@opensip-tools/fitness 1.0.4

package/src/plugins/check-package-discovery.ts

@@ -0,0 +1,242 @@
+/**
+ * @fileoverview Auto-discovery of @opensip-tools/checks-* packages
+ * installed in node_modules.
+ *
+ * Resolution rules (apply in order):
+ *
+ *   1. If `plugins.checkPackages` is declared in the project config,
+ *      that explicit list wins. Auto-discovery is skipped entirely.
+ *      Lets users pin their check set deterministically.
+ *
+ *   2. Else if `plugins.autoDiscoverChecks: false` is declared,
+ *      no additional check packages are loaded. Lets users opt out
+ *      of dependency-based discovery (e.g. when running in an
+ *      environment with unrelated @opensip-tools packages installed).
+ *
+ *   3. Otherwise (default), scan node_modules for any package whose
+ *      name matches `@opensip-tools/checks-*` and return the list.
+ *
+ * No package is privileged — what used to be `checks-builtin` is now
+ * just one of many `@opensip-tools/checks-*` packages declared as
+ * ordinary CLI dependencies and discovered uniformly. The CLI no
+ * longer hardcodes any check package import.
+ *
+ * The walker handles pnpm's nested node_modules layout: it looks at
+ * the project's direct node_modules, then walks up to ancestor
+ * node_modules (matching Node's resolution algorithm). We don't need
+ * to recurse into transitive deps because check packages are expected
+ * to be direct dependencies.
+ */
+
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { dirname, join } from 'node:path'
+
+import { logger } from '@opensip-tools/core'
+
+const CONFIG_FILENAME = 'opensip-tools.config.yml'
+
+// Bridge ESM ↔ CJS: createRequire bound to this module's URL gives us a
+// `require` that resolves js-yaml from this package's own deps. The bare
+// `require('js-yaml')` form fails in ESM because no global require is
+// present; using createRequire(import.meta.url) is the supported escape
+// hatch.
+const requireFromHere = createRequire(import.meta.url)
+
+const SCOPE = '@opensip-tools'
+const CHECKS_PREFIX = 'checks-'
+
+export interface CheckPackageDiscoveryOptions {
+  /** Absolute path to the project root (where opensip-tools.config.yml lives). */
+  readonly projectDir: string
+  /** Explicit list from `plugins.checkPackages` in the config. */
+  readonly explicitPackages?: readonly string[]
+  /** When false, auto-discovery is disabled. Default: true. */
+  readonly autoDiscover?: boolean
+}
+
+export interface DiscoveredCheckPackage {
+  /** npm package name, e.g. '@opensip-tools/checks-python'. */
+  readonly name: string
+  /** Absolute path to the package's directory inside node_modules. */
+  readonly packageDir: string
+}
+
+/**
+ * Resolve the list of check packages to load, applying the ordered
+ * resolution rules in the file header. Returns every discovered
+ * @opensip-tools/checks-* package; the CLI loads them all uniformly,
+ * with no package privileged over another.
+ */
+export function discoverCheckPackages(
+  options: CheckPackageDiscoveryOptions,
+): DiscoveredCheckPackage[] {
+  const { projectDir, explicitPackages, autoDiscover = true } = options
+
+  // Rule 1: explicit list wins
+  if (explicitPackages !== undefined) {
+    if (explicitPackages.length === 0) {
+      return []
+    }
+    const out: DiscoveredCheckPackage[] = []
+    for (const name of explicitPackages) {
+      const dir = resolvePackageDir(projectDir, name)
+      if (dir) {
+        out.push({ name, packageDir: dir })
+      } else {
+        logger.warn({
+          evt: 'plugin.check_package.not_resolved',
+          module: 'core:plugins',
+          name,
+          msg: `Configured check package "${name}" is not installed in node_modules — skipping`,
+        })
+      }
+    }
+    return out
+  }
+
+  // Rule 2: opt-out
+  if (!autoDiscover) {
+    return []
+  }
+
+  // Rule 3: auto-discover
+  return autoDiscoverChecks(projectDir)
+}
+
+/**
+ * Walk up the directory tree from `projectDir` looking for the first
+ * `node_modules/@opensip-tools/` directory and return all `checks-*`
+ * package directories found there. Mirrors Node's module resolution
+ * (any ancestor node_modules counts), which handles pnpm hoisting and
+ * monorepo layouts where the scope may live in the workspace root.
