@opensip-cli/checks-typescript 0.1.0

package/dist/checks/architecture/phantom-dependency-detection.js

@@ -0,0 +1,330 @@
+// @fitness-ignore-file toctou-race-condition -- TOCTOU acceptable in this non-concurrent context
+// @fitness-ignore-file fitness-check-standards -- Check requires direct fs access for package.json parsing outside of standard file scanning pipeline
+// @fitness-ignore-file unbounded-memory -- reads workspace package.json files; bounded by standard package metadata size
+// @fitness-ignore-file performance-anti-patterns -- sequential package.json reads keep peak memory bounded; small N per workspace
+/**
+ * @fileoverview Detect phantom dependencies - packages used in code but not declared in package.json (v3, AST-based)
+ * @invariants
+ * - Only checks external npm packages, not workspace packages or relative imports
+ * - Distinguishes between dependencies, devDependencies, and peerDependencies
+ * - Respects pnpm's strict node_modules isolation
+ * - Extracts imports from the TypeScript AST, so import-like text inside string
+ *   literals (detection patterns, docs, fixtures) is never mistaken for a real import
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { defineCheck } from '@opensip-cli/fitness';
+import { getSharedSourceFile, walkNodes } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/**
+ * Packages that are always available (Node.js built-ins)
+ */
+const NODE_BUILTINS = new Set([
+    'assert',
+    'async_hooks',
+    'buffer',
+    'child_process',
+    'cluster',
+    'console',
+    'constants',
+    'crypto',
+    'dgram',
+    'dns',
+    'domain',
+    'events',
+    'fs',
+    'fs/promises',
+    'http',
+    'http2',
+    'https',
+    'inspector',
+    'module',
+    'net',
+    'os',
+    'path',
+    'perf_hooks',
+    'process',
+    'punycode',
+    'querystring',
+    'readline',
+    'repl',
+    'stream',
+    'stream/promises',
+    'string_decoder',
+    'sys',
+    'timers',
+    'timers/promises',
+    'tls',
+    'trace_events',
+    'tty',
+    'url',
+    'util',
+    'v8',
+    'vm',
+    'worker_threads',
+    'zlib',
+]);
+/**
+ * Patterns that indicate test-only imports (should check devDependencies)
+ */
+const TEST_FILE_PATTERNS = [
+    /__tests__\//,
+    /\.test\.(ts|tsx|js|jsx)$/,
+    /\.spec\.(ts|tsx|js|jsx)$/,
+    /test\//,
+    /tests\//,
+];
+/**
+ * Build/tooling config files (e.g. `vitest.config.ts`, `drizzle.config.ts`,
+ * `eslint.config.mjs`). Like test files, these run only at dev/build time and
+ * are never part of the published package, so importing a `devDependency` from
+ * them is legitimate — a genuinely undeclared import is still flagged.
+ */
+const TOOLING_FILE_PATTERN = /(?:^|\/)[^/]+\.config\.(?:ts|tsx|js|jsx|mts|cts|mjs|cjs)$/;
+/**
+ * Extract package name from an import specifier.
+ * Handles scoped packages (@org/pkg) and subpath imports (@org/pkg/subpath).
+ */
+function extractPackageName(importSpecifier) {
+    // Skip relative imports
+    if (importSpecifier.startsWith('.') || importSpecifier.startsWith('/')) {
+        return null;
+    }
+    // Strip the node: prefix before built-in / package detection
+    const bare = importSpecifier.startsWith('node:') ? importSpecifier.slice(5) : importSpecifier;
+    // Skip Node.js built-ins (with or without the node: prefix, and subpaths like fs/promises)
+    if (NODE_BUILTINS.has(bare) || NODE_BUILTINS.has(bare.split('/')[0] ?? '')) {
+        return null;
+    }
+    // Handle scoped packages (@org/pkg or @org/pkg/subpath)
+    if (importSpecifier.startsWith('@')) {
+        const parts = importSpecifier.split('/');
+        if (parts.length >= 2) {
+            return `${parts[0]}/${parts[1]}`;
+        }
+        return null;
+    }
+    // Handle regular packages (pkg or pkg/subpath)
+    return importSpecifier.split('/')[0] ?? null;
+}
+/**
+ * Extract real module imports from a TypeScript/JavaScript source file using the
+ * AST. Covers static `import`/`export ... from`, `import x = require()`, dynamic
+ * `import()`, and `require()` call expressions. Because these are structural AST
+ * nodes, import-like text appearing inside string literals is never matched.
+ */
+function extractImports(filePath, content) {
+    const sourceFile = getSharedSourceFile(filePath, content);
+    if (!sourceFile)
+        return [];
+    const imports = [];
+    const push = (node, specifier) => {
+        const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+        imports.push({ specifier, line: line + 1 });
