@opensip-cli/checks-universal 0.1.0

package/dist/checks/resilience/dangerous-config-defaults.js

@@ -0,0 +1,304 @@
+// @fitness-ignore-file batch-operation-limits -- iterates bounded collections (config entries, registry items, or small analysis results)
+// @fitness-ignore-file unsafe-secret-comparison -- keyIndex comparisons are search index positions, not cryptographic keys
+// @fitness-ignore-file dangerous-config-defaults -- Fitness check definition references config patterns in longDescription, not actual configuration
+/**
+ * @fileoverview Dangerous configuration defaults check
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck, isTestFile, getLineNumber } from '@opensip-cli/fitness';
+import { isDigit, isAlphanumericChar } from './_helpers/config-validation.js';
+// =============================================================================
+// PATTERN CHECKERS
+// =============================================================================
+/**
+ * Extract assignment part after a config key.
+ */
+function extractAssignment(afterKey, expectedValue) {
+    logger.debug({
+        evt: 'fitness.checks.dangerous_config_defaults.extract_assignment',
+        msg: 'Extracting assignment part after config key',
+    });
+    let i = 0;
+    while (i < afterKey.length && (afterKey[i] === ' ' || afterKey[i] === '\t')) {
+        i++;
+    }
+    if (afterKey[i] !== '=' && afterKey[i] !== ':') {
+        return null;
+    }
+    i++;
+    while (i < afterKey.length && (afterKey[i] === ' ' || afterKey[i] === '\t')) {
+        i++;
+    }
+    const remaining = afterKey.slice(Math.max(0, i));
+    if (remaining.toLowerCase().startsWith(expectedValue.toLowerCase())) {
+        const nextChar = remaining[expectedValue.length];
+        if (!nextChar || !isAlphanumericChar(nextChar)) {
+            return afterKey.slice(0, Math.max(0, i + expectedValue.length));
+        }
+    }
+    return null;
+}
+/**
+ * Creates a config pattern checker using string search.
+ * This avoids regex safety warnings from SonarJS.
+ */
+function createConfigChecker(options) {
+    const { configKey, expectedValue, message, suggestion, severity } = options;
+    return {
+        check(content) {
+            logger.debug({
+                evt: 'fitness.checks.dangerous_config_defaults.config_checker_check',
+                msg: 'Checking content for dangerous config pattern matches',
+            });
+            const results = [];
+            const lowerContent = content.toLowerCase();
+            const lowerKey = configKey.toLowerCase();
+            let searchStart = 0;
+            for (;;) {
+                const keyIndex = lowerContent.indexOf(lowerKey, searchStart);
+                if (keyIndex === -1)
+                    break;
+                const afterKey = content.slice(Math.max(0, keyIndex + configKey.length));
+                const assignMatch = extractAssignment(afterKey, expectedValue);
+                if (assignMatch) {
+                    const fullMatch = content.slice(keyIndex, keyIndex + configKey.length + assignMatch.length);
+                    results.push({ index: keyIndex, match: fullMatch });
+                }
+                searchStart = keyIndex + 1;
+            }
+            return results;
+        },
+        message,
+        suggestion,
+        severity,
+    };
+}
+/**
+ * Extract TLS assignment value (0 with optional quotes).
+ */
+function extractTlsAssignment(afterKey) {
+    logger.debug({
+        evt: 'fitness.checks.dangerous_config_defaults.extract_tls_assignment',
+        msg: 'Extracting TLS assignment value with optional quotes',
+    });
+    let i = 0;
+    while (i < afterKey.length && (afterKey[i] === ' ' || afterKey[i] === '\t')) {
+        i++;
+    }
+    if (afterKey[i] !== '=' && afterKey[i] !== ':') {
+        return null;
+    }
+    i++;
+    while (i < afterKey.length && (afterKey[i] === ' ' || afterKey[i] === '\t')) {
+        i++;
+    }
+    const hasQuote = afterKey[i] === '"' || afterKey[i] === "'";
+    if (hasQuote)
+        i++;
+    if (afterKey[i] !== '0') {
+        return null;
+    }
+    i++;
+    if (hasQuote && (afterKey[i] === '"' || afterKey[i] === "'")) {
+        i++;
+    }
+    return afterKey.slice(0, Math.max(0, i));
+}
+/**
+ * Check for TLS reject unauthorized env var set to disabled (with optional quotes).
