@opensip-cli/checks-universal 0.1.0

package/dist/checks/resilience/sentry/sentry-sample-rate.js

@@ -0,0 +1,78 @@
+/**
+ * @fileoverview Detect missing or dangerous tracesSampleRate in Sentry.init()
+ * @module checks-builtin/checks/resilience/sentry/sentry-sample-rate
+ */
+import { defineCheck, getLineNumber } from '@opensip-cli/fitness';
+import { hasSentryInit, extractSentryInitBlock } from './_helpers/sentry.js';
+function analyze(content, filePath) {
+    if (!hasSentryInit(content))
+        return [];
+    const initBlock = extractSentryInitBlock(content);
+    if (!initBlock)
+        return [];
+    const violations = [];
+    // Check for tracesSampleRate: 1.0 (or 1) — expensive in production
+    const rateMatch = /tracesSampleRate\s*:\s*([\d.]+)/.exec(initBlock.block);
+    if (rateMatch) {
+        const rate = Number.parseFloat(rateMatch[1] ?? '0');
+        if (rate === 1) {
+            const absoluteIndex = content.indexOf('tracesSampleRate', content.indexOf('Sentry.init'));
+            violations.push({
+                line: absoluteIndex === -1 ? initBlock.startLine + 1 : getLineNumber(content, absoluteIndex),
+                message: 'tracesSampleRate is 1.0 — every transaction is traced, which is expensive at scale',
+                severity: 'warning',
+                suggestion: 'Set tracesSampleRate to a lower value in production (e.g., 0.1 for 10% sampling). Use environment checks: tracesSampleRate: process.env.NODE_ENV === "production" ? 0.1 : 1.0',
+                type: 'sentry-full-sample-rate',
+                match: rateMatch[0],
+                filePath,
+            });
+        }
+    }
+    // Check for missing tracesSampleRate entirely
+    if (!initBlock.block.includes('tracesSampleRate') && !initBlock.block.includes('tracesSampler')) {
+        // Only flag if the project appears to use Sentry tracing (has performance imports)
+        const hasTracingImport = content.includes('BrowserTracing') ||
+            content.includes('browserTracingIntegration') ||
+            content.includes('@sentry/tracing') ||
+            content.includes('httpIntegration') ||
+            content.includes('expressIntegration');
+        if (hasTracingImport) {
+            violations.push({
+                line: initBlock.startLine + 1,
+                message: 'Sentry tracing integration imported but no tracesSampleRate or tracesSampler set — tracing may be silently disabled',
+                severity: 'warning',
+                suggestion: 'Add tracesSampleRate to Sentry.init(): Sentry.init({ tracesSampleRate: 0.1, ... }). Without it, the default is 0 (no traces captured).',
+                type: 'sentry-missing-sample-rate',
+                filePath,
+            });
+        }
+    }
+    return violations;
+}
+/**
+ * Check: sentry-sample-rate
+ *
+ * Detects missing or problematic tracesSampleRate in Sentry.init().
+ * Catches both "too high" (1.0 in production) and "not set" (tracing silently off).
+ */
+export const sentrySampleRate = defineCheck({
+    id: 'a7c3e9f6-0b8d-4e4a-f567-d9c1a3b5e8f0',
+    slug: 'sentry-sample-rate',
+    scope: { languages: ['typescript', 'javascript'], concerns: ['backend', 'frontend'] },
+    contentFilter: 'strip-strings-and-comments',
+    description: 'Detects missing or 1.0 tracesSampleRate — tracing disabled or too expensive',
+    longDescription: `**Purpose:** Ensures Sentry performance tracing is configured with an appropriate sample rate.
+
+**Detects:**
+- \`tracesSampleRate: 1.0\` — capturing every transaction is expensive at scale and can significantly increase Sentry costs
+- Tracing integrations imported (BrowserTracing, @sentry/tracing, etc.) but no \`tracesSampleRate\` or \`tracesSampler\` configured — tracing defaults to 0 (disabled)
+
+**Why it matters:** A sample rate of 1.0 in production sends every transaction to Sentry, which can be prohibitively expensive and may cause rate limiting. Conversely, importing tracing integrations without setting a sample rate means tracing is silently disabled — the integration runs but captures nothing.
+
+**Scope:** Any file that calls \`Sentry.init()\`. Analyzes each file individually.`,
+    tags: ['sentry', 'resilience', 'performance', 'observability'],
+    fileTypes: ['ts', 'js', 'tsx', 'jsx', 'mjs'],
+    confidence: 'high',
+    analyze,
+});
+//# sourceMappingURL=sentry-sample-rate.js.map

