@opensip-cli/checks-typescript 0.1.0

package/dist/checks/quality/api/fastify-route-validation.js

@@ -0,0 +1,298 @@
+// @fitness-ignore-file correlation-id-coverage -- Fitness check implementation, not an API handler
+// @fitness-ignore-file fastify-schema-coverage -- schema definitions to be added in schema coverage sprint
+// @fitness-ignore-file duplicate-utility-functions -- reviewed: route-analysis and validation-detection helpers are check-specific logic, not general-purpose utilities
+/**
+ * @fileoverview Fastify Route Validation Check
+ *
+ * Ensures all Fastify POST/PATCH/PUT route handlers validate request bodies
+ * using Zod schemas.
+ */
+import { defineCheck, isTestFile } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/**
+ * Quick filter regex to check if file might contain Fastify routes
+ */
+const QUICK_FILTER_PATTERNS = /fastify\.(post|patch|put)|\.post\(|\.patch\(|\.put\(/i;
+/**
+ * Patterns that indicate Zod validation is present
+ */
+const ZOD_VALIDATION_PATTERNS = [
+    /\.parse\s*\(/,
+    /\.safeParse\s*\(/,
+    /Schema\.parse/,
+    /Schema\.safeParse/,
+    /z\.\w+\(\)/,
+];
+/**
+ * Patterns that indicate other validation libraries are present
+ */
+const OTHER_VALIDATION_PATTERNS = [
+    /\.validate\s*\(/,
+    /validateBody\s*\(/,
+    /validateRequest\s*\(/,
+    /validateInput\s*\(/,
+];
+/**
+ * Extract route information from a call expression
+ * @param node - TypeScript CallExpression node to extract from
+ * @param sourceFile - TypeScript SourceFile for position information
+ * @returns RouteInfo object if this is a route call, null otherwise
+ */
+// eslint-disable-next-line sonarjs/cognitive-complexity -- AST traversal with multiple node-type checks and nested property extraction
+function extractRouteInfo(node, sourceFile) {
+    if (!ts.isPropertyAccessExpression(node.expression)) {
+        return null;
+    }
+    const methodName = node.expression.name.text.toLowerCase();
+    if (!['post', 'patch', 'put'].includes(methodName)) {
+        return null;
+    }
+    const method = methodName.toUpperCase();
+    const args = node.arguments;
+    if (args.length < 2) {
+        return null;
+    }
+    let routePath = 'unknown';
+    const firstArg = args[0];
+    if (firstArg && ts.isStringLiteral(firstArg)) {
+        routePath = firstArg.text;
+    }
+    let handlerNode = null;
+    let hasSchemaOption = false;
+    const secondArg = args[1];
+    if (secondArg) {
+        if (ts.isArrowFunction(secondArg) || ts.isFunctionExpression(secondArg)) {
+            handlerNode = secondArg;
+        }
+        else if (ts.isObjectLiteralExpression(secondArg)) {
+            // Check for schema: { body: ... } in the options object (fastify-type-provider-zod pattern)
+            hasSchemaOption = secondArg.properties.some((prop) => {
+                /* v8 ignore next -- defensive AST/type guard */
+                if (!ts.isPropertyAssignment(prop))
+                    return false;
+                const name = prop.name;
+                /* v8 ignore next -- defensive AST/type guard */
+                if (!ts.isIdentifier(name) || name.text !== 'schema')
+                    return false;
+                // Check if the schema object has a 'body' property
+                if (ts.isObjectLiteralExpression(prop.initializer)) {
+                    return prop.initializer.properties.some((schemaProp) => ts.isPropertyAssignment(schemaProp) &&
+                        ts.isIdentifier(schemaProp.name) &&
+                        schemaProp.name.text === 'body');
+                }
+                return false;
+            });
+            if (args[2]) {
+                const thirdArg = args[2];
+                /* v8 ignore next -- defensive AST/type guard */
+                if (ts.isArrowFunction(thirdArg) || ts.isFunctionExpression(thirdArg)) {
+                    handlerNode = thirdArg;
+                }
+            }
+        }
+        else {
+            // Other argument types - handler not found
+        }
+    }
+    const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    return {
+        method,
+        path: routePath,
+        line: line + 1,
+        handlerNode,
+        hasSchemaOption,
+    };
+}
+/**
+ * Check if text matches any validation pattern
+ * @param text - Text to check against patterns
+ * @param patterns - Array of patterns to test
+ * @returns true if any pattern matches
+ */
+function matchesAnyPattern(text, patterns) {
+    return patterns.some((pattern) => pattern.test(text));
+}
+/**
+ * Check if handler has validation after request.body access
+ * @param handlerText - Handler text to analyze
+ * @returns true if validation found after body access
+ */
+function hasValidationAfterBodyAccess(handlerText) {
+    if (!handlerText.includes('request.body')) {
+        return false;
+    }
+    const bodyAccessIndex = handlerText.indexOf('request.body');