+ */
+// eslint-disable-next-line sonarjs/cognitive-complexity -- ancestor-walk discovery: walks node_modules trees up the directory tree until the filesystem root
+function autoDiscoverChecks(projectDir: string): DiscoveredCheckPackage[] {
+  const seen = new Set<string>()
+  const out: DiscoveredCheckPackage[] = []
+  let dir = projectDir
+  let prev = ''
+  while (dir !== prev) {
+    const scopeDir = join(dir, 'node_modules', SCOPE)
+    if (existsSync(scopeDir)) {
+      for (const entry of safeReaddir(scopeDir)) {
+        if (!entry.startsWith(CHECKS_PREFIX)) continue
+        const name = `${SCOPE}/${entry}`
+        if (seen.has(name)) continue
+        const packageDir = join(scopeDir, entry)
+        if (!hasPackageJson(packageDir)) continue
+        seen.add(name)
+        out.push({ name, packageDir })
+      }
+    }
+    prev = dir
+    dir = dirname(dir)
+  }
+  return out
+}
+
+function resolvePackageDir(projectDir: string, name: string): string | undefined {
+  let dir = projectDir
+  let prev = ''
+  while (dir !== prev) {
+    const candidate = join(dir, 'node_modules', name)
+    if (hasPackageJson(candidate)) return candidate
+    prev = dir
+    dir = dirname(dir)
+  }
+  return undefined
+}
+
+function hasPackageJson(packageDir: string): boolean {
+  if (!existsSync(packageDir)) return false
+  return existsSync(join(packageDir, 'package.json'))
+}
+
+function safeReaddir(dir: string): string[] {
+  try {
+    return readdirSync(dir)
+  } catch {
+    return []
+  }
+}
+
+/**
+ * Read `name` and `main`/`exports` from a package.json. Used by the CLI
+ * to resolve the entry point of a discovered check package.
+ */
+export interface CheckPackageMetadata {
+  readonly name: string
+  readonly mainEntry: string
+}
+
+/**
+ * Read the `plugins.checkPackages` and `plugins.autoDiscoverChecks`
+ * fields from the project's opensip-tools.config.yml without doing a
+ * full schema parse. Returns the raw values so callers can apply the
+ * resolution rules in `discoverCheckPackages()`.
+ *
+ * Mirrors the inline-yaml-read pattern used by readProjectPluginsList()
+ * — avoids a circular dep between plugins/ and targets/.
+ */
+export function readCheckPackagePreferences(projectDir: string): {
+  readonly checkPackages?: readonly string[]
+  readonly autoDiscoverChecks?: boolean
+} {
+  const configPath = join(projectDir, CONFIG_FILENAME)
+  if (!existsSync(configPath)) return {}
+  try {
+    const raw = readFileSync(configPath, 'utf8')
+    const yaml = requireFromHere('js-yaml') as { load: (s: string) => unknown }
+    const doc = yaml.load(raw) as Record<string, unknown> | null
+    if (!doc || typeof doc !== 'object') return {}
+    const plugins = doc.plugins
+    if (!plugins || typeof plugins !== 'object') return {}
+    const p = plugins as Record<string, unknown>
+    const result: { checkPackages?: readonly string[]; autoDiscoverChecks?: boolean } = {}
+    if (Array.isArray(p.checkPackages)) {
+      result.checkPackages = p.checkPackages.filter((v): v is string => typeof v === 'string')
+    }
+    if (typeof p.autoDiscoverChecks === 'boolean') {
+      result.autoDiscoverChecks = p.autoDiscoverChecks
+    }
+    return result
+  } catch {
+    return {}
+  }
+}
+
+// eslint-disable-next-line sonarjs/cognitive-complexity -- exports-map resolution: each branch corresponds to a documented npm exports shape (string, object with import/default/require)
+export function readCheckPackageMetadata(packageDir: string): CheckPackageMetadata | undefined {
+  const pkgPath = join(packageDir, 'package.json')
+  if (!existsSync(pkgPath)) return undefined
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8')) as {
+      name?: string
+      main?: string
+      exports?: Record<string, unknown> | string
+    }
+    if (!pkg.name) return undefined
+    let mainEntry: string | undefined
+    const exports = pkg.exports
+    if (typeof exports === 'string') {
+      mainEntry = exports
+    } else if (exports && typeof exports === 'object' && '.' in exports) {
+      const dot = exports['.']
