@opensip-cli/fitness 0.1.0

package/dist/framework/__tests__/strip-literals.test.js

@@ -0,0 +1,87 @@
+import { describe, expect, it } from 'vitest';
+import { isInsideStringLiteral, stripStringLiterals, stripStringsAndComments, stripStringsAndCommentsPreservingPositions, } from '../strip-literals.js';
+describe('stripStringLiterals', () => {
+    it('empties single-quoted strings', () => {
+        expect(stripStringLiterals(`const a = 'hi'`)).toBe(`const a = ''`);
+    });
+    it('empties double-quoted strings', () => {
+        expect(stripStringLiterals(`const a = "hi"`)).toBe(`const a = ""`);
+    });
+    it('empties template literals', () => {
+        expect(stripStringLiterals('const a = `hi`')).toBe('const a = ``');
+    });
+    it('preserves escaped quotes', () => {
+        expect(stripStringLiterals(String.raw `const a = 'it\'s'`)).toBe(`const a = ''`);
+    });
+});
+describe('stripStringsAndComments', () => {
+    it('strips strings AND single-line comments', () => {
+        const out = stripStringsAndComments(`const a = "hi"; // comment\nconst b = 1;`);
+        expect(out).not.toContain('hi');
+        expect(out).not.toContain('comment');
+    });
+    it('keeps code outside strings/comments intact', () => {
+        const out = stripStringsAndComments(`const x = 1;`);
+        expect(out).toBe(`const x = 1;`);
+    });
+});
+describe('isInsideStringLiteral', () => {
+    it('returns true for a position inside a single-quoted string', () => {
+        expect(isInsideStringLiteral(`const x = 'hello'`, 12)).toBe(true);
+    });
+    it('returns true for a position inside a double-quoted string', () => {
+        expect(isInsideStringLiteral(`const x = "hello"`, 12)).toBe(true);
+    });
+    it('returns true for a position inside a template literal', () => {
+        expect(isInsideStringLiteral('const x = `hello`', 12)).toBe(true);
+    });
+    it('returns false for a position outside any string', () => {
+        expect(isInsideStringLiteral(`const x = "h"; foo()`, 18)).toBe(false);
+    });
+    it('handles escaped quotes correctly', () => {
+        // Position 14 is inside the closed string, so still inside the next
+        // unescaped quote? Actually after the closing quote, so outside.
+        expect(isInsideStringLiteral(String.raw `const x = 'it\'s'`, 14)).toBe(true);
+    });
+});
+describe('stripStringsAndCommentsPreservingPositions', () => {
+    it('replaces string content with spaces while preserving newlines', () => {
+        const input = `const a = "hi"\nconst b = 1`;
+        const output = stripStringsAndCommentsPreservingPositions(input);
+        expect(output.length).toBe(input.length);
+        expect(output).toContain('\n');
+        expect(output).not.toContain('hi');
+    });
+    it('blanks out single-line comments to end of line', () => {
+        const input = `const x = 1; // comment\nconst y = 2;`;
+        const output = stripStringsAndCommentsPreservingPositions(input);
+        expect(output.length).toBe(input.length);
+        expect(output).not.toContain('comment');
+        expect(output).toContain('const x = 1;');
+    });
+    it('blanks out block comments preserving line breaks', () => {
+        const input = `const a = 1;\n/* multi\n   line\n*/\nconst b = 2;`;
+        const output = stripStringsAndCommentsPreservingPositions(input);
+        expect(output.length).toBe(input.length);
+        expect(output).not.toContain('multi');
+        expect(output).not.toContain('line');
+    });
+    it('handles escaped characters inside strings', () => {
+        const input = String.raw `const a = "it\"s";`;
+        const output = stripStringsAndCommentsPreservingPositions(input);
+        expect(output.length).toBe(input.length);
+        expect(output).not.toContain('it');
+    });
+    it('preserves character positions outside strings/comments', () => {
+        const input = `const x = "y"; foo();`;
+        const output = stripStringsAndCommentsPreservingPositions(input);
+        expect(output.length).toBe(input.length);
+        expect(output).toContain('foo()');
+        // The "x" identifier should be at the same position
+        expect(output[6]).toBe('x');
+    });
+    it('handles empty content', () => {
+        expect(stripStringsAndCommentsPreservingPositions('')).toBe('');
+    });
+});
+//# sourceMappingURL=strip-literals.test.js.map

