@opensip-cli/checks-typescript 0.1.0

package/dist/checks/quality/unused-config-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unused-config-options.js","sourceRoot":"","sources":["../../../src/checks/quality/unused-config-options.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,+GAA+G;AAC/G;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAA0C,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAUjC;;GAEG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,gDAAgD;IAChD,SAAS;IACT,UAAU;IACV,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;IACT,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IACL,OAAO;IACP,MAAM;IACN,SAAS;IACT,QAAQ;IACR,UAAU;IACV,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,4BAA4B,GAAG;IACnC,SAAS;IACT,aAAa;IACb,SAAS;IACT,aAAa;IACb,UAAU;IACV,UAAU;IACV,aAAa;IACb,6BAA6B;IAC7B,YAAY;IACZ,iBAAiB;IACjB,eAAe;CAChB,CAAC;AAEF;;GAEG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,aAAqB;IAC9C,gDAAgD;IAChD,OAAO,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/E,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAChC,MAAsB,EACtB,UAAyB,EACzB,aAAqB,EACrB,QAAgB;IAEhB,gDAAgD;IAChD,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,gDAAgD;IAChD,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAElC,mEAAmE;IACnE,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7E,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,aAAa;QACb,QAAQ;QACR,IAAI,EAAE,IAAI,GAAG,CAAC;QACd,UAAU,EAAE,MAAM,CAAC,aAAa,KAAK,SAAS;KAC/C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CACjC,IAA6B,EAC7B,UAAyB,EACzB,QAAgB;IAEhB,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAErC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,QAAgB,EAChB,KAAmB;IAEnB,gFAAgF;IAChF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1D,uCAAuC;IACvC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAAE,OAAO;QAC7C,gDAAgD;QAChD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO;QAC/C,UAAU,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;IACvB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAAmB;IACxD,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,yCAAyC;QAC9C,GAAG,EAAE,8BAA8B;KACpC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAqB,EAAE,CAAC;IAE9C,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEzE,IAAI,CAAC;YACH,yHAAyH;YACzH,MAAM,KAAK,GAAG,MAAM,+BAA+B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACrE,gBAAgB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YAChC,yEAAyE;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,4CAA4C;QACjD,KAAK,EAAE,gBAAgB,CAAC,MAAM;QAC9B,GAAG,EAAE,6BAA6B;KACnC,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAAmB;IACtD,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,uCAAuC;QAC5C,GAAG,EAAE,yCAAyC;KAC/C,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/C,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,yHAAyH;YACzH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,uCAAuC;YACvC,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;gBACpC,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBACpC,kDAAkD;oBAClD,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5E,CAAC;gBAED,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBACpC,kDAAkD;oBAClD,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5E,CAAC;gBAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC,CAAC;YAEF,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;YACvB,yEAAyE;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,gCAAgC,CAAC,IAAoB;IAC5D,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,oBAAoB,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,aAAa,oBAAoB;QACpF,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,kCAAkC,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,aAAa,yDAAyD;QAC5I,KAAK,EAAE,IAAI,CAAC,IAAI;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,gBAAkC,EAClC,YAAiC;IAEjC,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU;YAAE,SAAS;QAC9B,kDAAkD;QAClD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC1E,aAAa,EAAE,KAAK;IAEpB,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,6DAA6D;IAC1E,eAAe,EAAE;;;;;;;;;8KAS2J;IAC5K,IAAI,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,iBAAiB,CAAC;IACpD,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IAExB,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,+KAA+K;QAC/K,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,oBAAoB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/resilience/__tests__/callback-invocation-safe.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=callback-invocation-safe.test.d.ts.map

package/dist/checks/resilience/__tests__/callback-invocation-safe.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-invocation-safe.test.d.ts","sourceRoot":"","sources":["../../../../src/checks/resilience/__tests__/callback-invocation-safe.test.ts"],"names":[],"mappings":""}

