/architecture/module-coupling-fan-out.js

@@ -0,0 +1,120 @@
+/**
+ * @fileoverview File-level fan-out (outbound coupling) check.
+ *
+ * Flags files that import many other intra-project files. High fan-out
+ * indicates a "god-file" — a module that knows too much, hard to refactor
+ * without ripple effects, hard for an AI agent to reason about because
+ * search returns too many adjacent matches.
+ *
+ * Composition-root files (DI containers, plugin registries) legitimately
+ * have high fan-out and can be exempted with
+ * `// @fitness-ignore-file module-coupling-fan-out` at the top of the file.
+ *
+ * Pure barrel files (whose only top-level content is `export ... from`
+ * re-exports) are auto-exempt. Re-exporting many modules is a barrel's
+ * function — the "god-file" pathology applies to logic-bearing files,
+ * not to public-API surfaces. If a barrel grows enormous, that's a
+ * separate concern (warrants a "barrel-bloat" check, not this one).
+ */
+import { defineCheck, buildImportGraph, } from '@opensip-cli/fitness';
+const WARNING_THRESHOLD = 15;
+const ERROR_THRESHOLD = 30;
+/**
+ * True if a file's only top-level content is `export ... from` re-exports.
+ * Robust against block comments, line comments, and multi-line export
+ * lists — but not a full parser. False negatives (treating a real barrel
+ * as non-barrel) just leave the existing check behaviour; false positives
+ * (treating a logic file as a barrel) would silently exempt a god-file.
+ * The heuristic biases toward the safer false-negative side: any
+ * non-re-export top-level statement (import, const, function, class,
+ * interface, type X = …) flips the verdict to "not a barrel".
+ */
+function isBarrelFile(content) {
+    // Strip block comments and line comments first so prose can't fool the
+    // top-level statement scan.
+    const stripped = content
+        .replaceAll(/\/\*[\s\S]*?\*\//g, '')
+        // eslint-disable-next-line sonarjs/slow-regex -- anchored line scan with bounded `.*`; no ReDoS exposure
+        .replaceAll(/\/\/.*$/gm, '');
+    // Collapse multi-line `export { a, b, c } from '...'` blocks onto one
+    // logical line by joining lines that don't terminate a statement. Any
+    // line that contains `from '` or `from "` is treated as a terminator.
+    const logicalLines = [];
+    let buffer = '';
+    for (const rawLine of stripped.split('\n')) {
+        const line = rawLine.trim();
+        /* v8 ignore next -- defensive guard */
+        if (!line)
+            continue;
+        buffer = buffer ? `${buffer} ${line}` : line;
+        if (line.includes(';') || / from ['"]/.test(line)) {
+            logicalLines.push(buffer);
+            buffer = '';
+        }
+    }
+    if (buffer)
+        logicalLines.push(buffer);
+    // Every logical line must be a re-export, and an empty file is not a re-export
+    // barrel. Anything else (import, declaration, side-effect call) disqualifies.
+    // Single boolean expression — no early `return false` (which the
+    // silent-early-returns check would flag as a swallowed failure path).
+    const reExportRe = /^export\s+(?:type\s+)?[*{]/;
