@opensip-cli/checks-typescript 0.1.0

package/dist/checks/quality/api/api-contract-validation.js

@@ -0,0 +1,316 @@
+// @fitness-ignore-file correlation-id-coverage -- Fitness check implementation, not an API handler
+// @fitness-ignore-file duplicate-utility-functions -- Check-specific helpers (getFunctionName, isHandlerFunction) use check-local types; extracting would couple independent checks
+/**
+ * @fileoverview API Contract Validation Check
+ *
+ * Ensures API handlers have proper validation, typed responses, and error handling.
+ * Validates that request/response contracts are enforced through types and schemas.
+ */
+import { defineCheck, isAPIFile } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/**
+ * Validation detection patterns
+ */
+const VALIDATION_METHOD_NAMES = new Set([
+    'parse',
+    'safeParse',
+    'validate',
+    'validateRequest',
+    'validateBody',
+    'validateParams',
+    'validateQuery',
+]);
+/**
+ * Handler name patterns
+ */
+const HANDLER_NAME_PATTERNS = [/handler$/i, /^handle[A-Z]/, /^process[A-Z]/];
+/**
+ * Names that match HANDLER_NAME_PATTERNS but are themselves error
+ * translators / classifiers — they're called from inside a catch block,
+ * so requiring try-catch around their body is error-handling-inception.
+ * Match: handleXxxError, handleStoreError, processError.
+ */
+const ERROR_HANDLER_NAME_PATTERNS = [/^handle[A-Z].*Error$/, /^process[A-Z].*Error$/];
+/**
+ * Get function name from node
+ * @returns {string} The function name or '<anonymous>' if not found
+ */
+function getFunctionName(node) {
+    if (ts.isFunctionDeclaration(node) && node.name) {
+        return node.name.text;
+    }
+    if (ts.isMethodDeclaration(node) && ts.isIdentifier(node.name)) {
+        return node.name.text;
+    }
+    // Combined condition for arrow function with variable declaration
+    if (ts.isArrowFunction(node) &&
+        ts.isVariableDeclaration(node.parent) &&
+        ts.isIdentifier(node.parent.name)) {
+        return node.parent.name.text;
+    }
+    return '<anonymous>';
+}
+/**
+ * Check if function has Express handler signature
+ * @returns {boolean} True if the function has Express handler signature (req, res)
+ */
+function getParamIdentifierName(p) {
+    /* v8 ignore next -- defensive AST/type guard */
+    return p && ts.isIdentifier(p.name) ? p.name.text : '';
+}
+function hasExpressHandlerSignature(node) {
+    const params = node.parameters;
+    if (params.length < 2)
+        return false;
+    const param1 = getParamIdentifierName(params[0]);
+    const param2 = getParamIdentifierName(params[1]);
+    return (param1 === 'req' || param1 === 'request') && (param2 === 'res' || param2 === 'response');
+}
+/**
+ * Check if function name suggests it's a handler
+ * @returns {boolean} True if the function appears to be a handler
+ */
+function isHandlerFunction(name, filePath, node) {
+    /* v8 ignore next -- defensive AST/type guard */
+    if (!isAPIFile(filePath))
+        return false;
+    // Check if exported
+    let isExported = false;
+    if (ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)) {
+        isExported = node.modifiers?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword) ?? false;
+    }
+    else if (ts.isArrowFunction(node) && ts.isVariableDeclaration(node.parent)) {
+        const varStatement = node.parent.parent.parent;
+        if (ts.isVariableStatement(varStatement)) {
+            isExported =
+                varStatement.modifiers?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword) ?? false;
+        }
+    }
+    else {
+        // Other node types remain isExported = false (initial value)
+    }
+    if (!isExported)
+        return false;
+    return HANDLER_NAME_PATTERNS.some((pattern) => pattern.test(name));
+}
+/**
+ * Check if function should be skipped
+ * @returns {boolean} True if the function should be skipped in validation
+ */
+function shouldSkipFunction(node, functionName, filePath) {
+    if (ts.isMethodDeclaration(node)) {
+        const isPrivate = node.modifiers?.some((m) => m.kind === ts.SyntaxKind.PrivateKeyword);
+        /* v8 ignore next -- defensive AST/type guard */
+        if (isPrivate)
+            return true;
+    }
+    const isExpressHandler = hasExpressHandlerSignature(node);
+    if (functionName === '<anonymous>' && isExpressHandler)
+        return true;
+    if (!isExpressHandler && !isHandlerFunction(functionName, filePath, node))