+    };
+    walkNodes(sourceFile, (node) => {
+        // import ... from 'x'  /  export ... from 'x'
+        if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&
+            node.moduleSpecifier &&
+            ts.isStringLiteral(node.moduleSpecifier)) {
+            push(node, node.moduleSpecifier.text);
+            return;
+        }
+        // import x = require('x')
+        if (ts.isImportEqualsDeclaration(node) &&
+            ts.isExternalModuleReference(node.moduleReference) &&
+            ts.isStringLiteralLike(node.moduleReference.expression)) {
+            push(node, node.moduleReference.expression.text);
+            return;
+        }
+        // dynamic import('x') and require('x')
+        if (ts.isCallExpression(node)) {
+            const isDynamicImport = node.expression.kind === ts.SyntaxKind.ImportKeyword;
+            const isRequire = ts.isIdentifier(node.expression) && node.expression.text === 'require';
+            const arg = node.arguments[0];
+            if ((isDynamicImport || isRequire) && arg && ts.isStringLiteralLike(arg)) {
+                push(node, arg.text);
+            }
+        }
+    });
+    return imports;
+}
+/**
+ * Find the nearest package.json for a file.
+ */
+function findNearestPackageJson(filePath) {
+    let dir = path.dirname(filePath);
+    // @fitness-ignore-next-line null-safety -- path.parse() always returns object with .root per Node.js API
+    const root = path.parse(dir).root;
+    while (dir !== root) {
+        const pkgPath = path.join(dir, 'package.json');
+        if (fs.existsSync(pkgPath)) {
+            return pkgPath;
+        }
+        dir = path.dirname(dir);
+    }
+    return null;
+}
+/**
+ * Read and parse package.json.
+ */
+function readPackageJson(pkgPath) {
+    try {
+        const content = fs.readFileSync(pkgPath, 'utf8');
+        return JSON.parse(content);
+    }
+    catch {
+        // @swallow-ok graceful degradation - return sentinel on failure
+        return null;
+    }
+}
+/**
+ * Whether a file may legitimately import `devDependencies`: test files and
+ * build/tooling config files, which run only at dev/build time and never ship.
+ */
+function allowsDevDependencies(filePath) {
+    return (TEST_FILE_PATTERNS.some((pattern) => pattern.test(filePath)) ||
+        TOOLING_FILE_PATTERN.test(filePath));
+}
+/**
+ * Check if a package is declared in any dependency section.
+ */
+function isDeclaredDependency(pkg, packageName, allowDevDeps) {
+    if (pkg.dependencies?.[packageName]) {
+        return { declared: true, section: 'dependencies' };
+    }
+    if (pkg.peerDependencies?.[packageName]) {
+        return { declared: true, section: 'peerDependencies' };
+    }
+    if (pkg.optionalDependencies?.[packageName]) {
+        return { declared: true, section: 'optionalDependencies' };
+    }
+    // In dev-only files (tests, build/tooling configs), devDependencies are valid.
+    if (allowDevDeps && pkg.devDependencies?.[packageName]) {
+        return { declared: true, section: 'devDependencies' };
+    }
+    // In shipped source, importing a devDependency is a problem (won't ship in prod).
+    if (!allowDevDeps && pkg.devDependencies?.[packageName]) {
+        return { declared: false, section: 'devDependencies' };
+    }
+    return { declared: false };
+}
+/** Read + cache a package.json by its resolved path. */
+function getCachedPackageJson(cache, pkgJsonPath) {
+    let pkgJson = cache.get(pkgJsonPath);
+    if (pkgJson === undefined) {
+        pkgJson = readPackageJson(pkgJsonPath);
+        cache.set(pkgJsonPath, pkgJson);
+    }
+    return pkgJson;
+}
+/** Build the violation for a single import, or null when it's fine. */
+function violationForImport(imp, ctx) {
+    const { pkgJson, allDeps, allowDevDeps, filePath, pkgJsonPath } = ctx;
+    const packageName = extractPackageName(imp.specifier);
+    if (!packageName)
+        return null;
+    // Skip workspace packages (declared via the workspace: protocol)
+    if (allDeps[packageName]?.startsWith('workspace:'))
+        return null;
+    const { declared, section } = isDeclaredDependency(pkgJson, packageName, allowDevDeps);
+    if (declared)
+        return null;
+    const isDevDep = section === 'devDependencies';
+    const message = isDevDep
+        ? `Source file imports "${packageName}" which is only in devDependencies`
+        : `Phantom dependency: "${packageName}" is used but not declared in package.json`;
+    const suggestion = isDevDep