package/dist/checks/resilience/sentry/sentry-sample-rate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry-sample-rate.js","sourceRoot":"","sources":["../../../../src/checks/resilience/sentry/sentry-sample-rate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAuB,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEvF,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,SAAS,OAAO,CAAC,OAAe,EAAE,QAAgB;IAChD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAE1B,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,mEAAmE;IACnE,MAAM,SAAS,GAAG,iCAAiC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;YAC1F,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EACF,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC;gBACxF,OAAO,EACL,oFAAoF;gBACtF,QAAQ,EAAE,SAAS;gBACnB,UAAU,EACR,+KAA+K;gBACjL,IAAI,EAAE,yBAAyB;gBAC/B,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;gBACnB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAChG,mFAAmF;QACnF,MAAM,gBAAgB,GACpB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAClC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC;YAC7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAEzC,IAAI,gBAAgB,EAAE,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,SAAS,CAAC,SAAS,GAAG,CAAC;gBAC7B,OAAO,EACL,qHAAqH;gBACvH,QAAQ,EAAE,SAAS;gBACnB,UAAU,EACR,wIAAwI;gBAC1I,IAAI,EAAE,4BAA4B;gBAClC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,oBAAoB;IAC1B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;IACrF,aAAa,EAAE,4BAA4B;IAC3C,WAAW,EAAE,6EAA6E;IAC1F,eAAe,EAAE;;;;;;;;mFAQgE;IACjF,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,CAAC;IAC9D,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;IAC5C,UAAU,EAAE,MAAM;IAClB,OAAO;CACR,CAAC,CAAC"}

package/dist/checks/resilience/sentry/sentry-source-maps.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview Detect missing Sentry source map upload in bundler configs
+ * @module checks-builtin/checks/resilience/sentry/sentry-source-maps
+ */
+/**
+ * Check: sentry-source-maps
+ *
+ * Detects bundler configs that reference Sentry but don't include
+ * a source map upload plugin.
+ */
+export declare const sentrySourceMaps: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=sentry-source-maps.d.ts.map

package/dist/checks/resilience/sentry/sentry-source-maps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry-source-maps.d.ts","sourceRoot":"","sources":["../../../../src/checks/resilience/sentry/sentry-source-maps.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,sCAiB3B,CAAC"}

