@opensip-cli/checks-typescript 0.1.0

package/dist/checks/resilience/no-raw-fetch.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview No raw fetch check — flags direct `fetch()` calls that should
+ * use a wrapped HTTP client.
+ */
+/**
+ * Check: resilience/no-raw-fetch
+ *
+ * Detects direct use of fetch() without retry/timeout wrapper.
+ */
+export declare const noRawFetch: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=no-raw-fetch.d.ts.map

package/dist/checks/resilience/no-raw-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-raw-fetch.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/no-raw-fetch.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAoBH;;;;GAIG;AACH,eAAO,MAAM,UAAU,sCAoGrB,CAAC"}

package/dist/checks/resilience/no-raw-fetch.js

@@ -0,0 +1,110 @@
+/**
+ * @fileoverview No raw fetch check — flags direct `fetch()` calls that should
+ * use a wrapped HTTP client.
+ */
+import { defineCheck, isCommentLine, isTestFile } from '@opensip-cli/fitness';
+/**
+ * Pattern for detecting raw fetch() calls.
+ *
+ * Safe regex: bounded whitespace + a single negative lookbehind that
+ * rejects any identifier-char or `.` immediately before `fetch`. The
+ * lookbehind excludes both larger identifiers ending in `fetch`
+ * (`prefetch`, `recordReconcilerPrefetch`, `MyClass.fetch`) AND any
+ * dotted call (`this.fetch`, `cacheGit.fetch`, `httpClient.fetch`) in
+ * one rule — there's no need for a separate `this.` exclusion.
+ *
+ * The previous form `(?<!this\.)fetch...` had no word-boundary on the
+ * left, so anything ending in `fetch(` matched (false positives on
+ * `prefetch(`, `recordReconcilerPrefetch(`, etc.).
+ */
+const RAW_FETCH_PATTERN = /(?<![\w$.])fetch\s{0,10}\(/g;
+/**
+ * Check: resilience/no-raw-fetch
+ *
+ * Detects direct use of fetch() without retry/timeout wrapper.
+ */
+export const noRawFetch = defineCheck({
+    id: 'cfeba2d8-0f62-4b64-b625-f5ba8a0f3b11',
+    slug: 'no-raw-fetch',
+    fileTypes: ['ts', 'tsx', 'js', 'jsx'],
+    description: 'Detect direct fetch() calls that should use wrapped HTTP clients',
+    longDescription: `**Purpose:** Enforces use of the platform HTTP client wrapper instead of raw \`fetch()\` calls.
+
+**Detects:**
+- Bare \`fetch(\` calls via regex \`(?<![\\w$.])fetch\\s{0,10}\\(\` (excludes any \`<ident>.fetch\` method call AND any larger identifier ending in \`fetch\`, e.g. \`prefetch\`)
+- Skips comment lines
+
+**Why it matters:** Raw \`fetch()\` lacks built-in retry, timeout, observability, and error normalization that the canonical HttpClient provides.
+
+**Scope:** Codebase-specific convention. Analyzes each file individually via regex.`,
+    tags: ['resilience', 'http', 'fetch'],
+    analyze(content, filePath) {
+        const violations = [];
+        // Quick check: skip files that don't contain fetch
+        if (!content.includes('fetch(')) {
+            return violations;
+        }
+        // Skip the resilient fetch wrapper itself — this IS the raw fetch implementation
+        if (filePath.includes('resilient-fetch') || filePath.includes('resilient_fetch')) {
+            return violations;
+        }
+        // Skip test files — tests legitimately invoke `fetch(` directly to
+        // exercise the wrapper, mock the global, or hit a localhost test
+        // server. Routing those through the wrapper would defeat the test.
+        if (isTestFile(filePath)) {
+            return violations;
+        }
+        // Skip fitness check definitions that reference fetch in string/regex patterns
+        if (filePath.includes('/fitness/src/checks/')) {
+            return violations;
+        }
+        // Skip LLM adapter files — infrastructure boundary making direct API calls
+        if (filePath.includes('/llm/') || filePath.includes('/llm-adapter')) {
+            return violations;
+        }
+        // Skip SSE/streaming implementations that require raw fetch for stream parsing
+        if (content.includes('ReadableStream') ||
+            content.includes('text/event-stream') ||
+            content.includes('EventSource') ||
+            content.includes('getReader()')) {
+            return violations;
+        }
+        // Skip files where fetch() is invoked through a retry wrapper AND
+        // every fetch call passes an abort signal / timeout. This is the
+        // canonical "wrapped" pattern: `withRetry(() => fetch(url, { signal:
+        // AbortSignal.timeout(...) }))`. The check exists to flag the bare
+        // primitive, not legitimate library code that already adds the
+        // missing affordances around it.
+        const fetchCallCount = (content.match(/(?<![\w$.])fetch\s{0,10}\(/g) ?? []).length;
+        const signalCount = (content.match(/\bsignal\s*:/g) ?? []).length;
+        const usesRetryWrapper = content.includes('withRetry(') ||
+            content.includes('withRetries(') ||
+            content.includes('retryFetch(');
+        if (usesRetryWrapper && signalCount >= fetchCallCount) {
+            return violations;
+        }
+        const lines = content.split('\n');
+        for (const [lineNum, line_] of lines.entries()) {
+            const line = line_ ?? '';
+            // Skip comment lines
+            if (isCommentLine(line)) {
+                continue;
+            }
+            RAW_FETCH_PATTERN.lastIndex = 0;
+            let match;
+            while ((match = RAW_FETCH_PATTERN.exec(line)) !== null) {
+                violations.push({
+                    line: lineNum + 1,
+                    column: match.index,
+                    message: 'Raw fetch() usage detected',
+                    severity: 'warning',
+                    suggestion: 'Use a shared HTTP client wrapper with built-in retry, timeout, and error handling instead of raw fetch()',
+                    match: match[0],
+                    filePath,
+                });
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=no-raw-fetch.js.map