+        ? `Move "${packageName}" from devDependencies to dependencies in ${path.basename(pkgJsonPath)}`
+        : `Add "${packageName}" to dependencies in ${path.basename(pkgJsonPath)}`;
+    return {
+        filePath,
+        line: imp.line,
+        message,
+        severity: 'error',
+        suggestion,
+        match: packageName,
+        type: 'phantom-dependency',
+    };
+}
+/** Collect all phantom/devDep violations for one already-read source file. */
+function collectFileViolations(filePath, content, cache) {
+    const imports = extractImports(filePath, content);
+    if (imports.length === 0)
+        return [];
+    const pkgJsonPath = findNearestPackageJson(filePath);
+    if (!pkgJsonPath)
+        return [];
+    const pkgJson = getCachedPackageJson(cache, pkgJsonPath);
+    if (!pkgJson)
+        return [];
+    const allDeps = {
+        ...pkgJson.dependencies,
+        ...pkgJson.devDependencies,
+        ...pkgJson.peerDependencies,
+        ...pkgJson.optionalDependencies,
+    };
+    const allowDevDeps = allowsDevDependencies(filePath);
+    const ctx = { pkgJson, allDeps, allowDevDeps, filePath, pkgJsonPath };
+    const out = [];
+    for (const imp of imports) {
+        const violation = violationForImport(imp, ctx);
+        if (violation)
+            out.push(violation);
+    }
+    return out;
+}
+/**
+ * Check: architecture/phantom-dependency-detection
+ *
+ * Detects packages that are imported in code but not declared in package.json.
+ * This is critical for pnpm which uses strict node_modules isolation.
+ *
+ * Phantom dependencies can cause:
+ * - Runtime failures in pnpm projects (strict node_modules)
+ * - Inconsistent behavior between development and production
+ * - Version conflicts when the hoisted dependency changes
+ */
+export const phantomDependencyDetection = defineCheck({
+    id: '67284374-69b8-4711-9c66-33d2ad44ef79',
+    slug: 'phantom-dependency-detection',
+    scope: { languages: ['typescript'], concerns: ['backend', 'frontend', 'cli'] },
+    // AST-based: needs the real source (string stripping would blank module specifiers).
+    contentFilter: 'raw',
+    confidence: 'medium',
+    description: 'Detect phantom dependencies (used but not declared in package.json)',
+    longDescription: `**Purpose:** Detects packages imported in source code that are not declared in the nearest \`package.json\`, which is critical under pnpm's strict \`node_modules\` isolation.
+
+**Detects:**
+- ES imports (\`import ... from\`), re-exports (\`export ... from\`), \`import x = require()\`, dynamic imports (\`import()\`), and \`require()\` calls referencing external npm packages not listed in \`dependencies\`, \`peerDependencies\`, or \`optionalDependencies\`
+- Shipped source files importing packages only declared in \`devDependencies\` (test files and build/tooling \`*.config.*\` files are exempt — they run only at dev/build time and never ship)
+- Imports are extracted from the TypeScript AST, so import-like text inside string literals, comments, or documentation is never mistaken for a real import; skips Node.js built-ins and workspace packages (detected via \`workspace:*\` protocol)
+
+**Why it matters:** Phantom dependencies cause runtime failures in pnpm projects, create inconsistent behavior between dev and production, and introduce fragile version coupling via hoisting.
+
+**Scope:** General best practice. Cross-file analysis: extracts imports from each file and resolves them against the nearest \`package.json\`.`,
+    timeout: 120_000,
+    tags: ['architecture', 'dependencies', 'pnpm'],
+    fileTypes: ['ts', 'tsx', 'js', 'jsx'],
+    async analyzeAll(files) {
+        const violations = [];
+        // Cache for package.json contents, keyed by resolved package.json path
+        const pkgJsonCache = new Map();
+        // @lazy-ok -- validations inside loop depend on file content from await
+        for (const filePath of files.paths) {
+            try {
+                // @fitness-ignore-next-line performance-anti-patterns -- sequential file reading to control memory; FileAccessor is lazy
+                const content = await files.read(filePath);
+                if (!content)
+                    continue;
+                violations.push(...collectFileViolations(filePath, content, pkgJsonCache));
+            }
+            catch {
+                // @swallow-ok Skip files that can't be read
+                continue;
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=phantom-dependency-detection.js.map