package/dist/checks/resilience/sentry/sentry-source-maps.js

@@ -0,0 +1,83 @@
+/**
+ * @fileoverview Detect missing Sentry source map upload in bundler configs
+ * @module checks-builtin/checks/resilience/sentry/sentry-source-maps
+ */
+import { defineCheck } from '@opensip-cli/fitness';
+import { hasSentryUsage } from './_helpers/sentry.js';
+// Sentry bundler plugins that handle source map upload
+const SOURCE_MAP_PLUGINS = [
+    '@sentry/webpack-plugin',
+    '@sentry/vite-plugin',
+    '@sentry/esbuild-plugin',
+    '@sentry/rollup-plugin',
+    '@sentry/nextjs',
+    '@sentry/nuxt',
+    '@sentry/astro',
+    'sentryWebpackPlugin',
+    'sentryVitePlugin',
+    'sentryEsbuildPlugin',
+    'sentryRollupPlugin',
+];
+// File name patterns that indicate a bundler config
+const BUNDLER_CONFIG_PATTERNS = [
+    'webpack.config',
+    'vite.config',
+    'rollup.config',
+    'esbuild.config',
+    'next.config',
+    'nuxt.config',
+    'astro.config',
+];
+function isBundlerConfig(filePath) {
+    const lower = filePath.toLowerCase();
+    return BUNDLER_CONFIG_PATTERNS.some((pattern) => lower.includes(pattern));
+}
+function analyze(content, filePath) {
+    // Only check bundler config files
+    if (!isBundlerConfig(filePath))
+        return [];
+    // Only relevant if the project uses Sentry (SDK import in this file or
+    // Sentry plugin reference)
+    if (!hasSentryUsage(content) && !content.includes('sentry'))
+        return [];
+    // Check if any Sentry source map plugin is configured
+    const hasSourceMapPlugin = SOURCE_MAP_PLUGINS.some((plugin) => content.includes(plugin));
+    if (hasSourceMapPlugin)
+        return [];
+    // The file mentions Sentry but has no source map plugin
+    return [
+        {
+            line: 1,
+            message: 'Bundler config references Sentry but no source map upload plugin is configured — stack traces will be unreadable',
+            severity: 'warning',
+            suggestion: 'Add a Sentry source map plugin: npm install @sentry/vite-plugin (or @sentry/webpack-plugin) and add it to your plugins array. This uploads source maps at build time so Sentry can show readable stack traces.',
+            type: 'sentry-missing-source-maps',
+            filePath,
+        },
+    ];
+}
+/**
+ * Check: sentry-source-maps
+ *
+ * Detects bundler configs that reference Sentry but don't include
+ * a source map upload plugin.
+ */
+export const sentrySourceMaps = defineCheck({
+    id: 'e5a1c7d4-8f6b-4c2e-d345-b7a9e1f3c6d8',
+    slug: 'sentry-source-maps',
+    scope: { languages: ['typescript', 'javascript'], concerns: ['backend', 'frontend'] },
+    description: 'Detects missing Sentry source map upload — stack traces will be unreadable',
+    longDescription: `**Purpose:** Ensures bundler configurations include a Sentry source map upload plugin so production stack traces are readable.
+
+**Detects:**
+- Webpack, Vite, Rollup, esbuild, Next.js, Nuxt, or Astro config files that reference Sentry but don't include a Sentry source map plugin (@sentry/webpack-plugin, @sentry/vite-plugin, etc.)
+
+**Why it matters:** Without source maps, Sentry shows minified stack traces (single-character variable names, collapsed files). Developers can't identify the actual source of errors, making Sentry significantly less useful. The Sentry SDK alone doesn't upload source maps — a bundler plugin is required.
+
+**Scope:** Bundler configuration files only (webpack.config.*, vite.config.*, next.config.*, etc.). Analyzes each file individually.`,
+    tags: ['sentry', 'quality', 'observability', 'build'],
+    fileTypes: ['ts', 'js', 'mjs', 'cjs'],
+    confidence: 'high',
+    analyze,
+});
+//# sourceMappingURL=sentry-source-maps.js.map

package/dist/checks/resilience/sentry/sentry-source-maps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry-source-maps.js","sourceRoot":"","sources":["../../../../src/checks/resilience/sentry/sentry-source-maps.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,uDAAuD;AACvD,MAAM,kBAAkB,GAAG;IACzB,wBAAwB;IACxB,qBAAqB;IACrB,wBAAwB;IACxB,uBAAuB;IACvB,gBAAgB;IAChB,cAAc;IACd,eAAe;IACf,qBAAqB;IACrB,kBAAkB;IAClB,qBAAqB;IACrB,oBAAoB;CACrB,CAAC;AAEF,oDAAoD;AACpD,MAAM,uBAAuB,GAAG;IAC9B,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,cAAc;CACf,CAAC;AAEF,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,QAAgB;IAChD,kCAAkC;IAClC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,uEAAuE;IACvE,2BAA2B;IAC3B,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvE,sDAAsD;IACtD,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzF,IAAI,kBAAkB;QAAE,OAAO,EAAE,CAAC;IAElC,wDAAwD;IACxD,OAAO;QACL;YACE,IAAI,EAAE,CAAC;YACP,OAAO,EACL,kHAAkH;YACpH,QAAQ,EAAE,SAAS;YACnB,UAAU,EACR,gNAAgN;YAClN,IAAI,EAAE,4BAA4B;YAClC,QAAQ;SACT;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,oBAAoB;IAC1B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;IACrF,WAAW,EAAE,4EAA4E;IACzF,eAAe,EAAE;;;;;;;qIAOkH;IACnI,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC;IACrD,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;IACrC,UAAU,EAAE,MAAM;IAClB,OAAO;CACR,CAAC,CAAC"}

package/dist/checks/resilience/service-patterns.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @fileoverview Service communication and infrastructure resilience checks
+ */
+/**
+ * Check: resilience/graceful-shutdown
+ *
+ * Validates services implement proper graceful shutdown handling.
+ * Ensures in-flight requests complete and resources are cleaned up.
+ */
+export declare const gracefulShutdown: import("@opensip-cli/fitness").Check;
+/**
+ * Check: resilience/rate-limiting-coverage
+ *
+ * Validates API endpoints have rate limiting configured,
+ * especially for sensitive operations.
+ */
+export declare const rateLimitingCoverage: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=service-patterns.d.ts.map

