@opensip-cli/checks-universal 0.1.0

package/dist/checks/resilience/transaction-patterns.js

@@ -0,0 +1,258 @@
+// @fitness-ignore-file transaction-boundary-validation -- Transaction boundaries appropriate for this use case
+// @fitness-ignore-file unused-config-options -- Config options reserved for future use or environment-specific
+/**
+ * @fileoverview Transaction handling resilience checks
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck, isTestFile, getLineNumber } from '@opensip-cli/fitness';
+// =============================================================================
+// TRANSACTION BOUNDARY VALIDATION
+// =============================================================================
+/**
+ * Patterns indicating transaction usage.
+ * Uses `g` flag for patterns used in while(exec()) loops.
+ * Note: Patterns must be specific enough to avoid false positives on
+ * unrelated uses of similar words (e.g., "Transactional" SMS type in AWS SNS).
+ */
+const TRANSACTION_PATTERNS = [
+    /\.transaction\s*\(/g,
+    /\.beginTransaction\s*\(/g,
+    /\.startTransaction\s*\(/g,
+    /BEGIN\s+TRANSACTION/gi,
+    /@Transaction\b/g,
+    /@Transactional\b/g, // Match decorator only, not SMS type configurations
+    /queryRunner\.startTransaction/g,
+];
+/**
+ * Patterns indicating proper transaction handling
+ */
+const PROPER_TRANSACTION_PATTERNS = [
+    /\.commit\s*\(\)/,
+    /\.rollback\s*\(\)/,
+    /COMMIT/i,
+    /ROLLBACK/i,
+];
+/**
+ * Patterns indicating async operations inside transactions (risky).
+ * Uses `g` flag for patterns used in while(exec()) loops.
+ */
+const ASYNC_IN_TRANSACTION_PATTERNS = [
+    /await.*?fetch\s*\(/g,
+    /await.*?http/gi,
+    /await.*?request\s*\(/g,
+    /await.*?\.publish\s*\(/g, // Event publishing
+    /await.*?\.send\s*\(/g, // Message sending
+];
+/**
+ * Patterns indicating transaction timeout configuration
+ */
+const TIMEOUT_PATTERNS = [
+    /transactionTimeout/i,
+    /queryTimeout/i,
+    /statementTimeout/i,
+    /lockTimeout/i,
+];
+/**
+ * Check if a line is a simple delegation pattern like:
+ * return this.repository.transaction(work);
+ * These delegate transaction management to another layer.
+ */
+function isTransactionDelegation(content, matchIndex) {
+    logger.debug({
+        evt: 'fitness.checks.transaction_patterns.is_transaction_delegation',
+        msg: 'Checking if transaction usage is a delegation pattern',
+    });
+    // Find the start of the line containing the match
+    let lineStart = content.lastIndexOf('\n', matchIndex);
+    if (lineStart === -1)
+        lineStart = 0;
+    else
+        lineStart++; // Move past the newline
+    // Find the end of the line
+    let lineEnd = content.indexOf('\n', matchIndex);
+    if (lineEnd === -1)
+        lineEnd = content.length;
+    const line = content.slice(lineStart, lineEnd).trim();
+    // Simple delegation pattern: return (await?) this.something.transaction(...);
+    // or: return (await?) something.transaction(...);
+    return /^\s*return\s+(await\s+)?(?:this\.)?\w+\.transaction\s*\(/.test(line);
+}
+/**
+ * Detect callback-style transactions: `.transaction((tx) => { ... })` or
+ * `.transaction(async (tx) => { ... })`. The callback model commits on
+ * normal return and rolls back on throw — no manual commit/rollback
+ * needed. Used by drizzle, better-sqlite3, knex, and our own DataStore.
+ */
+function isCallbackStyleTransaction(content, matchIndex) {
+    // Look at the slice starting at the match for callback signatures.
+    // Bounded window keeps this O(1) per match.