+        return true;
+    return false;
+}
+/**
+ * Check if function has request parameter
+ * @returns {boolean} True if the function has a request parameter
+ */
+function hasRequestParameter(node) {
+    return node.parameters.some((param) => {
+        /* v8 ignore next -- defensive AST/type guard */
+        if (!ts.isIdentifier(param.name))
+            return false;
+        const name = param.name.text;
+        /* v8 ignore next -- defensive AST/type guard */
+        return name === 'req' || name === 'request' || name.includes('Request');
+    });
+}
+/**
+ * Check if a call expression is a validation method call
+ */
+function isValidationMethodCall(n) {
+    if (ts.isPropertyAccessExpression(n.expression)) {
+        return VALIDATION_METHOD_NAMES.has(n.expression.name.text);
+    }
+    if (ts.isIdentifier(n.expression)) {
+        return n.expression.text.toLowerCase().includes('validate');
+    }
+    return false;
+}
+/**
+ * Check if function has validation logic
+ * @returns {boolean} True if the function has validation logic
+ */
+function hasRequestValidation(node) {
+    let hasValidation = false;
+    const visit = (n) => {
+        if (ts.isCallExpression(n) && isValidationMethodCall(n)) {
+            hasValidation = true;
+        }
+        if (!hasValidation)
+            ts.forEachChild(n, visit);
+    };
+    if (node.body)
+        visit(node.body);
+    return hasValidation;
+}
+/**
+ * Check if function has try-catch block
+ * @returns {boolean} True if the function has a try-catch block
+ */
+function hasTryCatchBlock(node) {
+    let hasTryCatch = false;
+    const visit = (n) => {
+        if (ts.isTryStatement(n))
+            hasTryCatch = true;
+        if (!hasTryCatch)
+            ts.forEachChild(n, visit);
+    };
+    visit(node);
+    return hasTryCatch;
+}
+/**
+ * Check if function has untyped parameters
+ * @returns {boolean} True if the function has any untyped parameters
+ */
+function hasUntypedParameters(node) {
+    return node.parameters.some((param) => !param.type);
+}
+/**
+ * Check if function has proper API contract
+ * @param {CheckFunctionContractOptions} options - The contract check options
+ * @returns {CheckViolation[]} Array of contract violations found
+ */
+function checkFunctionContract(options) {
+    const { absolutePath, sourceFile, node } = options;
+    const violations = [];
+    const functionName = getFunctionName(node);
+    if (shouldSkipFunction(node, functionName, absolutePath)) {
+        return violations;
+    }
+    const { line: lineIdx, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    const line = lineIdx + 1;
+    const functionSignature = node.getText(sourceFile).split('{')[0]?.trim().slice(0, 100) ?? functionName;
+    // Check 1: Has explicit return type
+    if (!node.type) {
+        violations.push({
+            line,
+            column: character + 1,
+            message: `Handler '${functionName}' missing explicit return type`,
+            severity: 'error',
+            suggestion: `Add explicit return type to '${functionName}', e.g., ': Promise<ServiceResult<T>>' or ': Promise<Response<T>>'`,
+            type: 'missing-response-type',
+            match: functionSignature,
+        });
+    }
+    // Check 2: Has typed parameters
+    if (hasUntypedParameters(node)) {
+        violations.push({
+            line,
+            column: character + 1,
+            message: `Handler '${functionName}' has untyped parameters`,
+            severity: 'error',
+            suggestion: `Add explicit TypeScript types to all parameters in '${functionName}' for type safety`,
+            type: 'untyped-parameters',
+            match: functionSignature,
+        });
+    }
+    // Check 3: Has validation for request parameters
+    if (!hasRequestValidation(node) && hasRequestParameter(node)) {
+        violations.push({
+            line,
+            column: character + 1,
+            message: `Handler '${functionName}' accepts request but has no validation`,
+            severity: 'error',
+            suggestion: `Add Zod schema validation using .parse() or .safeParse() for request body/params in '${functionName}'`,
+            type: 'missing-validation',
+            match: functionSignature,
+        });
+    }
+    // Check 4: Has try-catch for error handling
+    // Skip functions that ARE error handlers (handleXxxError) — wrapping
+    // them in another try-catch is error-handling-inception.