+ */
+// @fitness-ignore-next-line dangerous-config-defaults -- This is the fitness check definition itself; the string literal 'node_tls_reject_unauthorized' is the pattern being detected, not actual TLS configuration
+function createTlsRejectChecker() {
+    return {
+        check(content) {
+            logger.debug({
+                evt: 'fitness.checks.dangerous_config_defaults.tls_reject_checker_check',
+                msg: 'Checking content for TLS reject unauthorized patterns',
+            });
+            const results = [];
+            const lowerContent = content.toLowerCase();
+            const key = 'node_tls_reject_unauthorized';
+            let searchStart = 0;
+            for (;;) {
+                const keyIndex = lowerContent.indexOf(key, searchStart);
+                if (keyIndex === -1)
+                    break;
+                const afterKey = content.slice(Math.max(0, keyIndex + key.length));
+                const assignMatch = extractTlsAssignment(afterKey);
+                if (assignMatch) {
+                    const fullMatch = content.slice(keyIndex, keyIndex + key.length + assignMatch.length);
+                    results.push({ index: keyIndex, match: fullMatch });
+                }
+                searchStart = keyIndex + 1;
+            }
+            return results;
+        },
+        message: 'TLS validation globally disabled via environment',
+        suggestion: 'Remove this setting - it disables all TLS security',
+        severity: 'error',
+    };
+}
+/**
+ * Check for very small connection pool sizes (1 or 2).
+ */
+// @fitness-ignore-next-line dangerous-config-defaults -- This is the fitness check definition itself; the string literal 'poolsize' is the pattern being detected, not actual pool configuration
+function createPoolSizeChecker() {
+    return {
+        check(content) {
+            logger.debug({
+                evt: 'fitness.checks.dangerous_config_defaults.pool_size_checker_check',
+                msg: 'Checking content for small connection pool size patterns',
+            });
+            const results = [];
+            const lowerContent = content.toLowerCase();
+            let searchStart = 0;
+            for (;;) {
+                const keyIndex = lowerContent.indexOf('poolsize', searchStart);
+                if (keyIndex === -1)
+                    break;
+                const afterKey = content.slice(Math.max(0, keyIndex + 8));
+                const assignMatch = extractPoolSizeAssignment(afterKey);
+                if (assignMatch) {
+                    const fullMatch = content.slice(keyIndex, keyIndex + 8 + assignMatch.length);
+                    results.push({ index: keyIndex, match: fullMatch });
+                }
+                searchStart = keyIndex + 1;
+            }
+            return results;
+        },
+        message: 'Very small connection pool size',
+        suggestion: 'Consider larger pool size for production workloads',
+        severity: 'warning',
+    };
+}
+function extractPoolSizeAssignment(afterKey) {
+    logger.debug({
+        evt: 'fitness.checks.dangerous_config_defaults.extract_pool_size_assignment',
+        msg: 'Extracting pool size assignment value',
+    });
+    let i = 0;
+    while (i < afterKey.length && (afterKey[i] === ' ' || afterKey[i] === '\t')) {
+        i++;
+    }
+    if (afterKey[i] !== '=' && afterKey[i] !== ':') {
+        return null;
+    }
+    i++;
+    while (i < afterKey.length && (afterKey[i] === ' ' || afterKey[i] === '\t')) {
+        i++;
+    }
+    if (afterKey[i] === '1' || afterKey[i] === '2') {
+        const nextChar = afterKey[i + 1];
+        if (!nextChar || !isDigit(nextChar)) {
+            return afterKey.slice(0, Math.max(0, i + 1));
+        }
+    }
+    return null;
+}
+// =============================================================================
+// DANGEROUS DEFAULTS PATTERNS
+// =============================================================================
+/**
+ * Patterns for dangerous default configurations
+ */
+const DANGEROUS_DEFAULTS = [
+    createConfigChecker({
+        configKey: 'ssl',
+        expectedValue: 'false',
+        message: 'SSL disabled in configuration',
+        suggestion: 'Enable SSL for all database and service connections',
+        severity: 'error',
+    }),
+    createConfigChecker({
+        configKey: 'rejectUnauthorized',
+        expectedValue: 'false',
+        message: 'TLS certificate validation disabled',
+        suggestion: 'Enable certificate validation in production',
+        severity: 'error',
+    }),
+    createTlsRejectChecker(),
+    createConfigChecker({
+        configKey: 'debug',
+        expectedValue: 'true',
+        message: 'Debug mode enabled in configuration',
+        suggestion: 'Ensure debug mode is disabled in production',
+        severity: 'warning',
+    }),
+    createConfigChecker({
+        configKey: 'maxRetries',
+        expectedValue: '0',
+        message: 'Zero retries configured - no fault tolerance',
+        suggestion: 'Configure at least 1-3 retries for resilience',
+        severity: 'warning',
+    }),
+    createConfigChecker({
+        configKey: 'timeout',
+        expectedValue: '0',
+        message: 'Zero timeout configured - operations may hang indefinitely',
+        suggestion: 'Set appropriate timeout values',
+        severity: 'error',
+    }),
+    createPoolSizeChecker(),
+];
+// =============================================================================
+// CHECK DEFINITION
+// =============================================================================
+/**
+ * Check: resilience/dangerous-config-defaults
+ *
+ * Detects potentially dangerous configuration defaults that could
+ * compromise security or reliability.