package/dist/framework/__tests__/strip-literals.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip-literals.test.js","sourceRoot":"","sources":["../../../src/framework/__tests__/strip-literals.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,0CAA0C,GAC3C,MAAM,sBAAsB,CAAC;AAE9B,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAA,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,GAAG,GAAG,uBAAuB,CAAC,0CAA0C,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAA,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,KAAK,GAAG,6BAA6B,CAAC;QAC5C,MAAM,MAAM,GAAG,0CAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,KAAK,GAAG,uCAAuC,CAAC;QACtD,MAAM,MAAM,GAAG,0CAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,KAAK,GAAG,mDAAmD,CAAC;QAClE,MAAM,MAAM,GAAG,0CAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,oBAAoB,CAAC;QAC7C,MAAM,MAAM,GAAG,0CAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG,uBAAuB,CAAC;QACtC,MAAM,MAAM,GAAG,0CAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,oDAAoD;QACpD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/framework/abortable-exec.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @fileoverview Abortable command execution for fitness checks
+ *
+ * Provides shell command execution with abort signal and timeout support.
+ * Child processes are properly cleaned up on abort.
+ */
+/**
+ * Options for abortable command execution
+ */
+export interface AbortableExecOptions {
+    cwd?: string | undefined;
+    signal?: AbortSignal | undefined;
+    maxBuffer?: number | undefined;
+    env?: NodeJS.ProcessEnv | undefined;
+    timeout?: number | undefined;
+}
+/**
+ * Result of command execution
+ */
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number | null;
+    aborted: boolean;
+}
+/**
+ * Execute a command with abort support.
+ *
+ * @param command - Either a shell command string or an array of [bin, ...args] (no shell).
+ * @throws {SystemError} When the command array is empty
+ * @throws {ExecError} When the child process fails to spawn
+ */
+export declare function execAbortable(command: string | readonly string[], options?: AbortableExecOptions): Promise<ExecResult>;
+//# sourceMappingURL=abortable-exec.d.ts.map

package/dist/framework/abortable-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abortable-exec.d.ts","sourceRoot":"","sources":["../../src/framework/abortable-exec.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAMH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;CAClB;AAoBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACnC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,UAAU,CAAC,CAyGrB"}

package/dist/framework/abortable-exec.js

@@ -0,0 +1,143 @@
+// @fitness-ignore-file semgrep-scan -- reviewed: pattern justified for this module
+// @fitness-ignore-file error-handling-suite -- catch blocks delegate errors through established patterns
+/**
+ * @fileoverview Abortable command execution for fitness checks
+ *
+ * Provides shell command execution with abort signal and timeout support.
+ * Child processes are properly cleaned up on abort.
+ */
+import { spawn } from 'node:child_process';
+import { SystemError } from '@opensip-cli/core';
+/**
+ * Error thrown when command execution fails
+ */
+class ExecError extends SystemError {
+    stdout;
+    stderr;
+    exitCode;
+    aborted;
+    constructor(message, stdout, stderr, exitCode, aborted) {
+        super(message, { code: 'SYSTEM.FITNESS.EXEC_FAILED' });
+        this.stdout = stdout;
+        this.stderr = stderr;
+        this.exitCode = exitCode;
+        this.aborted = aborted;
+        this.name = 'ExecError';
+    }
+}
+const DEFAULT_MAX_BUFFER_BYTES = 10 * 1024 * 1024; // 10 MB
+/**
+ * Execute a command with abort support.
+ *
+ * @param command - Either a shell command string or an array of [bin, ...args] (no shell).
+ * @throws {SystemError} When the command array is empty
+ * @throws {ExecError} When the child process fails to spawn
+ */
+export function execAbortable(command, options = {}) {
+    const { cwd = process.cwd(), signal, maxBuffer = DEFAULT_MAX_BUFFER_BYTES, env = process.env, timeout, } = options;
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            resolve({ stdout: '', stderr: '', exitCode: null, aborted: true });
+            return;
+        }
+        let child;
+        if (typeof command === 'string') {
+            // Shell mode (string command) — callers pass hardcoded commands (e.g., lint/test runners).