package/dist/checks/resilience/__tests__/callback-invocation-safe.test.js

@@ -0,0 +1,79 @@
+import { describe, expect, it } from 'vitest';
+import { analyzeCallbackInvocationSafe } from '../callback-invocation-safe.js';
+const SRC_FILE = 'packages/foo/src/notifier.ts';
+describe('callback-invocation-safe', () => {
+    it('flags unwrapped subscribers.forEach((cb) => cb(x))', () => {
+        const src = `
+      class Notifier {
+        private subscribers: ((x: number) => void)[] = []
+        notify(x: number) {
+          this.subscribers.forEach((cb) => cb(x))
+        }
+      }
+    `;
+        const v = analyzeCallbackInvocationSafe(src, SRC_FILE);
+        expect(v.length).toBeGreaterThanOrEqual(1);
+        expect(v[0]?.message).toMatch(/Direct callback invocation/);
+    });
+    it('flags unwrapped for-of over listeners', () => {
+        const src = `
+      class Bus {
+        private listeners: (() => void)[] = []
+        fire() {
+          for (const cb of this.listeners) {
+            cb()
+          }
+        }
+      }
+    `;
+        const v = analyzeCallbackInvocationSafe(src, SRC_FILE);
+        expect(v.length).toBeGreaterThanOrEqual(1);
+    });
+    it('does NOT flag when the invocation goes through a safe<Name>() wrapper', () => {
+        const src = `
+      class Notifier {
+        private subscribers: ((x: number) => void)[] = []
+        notify(x: number) {
+          this.subscribers.forEach((cb) => this.safeInvokeSubscriber(cb, x))
+        }
+        private safeInvokeSubscriber(cb: any, x: number) {
+          try { cb(x) } catch {}
+        }
+      }
+    `;
+        expect(analyzeCallbackInvocationSafe(src, SRC_FILE)).toHaveLength(0);
+    });
+    it('does NOT flag iteration over a non-callback-collection identifier', () => {
+        const src = `
+      const numbers = [1, 2, 3]
+      numbers.forEach((n) => n)
+      for (const x of numbers) { x }
+    `;
+        expect(analyzeCallbackInvocationSafe(src, SRC_FILE)).toHaveLength(0);
+    });
+    it('skips test files', () => {
+        const src = `this.subscribers.forEach((cb) => cb())\n`;
+        expect(analyzeCallbackInvocationSafe(src, 'packages/foo/src/__tests__/x.test.ts')).toHaveLength(0);
+    });
+    it('skips files outside packages/', () => {
+        const src = `this.subscribers.forEach((cb) => cb())\n`;
+        expect(analyzeCallbackInvocationSafe(src, 'apps/web/src/x.ts')).toHaveLength(0);
+    });
+    it('honors the @callback-invocation-safe-by-caller pragma with a rationale', () => {
+        const src = `
+      // @callback-invocation-safe-by-caller -- caller wraps in try/catch
+      this.subscribers.forEach((cb) => cb())
+    `;
+        expect(analyzeCallbackInvocationSafe(src, SRC_FILE)).toHaveLength(0);
+    });
+    it('flags bare pragma without rationale', () => {
+        const src = `
+      // @callback-invocation-safe-by-caller
+      this.subscribers.forEach((cb) => cb())
+    `;
+        const v = analyzeCallbackInvocationSafe(src, SRC_FILE);
+        expect(v.length).toBeGreaterThanOrEqual(1);
+        expect(v[0]?.message).toContain('Bare pragmas are rejected');
+    });
+});
+//# sourceMappingURL=callback-invocation-safe.test.js.map