+      if (typeof dot === 'string') {
+        mainEntry = dot
+      } else if (dot && typeof dot === 'object') {
+        const obj = dot as Record<string, unknown>
+        if (typeof obj.import === 'string') mainEntry = obj.import
+        else if (typeof obj.default === 'string') mainEntry = obj.default
+      }
+    }
+    if (!mainEntry && typeof pkg.main === 'string') {
+      mainEntry = pkg.main
+    }
+    mainEntry ??= './index.js'
+    return { name: pkg.name, mainEntry: join(packageDir, mainEntry) }
+  } catch {
+    return undefined
+  }
+}

package/src/plugins/loader.ts

@@ -0,0 +1,327 @@
+/**
+ * @fileoverview Plugin loader — dynamic import and registration
+ *
+ * Takes discovered plugins, imports them, validates their exports,
+ * and registers checks/recipes with namespaces.
+ */
+
+import { pathToFileURL } from 'node:url'
+
+import { logger, defaultLanguageRegistry, discoverPlugins } from '@opensip-tools/core'
+
+
+import { isCheck } from '../framework/check-types.js'
+import { defaultRegistry } from '../framework/registry.js'
+import { defaultRecipeRegistry } from '../recipes/registry.js'
+
+import type { FitPluginExports } from './types.js'
+import type { FitnessRecipe } from '../recipes/types.js'
+import type {
+  DiscoveredPlugin,
+  LangPluginExports,
+  LoadedPlugin,
+  PluginDomain,
+  PluginLoadResult,
+} from '@opensip-tools/core'
+
+/** Logger module tag used by every event emitted from this loader. */
+const MODULE_TAG = 'core:plugins'
+
+/**
+ * Load a single discovered plugin.
+ *
+ * For `domain === 'lang'`, the module is expected to export an `adapters`
+ * array of LanguageAdapter; each is registered with defaultLanguageRegistry.
+ * For other domains, registers checks and recipes with defaultRegistry and
+ * defaultRecipeRegistry respectively.
+ */
+// eslint-disable-next-line sonarjs/cognitive-complexity -- plugin loader dispatcher: handles three domains and lifecycle (validate, register, error-wrap) inline; splitting fragments error context
+export async function loadPlugin(
+  plugin: DiscoveredPlugin,
+  domain: PluginDomain = 'fit',
+): Promise<LoadedPlugin> {
+  try {
+    const moduleUrl = pathToFileURL(plugin.entryPoint).href
+    const mod = await import(moduleUrl) as FitPluginExports & LangPluginExports
+
+    let checksRegistered = 0
+    let recipesRegistered = 0
+    let adaptersRegistered = 0
+
+    // Lang domain: register language adapters from `adapters` array,
+    // named exports, and default export. Adapters are deduplicated by id.
