@opensip-cli/checks-typescript 0.1.0

package/dist/checks/security/unsafe-secret-comparison.js

@@ -0,0 +1,227 @@
+/**
+ * @fileoverview Detect unsafe equality comparisons on secret/token values
+ *
+ * Finds binary equality operators (=== / !==) applied to variables whose names
+ * suggest they hold cryptographic secrets (token, secret, signature, password,
+ * key). Such comparisons are vulnerable to timing attacks and must use a
+ * constant-time comparison function like safeCompare().
+ */
+import { defineCheck } from '@opensip-cli/fitness';
+import { parseSource, walkNodes, getIdentifierName, isLiteral, isPropertyAccess, getLineNumber, } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/**
+ * Identifier patterns that indicate a secret value.
+ *
+ * Two heuristics work together:
+ *
+ *   1. **Standalone match** — the whole identifier (case-insensitive)
+ *      is an unambiguously secret-bearing name from
+ *      `STANDALONE_SECRET_NAMES`.
+ *
+ *   2. **Compound CamelCase match** — the identifier splits into a
+ *      `<securityPrefix><CamelSuffix>` shape where the prefix is in
+ *      `SECRET_PREFIXES` and the trailing CamelCase noun ends with a
+ *      word in `SECRET_SUFFIXES` (e.g., `apiKey`, `passwordHash`,
+ *      `webhookSignature`).
+ *
+ * The earlier broad substring heuristic (`/secret|token|key|hash|.../i`)
+ * was retired because it over-fired on content-identity / cache /
+ * dedup variables like `cacheKey`, `bodyHash`, `ownerHash`,
+ * `contentHash`, `mapKey` — none of which are security boundaries
+ * (both sides are locally computed; no attacker timing channel). For
+ * the cases the tighter heuristic misses, mark the suspect site with
+ * `// @fitness-ignore-next-line unsafe-secret-comparison -- <reason>`
+ * (false positive) or refactor to `crypto.timingSafeEqual()` (real
+ * secret comparison).
+ *
+ * Sets are used instead of one big regex because the alternation
+ * count was tripping `sonarjs/regex-complexity` (≤ 20 alternatives).
+ */
+const STANDALONE_SECRET_NAMES = new Set([
+    'secret',
+    'password',
+    'token',
+    'signature',
+    'jwt',
+    'hmac',
+    'bearer',
+    'sessionid',
+    'csrftoken',
+    'sessiontoken',
+    'accesstoken',
+    'refreshtoken',
+    'idtoken',
+    'bearertoken',
+    'apikey',
+    'apitoken',
+    'apisecret',
+    'signingkey',
+    'encryptionkey',
+    'privatekey',
+    'publickey',
+    'secretkey',
+    'hmackey',
+    'cookiesecret',
+    'webhooksignature',
+    'paymentsignature',
+    'passwordhash',
+    'authtoken',
+]);
+const SECRET_PREFIXES = new Set([
+    'secret',
+    'api',
+    'access',
+    'refresh',
+    'id',
+    'bearer',
+    'csrf',
+    'session',
+    'signing',
+    'encryption',
+    'private',
+    'public',
+    'password',
+    'jwt',
+    'oauth',
+    'auth',
+    'cookie',
+    'webhook',
+    'payment',
+    'hmac',
+    'otp',
+    'mfa',
+]);
+const SECRET_SUFFIXES = new Set([
+    'Key',
+    'Token',
+    'Secret',
+    'Hash',
+    'Hmac',
+    'Digest',
+    'Signature',
+    'Code',
+    'Cookie',
+]);
+/** Split `apiKey` → `['api', 'Key']`; `accessRefreshToken` → `['access', 'Refresh', 'Token']`. */
+const CAMEL_SPLIT_PATTERN = /(?=[A-Z])/;
+function looksLikeSecret(name) {
+    if (!name)
+        return false;
+    if (STANDALONE_SECRET_NAMES.has(name.toLowerCase()))
+        return true;
+    // Compound: first word is a security prefix; final word is a sensitive suffix.
+    const parts = name.split(CAMEL_SPLIT_PATTERN);
+    const last = parts.at(-1);
+    return (parts.length >= 2 &&
+        SECRET_PREFIXES.has(parts[0]) &&
+        last !== undefined &&
+        SECRET_SUFFIXES.has(last));
+}
+/**
+ * Names that look like secrets but are actually safe to compare with ===.
+ * E.g. `key.length`, `token !== undefined`, `tokenType === 'bearer'`.
+ */
+const SAFE_COMPARAND_PATTERNS = [/^undefined$/, /^null$/, /^true$/, /^false$/];
+/** Properties that don't carry secret data */
+const SAFE_PROPERTY_NAMES = ['length', 'type', 'status', 'kind', 'name', 'id', 'count', 'size'];
+/**
+ * Check if a comparand is a literal value or safe property access,
+ * which would make the comparison safe (not comparing two secret values).
+ */
+function isLiteralOrSafe(node) {
+    if (isLiteral(node))
+        return true;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (ts.isTypeOfExpression(node))
+        return true;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (SAFE_PROPERTY_NAMES.some((prop) => isPropertyAccess(node, prop)))
+        return true;
+    const text = getIdentifierName(node);
+    /* v8 ignore next -- defensive AST/type guard */
+    if (text && SAFE_COMPARAND_PATTERNS.some((p) => p.test(text)))
+        return true;
+    return false;
+}
+/**
+ * Check if either operand has a secret-like name.
+ * Returns the secret-bearing operand name for the violation message, or null.
+ */
+function findSecretOperand(left, right) {
+    const leftName = getIdentifierName(left);
+    const rightName = getIdentifierName(right);
+    const leftIsSecret = looksLikeSecret(leftName);
+    const rightIsSecret = looksLikeSecret(rightName);
+    if (!leftIsSecret && !rightIsSecret)