+            // Array overload is preferred for untrusted input (no shell, no injection risk).
+            // nosemgrep: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true -- shell=true required for string commands; input is developer-defined check commands, not user input
+            // eslint-disable-next-line sonarjs/os-command -- developer-supplied check command; not user-controllable
+            child = spawn(command, [], {
+                cwd,
+                env,
+                shell: true,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                detached: true,
+            });
+        }
+        else {
+            // Array mode (no shell, safer)
+            if (command.length === 0) {
+                reject(new SystemError('Command array must not be empty', {
+                    code: 'SYSTEM.FITNESS.EXEC_EMPTY_COMMAND',
+                }));
+                return;
+            }
+            const [bin, ...args] = command;
+            // @fitness-ignore-next-line no-non-null-assertions -- command length validated above
+            child = spawn(bin ?? '', args, {
+                cwd,
+                env,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                detached: true,
+            });
+        }
+        let stdout = '';
+        let stderr = '';
+        let aborted = false;
+        let timeoutId;
+        // setEncoding routes chunks through a StringDecoder that buffers
+        // partial multi-byte UTF-8 sequences across 'data' chunk boundaries.
+        // Without it, a non-ASCII char (unicode in a file path, an error
+        // message) split across two chunks decodes to replacement chars and
+        // corrupts the captured output used for downstream text matching.
+        child.stdout?.setEncoding('utf8');
+        child.stderr?.setEncoding('utf8');
+        child.stdout?.on('data', (chunk) => {
+            if (stdout.length + chunk.length <= maxBuffer) {
+                stdout += chunk;
+            }
+        });
+        child.stderr?.on('data', (chunk) => {
+            if (stderr.length + chunk.length <= maxBuffer) {
+                stderr += chunk;
+            }
+        });
+        const abortHandler = () => {
+            if (!aborted) {
+                aborted = true;
+                killProcess(child);
+            }
+        };
+        signal?.addEventListener('abort', abortHandler);
+        if (timeout && timeout > 0) {
+            timeoutId = setTimeout(() => {
+                if (!aborted) {
+                    aborted = true;
+                    killProcess(child);
+                }
+            }, timeout);
+        }
+        child.on('close', (code) => {
+            signal?.removeEventListener('abort', abortHandler);
+            if (timeoutId)
+                clearTimeout(timeoutId);
+            resolve({ stdout, stderr, exitCode: code, aborted });
+        });
+        child.on('error', (err) => {
+            signal?.removeEventListener('abort', abortHandler);
+            if (timeoutId)
+                clearTimeout(timeoutId);
+            reject(new ExecError(`Failed to spawn process: ${err.message}`, stdout, stderr, null, aborted));
+        });
+    });
+}
+/**
+ * Kill a child process and all its descendants.
+ */
+function killProcess(child) {
+    if (child.pid) {
+        try {
+            process.kill(-child.pid, 'SIGKILL');
+        }
+        catch {
+            // @swallow-ok Process group kill failed, try direct kill
+            try {
+                child.kill('SIGKILL');
+            }
+            catch {
+                // @swallow-ok Process already exited
+            }
+        }
+    }
+}
+//# sourceMappingURL=abortable-exec.js.map

package/dist/framework/abortable-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abortable-exec.js","sourceRoot":"","sources":["../../src/framework/abortable-exec.