+ */
+export const dangerousConfigDefaults = defineCheck({
+    id: '81e6dbfc-b755-4c65-a62b-ffd244542129',
+    slug: 'dangerous-config-defaults',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    confidence: 'medium',
+    description: 'Detect dangerous default configurations',
+    longDescription: `**Purpose:** Catches configuration defaults that compromise security or reliability if accidentally deployed to production.
+
+**Detects:**
+- \`ssl = false\` (SSL disabled)
+- \`rejectUnauthorized = false\` (TLS certificate validation disabled)
+- \`NODE_TLS_REJECT_UNAUTHORIZED = 0\` (global TLS validation disabled, with optional quotes)
+- \`debug = true\` (debug mode enabled)
+- \`maxRetries = 0\` (no fault tolerance)
+- \`timeout = 0\` (operations may hang indefinitely)
+- \`poolSize = 1\` or \`poolSize = 2\` (very small connection pool)
+
+**Why it matters:** These defaults can silently disable security controls or remove fault tolerance, causing outages or vulnerabilities in production.
+
+**Scope:** General best practice. Analyzes each file individually via string matching.`,
+    tags: ['resilience', 'security', 'config'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        // Test fixtures intentionally exercise dangerous defaults (debug:true,
+        // zero retries, SSL disabled, etc.) to verify the check's detection
+        // logic. These are not production config — skip to avoid noise.
+        if (isTestFile(filePath))
+            return [];
+        logger.debug({
+            evt: 'fitness.checks.dangerous_config_defaults.analyze',
+            msg: 'Analyzing file for dangerous configuration defaults',
+        });
+        const violations = [];
+        for (const checker of DANGEROUS_DEFAULTS) {
+            const matches = checker.check(content);
+            for (const { index, match } of matches) {
+                const lineNumber = getLineNumber(content, index);
+                violations.push({
+                    line: lineNumber,
+                    column: 0,
+                    message: checker.message,
+                    severity: checker.severity,
+                    suggestion: checker.suggestion,
+                    match,
+                    type: 'dangerous-config',
+                    filePath,
+                });
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=dangerous-config-defaults.js.map

package/dist/checks/resilience/dangerous-config-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dangerous-config-defaults.js","sourceRoot":"","sources":["../../../src/checks/resilience/dangerous-config-defaults.ts"],"names":[],"mappings":"AAAA,0IAA0I;AAC1I,2HAA2H;AAC3H,qJAAqJ;AACrJ;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEnG,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AA4B9E,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,aAAqB;IAChE,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,6DAA6D;QAClE,GAAG,EAAE,6CAA6C;KACnD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,CAAC,EAAE,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,CAAC,EAAE,CAAC;IAEJ,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,CAAC,EAAE,CAAC;IACN,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,OAAmC;IAC9D,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC5E,OAAO;QACL,KAAK,CAAC,OAAe;YACnB,MAAM,CAAC,KAAK,CAAC;gBACX,GAAG,EAAE,+DAA+D;gBACpE,GAAG,EAAE,uDAAuD;aAC7D,CAAC,CAAC;YACH,MAAM,OAAO,GAAuC,EAAE,CAAC;YACvD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACzC,IAAI,WAAW,GAAG,CAAC,CAAC;YAEpB,SAAS,CAAC;gBACR,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBAC7D,IAAI,QAAQ,KAAK,CAAC,CAAC;oBAAE,MAAM;gBAE3B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACzE,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;gBAE/D,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAC7B,QAAQ,EACR,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CACjD,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBACtD,CAAC;gBAED,WAAW,GAAG,QAAQ,GAAG,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO;QACP,UAAU;QACV,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,iEAAiE;QACtE,GAAG,EAAE,sDAAsD;