+    const window = content.slice(matchIndex, matchIndex + 200);
+    return (/\.(?:transaction|beginTransaction|startTransaction)\s*\(\s*(?:async\s+)?(?:\([^)]{0,80}\)|\w+)\s*=>/.test(window) ||
+        /\.(?:transaction|beginTransaction|startTransaction)\s*\(\s*(?:async\s+)?function\b/.test(window));
+}
+function findUncommittedTransactionViolations(content, filePath) {
+    logger.debug({
+        evt: 'fitness.checks.transaction_patterns.find_uncommitted_transaction_violations',
+        msg: 'Searching for uncommitted transaction violations',
+    });
+    const violations = [];
+    for (const pattern of TRANSACTION_PATTERNS) {
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(content)) !== null) {
+            const isSkippable = match[0].includes('@') ||
+                isTransactionDelegation(content, match.index) ||
+                isCallbackStyleTransaction(content, match.index);
+            if (isSkippable) {
+                continue;
+            }
+            violations.push({
+                line: getLineNumber(content, match.index),
+                column: 0,
+                message: 'Transaction may not be properly committed or rolled back',
+                severity: 'warning',
+                suggestion: 'Ensure all code paths commit or rollback the transaction. Use try/finally: try { await queryRunner.commitTransaction(); } catch { await queryRunner.rollbackTransaction(); } finally { await queryRunner.release(); }',
+                match: match[0],
+                type: 'uncommitted-transaction',
+                filePath,
+            });
+        }
+    }
+    return violations;
+}
+function findAsyncInTransactionViolations(content, filePath) {
+    logger.debug({
+        evt: 'fitness.checks.transaction_patterns.find_async_in_transaction_violations',
+        msg: 'Searching for async operations inside transactions',
+    });
+    const violations = [];
+    for (const pattern of ASYNC_IN_TRANSACTION_PATTERNS) {
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(content)) !== null) {
+            const beforeMatch = content.slice(0, Math.max(0, match.index));
+            const hasOpenTransaction = TRANSACTION_PATTERNS.some((p) => p.test(beforeMatch.slice(-500)));
+            if (!hasOpenTransaction) {
+                continue;
+            }
+            violations.push({
+                line: getLineNumber(content, match.index),
+                column: 0,
+                message: 'Async operation inside transaction may cause long locks',
+                severity: 'warning',
+                suggestion: 'Move network/external calls outside transaction boundary. Collect data first, then start transaction for DB writes only. Publish events after commit.',
+                match: match[0],
+                type: 'async-in-transaction',
+                filePath,
+            });
+        }
+    }
+    return violations;
+}
+/**
+ * Check: resilience/transaction-boundary-validation
+ *
+ * Validates transaction boundaries are properly managed:
+ * - Transactions are committed or rolled back
+ * - No async operations inside transactions that could cause long locks
+ * - Proper error handling in transaction blocks
+ */
+export const transactionBoundaryValidation = defineCheck({
+    id: '77c69adc-7ccd-4f83-98d1-fb9599d3e16f',
+    slug: 'transaction-boundary-validation',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Validate transaction boundaries are properly managed',
+    longDescription: `**Purpose:** Ensures database transactions are properly committed/rolled back and do not contain risky async operations that hold locks.
+
+**Detects:**
+- Transaction starts (\`.transaction(\`, \`.beginTransaction(\`, \`.startTransaction(\`, \`BEGIN TRANSACTION\`, \`@Transaction\`, \`@Transactional\`, \`queryRunner.startTransaction\`) without corresponding \`.commit()\` or \`.rollback()\`
+- Async operations inside open transactions: \`await...fetch(\`, \`await...http\`, \`await...request(\`, \`await...publish(\`, \`await...send(\` preceded by a transaction start within 500 chars
+- Skips decorator-based transactions and delegation patterns (\`return this.repository.transaction(...)\`)
+
+**Why it matters:** Uncommitted transactions leak connections; async calls inside transactions hold database locks and cause deadlocks or timeouts.
