@sfdxy/mule-lint 1.8.2 → 1.9.0

package/README.md

@@ -203,9 +203,19 @@ mule-lint src/main/mule -f sarif -o results.sarif
 | EXP-003 | MUnit Coverage | Info | Experimental | Check for MUnit tests |
 | YAML-001 | Env Files | Warning | Standards | Environment YAML files |
 | YAML-003 | Property Naming | Info | Standards | Property key format |
-| YAML-004 | Plaintext Secrets | Error | Security | Encrypted secrets |
+### 2025-2026 Best Practices Rules (NEW)
 
-**Total: 41 rules** across 13 categories.
+| ID | Name | Severity | Category | Description |
+|----|------|----------|----------|-------------|
+| SEC-002 | TLS Version | Error | Security | Detect deprecated TLS versions (< 1.2) |
+| SEC-003 | Rate Limiting | Warning | Security | APIs should have rate limiting configured |
+| SEC-004 | Input Validation | Warning | Security | Incoming payloads should be validated |
+| LOG-001 | Structured Logging | Info | Logging | Recommend JSON logger format |
+| LOG-004 | Sensitive Data Logging | Error | Logging | Detect PII/secrets in log statements |
+| ERR-001 | Try Scope | Info | Error Handling | Complex operations should use Try scope |
+| PERF-002 | Connection Pooling | Warning | Performance | DB/HTTP should configure connection pools |
+
+**Total: 48 rules** across 13 categories.
 
 See [Rules Catalog](docs/best-practices/rules-catalog.md) for detailed documentation.
 

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@sfdxy/mule-lint",
-    "version": "1.8.2",
+    "version": "1.9.0",
     "description": "Static analysis tool for MuleSoft applications - supports humans, AI agents, and CI/CD pipelines",
     "author": "Avinava",
     "license": "MIT",

package/dist/src/mcp/index.js

@@ -52,7 +52,7 @@ class MuleLintMcpServer {
     constructor() {
         this.server = new mcp_js_1.McpServer({
             name: 'mule-lint',
-            version: '1.8.0',
+            version: '1.9.0',
         });
         // Initialize engine with default config
         const defaultConfig = {

package/dist/src/rules/error-handling/TryScopeRule.d.ts

@@ -0,0 +1,17 @@
+import { ValidationContext, Issue } from '../../types';
+import { BaseRule } from '../base/BaseRule';
+/**
+ * ERR-001: Try Scope Best Practice
+ *
+ * Complex operations (DB calls, HTTP requests) should use Try scope
+ * for granular error isolation and handling.
+ */
+export declare class TryScopeRule extends BaseRule {
+    id: string;
+    name: string;
+    description: string;
+    severity: "info";
+    category: "error-handling";
+    validate(doc: Document, _context: ValidationContext): Issue[];
+}
+//# sourceMappingURL=TryScopeRule.d.ts.map

package/dist/src/rules/error-handling/TryScopeRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TryScopeRule.d.ts","sourceRoot":"","sources":["../../../../src/rules/error-handling/TryScopeRule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,QAAQ;IACtC,EAAE,SAAa;IACf,IAAI,SAA6B;IACjC,WAAW,SAAiE;IAC5E,QAAQ,EAAG,MAAM,CAAU;IAC3B,QAAQ,EAAG,gBAAgB,CAAU;IAErC,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,GAAG,KAAK,EAAE;CAyChE"}

package/dist/src/rules/error-handling/TryScopeRule.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TryScopeRule = void 0;
+const BaseRule_1 = require("../base/BaseRule");
+/**
+ * ERR-001: Try Scope Best Practice
+ *
+ * Complex operations (DB calls, HTTP requests) should use Try scope
+ * for granular error isolation and handling.
+ */
+class TryScopeRule extends BaseRule_1.BaseRule {
+    id = 'ERR-001';
+    name = 'Try Scope Best Practice';
+    description = 'Complex operations should use Try scope for error isolation';
+    severity = 'info';
+    category = 'error-handling';
+    validate(doc, _context) {
+        const issues = [];
+        // Find flows with multiple risky operations
+        const flows = this.select('//*[local-name()="flow"]', doc);
+        for (const flow of flows) {
+            const flowElement = flow;
+            const flowName = flowElement.getAttribute('name') || 'unnamed';
+            // Count risky operations (DB, HTTP, external calls)
+            const dbOperations = this.select('.//*[namespace-uri()="http://www.mulesoft.org/schema/mule/db"]', flow);
+            const httpRequests = this.select('.//*[local-name()="request" and namespace-uri()="http://www.mulesoft.org/schema/mule/http"]', flow);
+            const externalCalls = [...dbOperations, ...httpRequests];
+            // Check if Try scope exists
+            const tryScopes = this.select('.//*[local-name()="try"]', flow);
+            // If multiple external calls but no Try scope
+            if (externalCalls.length >= 2 && tryScopes.length === 0) {
+                issues.push(this.createIssue(flow, `Flow "${flowName}" has ${externalCalls.length} external calls without Try scope isolation`, {
+                    suggestion: 'Wrap risky operations in Try scope for granular error handling and isolation',
+                }));
+            }
+        }
+        return issues;
+    }
+}
+exports.TryScopeRule = TryScopeRule;
+//# sourceMappingURL=TryScopeRule.js.map

