@oxog/codeguardian 1.0.0

package/dist/plugins/index.js

@@ -0,0 +1,1316 @@
+import ts from 'typescript';
+
+// src/graph/query.ts
+function findCircularDeps(graph) {
+  const cycles = [];
+  const visited = /* @__PURE__ */ new Set();
+  const inStack = /* @__PURE__ */ new Set();
+  const stack = [];
+  const dfs = (node) => {
+    if (inStack.has(node)) {
+      const cycleStart = stack.indexOf(node);
+      if (cycleStart !== -1) {
+        const cycle = [...stack.slice(cycleStart), node];
+        cycles.push(cycle);
+      }
+      return;
+    }
+    if (visited.has(node)) return;
+    visited.add(node);
+    inStack.add(node);
+    stack.push(node);
+    const deps = graph.dependencies.adjacency.get(node);
+    if (deps) {
+      for (const dep of deps) {
+        dfs(dep);
+      }
+    }
+    stack.pop();
+    inStack.delete(node);
+  };
+  for (const node of graph.dependencies.adjacency.keys()) {
+    dfs(node);
+  }
+  return cycles;
+}
+
+// src/plugins/core/architecture.ts
+function architecturePlugin(config = {}) {
+  const fullConfig = {
+    layers: ["controller", "service", "repository", "util"],
+    enforceDirection: true,
+    maxFileLines: 300,
+    maxFunctionLines: 50,
+    ...config
+  };
+  return {
+    name: "architecture",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "architecture/layer-violation",
+        severity: "error",
+        description: "Detects when a lower layer imports from a higher layer",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const layers = fullConfig.layers;
+          if (!fullConfig.enforceDirection || layers.length === 0) return findings;
+          const fileLayer = context.file.layer;
+          const fileLayerIndex = layers.indexOf(fileLayer);
+          if (fileLayerIndex === -1) return findings;
+          for (const imp of context.file.imports) {
+            const targetFile = context.graph.files.get(resolveImport(context.file.path, imp.source));
+            if (!targetFile) continue;
+            const targetLayerIndex = layers.indexOf(targetFile.layer);
+            if (targetLayerIndex === -1) continue;
+            if (fileLayerIndex <= targetLayerIndex) ; else {
+              findings.push({
+                message: `${fileLayer} layer importing from ${targetFile.layer} layer (violates layer direction)`,
+                file: context.file.path,
+                line: 1,
+                column: 1,
+                fix: {
+                  suggestion: `${capitalize(fileLayer)}s should not depend on ${targetFile.layer}s. Invert the dependency.`
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "architecture/circular-dependency",
+        severity: "error",
+        description: "Detects circular import chains",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const cycles = findCircularDeps(context.graph);
+          for (const cycle of cycles) {
+            if (cycle.includes(context.file.path)) {
+              findings.push({
+                message: `Circular dependency detected: ${cycle.join(" \u2192 ")}`,
+                file: context.file.path,
+                line: 1,
+                column: 1,
+                fix: {
+                  suggestion: "Break the cycle by extracting shared types or using dependency injection."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "architecture/file-role-mismatch",
+        severity: "warning",
+        description: "Detects when file content does not match directory role",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const path = context.file.path.toLowerCase();
+          const role = context.file.role;
+          if (path.includes("/service") && role !== "service" && role !== "unknown") {
+            findings.push({
+              message: `File is in services directory but detected role is "${role}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: {
+                suggestion: "Move this file to the appropriate directory or rename it."
+              }
+            });
+          }
+          if (path.includes("/controller") && role !== "controller" && role !== "unknown") {
+            findings.push({
+              message: `File is in controllers directory but detected role is "${role}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: {
+                suggestion: "Move this file to the appropriate directory or rename it."
+              }
+            });
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "architecture/god-file",
+        severity: "warning",
+        description: "Detects files exceeding maximum line count",
+        category: "architecture",
+        check(context) {
+          const maxLines = fullConfig.maxFileLines ?? 300;
+          if (context.file.loc > maxLines) {
+            return [
+              {
+                message: `File has ${context.file.loc} lines (max: ${maxLines})`,
+                file: context.file.path,
+                line: 1,
+                column: 1,
+                fix: {
+                  suggestion: "Split this file into smaller, focused modules."