package/dist/checks/resilience/__tests__/callback-invocation-safe.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-invocation-safe.test.js","sourceRoot":"","sources":["../../../../src/checks/resilience/__tests__/callback-invocation-safe.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E,MAAM,QAAQ,GAAG,8BAA8B,CAAC;AAEhD,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG;;;;;;;KAOX,CAAC;QACF,MAAM,CAAC,GAAG,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG;;;;;;;;;KASX,CAAC;QACF,MAAM,CAAC,GAAG,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,GAAG,GAAG;;;;;;;;;;KAUX,CAAC;QACF,MAAM,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG;;;;KAIX,CAAC;QACF,MAAM,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,GAAG,GAAG,0CAA0C,CAAC;QACvD,MAAM,CAAC,6BAA6B,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC,CAAC,YAAY,CAC7F,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,0CAA0C,CAAC;QACvD,MAAM,CAAC,6BAA6B,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,GAAG,GAAG;;;KAGX,CAAC;QACF,MAAM,CAAC,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG;;;KAGX,CAAC;QACF,MAAM,CAAC,GAAG,6BAA6B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/resilience/__tests__/context-leakage-fp.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview Regression test for the `context-leakage` FP fix.
+ *
+ * A module-level `let parentContext: Context` holding OpenTelemetry's W3C
+ * trace-propagation context was flagged as request-context leakage because
+ * the type name ends in "Context". OTel's `Context` is process/propagation
+ * scoped, not the per-request tenant context this check targets. The fix
+ * inspects the import source: only types imported from `@opentelemetry/*`
+ * are spared, so a genuine `let activeContext: RequestContext` still fires.
+ */
+export {};
+//# sourceMappingURL=context-leakage-fp.test.d.ts.map

package/dist/checks/resilience/__tests__/context-leakage-fp.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-leakage-fp.test.d.ts","sourceRoot":"","sources":["../../../../src/checks/resilience/__tests__/context-leakage-fp.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/checks/resilience/__tests__/context-leakage-fp.test.js

@@ -0,0 +1,34 @@
+/**
+ * @fileoverview Regression test for the `context-leakage` FP fix.
+ *
+ * A module-level `let parentContext: Context` holding OpenTelemetry's W3C
+ * trace-propagation context was flagged as request-context leakage because
+ * the type name ends in "Context". OTel's `Context` is process/propagation
+ * scoped, not the per-request tenant context this check targets. The fix
+ * inspects the import source: only types imported from `@opentelemetry/*`
+ * are spared, so a genuine `let activeContext: RequestContext` still fires.
+ */
+import { describe, expect, it } from 'vitest';
+import { analyzeContextLeakage } from '../context-leakage.js';
+function analyze(src) {
+    return analyzeContextLeakage(src, 'src/cli/telemetry/sdk-init.ts');
+}
+describe('context-leakage — OTel Context FP regression', () => {
+    it('does NOT flag a module-level binding typed as OTel-imported Context', () => {
+        const src = `
+      import { context as otelContext, type Context } from '@opentelemetry/api';
+      let parentContext: Context | undefined;
+      export function setParent(c: Context): void { parentContext = c; }
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('STILL flags a module-level binding typed as a non-OTel request context', () => {
+        const src = `
+      import type { RequestContext } from './http.js';
+      let activeContext: RequestContext | null = null;
+      export function setCtx(c: RequestContext): void { activeContext = c; }
+    `;
+        expect(analyze(src).length).toBeGreaterThan(0);
+    });
+});
+//# sourceMappingURL=context-leakage-fp.test.js.map

package/dist/checks/resilience/__tests__/context-leakage-fp.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-leakage-fp.test.js","sourceRoot":"","sources":["../../../../src/checks/resilience/__tests__/context-leakage-fp.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,qBAAqB,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;AACrE,CAAC;AAED,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,GAAG,GAAG;;;;KAIX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,GAAG,GAAG;;;;KAIX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/resilience/__tests__/context-mutation.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Regression tests for `context-mutation` FP fix.
+ *
+ * The 1.0.7 release added detection for locally-declared `ctx` /
+ * `context` variables — when the file declares them via `const`/`let`/
+ * `var`, subsequent `.X =` mutations are object-construction patterns
+ * (`const ctx = {}; ctx.x = ...`), NOT mutations of a shared request
+ * context. This test pins the FP that previously fired.
+ */
+export {};
+//# sourceMappingURL=context-mutation.test.d.ts.map

package/dist/checks/resilience/__tests__/context-mutation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-mutation.test.d.ts","sourceRoot":"","sources":["../../../../src/checks/resilience/__tests__/context-mutation.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/checks/resilience/__tests__/context-mutation.test.js