+    const isErrorHandler = ERROR_HANDLER_NAME_PATTERNS.some((p) => p.test(functionName));
+    if (!isErrorHandler && !hasTryCatchBlock(node)) {
+        violations.push({
+            line,
+            column: character + 1,
+            message: `Handler '${functionName}' missing try-catch error handling`,
+            severity: 'warning',
+            suggestion: `Wrap the body of '${functionName}' in try-catch to handle errors gracefully and return appropriate error responses`,
+            type: 'missing-error-handling',
+            match: functionSignature,
+        });
+    }
+    return violations;
+}
+/**
+ * Analyze a file for API contract violations
+ * @returns {CheckViolation[]} Array of violations found in the file
+ */
+function analyzeFile(absolutePath, content) {
+    const violations = [];
+    const sourceFile = getSharedSourceFile(absolutePath, content);
+    /* v8 ignore next -- defensive guard */
+    if (!sourceFile)
+        return [];
+    const visit = (node) => {
+        if (ts.isFunctionDeclaration(node) ||
+            ts.isArrowFunction(node) ||
+            ts.isMethodDeclaration(node)) {
+            const nodeViolations = checkFunctionContract({
+                absolutePath,
+                sourceFile,
+                node,
+            });
+            violations.push(...nodeViolations);
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return violations;
+}
+/**
+ * Check: quality/api-contract-validation
+ *
+ * Validates that API handlers have proper validation, typed responses,
+ * and error handling for type safety and reliability.
+ *
+ */
+export const apiContractValidation = defineCheck({
+    id: 'ef307717-de39-41d3-8344-0e6f7562367a',
+    slug: 'api-contract-validation',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'high',
+    description: 'Validate API handlers have proper validation, typed responses, and error handling',
+    longDescription: `**Purpose:** Enforces that API handler functions have proper type contracts, input validation, and error handling.
+
+**Detects:**
+- Handlers (matching \`/handler$/i\`, \`/^handle[A-Z]/\`, \`/^process[A-Z]/\`) missing explicit return types
+- Handler parameters without TypeScript type annotations
+- Handlers accepting \`req\`/\`request\` params without calling \`parse\`, \`safeParse\`, \`validate\`, or similar validation methods
+- Handler bodies missing try-catch error handling
+
+**Why it matters:** Untyped or unvalidated API handlers allow malformed requests through and produce unpredictable error responses.