+                }
+              }
+            ];
+          }
+          return [];
+        }
+      });
+      kernel.registerRule({
+        name: "architecture/god-function",
+        severity: "warning",
+        description: "Detects functions exceeding maximum line count",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const maxLines = fullConfig.maxFunctionLines ?? 50;
+          for (const fn of context.file.functions) {
+            const fnLines = fn.endLine - fn.startLine + 1;
+            if (fnLines > maxLines) {
+              findings.push({
+                message: `Function "${fn.name}" has ${fnLines} lines (max: ${maxLines})`,
+                file: context.file.path,
+                line: fn.startLine,
+                column: 1,
+                fix: {
+                  suggestion: "Extract logic into smaller helper functions."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "architecture/barrel-explosion",
+        severity: "info",
+        description: "Detects barrel files (index.ts) that re-export everything",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const fileName = context.file.path.split("/").pop() ?? "";
+          if (fileName === "index.ts" || fileName === "index.tsx") {
+            const exportCount = context.file.exports.length;
+            if (exportCount > 10) {
+              findings.push({
+                message: `Barrel file re-exports ${exportCount} symbols (may cause bundle size issues)`,
+                file: context.file.path,
+                line: 1,
+                column: 1,
+                fix: {
+                  suggestion: "Consider using direct imports instead of barrel files for tree-shaking."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+    }
+  };
+}
+function resolveImport(fromFile, source) {
+  if (!source.startsWith(".")) return source;
+  const fromDir = fromFile.split("/").slice(0, -1).join("/");
+  const parts = [...fromDir.split("/"), ...source.split("/")];
+  const resolved = [];
+  for (const part of parts) {
+    if (part === "..") resolved.pop();
+    else if (part !== ".") resolved.push(part);
+  }
+  let result = resolved.join("/");
+  if (!result.endsWith(".ts") && !result.endsWith(".tsx")) {
+    result += ".ts";
+  }
+  return result;
+}
+function capitalize(str) {
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}
+var DB_METHODS = ["query", "execute", "raw", "prepare", "exec"];
+var SECRET_PATTERNS = [
+  /^(sk_|pk_|api_|token_|secret_|password|auth_)/i,
+  /^(AKIA[0-9A-Z]{16})/,
+  // AWS access key
+  /^eyJ[A-Za-z0-9-_]+\.eyJ/,
+  // JWT token
+  /^(ghp_|gho_|ghu_|ghs_|ghr_)/,
+  // GitHub tokens
+  /(mongodb(\+srv)?:\/\/|postgres(ql)?:\/\/|mysql:\/\/|redis:\/\/)/i
+  // Connection strings
+];
+function securityPlugin(config = {}) {
+  const fullConfig = {
+    checkInjection: true,
+    checkAuth: true,
+    checkSecrets: true,
+    checkXSS: true,
+    ...config
+  };
+  return {
+    name: "security",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "security/sql-injection",
+        severity: "critical",
+        description: "Detects string concatenation in SQL queries",
+        category: "security",
+        check(context) {
+          if (!fullConfig.checkInjection) return [];
+          const findings = [];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              const expr = call.expression;
+              let methodName = "";
+              if (ts.isPropertyAccessExpression(expr)) {
+                methodName = expr.name.text;
+              } else if (ts.isIdentifier(expr)) {
+                methodName = expr.text;
+              }
+              if (DB_METHODS.includes(methodName)) {
+                for (const arg of call.arguments) {
+                  if (ts.isTemplateExpression(arg) || context.hasStringConcat(arg)) {
+                    const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                    findings.push({
+                      message: "Raw string concatenation in SQL query \u2014 potential SQL injection",
+                      file: context.file.path,
+                      line: pos.line + 1,
+                      column: pos.character + 1,
+                      fix: {
+                        suggestion: "Use parameterized queries instead of string templates."
+                      }
+                    });
+                  }
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/hardcoded-secret",
+        severity: "critical",
+        description: "Detects hardcoded API keys, tokens, and passwords",
+        category: "security",
+        check(context) {
+          if (!fullConfig.checkSecrets) return [];
+          if (context.file.role === "test") return [];
+          const findings = [];
+          context.walk(context.ast, {
+            StringLiteral(node) {
+              const str = node;
+              const value = str.text;
+              if (value.length < 8) return;
+              for (const pattern of SECRET_PATTERNS) {
+                if (pattern.test(value)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(str.getStart(context.ast));
+                  findings.push({
+                    message: "Possible hardcoded secret detected",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Move secrets to environment variables or a secure vault."