+    if (domain === 'lang') {
+      const registeredAdapterIds = new Set<string>()
+
+      const tryRegisterAdapter = (value: unknown, sourceLabel: string): void => {
+        if (!looksLikeLanguageAdapter(value)) return
+        const id = (value as { id: string }).id
+        if (registeredAdapterIds.has(id)) return
+        defaultLanguageRegistry.register(value as Parameters<typeof defaultLanguageRegistry.register>[0])
+        registeredAdapterIds.add(id)
+        adaptersRegistered++
+        logger.debug({
+          evt: 'plugin.loader.adapter.registered',
+          module: MODULE_TAG,
+          namespace: plugin.namespace,
+          source: sourceLabel,
+          id,
+        })
+      }
+
+      if (mod.adapters !== undefined) {
+        if (Array.isArray(mod.adapters)) {
+          for (const [index, adapter] of mod.adapters.entries()) {
+            if (looksLikeLanguageAdapter(adapter)) {
+              tryRegisterAdapter(adapter, `adapters[${index}]`)
+            } else {
+              logger.warn({
+                evt: 'plugin.loader.invalid_adapter_item',
+                module: MODULE_TAG,
+                namespace: plugin.namespace,
+                source: plugin.source,
+                index,
+                msg: `Plugin "${plugin.namespace}" adapters[${index}] is not a valid LanguageAdapter — skipping.`,
+              })
+            }
+          }
+        } else {
+          logger.warn({
+            evt: 'plugin.loader.invalid_adapters_export',
+            module: MODULE_TAG,
+            namespace: plugin.namespace,
+            source: plugin.source,
+            msg: `Plugin "${plugin.namespace}" exports "adapters" but it is not an array — skipping adapter registration.`,
+          })
+        }
+      }
+
+      // Named exports that look like LanguageAdapter
+      for (const [exportName, value] of Object.entries(mod)) {
+        if (
+          exportName === 'default' ||
+          exportName === 'adapters' ||
+          exportName === 'checks' ||
+          exportName === 'recipes' ||
+          exportName === 'metadata'
+        ) continue
+        tryRegisterAdapter(value, `named:${exportName}`)
+      }
+
+      // Default export: a single LanguageAdapter
+      const defaultExport = (mod as { default?: unknown }).default
+      tryRegisterAdapter(defaultExport, 'default')
+    }
+
+    // Register checks with namespace (skipped for lang domain).
+    //
+    // Two authorship styles are supported:
+    //   1. `export const checks = [...]`  — array of Check instances
+    //   2. `export const myCheck = defineCheck({...})` — Check as a named export
+    //
+    // Style 2 enables single-file plugins that drop into ~/.opensip-tools/fit/
+    // to author one check per file without a redundant array wrapper.
+    // Both styles can coexist in the same module; checks are deduplicated by
+    // their stable id so a check appearing in both an array and a named
+    // export is registered exactly once.
+    if (domain !== 'lang') {
+      const registeredIds = new Set<string>()
+
+      // Style 1: explicit `checks` array
+      if (mod.checks !== undefined) {
+        if (Array.isArray(mod.checks)) {
+          for (const [index, check] of mod.checks.entries()) {
+            if (isCheck(check)) {
+              if (!registeredIds.has(check.config.id)) {
+                defaultRegistry.register(check, plugin.namespace)
+                registeredIds.add(check.config.id)
+                checksRegistered++
+              }
+            } else {
+              logger.warn({
+                evt: 'plugin.loader.invalid_check_item',
+                module: MODULE_TAG,
+                namespace: plugin.namespace,
+                source: plugin.source,
+                index,
+                msg: `Plugin "${plugin.namespace}" checks[${index}] is not a valid Check object — skipping.`,
+              })
+            }
+          }
+        } else {
+          logger.warn({
+            evt: 'plugin.loader.invalid_checks_export',
+            module: MODULE_TAG,
+            namespace: plugin.namespace,
+            source: plugin.source,