+
+**Scope:** General best practice. Analyzes each file individually using TypeScript AST parsing. Only processes files identified as API files by \`isAPIFile()\`.`,
+    tags: ['quality', 'api', 'type-safety', 'validation'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        // Only analyze API files
+        if (!isAPIFile(filePath)) {
+            return [];
+        }
+        try {
+            return analyzeFile(filePath, content);
+            /* v8 ignore next 1 -- defensive catch: parse failures already handled */
+        }
+        catch {
+            // @swallow-ok Skip files that fail to parse
+            return [];
+        }
+    },
+});
+//# sourceMappingURL=api-contract-validation.js.map

package/dist/checks/quality/api/api-contract-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-contract-validation.js","sourceRoot":"","sources":["../../../../src/checks/quality/api/api-contract-validation.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,oLAAoL;AACpL;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAuB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;GAEG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,OAAO;IACP,WAAW;IACX,UAAU;IACV,iBAAiB;IACjB,cAAc;IACd,gBAAgB;IAChB,eAAe;CAChB,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;AAgBtF;;;GAGG;AACH,SAAS,eAAe,CAAC,IAAsB;IAC7C,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,kEAAkE;IAClE,IACE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;QACxB,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QACrC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EACjC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAC/B,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,CAAsC;IACpE,gDAAgD;IAChD,OAAO,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAsB;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjD,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,UAAU,CAAC,CAAC;AACnG,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB,EAAE,IAAsB;IAC/E,gDAAgD;IAChD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,oBAAoB;IACpB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC;IAC5F,CAAC;SAAM,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7E,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/C,IAAI,EAAE,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,UAAU;gBACR,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC;QACzF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,6DAA6D;IAC/D,CAAC;IAED,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,IAAsB,EACtB,YAAoB,EACpB,QAAgB;IAEhB,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACvF,gDAAgD;QAChD,IAAI,SAAS;YAAE,OAAO,IAAI,CAAC;IAC7B,CAAC;IAED,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,YAAY,KAAK,aAAa,IAAI,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC,gBAAgB,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,IAAsB;IACjD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACpC,gDAAgD;QAChD,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7B,gDAAgD;QAChD,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,CAAoB;IAClD,IAAI,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,IAAsB;IAClD,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE;QAC3B,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,aAAa;YAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAsB;IAC9C,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE;QAC3B,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;YAAE,WAAW,GAAG,IAAI,CAAC;QAC7C,IAAI,CAAC,WAAW;YAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,IAAsB;IAClD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,OAAqC;IAClE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACnD,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAE3C,IAAI,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QACzD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC;IACzB,MAAM,iBAAiB,GACrB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC;IAE/E,oCAAoC;IACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,MAAM,EAAE,SAAS,GAAG,CAAC;YACrB,OAAO,EAAE,YAAY,YAAY,gCAAgC;YACjE,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,gCAAgC,YAAY,oEAAoE;YAC5H,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,MAAM,EAAE,SAAS,GAAG,CAAC;YACrB,OAAO,EAAE,YAAY,YAAY,0BAA0B;YAC3D,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,uDAAuD,YAAY,mBAAmB;YAClG,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,MAAM,EAAE,SAAS,GAAG,CAAC;YACrB,OAAO,EAAE,YAAY,YAAY,yCAAyC;YAC1E,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,wFAAwF,YAAY,GAAG;YACnH,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,qEAAqE;IACrE,yDAAyD;IACzD,MAAM,cAAc,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,MAAM,EAAE,SAAS,GAAG,CAAC;YACrB,OAAO,EAAE,YAAY,YAAY,oCAAoC;YACrE,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,qBAAqB,YAAY,mFAAmF;YAChI,IAAI,EAAE,wBAAwB;YAC9B,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,YAAoB,EAAE,OAAe;IACxD,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9D,uCAAuC;IACvC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAE;QAC9B,IACE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;YAC9B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;YACxB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAC5B,CAAC;YACD,MAAM,cAAc,GAAG,qBAAqB,CAAC;gBAC3C,YAAY;gBACZ,UAAU;gBACV,IAAI;aACL,CAAC,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QACrC,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,UAAU,CAAC,CAAC;IAClB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,mFAAmF;IAChG,eAAe,EAAE;;;;;;;;;;iKAU8I;IAC/J,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,CAAC;IACrD,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAO,EAAE,QAAQ;QACvB,yBAAyB;QACzB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtC,yEAAyE;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;YAC5C,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/quality/api/api-response-validation.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @fileoverview API Response Validation Check
+ *
+ * Ensures API responses are validated with Zod schemas before being sent to clients.
+ * Validates that response types match their Zod schema definitions.
+ */
+/**
+ * Check: quality/api-response-validation
+ *
+ * Ensures API responses are validated with Zod schemas.