+    const afterBodyAccess = handlerText.slice(bodyAccessIndex);
+    const allPatterns = [...ZOD_VALIDATION_PATTERNS, ...OTHER_VALIDATION_PATTERNS];
+    if (matchesAnyPattern(afterBodyAccess, allPatterns)) {
+        return true;
+    }
+    // Check for manual validation with if statement - simple non-backtracking check
+    return afterBodyAccess.includes('if') && afterBodyAccess.includes('!');
+}
+/**
+ * Check if handler has 400 status response with validation message
+ * @param handlerText - Handler text to analyze
+ * @returns true if validation response pattern found
+ */
+function hasValidationResponse(handlerText) {
+    // Use indexOf for simple string checks to avoid regex complexity
+    const has400Code = handlerText.includes('reply.code') && handlerText.includes('400');
+    const hasValidationMessage = handlerText.includes('Missing') ||
+        handlerText.includes('Invalid') ||
+        handlerText.includes('required');
+    /* v8 ignore next -- defensive AST/type guard */
+    return has400Code && hasValidationMessage;
+}
+/**
+ * Check if a handler has validation
+ * @param handlerNode - TypeScript node of the handler or null
+ * @param sourceFile - TypeScript SourceFile for context
+ * @param fullContent - Full file content as string
+ * @returns true if validation is found, false otherwise
+ */
+function checkForValidation(handlerNode, sourceFile, fullContent) {
+    if (!handlerNode) {
+        return hasValidationInContent(fullContent);
+    }
+    const handlerText = handlerNode.getText(sourceFile);
+    if (matchesAnyPattern(handlerText, ZOD_VALIDATION_PATTERNS)) {
+        return true;
+    }
+    if (matchesAnyPattern(handlerText, OTHER_VALIDATION_PATTERNS)) {
+        return true;
+    }
+    if (hasValidationAfterBodyAccess(handlerText)) {
+        return true;
+    }
+    return hasValidationResponse(handlerText);
+}
+function hasValidationInContent(content) {
+    if (content.includes('contracts') && content.includes('Schema')) {
+        return true;
+    }
+    if (content.includes('zod') && content.includes('.parse(')) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Create a violation for a route missing validation
+ * @param routeInfo - Route information
+ * @param filePath - Path to the file
+ * @returns CheckViolation object
+ */
+function createMissingValidationViolation(routeInfo, filePath) {
+    return {
+        filePath,
+        line: routeInfo.line,
+        column: 0,
+        message: `${routeInfo.method} ${routeInfo.path} - Route handler accepts request body without Zod schema validation`,
+        severity: 'error',
+        type: 'missing-validation',
+        suggestion: 'Add Zod schema validation for request body. Import schema from shared contract schemas and use schema.parse(request.body).',
+        match: `${routeInfo.method} ${routeInfo.path}`,
+    };
+}
+/**
+ * Check a single call expression for route validation issues
+ * @param options - The options for the check
+ * @returns Violation if found, null otherwise
+ */
+function checkCallExpressionForViolation(options) {
+    const { node, sourceFile, content, filePath } = options;
+    const routeInfo = extractRouteInfo(node, sourceFile);
+    if (!routeInfo) {
+        return null;
+    }
+    // Routes using fastify-type-provider-zod pass schema in options — validation is automatic
+    if (routeInfo.hasSchemaOption) {
+        return null;
+    }
+    const hasValidation = checkForValidation(routeInfo.handlerNode, sourceFile, content);
+    if (hasValidation) {
+        return null;
+    }
+    return createMissingValidationViolation(routeInfo, filePath);
+}
+/**
+ * Analyze a file for Fastify routes missing validation
+ * @param content - File content to analyze
+ * @param filePath - Path to the file being analyzed
+ * @returns Array of violations found in the file
+ */
+function analyzeFile(content, filePath) {
+    const violations = [];
+    try {
+        const sourceFile = getSharedSourceFile(filePath, content);
+        /* v8 ignore next -- defensive guard */
+        if (!sourceFile)
+            return [];
+        const visit = (node) => {
+            if (ts.isCallExpression(node)) {
+                const violation = checkCallExpressionForViolation({ node, sourceFile, content, filePath });
+                if (violation) {
+                    violations.push(violation);
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+        /* v8 ignore next 1 -- defensive catch: parse failures already handled */
+    }
+    catch {
+        // @swallow-ok Skip files that fail to parse
+    }
+    return violations;
+}
+/**
+ * Check if file is a route file
+ */
+function isRouteFile(file) {
+    return file.includes('/routes/') && !isTestFile(file) && !file.endsWith('.d.ts');
+}
+/**
+ * Check: quality/fastify-route-validation
+ *
+ * Ensures all Fastify POST/PATCH/PUT route handlers validate request bodies
+ * with Zod schemas.