package/dist/checks/resilience/no-raw-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-raw-fetch.js","sourceRoot":"","sources":["../../../src/checks/resilience/no-raw-fetch.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AAEnG;;;;;;;;;;;;;GAaG;AACH,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC;IACpC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,cAAc;IACpB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;IACrC,WAAW,EAAE,kEAAkE;IAC/E,eAAe,EAAE;;;;;;;;oFAQiE;IAClF,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;IAErC,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,iFAAiF;QACjF,IAAI,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACjF,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,mEAAmE;QACnE,iEAAiE;QACjE,mEAAmE;QACnE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,+EAA+E;QAC/E,IAAI,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC9C,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,2EAA2E;QAC3E,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACpE,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,+EAA+E;QAC/E,IACE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAClC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAC/B,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,kEAAkE;QAClE,iEAAiE;QACjE,qEAAqE;QACrE,mEAAmE;QACnE,+DAA+D;QAC/D,iCAAiC;QACjC,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACnF,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAClE,MAAM,gBAAgB,GACpB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;YAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAClC,IAAI,gBAAgB,IAAI,WAAW,IAAI,cAAc,EAAE,CAAC;YACtD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAEzB,qBAAqB;YACrB,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,iBAAiB,CAAC,SAAS,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvD,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,OAAO,GAAG,CAAC;oBACjB,MAAM,EAAE,KAAK,CAAC,KAAK;oBACnB,OAAO,EAAE,4BAA4B;oBACrC,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,0GAA0G;oBAC5G,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;oBACf,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/resilience/no-unbounded-concurrency.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview No unbounded concurrency check — flags `Promise.all(arr.map(...))`
+ * patterns without nearby concurrency controls.
+ */
+/**
+ * Check: resilience/no-unbounded-concurrency
+ *
+ * Detects Promise.all with .map() that may spawn unbounded concurrent operations.
+ */
+export declare const noUnboundedConcurrency: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=no-unbounded-concurrency.d.ts.map

package/dist/checks/resilience/no-unbounded-concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unbounded-concurrency.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/no-unbounded-concurrency.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkCH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sCAqFjC,CAAC"}