@@ -0,0 +1,54 @@
+/**
+ * @fileoverview Regression tests for `context-mutation` FP fix.
+ *
+ * The 1.0.7 release added detection for locally-declared `ctx` /
+ * `context` variables — when the file declares them via `const`/`let`/
+ * `var`, subsequent `.X =` mutations are object-construction patterns
+ * (`const ctx = {}; ctx.x = ...`), NOT mutations of a shared request
+ * context. This test pins the FP that previously fired.
+ */
+import { describe, expect, it } from 'vitest';
+import { analyzeContextMutation } from '../context-mutation.js';
+function analyze(src) {
+    return analyzeContextMutation(src, 'test.ts');
+}
+describe('context-mutation — FP regression suite (1.0.7)', () => {
+    it('does NOT flag mutations on a locally-declared const ctx object', () => {
+        const src = `
+      function buildContext() {
+        const ctx: { foo?: string; bar?: number } = {}
+        ctx.foo = 'value'
+        ctx.bar = 42
+        return ctx
+      }
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('does NOT flag mutations on a locally-declared let context object', () => {
+        const src = `
+      function build() {
+        let context: Record<string, unknown> = {}
+        context.id = 'abc'
+        return context
+      }
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('STILL flags mutations on req.context (passed request)', () => {
+        const src = `
+      function middleware(req: Request) {
+        req.context.user = 'X'
+      }
+    `;
+        expect(analyze(src).length).toBeGreaterThanOrEqual(1);
+    });
+    it('STILL flags mutations on request.context (passed request)', () => {
+        const src = `
+      function middleware(request: Request) {
+        request.context.user = 'X'
+      }
+    `;
+        expect(analyze(src).length).toBeGreaterThanOrEqual(1);
+    });
+});
+//# sourceMappingURL=context-mutation.test.js.map

package/dist/checks/resilience/__tests__/context-mutation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-mutation.test.js","sourceRoot":"","sources":["../../../../src/checks/resilience/__tests__/context-mutation.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,GAAG,GAAG;;;;;;;KAOX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG;;;;;;KAMX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG;;;;KAIX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG;;;;KAIX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/resilience/callback-invocation-safe.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @fileoverview resilience/callback-invocation-safe — callbacks iterated
+ * from producer code paths (`subscribers.forEach((cb) => cb(...))`,
+ * `for (const cb of listeners) { cb(...) }`) must be wrapped in a
+ * `safe<Name>(...)` helper or a `try { ... }` block. A throw from a
+ * single subscriber must never crash the producer or skip subsequent
+ * subscribers in the same notification.
+ *
+ * Why it matters: callback iteration inside `setInterval` or async
+ * drain loops will surface a subscriber throw as `uncaughtException`
+ * — and even on a synchronous code path, an unprotected throw drops
+ * every later subscriber in the same loop iteration. The contract is
+ * "subscribers are isolated"; this check is the regression gate.
+ *
+ * Scope (deliberately narrow):
+ *   - `.ts` / `.tsx` source under `packages/`.
+ *   - Skips tests and `.d.ts`.
+ *   - Detects only iteration over identifiers ending in
+ *     `subscribers`, `listeners`, `observers`, `callbacks`, `handlers`.
+ *
+ * Per-site opt-out: `// @callback-invocation-safe-by-caller -- <reason>`
+ * on the same line or the line immediately above. A bare pragma without
+ * `-- <reason>` is itself flagged so reviewers can grep the rationale.
+ *
+ * Confidence: low. Under-flag aggressively. This is a regression guard,
+ * not a discovery tool.
+ *
+ * Inspired by `opensip-ai/opensip/opensip-cli` `arch-callback-invocation-safe`.
+ */
+import { type CheckViolation } from '@opensip-cli/fitness';
+/** Exported for unit tests. */
+export declare function analyzeCallbackInvocationSafe(content: string, filePath: string): CheckViolation[];
+export declare const callbackInvocationSafe: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=callback-invocation-safe.d.ts.map

package/dist/checks/resilience/callback-invocation-safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-invocation-safe.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/callback-invocation-safe.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAiKpF,+BAA+B;AAC/B,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CA+BjG;AAED,eAAO,MAAM,sBAAsB,sCAyBjC,CAAC"}