package/dist/checks/resilience/service-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-patterns.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/service-patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAqIH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,sCA2D3B,CAAC;AAMH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,sCAuD/B,CAAC"}

package/dist/checks/resilience/service-patterns.js

@@ -0,0 +1,230 @@
+/**
+ * @fileoverview Service communication and infrastructure resilience checks
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck, isTestFile, getLineNumber } from '@opensip-cli/fitness';
+// =============================================================================
+// PRE-COMPILED REGEX PATTERNS (Safe for static code analysis)
+// =============================================================================
+// Service entry patterns (bounded quantifiers to prevent slow regex)
+const LISTEN_PATTERN = /\.listen\s{0,5}\(/;
+const FASTIFY_PATTERN = /fastify\s{0,5}\(\)/;
+const EXPRESS_PATTERN = /express\s{0,5}\(\)/;
+const CREATE_SERVER_PATTERN = /createServer\s{0,5}\(/;
+// Shutdown patterns (bounded quantifiers to prevent slow regex)
+const SIGTERM_PATTERN = /process\.on\s{0,5}\(\s{0,5}['"]SIGTERM['"]/;
+const SIGINT_PATTERN = /process\.on\s{0,5}\(\s{0,5}['"]SIGINT['"]/;
+const CLOSE_PATTERN = /\.close\s{0,5}\(\s{0,5}\)/;
+const GRACEFUL_PATTERN = /graceful(?:Shutdown|Stop)/i;
+// API endpoint patterns
+const GET_ENDPOINT_PATTERN = /\.get\s*\(\s*['"][^'"]{1,200}['"]/;
+const POST_ENDPOINT_PATTERN = /\.post\s*\(\s*['"][^'"]{1,200}['"]/;
+const PUT_ENDPOINT_PATTERN = /\.put\s*\(\s*['"][^'"]{1,200}['"]/;
+const DELETE_ENDPOINT_PATTERN = /\.delete\s*\(\s*['"][^'"]{1,200}['"]/;
+const PATCH_ENDPOINT_PATTERN = /\.patch\s*\(\s*['"][^'"]{1,200}['"]/;
+// Rate limiting patterns
+const RATE_LIMIT_PATTERN = /rateLimit/i;
+const RATE_LIMITER_PATTERN = /rateLimiter/i;
+const THROTTLE_PATTERN = /throttle/i;
+const RATE_LIMIT_DECORATOR_PATTERN = /@RateLimit/;
+// Sensitive endpoints
+const AUTH_ENDPOINT_PATTERN = /\/auth\//i;
+const LOGIN_ENDPOINT_PATTERN = /\/login/i;
+const REGISTER_ENDPOINT_PATTERN = /\/register/i;
+const PASSWORD_ENDPOINT_PATTERN = /\/password/i;
+const PAYMENT_ENDPOINT_PATTERN = /\/payment/i;
+// =============================================================================
+// PATTERN ARRAYS (Using pre-compiled patterns)
+// =============================================================================
+const SERVICE_ENTRY_PATTERNS = [
+    LISTEN_PATTERN,
+    FASTIFY_PATTERN,
+    EXPRESS_PATTERN,
+    CREATE_SERVER_PATTERN,
+];
+const SHUTDOWN_PATTERNS = [SIGTERM_PATTERN, SIGINT_PATTERN, CLOSE_PATTERN, GRACEFUL_PATTERN];
+const API_ENDPOINT_PATTERNS = [
+    GET_ENDPOINT_PATTERN,
+    POST_ENDPOINT_PATTERN,
+    PUT_ENDPOINT_PATTERN,
+    DELETE_ENDPOINT_PATTERN,
+    PATCH_ENDPOINT_PATTERN,
+];
+const RATE_LIMITING_PATTERNS = [
+    RATE_LIMIT_PATTERN,
+    RATE_LIMITER_PATTERN,
+    THROTTLE_PATTERN,
+    RATE_LIMIT_DECORATOR_PATTERN,
+];
+const SENSITIVE_ENDPOINTS = [
+    AUTH_ENDPOINT_PATTERN,
+    LOGIN_ENDPOINT_PATTERN,
+    REGISTER_ENDPOINT_PATTERN,
+    PASSWORD_ENDPOINT_PATTERN,
+    PAYMENT_ENDPOINT_PATTERN,
+];
+// =============================================================================
+// HELPER FUNCTIONS
+// =============================================================================
+function isServiceEntryPoint(content) {
+    logger.debug({
+        evt: 'fitness.checks.service_patterns.is_service_entry_point',
+        msg: 'Checking if content is a service entry point',
+    });
+    return SERVICE_ENTRY_PATTERNS.some((pattern) => pattern.test(content));
+}
+function hasShutdownHandler(content) {
+    logger.debug({
+        evt: 'fitness.checks.service_patterns.has_shutdown_handler',
+        msg: 'Checking if content has shutdown handler',
+    });
+    return SHUTDOWN_PATTERNS.some((pattern) => pattern.test(content));
+}
+function hasApiEndpoints(content) {
+    logger.debug({
+        evt: 'fitness.checks.service_patterns.has_api_endpoints',
+        msg: 'Checking if content has API endpoints',
+    });
+    return API_ENDPOINT_PATTERNS.some((pattern) => pattern.test(content));
+}
+function matchesRateLimitingPatterns(content) {
+    logger.debug({
+        evt: 'fitness.checks.service_patterns.matches_rate_limiting_patterns',
+        msg: 'Checking if content matches rate limiting patterns',
+    });
+    return RATE_LIMITING_PATTERNS.some((pattern) => pattern.test(content));
+}
+function isSensitiveEndpoint(line) {
+    logger.debug({
+        evt: 'fitness.checks.service_patterns.is_sensitive_endpoint',
+        msg: 'Checking if line contains a sensitive endpoint',
+    });
+    return SENSITIVE_ENDPOINTS.some((pattern) => pattern.test(line));
+}
+function isApiEndpoint(line) {
+    logger.debug({
+        evt: 'fitness.checks.service_patterns.is_api_endpoint',
+        msg: 'Checking if line contains an API endpoint',
+    });
+    return API_ENDPOINT_PATTERNS.some((pattern) => pattern.test(line));
+}
+// =============================================================================
+// GRACEFUL SHUTDOWN
+// =============================================================================
+/**
+ * Check: resilience/graceful-shutdown
+ *