package/dist/checks/architecture/phantom-dependency-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phantom-dependency-detection.js","sourceRoot":"","sources":["../../../src/checks/architecture/phantom-dependency-detection.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,sJAAsJ;AACtJ,yHAAyH;AACzH,kIAAkI;AAClI;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAA0C,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;GAEG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,eAAe;IACf,SAAS;IACT,SAAS;IACT,WAAW;IACX,QAAQ;IACR,OAAO;IACP,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,aAAa;IACb,MAAM;IACN,OAAO;IACP,OAAO;IACP,WAAW;IACX,QAAQ;IACR,KAAK;IACL,IAAI;IACJ,MAAM;IACN,YAAY;IACZ,SAAS;IACT,UAAU;IACV,aAAa;IACb,UAAU;IACV,MAAM;IACN,QAAQ;IACR,iBAAiB;IACjB,gBAAgB;IAChB,KAAK;IACL,QAAQ;IACR,iBAAiB;IACjB,KAAK;IACL,cAAc;IACd,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,gBAAgB;IAChB,MAAM;CACP,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,aAAa;IACb,0BAA0B;IAC1B,0BAA0B;IAC1B,QAAQ;IACR,SAAS;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,2DAA2D,CAAC;AAezF;;;GAGG;AACH,SAAS,kBAAkB,CAAC,eAAuB;IACjD,wBAAwB;IACxB,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6DAA6D;IAC7D,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAE9F,2FAA2F;IAC3F,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+CAA+C;IAC/C,OAAO,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,OAAe;IACvD,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,SAAiB,EAAQ,EAAE;QACtD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEF,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QAC7B,8CAA8C;QAC9C,IACE,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe;YACpB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,EACxC,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,0BAA0B;QAC1B,IACE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;YAClC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC;YAClD,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EACvD,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;YAC7E,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC;YACzF,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,eAAe,IAAI,SAAS,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,yGAAyG;IACzG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAElC,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,CACL,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAC3B,GAAgB,EAChB,WAAmB,EACnB,YAAqB;IAErB,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC7D,CAAC;IACD,+EAA+E;IAC/E,IAAI,YAAY,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IACD,kFAAkF;IAClF,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,wDAAwD;AACxD,SAAS,oBAAoB,CAC3B,KAAsC,EACtC,WAAmB;IAEnB,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QACvC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,GAAoB,EAAE,GAAmB;IACnE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACtE,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,iEAAiE;IACjE,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACvF,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,QAAQ,GAAG,OAAO,KAAK,iBAAiB,CAAC;IAC/C,MAAM,OAAO,GAAG,QAAQ;QACtB,CAAC,CAAC,wBAAwB,WAAW,oCAAoC;QACzE,CAAC,CAAC,wBAAwB,WAAW,4CAA4C,CAAC;IACpF,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,SAAS,WAAW,6CAA6C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;QAC/F,CAAC,CAAC,QAAQ,WAAW,wBAAwB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAE5E,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO;QACP,QAAQ,EAAE,OAAO;QACjB,UAAU;QACV,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,oBAAoB;KAC3B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,qBAAqB,CAC5B,QAAgB,EAChB,OAAe,EACf,KAAsC;IAEtC,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAE5B,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,MAAM,OAAO,GAA2B;QACtC,GAAG,OAAO,CAAC,YAAY;QACvB,GAAG,OAAO,CAAC,eAAe;QAC1B,GAAG,OAAO,CAAC,gBAAgB;QAC3B,GAAG,OAAO,CAAC,oBAAoB;KAChC,CAAC;IACF,MAAM,YAAY,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAErD,MAAM,GAAG,GAAmB,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACtF,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;IACpD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,8BAA8B;IACpC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;IAC9E,qFAAqF;IACrF,aAAa,EAAE,KAAK;IAEpB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,qEAAqE;IAClF,eAAe,EAAE;;;;;;;;;+IAS4H;IAC7I,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;IAErC,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,uEAAuE;QACvE,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAC;QAE3D,wEAAwE;QACxE,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,yHAAyH;gBACzH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC3C,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,UAAU,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;gBAC5C,SAAS;YACX,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/architecture/tsconfig-extends-validation.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview TSConfig extends validation
+ * @module checks-builtin/checks/architecture/tsconfig-extends-validation
+ *
+ * Ensures all tsconfig.json files extend a shared base configuration
+ * and that the referenced base file exists. Prevents config drift
+ * across packages in a monorepo.
+ */
+export declare const tsconfigExtendsValidation: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=tsconfig-extends-validation.d.ts.map