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,CAAC,EAAE,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,CAAC,EAAE,CAAC;IAEJ,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,CAAC,EAAE,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;IAC5D,IAAI,QAAQ;QAAE,CAAC,EAAE,CAAC;IAElB,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,CAAC,EAAE,CAAC;IAEJ,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC7D,CAAC,EAAE,CAAC;IACN,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,oNAAoN;AACpN,SAAS,sBAAsB;IAC7B,OAAO;QACL,KAAK,CAAC,OAAe;YACnB,MAAM,CAAC,KAAK,CAAC;gBACX,GAAG,EAAE,mEAAmE;gBACxE,GAAG,EAAE,uDAAuD;aAC7D,CAAC,CAAC;YACH,MAAM,OAAO,GAAuC,EAAE,CAAC;YACvD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,8BAA8B,CAAC;YAC3C,IAAI,WAAW,GAAG,CAAC,CAAC;YAEpB,SAAS,CAAC;gBACR,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBACxD,IAAI,QAAQ,KAAK,CAAC,CAAC;oBAAE,MAAM;gBAE3B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnE,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBAEnD,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;oBACtF,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBACtD,CAAC;gBAED,WAAW,GAAG,QAAQ,GAAG,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,kDAAkD;QAC3D,UAAU,EAAE,oDAAoD;QAChE,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,iMAAiM;AACjM,SAAS,qBAAqB;IAC5B,OAAO;QACL,KAAK,CAAC,OAAe;YACnB,MAAM,CAAC,KAAK,CAAC;gBACX,GAAG,EAAE,kEAAkE;gBACvE,GAAG,EAAE,0DAA0D;aAChE,CAAC,CAAC;YACH,MAAM,OAAO,GAAuC,EAAE,CAAC;YACvD,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,WAAW,GAAG,CAAC,CAAC;YAEpB,SAAS,CAAC;gBACR,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBAC/D,IAAI,QAAQ,KAAK,CAAC,CAAC;oBAAE,MAAM;gBAE3B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC1D,MAAM,WAAW,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;gBAExD,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;oBAC7E,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBACtD,CAAC;gBAED,WAAW,GAAG,QAAQ,GAAG,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,iCAAiC;QAC1C,UAAU,EAAE,oDAAoD;QAChE,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IACjD,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,uEAAuE;QAC5E,GAAG,EAAE,uCAAuC;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,CAAC,EAAE,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,CAAC,EAAE,CAAC;IAEJ,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,CAAC,EAAE,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,kBAAkB,GAA2B;IACjD,mBAAmB,CAAC;QAClB,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,OAAO;QACtB,OAAO,EAAE,+BAA+B;QACxC,UAAU,EAAE,qDAAqD;QACjE,QAAQ,EAAE,OAAO;KAClB,CAAC;IACF,mBAAmB,CAAC;QAClB,SAAS,EAAE,oBAAoB;QAC/B,aAAa,EAAE,OAAO;QACtB,OAAO,EAAE,qCAAqC;QAC9C,UAAU,EAAE,6CAA6C;QACzD,QAAQ,EAAE,OAAO;KAClB,CAAC;IACF,sBAAsB,EAAE;IACxB,mBAAmB,CAAC;QAClB,SAAS,EAAE,OAAO;QAClB,aAAa,EAAE,MAAM;QACrB,OAAO,EAAE,qCAAqC;QAC9C,UAAU,EAAE,6CAA6C;QACzD,QAAQ,EAAE,SAAS;KACpB,CAAC;IACF,mBAAmB,CAAC;QAClB,SAAS,EAAE,YAAY;QACvB,aAAa,EAAE,GAAG;QAClB,OAAO,EAAE,8CAA8C;QACvD,UAAU,EAAE,+CAA+C;QAC3D,QAAQ,EAAE,SAAS;KACpB,CAAC;IACF,mBAAmB,CAAC;QAClB,SAAS,EAAE,SAAS;QACpB,aAAa,EAAE,GAAG;QAClB,OAAO,EAAE,4DAA4D;QACrE,UAAU,EAAE,gCAAgC;QAC5C,QAAQ,EAAE,OAAO;KAClB,CAAC;IACF,qBAAqB,EAAE;CACxB,CAAC;AAEF,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,2BAA2B;IACjC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IAErE,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,yCAAyC;IACtD,eAAe,EAAE;;;;;;;;;;;;;uFAaoE;IACrF,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC;IAC1C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpC,MAAM,CAAC,KAAK,CAAC;YACX,GAAG,EAAE,kDAAkD;YACvD,GAAG,EAAE,qDAAqD;SAC3D,CAAC,CAAC;QACH,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;gBACvC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,KAAK;oBACL,IAAI,EAAE,kBAAkB;oBACxB,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/resilience/error-code-registration.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @fileoverview Error code registration check
+ */
+/**
+ * Check: resilience/error-code-registration
+ *
+ * Validates that error codes used in code are registered in