+ *
+ */
+export declare const apiResponseValidation: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=api-response-validation.d.ts.map

package/dist/checks/quality/api/api-response-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-response-validation.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/api/api-response-validation.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAoMH;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,sCAsChC,CAAC"}

package/dist/checks/quality/api/api-response-validation.js

@@ -0,0 +1,209 @@
+// @fitness-ignore-file correlation-id-coverage -- Fitness check implementation, not an API handler
+// @fitness-ignore-file duplicate-implementation-detection -- similar patterns across diagnostic modules
+// @fitness-ignore-file no-raw-regex-on-code -- fitness check: regex patterns analyze trusted codebase content, not user input
+/**
+ * @fileoverview API Response Validation Check
+ *
+ * Ensures API responses are validated with Zod schemas before being sent to clients.
+ * Validates that response types match their Zod schema definitions.
+ */
+import { basename } from 'node:path';
+import { defineCheck, isAPIFile } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/**
+ * Check if a file contains Fastify route-level response schema definitions.
+ * Routes using `schema: { response: ... }` already validate responses at the framework level.
+ *
+ * The previous regex `\{[^}]*response\s*:` failed on real route schemas
+ * because real schemas contain nested object literals — once the regex
+ * hits the first `}` (e.g. closing a `querystring` block) it gives up
+ * before reaching `response:`. The lazy `.*?` form scans across nested
+ * braces correctly. We also accept the related forms a Zod-typed Fastify
+ * route uses: bare `response: {` blocks, response-status-keyed objects,
+ * and ResponseSchema imports paired with .send.
+ */
+function hasRouteResponseSchema(content) {
+    // schema: { ... response: ... } — handles nested braces via lazy match.
+    if (/schema\s*:\s*\{.*?\bresponse\s*:/s.test(content))
+        return true;
+    // Direct `response: { 200: ... }` block — Fastify also accepts this
+    // shape outside an enclosing `schema:` wrapper inside `RouteOptions`.
+    if (/\bresponse\s*:\s*\{\s*[12345]\d{2}\s*:/s.test(content))
+        return true;
+    return false;
+}
+/**
+ * Check if a file only uses `reply.send()` with dynamic/passthrough payloads.
+ * These routes forward external API responses or computed results that have no fixed shape.
+ */
+function isDynamicReplyOnly(content) {
+    // If file has reply.send() but no reply.status().send({ ... }) with object literals,
+    // it's likely a passthrough/dynamic endpoint
+    const hasSendCalls = content.includes('reply.send(') || content.includes('reply.send (');
+    if (!hasSendCalls)
+        return false;
+    // If there's a reply.code/status + structured object, it likely has a fixed shape
+    const hasStructuredResponse = /reply\s*\.\s*(?:code|status)\s*\([^)]+\)\s*\.\s*send\s*\(\s*\{/.test(content);
+    // If there's no structured response pattern, treat as dynamic
+    return !hasStructuredResponse;
+}
+/**
+ * Check if an import declaration imports schema/contracts
+ */
+function checkSchemaImport(node, state) {
+    const moduleSpecifier = node.moduleSpecifier;
+    if (ts.isStringLiteral(moduleSpecifier)) {
+        const importPath = moduleSpecifier.text;
+        if (importPath.includes('schema') || importPath.includes('contracts')) {
+            state.hasResponseSchemaImport = true;
+        }
+    }
+}
+/**
+ * Check if a call expression validates a response
+ */
+function checkValidationCall(node, sourceFile, state) {
+    const callText = node.expression.getText(sourceFile);
+    if (!callText.includes('parse') && !callText.includes('safeParse')) {
+        return;
+    }
+    /* v8 ignore next -- defensive nullish fallback */
+    const argText = node.arguments[0]?.getText(sourceFile) ?? '';
+    if (argText.includes('response') || argText.includes('result') || argText.includes('data')) {
+        state.hasResponseValidation = true;
+    }
+}
+/**
+ * Check if a return statement returns an API response
+ */
+function checkApiResponseReturn(node, sourceFile, state) {
+    /* v8 ignore next -- defensive AST/type guard */
+    if (!node.expression)
+        return;
+    const returnText = node.expression.getText(sourceFile);
+    if (returnText.includes('res.') ||
+        returnText.includes('reply.') ||
+        returnText.includes('response.')) {
+        state.hasApiResponse = true;
+    }
+}
+/**
+ * Check if a file is an SSE/streaming endpoint.