+                    }
+                  });
+                  break;
+                }
+              }
+            },
+            NoSubstitutionTemplateLiteral(node) {
+              const tmpl = node;
+              const value = tmpl.text;
+              if (value.length < 8) return;
+              for (const pattern of SECRET_PATTERNS) {
+                if (pattern.test(value)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(tmpl.getStart(context.ast));
+                  findings.push({
+                    message: "Possible hardcoded secret detected",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Move secrets to environment variables or a secure vault."
+                    }
+                  });
+                  break;
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/eval-usage",
+        severity: "critical",
+        description: "Detects eval(), Function(), and similar unsafe patterns",
+        category: "security",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              let name = "";
+              if (ts.isIdentifier(call.expression)) {
+                name = call.expression.text;
+              }
+              if (name === "eval" || name === "Function") {
+                const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                findings.push({
+                  message: `Unsafe ${name}() call \u2014 potential code injection`,
+                  file: context.file.path,
+                  line: pos.line + 1,
+                  column: pos.character + 1,
+                  fix: {
+                    suggestion: `Avoid ${name}(). Use safe alternatives like JSON.parse() or structured data.`
+                  }
+                });
+              }
+              if ((name === "setTimeout" || name === "setInterval") && call.arguments.length > 0) {
+                const firstArg = call.arguments[0];
+                if (ts.isStringLiteral(firstArg)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: `${name}() with string argument is equivalent to eval()`,
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Pass a function reference instead of a string."
+                    }
+                  });
+                }
+              }
+            },
+            NewExpression(node) {
+              const newExpr = node;
+              if (ts.isIdentifier(newExpr.expression) && newExpr.expression.text === "Function") {
+                const pos = context.ast.getLineAndCharacterOfPosition(newExpr.getStart(context.ast));
+                findings.push({
+                  message: "new Function() is equivalent to eval() \u2014 potential code injection",
+                  file: context.file.path,
+                  line: pos.line + 1,
+                  column: pos.character + 1,
+                  fix: {
+                    suggestion: "Avoid new Function(). Use safe alternatives."
+                  }
+                });
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/prototype-pollution",
+        severity: "error",
+        description: "Detects potential prototype pollution",
+        category: "security",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            PropertyAccessExpression(node) {
+              const propAccess = node;
+              if (propAccess.name.text === "__proto__" || propAccess.name.text === "prototype") {
+                const parent = propAccess.parent;
+                if (ts.isBinaryExpression(parent) && parent.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(propAccess.getStart(context.ast));
+                  findings.push({
+                    message: "Direct prototype assignment \u2014 potential prototype pollution",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Use Object.create(null) or Map for dynamic key-value stores."
+                    }
+                  });
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/xss-risk",
+        severity: "error",
+        description: "Detects innerHTML and similar XSS-prone patterns",
+        category: "security",
+        check(context) {
+          if (!fullConfig.checkXSS) return [];
+          const findings = [];
+          const xssProps = ["innerHTML", "outerHTML", "dangerouslySetInnerHTML"];
+          context.walk(context.ast, {
+            PropertyAccessExpression(node) {
+              const propAccess = node;
+              if (xssProps.includes(propAccess.name.text)) {
+                const pos = context.ast.getLineAndCharacterOfPosition(propAccess.getStart(context.ast));
+                findings.push({
+                  message: `Use of ${propAccess.name.text} \u2014 potential XSS vulnerability`,
+                  file: context.file.path,
+                  line: pos.line + 1,
+                  column: pos.character + 1,
+                  fix: {
+                    suggestion: "Sanitize HTML content before insertion or use safe alternatives."
+                  }
+                });
+              }
+            },
+            CallExpression(node) {
+              const call = node;
+              if (ts.isPropertyAccessExpression(call.expression)) {
+                const name = call.expression.name.text;
+                if (name === "write" || name === "writeln") {
+                  if (ts.isIdentifier(call.expression.expression) && call.expression.expression.text === "document") {
+                    const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                    findings.push({
+                      message: "document.write() is an XSS risk",
+                      file: context.file.path,
+                      line: pos.line + 1,
+                      column: pos.character + 1,
+                      fix: {
+                        suggestion: "Use DOM manipulation methods instead of document.write()."