package/dist/checks/resilience/callback-invocation-safe.js

@@ -0,0 +1,247 @@
+// @fitness-ignore-file callback-invocation-safe -- This file IS the callback-invocation-safe check; its JSDoc and `longDescription` template literal necessarily contain example patterns (`subscribers.forEach((cb) => cb(...))`, `for (const cb of listeners)`) so the documentation can describe what the check detects. The check uses `contentFilter: 'raw'` (intentional — must see real code), so it cannot strip its own documentation. Reviewers grepping for the rationale land here.
+// @fitness-ignore-file performance-anti-patterns -- spread patterns appear in the check's own JSDoc example strings, not real loop code
+/**
+ * @fileoverview resilience/callback-invocation-safe — callbacks iterated
+ * from producer code paths (`subscribers.forEach((cb) => cb(...))`,
+ * `for (const cb of listeners) { cb(...) }`) must be wrapped in a
+ * `safe<Name>(...)` helper or a `try { ... }` block. A throw from a
+ * single subscriber must never crash the producer or skip subsequent
+ * subscribers in the same notification.
+ *
+ * Why it matters: callback iteration inside `setInterval` or async
+ * drain loops will surface a subscriber throw as `uncaughtException`
+ * — and even on a synchronous code path, an unprotected throw drops
+ * every later subscriber in the same loop iteration. The contract is
+ * "subscribers are isolated"; this check is the regression gate.
+ *
+ * Scope (deliberately narrow):
+ *   - `.ts` / `.tsx` source under `packages/`.
+ *   - Skips tests and `.d.ts`.
+ *   - Detects only iteration over identifiers ending in
+ *     `subscribers`, `listeners`, `observers`, `callbacks`, `handlers`.
+ *
+ * Per-site opt-out: `// @callback-invocation-safe-by-caller -- <reason>`
+ * on the same line or the line immediately above. A bare pragma without
+ * `-- <reason>` is itself flagged so reviewers can grep the rationale.
+ *
+ * Confidence: low. Under-flag aggressively. This is a regression guard,
+ * not a discovery tool.
+ *
+ * Inspired by `opensip-ai/opensip/opensip-cli` `arch-callback-invocation-safe`.
+ */
+import { defineCheck, isTestFile } from '@opensip-cli/fitness';
+const SCOPE_PREFIXES = ['packages/'];
+const PRAGMA_RE = /@callback-invocation-safe-by-caller\s*--\s*\S+/;
+const PRAGMA_BARE_RE = /@callback-invocation-safe-by-caller\b(?!\s*--\s*\S)/;
+const COLLECTION_NAMES = new Set([
+    'subscribers',
+    'listeners',
+    'observers',
+    'callbacks',
+    'handlers',
+]);
+// Two-step match — first the receiver + `.forEach(`, then the arrow
+// parameter. Splitting the original mega-regex avoids the
+// sonarjs/regex-complexity ceiling and makes each step easier to reason
+// about. Both regexes are bounded — they only consume identifier chars
+// and a few whitespace boundaries, never backtrack on user input.
+const FOREACH_HEAD_RE = /\b([A-Za-z_$][\w$]*)\s*\.\s*forEach\s*\(\s*/g;
+// eslint-disable-next-line sonarjs/slow-regex -- arrow header; bounded prefix optional groups, anchored at slice start
+const FOREACH_ARROW_RE = /^(?:async\s+)?\(?\s*([A-Za-z_$][\w$]*)\s*\)?\s*=>\s*\{?\s*/;
+// `for (const <ident> of <receiver>) { ... }`
+const FOR_OF_INVOCATION_RE = /\bfor\s*\(\s*(?:const|let)\s+([A-Za-z_$][\w$]*)\s+of\s+(?:this\s*\.\s*)?([A-Za-z_$][\w$]*)\s*\)\s*\{/g;
+function collectionNameMatches(name) {
+    const lower = name.toLowerCase();
+    for (const n of COLLECTION_NAMES) {
+        if (lower === n || lower.endsWith(n))
+            return true;
+    }
+    return false;
+}
+function lineNumberOfIndex(content, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < content.length; i++) {
+        if (content[i] === '\n')
+            line++;
+    }
+    return line;
+}
+function inScope(normalized) {
+    return SCOPE_PREFIXES.some((p) => normalized.startsWith(p) || normalized.includes(`/${p}`));
+}
+function bodyInvokesIdent(body, ident) {
+    const re = new RegExp(String.raw `(?<![A-Za-z0-9_$.])` + ident + String.raw `\s*\(`);
+    return re.test(body);
+}
+function bodyHasSafeWrapper(body) {
+    return /\bsafe[A-Z][\w$]*\s*\(/.test(body);
+}
+function isInsideTryBlock(stripped, idx) {
+    const start = Math.max(0, idx - 400);
+    const slice = stripped.slice(start, idx);
+    const lastTry = slice.lastIndexOf('try');
+    if (lastTry === -1)
+        return false;
+    let depth = 0;
+    let saw = false;
+    for (let i = lastTry; i < slice.length; i++) {
+        const ch = slice[i];
+        if (ch === '{') {
+            depth++;
+            saw = true;
+        }
+        else if (ch === '}') {
+            depth--;
+            if (saw && depth <= 0)
+                return false;
+        }
+    }
+    return saw && depth > 0;
+}
+function pragmaAt(lines, callLine) {
+    for (const offset of [0, -1]) {
+        const idx = callLine - 1 + offset;
+        if (idx < 0 || idx >= lines.length)
+            continue;
+        const line = lines[idx] ?? '';
+        if (PRAGMA_RE.test(line))
+            return 'honored';
+        if (PRAGMA_BARE_RE.test(line))
+            return 'bare';
+    }
+    return 'absent';
+}
+function fileIsInScope(filePath) {
+    if (!filePath.endsWith('.ts') && !filePath.endsWith('.tsx'))
+        return false;
+    if (filePath.endsWith('.d.ts'))
+        return false;
+    if (isTestFile(filePath))
+        return false;
+    return inScope(filePath.replaceAll('\\', '/'));
+}
+function contentMentionsCollection(content) {
+    for (const name of COLLECTION_NAMES) {
+        if (content.includes(name))
+            return true;
+    }
+    return false;
+}
+function shouldEmitForEachSite(content, m) {
+    const receiver = m[1] ?? '';