+ * an error registry file (error-codes.ts, errors.ts, etc.)
+ */
+export declare const errorCodeRegistration: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=error-code-registration.d.ts.map

package/dist/checks/resilience/error-code-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-code-registration.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/error-code-registration.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,sCAoFhC,CAAC"}

package/dist/checks/resilience/error-code-registration.js

@@ -0,0 +1,88 @@
+/**
+ * @fileoverview Error code registration check
+ */
+import { defineCheck } from '@opensip-cli/fitness';
+/**
+ * Check: resilience/error-code-registration
+ *
+ * Validates that error codes used in code are registered in
+ * an error registry file (error-codes.ts, errors.ts, etc.)
+ */
+export const errorCodeRegistration = defineCheck({
+    id: '346b53d8-58a3-4fd5-8340-d7bd42da406a',
+    slug: 'error-code-registration',
+    disabled: true,
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Validates that error codes used in code are registered in an error registry file',
+    longDescription: `**Purpose:** Ensures all error codes used in the codebase are registered in a central error registry file, enabling error catalogs, monitoring, and consistent conventions.
+
+**Detects:**
+- Error codes (DOMAIN.CATEGORY.SPECIFIC format) used in \`code:\` or \`errorCode:\` properties that are not defined in any error-codes.ts, errors.ts, or error-registry.ts file
+
+**Why it matters:** Unregistered error codes make centralized error catalogs incomplete, complicate monitoring, and lead to ad-hoc codes that don't follow conventions.
+
+**Scope:** Backend code. Analyzes all matched files together (\`analyzeAll\`) to correlate error code usage with registry definitions.`,
+    tags: ['errors', 'resilience', 'consistency'],
+    fileTypes: ['ts'],
+    // eslint-disable-next-line sonarjs/cognitive-complexity -- Inherent complexity: two-phase analysis collecting registered codes from registry files, then scanning all files for unregistered usage
+    async analyzeAll(files) {
+        const violations = [];
+        // Phase 1: Collect all registered error codes from registry files
+        const registeredCodes = new Set();
+        const registryFilePattern = /(?:error-codes|error-registry|errors)\.ts$/;
+        const registryPaths = files.paths.filter((fp) => registryFilePattern.test(fp));
+        // @fitness-ignore-next-line no-unbounded-concurrency -- bounded by small number of error registry files (typically 1-3)
+        const registryContents = await Promise.all(registryPaths.map((fp) => files.read(fp)));
+        for (const content of registryContents) {
+            if (!content)
+                continue;
+            // Match code definitions: 'DOMAIN.CATEGORY.SPECIFIC' in any context
+            const codeRegex = /['"]([A-Z][A-Z0-9]*(?:\.[A-Z][A-Z0-9_]*){2,})['"]/g;
+            let match;
+            while ((match = codeRegex.exec(content)) !== null) {
+                if (match[1])
+                    registeredCodes.add(match[1]);
+            }
+        }
+        // Phase 2: Scan non-registry files for error code usage
+        const nonRegistryPaths = files.paths.filter((fp) => !registryFilePattern.test(fp));
+        // @fitness-ignore-next-line no-unbounded-concurrency -- bounded by files matching target; read is lightweight (FileAccessor caches)
+        const nonRegistryContents = await Promise.all(nonRegistryPaths.map((fp) => files.read(fp)));
+        for (const [fileIdx, filePath] of nonRegistryPaths.entries()) {
+            if (!filePath)
+                continue;
+            const content = nonRegistryContents[fileIdx];
+            if (!content)
+                continue;
+            const lines = content.split('\n');
+            for (const [i, line_] of lines.entries()) {
+                const line = line_ ?? '';
+                const trimmed = line.trim();
+                // Skip comments
+                if (trimmed.startsWith('//') || trimmed.startsWith('*'))
+                    continue;