+        return null;
+    // If one side is secret but the other is a literal/safe value, skip
+    if (leftIsSecret && isLiteralOrSafe(right))
+        return null;
+    /* v8 ignore next -- defensive AST/type guard */
+    if (rightIsSecret && isLiteralOrSafe(left))
+        return null;
+    /* v8 ignore next -- defensive AST/type guard */
+    return leftIsSecret ? leftName : rightName;
+}
+/**
+ * Check: security/unsafe-secret-comparison
+ *
+ * Detects usage of === or !== to compare variables whose names suggest they
+ * hold cryptographic secrets. Such comparisons are vulnerable to timing
+ * side-channel attacks.
+ */
+export const unsafeSecretComparison = defineCheck({
+    id: '0249cfc8-5342-480a-a9d0-fbf7ad89a6cf',
+    slug: 'unsafe-secret-comparison',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'high',
+    description: 'Detect timing-unsafe equality comparisons on secret/token values',
+    longDescription: `**Purpose:** Detects \`===\` or \`!==\` comparisons on variables whose names suggest they hold cryptographic secrets, which are vulnerable to timing side-channel attacks.
+
+**Detects:**
+- Binary expressions using \`===\` or \`!==\` where either operand name matches:
+  - **Standalone:** \`secret\`, \`password\`, \`token\`, \`signature\`, \`jwt\`, \`hmac\`, \`bearer\`, \`apiKey\`, \`apiToken\`, \`apiSecret\`, \`accessToken\`, \`refreshToken\`, \`idToken\`, \`bearerToken\`, \`sessionToken\`, \`sessionId\`, \`csrfToken\`, \`signingKey\`, \`encryptionKey\`, \`privateKey\`, \`publicKey\`, \`secretKey\`, \`hmacKey\`, \`cookieSecret\`, \`webhookSignature\`, \`paymentSignature\`, \`passwordHash\`, \`authToken\` (case-insensitive)
+  - **Compound CamelCase:** a security-context prefix (\`secret\`, \`api\`, \`access\`, \`refresh\`, \`id\`, \`bearer\`, \`csrf\`, \`session\`, \`signing\`, \`encryption\`, \`private\`, \`public\`, \`password\`, \`jwt\`, \`oauth\`, \`auth\`, \`cookie\`, \`webhook\`, \`payment\`, \`hmac\`, \`otp\`, \`mfa\`) paired with a sensitive-data suffix (\`Key\`, \`Token\`, \`Secret\`, \`Hash\`, \`Hmac\`, \`Digest\`, \`Signature\`, \`Code\`, \`Cookie\`).
+- Excludes comparisons against literals, \`undefined\`, \`null\`, \`true\`, \`false\`, \`typeof\`, and safe property accesses (.length, .type, .status, .kind, .name, .id, .count, .size)
+- **Does NOT fire on** generic identity / cache / dedup hashes like \`cacheKey\`, \`bodyHash\`, \`ownerHash\`, \`contentHash\`, \`mapKey\` — both sides are locally computed, no attacker timing channel.
+
+**Why it matters:** Standard equality operators short-circuit on the first differing byte, leaking information about how much of a secret value matches. Attackers can reconstruct secrets one byte at a time using timing measurements.
+
+**False negatives:** If you compare a real secret under a name the heuristic doesn't recognize (e.g., a custom domain term), the check will miss it — switching to \`crypto.timingSafeEqual()\` everywhere you compare attacker-influenced values against trusted ones is the durable fix; this check is a tripwire, not a guarantee.
+
+**False positives:** If the check fires on a content-identity variable the heuristic doesn't yet skip, annotate with \`// @fitness-ignore-next-line unsafe-secret-comparison -- <reason>\` (preferred) or rename the variable to make the non-secret intent explicit.
+
+**Scope:** General best practice. Analyzes each file individually using TypeScript AST. Targets auth, middleware, token service, and crypto directories — i.e., wherever the project's targets attach a \`backend\` or \`server\` concern.`,
+    tags: ['security', 'timing-attack', 'crypto'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        const sourceFile = parseSource(content, filePath);
+        /* v8 ignore next -- defensive guard */
+        if (!sourceFile)
+            return [];
+        const violations = [];
+        walkNodes(sourceFile, (node) => {
+            if (ts.isBinaryExpression(node) &&
+                (node.operatorToken.kind === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+                    node.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken)) {
+                const secretName = findSecretOperand(node.left, node.right);
+                if (secretName) {
+                    const line = getLineNumber(node, sourceFile);
+                    const operator = node.operatorToken.kind === ts.SyntaxKind.EqualsEqualsEqualsToken ? '===' : '!==';
+                    violations.push({
+                        line,
+                        column: node.operatorToken.getStart() - node.getStart(),
+                        message: `Timing-unsafe ${operator} comparison on '${secretName}' — use crypto.timingSafeEqual() (Node.js built-in)`,
+                        severity: 'error',
+                        suggestion: `Replace \`a ${operator} b\` with \`${operator === '!==' ? '!' : ''}safeCompare(a, b)\` to prevent timing side-channel attacks.`,
+                        match: node.getText(),
+                        filePath,
+                    });
+                }
+            }
+        });
+        return violations;
+    },
+});
+//# sourceMappingURL=unsafe-secret-comparison.js.map