+ * Validates services implement proper graceful shutdown handling.
+ * Ensures in-flight requests complete and resources are cleaned up.
+ */
+export const gracefulShutdown = defineCheck({
+    id: '3e98b441-1ec9-4963-bb97-6f5b0bce0fbe',
+    slug: 'graceful-shutdown',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Validate services implement graceful shutdown handling',
+    longDescription: `**Purpose:** Ensures service entry points implement graceful shutdown to allow in-flight requests to complete before termination.
+
+**Detects:**
+- Files containing service entry patterns (\`.listen(\`, \`fastify()\`, \`express()\`, \`createServer(\`) without shutdown handlers
+- Checks for \`process.on('SIGTERM'\`, \`process.on('SIGINT'\`, \`.close()\`, or \`gracefulShutdown\`/\`gracefulStop\` patterns
+
+**Why it matters:** Without graceful shutdown, deploys and restarts drop in-flight requests, corrupt transactions, and leak resources.
+
+**Scope:** General best practice. Analyzes each file individually via regex.`,
+    tags: ['resilience', 'infrastructure', 'shutdown'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        const violations = [];
+        if (!isServiceEntryPoint(content)) {
+            return violations;
+        }
+        if (hasShutdownHandler(content)) {
+            return violations;
+        }
+        // Find service entry violation
+        for (const pattern of SERVICE_ENTRY_PATTERNS) {
+            // @fitness-ignore-next-line performance-anti-patterns -- false positive: keyword in comment text below, not an async call
+            // @lazy-ok -- 'await' appears in suggestion string literal, not actual await
+            pattern.lastIndex = 0;
+            const match = pattern.exec(content);
+            if (!match) {
+                continue;
+            }
+            const lineNumber = getLineNumber(content, match.index);
+            violations.push({
+                line: lineNumber,
+                column: 0,
+                message: 'Service entry point missing graceful shutdown handler',
+                severity: 'warning',
+                suggestion: 'Add SIGTERM/SIGINT handlers to gracefully close connections. Example: process.on("SIGTERM", async () => { await server.close(); process.exit(0); })',
+                match: match[0],
+                type: 'missing-shutdown-handler',
+                filePath,
+            });
+            // Found one violation, exit loop
+            break;
+        }
+        return violations;
+    },
+});
+// =============================================================================
+// RATE LIMITING COVERAGE
+// =============================================================================
+/**
+ * Check: resilience/rate-limiting-coverage
+ *
+ * Validates API endpoints have rate limiting configured,
+ * especially for sensitive operations.
+ */
+export const rateLimitingCoverage = defineCheck({
+    id: '4648cce9-f8de-47fe-9350-5f49953c8edc',
+    slug: 'rate-limiting-coverage',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    description: 'Validate API endpoints have rate limiting',
+    longDescription: `**Purpose:** Ensures sensitive API endpoints have rate limiting configured to prevent abuse.
+
+**Detects:**
+- API endpoint definitions (\`.get(\`, \`.post(\`, \`.put(\`, \`.delete(\`, \`.patch(\` with string path) that match sensitive paths (\`/auth/\`, \`/login\`, \`/register\`, \`/password\`, \`/payment\`)
+- Flags when the file lacks any rate limiting indicator: \`rateLimit\`, \`rateLimiter\`, \`throttle\`, \`@RateLimit\`
+
+**Why it matters:** Unprotected auth, login, and payment endpoints are vulnerable to brute-force attacks, credential stuffing, and payment fraud.
+
+**Scope:** General best practice. Analyzes each file individually via regex.`,
+    tags: ['resilience', 'security', 'rate-limiting'],
+    analyze(content, filePath) {
+        const violations = [];
+        // Test files routinely embed endpoint shapes inline as fixtures
+        // for this very check; production rate-limiting is the contract,
+        // not test scaffolding.
+        if (isTestFile(filePath))
+            return violations;
+        if (!hasApiEndpoints(content)) {
+            return violations;
+        }
+        const hasRateLimitingInFile = matchesRateLimitingPatterns(content);
+        const lines = content.split('\n');
+        for (const [i, line] of lines.entries()) {
+            if (!line)
+                continue;
+            const isEndpoint = isApiEndpoint(line);
+            const isSensitive = isSensitiveEndpoint(line);
+            if (isEndpoint && isSensitive && !hasRateLimitingInFile) {
+                const lineNumber = i + 1;
+                violations.push({
+                    line: lineNumber,
+                    column: 0,
+                    message: 'Sensitive endpoint without rate limiting',
+                    severity: 'warning',
+                    suggestion: 'Add rate limiting to prevent abuse. Use a shared rate limiter middleware or apply a @RateLimit decorator to protect auth, login, and payment endpoints.',
+                    match: line.trim(),
+                    type: 'sensitive-endpoint-no-rate-limit',
+                    filePath,
+                });
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=service-patterns.js.map