package/dist/checks/architecture/tsconfig-extends-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tsconfig-extends-validation.d.ts","sourceRoot":"","sources":["../../../src/checks/architecture/tsconfig-extends-validation.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAOH,eAAO,MAAM,yBAAyB,sCA2EpC,CAAC"}

package/dist/checks/architecture/tsconfig-extends-validation.js

@@ -0,0 +1,78 @@
+// @fitness-ignore-file batch-operation-limits -- iterates bounded collection (workspace tsconfig files matched by glob; small N per repo)
+// @fitness-ignore-file performance-anti-patterns -- sequential file reads keep memory bounded across tsconfig chains
+/**
+ * @fileoverview TSConfig extends validation
+ * @module checks-builtin/checks/architecture/tsconfig-extends-validation
+ *
+ * Ensures all tsconfig.json files extend a shared base configuration
+ * and that the referenced base file exists. Prevents config drift
+ * across packages in a monorepo.
+ */
+import { existsSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { defineCheck } from '@opensip-cli/fitness';
+export const tsconfigExtendsValidation = defineCheck({
+    id: '842e7d00-c8e8-4a57-873a-c03caec7e603',
+    slug: 'tsconfig-extends-validation',
+    scope: { languages: ['typescript'], concerns: ['backend', 'frontend', 'cli'] },
+    confidence: 'high',
+    description: 'Ensures all tsconfig.json files extend a shared base and the base file exists',
+    tags: ['architecture', 'typescript', 'monorepo'],
+    async analyzeAll(files) {
+        const violations = [];
+        const tsconfigPaths = files.paths.filter((p) => p.endsWith('tsconfig.json') && !p.includes('node_modules'));
+        for (const filePath of tsconfigPaths) {
+            const content = await files.read(filePath);
+            /* v8 ignore next -- defensive guard */
+            if (!content)
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(content);
+            }
+            catch {
+                violations.push({
+                    filePath,
+                    line: 1,
+                    message: 'Invalid JSON in tsconfig.json',
+                    severity: 'error',
+                    type: 'TSCONFIG_INVALID_JSON',
+                });
+                continue;
+            }
+            // Root tsconfig doesn't need to extend
+            if (filePath === 'tsconfig.json' ||
+                (filePath.endsWith('/tsconfig.json') && filePath.split('/').length === 2)) {
+                continue;
+            }
+            const extendsValue = parsed.extends;
+            if (!extendsValue || typeof extendsValue !== 'string') {
+                violations.push({
+                    filePath,
+                    line: 1,
+                    message: 'tsconfig.json does not extend a base configuration. Add "extends" to ensure consistent compiler options.',
+                    severity: 'warning',
+                    suggestion: 'Add "extends": "../../tsconfig.json" (or appropriate relative path to the root tsconfig).',
+                    type: 'TSCONFIG_NO_EXTENDS',
+                });
+                continue;
+            }
+            // Verify the extended file exists
+            const dir = dirname(filePath);
+            const resolvedBase = resolve(process.cwd(), dir, extendsValue);
+            const baseWithJson = resolvedBase.endsWith('.json') ? resolvedBase : `${resolvedBase}.json`;
+            if (!existsSync(resolvedBase) && !existsSync(baseWithJson)) {
+                violations.push({
+                    filePath,
+                    line: 1,
+                    message: `tsconfig.json extends "${extendsValue}" but the file does not exist at ${resolvedBase}`,
+                    severity: 'error',
+                    suggestion: 'Fix the "extends" path or create the missing base tsconfig.',
+                    type: 'TSCONFIG_MISSING_BASE',
+                });
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=tsconfig-extends-validation.js.map