+            msg: `Plugin "${plugin.namespace}" exports "checks" but it is not an array — skipping checks registration.`,
+          })
+        }
+      }
+
+      // Style 2: any named export that is a Check instance
+      for (const [exportName, value] of Object.entries(mod)) {
+        if (exportName === 'default' || exportName === 'checks' || exportName === 'recipes' || exportName === 'metadata') continue
+        if (isCheck(value) && !registeredIds.has(value.config.id)) {
+            defaultRegistry.register(value, plugin.namespace)
+            registeredIds.add(value.config.id)
+            checksRegistered++
+          }
+      }
+
+      // Default export: a single Check instance
+      const defaultExport = (mod as { default?: unknown }).default
+      if (isCheck(defaultExport) && !registeredIds.has(defaultExport.config.id)) {
+          defaultRegistry.register(defaultExport, plugin.namespace)
+          registeredIds.add(defaultExport.config.id)
+          checksRegistered++
+        }
+    }
+
+    // Register recipes (skipped for lang domain)
+    if (domain !== 'lang' && mod.recipes !== undefined) {
+      const recipes: readonly FitnessRecipe[] = mod.recipes
+      for (const [index, recipe] of recipes.entries()) {
+        if (recipe && typeof recipe === 'object' && 'id' in recipe && 'name' in recipe) {
+          try {
+            defaultRecipeRegistry.register(recipe, { allowOverwrite: false })
+            recipesRegistered++
+          } catch {
+            // Duplicate recipe — skip silently
+          }
+        } else {
+          logger.warn({
+            evt: 'plugin.loader.invalid_recipe_item',
+            module: MODULE_TAG,
+            namespace: plugin.namespace,
+            source: plugin.source,
+            index,
+            msg: `Plugin "${plugin.namespace}" recipes[${index}] is not a valid Recipe object (missing id or name) — skipping.`,
+          })
+        }
+      }
+    }
+
+    // Warn only when nothing was registered. With named-export discovery,
+    // counting actual registrations is more accurate than checking which
+    // declared exports were present.
+    const nothingRegistered =
+      domain === 'lang'
+        ? adaptersRegistered === 0
+        : checksRegistered === 0 && recipesRegistered === 0
+
+    if (nothingRegistered) {
+      logger.warn({
+        evt: 'plugin.loader.no_exports',
+        module: MODULE_TAG,
+        namespace: plugin.namespace,
+        source: plugin.source,
+        domain,
+        msg:
+          domain === 'lang'
+            ? `Plugin "${plugin.namespace}" registered no language adapters — nothing to use.`
+            : `Plugin "${plugin.namespace}" registered no checks or recipes — nothing to run.`,
+      })
+    }
+
+    logger.info({
+      evt: 'plugin.loader.load.success',
+      module: MODULE_TAG,
+      namespace: plugin.namespace,
+      source: plugin.source,
+      domain,
+      checksRegistered,
+      recipesRegistered,
+      adaptersRegistered,
+    })
+
+    return {
+      namespace: plugin.namespace,
+      source: plugin.source,
+      type: plugin.type,
+      checksRegistered,
+      recipesRegistered,
+      adaptersRegistered,
+    }
+  } catch (error) {
+    const errorMsg = error instanceof Error ? error.message : String(error)
+
+    logger.warn({
+      evt: 'plugin.loader.load.error',
+      module: MODULE_TAG,
+      namespace: plugin.namespace,
+      source: plugin.source,
+      error: errorMsg,
+      err: error instanceof Error ? error : undefined,
+      msg: `Plugin "${plugin.namespace}" failed to load: ${errorMsg}. Continuing without this plugin.`,
+    })
+
+    return {
+      namespace: plugin.namespace,
+      source: plugin.source,
+      type: plugin.type,
+      checksRegistered: 0,
+      recipesRegistered: 0,
+      adaptersRegistered: 0,
+      error: errorMsg,
+    }
+  }
+}
+
+/**
+ * Structural check for LanguageAdapter — used by the lang plugin domain
+ * to identify adapter values among arbitrary named exports. We don't
+ * have a runtime type guard equivalent to isCheck() for adapters, so
+ * we duck-type the required surface (`id`, `fileExtensions`, `parse`,
+ * `stripStrings`, `stripComments`).