package/dist/checks/security/unsafe-secret-comparison.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafe-secret-comparison.js","sourceRoot":"","sources":["../../../src/checks/security/unsafe-secret-comparison.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,SAAS,EACT,gBAAgB,EAChB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,QAAQ;IACR,UAAU;IACV,OAAO;IACP,WAAW;IACX,KAAK;IACL,MAAM;IACN,QAAQ;IACR,WAAW;IACX,WAAW;IACX,cAAc;IACd,aAAa;IACb,cAAc;IACd,SAAS;IACT,aAAa;IACb,QAAQ;IACR,UAAU;IACV,WAAW;IACX,YAAY;IACZ,eAAe;IACf,YAAY;IACZ,WAAW;IACX,WAAW;IACX,SAAS;IACT,cAAc;IACd,kBAAkB;IAClB,kBAAkB;IAClB,cAAc;IACd,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,QAAQ;IACR,MAAM;IACN,SAAS;IACT,SAAS;IACT,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,UAAU;IACV,KAAK;IACL,OAAO;IACP,MAAM;IACN,QAAQ;IACR,SAAS;IACT,SAAS;IACT,MAAM;IACN,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,KAAK;IACL,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,QAAQ;IACR,WAAW;IACX,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAExC,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,+EAA+E;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,CACL,KAAK,CAAC,MAAM,IAAI,CAAC;QACjB,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,KAAK,SAAS;QAClB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,uBAAuB,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAE/E,8CAA8C;AAC9C,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEhG;;;GAGG;AACH,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,gDAAgD;IAChD,IAAI,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,gDAAgD;IAChD,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAElF,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,gDAAgD;IAChD,IAAI,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAa,EAAE,KAAc;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE3C,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAEjD,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEjD,oEAAoE;IACpE,IAAI,YAAY,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,gDAAgD;IAChD,IAAI,aAAa,IAAI,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,gDAAgD;IAChD,OAAO,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,0BAA0B;IAChC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAC9B,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,kEAAkE;IAC/E,eAAe,EAAE;;;;;;;;;;;;;;;2OAewN;IACzO,IAAI,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC;IAC7C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,uCAAuC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7B,IACE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;gBAC3B,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,uBAAuB;oBAChE,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,4BAA4B,CAAC,EACzE,CAAC;gBACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5D,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;oBAC7C,MAAM,QAAQ,GACZ,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;oBACpF,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI;wBACJ,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE;wBACvD,OAAO,EAAE,iBAAiB,QAAQ,mBAAmB,UAAU,qDAAqD;wBACpH,QAAQ,EAAE,OAAO;wBACjB,UAAU,EAAE,eAAe,QAAQ,eAAe,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,6DAA6D;wBAC5I,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;wBACrB,QAAQ;qBACT,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/testing/index.d.ts