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,yGAAyG;AACzG;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAuBhD;;GAEG;AACH,MAAM,SAAU,SAAQ,WAAW;IAGf;IACA;IACA;IACA;IALlB,YACE,OAAe,EACC,MAAc,EACd,MAAc,EACd,QAAuB,EACvB,OAAgB;QAEhC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QALvC,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAe;QACvB,YAAO,GAAP,OAAO,CAAS;QAGhC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAE3D;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAmC,EACnC,UAAgC,EAAE;IAElC,MAAM,EACJ,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,MAAM,EACN,SAAS,GAAG,wBAAwB,EACpC,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,OAAO,GACR,GAAG,OAAO,CAAC;IAEZ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,IAAI,KAAmB,CAAC;QACxB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,2FAA2F;YAC3F,iFAAiF;YACjF,oLAAoL;YACpL,yGAAyG;YACzG,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE;gBACzB,GAAG;gBACH,GAAG;gBACH,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,+BAA+B;YAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CACJ,IAAI,WAAW,CAAC,iCAAiC,EAAE;oBACjD,IAAI,EAAE,mCAAmC;iBAC1C,CAAC,CACH,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;YAC/B,qFAAqF;YACrF,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE;gBAC7B,GAAG;gBACH,GAAG;gBACH,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAqC,CAAC;QAE1C,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,oEAAoE;QACpE,kEAAkE;QAClE,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAElC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAS,EAAE;YAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAEhD,IAAI,OAAO,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC3B,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,WAAW,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC,EAAE,OAAO,CAAC,CAAC;QACd,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACxC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACnD,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC/B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACnD,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,CACJ,IAAI,SAAS,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CACxF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAmB;IACtC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/framework/check-config.d.ts

@@ -0,0 +1,175 @@
+/**
+ * @fileoverview Unified check configuration schema
+ *
+ * Defines the configuration types for fitness checks with three analysis modes:
+ * - analyze: Per-file analysis with content and path
+ * - analyzeAll: Multi-file analysis with lazy loading FileAccessor
+ * - command: External tool execution with output parsing
+ */
+import type { ItemType } from '../types/findings.js';
+/** Type alias for a kebab-case check slug string. */
+type CheckSlug = string;
+/**
+ * Resolved scope with concrete glob patterns for file matching.
+ * Produced by resolving a CheckScope against targets configuration.
+ */
+export interface ResolvedScope {
+    readonly include: readonly string[];
+    readonly exclude: readonly string[];
+    readonly description: string;
+}
+/**
+ * Semantic concern describing what kind of code a check targets.
+ * Used for automatic target matching: a check with `concerns: ['backend']`
+ * matches any target that declares `concerns: ['backend', ...]`.
+ */
+export type CheckConcern = string;
+/**
+ * Language a check is designed for. Used for automatic target matching:
+ * a check with `languages: ['typescript']` matches any target with
+ * `languages: ['typescript', ...]`.
+ */
+export type CheckLanguage = string;
+/**
+ * Portable scope declaration for a fitness check.
+ *
+ * Instead of referencing project-specific target names, checks declare
+ * what kind of code they analyze. The platform matches this intent
+ * against project targets automatically.
+ *
+ * @example
+ * ```typescript
+ * scope: {
+ *   languages: ['typescript'],
+ *   concerns: ['backend', 'server'],
+ * }
+ * ```
+ */
+export interface CheckScope {
+    /** File type affinity — which languages this check analyzes. */
+    readonly languages: readonly CheckLanguage[];
+    /** Semantic hints — what kind of code this check targets. */
+    readonly concerns: readonly CheckConcern[];
+}
+/**
+ * Violation returned by check authors.
+ * This is the simplified shape - the framework converts it to a Signal.
+ */
+export interface CheckViolation {
+    readonly line: number;
+    readonly column?: number;
+    readonly message: string;
+    readonly severity: 'error' | 'warning';
+    readonly suggestion?: string;
+    readonly match?: string;
+    readonly type?: string;
+    readonly filePath?: string;
+    readonly fix?: {
+        readonly action: 'replace' | 'insert' | 'delete' | 'refactor' | 'configure' | 'investigate';
+        readonly replacement?: string;
+        readonly confidence: number;
+    };
+}
+/**
+ * Lazy-loading file accessor for analyzeAll mode.