+    /* v8 ignore next -- empty-input branch is a defensive guard, not hit by fixtures */
+    return logicalLines.length > 0 && logicalLines.every((line) => reExportRe.test(line));
+}
+export const moduleCouplingFanOut = defineCheck({
+    id: 'c0b7289b-984c-4f39-b2be-7d9b0692abec',
+    slug: 'module-coupling-fan-out',
+    description: 'Flags files with high outbound import fan-out (god-files)',
+    longDescription: `Counts each file's outbound intra-project imports. Files exceeding ${WARNING_THRESHOLD} ` +
+        `imports get a warning; files exceeding ${ERROR_THRESHOLD} get an error. Composition ` +
+        'roots (DI, plugin registries) legitimately exceed this — exempt them with ' +
+        '`// @fitness-ignore-file module-coupling-fan-out` at the top of the file. ' +
+        'Pure barrel files (only `export ... from` re-exports) are auto-exempt: ' +
+        "fanning out is the barrel's job, not a god-file pathology.",
+    scope: {
+        languages: ['typescript', 'tsx', 'javascript', 'jsx'],
+        concerns: ['backend', 'frontend', 'cli', 'shared'],
+    },
+    confidence: 'medium',
+    tags: ['architecture', 'modularity'],
+    fileTypes: ['ts', 'tsx', 'js', 'jsx'],
+    async analyzeAll(files) {
+        const fileMap = await files.readAll();
+        const graph = buildImportGraph(fileMap);
+        const violations = [];
+        for (const [filePath, edges] of graph.outbound) {
+            const fanOut = edges.size;
+            if (fanOut <= WARNING_THRESHOLD)
+                continue;
+            // Auto-exempt type-declaration files. `.d.ts` and `.test-d.ts`
+            // files contain only type information that compiles to nothing —
+            // their imports impose no runtime coupling cost.
+            if (filePath.endsWith('.d.ts') || filePath.endsWith('.test-d.ts'))
+                continue;
+            // Auto-exempt barrels. Re-export-only files have high fan-out by
+            // design and never represent the "knows too much" pathology this
+            // check targets.
+            const content = fileMap.get(filePath);
+            if (content !== undefined && isBarrelFile(content))
+                continue;
+            const severity = fanOut > ERROR_THRESHOLD ? 'error' : 'warning';
+            const limit = severity === 'error' ? ERROR_THRESHOLD : WARNING_THRESHOLD;
+            violations.push({
+                severity,
+                message: `High fan-out: ${fanOut} intra-project imports (limit ${limit}). High-fan-out files are hard to refactor and reason about.`,
+                filePath,
+                line: 1,
+            });
+        }
+        // Sort for deterministic output: highest fan-out first.
+        return violations.sort((a, b) => {
+            /* v8 ignore next -- defensive nullish fallback */
+            const aFan = graph.outbound.get(a.filePath ?? '')?.size ?? 0;
+            /* v8 ignore next -- defensive nullish fallback */
+            const bFan = graph.outbound.get(b.filePath ?? '')?.size ?? 0;
+            return bFan - aFan;
+        });
+    },
+});
+//# sourceMappingURL=module-coupling-fan-out.js.map