package/dist/checks/resilience/no-unbounded-concurrency.js

@@ -0,0 +1,117 @@
+/**
+ * @fileoverview No unbounded concurrency check — flags `Promise.all(arr.map(...))`
+ * patterns without nearby concurrency controls.
+ */
+import { defineCheck, getLineNumber, isTestFile, stripStringsAndCommentsPreservingPositions, } from '@opensip-cli/fitness';
+/**
+ * Pattern indicating unbounded Promise.all usage.
+ * Safe regex: uses word boundaries and explicit character classes, no nested quantifiers.
+ */
+const UNBOUNDED_PROMISE_ALL_PATTERN = /Promise\.all\s*\(\s*[a-zA-Z_$][a-zA-Z0-9_$]*\.map\s*\(/g;
+/**
+ * Check if content contains bounded concurrency patterns.
+ * @param {string} content - The content to check
+ * @returns {boolean} True if bounded patterns found
+ */
+function hasBoundedConcurrencyPattern(content) {
+    const lowerContent = content.toLowerCase();
+    // Check simple string patterns first (faster)
+    if (lowerContent.includes('plimit'))
+        return true;
+    if (lowerContent.includes('p-limit'))
+        return true;
+    if (content.includes('Promise.allSettled'))
+        return true;
+    // Check regex patterns
+    if (/concurrency:\s*\d+/i.test(content))
+        return true;
+    if (/\b(?:chunk|batch)\b/i.test(content))
+        return true;
+    if (/\b(?:throttle|rateLimit)\b/i.test(content))
+        return true;
+    return false;
+}
+/**
+ * Check: resilience/no-unbounded-concurrency
+ *
+ * Detects Promise.all with .map() that may spawn unbounded concurrent operations.
+ */
+export const noUnboundedConcurrency = defineCheck({
+    id: 'fc2a0fee-8374-432b-a7ef-763aea867855',
+    slug: 'no-unbounded-concurrency',
+    description: 'Detect Promise.all with unbounded concurrency',
+    longDescription: `**Purpose:** Prevents unbounded parallel execution that can overwhelm downstream services or exhaust system resources.
+
+**Detects:**
+- \`Promise.all(items.map(\` pattern without nearby concurrency controls
+- Skips files containing bounded concurrency indicators: \`plimit\`, \`p-limit\`, \`Promise.allSettled\`, \`concurrency: N\`, \`chunk\`, \`batch\`, \`throttle\`, \`rateLimit\`
+
+**Why it matters:** Mapping an unbounded array into concurrent promises can spawn thousands of simultaneous operations, causing connection exhaustion or OOM.
+
+**Scope:** General best practice. Analyzes each file individually via regex.`,
+    tags: ['resilience', 'async', 'concurrency'],
+    analyze(content, filePath) {
+        const violations = [];
+        // Skip test files — bounded by fixture data, not external load. A
+        // partial mock of bounded-concurrency helpers that fans out via
+        // Promise.all is a deliberate test seam; the production callers it
+        // replaces ARE bounded.
+        if (isTestFile(filePath))
+            return violations;
+        // Skip files that don't use Promise.all
+        if (!content.includes('Promise.all')) {
+            return violations;
+        }
+        // Strip strings and comments before pattern-match scanning so
+        // doc-block prose describing the pattern (e.g. JSDoc that says
+        // "`Promise.all(arr.map(asyncFn))` fans out one promise per
+        // element") doesn't produce a false positive that's impossible to
+        // suppress without a pragma in user code. Use the position-
+        // preserving variant so match indexes still map onto the original
+        // source line numbers.
+        //
+        // Bounded-pattern detection (`hasBoundedConcurrencyPattern`)
+        // intentionally runs on the ORIGINAL content — comments often carry
+        // intent ("// Batch failed", "// chunked at 4 in flight") that
+        // operators expect to suppress the warning. Stripping them there
+        // would surface previously-passing files as new positives every
+        // time we tighten the regex, so keep the file-level escape hatch
+        // generous and only narrow the per-match scan.
+        const codeOnly = stripStringsAndCommentsPreservingPositions(content);
+        if (!codeOnly.includes('Promise.all')) {
+            return violations;
+        }
+        // Check if file has bounded concurrency patterns (uses original content)
+        if (hasBoundedConcurrencyPattern(content)) {
+            return violations;
+        }
+        UNBOUNDED_PROMISE_ALL_PATTERN.lastIndex = 0;
+        let match;
+        while ((match = UNBOUNDED_PROMISE_ALL_PATTERN.exec(codeOnly)) !== null) {
+            // @lazy-ok -- 'await' appears in suggestion string literal, not actual await
+            // Check context around match for bounded patterns. Use the
+            // ORIGINAL content here — adjacent comments like
+            // `// chunked, batch=N` or `// see batchWithConcurrency above`
+            // are deliberate hints that operators expect to suppress the
+            // warning. Same rationale as the file-level bounded check.
+            const start = Math.max(0, match.index - 200);
+            const end = Math.min(content.length, match.index + 200);
+            const context = content.slice(start, end);
+            if (!hasBoundedConcurrencyPattern(context)) {
+                const lineNumber = getLineNumber(content, match.index);
+                violations.push({
+                    line: lineNumber,
+                    column: 0,
+                    message: 'Promise.all with .map() may spawn unbounded concurrent operations',
+                    severity: 'warning',
+                    suggestion: 'Use p-limit or batch processing to limit concurrency. Example: const limit = pLimit(10); await Promise.all(items.map(item => limit(() => process(item))))',
+                    match: match[0],
+                    type: 'unbounded-promise-all',
+                    filePath,
+                });
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=no-unbounded-concurrency.js.map

