@opensip-cli/checks-typescript 0.1.0

package/dist/checks/quality/data-integrity/in-memory-repository-detection.js

@@ -0,0 +1,157 @@
+/**
+ * @fileoverview In-Memory Repository Detection Check
+ *
+ * Detects repository classes using Map or in-memory storage in production code.
+ * These are often placeholders that should be replaced with DynamoDB implementations.
+ */
+import { defineCheck } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/**
+ * Patterns that indicate intentional in-memory usage
+ */
+const ALLOWED_PATTERNS = [/cache/i, /Cache/, /InMemory/, /Mock/, /Stub/, /Fake/, /Test/];
+/**
+ * Repository class name patterns
+ */
+const REPOSITORY_PATTERNS = [/Repository$/, /Store$/, /Storage$/, /DAO$/, /DataAccess$/];
+/**
+ * Quick filter keywords
+ */
+const QUICK_FILTER_STORAGE = ['new Map', 'new Set', '= []', '= {}'];
+/**
+ * Repeated suggestion message for in-memory storage violations
+ */
+const IN_MEMORY_STORAGE_SUGGESTION = 'Replace with DynamoDB/PostgreSQL persistent storage implementation. In-memory storage is lost on restart and does not scale.';
+/**
+ * Detect in-memory storage type from initializer text
+ * @param initText - Initializer text to analyze
+ * @returns Storage violation info if detected, null otherwise
+ */
+function detectStorageType(initText) {
+    if (initText.includes('new Map')) {
+        return { type: 'map-storage', storageType: 'Map', match: 'new Map' };
+    }
+    if (initText.includes('new Set')) {
+        return { type: 'set-storage', storageType: 'Set', match: 'new Set' };
+    }
+    if (initText === '[]' || initText.startsWith('[')) {
+        return { type: 'array-storage', storageType: 'Array', match: '[]' };
+    }
+    if (initText === '{}' || initText.startsWith('{')) {
+        return { type: 'object-storage', storageType: 'Object', match: '{}' };
+    }
+    return null;
+}
+/**
+ * Check a class property for in-memory storage patterns
+ * @param ctx - Context for property checking
+ * @returns CheckViolation if found, null otherwise
+ */
+function checkPropertyForStorage(ctx) {
+    const { member, className, sourceFile } = ctx;
+    const initializer = member.initializer;
+    if (!initializer) {
+        return null;
+    }
+    const initText = initializer.getText(sourceFile);
+    const storageInfo = detectStorageType(initText);
+    if (!storageInfo) {
+        return null;
+    }
+    const { line } = sourceFile.getLineAndCharacterOfPosition(member.getStart());
+    const lineNum = line + 1;
+    return {
+        line: lineNum,
+        column: 0,
+        message: `Repository ${className} uses in-memory ${storageInfo.storageType} storage`,
+        severity: 'error',
+        type: storageInfo.type,
+        suggestion: IN_MEMORY_STORAGE_SUGGESTION,
+        match: storageInfo.match,
+    };
+}
+/**
+ * Analyze a file for in-memory repository patterns
+ * @param content - File content to analyze
+ * @param filePath - Path to the file
+ * @returns Array of violations found
+ */
+function analyzeFile(content, filePath) {
+    const violations = [];
+    // Quick filter: must have repository pattern AND in-memory storage pattern
+    const hasRepository = REPOSITORY_PATTERNS.some((p) => p.test(content));
+    const hasStorage = QUICK_FILTER_STORAGE.some((kw) => content.includes(kw));
+    if (!hasRepository || !hasStorage) {
+        return violations;
+    }
+    // Check if file has allowed patterns
+    if (ALLOWED_PATTERNS.some((pattern) => pattern.test(content))) {
+        return violations;
+    }
+    try {
+        const sourceFile = getSharedSourceFile(filePath, content);
+        /* v8 ignore next -- defensive guard */
+        if (!sourceFile)
+            return [];
+        const visit = (node) => {
+            if (ts.isClassDeclaration(node) && node.name) {
+                const className = node.name.getText(sourceFile);
+                // Check if this is a repository class
+                const isRepository = REPOSITORY_PATTERNS.some((p) => p.test(className));
+                if (!isRepository) {
+                    ts.forEachChild(node, visit);
+                    return;
+                }
+                // Check class properties for in-memory storage
+                node.members.forEach((member) => {
+                    if (ts.isPropertyDeclaration(member)) {
+                        const violation = checkPropertyForStorage({
+                            member,
+                            className,
+                            sourceFile,
+                        });
+                        if (violation) {
+                            violations.push(violation);
+                        }
+                    }
+                });
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+        /* v8 ignore next 1 -- defensive catch: parse failures already handled */
+    }
+    catch {
+        // @swallow-ok Skip files that fail to parse
+    }
+    return violations;
+}
+/**
+ * Check: quality/in-memory-repository-detection
+ *
+ * Detects repository classes using Map or in-memory storage instead of
+ * proper persistence.
+ */
+export const inMemoryRepositoryDetection = defineCheck({
+    id: 'e44c8f1a-c63f-4583-8f64-a652d240865a',
+    slug: 'in-memory-repository-detection',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'high',
+    description: 'Detect repository classes using Map or in-memory storage instead of proper persistence',
+    longDescription: `**Purpose:** Detects repository classes that use in-memory data structures instead of persistent database storage, flagging placeholder implementations that should be replaced.
+
+**Detects:**
+- Classes named \`*Repository\`, \`*Store\`, \`*Storage\`, \`*DAO\`, or \`*DataAccess\` with properties initialized to \`new Map\`, \`new Set\`, \`[]\`, or \`{}\`
+- Skips files containing allowed patterns: \`Cache\`, \`InMemory\`, \`Mock\`, \`Stub\`, \`Fake\`, \`Test\` (intentional in-memory usage)
+- Quick-filters on both repository class name patterns and storage initialization keywords
+
+**Why it matters:** In-memory storage is lost on restart, does not scale across instances, and is a common placeholder that gets accidentally shipped to production.
+
+**Scope:** General best practice. Analyzes each file individually.`,
+    tags: ['quality', 'architecture', 'best-practices'],
+    fileTypes: ['ts'],
+    analyze: analyzeFile,
+});
+//# sourceMappingURL=in-memory-repository-detection.js.map