+ */
+export const fastifyRouteValidation = defineCheck({
+    id: '0de8bce9-e6fd-45c2-83ea-013bedfd3346',
+    slug: 'fastify-route-validation',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    // 'raw', not 'strip-strings': the check extracts the route *path string literal*
+    // value (first arg to fastify.post/patch/put) to embed the real path in the
+    // violation message, and uses content includes() on import/usage strings for
+    // fallback validation detection when no inline handler. Stripping blanks those,
+    // producing useless messages (e.g. "POST        - ...") and false violations.
+    // See auth-route-guard.ts for identical rationale on route paths.
+    contentFilter: 'raw',
+    confidence: 'high',
+    description: 'Ensure all Fastify POST/PATCH/PUT routes validate request bodies with Zod schemas',
+    longDescription: `**Purpose:** Ensures every Fastify POST, PATCH, and PUT route handler validates the request body using Zod or an equivalent validation library.
+
+**Detects:**
+- Route handlers registered via \`fastify.post(\`, \`.patch(\`, \`.put(\` (matched by \`/fastify\\.(post|patch|put)|\\.(post|patch|put)\\(/i\`) that lack validation
+- Missing Zod calls (\`.parse(\`, \`.safeParse(\`, \`z.\\w+()\`) and alternative validators (\`.validate(\`, \`validateBody(\`, \`validateRequest(\`, \`validateInput(\`)
+- Handlers that access \`request.body\` without subsequent validation or 400-status error responses
+
+**Why it matters:** Unvalidated request bodies allow malformed or malicious payloads to reach business logic, causing runtime errors and security vulnerabilities.
+
+**Scope:** General best practice. Analyzes each file individually using TypeScript AST parsing. Only processes files under \`/routes/\` directories.`,
+    tags: ['quality', 'security', 'code-quality', 'fastify', 'validation'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        // Filter to only route files
+        if (!isRouteFile(filePath)) {
+            return [];
+        }
+        // Quick filter: skip files that don't contain route patterns
+        if (!QUICK_FILTER_PATTERNS.test(content)) {
+            return [];
+        }
+        return analyzeFile(content, filePath);
+    },
+});
+//# sourceMappingURL=fastify-route-validation.js.map

package/dist/checks/quality/api/fastify-route-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify-route-validation.js","sourceRoot":"","sources":["../../../../src/checks/quality/api/fastify-route-validation.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,2GAA2G;AAC3G,wKAAwK;AACxK;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;GAEG;AACH,MAAM,qBAAqB,GAAG,uDAAuD,CAAC;AAEtF;;GAEG;AACH,MAAM,uBAAuB,GAAG;IAC9B,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,YAAY;CACb,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAChC,iBAAiB;IACjB,mBAAmB;IACnB,sBAAsB;IACtB,oBAAoB;CACrB,CAAC;AAUF;;;;;GAKG;AACH,uIAAuI;AACvI,SAAS,gBAAgB,CAAC,IAAuB,EAAE,UAAyB;IAC1E,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAA8B,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,SAAS,GAAG,SAAS,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,QAAQ,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,IAAI,WAAW,GAAmB,IAAI,CAAC;IACvC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;YACxE,WAAW,GAAG,SAAS,CAAC;QAC1B,CAAC;aAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,4FAA4F;YAC5F,eAAe,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACnD,gDAAgD;gBAChD,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,gDAAgD;gBAChD,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBACnE,mDAAmD;gBACnD,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CACrC,CAAC,UAAU,EAAE,EAAE,CACb,EAAE,CAAC,oBAAoB,CAAC,UAAU,CAAC;wBACnC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC;wBAChC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAClC,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzB,gDAAgD;gBAChD,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtE,WAAW,GAAG,QAAQ,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,2CAA2C;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE3E,OAAO;QACL,MAAM;QACN,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,GAAG,CAAC;QACd,WAAW;QACX,eAAe;KAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAA2B;IAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CAAC,WAAmB;IACvD