package/dist/checks/resilience/no-unbounded-concurrency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unbounded-concurrency.js","sourceRoot":"","sources":["../../../src/checks/resilience/no-unbounded-concurrency.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,WAAW,EACX,aAAa,EACb,UAAU,EACV,0CAA0C,GAE3C,MAAM,sBAAsB,CAAC;AAE9B;;;GAGG;AACH,MAAM,6BAA6B,GAAG,yDAAyD,CAAC;AAEhG;;;;GAIG;AACH,SAAS,4BAA4B,CAAC,OAAe;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,8CAA8C;IAC9C,IAAI,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,uBAAuB;IACvB,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,+CAA+C;IAC5D,eAAe,EAAE;;;;;;;;6EAQ0D;IAC3E,IAAI,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,aAAa,CAAC;IAE5C,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,kEAAkE;QAClE,gEAAgE;QAChE,mEAAmE;QACnE,wBAAwB;QACxB,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,UAAU,CAAC;QAE5C,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,8DAA8D;QAC9D,+DAA+D;QAC/D,4DAA4D;QAC5D,kEAAkE;QAClE,4DAA4D;QAC5D,kEAAkE;QAClE,uBAAuB;QACvB,EAAE;QACF,6DAA6D;QAC7D,oEAAoE;QACpE,+DAA+D;QAC/D,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,0CAA0C,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACtC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,yEAAyE;QACzE,IAAI,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,6BAA6B,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACvE,6EAA6E;YAC7E,2DAA2D;YAC3D,iDAAiD;YACjD,+DAA+D;YAC/D,6DAA6D;YAC7D,2DAA2D;YAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAE1C,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvD,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,mEAAmE;oBAC5E,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,2JAA2J;oBAC7J,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;oBACf,IAAI,EAAE,uBAAuB;oBAC7B,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/__tests__/sql-injection.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @fileoverview Regression tests for `sql-injection` check FP fixes.
+ *
+ * The 1.0.7 release tightened arm-3 (right-side string concat with
+ * SQL clause keyword) to:
+ *   - case-sensitive `WHERE|AND|OR|SET|VALUES` (no longer matches
+ *     lowercase English words)
+ *   - require the concat chain to contain a real SQL keyword
+ *     (`SELECT|INSERT|UPDATE|...`) somewhere
+ *   - skip arguments to known output methods (cli.info/log/error,
+ *     console.log, logger.warn, etc.)
+ *
+ * These tests pin the FP cases that previously fired so future
+ * refactors don't reintroduce them.
+ */
+export {};
+//# sourceMappingURL=sql-injection.test.d.ts.map

package/dist/checks/security/__tests__/sql-injection.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection.test.d.ts","sourceRoot":"","sources":["../../../../src/checks/security/__tests__/sql-injection.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/checks/security/__tests__/sql-injection.test.js