+                // Match: code: 'DOMAIN.CATEGORY.SPECIFIC' or errorCode: 'DOMAIN.CATEGORY.SPECIFIC'
+                const codeUsageRegex = /(?:code|errorCode)\s*:\s*['"]([A-Z][A-Z0-9]*(?:\.[A-Z][A-Z0-9_]*){2,})['"]/g;
+                let usageMatch;
+                while ((usageMatch = codeUsageRegex.exec(line)) !== null) {
+                    const code = usageMatch[1];
+                    if (code && !registeredCodes.has(code)) {
+                        violations.push({
+                            filePath,
+                            line: i + 1,
+                            message: `Error code '${code}' is used but not registered in any error registry file`,
+                            severity: 'warning',
+                            suggestion: `Register '${code}' in the appropriate error-codes.ts or error-registry.ts file`,
+                            type: 'unregistered-error-code',
+                            match: trimmed.slice(0, 120),
+                        });
+                    }
+                }
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=error-code-registration.js.map

package/dist/checks/resilience/error-code-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-code-registration.js","sourceRoot":"","sources":["../../../src/checks/resilience/error-code-registration.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAA0C,MAAM,sBAAsB,CAAC;AAE3F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,yBAAyB;IAC/B,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,kFAAkF;IAC/F,eAAe,EAAE;;;;;;;uIAOoH;IACrI,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,CAAC;IAC7C,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,mMAAmM;IACnM,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,kEAAkE;QAClE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,MAAM,mBAAmB,GAAG,4CAA4C,CAAC;QAEzE,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,wHAAwH;QACxH,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEtF,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,oEAAoE;YACpE,MAAM,SAAS,GAAG,oDAAoD,CAAC;YACvE,IAAI,KAAK,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,oIAAoI;QACpI,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAE5F,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7D,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAElC,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAE5B,gBAAgB;gBAChB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAElE,mFAAmF;gBACnF,MAAM,cAAc,GAClB,6EAA6E,CAAC;gBAChF,IAAI,UAAU,CAAC;gBACf,OAAO,CAAC,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACzD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;oBAC3B,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvC,UAAU,CAAC,IAAI,CAAC;4BACd,QAAQ;4BACR,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,OAAO,EAAE,eAAe,IAAI,yDAAyD;4BACrF,QAAQ,EAAE,SAAS;4BACnB,UAAU,EAAE,aAAa,IAAI,+DAA+D;4BAC5F,IAAI,EAAE,yBAAyB;4BAC/B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;yBAC7B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/resilience/event-patterns.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @fileoverview Event handling resilience checks
+ */
+/**
+ * Check: resilience/event-architecture
+ *
+ * Validates event handling follows architectural patterns:
+ * - Using canonical event bus from infrastructure
+ * - Not creating custom EventEmitters in domain code
+ * - Events have proper schemas
+ */
+export declare const eventArchitecture: import("@opensip-cli/fitness").Check;
+/**
+ * Check: resilience/event-handler-idempotency
+ *
+ * Validates event handlers implement idempotency for at-least-once delivery:
+ * - Checking for duplicate message processing
+ * - Using idempotent operations
+ */
+export declare const eventHandlerIdempotency: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=event-patterns.d.ts.map

package/dist/checks/resilience/event-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-patterns.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/event-patterns.ts"],"names":[],"mappings":"AAEA;;GAEG;AAuGH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,sCA+D5B,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,sCAmElC,CAAC"}