+                      }
+                    });
+                  }
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/missing-auth-check",
+        severity: "warning",
+        description: "Detects route handlers without auth checks",
+        category: "security",
+        check(context) {
+          if (!fullConfig.checkAuth) return [];
+          if (context.file.role !== "controller") return [];
+          const findings = [];
+          const fileText = context.ast.getFullText();
+          const hasAuthReference = fileText.includes("auth") || fileText.includes("Auth") || fileText.includes("authenticate") || fileText.includes("authorize") || fileText.includes("guard") || fileText.includes("middleware") || fileText.includes("jwt") || fileText.includes("token");
+          if (!hasAuthReference && context.file.functions.length > 0) {
+            findings.push({
+              message: "Controller has no authentication/authorization references",
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: {
+                suggestion: "Add authentication middleware or auth checks to route handlers."
+              }
+            });
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/insecure-random",
+        severity: "warning",
+        description: "Detects Math.random() in security-sensitive contexts",
+        category: "security",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              if (ts.isPropertyAccessExpression(call.expression)) {
+                if (ts.isIdentifier(call.expression.expression) && call.expression.expression.text === "Math" && call.expression.name.text === "random") {
+                  const fileText = context.ast.getFullText();
+                  const isSecurityContext = fileText.includes("token") || fileText.includes("secret") || fileText.includes("password") || fileText.includes("hash") || fileText.includes("crypto") || fileText.includes("session");
+                  if (isSecurityContext) {
+                    const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                    findings.push({
+                      message: "Math.random() is not cryptographically secure",
+                      file: context.file.path,
+                      line: pos.line + 1,
+                      column: pos.character + 1,
+                      fix: {
+                        suggestion: "Use crypto.randomBytes() or crypto.randomUUID() for security-sensitive values."
+                      }
+                    });
+                  }
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/path-traversal",
+        severity: "error",
+        description: "Detects file operations with potential path traversal",
+        category: "security",
+        check(context) {
+          const findings = [];
+          const fsOps = ["readFile", "readFileSync", "writeFile", "writeFileSync", "createReadStream", "createWriteStream", "access", "open"];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              let methodName = "";
+              if (ts.isPropertyAccessExpression(call.expression)) {
+                methodName = call.expression.name.text;
+              } else if (ts.isIdentifier(call.expression)) {
+                methodName = call.expression.text;
+              }
+              if (fsOps.includes(methodName) && call.arguments.length > 0) {
+                const firstArg = call.arguments[0];
+                if (ts.isTemplateExpression(firstArg) || context.hasStringConcat(firstArg)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: `File operation "${methodName}" with dynamic path \u2014 potential path traversal`,
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Validate and sanitize file paths. Use path.resolve() and check against a whitelist."
+                    }
+                  });
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+    }
+  };
+}
+var DB_CALL_PATTERNS = ["find", "findOne", "findAll", "findById", "query", "execute", "fetch", "get", "select"];
+var SYNC_FS_METHODS = ["readFileSync", "writeFileSync", "appendFileSync", "mkdirSync", "readdirSync", "statSync", "existsSync", "unlinkSync", "copyFileSync"];
+function performancePlugin(config = {}) {
+  const fullConfig = {
+    checkN1Queries: true,
+    checkMemoryLeaks: true,
+    checkAsyncPatterns: true,
+    checkBundleSize: false,
+    ...config
+  };
+  return {
+    name: "performance",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "performance/n1-query",
+        severity: "warning",
+        description: "Detects database calls inside loops (potential N+1 query)",
+        category: "performance",
+        check(context) {
+          if (!fullConfig.checkN1Queries) return [];
+          const findings = [];
+          const checkForDbCallsInLoop = (loopNode) => {
+            ts.forEachChild(loopNode, function visitChild(child) {
+              if (ts.isCallExpression(child)) {
+                let methodName = "";
+                if (ts.isPropertyAccessExpression(child.expression)) {
+                  methodName = child.expression.name.text;
+                }
+                if (DB_CALL_PATTERNS.includes(methodName)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(child.getStart(context.ast));
+                  findings.push({
+                    message: `Potential N+1 query: "${methodName}" called inside a loop`,
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Batch queries using Promise.all() or a single query with IN clause."