+ */
+function looksLikeLanguageAdapter(value: unknown): boolean {
+  if (!value || typeof value !== 'object') return false
+  const v = value as Record<string, unknown>
+  return (
+    typeof v.id === 'string' &&
+    Array.isArray(v.fileExtensions) &&
+    typeof v.parse === 'function' &&
+    typeof v.stripStrings === 'function' &&
+    typeof v.stripComments === 'function'
+  )
+}
+
+/**
+ * Discover and load all plugins for a domain. Loads sequentially to
+ * ensure deterministic registration order.
+ *
+ * Discovers loose `.mjs` files under
+ * `<projectDir>/opensip-tools/<tool>/{checks,recipes,scenarios}/` plus
+ * any npm-installed packages in
+ * `<projectDir>/opensip-tools/.runtime/plugins/<domain>/node_modules/`
+ * that are listed in `plugins.<domain>` in the project config.
+ *
+ * Without a `projectDir`, no plugins are loaded — there's no
+ * user-global fallback.
+ */
+export async function loadAllPlugins(
+  domain: PluginDomain,
+  projectDir?: string,
+): Promise<PluginLoadResult> {
+  const discovered = discoverPlugins(domain, projectDir)
+
+  const plugins: LoadedPlugin[] = []
+  const errors: string[] = []
+
+  for (const plugin of discovered) {
+    const result = await loadPlugin(plugin, domain)
+    plugins.push(result)
+    if (result.error) {
+      errors.push(`${result.source}: ${result.error}`)
+    }
+  }
+
+  return {
+    plugins,
+    totalChecks: plugins.reduce((sum, p) => sum + p.checksRegistered, 0),
+    totalRecipes: plugins.reduce((sum, p) => sum + p.recipesRegistered, 0),
+    totalAdapters: plugins.reduce((sum, p) => sum + (p.adaptersRegistered ?? 0), 0),
+    errors,
+  }
+}

package/src/plugins/types.ts

@@ -0,0 +1,25 @@
+/**
+ * @fileoverview Fitness plugin export contract
+ *
+ * What an @opensip-tools/checks-* (or any fit-domain plugin) exports.
+ * Held in fitness because it references Check / FitnessRecipe — types
+ * the kernel doesn't know about.
+ */
+
+
+import type { Check } from '../framework/check-types.js'
+import type { FitnessRecipe } from '../recipes/types.js'
+import type { CheckDisplayEntry, PluginMetadata } from '@opensip-tools/core'
+
+/** What a fitness plugin package/file exports */
+export interface FitPluginExports {
+  readonly checks?: readonly Check[]
+  readonly recipes?: readonly FitnessRecipe[]
+  readonly metadata?: PluginMetadata
+  /**
+   * Optional display map: check slug → [icon, displayName].
+   * The CLI merges these from every loaded check package and uses
+   * the merged map when rendering tables and dashboard catalog entries.