+    if (!collectionNameMatches(receiver))
+        return null;
+    const idx = m.index ?? 0;
+    // The match consumed up to and including the `(` of forEach; parse the
+    // arrow parameter from the slice that follows.
+    const afterParen = content.slice(idx + m[0].length, idx + m[0].length + 200);
+    const arrowMatch = FOREACH_ARROW_RE.exec(afterParen);
+    if (!arrowMatch)
+        return null;
+    const ident = arrowMatch[1] ?? '';
+    const bodyTail = afterParen.slice(arrowMatch[0].length, arrowMatch[0].length + 200);
+    if (!bodyInvokesIdent(bodyTail, ident))
+        return null;
+    if (bodyHasSafeWrapper(bodyTail))
+        return null;
+    if (isInsideTryBlock(content, idx))
+        return null;
+    return { callLine: lineNumberOfIndex(content, idx), receiver, ident };
+}
+function shouldEmitForOfSite(content, m) {
+    const ident = m[1] ?? '';
+    const receiver = m[2] ?? '';
+    if (!collectionNameMatches(receiver))
+        return null;
+    const idx = m.index ?? 0;
+    const blockBody = content.slice(idx, Math.min(content.length, idx + 400));
+    if (!bodyInvokesIdent(blockBody, ident))
+        return null;
+    if (bodyHasSafeWrapper(blockBody))
+        return null;
+    if (isInsideTryBlock(content, idx))
+        return null;
+    return { callLine: lineNumberOfIndex(content, idx), receiver, ident };
+}
+function findCallSites(content) {
+    const sites = [];
+    for (const m of content.matchAll(FOREACH_HEAD_RE)) {
+        const site = shouldEmitForEachSite(content, m);
+        if (site)
+            sites.push(site);
+    }
+    for (const m of content.matchAll(FOR_OF_INVOCATION_RE)) {
+        const site = shouldEmitForOfSite(content, m);
+        if (site)
+            sites.push(site);
+    }
+    return sites;
+}
+function barePragmaViolation(line) {
+    return {
+        line,
+        severity: 'error',
+        message: `Pragma '@callback-invocation-safe-by-caller' requires a '-- <rationale>' suffix. ` +
+            `Bare pragmas are rejected so reviewers can grep the rationale on every opt-out.`,
+        suggestion: `Change to '// @callback-invocation-safe-by-caller -- <one-line rationale>'.`,
+    };
+}
+/** Exported for unit tests. */
+export function analyzeCallbackInvocationSafe(content, filePath) {
+    if (!fileIsInScope(filePath))
+        return [];
+    if (!contentMentionsCollection(content))
+        return [];
+    const sites = findCallSites(content);
+    if (sites.length === 0)
+        return [];
+    const lines = content.split('\n');
+    const violations = [];
+    const seen = new Set();
+    for (const site of sites) {
+        if (seen.has(site.callLine))
+            continue;
+        seen.add(site.callLine);
+        const pragma = pragmaAt(lines, site.callLine);
+        if (pragma === 'honored')
+            continue;
+        if (pragma === 'bare') {
+            violations.push(barePragmaViolation(site.callLine));
+            continue;
+        }
+        const capIdent = site.ident.charAt(0).toUpperCase() + site.ident.slice(1);
+        violations.push({
+            line: site.callLine,
+            severity: 'error',
+            message: `Direct callback invocation \`${site.ident}(...)\` inside iteration over \`${site.receiver}\` is not wrapped in try/catch or a safe<Name>(...) helper. A throw from a single subscriber will propagate out of the producer loop, dropping subsequent subscribers and (under setInterval/async drain) surfacing as uncaughtException.`,
+            suggestion: `Wrap the invocation in a private safe${capIdent}(cb, ...args) helper that catches and logs at warn, then call this.safe${capIdent}(cb, ...) instead. Per-site opt-out: '// @callback-invocation-safe-by-caller -- <rationale>'.`,
+        });
+    }
+    return violations;
+}
+export const callbackInvocationSafe = defineCheck({
+    id: 'd3e7b1c8-95a2-4f6d-b8e2-2c4e7a9d1f3c',
+    slug: 'callback-invocation-safe',
+    scope: { languages: ['typescript'], concerns: ['backend', 'architecture', 'resilience'] },
+    contentFilter: 'raw',
+    confidence: 'low',
+    description: 'Class-field callbacks invoked from producer code paths (subscribers.forEach, for-of over listeners, etc.) must be wrapped in a safe<Name>(...) helper or try/catch. A throw from one subscriber must not crash the producer or skip subsequent subscribers.',
+    longDescription: `**Purpose:** Subscriber/listener throws must be isolated from the producer that fires them.
+
+**Detects:**
+- \`subscribers.forEach((cb) => cb(...))\` and equivalents over identifiers ending in subscribers/listeners/observers/callbacks/handlers
+- \`for (const cb of <coll>) { cb(...) }\`
+
+**Skips when ANY hold:**
+- The invocation is inside a \`try { ... }\` block
+- The body of the iteration uses a \`safe<Name>(...)\` helper instead of the bare callback
+- The opt-out pragma \`// @callback-invocation-safe-by-caller -- <rationale>\` appears on the same line or the line above
+
+**Why it matters:** Inside \`setInterval\` or an async drain loop, a subscriber throw becomes \`uncaughtException\` and kills the producer. Even on a sync code path, a throw drops every subsequent subscriber in the same notification — silent partial-failure.
+
+**Scope:** TypeScript source under \`packages/\`. Tests, \`.d.ts\`, and files that don't reference any of the recognised collection names are skipped via fast path. Detection is deliberately narrow (confidence: low) — this is a regression guard, not a discovery tool.`,
+    tags: ['architecture', 'resilience'],
+    fileTypes: ['ts', 'tsx'],
+    analyze: analyzeCallbackInvocationSafe,
+});
+//# sourceMappingURL=callback-invocation-safe.js.map