+                    }
+                  });
+                }
+              }
+              ts.forEachChild(child, visitChild);
+            });
+          };
+          context.walk(context.ast, {
+            ForStatement(node) {
+              checkForDbCallsInLoop(node);
+            },
+            ForInStatement(node) {
+              checkForDbCallsInLoop(node);
+            },
+            ForOfStatement(node) {
+              checkForDbCallsInLoop(node);
+            },
+            WhileStatement(node) {
+              checkForDbCallsInLoop(node);
+            },
+            DoStatement(node) {
+              checkForDbCallsInLoop(node);
+            }
+          });
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              if (ts.isPropertyAccessExpression(call.expression)) {
+                const name = call.expression.name.text;
+                if (name === "forEach" || name === "map") {
+                  if (call.arguments.length > 0) {
+                    checkForDbCallsInLoop(call.arguments[0]);
+                  }
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "performance/sync-in-async",
+        severity: "warning",
+        description: "Detects synchronous file operations in async functions",
+        category: "performance",
+        check(context) {
+          if (!fullConfig.checkAsyncPatterns) return [];
+          const findings = [];
+          for (const fn of context.file.functions) {
+            if (!fn.isAsync) continue;
+            context.walk(context.ast, {
+              CallExpression(node) {
+                const call = node;
+                const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                const callLine = pos.line + 1;
+                if (callLine < fn.startLine || callLine > fn.endLine) return;
+                let methodName = "";
+                if (ts.isPropertyAccessExpression(call.expression)) {
+                  methodName = call.expression.name.text;
+                } else if (ts.isIdentifier(call.expression)) {
+                  methodName = call.expression.text;
+                }
+                if (SYNC_FS_METHODS.includes(methodName)) {
+                  findings.push({
+                    message: `Synchronous "${methodName}" in async function "${fn.name}"`,
+                    file: context.file.path,
+                    line: callLine,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: `Use the async version instead (e.g., fs.promises.${methodName.replace("Sync", "")}).`
+                    }
+                  });
+                }
+              }
+            });
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "performance/memory-leak-risk",
+        severity: "warning",
+        description: "Detects addEventListener without removeEventListener, setInterval without clearInterval",
+        category: "performance",
+        check(context) {
+          if (!fullConfig.checkMemoryLeaks) return [];
+          const findings = [];
+          const fileText = context.ast.getFullText();
+          if (fileText.includes("addEventListener") && !fileText.includes("removeEventListener")) {
+            context.walk(context.ast, {
+              CallExpression(node) {
+                const call = node;
+                if (ts.isPropertyAccessExpression(call.expression) && call.expression.name.text === "addEventListener") {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: "addEventListener without corresponding removeEventListener \u2014 potential memory leak",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Add a cleanup function that calls removeEventListener."
+                    }
+                  });
+                }
+              }
+            });
+          }
+          if (fileText.includes("setInterval") && !fileText.includes("clearInterval")) {
+            context.walk(context.ast, {
+              CallExpression(node) {
+                const call = node;
+                if (ts.isIdentifier(call.expression) && call.expression.text === "setInterval") {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: "setInterval without clearInterval \u2014 potential memory leak",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Store the interval ID and clear it when no longer needed."
+                    }
+                  });
+                }
+              }
+            });
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "performance/unbounded-query",
+        severity: "warning",
+        description: "Detects database queries without LIMIT or pagination",
+        category: "performance",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              let methodName = "";
+              if (ts.isPropertyAccessExpression(call.expression)) {
+                methodName = call.expression.name.text;
+              }
+              if (methodName === "findAll" || methodName === "find") {
+                const argText = call.arguments.map((a) => a.getText(context.ast)).join(" ");
+                if (!argText.includes("limit") && !argText.includes("take") && !argText.includes("LIMIT")) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: `"${methodName}" without limit \u2014 could return unbounded results`,
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Add a LIMIT clause or pagination to prevent loading too many records."
+                    }
+                  });
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "performance/missing-index-hint",
+        severity: "info",
+        description: "Detects queries that may need database indexes",
+        category: "performance",
+        check(_context) {
+          return [];
+        }
+      });
+      kernel.registerRule({
+        name: "performance/heavy-import",
+        severity: "info",
+        description: "Detects importing entire libraries when a smaller import is available",
+        category: "performance",
+        check(context) {
+          if (!fullConfig.checkBundleSize) return [];
+          const findings = [];
+          const heavyLibs = ["lodash", "moment", "rxjs"];
+          for (const imp of context.file.imports) {
+            for (const lib of heavyLibs) {
+              if (imp.source === lib && imp.specifiers.length <= 2) {
+                findings.push({
+                  /* v8 ignore next */
+                  message: `Importing from "${lib}" \u2014 consider using "${lib}/${imp.specifiers[0] ?? ""}" for smaller bundle`,
+                  file: context.file.path,
+                  line: 1,
+                  column: 1,
+                  fix: {
+                    suggestion: `Use deep imports (e.g., "${lib}/functionName") for tree-shaking.`
+                  }
+                });
+              }
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "performance/blocking-operation",
+        severity: "warning",
+        description: "Detects CPU-intensive operations in request handlers",
+        category: "performance",
+        check(context) {
+          if (context.file.role !== "controller") return [];
+          const findings = [];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              let methodName = "";
+              if (ts.isPropertyAccessExpression(call.expression)) {
+                methodName = call.expression.name.text;
+              } else if (ts.isIdentifier(call.expression)) {
+                methodName = call.expression.text;
+              }
+              if (methodName === "parse" && ts.isPropertyAccessExpression(call.expression)) {
+                if (ts.isIdentifier(call.expression.expression) && call.expression.expression.text === "JSON") {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: "JSON.parse() in request handler may block event loop for large payloads",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Consider streaming JSON parsing or limiting request body size."