package/dist/checks/resilience/service-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-patterns.js","sourceRoot":"","sources":["../../../src/checks/resilience/service-patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEnG,gFAAgF;AAChF,8DAA8D;AAC9D,gFAAgF;AAEhF,qEAAqE;AACrE,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAC3C,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAC7C,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAC7C,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAEtD,gEAAgE;AAChE,MAAM,eAAe,GAAG,4CAA4C,CAAC;AACrE,MAAM,cAAc,GAAG,2CAA2C,CAAC;AACnE,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAClD,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAEtD,wBAAwB;AACxB,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AACjE,MAAM,qBAAqB,GAAG,oCAAoC,CAAC;AACnE,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AACjE,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AACvE,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AAErE,yBAAyB;AACzB,MAAM,kBAAkB,GAAG,YAAY,CAAC;AACxC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAC5C,MAAM,gBAAgB,GAAG,WAAW,CAAC;AACrC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAElD,sBAAsB;AACtB,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAC1C,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAC1C,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAChD,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAChD,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAE9C,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF,MAAM,sBAAsB,GAAG;IAC7B,cAAc;IACd,eAAe;IACf,eAAe;IACf,qBAAqB;CACtB,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAE7F,MAAM,qBAAqB,GAAG;IAC5B,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;CACvB,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,kBAAkB;IAClB,oBAAoB;IACpB,gBAAgB;IAChB,4BAA4B;CAC7B,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,yBAAyB;IACzB,wBAAwB;CACzB,CAAC;AAEF,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,wDAAwD;QAC7D,GAAG,EAAE,8CAA8C;KACpD,CAAC,CAAC;IACH,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,sDAAsD;QAC3D,GAAG,EAAE,0CAA0C;KAChD,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,mDAAmD;QACxD,GAAG,EAAE,uCAAuC;KAC7C,CAAC,CAAC;IACH,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe;IAClD,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,gEAAgE;QACrE,GAAG,EAAE,oDAAoD;KAC1D,CAAC,CAAC;IACH,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,uDAAuD;QAC5D,GAAG,EAAE,gDAAgD;KACtD,CAAC,CAAC;IACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,iDAAiD;QACtD,GAAG,EAAE,2CAA2C;KACjD,CAAC,CAAC;IACH,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,mBAAmB;IACzB,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,wDAAwD;IACrE,eAAe,EAAE;;;;;;;;6EAQ0D;IAC3E,IAAI,EAAE,CAAC,YAAY,EAAE,gBAAgB,EAAE,UAAU,CAAC;IAClD,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,+BAA+B;QAC/B,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;YAC7C,0HAA0H;YAC1H,6EAA6E;YAC7E,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,uDAAuD;gBAChE,QAAQ,EAAE,SAAS;gBACnB,UAAU,EACR,qJAAqJ;gBACvJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBACf,IAAI,EAAE,0BAA0B;gBAChC,QAAQ;aACT,CAAC,CAAC;YACH,iCAAiC;YACjC,MAAM;QACR,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC;AAEH,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,wBAAwB;IAC9B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,WAAW,EAAE,2CAA2C;IACxD,eAAe,EAAE;;;;;;;;6EAQ0D;IAC3E,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;IAEjD,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,gEAAgE;QAChE,iEAAiE;QACjE,wBAAwB;QACxB,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,UAAU,CAAC;QAE5C,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,qBAAqB,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElC,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAE9C,IAAI,UAAU,IAAI,WAAW,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACxD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,0CAA0C;oBACnD,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,yJAAyJ;oBAC3J,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;oBAClB,IAAI,EAAE,kCAAkC;oBACxC,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/resilience/timer-lifecycle.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Timer lifecycle check
+ */
+/**
+ * Check: resilience/timer-lifecycle
+ *
+ * Detects setInterval() calls without corresponding clearInterval() cleanup.
+ */
+export declare const timerLifecycle: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=timer-lifecycle.d.ts.map