package/dist/checks/quality/data-integrity/in-memory-repository-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-repository-detection.js","sourceRoot":"","sources":["../../../../src/checks/quality/data-integrity/in-memory-repository-detection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;GAEG;AACH,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAEzF;;GAEG;AACH,MAAM,mBAAmB,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;AAEzF;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAEpE;;GAEG;AACH,MAAM,4BAA4B,GAChC,8HAA8H,CAAC;AAQjI;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,GAAyB;IACxD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAEvC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEhD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;IAEzB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,cAAc,SAAS,mBAAmB,WAAW,CAAC,WAAW,UAAU;QACpF,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,UAAU,EAAE,4BAA4B;QACxC,KAAK,EAAE,WAAW,CAAC,KAAK;KACzB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,QAAgB;IACpD,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,2EAA2E;IAC3E,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,qCAAqC;IACrC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,uCAAuC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;YACpC,IAAI,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAEhD,sCAAsC;gBACtC,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBACxE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBAED,+CAA+C;gBAC/C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;oBAC9B,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;wBACrC,MAAM,SAAS,GAAG,uBAAuB,CAAC;4BACxC,MAAM;4BACN,SAAS;4BACT,UAAU;yBACX,CAAC,CAAC;wBACH,IAAI,SAAS,EAAE,CAAC;4BACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;wBAC7B,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;YACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,yEAAyE;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;IACrD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,gCAAgC;IACtC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,MAAM;IAClB,WAAW,EACT,wFAAwF;IAC1F,eAAe,EAAE;;;;;;;;;mEASgD;IACjE,IAAI,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,gBAAgB,CAAC;IACnD,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,EAAE,WAAW;CACrB,CAAC,CAAC"}