@@ -0,0 +1,2 @@
+export * from './mock-implementations-in-production.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/checks/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/checks/testing/index.ts"],"names":[],"mappings":"AAAA,cAAc,yCAAyC,CAAC"}

package/dist/checks/testing/index.js

@@ -0,0 +1,2 @@
+export * from './mock-implementations-in-production.js';
+//# sourceMappingURL=index.js.map

package/dist/checks/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/checks/testing/index.ts"],"names":[],"mappings":"AAAA,cAAc,yCAAyC,CAAC"}

package/dist/checks/testing/mock-implementations-in-production.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview Detects mock, stub, or fake implementations in production code
+ *
+ * Mock implementations should only exist in test files, not production code.
+ */
+/**
+ * Check: testing/mock-implementations-in-production
+ *
+ * Detects mock, stub, or fake implementations in production code.
+ */
+export declare const mockImplementationsInProduction: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=mock-implementations-in-production.d.ts.map

package/dist/checks/testing/mock-implementations-in-production.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-implementations-in-production.d.ts","sourceRoot":"","sources":["../../../src/checks/testing/mock-implementations-in-production.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwMH;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,sCA6B1C,CAAC"}

package/dist/checks/testing/mock-implementations-in-production.js

@@ -0,0 +1,211 @@
+/**
+ * @fileoverview Detects mock, stub, or fake implementations in production code
+ *
+ * Mock implementations should only exist in test files, not production code.
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck, isTestFile } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/**
+ * Pre-compiled regex patterns for detecting mock implementations.
+ * These patterns are intentional and safe for static code analysis.
+ * Using explicit anchors and bounded quantifiers to prevent ReDoS.
+ */
+// Pattern: MockXxx or XxxMock class names (grouped for proper anchor precedence)
+const MOCK_CLASS_PATTERN = /^(?:(?:Mock|Fake|Stub|Dummy)[A-Z]|[A-Z]\w{0,100}(?:Mock|Fake|Stub|Dummy))$/;
+// Pattern: mock/fake/stub/dummy method names
+const MOCK_METHOD_PATTERN = /^(?:mock|fake|stub|dummy)/i;
+// Pattern: mock function names (grouped for proper anchor precedence)
+const MOCK_FUNCTION_PATTERN = /^(?:(?:mock|fake|stub|dummy)[A-Z]|create(?:Mock|Fake|Stub|Dummy))/i;
+// Pattern: stub implementations that throw "Not implemented" errors
+const STUB_IMPL_PATTERN = /throw new Error\(['"]Not implemented['"]\)/i;
+// Pattern: mock/test data returns - using bounded quantifier to prevent backtracking
+const MOCK_DATA_PATTERN = /return\s{0,10}\{[^}]{0,500}\b(?:mock|test|fake)\s{0,10}:/i;
+/**
+ * Check if a file should be analyzed for mock implementations
+ * @param filePath - Path to check
+ * @returns True if the file should be analyzed
+ */
+function shouldAnalyzeFile(filePath) {
+    logger.debug({
+        evt: 'fitness.checks.mock_in_production.should_analyze_file',
+        msg: 'Checking if file should be analyzed for mock implementations',
+    });
+    // Skip test files and test directories (mocks are allowed in tests)
+    if (isTestFile(filePath)) {
+        return false;
+    }
+    // Skip type definition files
+    if (filePath.endsWith('.d.ts')) {
+        return false;
+    }
+    // Only check TypeScript files
+    return filePath.endsWith('.ts') || filePath.endsWith('.tsx');
+}
+/**
+ * Analyze a file for mock implementations
+ */
+function analyzeFile(content, filePath) {
+    logger.debug({
+        evt: 'fitness.checks.mock_in_production.analyze_file',
+        msg: 'Analyzing file for mock implementations',
+    });
+    const violations = [];
+    if (!shouldAnalyzeFile(filePath)) {
+        return violations;
+    }
+    try {
+        const sourceFile = getSharedSourceFile(filePath, content);
+        /* v8 ignore next -- defensive guard */
+        if (!sourceFile)
+            return [];
+        const checkClassForMock = (node) => {
+            logger.debug({
+                evt: 'fitness.checks.mock_in_production.check_class_for_mock',
+                msg: 'Checking class declaration for mock patterns',
+            });
+            /* v8 ignore next -- defensive AST/type guard */
+            if (!node.name)
+                return;
+            const className = node.name.text;
+            // Check class name patterns
+            if (MOCK_CLASS_PATTERN.test(className)) {
+                const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                violations.push({
+                    line: line + 1,
+                    message: `Mock class '${className}' found in production code (should be in test files only)`,
+                    severity: 'error',
+                    type: 'mock-class',
+                    suggestion: `Move '${className}' to a test file (e.g., __tests__/unit/) or test utilities directory`,
+                    match: className,
+                });
+                return;
+            }
+            // Check if class has methods that return mock data
+            for (const member of node.members) {
+                if (ts.isMethodDeclaration(member) && ts.isIdentifier(member.name)) {
+                    checkMethodForMock(member, className, sourceFile);
+                }
+            }
+        };
+        const checkMethodForMock = (member, className, sf) => {
+            logger.debug({
+                evt: 'fitness.checks.mock_in_production.check_method_for_mock',
+                msg: 'Checking method declaration for mock patterns',
+            });
+            const methodName = member.name.text;
+            // Check for mock/stub methods
+            if (MOCK_METHOD_PATTERN.test(methodName)) {