+ * These routes use raw writes or event-stream content types, not structured JSON responses.
+ */
+function isStreamingFile(content) {
+    return content.includes('text/event-stream') || content.includes('reply.raw.write');
+}
+/**
+ * Check if a file serves diagnostic, debug, or health endpoints.
+ * These routes intentionally return dynamic/unstructured payloads.
+ */
+function isDiagnosticFile(filePath) {
+    const lowerPath = filePath.toLowerCase();
+    return (lowerPath.includes('diagnostic') || lowerPath.includes('debug') || lowerPath.includes('health'));
+}
+/**
+ * @returns {*}
+ * Analyze a file for response validation issues
+ */
+function analyzeFile(absolutePath, content) {
+    const violations = [];
+    // Skip SSE/streaming routes — they don't return structured JSON
+    /* v8 ignore next -- defensive AST/type guard */
+    if (isStreamingFile(content))
+        return [];
+    // Skip diagnostic/debug/health endpoints — intentionally dynamic responses
+    /* v8 ignore next -- defensive AST/type guard */
+    if (isDiagnosticFile(absolutePath))
+        return [];
+    // Skip routes that define response schemas at the Fastify route level
+    /* v8 ignore next -- defensive AST/type guard */
+    if (hasRouteResponseSchema(content))
+        return [];
+    // Skip routes that only use reply.send() with dynamic/passthrough payloads
+    if (isDynamicReplyOnly(content))
+        return [];
+    const sourceFile = getSharedSourceFile(absolutePath, content);
+    /* v8 ignore next -- defensive guard */
+    if (!sourceFile)
+        return [];
+    // Track if file has response schema imports
+    // Use state object to track findings across callback invocations
+    // (TypeScript can't track primitive mutations in callbacks)
+    const state = {
+        hasResponseSchemaImport: false,
+        hasResponseValidation: false,
+        hasApiResponse: false,
+    };
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node)) {
+            checkSchemaImport(node, state);
+        }
+        if (ts.isCallExpression(node)) {
+            checkValidationCall(node, sourceFile, state);
+        }
+        if (ts.isReturnStatement(node)) {
+            checkApiResponseReturn(node, sourceFile, state);
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    // If file has API responses but no validation, flag it
+    if (state.hasApiResponse && !state.hasResponseValidation && !state.hasResponseSchemaImport) {
+        violations.push({
+            line: 1,
+            column: 0,
+            message: 'API file sends responses without schema validation',
+            severity: 'warning',
+            suggestion: 'Import a Zod response schema from shared contract schemas and use .parse() or .safeParse() to validate API responses before sending to clients',
+            type: 'missing-response-validation',
+            match: basename(absolutePath),
+        });
+    }
+    return violations;
+}
+/**
+ * Check: quality/api-response-validation
+ *
+ * Ensures API responses are validated with Zod schemas.
+ *
+ */
+export const apiResponseValidation = defineCheck({
+    id: '8822fd30-bcd5-48d5-80d6-2f3abdec7f70',
+    slug: 'api-response-validation',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    confidence: 'high',
+    description: 'Ensure API responses are validated with Zod schemas',
+    longDescription: `**Purpose:** Ensures API files validate outbound responses with Zod schemas before sending them to clients.
+
+**Detects:**
+- Files that return API responses (via \`res.\`, \`reply.\`, or \`response.\`) but lack both a schema/contracts import and any \`parse\`/\`safeParse\` call on response/result/data arguments
+
+**Skips:**
+- SSE/streaming endpoints (files using \`text/event-stream\` or \`reply.raw.write\`)
+- Diagnostic, debug, and health endpoints (path-based detection)
+- Routes with Fastify-level response schemas (\`schema: { response: ... }\`)
+- Routes that only use \`reply.send()\` with dynamic/passthrough payloads
+
+**Why it matters:** Without response validation, API endpoints can silently send malformed or extra data to clients, breaking contracts and leaking internal fields.