package/dist/checks/quality/data-integrity/index.d.ts

@@ -0,0 +1,8 @@
+export * from './array-validation.js';
+export * from './database-index-coverage.js';
+export * from './database-schema-validation.js';
+export * from './in-memory-repository-detection.js';
+export * from './missing-input-validation.js';
+export * from './null-safety.js';
+export * from './numeric-validation.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/checks/quality/data-integrity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/data-integrity/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC"}

package/dist/checks/quality/data-integrity/index.js

@@ -0,0 +1,8 @@
+export * from './array-validation.js';
+export * from './database-index-coverage.js';
+export * from './database-schema-validation.js';
+export * from './in-memory-repository-detection.js';
+export * from './missing-input-validation.js';
+export * from './null-safety.js';
+export * from './numeric-validation.js';
+//# sourceMappingURL=index.js.map

package/dist/checks/quality/data-integrity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/checks/quality/data-integrity/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC"}

package/dist/checks/quality/data-integrity/missing-input-validation.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview Missing Input Validation Check
+ *
+ * Detects API handlers and functions accepting external input without validation.
+ */
+/**
+ * Check: quality/missing-input-validation
+ *
+ * Detects API handlers and functions accepting external input without validation.
+ */
+export declare const missingInputValidation: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=missing-input-validation.d.ts.map

package/dist/checks/quality/data-integrity/missing-input-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-input-validation.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/data-integrity/missing-input-validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgLH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sCAsBjC,CAAC"}