+                    }
+                  });
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+    }
+  };
+}
+function qualityPlugin(config = {}) {
+  const fullConfig = {
+    checkDeadCode: true,
+    checkNaming: true,
+    checkComplexity: true,
+    maxCyclomaticComplexity: 15,
+    ...config
+  };
+  return {
+    name: "quality",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "quality/cyclomatic-complexity",
+        severity: "warning",
+        description: "Detects functions with high cyclomatic complexity",
+        category: "quality",
+        check(context) {
+          if (!fullConfig.checkComplexity) return [];
+          const findings = [];
+          const maxComplexity = fullConfig.maxCyclomaticComplexity ?? 15;
+          for (const fn of context.file.functions) {
+            if (fn.complexity > maxComplexity) {
+              findings.push({
+                message: `Function "${fn.name}" has cyclomatic complexity ${fn.complexity} (max: ${maxComplexity})`,
+                file: context.file.path,
+                line: fn.startLine,
+                column: 1,
+                fix: {
+                  suggestion: "Simplify by extracting conditions into named functions or using early returns."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/dead-code",
+        severity: "warning",
+        description: "Detects exported symbols never imported by other files",
+        category: "quality",
+        check(context) {
+          if (!fullConfig.checkDeadCode) return [];
+          if (context.file.role === "test") return [];
+          const findings = [];
+          for (const exportName of context.file.exports) {
+            if (exportName === "default") continue;
+            const fileName = context.file.path.split("/").pop() ?? "";
+            if (fileName === "index.ts" || fileName === "index.tsx") continue;
+            const isUsed = context.isExternallyUsed(exportName);
+            if (!isUsed) {
+              findings.push({
+                message: `Exported symbol "${exportName}" is never imported by other files`,
+                file: context.file.path,
+                line: 1,
+                column: 1,
+                fix: {
+                  suggestion: "Remove unused export or add an import if intentional."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/any-type",
+        severity: "warning",
+        description: "Detects usage of `any` type annotation",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            // TypeReference for explicit 'any' annotations
+            AnyKeyword(node) {
+              const pos = context.ast.getLineAndCharacterOfPosition(node.getStart(context.ast));
+              findings.push({
+                message: "Usage of `any` type \u2014 use a specific type instead",
+                file: context.file.path,
+                line: pos.line + 1,
+                column: pos.character + 1,
+                fix: {
+                  suggestion: "Replace `any` with a specific type or `unknown`."
+                }
+              });
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/no-error-handling",
+        severity: "warning",
+        description: "Detects async functions without error handling",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          for (const fn of context.file.functions) {
+            if (!fn.isAsync) continue;
+            const fileText = context.ast.getFullText();
+            const fnText = fileText.slice(
+              getLineOffset(fileText, fn.startLine),
+              getLineOffset(fileText, fn.endLine + 1)
+            );
+            const hasTryCatch = fnText.includes("try") && fnText.includes("catch");
+            const hasDotCatch = fnText.includes(".catch(");
+            const hasThrow = fnText.includes("throw ");
+            if (!hasTryCatch && !hasDotCatch && !hasThrow) {
+              findings.push({
+                message: `Async function "${fn.name}" has no error handling (try-catch or .catch())`,
+                file: context.file.path,
+                line: fn.startLine,
+                column: 1,
+                fix: {
+                  suggestion: "Add try-catch around async operations or use .catch() on promises."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/inconsistent-naming",
+        severity: "info",
+        description: "Detects naming that does not follow project conventions",
+        category: "quality",
+        check(context) {
+          if (!fullConfig.checkNaming) return [];
+          const findings = [];
+          for (const fn of context.file.functions) {
+            if (fn.name && !/^[a-z_$]/.test(fn.name) && !/^[A-Z][A-Z_]+$/.test(fn.name)) {
+              if (context.file.role !== "unknown") {
+                findings.push({
+                  message: `Function "${fn.name}" does not follow camelCase naming convention`,
+                  file: context.file.path,
+                  line: fn.startLine,
+                  column: 1,
+                  fix: {
+                    suggestion: "Use camelCase for function names (e.g., getUser, handleRequest)."