+
+**Scope:** General best practice. Analyzes each file individually via regex.`,
+    tags: ['resilience', 'database', 'transactions'],
+    fileTypes: ['ts'],
+    analyze(content, filePath) {
+        // Test fixtures intentionally exercise transaction boundaries (no
+        // commit/rollback, callback throws, etc.) to verify detection logic.
+        if (isTestFile(filePath))
+            return [];
+        const usesTransactions = TRANSACTION_PATTERNS.some((p) => p.test(content));
+        if (!usesTransactions) {
+            return [];
+        }
+        const hasProperHandling = PROPER_TRANSACTION_PATTERNS.some((p) => p.test(content));
+        const uncommittedViolations = hasProperHandling
+            ? []
+            : findUncommittedTransactionViolations(content, filePath);
+        const asyncViolations = findAsyncInTransactionViolations(content, filePath);
+        return [...uncommittedViolations, ...asyncViolations];
+    },
+});
+// =============================================================================
+// TRANSACTION TIMEOUT
+// =============================================================================
+/**
+ * Check: resilience/transaction-timeout
+ *
+ * Validates transactions have timeout configurations:
+ * - Statement timeouts to prevent long-running queries
+ * - Lock timeouts to prevent deadlocks
+ */
+export const transactionTimeout = defineCheck({
+    id: 'd53a49fd-a3e2-4c35-b07a-81b48e8e0325',
+    slug: 'transaction-timeout',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    description: 'Validate transactions have timeout configurations',
+    longDescription: `**Purpose:** Ensures manually managed transactions include timeout configurations to prevent indefinite lock holding.
+
+**Detects:**
+- Files using manual transaction management (\`.beginTransaction\`, \`.startTransaction\`, \`queryRunner\`) without timeout keywords (\`transactionTimeout\`, \`queryTimeout\`, \`statementTimeout\`, \`lockTimeout\`)
+- Only flags manual transactions, not ORM decorator-based transactions
+
+**Why it matters:** Transactions without timeouts can hold database locks indefinitely during network partitions or slow queries, causing cascading connection pool exhaustion.
+
+**Scope:** General best practice. Analyzes each file individually via regex.`,
+    tags: ['resilience', 'database', 'timeout'],
+    analyze(content, filePath) {
+        const violations = [];
+        // Check if this file uses transactions
+        const usesTransactions = TRANSACTION_PATTERNS.some((p) => p.test(content));
+        if (!usesTransactions) {
+            return violations;
+        }
+        // Check for timeout configuration
+        const hasTimeout = TIMEOUT_PATTERNS.some((p) => p.test(content));
+        // Only flag if using manual transaction management (not ORM decorators)
+        const usesManualTransactions = content.includes('.beginTransaction') ||
+            content.includes('.startTransaction') ||
+            content.includes('queryRunner');
+        if (usesManualTransactions && !hasTimeout) {
+            // Find the transaction usage for line number
+            for (const pattern of TRANSACTION_PATTERNS) {
+                pattern.lastIndex = 0;
+                const match = pattern.exec(content);
+                if (match) {
+                    const lineNumber = getLineNumber(content, match.index);
+                    violations.push({
+                        line: lineNumber,
+                        column: 0,
+                        message: 'Transaction without timeout configuration may hang indefinitely',
+                        severity: 'warning',
+                        suggestion: 'Configure transactionTimeout or statementTimeout. Example: SET statement_timeout = 30000; or configure in TypeORM: { extra: { statement_timeout: 30000 } }',
+                        match: match[0],
+                        type: 'missing-transaction-timeout',
+                        filePath,
+                    });
+                    break;
+                }
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=transaction-patterns.js.map