package/dist/checks/architecture/module-coupling-fan-out.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-coupling-fan-out.js","sourceRoot":"","sources":["../../../src/checks/architecture/module-coupling-fan-out.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,WAAW,EAGX,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,uEAAuE;IACvE,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,OAAO;SACrB,UAAU,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACpC,yGAAyG;SACxG,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAE/B,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,uCAAuC;QACvC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,MAAM;QAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEtC,+EAA+E;IAC/E,8EAA8E;IAC9E,iEAAiE;IACjE,sEAAsE;IACtE,MAAM,UAAU,GAAG,4BAA4B,CAAC;IAChD,oFAAoF;IACpF,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,yBAAyB;IAC/B,WAAW,EAAE,2DAA2D;IACxE,eAAe,EACb,sEAAsE,iBAAiB,GAAG;QAC1F,0CAA0C,eAAe,6BAA6B;QACtF,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,4DAA4D;IAC9D,KAAK,EAAE;QACL,SAAS,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC;QACrD,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;KACnD;IACD,UAAU,EAAE,QAAQ;IACpB,IAAI,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;IACpC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;IAErC,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAExC,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;YAC1B,IAAI,MAAM,IAAI,iBAAiB;gBAAE,SAAS;YAE1C,+DAA+D;YAC/D,iEAAiE;YACjE,iDAAiD;YACjD,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,SAAS;YAE5E,iEAAiE;YACjE,iEAAiE;YACjE,iBAAiB;YACjB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,OAAO,CAAC;gBAAE,SAAS;YAE7D,MAAM,QAAQ,GAAwB,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACrF,MAAM,KAAK,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACzE,UAAU,CAAC,IAAI,CAAC;gBACd,QAAQ;gBACR,OAAO,EAAE,iBAAiB,MAAM,iCAAiC,KAAK,8DAA8D;gBACpI,QAAQ;gBACR,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAED,wDAAwD;QACxD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC9B,kDAAkD;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;YAC7D,kDAAkD;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;YAC7D,OAAO,IAAI,GAAG,IAAI,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/architecture/no-bootstrap-tool-import.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @fileoverview The CLI host must not statically import a tool RUNTIME (§1, 3.0.0).
+ *
+ * Install-source independence (north-star §1) requires the host to load bundled
+ * tools through the SAME dynamic-import plugin path an installed tool uses — never
+ * a static `import { fitnessTool } from '@opensip-cli/fitness'`. Importing a
+ * tool-runtime export (`fitnessTool` / `graphTool` / `simulationTool`) compiles the
+ * tool into the CLI and re-privileges its load path — the exact coupling the
+ * acceptance test deletes. Bundled tools are named in `BUNDLED_TOOL_PACKAGES` and
+ * loaded by `importToolRuntime` (`bootstrap/register-tools.ts`). This is the
+ * mechanical guarantee behind completion invariant 1 (§8).
+ *
+ * The check is PRECISE — it flags only the tool-RUNTIME symbols, so legitimate
+ * host couplings to a tool package's NON-runtime API are untouched: graph's
+ * adapter-discovery (`register-graph-adapters.ts` imports
+ * `discoverGraphAdapterPackages` / `GraphLanguageAdapter`) and fitness's
+ * `defineCheck` authoring API are different concerns, not the runtime-load
+ * privilege. AST-based, so a tool-runtime symbol appearing as TEXT inside a
+ * template literal (e.g. the `init` scaffolds in `config-templates.ts`, which
+ * EMIT user-project source) is correctly ignored — it is not a real import
+ * declaration. Test code (`__tests__/`) is exempt: a white-box test may import a
+ * tool runtime directly (see `cli/.../__tests__/test-utils/bundled-tools.ts`).
+ *
+ * WAIVED placement exception (the `//` directive below is what the suppressor
+ * reads): this is an opensip-internal dogfood check, but it is the one relocation
+ * that genuinely needs the TS-AST substrate (@opensip-cli/lang-typescript
+ * `getSharedSourceFile`) — it must tell a REAL `import { fitnessTool }` from the
+ * same symbol appearing as TEXT inside `init` scaffold template literals, which a
+ * raw-regex project-local .mjs cannot (the module-specifier string can't be
+ * stripped without losing import detection). `@opensip-cli/lang-*` is not
+ * resolvable from `opensip-cli/fit/checks/`, so it stays SHIPPED until lang-* is
+ * root-resolvable for project-local checks (then relocate it).
+ */
+import { type CheckViolation } from '@opensip-cli/fitness';
+/** Pure analysis over a parsed source file. Exported for unit tests. */
+export declare function analyzeBootstrapToolImport(content: string, filePath: string): CheckViolation[];
+export declare const noBootstrapToolImport: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=no-bootstrap-tool-import.d.ts.map