package/dist/checks/resilience/timer-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timer-lifecycle.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/timer-lifecycle.ts"],"names":[],"mappings":"AAAA;;GAEG;AA0DH;;;;GAIG;AACH,eAAO,MAAM,cAAc,sCAoBzB,CAAC"}

package/dist/checks/resilience/timer-lifecycle.js

@@ -0,0 +1,78 @@
+/**
+ * @fileoverview Timer lifecycle check
+ */
+import { defineCheck } from '@opensip-cli/fitness';
+/**
+ * Analyze a file for setInterval without corresponding clearInterval
+ */
+// eslint-disable-next-line sonarjs/cognitive-complexity -- Inherent complexity: line-by-line detection of setInterval/clearInterval pairs with variable capture tracking
+function analyzeTimerLifecycle(content, _filePath) {
+    const violations = [];
+    const lines = content.split('\n');
+    // Quick check: skip files without setInterval
+    if (!content.includes('setInterval'))
+        return violations;
+    const intervalCreations = [];
+    let hasClearInterval = false;
+    for (const [i, line_] of lines.entries()) {
+        /* v8 ignore next -- defensive: lines.entries() never yields undefined */
+        const line = line_ ?? '';
+        const trimmed = line.trim();
+        // Skip comments
+        if (trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        // Detect setInterval with variable capture
+        const intervalMatch = /(?:const|let|var)\s+(\w+)\s*=\s*setInterval\s*\(/.exec(line);
+        if (intervalMatch) {
+            /* v8 ignore next -- defensive: regex (\w+) capture group always yields a string */
+            intervalCreations.push({ line: i + 1, varName: intervalMatch[1] ?? null });
+        }
+        else if (/\bsetInterval\s*\(/.test(line) && !line.includes('clearInterval')) {
+            // setInterval without variable capture
+            intervalCreations.push({ line: i + 1, varName: null });
+        }
+        // Detect cleanup
+        if (/\bclearInterval\s*\(/.test(line))
+            hasClearInterval = true;
+    }
+    // Flag intervals without corresponding cleanup
+    if (!hasClearInterval) {
+        for (const interval of intervalCreations) {
+            violations.push({
+                line: interval.line,
+                // eslint-disable-next-line sonarjs/no-nested-template-literals -- Optional variable name suffix is a single inline expression; clearer than pre-computing
+                message: `setInterval() created${interval.varName ? ` (${interval.varName})` : ''} without clearInterval() in the same module — potential timer leak`,
+                severity: 'warning',
+                suggestion: 'Store the timer ID and call clearInterval() in a cleanup/dispose/shutdown handler',
+                type: 'interval-without-cleanup',
+            });
+        }
+    }
+    return violations;
+}
+/**
+ * Check: resilience/timer-lifecycle
+ *
+ * Detects setInterval() calls without corresponding clearInterval() cleanup.
+ */
+export const timerLifecycle = defineCheck({
+    id: 'f42299e1-6d22-4c4b-a236-6157a95f0949',
+    slug: 'timer-lifecycle',
+    scope: { languages: ['typescript'], concerns: ['backend', 'frontend', 'cli'] },
+    description: 'Detects setInterval() calls without corresponding clearInterval() cleanup — prevents timer leaks',
+    longDescription: `**Purpose:** Detects \`setInterval()\` calls that have no corresponding \`clearInterval()\` in the same module, which causes timer leaks.
+
+**Detects:**
+- \`setInterval()\` calls (with or without variable capture) where no \`clearInterval()\` exists in the same file
+- Focuses on \`setInterval\` (always needs cleanup) rather than \`setTimeout\` (often fire-and-forget)
+
+**Why it matters:** Leaked intervals cause memory leaks and can prevent graceful shutdown. They continue executing after their purpose has ended.
+
+**Scope:** Backend code. Analyzes each file individually via regex.`,
+    tags: ['resilience', 'memory', 'lifecycle'],
+    fileTypes: ['ts'],
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    analyze: analyzeTimerLifecycle,
+});
+//# sourceMappingURL=timer-lifecycle.js.map