+ */
+export interface FileAccessor {
+    /** List of matched file paths */
+    readonly paths: readonly string[];
+    /** Read a single file on demand (cached after first read) */
+    read(filePath: string): Promise<string>;
+    /** Read multiple files in batch */
+    readMany(filePaths: readonly string[]): Promise<Map<string, string>>;
+    /** Read all matched files */
+    readAll(): Promise<Map<string, string>>;
+}
+/** Configuration for an external command-based check. */
+export interface CommandConfig {
+    readonly bin: string;
+    readonly args: readonly string[] | ((files: readonly string[]) => readonly string[]);
+    parseOutput(stdout: string, stderr: string, exitCode: number, files: readonly string[], cwd: string): CheckViolation[];
+    readonly expectedExitCodes?: readonly number[];
+}
+/** Common configuration fields shared by all check types. */
+interface BaseCheckConfig {
+    readonly id: string;
+    readonly slug: CheckSlug;
+    readonly description: string;
+    readonly longDescription?: string;
+    readonly tags: readonly string[];
+    readonly docs?: string;
+    readonly timeout?: number;
+    readonly disabled?: boolean;
+    readonly fileTypes?: readonly string[];
+    /** Signal provider name for external tool checks (default: 'opensip') */
+    readonly provider?: string;
+    /** The type of items this check validates (default: 'files'). Used for display in results table. */
+    readonly itemType?: ItemType;
+    /** Portable scope declaration for marketplace-ready target matching. */
+    readonly scope?: CheckScope;
+    /**
+     * Content filtering mode for the analyze() function. Names describe
+     * what the filter strips so rule authors don't have to guess at intent.
+     *
+     * - 'raw' (default): Full file content, unchanged. Use for checks that
+     *   need to analyze string content (e.g., hardcoded secrets, PII detection).
+     * - 'strip-strings': String literals replaced with whitespace,
+     *   preserving line/column positions. COMMENTS PRESERVED — use when
+     *   the check reads comment-based directives like the deprecation
+     *   marker, the swallow-ok marker, or `// @fitness-ignore-...` (we
+     *   don't reference those tag names verbatim in this JSDoc to avoid
+     *   confusing static analyzers).
+     * - 'strip-strings-and-comments': BOTH string literals and comments
+     *   replaced with whitespace, preserving line/column positions. Use
+     *   for checks that pattern-match identifiers via regex and would
+     *   false-positive on the same banned phrase appearing in JSDoc /
+     *   line / block comments documenting the rule itself.
+     */
+    readonly contentFilter?: 'raw' | 'strip-strings' | 'strip-strings-and-comments';
+    /**
+     * Confidence level of this check's findings. Consumers of opensip-cli
+     * signals (via --report-to) use this to decide how aggressively to act
+     * on findings; this package treats it as pure metadata.
+     *
+     * - 'high': AST-based or structurally guaranteed no false positives.
+     * - 'medium': Regex with context filtering — some false positives expected.
+     * - 'low': Naive regex or heuristic — surfaced in reports but easily noisy.
+     *
+     * Default: 'medium' (applied at runtime, not in schema).
+     */
+    readonly confidence?: 'high' | 'medium' | 'low';
+    /**
+     * Display icon (emoji) for CLI/dashboard output. Optional — display travels
+     * WITH the check (§5.3 fold), so authors (or a pack's display map applied via
+     * {@link applyCheckDisplay}) set it here rather than in a separate sidecar.
+     */
+    readonly icon?: string;
+    /** Human-readable display name for CLI/dashboard output. Optional (slug fallback). */
+    readonly displayName?: string;
+}
+/** Check config with per-file analysis mode. */
+export interface AnalyzeCheckConfig extends BaseCheckConfig {
+    analyze(content: string, filePath: string): CheckViolation[];
+}
+/** Check config with multi-file analysis mode using FileAccessor. */
+export interface AnalyzeAllCheckConfig extends BaseCheckConfig {
+    analyzeAll(files: FileAccessor): Promise<CheckViolation[]>;
+}
+/** Check config with external command execution mode. */
+export interface CommandCheckConfig extends BaseCheckConfig {
+    command: CommandConfig;
+}
+/** Union of all check configuration types (analyze, analyzeAll, command). */
+export type UnifiedCheckConfig = AnalyzeCheckConfig | AnalyzeAllCheckConfig | CommandCheckConfig;
+/** Validate and parse a check configuration, throwing on invalid input. */
+export declare function validateCheckConfig(config: unknown): UnifiedCheckConfig;
+/** Type guard for per-file analyze mode checks. */
+export declare function isAnalyzeConfig(config: UnifiedCheckConfig): config is AnalyzeCheckConfig;