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,CAAC,GAAG,uBAAuB,EAAE,GAAG,yBAAyB,CAAC,CAAC;IAE/E,IAAI,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gFAAgF;IAChF,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,WAAmB;IAChD,iEAAiE;IACjE,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,oBAAoB,GACxB,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/B,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/B,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEnC,gDAAgD;IAChD,OAAO,UAAU,IAAI,oBAAoB,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CACzB,WAA2B,EAC3B,UAAyB,EACzB,WAAmB;IAEnB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAEpD,IAAI,iBAAiB,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,iBAAiB,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,4BAA4B,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,qBAAqB,CAAC,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,gCAAgC,CAAC,SAAoB,EAAE,QAAgB;IAC9E,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,GAAG,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,qEAAqE;QACnH,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EACR,4HAA4H;QAC9H,KAAK,EAAE,GAAG,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE;KAC/C,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,SAAS,+BAA+B,CACtC,OAAmC;IAEnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACxD,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0FAA0F;IAC1F,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACrF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,gCAAgC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,QAAgB;IACpD,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,uCAAuC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;YACpC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,+BAA+B,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC3F,IAAI,SAAS,EAAE,CAAC;oBACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,yEAAyE;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,iFAAiF;IACjF,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,8EAA8E;IAC9E,kEAAkE;IAClE,aAAa,EAAE,KAAK;IAEpB,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,mFAAmF;IAChG,eAAe,EAAE;;;;;;;;;qJASkI;IACnJ,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC;IACtE,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAO,EAAE,QAAQ;QACvB,6BAA6B;QAC7B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/quality/api/fastify-schema-coverage.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Fastify Schema Coverage Check
+ *
+ * Validates Fastify routes have proper schema coverage:
+ * - Routes without schema option (unless Zod validation is present)
+ * - Routes with body but missing body schema
+ * - Routes with response but missing response schema
+ * - Recognizes Zod .parse()/.safeParse() on request properties as equivalent coverage
+ */
+export declare const fastifySchemaCoverage: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=fastify-schema-coverage.d.ts.map

package/dist/checks/quality/api/fastify-schema-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify-schema-coverage.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/api/fastify-schema-coverage.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAkUH,eAAO,MAAM,qBAAqB,sCAwChC,CAAC"}

package/dist/checks/quality/api/fastify-schema-coverage.js

@@ -0,0 +1,261 @@
+// @fitness-ignore-file correlation-id-coverage -- Fitness check implementation, not an API handler
+// @fitness-ignore-file fastify-schema-coverage -- Fitness check definition file; references Fastify schema patterns for detection, not actual routes
+/**
+ * @fileoverview Fastify Schema Coverage Check
+ *
+ * Validates Fastify routes have proper schema coverage:
+ * - Routes without schema option (unless Zod validation is present)
+ * - Routes with body but missing body schema
+ * - Routes with response but missing response schema
+ * - Recognizes Zod .parse()/.safeParse() on request properties as equivalent coverage
+ */
+import { defineCheck, isTestFile } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+const BODY_METHODS = new Set(['POST', 'PUT', 'PATCH']);
+function createSchemaViolation(options, type, message, suggestion) {
+    const { method, line, filePath, routePath } = options;
+    return {
+        filePath,
+        line,
+        column: 0,
+        message,
+        severity: 'warning',