package/dist/checks/architecture/tsconfig-extends-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tsconfig-extends-validation.js","sourceRoot":"","sources":["../../../src/checks/architecture/tsconfig-extends-validation.ts"],"names":[],"mappings":"AAAA,0IAA0I;AAC1I,qHAAqH;AACrH;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,WAAW,EAA0C,MAAM,sBAAsB,CAAC;AAE3F,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC;IACnD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,6BAA6B;IACnC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;IAC9E,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,+EAA+E;IAC5F,IAAI,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC;IAEhD,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,MAAM,UAAU,GAAqB,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAClE,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,uCAAuC;YACvC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,MAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,CAAC,IAAI,CAAC;oBACd,QAAQ;oBACR,IAAI,EAAE,CAAC;oBACP,OAAO,EAAE,+BAA+B;oBACxC,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,uBAAuB;iBAC9B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,uCAAuC;YACvC,IACE,QAAQ,KAAK,eAAe;gBAC5B,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EACzE,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC;YACpC,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACtD,UAAU,CAAC,IAAI,CAAC;oBACd,QAAQ;oBACR,IAAI,EAAE,CAAC;oBACP,OAAO,EACL,0GAA0G;oBAC5G,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,2FAA2F;oBAC7F,IAAI,EAAE,qBAAqB;iBAC5B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,kCAAkC;YAClC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;YAC/D,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,CAAC;YAE5F,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3D,UAAU,CAAC,IAAI,CAAC;oBACd,QAAQ;oBACR,IAAI,EAAE,CAAC;oBACP,OAAO,EAAE,0BAA0B,YAAY,oCAAoC,YAAY,EAAE;oBACjG,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,6DAA6D;oBACzE,IAAI,EAAE,uBAAuB;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/index.d.ts

@@ -0,0 +1,6 @@
+export * from './architecture/index.js';
+export * from './quality/index.js';
+export * from './resilience/index.js';
+export * from './security/index.js';
+export * from './testing/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/checks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/checks/index.js

@@ -0,0 +1,6 @@
+export * from './architecture/index.js';
+export * from './quality/index.js';
+export * from './resilience/index.js';
+export * from './security/index.js';
+export * from './testing/index.js';
+//# sourceMappingURL=index.js.map

package/dist/checks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/checks/quality/api/api-contract-validation.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @fileoverview API Contract Validation Check
+ *
+ * Ensures API handlers have proper validation, typed responses, and error handling.
+ * Validates that request/response contracts are enforced through types and schemas.
+ */
+/**
+ * Check: quality/api-contract-validation
+ *
+ * Validates that API handlers have proper validation, typed responses,
+ * and error handling for type safety and reliability.
+ *
+ */
+export declare const apiContractValidation: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=api-contract-validation.d.ts.map

package/dist/checks/quality/api/api-contract-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-contract-validation.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/api/api-contract-validation.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAsTH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,sCAoChC,CAAC"}