package/dist/checks/resilience/callback-invocation-safe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-invocation-safe.js","sourceRoot":"","sources":["../../../src/checks/resilience/callback-invocation-safe.ts"],"names":[],"mappings":"AAAA,geAAge;AAChe,wIAAwI;AACxI;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AAEpF,MAAM,cAAc,GAAG,CAAC,WAAW,CAAU,CAAC;AAE9C,MAAM,SAAS,GAAG,gDAAgD,CAAC;AACnE,MAAM,cAAc,GAAG,qDAAqD,CAAC;AAE7E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,aAAa;IACb,WAAW;IACX,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAEH,oEAAoE;AACpE,0DAA0D;AAC1D,wEAAwE;AACxE,uEAAuE;AACvE,kEAAkE;AAClE,MAAM,eAAe,GAAG,8CAA8C,CAAC;AACvE,uHAAuH;AACvH,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AAEtF,8CAA8C;AAC9C,MAAM,oBAAoB,GACxB,uGAAuG,CAAC;AAE1G,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAa;IACvD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACnD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,qBAAqB,GAAG,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,OAAO,CAAC,CAAC;IACnF,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,EAAE,CAAC;YACR,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAwB,EAAE,QAAgB;IAC1D,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM;YAAE,SAAS;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAe;IAChD,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,CAAmB;IACjE,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACzB,uEAAuE;IACvE,+CAA+C;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IACpF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,kBAAkB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe,EAAE,CAAmB;IAC/D,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,kBAAkB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/C,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,OAAO;QACjB,OAAO,EACL,mFAAmF;YACnF,iFAAiF;QACnF,UAAU,EAAE,6EAA6E;KAC1F,CAAC;AACJ,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,6BAA6B,CAAC,OAAe,EAAE,QAAgB;IAC7E,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1E,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,gCAAgC,IAAI,CAAC,KAAK,mCAAmC,IAAI,CAAC,QAAQ,2OAA2O;YAC9U,UAAU,EAAE,wCAAwC,QAAQ,0EAA0E,QAAQ,+FAA+F;SAC9O,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE;IACzF,aAAa,EAAE,KAAK;IACpB,UAAU,EAAE,KAAK;IACjB,WAAW,EACT,6PAA6P;IAC/P,eAAe,EAAE;;;;;;;;;;;;;4QAayP;IAC1Q,IAAI,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;IACpC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IACxB,OAAO,EAAE,6BAA6B;CACvC,CAAC,CAAC"}