+                  }
+                });
+              }
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/magic-number",
+        severity: "info",
+        description: "Detects numeric literals used directly in logic",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          const allowedNumbers = /* @__PURE__ */ new Set([0, 1, -1, 2, 100, 200, 201, 204, 301, 302, 400, 401, 403, 404, 500]);
+          context.walk(context.ast, {
+            NumericLiteral(node) {
+              const num = node;
+              const value = parseFloat(num.text);
+              if (allowedNumbers.has(value)) return;
+              let parent = num.parent;
+              while (parent) {
+                if (ts.isVariableDeclaration(parent) || ts.isEnumMember(parent) || ts.isPropertyAssignment(parent)) {
+                  return;
+                }
+                parent = parent.parent;
+              }
+              const pos = context.ast.getLineAndCharacterOfPosition(num.getStart(context.ast));
+              findings.push({
+                message: `Magic number ${num.text} \u2014 extract to a named constant`,
+                file: context.file.path,
+                line: pos.line + 1,
+                column: pos.character + 1,
+                fix: {
+                  suggestion: "Extract numeric literal to a named constant for clarity."
+                }
+              });
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/empty-catch",
+        severity: "warning",
+        description: "Detects empty catch blocks",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            CatchClause(node) {
+              const catchClause = node;
+              const block = catchClause.block;
+              if (block.statements.length === 0) {
+                const pos = context.ast.getLineAndCharacterOfPosition(catchClause.getStart(context.ast));
+                findings.push({
+                  message: "Empty catch block \u2014 errors are silently swallowed",
+                  file: context.file.path,
+                  line: pos.line + 1,
+                  column: pos.character + 1,
+                  fix: {
+                    suggestion: "Handle the error, log it, or re-throw if appropriate."
+                  }
+                });
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/nested-callbacks",
+        severity: "warning",
+        description: "Detects deeply nested callbacks (> 3 levels)",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          const maxNesting = 3;
+          const checkNesting = (node, depth) => {
+            if (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) {
+              if (depth > maxNesting) {
+                const pos = context.ast.getLineAndCharacterOfPosition(node.getStart(context.ast));
+                findings.push({
+                  message: `Callback nested ${depth} levels deep (max: ${maxNesting})`,
+                  file: context.file.path,
+                  line: pos.line + 1,
+                  column: pos.character + 1,
+                  fix: {
+                    suggestion: "Use async/await or extract nested callbacks into named functions."
+                  }
+                });
+                return;
+              }
+              ts.forEachChild(node, (child) => checkNesting(child, depth + 1));
+            } else {
+              ts.forEachChild(node, (child) => checkNesting(child, depth));
+            }
+          };
+          ts.forEachChild(context.ast, (child) => checkNesting(child, 0));
+          return findings;
+        }
+      });
+    }
+  };
+}
+function getLineOffset(text, line) {
+  let offset = 0;
+  let currentLine = 1;
+  for (let i = 0; i < text.length; i++) {
+    if (currentLine === line) return offset;
+    if (text[i] === "\n") {
+      currentLine++;
+    }
+    offset++;
+  }
+  return offset;
+}
+
+// src/plugins/optional/naming.ts
+function namingPlugin(_config = {}) {
+  return {
+    name: "naming-convention",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "naming-convention/file-naming",
+        severity: "warning",
+        description: "Enforces consistent file naming patterns based on directory",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          const path = context.file.path;
+          const fileName = path.split("/").pop() ?? "";
+          if (path.includes("/services/") && !fileName.endsWith(".service.ts") && !fileName.endsWith(".test.ts")) {
+            findings.push({
+              message: `File in services/ should follow *.service.ts naming: "${fileName}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: { suggestion: "Rename file to follow *.service.ts convention." }
+            });
+          }
+          if (path.includes("/controllers/") && !fileName.endsWith(".controller.ts") && !fileName.endsWith(".test.ts")) {
+            findings.push({