+                const { line } = sf.getLineAndCharacterOfPosition(member.getStart());
+                violations.push({
+                    line: line + 1,
+                    message: `Mock method '${className}.${methodName}' found in production code`,
+                    severity: 'error',
+                    type: 'mock-function',
+                    suggestion: `Move '${methodName}' method to a test file or rename it to not use mock/fake/stub/dummy prefix`,
+                    match: methodName,
+                });
+            }
+            // Check method body for stub implementations
+            if (member.body) {
+                const bodyText = member.body.getText(sf);
+                // Check for "Not implemented" stub patterns
+                if (STUB_IMPL_PATTERN.test(bodyText)) {
+                    const { line } = sf.getLineAndCharacterOfPosition(member.getStart());
+                    violations.push({
+                        line: line + 1,
+                        message: `Stub implementation in '${className}.${methodName}' (throws "Not implemented")`,
+                        severity: 'error',
+                        type: 'stub-implementation',
+                        suggestion: `Implement the method '${methodName}' properly or move stub to test files if it's for testing only`,
+                        match: `${className}.${methodName}`,
+                    });
+                }
+                // Check for methods that always return mock data
+                if (MOCK_DATA_PATTERN.test(bodyText)) {
+                    const { line } = sf.getLineAndCharacterOfPosition(member.getStart());
+                    violations.push({
+                        line: line + 1,
+                        message: `Method '${className}.${methodName}' returns hardcoded mock/test data`,
+                        severity: 'error',
+                        type: 'fake-data',
+                        suggestion: `Replace hardcoded mock/test data in '${methodName}' with real implementation or move to test files`,
+                        match: `${className}.${methodName}`,
+                    });
+                }
+            }
+        };
+        const checkFunctionForMock = (node) => {
+            logger.debug({
+                evt: 'fitness.checks.mock_in_production.check_function_for_mock',
+                msg: 'Checking function declaration for mock patterns',
+            });
+            /* v8 ignore next -- defensive AST/type guard */
+            if (!node.name)
+                return;
+            const functionName = node.name.text;
+            // Check function name patterns
+            if (MOCK_FUNCTION_PATTERN.test(functionName)) {
+                const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                violations.push({
+                    line: line + 1,
+                    message: `Mock function '${functionName}' found in production code (should be in test utilities only)`,
+                    severity: 'error',
+                    type: 'mock-function',
+                    suggestion: `Move '${functionName}' to a test file (e.g., __tests__/unit/) or test utilities directory`,
+                    match: functionName,
+                });
+            }
+        };
+        const visit = (node) => {
+            if (ts.isClassDeclaration(node) && node.name) {
+                checkClassForMock(node);
+            }
+            if (ts.isFunctionDeclaration(node) && node.name) {
+                checkFunctionForMock(node);
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(sourceFile);
+        /* v8 ignore next 1 -- defensive catch: parse failures already handled */
+    }
+    catch {
+        // @swallow-ok If AST parsing fails, skip this file
+    }
+    return violations;
+}
+/**
+ * Check: testing/mock-implementations-in-production
+ *
+ * Detects mock, stub, or fake implementations in production code.
+ */
+export const mockImplementationsInProduction = defineCheck({
+    id: 'f7507280-993b-4dde-9270-52b30478cca8',
+    slug: 'mock-implementations-in-production',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    // 'raw', not 'strip-strings': STUB_IMPL_PATTERN matches the exact sentinel
+    // string inside `throw new Error("Not implemented")` (and MOCK_DATA looks
+    // for keys in object returns). Stripping blanks the string content in the
+    // parsed source used for body.getText(), so the patterns would never match
+    // even for real placeholder stubs in prod code.
+    contentFilter: 'raw',
+    confidence: 'high',
+    description: 'Detects mock, stub, or fake implementations in production code',
+    longDescription: `**Purpose:** Ensures mock, stub, fake, and dummy implementations exist only in test files, not in production source code.
+
+**Detects:**
+- Classes named with Mock/Fake/Stub/Dummy prefixes or suffixes via \`/^(?:(?:Mock|Fake|Stub|Dummy)[A-Z]|[A-Z]\\w{0,100}(?:Mock|Fake|Stub|Dummy))$/\`
+- Methods prefixed with mock/fake/stub/dummy via \`/^(?:mock|fake|stub|dummy)/i\`
+- Functions named \`mockXxx\`, \`fakeXxx\`, \`createMock\`, \`createFake\`, etc. via \`/^(?:(?:mock|fake|stub|dummy)[A-Z]|create(?:Mock|Fake|Stub|Dummy))/i\`
+- Stub methods that \`throw new Error('Not implemented')\`
+- Methods returning hardcoded objects with \`mock\`, \`test\`, or \`fake\` keys
+
+**Why it matters:** Mock implementations in production code indicate incomplete refactoring or testing artifacts leaking into shipped code, leading to unreliable runtime behavior.
+
+**Scope:** General best practice. Analyzes each file individually via TypeScript AST parsing, skipping test files, \`.d.ts\` files, and excluded test directories.`,
+    tags: ['testing', 'code-quality'],
+    fileTypes: ['ts', 'tsx'],
+    analyze: analyzeFile,
+});
+//# sourceMappingURL=mock-implementations-in-production.js.map