package/dist/checks/resilience/context-leakage.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @fileoverview Context leakage detection — flags request-scoped state stored
+ * in module or class scope that can leak between concurrent requests.
+ */
+import { type CheckViolation } from '@opensip-cli/fitness';
+/**
+ * Check: resilience/context-leakage
+ *
+ * Detects request context stored in module or class scope, which could cause
+ * cross-request pollution in multi-tenant / concurrent server environments.
+ *
+ * Implemented as a TypeScript AST walk. The previous regex implementation flagged:
+ * - type-only references (`SyncStrategy<InitialSyncContext>`),
+ * - method-parameter types (`(ctx: SomeContext) => …`),
+ * - module-level lazy-init metric instruments (`let counter: Counter | null = null`).
+ * The AST rewrite eliminates those false positives by inspecting the actual
+ * declaration shape rather than line text.
+ */
+export declare const contextLeakage: import("@opensip-cli/fitness").Check;
+/**
+ * Analyze a file for request-context leakage. Exported for the FP-regression
+ * suite (see `__tests__/context-leakage-fp.test.ts`).
+ */
+export declare function analyzeContextLeakage(content: string, filePath: string): CheckViolation[];
+//# sourceMappingURL=context-leakage.d.ts.map

package/dist/checks/resilience/context-leakage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-leakage.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/context-leakage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAkXpF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,sCA8BzB,CAAC;AAEH;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAmCzF"}