package/dist/checks/quality/data-integrity/missing-input-validation.js

@@ -0,0 +1,180 @@
+/**
+ * @fileoverview Missing Input Validation Check
+ *
+ * Detects API handlers and functions accepting external input without validation.
+ */
+import { createPathMatcher, defineCheck } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/**
+ * Paths that should be excluded from validation check
+ */
+const EXCLUDED_PATH_SEGMENTS = [
+    '/services/',
+    '/service/',
+    '/utils/',
+    '/util/',
+    '/helpers/',
+    '/helper/',
+    '/domain/',
+    '/models/',
+    '/model/',
+    '/types/',
+    '/type/',
+    '/schemas/',
+    '/schema/',
+    '/lib/',
+    '/core/',
+    '/shared/',
+    '/common/',
+];
+const isExcludedValidationPath = createPathMatcher(EXCLUDED_PATH_SEGMENTS);
+/**
+ * Quick filter regex for handler patterns
+ */
+const QUICK_FILTER_HANDLER_PATTERNS = /\b(req|request|res|response|reply|handler|Handler|route|Route|endpoint|Endpoint|controller|Controller)\b/;
+/**
+ * Validation patterns
+ */
+const VALIDATION_PATTERNS = [
+    /\.parse\s*\(/,
+    /\.safeParse\s*\(/,
+    /z\.\w+\(/,
+    /Joi\.\w+/,
+    /yup\.\w+/,
+    /\.validate\s*\(/,
+    /validator\./i,
+    /assertValid/i,
+];
+/**
+ * @param {*} node
+ * @returns {*}
+ * Get function name from node
+ */
+// @fitness-ignore-next-line duplicate-utility-functions -- Check-specific helper typed to FunctionLike; each fitness check defines its own variant for its node type
+function getFunctionName(node) {
+    /* v8 ignore next -- defensive AST/type guard */
+    if (ts.isFunctionDeclaration(node) && node.name)
+        return node.name.text;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (ts.isMethodDeclaration(node) && ts.isIdentifier(node.name))
+        return node.name.text;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (ts.isVariableDeclaration(node.parent) && ts.isIdentifier(node.parent.name)) {
+        return node.parent.name.text;
+    }
+    return 'anonymous';
+}
+/**
+ * Check if function has API handler parameters
+ */
+function hasApiParams(params) {
+    if (params.length < 2)
+        return false;
+    const [firstParam, secondParam] = params;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (!firstParam || !secondParam)
+        return false;
+    const firstName = ts.isIdentifier(firstParam.name) ? firstParam.name.text : '';
+    const secondName = ts.isIdentifier(secondParam.name) ? secondParam.name.text : '';
+    // Express: (req, res) or Fastify: (request, reply)
+    return ((/^(req|request)$/i.test(firstName) && /^(res|response)$/i.test(secondName)) ||
+        (/^request$/i.test(firstName) && /^reply$/i.test(secondName)));
+}
+/**
+ * Check if function is an API handler
+ */
+function isApiHandler(node) {
+    return hasApiParams(node.parameters);
+}
+/**
+ * Check if function body has validation
+ */
+function hasValidation(node, sourceFile) {
+    /* v8 ignore next -- defensive guard */
+    if (!node.body)
+        return true; // No body = nothing to validate
+    const bodyText = node.body.getText(sourceFile);
+    return VALIDATION_PATTERNS.some((pattern) => pattern.test(bodyText));
+}
+/**
+ * Analyze a file for missing input validation
+ */
+function analyzeFile(content, filePath) {
+    const violations = [];
+    // Skip excluded paths
+    if (isExcludedValidationPath(filePath)) {
+        return violations;
+    }
+    // Quick filter: skip files without handler patterns
+    if (!QUICK_FILTER_HANDLER_PATTERNS.test(content)) {
+        return violations;
+    }
+    try {
+        const sourceFile = getSharedSourceFile(filePath, content);
+        /* v8 ignore next -- defensive guard */
+        if (!sourceFile)
+            return [];
+        const checkFunction = (node) => {
+            if (!isApiHandler(node))
+                return;
+            const functionName = getFunctionName(node);
+            /* v8 ignore next -- defensive AST/type guard */
+            if (hasValidation(node, sourceFile))
+                return;
+            const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+            violations.push({
+                line: line + 1,
+                message: `API handler '${functionName}' accepts external input without validation`,
+                severity: 'warning',
+                suggestion: 'Add input validation using Zod, Joi, or similar library',
+                match: functionName,
+                type: 'missing-validation',
+            });
+        };
+        const visit = (node) => {
+            if (ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)) {
+                checkFunction(node);
+            }
+            if (ts.isVariableDeclaration(node) &&
+                node.initializer &&
+                (ts.isArrowFunction(node.initializer) || ts.isFunctionExpression(node.initializer))) {
+                checkFunction(node.initializer);
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+        /* v8 ignore next 1 -- defensive catch: parse failures already handled */
+    }
+    catch {
+        // @swallow-ok Skip files that fail to parse
+    }
+    return violations;
+}
+/**
+ * Check: quality/missing-input-validation
+ *
+ * Detects API handlers and functions accepting external input without validation.
+ */
+export const missingInputValidation = defineCheck({
+    id: '25f2a9b6-be96-42a4-aa0d-3b00839784e3',
+    slug: 'missing-input-validation',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'high',
+    description: 'Detect API handlers accepting external input without validation (Zod, Joi, etc.)',
+    longDescription: `**Purpose:** Detects API route handlers that accept external input (request/response parameters) without any schema validation, ensuring all boundaries validate their inputs.
+
+**Detects:**
+- Functions with Express-style \`(req, res)\` or Fastify-style \`(request, reply)\` parameter signatures
+- Handler bodies lacking validation calls: \`.parse()\`, \`.safeParse()\`, \`z.*\`, \`Joi.*\`, \`yup.*\`, \`.validate()\`, \`validator.*\`, or \`assertValid\`
+- Excludes internal paths (\`/services/\`, \`/utils/\`, \`/helpers/\`, \`/domain/\`, \`/models/\`, \`/types/\`, \`/schemas/\`, \`/lib/\`, \`/core/\`, \`/shared/\`, \`/common/\`)
+
+**Why it matters:** API handlers without input validation are vulnerable to injection attacks, type confusion, and malformed data propagating into the system.
+
+**Scope:** General best practice. Analyzes each file individually.`,
+    tags: ['quality', 'security', 'code-quality'],
+    fileTypes: ['ts'],
+    analyze: analyzeFile,
+});
+//# sourceMappingURL=missing-input-validation.js.map