package/dist/checks/architecture/no-bootstrap-tool-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-bootstrap-tool-import.d.ts","sourceRoot":"","sources":["../../../src/checks/architecture/no-bootstrap-tool-import.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAiBpF,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CA6B9F;AAED,eAAO,MAAM,qBAAqB,sCAYhC,CAAC"}

package/dist/checks/architecture/no-bootstrap-tool-import.js

@@ -0,0 +1,95 @@
+/**
+ * @fileoverview The CLI host must not statically import a tool RUNTIME (§1, 3.0.0).
+ *
+ * Install-source independence (north-star §1) requires the host to load bundled
+ * tools through the SAME dynamic-import plugin path an installed tool uses — never
+ * a static `import { fitnessTool } from '@opensip-cli/fitness'`. Importing a
+ * tool-runtime export (`fitnessTool` / `graphTool` / `simulationTool`) compiles the
+ * tool into the CLI and re-privileges its load path — the exact coupling the
+ * acceptance test deletes. Bundled tools are named in `BUNDLED_TOOL_PACKAGES` and
+ * loaded by `importToolRuntime` (`bootstrap/register-tools.ts`). This is the
+ * mechanical guarantee behind completion invariant 1 (§8).
+ *
+ * The check is PRECISE — it flags only the tool-RUNTIME symbols, so legitimate
+ * host couplings to a tool package's NON-runtime API are untouched: graph's
+ * adapter-discovery (`register-graph-adapters.ts` imports
+ * `discoverGraphAdapterPackages` / `GraphLanguageAdapter`) and fitness's
+ * `defineCheck` authoring API are different concerns, not the runtime-load
+ * privilege. AST-based, so a tool-runtime symbol appearing as TEXT inside a
+ * template literal (e.g. the `init` scaffolds in `config-templates.ts`, which
+ * EMIT user-project source) is correctly ignored — it is not a real import
+ * declaration. Test code (`__tests__/`) is exempt: a white-box test may import a
+ * tool runtime directly (see `cli/.../__tests__/test-utils/bundled-tools.ts`).
+ *
+ * WAIVED placement exception (the `//` directive below is what the suppressor
+ * reads): this is an opensip-internal dogfood check, but it is the one relocation
+ * that genuinely needs the TS-AST substrate (@opensip-cli/lang-typescript
+ * `getSharedSourceFile`) — it must tell a REAL `import { fitnessTool }` from the
+ * same symbol appearing as TEXT inside `init` scaffold template literals, which a
+ * raw-regex project-local .mjs cannot (the module-specifier string can't be
+ * stripped without losing import detection). `@opensip-cli/lang-*` is not
+ * resolvable from `opensip-cli/fit/checks/`, so it stays SHIPPED until lang-* is
+ * root-resolvable for project-local checks (then relocate it).
+ */
+// @fitness-ignore-file shipped-checks-must-be-generic -- AST-dependent dogfood check; needs @opensip-cli/lang-typescript, which a project-local .mjs cannot import. See header.
+import { defineCheck, isTestFile } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/** The CLI host source tree this check guards (the loader + composition root). */
+const CLI_HOST_PATH = 'packages/cli/src/';
+/** Tool packages whose runtime export must not be statically imported by the host. */
+const TOOL_PACKAGE_RE = /^@opensip-cli\/(?:fitness|graph|simulation)(?:\/.*)?$/;
+/** The tool-RUNTIME exports — importing any of these is the load-path privilege. */
+const TOOL_RUNTIME_SYMBOLS = new Set([
+    'fitnessTool',
+    'graphTool',
+    'simulationTool',
+]);
+/** Pure analysis over a parsed source file. Exported for unit tests. */
+export function analyzeBootstrapToolImport(content, filePath) {
+    const violations = [];
+    const sourceFile = getSharedSourceFile(filePath, content);
+    if (!sourceFile)
+        return violations;
+    for (const stmt of sourceFile.statements) {
+        if (!ts.isImportDeclaration(stmt) || !ts.isStringLiteral(stmt.moduleSpecifier))
+            continue;
+        if (!TOOL_PACKAGE_RE.test(stmt.moduleSpecifier.text))
+            continue;
+        const named = stmt.importClause?.namedBindings;
+        if (named === undefined || !ts.isNamedImports(named))
+            continue;
+        for (const element of named.elements) {
+            // The ORIGINAL imported name (`{ graphTool as gt }` → `graphTool`).
+            const imported = (element.propertyName ?? element.name).text;
+            if (!TOOL_RUNTIME_SYMBOLS.has(imported))
+                continue;
+            const line = sourceFile.getLineAndCharacterOfPosition(element.getStart(sourceFile)).line + 1;
+            violations.push({
+                message: `The CLI host must not statically import the tool runtime '${imported}' from ` +
+                    `'${stmt.moduleSpecifier.text}' (§1): bundled tools load through the dynamic plugin ` +
+                    `path, so install-source independence stays structural. A static import re-privileges ` +
+                    `the bundled load path.`,
+                severity: 'error',
+                line,
+                suggestion: 'Load bundled tools via BUNDLED_TOOL_PACKAGES + importToolRuntime ' +
+                    '(bootstrap/register-tools.ts). Test code may import a tool runtime directly.',
+            });
+        }
+    }
+    return violations;
+}
+export const noBootstrapToolImport = defineCheck({
+    id: '09453917-4f95-446d-a6d1-3a5445b00902',
+    slug: 'no-bootstrap-tool-import',
+    description: 'The CLI host must not statically import a tool runtime — bundled tools load via the dynamic plugin path (§1 install-source independence)',
+    scope: { languages: ['typescript'], concerns: ['backend'] },
+    tags: ['architecture'],
+    fileTypes: ['ts', 'tsx'],
+    analyze: (content, filePath) => {
+        if (!filePath.includes(CLI_HOST_PATH) || isTestFile(filePath))
+            return [];
+        return analyzeBootstrapToolImport(content, filePath);
+    },
+});
+//# sourceMappingURL=no-bootstrap-tool-import.js.map