package/dist/checks/testing/mock-implementations-in-production.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-implementations-in-production.js","sourceRoot":"","sources":["../../../src/checks/testing/mock-implementations-in-production.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC;;;;GAIG;AACH,iFAAiF;AACjF,MAAM,kBAAkB,GACtB,4EAA4E,CAAC;AAC/E,6CAA6C;AAC7C,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AACzD,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,oEAAoE,CAAC;AACnG,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,6CAA6C,CAAC;AACxE,qFAAqF;AACrF,MAAM,iBAAiB,GAAG,2DAA2D,CAAC;AAEtF;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,uDAAuD;QAC5D,GAAG,EAAE,8DAA8D;KACpE,CAAC,CAAC;IACH,oEAAoE;IACpE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6BAA6B;IAC7B,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8BAA8B;IAC9B,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,QAAgB;IACpD,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,gDAAgD;QACrD,GAAG,EAAE,yCAAyC;KAC/C,CAAC,CAAC;IACH,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1D,uCAAuC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,iBAAiB,GAAG,CAAC,IAAyB,EAAQ,EAAE;YAC5D,MAAM,CAAC,KAAK,CAAC;gBACX,GAAG,EAAE,wDAAwD;gBAC7D,GAAG,EAAE,8CAA8C;aACpD,CAAC,CAAC;YACH,gDAAgD;YAChD,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO;YAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAEjC,4BAA4B;YAC5B,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC3E,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,IAAI,GAAG,CAAC;oBACd,OAAO,EAAE,eAAe,SAAS,2DAA2D;oBAC5F,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,SAAS,SAAS,sEAAsE;oBACpG,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,mDAAmD;YACnD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnE,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,kBAAkB,GAAG,CACzB,MAA4B,EAC5B,SAAiB,EACjB,EAAiB,EACX,EAAE;YACR,MAAM,CAAC,KAAK,CAAC;gBACX,GAAG,EAAE,yDAAyD;gBAC9D,GAAG,EAAE,+CAA+C;aACrD,CAAC,CAAC;YACH,MAAM,UAAU,GAAI,MAAM,CAAC,IAAsB,CAAC,IAAI,CAAC;YAEvD,8BAA8B;YAC9B,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACrE,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,IAAI,GAAG,CAAC;oBACd,OAAO,EAAE,gBAAgB,SAAS,IAAI,UAAU,4BAA4B;oBAC5E,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,eAAe;oBACrB,UAAU,EAAE,SAAS,UAAU,6EAA6E;oBAC5G,KAAK,EAAE,UAAU;iBAClB,CAAC,CAAC;YACL,CAAC;YAED,6CAA6C;YAC7C,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAEzC,4CAA4C;gBAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACrC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACrE,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,IAAI,GAAG,CAAC;wBACd,OAAO,EAAE,2BAA2B,SAAS,IAAI,UAAU,8BAA8B;wBACzF,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,qBAAqB;wBAC3B,UAAU,EAAE,yBAAyB,UAAU,gEAAgE;wBAC/G,KAAK,EAAE,GAAG,SAAS,IAAI,UAAU,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;gBAED,iDAAiD;gBACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACrC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACrE,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,IAAI,GAAG,CAAC;wBACd,OAAO,EAAE,WAAW,SAAS,IAAI,UAAU,oCAAoC;wBAC/E,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,WAAW;wBACjB,UAAU,EAAE,wCAAwC,UAAU,kDAAkD;wBAChH,KAAK,EAAE,GAAG,SAAS,IAAI,UAAU,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,oBAAoB,GAAG,CAAC,IAA4B,EAAQ,EAAE;YAClE,MAAM,CAAC,KAAK,CAAC;gBACX,GAAG,EAAE,2DAA2D;gBAChE,GAAG,EAAE,iDAAiD;aACvD,CAAC,CAAC;YACH,gDAAgD;YAChD,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO;YAEvB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAEpC,+BAA+B;YAC/B,IAAI,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC3E,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,IAAI,GAAG,CAAC;oBACd,OAAO,EAAE,kBAAkB,YAAY,+DAA+D;oBACtG,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,eAAe;oBACrB,UAAU,EAAE,SAAS,YAAY,sEAAsE;oBACvG,KAAK,EAAE,YAAY;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;YACpC,IAAI,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC7C,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAED,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAChD,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,yEAAyE;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAC;IACzD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,oCAAoC;IAC1C,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,gDAAgD;IAChD,aAAa,EAAE,KAAK;IAEpB,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,gEAAgE;IAC7E,eAAe,EAAE;;;;;;;;;;;mKAWgJ;IACjK,IAAI,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC;IACjC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IAExB,OAAO,EAAE,WAAW;CACrB,CAAC,CAAC"}