+   */
+  readonly checkDisplay?: Readonly<Record<string, CheckDisplayEntry>>
+}

package/src/recipes/__tests__/built-in-recipes.test.ts

@@ -0,0 +1,107 @@
+import { describe, it, expect } from 'vitest';
+
+import { builtInRecipes, builtInRecipesByName, isBuiltInRecipe } from '../built-in-recipes.js';
+
+describe('built-in recipes', () => {
+  it('has expected recipes', () => {
+    expect(builtInRecipesByName.has('default')).toBe(true);
+    expect(builtInRecipesByName.has('quick-smoke')).toBe(true);
+    expect(builtInRecipesByName.has('security')).toBe(true);
+    expect(builtInRecipesByName.has('backend')).toBe(true);
+    expect(builtInRecipesByName.has('frontend')).toBe(true);
+    expect(builtInRecipesByName.has('ci')).toBe(true);
+    expect(builtInRecipesByName.has('pre-commit')).toBe(true);
+    expect(builtInRecipesByName.has('pre-release')).toBe(true);
+    expect(builtInRecipesByName.has('nightly-full')).toBe(true);
+    expect(builtInRecipesByName.has('architecture')).toBe(true);
+  });
+
+  it('builtInRecipes array matches builtInRecipesByName map', () => {
+    expect(builtInRecipes.length).toBe(builtInRecipesByName.size);
+    for (const recipe of builtInRecipes) {
+      expect(builtInRecipesByName.get(recipe.name)).toBe(recipe);
+    }
+  });
+
+  it('all recipes have required fields', () => {
+    for (const [name, recipe] of builtInRecipesByName) {
+      expect(recipe.name).toBe(name);
+      expect(recipe.id).toBeDefined();
+      expect(recipe.displayName).toBeDefined();
+      expect(recipe.description).toBeDefined();
+      expect(recipe.checks).toBeDefined();
+      expect(recipe.execution).toBeDefined();
+      expect(recipe.reporting).toBeDefined();
+    }
+  });
+
+  it('all recipes have valid check selector types', () => {
+    const validTypes = ['all', 'explicit', 'pattern', 'tags'];
+    for (const [, recipe] of builtInRecipesByName) {
+      expect(validTypes).toContain(recipe.checks.type);
+    }
+  });
+
+  it('default recipe includes all checks', () => {
+    const defaultRecipe = builtInRecipesByName.get('default');
+    expect(defaultRecipe?.checks.type).toBe('all');
+  });
+
+  it('pre-release recipe includes all checks', () => {
+    const preRelease = builtInRecipesByName.get('pre-release');
+    expect(preRelease?.checks.type).toBe('all');
+  });
+
+  it('quick-smoke recipe uses explicit check list', () => {
+    const quickSmoke = builtInRecipesByName.get('quick-smoke');
+    expect(quickSmoke?.checks.type).toBe('explicit');
+    if (quickSmoke?.checks.type === 'explicit') {
+      expect(quickSmoke.checks.checkIds.length).toBeGreaterThan(0);
+    }
+  });
+
+  it('backend recipe uses pattern selector', () => {
+    const backend = builtInRecipesByName.get('backend');
+    expect(backend?.checks.type).toBe('pattern');
+    if (backend?.checks.type === 'pattern') {
+      expect(backend.checks.include.length).toBeGreaterThan(0);
+    }
+  });
+
+  it('architecture recipe uses tags selector', () => {
+    const arch = builtInRecipesByName.get('architecture');
+    expect(arch?.checks.type).toBe('tags');
+    if (arch?.checks.type === 'tags') {
+      expect(arch.checks.include).toContain('architecture');
+    }
+  });
+
+  it('all recipes have valid execution modes', () => {
+    for (const [, recipe] of builtInRecipesByName) {
+      expect(['parallel', 'sequential']).toContain(recipe.execution.mode);
+    }
+  });
+
+  it('all recipes have valid reporting formats', () => {
+    for (const [, recipe] of builtInRecipesByName) {
+      expect(['table', 'json', 'unified']).toContain(recipe.reporting.format);
+    }
+  });
+
+  it('isBuiltInRecipe returns true for known recipes', () => {
+    expect(isBuiltInRecipe('default')).toBe(true);
+    expect(isBuiltInRecipe('security')).toBe(true);
+    expect(isBuiltInRecipe('ci')).toBe(true);
+  });
+
+  it('isBuiltInRecipe returns false for unknown recipes', () => {
+    expect(isBuiltInRecipe('nonexistent')).toBe(false);
+    expect(isBuiltInRecipe('')).toBe(false);
+  });
+
+  it('recipes are frozen (immutable)', () => {
+    for (const recipe of builtInRecipes) {
+      expect(Object.isFrozen(recipe)).toBe(true);
+    }
+  });
+});