+        type,
+        suggestion,
+        match: `${method} ${routePath}`,
+    };
+}
+function hasProperty(routeText, propertyName) {
+    return routeText.includes(`${propertyName}:`) || routeText.includes(`${propertyName} :`);
+}
+function detectZodValidation(routeText) {
+    const bodyPattern = /\.(?:safe)?[Pp]arse\(\s{0,5}(?:request|req)\.body\s{0,5}\)/;
+    const queryPattern = /\.(?:safe)?[Pp]arse\(\s{0,5}(?:request|req)\.query\s{0,5}\)/;
+    const paramsPattern = /\.(?:safe)?[Pp]arse\(\s{0,5}(?:request|req)\.params\s{0,5}\)/;
+    const responsePattern = /[A-Z]\w{0,60}Schema\.parse\(/;
+    const generalPattern = /[A-Z]\w{0,60}Schema\.(?:safe)?[Pp]arse\(/;
+    const hasBody = bodyPattern.test(routeText);
+    const hasQuery = queryPattern.test(routeText);
+    const hasParams = paramsPattern.test(routeText);
+    const hasResponse = responsePattern.test(routeText);
+    const hasGeneral = generalPattern.test(routeText);
+    return {
+        hasAny: hasBody || hasQuery || hasParams || hasResponse || hasGeneral,
+        hasBody,
+        hasQuery,
+        hasParams,
+        hasResponse,
+    };
+}
+function checkMissingSchema(options, zodResult) {
+    if (hasProperty(options.routeText, 'schema')) {
+        return null;
+    }
+    if (zodResult.hasAny) {
+        return null;
+    }
+    return createSchemaViolation(options, 'missing-schema', `Route ${options.method} ${options.routePath} has no schema option`, 'Add schema option with body, response, params, and querystring as needed for request validation and OpenAPI documentation. Alternatively, use Zod Schema.parse() or Schema.safeParse() on request properties in the handler.');
+}
+function handlerReadsBody(routeText) {
+    // The route's text passed in here covers the full call expression,
+    // including the handler body. If neither `request.body` nor `req.body`
+    // appears, the handler doesn't consume a request body — POST/PUT/PATCH
+    // routes triggered purely by URL params (state-transition actions like
+    // `/dispatch`, `/replay`, `/dismiss`) legitimately have no body schema
+    // because there is no body. Flagging those is a false positive.
+    return routeText.includes('request.body') || routeText.includes('req.body');
+}
+function checkMissingBodySchema(options, zodResult) {
+    if (!BODY_METHODS.has(options.method)) {
+        return null;
+    }
+    if (hasProperty(options.routeText, 'body')) {
+        return null;
+    }
+    if (zodResult.hasBody) {
+        return null;
+    }
+    if (!handlerReadsBody(options.routeText)) {
+        return null;
+    }
+    return createSchemaViolation(options, 'missing-body-schema', `Route ${options.method} ${options.routePath} missing body schema`, 'Add body schema to validate request payload. Use Zod schema from shared contract schemas.');
+}
+function checkMissingResponseSchema(options, zodResult) {
+    if (hasProperty(options.routeText, 'response')) {
+        return null;
+    }
+    if (zodResult.hasResponse) {
+        return null;
+    }
+    return createSchemaViolation(options, 'missing-response-schema', `Route ${options.method} ${options.routePath} missing response schema`, 'Add response schema for proper API documentation and type safety. Define schemas for 200, 400, 500 status codes.');
+}
+function checkMissingParamsSchema(options, zodResult) {
+    const hasParams = options.routePath.includes(':');
+    if (!hasParams) {
+        return null;
+    }
+    if (hasProperty(options.routeText, 'params')) {
+        return null;
+    }
+    if (zodResult.hasParams) {
+        return null;
+    }
+    return createSchemaViolation(options, 'missing-params-schema', `Route ${options.method} ${options.routePath} has path params but no params schema`, 'Add params schema to validate path parameters. Use Zod schema to validate param types.');
+}
+function checkMissingQuerySchema(options, zodResult) {
+    const accessesQuery = options.routeText.includes('request.query') || options.routeText.includes('req.query');
+    if (!accessesQuery) {
+        return null;
+    }
+    if (hasProperty(options.routeText, 'querystring')) {
+        return null;
+    }
+    if (zodResult.hasQuery) {
+        return null;
+    }
+    return createSchemaViolation(options, 'missing-querystring-schema', `Route ${options.method} ${options.routePath} accesses query but no querystring schema`, 'Add querystring schema to validate query parameters. Use Zod schema to validate and coerce query string values.');