package/dist/display/architecture.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview Display entries for TypeScript-specific architecture checks
+ */
+import type { CheckDisplayEntry } from './types.js';
+/** Architecture check display entries (TS_AST only) */
+export declare const ARCHITECTURE_DISPLAY: Readonly<Record<string, CheckDisplayEntry>>;
+/** No documentation TS_AST checks; export empty object for symmetry */
+export declare const DOCUMENTATION_DISPLAY: Readonly<Record<string, CheckDisplayEntry>>;
+//# sourceMappingURL=architecture.d.ts.map

package/dist/display/architecture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"architecture.d.ts","sourceRoot":"","sources":["../../src/display/architecture.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,6CAU/B,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,6CAAuD,CAAC"}

package/dist/display/architecture.js

@@ -0,0 +1,18 @@
+/**
+ * @fileoverview Display entries for TypeScript-specific architecture checks
+ */
+/** Architecture check display entries (TS_AST only) */
+export const ARCHITECTURE_DISPLAY = Object.freeze({
+    'circular-import-detection': ['🔁', 'Circular Import Detection'],
+    'contracts-schema-consistency': ['📋', 'Contracts Schema Consistency'],
+    'drizzle-orm-migration-guardrails': ['🛡️', 'Drizzle ORM Migration Guardrails'],
+    'missing-type-exports': ['📤', 'Missing Type Exports'],
+    'module-coupling-fan-out': ['🕸️', 'Module Coupling Fan-Out'],
+    'no-bootstrap-tool-import': ['🔌', 'No Bootstrap Tool Import'],
+    'package-json-exports-field': ['📦', 'package.json Exports Field'],
+    'phantom-dependency-detection': ['📦', 'Phantom Dependency Detection'],
+    'tsconfig-extends-validation': ['⚙️', 'tsconfig Extends Validation'],
+});
+/** No documentation TS_AST checks; export empty object for symmetry */
+export const DOCUMENTATION_DISPLAY = Object.freeze({});
+//# sourceMappingURL=architecture.js.map

package/dist/display/architecture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"architecture.js","sourceRoot":"","sources":["../../src/display/architecture.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAoC;IACnF,2BAA2B,EAAE,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAChE,8BAA8B,EAAE,CAAC,IAAI,EAAE,8BAA8B,CAAC;IACtE,kCAAkC,EAAE,CAAC,KAAK,EAAE,kCAAkC,CAAC;IAC/E,sBAAsB,EAAE,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtD,yBAAyB,EAAE,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC7D,0BAA0B,EAAE,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC9D,4BAA4B,EAAE,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAClE,8BAA8B,EAAE,CAAC,IAAI,EAAE,8BAA8B,CAAC;IACtE,6BAA6B,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC;CACrE,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAoC,EAAE,CAAC,CAAC"}

package/dist/display/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @fileoverview Display configuration for fitness checks
+ *
+ * Maps check slugs to display entries (icon + display name) for CLI and dashboard output.
+ * Falls back to kebab-to-title-case conversion for unknown slugs.
+ *
+ * The lookup logic itself lives in @opensip-cli/fitness/check-utils; this
+ * file owns only the per-pack CHECK_DISPLAY map and binds the shared helpers
+ * to it.
+ */
+import type { CheckDisplayEntry } from './types.js';
+/** Combined check display configuration */
+export declare const CHECK_DISPLAY: Readonly<Record<string, CheckDisplayEntry>>;
+/**
+ * Slug-only display lookups bound to this pack's CHECK_DISPLAY map. The lookup
+ * logic lives in @opensip-cli/fitness; this file owns only the data.
+ */
+export declare const getCheckIcon: (checkSlug: string) => string, getCheckDisplayName: (checkSlug: string) => string;
+export { type CheckDisplayEntry } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/display/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/display/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,2CAA2C;AAC3C,eAAO,MAAM,aAAa,6CAOxB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAQ,YAAY,iCAAE,mBAAmB,+BAAsC,CAAC;AAEvF,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC"}