package/dist/checks/resilience/transaction-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-patterns.js","sourceRoot":"","sources":["../../../src/checks/resilience/transaction-patterns.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,+GAA+G;AAC/G;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEnG,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG;IAC3B,qBAAqB;IACrB,0BAA0B;IAC1B,0BAA0B;IAC1B,uBAAuB;IACvB,iBAAiB;IACjB,mBAAmB,EAAE,oDAAoD;IACzE,gCAAgC;CACjC,CAAC;AAEF;;GAEG;AACH,MAAM,2BAA2B,GAAG;IAClC,iBAAiB;IACjB,mBAAmB;IACnB,SAAS;IACT,WAAW;CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,6BAA6B,GAAG;IACpC,qBAAqB;IACrB,gBAAgB;IAChB,uBAAuB;IACvB,yBAAyB,EAAE,mBAAmB;IAC9C,sBAAsB,EAAE,kBAAkB;CAC3C,CAAC;AAEF;;GAEG;AACH,MAAM,gBAAgB,GAAG;IACvB,qBAAqB;IACrB,eAAe;IACf,mBAAmB;IACnB,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,OAAe,EAAE,UAAkB;IAClE,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,+DAA+D;QACpE,GAAG,EAAE,uDAAuD;KAC7D,CAAC,CAAC;IACH,kDAAkD;IAClD,IAAI,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,SAAS,GAAG,CAAC,CAAC;;QAC/B,SAAS,EAAE,CAAC,CAAC,wBAAwB;IAE1C,2BAA2B;IAC3B,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAE7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtD,8EAA8E;IAC9E,kDAAkD;IAClD,OAAO,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,OAAe,EAAE,UAAkB;IACrE,mEAAmE;IACnE,4CAA4C;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,GAAG,CAAC,CAAC;IAC3D,OAAO,CACL,qGAAqG,CAAC,IAAI,CACxG,MAAM,CACP;QACD,oFAAoF,CAAC,IAAI,CACvF,MAAM,CACP,CACF,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAAC,OAAe,EAAE,QAAgB;IAC7E,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,6EAA6E;QAClF,GAAG,EAAE,kDAAkD;KACxD,CAAC,CAAC;IACH,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;QAC3C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,WAAW,GACf,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACtB,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBAC7C,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,WAAW,EAAE,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACzC,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,0DAA0D;gBACnE,QAAQ,EAAE,SAAS;gBACnB,UAAU,EACR,uNAAuN;gBACzN,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBACf,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gCAAgC,CAAC,OAAe,EAAE,QAAgB;IACzE,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,0EAA0E;QAC/E,GAAG,EAAE,oDAAoD;KAC1D,CAAC,CAAC;IACH,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;QACpD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC;QACV,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAE7F,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;gBACzC,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,yDAAyD;gBAClE,QAAQ,EAAE,SAAS;gBACnB,UAAU,EACR,uJAAuJ;gBACzJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBACf,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,WAAW,CAAC;IACvD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,iCAAiC;IACvC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,sDAAsD;IACnE,eAAe,EAAE;;;;;;;;;6EAS0D;IAC3E,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,cAAc,CAAC;IAChD,SAAS,EAAE,CAAC,IAAI,CAAC;IAEjB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,kEAAkE;QAClE,qEAAqE;QACrE,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACnF,MAAM,qBAAqB,GAAG,iBAAiB;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,oCAAoC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE5D,MAAM,eAAe,GAAG,gCAAgC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE5E,OAAO,CAAC,GAAG,qBAAqB,EAAE,GAAG,eAAe,CAAC,CAAC;IACxD,CAAC;CACF,CAAC,CAAC;AAEH,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;IAC5C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,qBAAqB;IAC3B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,WAAW,EAAE,mDAAmD;IAChE,eAAe,EAAE;;;;;;;;6EAQ0D;IAC3E,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC;IAE3C,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,uCAAuC;QACvC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,kCAAkC;QAClC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAEjE,wEAAwE;QACxE,MAAM,sBAAsB,GAC1B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACrC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAElC,IAAI,sBAAsB,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,6CAA6C;YAC7C,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;gBAC3C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpC,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;oBACvD,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,UAAU;wBAChB,MAAM,EAAE,CAAC;wBACT,OAAO,EAAE,iEAAiE;wBAC1E,QAAQ,EAAE,SAAS;wBACnB,UAAU,EACR,4JAA4J;wBAC9J,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;wBACf,IAAI,EAAE,6BAA6B;wBACnC,QAAQ;qBACT,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/security/__tests__/no-hardcoded-secrets.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview Regression tests for `no-hardcoded-secrets` FP fix.