package/dist/checks/resilience/timer-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timer-lifecycle.js","sourceRoot":"","sources":["../../../src/checks/resilience/timer-lifecycle.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AAExE;;GAEG;AACH,yKAAyK;AACzK,SAAS,qBAAqB,CAAC,OAAe,EAAE,SAAiB;IAC/D,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,8CAA8C;IAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,UAAU,CAAC;IAExD,MAAM,iBAAiB,GAA+C,EAAE,CAAC;IACzE,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,yEAAyE;QACzE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,gBAAgB;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElE,2CAA2C;QAC3C,MAAM,aAAa,GAAG,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,aAAa,EAAE,CAAC;YAClB,mFAAmF;YACnF,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;aAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9E,uCAAuC;YACvC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,iBAAiB;QACjB,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,gBAAgB,GAAG,IAAI,CAAC;IACjE,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;YACzC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,0JAA0J;gBAC1J,OAAO,EAAE,wBAAwB,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,oEAAoE;gBACrJ,QAAQ,EAAE,SAAS;gBACnB,UAAU,EACR,mFAAmF;gBACrF,IAAI,EAAE,0BAA0B;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;IACxC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;IAC9E,WAAW,EACT,kGAAkG;IACpG,eAAe,EAAE;;;;;;;;oEAQiD;IAClE,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,WAAW,CAAC;IAC3C,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,aAAa,EAAE,eAAe;IAC9B,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,qBAAqB;CAC/B,CAAC,CAAC"}

package/dist/checks/resilience/transaction-patterns.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @fileoverview Transaction handling resilience checks
+ */
+/**
+ * Check: resilience/transaction-boundary-validation
+ *
+ * Validates transaction boundaries are properly managed:
+ * - Transactions are committed or rolled back
+ * - No async operations inside transactions that could cause long locks
+ * - Proper error handling in transaction blocks
+ */
+export declare const transactionBoundaryValidation: import("@opensip-cli/fitness").Check;
+/**
+ * Check: resilience/transaction-timeout
+ *
+ * Validates transactions have timeout configurations:
+ * - Statement timeouts to prevent long-running queries
+ * - Lock timeouts to prevent deadlocks
+ */
+export declare const transactionTimeout: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=transaction-patterns.d.ts.map

package/dist/checks/resilience/transaction-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-patterns.d.ts","sourceRoot":"","sources":["../../../src/checks/resilience/transaction-patterns.ts"],"names":[],"mappings":"AAEA;;GAEG;AA8KH;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,sCAwCxC,CAAC;AAMH;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,sCA2D7B,CAAC"}