+/** Type guard for multi-file analyzeAll mode checks. */
+export declare function isAnalyzeAllConfig(config: UnifiedCheckConfig): config is AnalyzeAllCheckConfig;
+/** Type guard for external command mode checks. */
+export declare function isCommandConfig(config: UnifiedCheckConfig): config is CommandCheckConfig;
+/** Determine which analysis mode a check config uses. */
+export declare function getAnalysisMode(config: UnifiedCheckConfig): 'analyze' | 'analyzeAll' | 'command';
+export {};
+//# sourceMappingURL=check-config.d.ts.map

package/dist/framework/check-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-config.d.ts","sourceRoot":"","sources":["../../src/framework/check-config.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAsBrD,qDAAqD;AAErD,KAAK,SAAS,GAAG,MAAM,CAAC;AAMxB;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAMD;;;;GAIG;AAEH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;;;GAIG;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IAC7C,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;CAC5C;AAMD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;QAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,6DAA6D;IAC7D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,6BAA6B;IAC7B,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzC;AAMD,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;IACrF,WAAW,CACT,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,GACV,cAAc,EAAE,CAAC;IACpB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAwBD,6DAA6D;AAC7D,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,GAAG,eAAe,GAAG,4BAA4B,CAAC;IAChF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,sFAAsF;IACtF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAwCD,gDAAgD;AAChD,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAAC;CAC9D;AAED,qEAAqE;AACrE,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CAC5D;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,qBAAqB,GAAG,kBAAkB,CAAC;AAgCjG,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,kBAAkB,CAEvE;AAED,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,IAAI,kBAAkB,CAExF;AAED,wDAAwD;AACxD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,IAAI,qBAAqB,CAE9F;AAED,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,IAAI,kBAAkB,CAExF;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAIhG"}

package/dist/framework/check-config.js

@@ -0,0 +1,115 @@
+// @fitness-ignore-file zod-schema-strictness -- flexible schema for external data
+// @fitness-ignore-file null-safety -- Zod schema builder chains (z.string().regex(), z.object().passthrough().superRefine().pipe()) always return valid schema objects
+/**
+ * @fileoverview Unified check configuration schema
+ *
+ * Defines the configuration types for fitness checks with three analysis modes:
+ * - analyze: Per-file analysis with content and path
+ * - analyzeAll: Multi-file analysis with lazy loading FileAccessor
+ * - command: External tool execution with output parsing
+ */
+import { z } from 'zod';
+// =============================================================================
+// CHECK SLUGS AND IDS
+// =============================================================================
+/** Zod schema for validating kebab-case check slugs. */
+const CheckSlugSchema = z
+    .string()
+    .regex(/^[a-z][a-z0-9-]*(?:-[a-z0-9]+)*$/, 'Check slug must be kebab-case (e.g., no-console-log)');
+/** Zod schema for validating UUID-format check IDs. */
+const CheckIdSchema = z
+    .string()
+    .regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/, 'Check ID must be plain UUID format');
+const CommandArgsSchema = z.union([z.array(z.string()), z.function()]);
+/** Zod schema for validating command configurations. */
+const CommandConfigSchema = z.object({
+    bin: z.string().min(1),
+    args: CommandArgsSchema,
+    parseOutput: z.function(),
+    expectedExitCodes: z.array(z.number().int()).optional(),
+});
+// =============================================================================
+// ANALYSIS MODE SCHEMAS
+// =============================================================================
+const AnalyzeModeSchema = z.object({ analyze: z.function() });
+const AnalyzeAllModeSchema = z.object({ analyzeAll: z.function() });
+const CommandModeSchema = z.object({ command: CommandConfigSchema });
+/**
+ * Zod schema for validating check scope declarations.
+ *
+ * Empty `languages` and empty `concerns` are both valid and mean
+ * "matches any". This is how cross-language ("universal") checks
+ * declare themselves — see @opensip-cli/checks-universal.
+ *
+ * findByScope() in TargetRegistry treats empty arrays as match-any
+ * already; the schema mirrors that behavior so callers can author
+ * universal checks without inventing a wildcard sentinel.