+              message: `File in controllers/ should follow *.controller.ts naming: "${fileName}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: { suggestion: "Rename file to follow *.controller.ts convention." }
+            });
+          }
+          if (path.includes("/repositories/") && !fileName.endsWith(".repository.ts") && !fileName.endsWith(".test.ts")) {
+            findings.push({
+              message: `File in repositories/ should follow *.repository.ts naming: "${fileName}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: { suggestion: "Rename file to follow *.repository.ts convention." }
+            });
+          }
+          return findings;
+        }
+      });
+    }
+  };
+}
+
+// src/plugins/optional/api.ts
+function apiPlugin(_config = {}) {
+  return {
+    name: "api-consistency",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "api-consistency/endpoint-naming",
+        severity: "info",
+        description: "Checks REST API endpoint naming conventions",
+        category: "quality",
+        check(context) {
+          if (context.file.role !== "controller") return [];
+          const findings = [];
+          context.walk(context.ast, {
+            StringLiteral(node) {
+              const str = node;
+              const value = str.text;
+              if (value.startsWith("/") && value.length > 1) {
+                if (/\/[a-z]+[A-Z]/.test(value)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(str.getStart(context.ast));
+                  findings.push({
+                    message: `API endpoint "${value}" uses camelCase \u2014 prefer kebab-case`,
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: { suggestion: "Use kebab-case for URL paths (e.g., /user-profiles instead of /userProfiles)." }
+                  });
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+    }
+  };
+}
+
+// src/plugins/optional/test-guard.ts
+function testGuardPlugin(_config = {}) {
+  return {
+    name: "test-coverage-guard",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "test-coverage-guard/missing-tests",
+        severity: "warning",
+        description: "Ensures source files have corresponding test files",
+        category: "quality",
+        check(context) {
+          if (context.file.role === "test" || context.file.role === "type" || context.file.role === "config") {
+            return [];
+          }
+          const findings = [];
+          const filePath = context.file.path;
+          const testPaths = getExpectedTestPaths(filePath);
+          const hasTest = testPaths.some((tp) => context.graph.files.has(tp));
+          if (!hasTest) {
+            findings.push({
+              message: `No test file found for "${filePath}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: {
+                /* v8 ignore next */
+                suggestion: `Create a test file (e.g., ${testPaths[0] ?? filePath.replace(".ts", ".test.ts")}).`
+              }
+            });
+          }
+          return findings;
+        }
+      });
+    }
+  };
+}
+function getExpectedTestPaths(filePath) {
+  const base = filePath.replace(/\.ts$/, "");
+  return [
+    `${base}.test.ts`,
+    `${base}.spec.ts`,
+    filePath.replace("src/", "tests/").replace(".ts", ".test.ts"),
+    filePath.replace("src/", "tests/unit/").replace(".ts", ".test.ts")
+  ];
+}
+
+// src/plugins/optional/dep-audit.ts
+function depAuditPlugin(config = {}) {
+  const fullConfig = {
+    maxDepth: 5,
+    ...config
+  };
+  return {
+    name: "dependency-audit",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "dependency-audit/deep-imports",
+        severity: "info",
+        description: "Detects deeply nested import chains",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const maxDepth = fullConfig.maxDepth ?? 5;
+          const depth = calculateImportDepth(
+            context.file.path,
+            context.graph.dependencies.adjacency,
+            /* @__PURE__ */ new Set()
+          );
+          if (depth > maxDepth) {
+            findings.push({
+              message: `File has import depth of ${depth} (max: ${maxDepth})`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: {
+                suggestion: "Consider restructuring imports to reduce dependency depth."
+              }
+            });
+          }
+          return findings;
+        }
+      });
+    }
+  };
+}
+function calculateImportDepth(file, adjacency, visited) {
+  if (visited.has(file)) return 0;
+  visited.add(file);
+  const deps = adjacency.get(file);
+  if (!deps || deps.size === 0) return 0;
+  let maxDepth = 0;
+  for (const dep of deps) {
+    const depth = calculateImportDepth(dep, adjacency, visited);
+    maxDepth = Math.max(maxDepth, depth);
+  }
+  return maxDepth + 1;
+}
+
+export { apiPlugin, architecturePlugin, depAuditPlugin, namingPlugin, performancePlugin, qualityPlugin, securityPlugin, testGuardPlugin };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map