@@ -0,0 +1,97 @@
+/**
+ * @fileoverview Regression tests for `sql-injection` check FP fixes.
+ *
+ * The 1.0.7 release tightened arm-3 (right-side string concat with
+ * SQL clause keyword) to:
+ *   - case-sensitive `WHERE|AND|OR|SET|VALUES` (no longer matches
+ *     lowercase English words)
+ *   - require the concat chain to contain a real SQL keyword
+ *     (`SELECT|INSERT|UPDATE|...`) somewhere
+ *   - skip arguments to known output methods (cli.info/log/error,
+ *     console.log, logger.warn, etc.)
+ *
+ * These tests pin the FP cases that previously fired so future
+ * refactors don't reintroduce them.
+ */
+import { describe, expect, it } from 'vitest';
+import { analyzeSqlInjection } from '../sql-injection.js';
+function analyze(src) {
+    return analyzeSqlInjection(src, 'test.ts');
+}
+describe('sql-injection — FP regression suite (1.0.7)', () => {
+    it('does NOT flag CLI help text with lowercase "and" between concatenated strings', () => {
+        // Pre-1.0.7 this fired because /\bAND\b/i matched "and" in plain
+        // English inside `cli.info('...\n' + '... and ...\n')`.
+        const src = String.raw `
+      import { cli } from './cli'
+      cli.info(
+        'Usage: opensip foo --tenant <id>\n\n' +
+        'Verifies the chain hash and surfaces every seal row.\n' +
+        'Exits 0 on a clean pass.\n',
+      )
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('does NOT flag CLI help text with lowercase "or" between concatenated strings', () => {
+        const src = String.raw `
+      const cli = { info: (_: string) => {} }
+      cli.info(
+        'Pick a strategy: shadow or apply.\n' +
+        '  shadow — log only\n' +
+        '  apply  — write the change\n',
+      )
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('does NOT flag logger.warn argument with concatenation', () => {
+        const src = `
+      const logger = { warn: (_: object) => {} }
+      logger.warn({
+        msg: 'phase ' + name + ' will retry and continue',
+      })
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('does NOT flag console.log with English-text concatenation', () => {
+        const src = String.raw `
+      console.log('Tables: ' + tables.join(', ') + '\n' + 'audit_log and chain_seals are checked')
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('STILL flags real SQL concatenation with WHERE', () => {
+        // Pre-1.0.7 caught this via arm-1 (left-side SELECT keyword); the
+        // 1.0.7 changes must preserve that detection.
+        const src = `
+      const q = 'SELECT * FROM users WHERE id = ' + userId
+      db.execute(q)
+    `;
+        expect(analyze(src).length).toBeGreaterThanOrEqual(1);
+    });
+    it('STILL flags right-side WHERE/AND continuation when chain has a SQL keyword', () => {
+        // Build-up pattern: prefix + variable + suffix where the suffix
+        // contains a clause keyword. The chain has "SELECT * FROM " on
+        // the left, so arm-3 should fire.
+        const src = `
+      const q = 'SELECT * FROM users WHERE id = ' + userId + ' AND status = $1'
+      db.execute(q)
+    `;
+        expect(analyze(src).length).toBeGreaterThanOrEqual(1);
+    });
+    it('does NOT flag uppercase AND/OR inside an output call even when the chain looks SQL-ish', () => {
+        // Edge case: even if the help text uses uppercase "AND" /
+        // "OR", the output-call filter should skip it because
+        // cli.info(...) is never SQL.
+        const src = String.raw `
+      const cli = { info: (_: string) => {} }
+      cli.info(
+        'Pick a mode:\n' +
+        '  shadow  - log only\n' +
+        '  apply   - write\n' +
+        '\n' +
+        'BOTH are safe to run; SHADOW is read-only.\n',
+      )
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=sql-injection.test.js.map

package/dist/checks/security/__tests__/sql-injection.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-injection.test.js","sourceRoot":"","sources":["../../../../src/checks/security/__tests__/sql-injection.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,iEAAiE;QACjE,wDAAwD;QACxD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;KAOrB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;KAOrB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG;;;;;KAKX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;;KAErB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,kEAAkE;QAClE,8CAA8C;QAC9C,MAAM,GAAG,GAAG;;;KAGX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,gEAAgE;QAChE,+DAA+D;QAC/D,kCAAkC;QAClC,MAAM,GAAG,GAAG;;;KAGX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,0DAA0D;QAC1D,sDAAsD;QACtD,8BAA8B;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;KASrB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/security/index.d.ts

@@ -0,0 +1,4 @@
+export * from './input-sanitization.js';
+export * from './sql-injection.js';
+export * from './unsafe-secret-comparison.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/checks/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/checks/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC"}

package/dist/checks/security/index.js

@@ -0,0 +1,4 @@
+export * from './input-sanitization.js';
+export * from './sql-injection.js';
+export * from './unsafe-secret-comparison.js';
+//# sourceMappingURL=index.js.map

package/dist/checks/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/checks/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC"}

package/dist/checks/security/input-sanitization.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @fileoverview Detect unsanitized user input usage
+ *
+ * Uses AST analysis to detect unsanitized user input in HTML injection,
+ * command injection, and path traversal contexts. AST context eliminates
+ * false positives from regex definitions, string constants, and comments.
+ *
+ *
+ */
+/**
+ * Check: security/input-sanitization
+ *
+ * Detects user input used without proper sanitization using AST analysis.
+ * Walks the AST to find actual innerHTML assignments, exec/spawn calls,
+ * and file operations with user input references.
+ *
+ *
+ */
+export declare const inputSanitization: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=input-sanitization.d.ts.map

package/dist/checks/security/input-sanitization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-sanitization.d.ts","sourceRoot":"","sources":["../../../src/checks/security/input-sanitization.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AA6MH;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,sCA8E5B,CAAC"}