package/dist/display/index.js

@@ -0,0 +1,30 @@
+/**
+ * @fileoverview Display configuration for fitness checks
+ *
+ * Maps check slugs to display entries (icon + display name) for CLI and dashboard output.
+ * Falls back to kebab-to-title-case conversion for unknown slugs.
+ *
+ * The lookup logic itself lives in @opensip-cli/fitness/check-utils; this
+ * file owns only the per-pack CHECK_DISPLAY map and binds the shared helpers
+ * to it.
+ */
+import { makeDisplayHelpers } from '@opensip-cli/fitness';
+import { ARCHITECTURE_DISPLAY, DOCUMENTATION_DISPLAY } from './architecture.js';
+import { QUALITY_DISPLAY } from './quality.js';
+import { RESILIENCE_DISPLAY } from './resilience.js';
+import { SECURITY_DISPLAY, TESTING_DISPLAY } from './security-testing.js';
+/** Combined check display configuration */
+export const CHECK_DISPLAY = Object.freeze({
+    ...ARCHITECTURE_DISPLAY,
+    ...DOCUMENTATION_DISPLAY,
+    ...QUALITY_DISPLAY,
+    ...RESILIENCE_DISPLAY,
+    ...SECURITY_DISPLAY,
+    ...TESTING_DISPLAY,
+});
+/**
+ * Slug-only display lookups bound to this pack's CHECK_DISPLAY map. The lookup
+ * logic lives in @opensip-cli/fitness; this file owns only the data.
+ */
+export const { getCheckIcon, getCheckDisplayName } = makeDisplayHelpers(CHECK_DISPLAY);
+//# sourceMappingURL=index.js.map

package/dist/display/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/display/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI1E,2CAA2C;AAC3C,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAoC;IAC5E,GAAG,oBAAoB;IACvB,GAAG,qBAAqB;IACxB,GAAG,eAAe;IAClB,GAAG,kBAAkB;IACrB,GAAG,gBAAgB;IACnB,GAAG,eAAe;CACnB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC"}

package/dist/display/quality.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @fileoverview Display entries for TypeScript-specific quality checks
+ */
+import type { CheckDisplayEntry } from './types.js';
+/** Quality check display entries (TS_AST only, sorted alphabetically by slug) */
+export declare const QUALITY_DISPLAY: Readonly<Record<string, CheckDisplayEntry>>;
+//# sourceMappingURL=quality.d.ts.map

package/dist/display/quality.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality.d.ts","sourceRoot":"","sources":["../../src/display/quality.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,iFAAiF;AACjF,eAAO,MAAM,eAAe,6CAiC1B,CAAC"}

package/dist/display/quality.js

@@ -0,0 +1,39 @@
+/**
+ * @fileoverview Display entries for TypeScript-specific quality checks
+ */
+/** Quality check display entries (TS_AST only, sorted alphabetically by slug) */
+export const QUALITY_DISPLAY = Object.freeze({
+    'a11y-form-labels': ['♿', 'A11y Form Labels'],
+    'a11y-semantic-html': ['♿', 'A11y Semantic HTML'],
+    'api-contract-validation': ['🔌', 'API Contract Validation'],
+    'api-response-validation': ['🔌', 'API Response Validation'],
+    'array-validation': ['📦', 'Array Parameter Validation'],
+    'async-waterfall-detection': ['⚡', 'Async Waterfall Detection'],
+    'database-index-coverage': ['🗄️', 'Database Index Coverage'],
+    'database-schema-validation': ['🗄️', 'Database Schema Validation'],
+    'dispose-pattern-completeness': ['🧹', 'Dispose Pattern Completeness'],
+    'duplicate-utility-functions': ['🔍', 'Duplicate Utility Functions'],
+    'error-handling-quality': ['⚠️', 'Error Handling Quality'],
+    'fastify-route-validation': ['🔌', 'Fastify Route Validation'],
+    'fastify-schema-coverage': ['🔌', 'Fastify Schema Coverage'],
+    'in-memory-repository-detection': ['💾', 'In-Memory Repository Detection'],
+    'incomplete-regex-escaping': ['🔒', 'Incomplete Regex Escaping'],
+    'lifecycle-cleanup-enforcement': ['🧹', 'Lifecycle Cleanup Enforcement'],
+    'logger-event-name-format': ['📊', 'Logger Event Name Format'],
+    'missing-input-validation': ['🛡️', 'Missing Input Validation'],
+    'no-any-types': ['📘', 'No Any Types'],
+    'no-hardcoded-correlation-id': ['🔗', 'No Hardcoded Correlation Id'],
+    'null-safety': ['🛡️', 'Null/Undefined Safety'],
+    'numeric-validation': ['🔢', 'Numeric Parameter Validation'],
+    'pii-exposure-in-logs': ['🔒', 'PII Exposure in Logs'],
+    'result-pattern-consistency': ['📋', 'Result Pattern Consistency'],
+    'silent-early-returns': ['🔍', 'Silent Early Returns'],
+    'stream-buffer-size-limits': ['🛡️', 'Stream Buffer Size Limits'],
+    'stubbed-implementation-detection': ['🔍', 'Stubbed Implementation Detection'],
+    'test-only-frontend-modules': ['🧪', 'Test-Only Frontend Modules'],
+    'throws-documentation': ['📝', 'Missing @throws JSDoc Detection'],
+    'toctou-race-condition': ['⚡', 'TOCTOU Race Condition Detection'],
+    'typescript-frontend': ['📘', 'TypeScript Frontend'],
+    'unused-config-options': ['⚙️', 'Unused Configuration Options'],
+});
+//# sourceMappingURL=quality.js.map