+ *
+ * The 1.0.7 release added two filters: (1) skip matches inside a
+ * regex literal (the file IS the redactor), (2) skip matches that
+ * are redaction placeholders (`***`, `[REDACTED]`, `XXXX`, etc.).
+ */
+export {};
+//# sourceMappingURL=no-hardcoded-secrets.test.d.ts.map

package/dist/checks/security/__tests__/no-hardcoded-secrets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-hardcoded-secrets.test.d.ts","sourceRoot":"","sources":["../../../../src/checks/security/__tests__/no-hardcoded-secrets.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/checks/security/__tests__/no-hardcoded-secrets.test.js

@@ -0,0 +1,37 @@
+/**
+ * @fileoverview Regression tests for `no-hardcoded-secrets` FP fix.
+ *
+ * The 1.0.7 release added two filters: (1) skip matches inside a
+ * regex literal (the file IS the redactor), (2) skip matches that
+ * are redaction placeholders (`***`, `[REDACTED]`, `XXXX`, etc.).
+ */
+import { describe, expect, it } from 'vitest';
+import { analyzeHardcodedSecrets } from '../no-hardcoded-secrets.js';
+function analyze(src) {
+    return analyzeHardcodedSecrets(src, 'test.ts');
+}
+describe('no-hardcoded-secrets — FP regression suite (1.0.7)', () => {
+    it('does NOT flag a regex literal that detects PRIVATE KEY blobs', () => {
+        // Pre-1.0.7 this fired because the regex pattern body contains
+        // "-----BEGIN PRIVATE KEY-----" literally.
+        const src = String.raw `
+      const REDACTORS = [
+        [/-----BEGIN (?:RSA |EC )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC )?PRIVATE KEY-----/g, '-----BEGIN PRIVATE KEY-----***-----END PRIVATE KEY-----'],
+      ]
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('does NOT flag a redaction placeholder string with ***', () => {
+        const src = `
+      const REDACTED_KEY = '-----BEGIN PRIVATE KEY-----***-----END PRIVATE KEY-----'
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('STILL flags a real PRIVATE KEY literal', () => {
+        const src = `
+      const KEY = '-----BEGIN PRIVATE KEY-----'
+    `;
+        expect(analyze(src).length).toBeGreaterThanOrEqual(1);
+    });
+});
+//# sourceMappingURL=no-hardcoded-secrets.test.js.map

package/dist/checks/security/__tests__/no-hardcoded-secrets.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-hardcoded-secrets.test.js","sourceRoot":"","sources":["../../../../src/checks/security/__tests__/no-hardcoded-secrets.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,+DAA+D;QAC/D,2CAA2C;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;;;;KAIrB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG;;KAEX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG;;KAEX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/security/__tests__/package-supply-chain-policy.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=package-supply-chain-policy.test.d.ts.map

package/dist/checks/security/__tests__/package-supply-chain-policy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-supply-chain-policy.test.d.ts","sourceRoot":"","sources":["../../../../src/checks/security/__tests__/package-supply-chain-policy.test.ts"],"names":[],"mappings":""}

package/dist/checks/security/__tests__/package-supply-chain-policy.test.js

@@ -0,0 +1,128 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileCache } from '@opensip-cli/fitness';
+import { afterEach, describe, expect, it } from 'vitest';
+import { packageSupplyChainPolicy } from '../package-supply-chain-policy.js';
+function makeProject() {
+    return mkdtempSync(join(tmpdir(), 'supply-chain-policy-'));
+}
+function writeFixture(cwd, relPath, content) {
+    const abs = join(cwd, relPath);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, content, 'utf8');
+    return abs;
+}