package/dist/checks/quality/data-integrity/missing-input-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-input-validation.js","sourceRoot":"","sources":["../../../../src/checks/quality/data-integrity/missing-input-validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;GAEG;AACH,MAAM,sBAAsB,GAAG;IAC7B,YAAY;IACZ,WAAW;IACX,SAAS;IACT,QAAQ;IACR,WAAW;IACX,UAAU;IACV,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,QAAQ;IACR,WAAW;IACX,UAAU;IACV,OAAO;IACP,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC;AAEF,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;AAQ3E;;GAEG;AACH,MAAM,6BAA6B,GACjC,0GAA0G,CAAC;AAE7G;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,cAAc;IACd,kBAAkB;IAClB,UAAU;IACV,UAAU;IACV,UAAU;IACV,iBAAiB;IACjB,cAAc;IACd,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,qKAAqK;AACrK,SAAS,eAAe,CAAC,IAAkB;IACzC,gDAAgD;IAChD,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACvE,gDAAgD;IAChD,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACtF,gDAAgD;IAChD,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAC/B,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,MAA6C;IACjE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC;IACzC,gDAAgD;IAChD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAElF,mDAAmD;IACnD,OAAO,CACL,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5E,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,IAAkB;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAkB,EAAE,UAAyB;IAClE,uCAAuC;IACvC,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,gCAAgC;IAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,QAAgB;IACpD,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,sBAAsB;IACtB,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,oDAAoD;IACpD,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,uCAAuC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,aAAa,GAAG,CAAC,IAAkB,EAAQ,EAAE;YACjD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEhC,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC3C,gDAAgD;YAChD,IAAI,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;gBAAE,OAAO;YAE5C,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAE3E,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,IAAI,GAAG,CAAC;gBACd,OAAO,EAAE,gBAAgB,YAAY,6CAA6C;gBAClF,QAAQ,EAAE,SAAS;gBACnB,UAAU,EAAE,yDAAyD;gBACrE,KAAK,EAAE,YAAY;gBACnB,IAAI,EAAE,oBAAoB;aAC3B,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;YACpC,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnE,aAAa,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YACD,IACE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAC9B,IAAI,CAAC,WAAW;gBAChB,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EACnF,CAAC;gBACD,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClC,CAAC;YACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,yEAAyE;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,kFAAkF;IAC/F,eAAe,EAAE;;;;;;;;;mEASgD;IACjE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC;IAC7C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,EAAE,WAAW;CACrB,CAAC,CAAC"}

package/dist/checks/quality/data-integrity/null-safety.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @fileoverview Null/Undefined Safety Check
+ *
+ * Detects unsafe property and method access without null checks.
+ */
+import { type CheckViolation } from '@opensip-cli/fitness';
+/**
+ * Recipe-config shape for null-safety. Project-specific safe-by-construction
+ * paths (e.g. opensip's `/dbos/schema`) belong in a recipe's
+ * `checks.config['null-safety']` block, not in built-in defaults.
+ */
+export interface NullSafetyConfig extends Record<string, unknown> {
+    /**
+     * Additional path patterns whose files are skipped entirely. Each entry
+     * is compiled to a case-insensitive RegExp via `new RegExp(entry, 'i')`.
+     */
+    additionalSafeNullPaths?: readonly string[];
+}
+/**
+ * @param {*} content
+ * @param {*} filePath
+ * @returns {*}
+ * Analyze a file for null safety issues. Exported for the FP-regression
+ * suite (see `__tests__/null-safety-fp.test.ts`).
+ */
+export declare function analyzeNullSafety(content: string, filePath: string): CheckViolation[];
+/**
+ * Check: quality/null-safety
+ *
+ * Detects unsafe property and method access without null checks.
+ */
+export declare const nullSafety: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=null-safety.d.ts.map

package/dist/checks/quality/data-integrity/null-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"null-safety.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/data-integrity/null-safety.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,EAA2C,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAIpG;;;;GAIG;AACH,MAAM,WAAW,gBAAiB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/D;;;OAGG;IACH,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAgqBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CA4ErF;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,sCA2BrB,CAAC"}