package/dist/checks/architecture/no-bootstrap-tool-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-bootstrap-tool-import.js","sourceRoot":"","sources":["../../../src/checks/architecture/no-bootstrap-tool-import.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,gLAAgL;AAChL,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,kFAAkF;AAClF,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C,sFAAsF;AACtF,MAAM,eAAe,GAAG,uDAAuD,CAAC;AAEhF,oFAAoF;AACpF,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IACxD,aAAa;IACb,WAAW;IACX,gBAAgB;CACjB,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,OAAe,EAAE,QAAgB;IAC1E,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU;QAAE,OAAO,UAAU,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,SAAS;QACzF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/D,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrC,oEAAoE;YACpE,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;YAC7D,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAClD,MAAM,IAAI,GAAG,UAAU,CAAC,6BAA6B,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7F,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EACL,6DAA6D,QAAQ,SAAS;oBAC9E,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,wDAAwD;oBACrF,uFAAuF;oBACvF,wBAAwB;gBAC1B,QAAQ,EAAE,OAAO;gBACjB,IAAI;gBACJ,UAAU,EACR,mEAAmE;oBACnE,8EAA8E;aACjF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,0BAA0B;IAChC,WAAW,EACT,0IAA0I;IAC5I,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE;IAC3D,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IACxB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC7B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACzE,OAAO,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/architecture/package-json-exports-field.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Package.json exports field validation
+ * @module checks-builtin/checks/architecture/package-json-exports-field
+ *
+ * Ensures packages have an "exports" field in package.json for explicit
+ * ESM module resolution. Without it, consumers can import from any path
+ * inside the package, creating fragile coupling to internal structure.
+ */
+export declare const packageJsonExportsField: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=package-json-exports-field.d.ts.map

package/dist/checks/architecture/package-json-exports-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-json-exports-field.d.ts","sourceRoot":"","sources":["../../../src/checks/architecture/package-json-exports-field.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AASH,eAAO,MAAM,uBAAuB,sCA+ClC,CAAC"}