+async function runPolicy(cwd) {
+    return packageSupplyChainPolicy.run(cwd, {
+        targetFiles: [join(cwd, 'package.json')],
+    });
+}
+afterEach(() => {
+    fileCache.clear();
+});
+describe('package-supply-chain-policy', () => {
+    it('accepts a hardened pnpm project', async () => {
+        const cwd = makeProject();
+        try {
+            writeFixture(cwd, 'package.json', JSON.stringify({
+                name: 'clean-app',
+                private: true,
+                packageManager: 'pnpm@11.5.1+sha512.abc123',
+                dependencies: { yaml: '^2.9.0' },
+            }, null, 2));
+            writeFixture(cwd, 'pnpm-lock.yaml', [
+                "lockfileVersion: '9.0'",
+                'packages:',
+                '  yaml@2.9.0:',
+                '    resolution: {integrity: sha512-clean}',
+            ].join('\n'));
+            writeFixture(cwd, 'pnpm-workspace.yaml', [
+                'packages:',
+                '  - "."',
+                'allowBuilds:',
+                '  esbuild: false',
+                'minimumReleaseAge: 1440',
+                'minimumReleaseAgeStrict: true',
+                'minimumReleaseAgeIgnoreMissingTime: false',
+                'trustPolicy: no-downgrade',
+                'trustLockfile: false',
+                'blockExoticSubdeps: true',
+            ].join('\n'));
+            writeFixture(cwd, '.github/workflows/ci.yml', [
+                'name: CI',
+                'jobs:',
+                '  test:',
+                '    steps:',
+                '      - run: pnpm install --frozen-lockfile',
+            ].join('\n'));
+            const result = await runPolicy(cwd);
+            expect(result.signals).toHaveLength(0);
+        }
+        finally {
+            rmSync(cwd, { recursive: true, force: true });
+        }
+    });
+    it('flags missing pins, mutable installs, install hooks, tokens, and exotic dependencies', async () => {
+        const cwd = makeProject();
+        try {
+            writeFixture(cwd, 'package.json', JSON.stringify({
+                name: 'weak-app',
+                version: '1.0.0',
+                scripts: { postinstall: 'node setup.js' },
+                dependencies: { 'left-pad': 'github:example/left-pad' },
+            }, null, 2));
+            writeFixture(cwd, '.github/workflows/release.yml', [
+                'name: Release',
+                'jobs:',
+                '  publish:',
+                '    steps:',
+                '      - run: npm install',
+                '      - run: npm publish',
+                '        env:',
+                '          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}',
+            ].join('\n'));
+            const result = await runPolicy(cwd);
+            const types = result.signals.map((signal) => signal.metadata.type);
+            expect(types).toContain('package-manager-missing');
+            expect(types).toContain('lockfile-missing');
+            expect(types).toContain('exotic-dependency-source');
+            expect(types).toContain('install-lifecycle-script');
+            expect(types).toContain('ci-install-not-frozen');
+            expect(types).toContain('trusted-publishing-missing-oidc');
+            expect(types).toContain('publish-provenance-missing');
+            expect(types).toContain('publish-token-exposure');
+        }
+        finally {
+            rmSync(cwd, { recursive: true, force: true });
+        }
+    });
+    it('flags remote package-lock entries that lack integrity', async () => {
+        const cwd = makeProject();
+        try {
+            writeFixture(cwd, 'package.json', JSON.stringify({
+                name: 'npm-app',
+                private: true,