+
+**Scope:** General best practice. Analyzes each file individually using TypeScript AST parsing. Only processes files identified as API files by \`isAPIFile()\`.`,
+    tags: ['quality', 'api', 'validation', 'zod'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        // Only analyze API files
+        if (!isAPIFile(filePath)) {
+            return [];
+        }
+        try {
+            return analyzeFile(filePath, content);
+            /* v8 ignore next 1 -- defensive catch: parse failures already handled */
+        }
+        catch {
+            // @swallow-ok Skip files that fail to parse
+            return [];
+        }
+    },
+});
+//# sourceMappingURL=api-response-validation.js.map

package/dist/checks/quality/api/api-response-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-response-validation.js","sourceRoot":"","sources":["../../../../src/checks/quality/api/api-response-validation.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,wGAAwG;AACxG,8HAA8H;AAC9H;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,WAAW,EAAuB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,wEAAwE;IACxE,IAAI,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,qFAAqF;IACrF,6CAA6C;IAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzF,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,kFAAkF;IAClF,MAAM,qBAAqB,GACzB,gEAAgE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjF,8DAA8D;IAC9D,OAAO,CAAC,qBAAqB,CAAC;AAChC,CAAC;AAWD;;GAEG;AACH,SAAS,iBAAiB,CAAC,IAA0B,EAAE,KAAuB;IAC5E,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;IAC7C,IAAI,EAAE,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC;QACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtE,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACvC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,IAAuB,EACvB,UAAyB,EACzB,KAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,OAAO;IACT,CAAC;IAED,kDAAkD;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3F,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAC7B,IAAwB,EACxB,UAAyB,EACzB,KAAuB;IAEvB,gDAAgD;IAChD,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO;IAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvD,IACE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAChC,CAAC;QACD,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzC,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAChG,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,YAAoB,EAAE,OAAe;IACxD,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,gEAAgE;IAChE,gDAAgD;IAChD,IAAI,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,gBAAgB,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IAE9C,sEAAsE;IACtE,gDAAgD;IAChD,IAAI,sBAAsB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/C,2EAA2E;IAC3E,IAAI,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,MAAM,UAAU,GAAG,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9D,uCAAuC;IACvC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,4CAA4C;IAC5C,iEAAiE;IACjE,4DAA4D;IAC5D,MAAM,KAAK,GAAqB;QAC9B,uBAAuB,EAAE,KAAK;QAC9B,qBAAqB,EAAE,KAAK;QAC5B,cAAc,EAAE,KAAK;KACtB,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAE;QAC9B,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,mBAAmB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,UAAU,CAAC,CAAC;IAElB,uDAAuD;IACvD,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC;QAC3F,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,oDAAoD;YAC7D,QAAQ,EAAE,SAAS;YACnB,UAAU,EACR,gJAAgJ;YAClJ,IAAI,EAAE,6BAA6B;YACnC,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IAErE,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,qDAAqD;IAClE,eAAe,EAAE;;;;;;;;;;;;;iKAa8I;IAC/J,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC;IAC7C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAO,EAAE,QAAQ;QACvB,yBAAyB;QACzB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtC,yEAAyE;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;YAC5C,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/quality/api/fastify-route-validation.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @fileoverview Fastify Route Validation Check
+ *
+ * Ensures all Fastify POST/PATCH/PUT route handlers validate request bodies
+ * using Zod schemas.
+ */
+/**
+ * Check: quality/fastify-route-validation
+ *
+ * Ensures all Fastify POST/PATCH/PUT route handlers validate request bodies
+ * with Zod schemas.
+ */
+export declare const fastifyRouteValidation: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=fastify-route-validation.d.ts.map

package/dist/checks/quality/api/fastify-route-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify-route-validation.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/api/fastify-route-validation.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAkTH;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,sCAwCjC,CAAC"}