+}
+function checkRouteSchema(options) {
+    const violations = [];
+    const zodResult = detectZodValidation(options.routeText);
+    const missingSchemaViolation = checkMissingSchema(options, zodResult);
+    if (missingSchemaViolation) {
+        violations.push(missingSchemaViolation);
+        return violations;
+    }
+    const bodyViolation = checkMissingBodySchema(options, zodResult);
+    if (bodyViolation) {
+        violations.push(bodyViolation);
+    }
+    const responseViolation = checkMissingResponseSchema(options, zodResult);
+    if (responseViolation) {
+        violations.push(responseViolation);
+    }
+    const paramsViolation = checkMissingParamsSchema(options, zodResult);
+    if (paramsViolation) {
+        violations.push(paramsViolation);
+    }
+    const queryViolation = checkMissingQuerySchema(options, zodResult);
+    if (queryViolation) {
+        violations.push(queryViolation);
+    }
+    return violations;
+}
+function matchObjectMethod(nodeText) {
+    const match = /method\s{0,5}:\s{0,5}['"]?(GET|POST|PUT|PATCH|DELETE)['"]?/i.exec(nodeText);
+    return match?.[1]?.toUpperCase() ?? null;
+}
+function matchObjectUrl(nodeText) {
+    const match = /url\s{0,5}:\s{0,5}['"`]([^'"`]{1,200})['"`]/.exec(nodeText);
+    return match?.[1] ?? null;
+}
+function matchShorthandMethod(callText) {
+    const match = /(?:fastify|app|server)\.(get|post|put|patch|delete)\s{0,5}\(/i.exec(callText);
+    return match?.[1]?.toUpperCase() ?? null;
+}
+function matchPathArgument(callText) {
+    const match = /\(\s{0,5}['"`]([^'"`]{1,200})['"`]/.exec(callText);
+    /* v8 ignore next -- defensive AST/type guard */
+    return match?.[1] ?? null;
+}
+function analyzeObjectLiteral(node, sourceFile, filePath) {
+    const nodeText = node.getText(sourceFile);
+    const method = matchObjectMethod(nodeText);
+    const routePath = matchObjectUrl(nodeText);
+    if (!method || !routePath) {
+        return [];
+    }
+    const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    return checkRouteSchema({
+        routeText: nodeText,
+        method,
+        line: line + 1,
+        filePath,
+        routePath,
+    });
+}
+function analyzeCallExpression(node, sourceFile, filePath) {
+    const callText = node.getText(sourceFile);
+    const method = matchShorthandMethod(callText);
+    if (!method) {
+        return [];
+    }
+    const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    /* v8 ignore next -- defensive nullish fallback */
+    const routePath = matchPathArgument(callText) ?? '';
+    return checkRouteSchema({
+        routeText: callText,
+        method,
+        line: line + 1,
+        filePath,
+        routePath,
+    });
+}
+function analyzeFile(content, filePath) {
+    const violations = [];
+    try {
+        const sourceFile = getSharedSourceFile(filePath, content);
+        /* v8 ignore next -- defensive guard */
+        if (!sourceFile)
+            return [];
+        const visit = (node) => {
+            if (ts.isObjectLiteralExpression(node)) {
+                violations.push(...analyzeObjectLiteral(node, sourceFile, filePath));
+            }
+            else if (ts.isCallExpression(node)) {
+                violations.push(...analyzeCallExpression(node, sourceFile, filePath));
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+        /* v8 ignore next 1 -- defensive catch: parse failures already handled */
+    }
+    catch {
+        // @swallow-ok Skip files that fail to parse
+    }
+    return violations;
+}
+function isRouteFile(file) {
+    const hasRouteKeyword = file.includes('route') || file.includes('controller') || file.includes('endpoint');
+    const isTypeFile = file.endsWith('.d.ts');
+    return hasRouteKeyword && !isTestFile(file) && !isTypeFile;
+}
+export const fastifySchemaCoverage = defineCheck({
+    id: '16f14276-7a70-43bb-8097-181dd277371c',
+    slug: 'fastify-schema-coverage',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'high',
+    description: 'Validate that Fastify routes have proper request/response schema validation',
+    longDescription: `**Purpose:** Validates that Fastify route definitions include complete schema options for request and response validation.