+                packageManager: 'npm@11.16.0',
+            }, null, 2));
+            writeFixture(cwd, '.npmrc', ['ignore-scripts=true', 'min-release-age=7'].join('\n'));
+            writeFixture(cwd, 'package-lock.json', JSON.stringify({
+                lockfileVersion: 3,
+                packages: {
+                    'node_modules/bad': {
+                        version: '1.0.0',
+                        resolved: 'https://registry.npmjs.org/bad/-/bad-1.0.0.tgz',
+                    },
+                },
+            }, null, 2));
+            writeFixture(cwd, '.github/workflows/ci.yml', ['name: CI', 'jobs:', '  test:', '    steps:', '      - run: npm ci'].join('\n'));
+            const result = await runPolicy(cwd);
+            const types = result.signals.map((signal) => signal.metadata.type);
+            expect(types).toContain('lockfile-entry-missing-integrity');
+        }
+        finally {
+            rmSync(cwd, { recursive: true, force: true });
+        }
+    });
+});
+//# sourceMappingURL=package-supply-chain-policy.test.js.map

package/dist/checks/security/__tests__/package-supply-chain-policy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-supply-chain-policy.test.js","sourceRoot":"","sources":["../../../../src/checks/security/__tests__/package-supply-chain-policy.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAE7E,SAAS,WAAW;IAClB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,OAAe;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAAG,EAAE;QACvC,WAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,2BAA2B;gBAC3C,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACjC,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CACV,GAAG,EACH,gBAAgB,EAChB;gBACE,wBAAwB;gBACxB,WAAW;gBACX,eAAe;gBACf,2CAA2C;aAC5C,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,qBAAqB,EACrB;gBACE,WAAW;gBACX,SAAS;gBACT,cAAc;gBACd,kBAAkB;gBAClB,yBAAyB;gBACzB,+BAA+B;gBAC/B,2CAA2C;gBAC3C,2BAA2B;gBAC3B,sBAAsB;gBACtB,0BAA0B;aAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,YAAY,CACV,GAAG,EACH,0BAA0B,EAC1B;gBACE,UAAU;gBACV,OAAO;gBACP,SAAS;gBACT,YAAY;gBACZ,6CAA6C;aAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE;gBACzC,YAAY,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;aACxD,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CACV,GAAG,EACH,+BAA+B,EAC/B;gBACE,eAAe;gBACf,OAAO;gBACP,YAAY;gBACZ,YAAY;gBACZ,0BAA0B;gBAC1B,0BAA0B;gBAC1B,cAAc;gBACd,qDAAqD;aACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;YACjD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CACV,GAAG,EACH,cAAc,EACd,IAAI,CAAC,SAAS,CACZ;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,aAAa;aAC9B,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,YAAY,CACV,GAAG,EACH,mBAAmB,EACnB,IAAI,CAAC,SAAS,CACZ;gBACE,eAAe,EAAE,CAAC;gBAClB,QAAQ,EAAE;oBACR,kBAAkB,EAAE;wBAClB,OAAO,EAAE,OAAO;wBAChB,QAAQ,EAAE,gDAAgD;qBAC3D;iBACF;aACF,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YACF,YAAY,CACV,GAAG,EACH,0BAA0B,EAC1B,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACjF,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC9D,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/security/api-key-rotation.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Validate API key handling supports rotation
+ */
+/**
+ * Check: security/api-key-rotation
+ *
+ * Validates that API key handling supports key rotation.
+ */
+export declare const apiKeyRotation: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=api-key-rotation.d.ts.map

package/dist/checks/security/api-key-rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-rotation.d.ts","sourceRoot":"","sources":["../../../src/checks/security/api-key-rotation.ts"],"names":[],"mappings":"AAEA;;GAEG;AAyIH;;;;GAIG;AACH,eAAO,MAAM,cAAc,sCA4DzB,CAAC"}