package/dist/checks/architecture/package-json-exports-field.js

@@ -0,0 +1,56 @@
+// @fitness-ignore-file performance-anti-patterns -- sequential package.json read across workspace is bounded by workspace package count; controls memory peak
+/**
+ * @fileoverview Package.json exports field validation
+ * @module checks-builtin/checks/architecture/package-json-exports-field
+ *
+ * Ensures packages have an "exports" field in package.json for explicit
+ * ESM module resolution. Without it, consumers can import from any path
+ * inside the package, creating fragile coupling to internal structure.
+ */
+import { defineCheck } from '@opensip-cli/fitness';
+// Match a `packages/` or `services/` workspace segment whether the path is
+// repo-relative (`packages/a/package.json`) or absolute (`/abs/packages/a/…`).
+const WORKSPACE_SEGMENT = /(?:^|\/)(?:packages|services)\//;
+const PACKAGES_SEGMENT = /(?:^|\/)packages\//;
+export const packageJsonExportsField = defineCheck({
+    id: 'b4203be3-3308-4fb1-8b20-44e23b8e3eff',
+    slug: 'package-json-exports-field',
+    scope: { languages: ['typescript'], concerns: ['backend', 'frontend', 'cli'] },
+    confidence: 'high',
+    description: 'Ensures packages have an "exports" field in package.json for explicit module resolution',
+    tags: ['architecture', 'esm', 'monorepo'],
+    async analyzeAll(files) {
+        const violations = [];
+        const packageJsonPaths = files.paths.filter((p) => p.endsWith('package.json') && !p.includes('node_modules') && WORKSPACE_SEGMENT.test(p));
+        for (const filePath of packageJsonPaths) {
+            const content = await files.read(filePath);
+            /* v8 ignore next -- defensive guard */
+            if (!content)
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(content);
+                /* v8 ignore next 1 -- defensive catch: parse failures already handled */
+            }
+            catch {
+                continue;
+            }
+            // Skip private packages that aren't consumed by others
+            if (parsed.private === true && !PACKAGES_SEGMENT.test(filePath))
+                continue;
+            if (!parsed.exports) {
+                const name = parsed.name ?? filePath;
+                violations.push({
+                    filePath,
+                    line: 1,
+                    message: `Package "${name}" has no "exports" field. Consumers can import from any internal path, creating fragile coupling.`,
+                    severity: 'warning',
+                    suggestion: 'Add an "exports" field to explicitly define public entry points. Example: "exports": { ".": "./dist/index.js" }',
+                    type: 'MISSING_EXPORTS_FIELD',
+                });
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=package-json-exports-field.js.map

package/dist/checks/architecture/package-json-exports-field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-json-exports-field.js","sourceRoot":"","sources":["../../../src/checks/architecture/package-json-exports-field.ts"],"names":[],"mappings":"AAAA,8JAA8J;AAC9J;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAA0C,MAAM,sBAAsB,CAAC;AAE3F,2EAA2E;AAC3E,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AAC5D,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,4BAA4B;IAClC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;IAC9E,UAAU,EAAE,MAAM;IAClB,WAAW,EACT,yFAAyF;IAC3F,IAAI,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,UAAU,CAAC;IAEzC,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC9F,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,uCAAuC;YACvC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,MAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;gBACxD,yEAAyE;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,uDAAuD;YACvD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAE1E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAI,MAAM,CAAC,IAAe,IAAI,QAAQ,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC;oBACd,QAAQ;oBACR,IAAI,EAAE,CAAC;oBACP,OAAO,EAAE,YAAY,IAAI,mGAAmG;oBAC5H,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,iHAAiH;oBACnH,IAAI,EAAE,uBAAuB;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/architecture/phantom-dependency-detection.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @fileoverview Detect phantom dependencies - packages used in code but not declared in package.json (v3, AST-based)
+ * @invariants
+ * - Only checks external npm packages, not workspace packages or relative imports
+ * - Distinguishes between dependencies, devDependencies, and peerDependencies
+ * - Respects pnpm's strict node_modules isolation
+ * - Extracts imports from the TypeScript AST, so import-like text inside string
+ *   literals (detection patterns, docs, fixtures) is never mistaken for a real import
+ */
+/**
+ * Check: architecture/phantom-dependency-detection
+ *
+ * Detects packages that are imported in code but not declared in package.json.
+ * This is critical for pnpm which uses strict node_modules isolation.
+ *
+ * Phantom dependencies can cause:
+ * - Runtime failures in pnpm projects (strict node_modules)
+ * - Inconsistent behavior between development and production
+ * - Version conflicts when the hoisted dependency changes
+ */
+export declare const phantomDependencyDetection: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=phantom-dependency-detection.d.ts.map

package/dist/checks/architecture/phantom-dependency-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phantom-dependency-detection.d.ts","sourceRoot":"","sources":["../../../src/checks/architecture/phantom-dependency-detection.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AA4UH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,sCA4CrC,CAAC"}