+ */
+const CheckScopeSchema = z.object({
+    languages: z.array(z.string()),
+    concerns: z.array(z.string()),
+});
+const BaseCheckConfigSchema = z.object({
+    id: CheckIdSchema,
+    slug: CheckSlugSchema,
+    description: z.string().min(1, 'Description is required'),
+    longDescription: z.string().optional(),
+    tags: z.array(z.string()).min(1, 'At least one tag is required'),
+    docs: z.string().optional(),
+    timeout: z.number().positive().optional(),
+    disabled: z.boolean().optional(),
+    fileTypes: z.array(z.string()).optional(),
+    provider: z.string().optional(),
+    scope: CheckScopeSchema.optional(),
+    contentFilter: z.enum(['raw', 'strip-strings', 'strip-strings-and-comments']).optional(),
+    confidence: z.enum(['high', 'medium', 'low']).optional(),
+    icon: z.string().optional(),
+    displayName: z.string().optional(),
+});
+// =============================================================================
+// VALIDATION
+// =============================================================================
+/** Zod schema for validating unified check configurations (exactly one analysis mode required). */
+const UnifiedCheckConfigSchema = z
+    .looseObject({})
+    .superRefine((config, ctx) => {
+    const modes = ['analyze' in config, 'analyzeAll' in config, 'command' in config].filter(Boolean).length;
+    if (modes === 0) {
+        ctx.addIssue({
+            code: 'custom',
+            message: 'Check config must specify an analysis mode: analyze, analyzeAll, or command',
+        });
+    }
+    else if (modes > 1) {
+        ctx.addIssue({
+            code: 'custom',
+            message: 'Check config must specify exactly one analysis mode (found multiple)',
+        });
+    }
+})
+    .pipe(BaseCheckConfigSchema.and(z.union([AnalyzeModeSchema, AnalyzeAllModeSchema, CommandModeSchema])));
+/** Validate and parse a check configuration, throwing on invalid input. */
+export function validateCheckConfig(config) {
+    return UnifiedCheckConfigSchema.parse(config);
+}
+/** Type guard for per-file analyze mode checks. */
+export function isAnalyzeConfig(config) {
+    return 'analyze' in config && typeof config.analyze === 'function';
+}
+/** Type guard for multi-file analyzeAll mode checks. */
+export function isAnalyzeAllConfig(config) {
+    return 'analyzeAll' in config && typeof config.analyzeAll === 'function';
+}
+/** Type guard for external command mode checks. */
+export function isCommandConfig(config) {
+    return 'command' in config && typeof config.command === 'object';
+}
+/** Determine which analysis mode a check config uses. */
+export function getAnalysisMode(config) {
+    if (isAnalyzeConfig(config))
+        return 'analyze';
+    if (isAnalyzeAllConfig(config))
+        return 'analyzeAll';
+    return 'command';
+}
+//# sourceMappingURL=check-config.js.map

package/dist/framework/check-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-config.js","sourceRoot":"","sources":["../../src/framework/check-config.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,uKAAuK;AACvK;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,wDAAwD;AACxD,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CACJ,kCAAkC,EAClC,sDAAsD,CACvD,CAAC;AAEJ,uDAAuD;AACvD,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,KAAK,CACJ,gEAAgE,EAChE,oCAAoC,CACrC,CAAC;AA0HJ,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAEvE,wDAAwD;AACxD,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC9D,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAgErE;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC;IACzD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC;IAChE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,4BAA4B,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAwBH,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,mGAAmG;AACnG,MAAM,wBAAwB,GAAG,CAAC;KAC/B,WAAW,CAAC,EAAE,CAAC;KACf,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,KAAK,GAAG,CAAC,SAAS,IAAI,MAAM,EAAE,YAAY,IAAI,MAAM,EAAE,SAAS,IAAI,MAAM,CAAC,CAAC,MAAM,CACrF,OAAO,CACR,CAAC,MAAM,CAAC;IAET,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;KACD,IAAI,CACH,qBAAqB,CAAC,GAAG,CACvB,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC,CACtE,CACF,CAAC;AAEJ,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,OAAO,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAuB,CAAC;AACtE,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,OAAO,SAAS,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC;AACrE,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,OAAO,YAAY,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC;AAC3E,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,OAAO,SAAS,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC;AACnE,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,IAAI,eAAe,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,kBAAkB,CAAC,MAAM,CAAC;QAAE,OAAO,YAAY,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC"}