+
+**Detects:**
+- Routes (both object-literal \`{ method: 'POST', url: '...' }\` and shorthand \`fastify.post(...)\` styles) missing the \`schema\` option entirely
+- POST/PUT/PATCH routes missing a \`body:\` schema property when the handler reads \`request.body\` (state-transition routes triggered by URL params with no body access are not flagged)
+- Routes missing a \`response:\` schema property
+- Routes with path parameters (containing \`:\`) missing a \`params:\` schema property
+- Routes accessing \`request.query\`/\`req.query\` missing a \`querystring:\` schema property
+
+**Zod validation support:** Routes using Zod-based validation in the handler body are recognized as having equivalent schema coverage:
+- \`Schema.safeParse(request.body)\` / \`Schema.parse(request.body)\` — counts as body validation
+- \`Schema.safeParse(request.query)\` / \`Schema.parse(request.query)\` — counts as querystring validation
+- \`Schema.safeParse(request.params)\` / \`Schema.parse(request.params)\` — counts as params validation
+- \`Schema.parse(result)\` (any \`*Schema.parse()\` call) — counts as response validation
+
+**Why it matters:** Missing schema properties disable Fastify's built-in request validation and omit routes from OpenAPI documentation, leading to undocumented and unvalidated endpoints.
+
+**Scope:** General best practice. Analyzes each file individually using TypeScript AST parsing. Only processes route/controller/endpoint files.`,
+    tags: ['quality', 'code-quality', 'best-practices', 'security', 'fastify', 'schema'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        if (!isRouteFile(filePath)) {
+            return [];
+        }
+        if (!content.includes('fastify') && !content.includes('route')) {
+            return [];
+        }
+        return analyzeFile(content, filePath);
+    },
+});
+//# sourceMappingURL=fastify-schema-coverage.js.map

package/dist/checks/quality/api/fastify-schema-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify-schema-coverage.js","sourceRoot":"","sources":["../../../../src/checks/quality/api/fastify-schema-coverage.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,qJAAqJ;AACrJ;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAUvD,SAAS,qBAAqB,CAC5B,OAAgC,EAChC,IAAY,EACZ,OAAe,EACf,UAAkB;IAElB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACtD,OAAO;QACL,QAAQ;QACR,IAAI;QACJ,MAAM,EAAE,CAAC;QACT,OAAO;QACP,QAAQ,EAAE,SAAS;QACnB,IAAI;QACJ,UAAU;QACV,KAAK,EAAE,GAAG,MAAM,IAAI,SAAS,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,YAAoB;IAC1D,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,YAAY,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,YAAY,IAAI,CAAC,CAAC;AAC3F,CAAC;AAUD,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,MAAM,WAAW,GAAG,4DAA4D,CAAC;IACjF,MAAM,YAAY,GAAG,6DAA6D,CAAC;IACnF,MAAM,aAAa,GAAG,8DAA8D,CAAC;IACrF,MAAM,eAAe,GAAG,8BAA8B,CAAC;IACvD,MAAM,cAAc,GAAG,0CAA0C,CAAC;IAElE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAElD,OAAO;QACL,MAAM,EAAE,OAAO,IAAI,QAAQ,IAAI,SAAS,IAAI,WAAW,IAAI,UAAU;QACrE,OAAO;QACP,QAAQ;QACR,SAAS;QACT,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAgC,EAChC,SAA8B;IAE9B,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,qBAAqB,CAC1B,OAAO,EACP,gBAAgB,EAChB,SAAS,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,uBAAuB,EACnE,8NAA8N,CAC/N,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,mEAAmE;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,gEAAgE;IAChE,OAAO,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAgC,EAChC,SAA8B;IAE9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,qBAAqB,CAC1B,OAAO,EACP,qBAAqB,EACrB,SAAS,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,sBAAsB,EAClE,2FAA2F,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAgC,EAChC,SAA8B;IAE9B,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,qBAAqB,CAC1B,OAAO,EACP,yBAAyB,EACzB,SAAS,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,0BAA0B,EACtE,kHAAkH,CACnH,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAgC,EAChC,SAA8B;IAE9B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,qBAAqB,CAC1B,OAAO,EACP,uBAAuB,EACvB,SAAS,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,uCAAuC,EACnF,wFAAwF,CACzF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgC,EAChC,SAA8B;IAE9B,MAAM,aAAa,GACjB,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,qBAAqB,CAC1B,OAAO,EACP,4BAA4B,EAC5B,SAAS,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,2CAA2C,EACvF,iHAAiH,CAClH,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzD,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,aAAa,GAAG,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,aAAa,EAAE,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzE,IAAI,iBAAiB,EAAE,CAAC;QACtB,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrE,IAAI,eAAe,EAAE,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnE,IAAI,cAAc,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,KAAK,GAAG,6DAA6D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3F,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,6CAA6C,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,+DAA+D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7F,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClE,gDAAgD;IAChD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAgC,EAChC,UAAyB,EACzB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3C,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE3E,OAAO,gBAAgB,CAAC;QACtB,SAAS,EAAE,QAAQ;QACnB,MAAM;QACN,IAAI,EAAE,IAAI,GAAG,CAAC;QACd,QAAQ;QACR,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAuB,EACvB,UAAyB,EACzB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,kDAAkD;IAClD,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEpD,OAAO,gBAAgB,CAAC;QACtB,SAAS,EAAE,QAAQ;QACnB,MAAM;QACN,IAAI,EAAE,IAAI,GAAG,CAAC;QACd,QAAQ;QACR,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,QAAgB;IACpD,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,uCAAuC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;YACpC,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvE,CAAC;iBAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,UAAU,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxE,CAAC;YAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,yEAAyE;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,eAAe,GACnB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,eAAe,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,6EAA6E;IAC1F,eAAe,EAAE;;;;;;;;;;;;;;;;;gJAiB6H;IAC9I,IAAI,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;IACpF,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAO,EAAE,QAAQ;QACvB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/quality/api/index.d.ts

@@ -0,0 +1,5 @@
+export * from './api-contract-validation.js';
+export * from './api-response-validation.js';
+export * from './fastify-route-validation.js';
+export * from './fastify-schema-coverage.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/checks/quality/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/api/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC"}

package/dist/checks/quality/api/index.js

@@ -0,0 +1,5 @@
+export * from './api-contract-validation.js';
+export * from './api-response-validation.js';
+export * from './fastify-route-validation.js';
+export * from './fastify-schema-coverage.js';
+//# sourceMappingURL=index.js.map

package/dist/checks/quality/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/checks/quality/api/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC"}

package/dist/checks/quality/code-structure/duplicate-utility-functions.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @fileoverview Duplicate Utility Functions check
+ *
+ * Detects duplicate utility functions that should be consolidated.
+ * Flags TWO types of issues:
+ * 1. Identical implementations - true duplicates that must be deduplicated
+ * 2. Same-named functions with different implementations - consolidation opportunities
+ */
+/**
+ * Recipe-config shape for the duplicate-utility-functions check. Augments
+ * the built-in {@link DOMAIN_SPECIFIC_FUNCTIONS} list with project-specific
+ * names that are deliberately distinct implementations sharing a name.
+ *
+ * Project-specific functions like `getCurrentCorrelationId`, `formatDuration`,
+ * `getRemoteUrl`, `sanitizeForPrompt`, etc. belong in a recipe's
+ * `checks.config['duplicate-utility-functions'].additionalDomainSpecificFunctions`
+ * block, NOT in built-in defaults.
+ */
+export interface DuplicateUtilityFunctionsConfig extends Record<string, unknown> {
+    /** Function names that should be skipped (treated as domain-specific by design). */
+    additionalDomainSpecificFunctions?: readonly string[];
+}
+/**
+ * Check: quality/duplicate-utility-functions
+ *
+ * Detects utility functions that should be consolidated across the codebase.
+ * Reports two types of issues:
+ * - IDENTICAL: Same name, same implementation (true duplicates)
+ * - SIMILAR: Same name, different implementation (consolidation opportunities)
+ */
+export declare const duplicateUtilityFunctions: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=duplicate-utility-functions.d.ts.map

package/dist/checks/quality/code-structure/duplicate-utility-functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duplicate-utility-functions.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/code-structure/duplicate-utility-functions.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAcH;;;;;;;;;GASG;AACH,MAAM,WAAW,+BAAgC,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC9E,oFAAoF;IACpF,iCAAiC,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvD;AAmdD;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,sCAkCpC,CAAC"}