package/dist/src/rules/error-handling/TryScopeRule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TryScopeRule.js","sourceRoot":"","sources":["../../../../src/rules/error-handling/TryScopeRule.ts"],"names":[],"mappings":";;;AACA,+CAA4C;AAE5C;;;;;GAKG;AACH,MAAa,YAAa,SAAQ,mBAAQ;IACtC,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,yBAAyB,CAAC;IACjC,WAAW,GAAG,6DAA6D,CAAC;IAC5E,QAAQ,GAAG,MAAe,CAAC;IAC3B,QAAQ,GAAG,gBAAyB,CAAC;IAErC,QAAQ,CAAC,GAAa,EAAE,QAA2B;QAC/C,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,4CAA4C;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAE3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,IAAe,CAAC;YACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;YAE/D,oDAAoD;YACpD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAC5B,gEAAgE,EAChE,IAAI,CACP,CAAC;YACF,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAC5B,6FAA6F,EAC7F,IAAI,CACP,CAAC;YACF,MAAM,aAAa,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,YAAY,CAAC,CAAC;YAEzD,4BAA4B;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;YAEhE,8CAA8C;YAC9C,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,WAAW,CACZ,IAAI,EACJ,SAAS,QAAQ,SAAS,aAAa,CAAC,MAAM,6CAA6C,EAC3F;oBACI,UAAU,EACN,8EAA8E;iBACrF,CACJ,CACJ,CAAC;YACN,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAhDD,oCAgDC"}

package/dist/src/rules/index.d.ts

@@ -27,7 +27,7 @@ export { AsyncErrorHandlerRule } from './performance/AsyncErrorHandlerRule';
 export { LargeChoiceBlockRule } from './performance/LargeChoiceBlockRule';
 /**
  * All available rules - instantiated and ready to use
- * Total: 26 rules
+ * Total: 48 rules (including 7 new 2025-2026 best practices rules)
  */
 export declare const ALL_RULES: Rule[];
 /**

package/dist/src/rules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rules/index.ts"],"names":[],"mappings":"AACA,cAAc,iBAAiB,CAAC;AAsEhC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGhC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAG7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAGpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAGxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,SAAS,EAAE,IAAI,EAuE3B,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,CAE3D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAExD;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAExC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/rules/index.ts"],"names":[],"mappings":"AACA,cAAc,iBAAiB,CAAC;AA4EhC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGhC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAG7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAGpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAGxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,SAAS,EAAE,IAAI,EA8E3B,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,CAE3D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAExD;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAExC"}

package/dist/src/rules/index.js

@@ -26,6 +26,7 @@ const MissingErrorHandlerRule_1 = require("./error-handling/MissingErrorHandlerR
 const HttpStatusRule_1 = require("./error-handling/HttpStatusRule");
 const CorrelationIdRule_1 = require("./error-handling/CorrelationIdRule");
 const GenericErrorRule_1 = require("./error-handling/GenericErrorRule");
+const TryScopeRule_1 = require("./error-handling/TryScopeRule");
 // Import all rules - Naming
 const FlowNamingRule_1 = require("./naming/FlowNamingRule");
 const FlowCasingRule_1 = require("./naming/FlowCasingRule");
@@ -34,10 +35,14 @@ const VariableNamingRule_1 = require("./naming/VariableNamingRule");
 const HardcodedHttpRule_1 = require("./security/HardcodedHttpRule");
 const HardcodedCredentialsRule_1 = require("./security/HardcodedCredentialsRule");
 const InsecureTlsRule_1 = require("./security/InsecureTlsRule");
+const TlsVersionRule_1 = require("./security/TlsVersionRule");
+const RateLimitingRule_1 = require("./security/RateLimitingRule");
+const InputValidationRule_1 = require("./security/InputValidationRule");
 // Import all rules - Logging
 const LoggerCategoryRule_1 = require("./logging/LoggerCategoryRule");
 const LoggerPayloadRule_1 = require("./logging/LoggerPayloadRule");
 const LoggerInUntilSuccessfulRule_1 = require("./logging/LoggerInUntilSuccessfulRule");
+const NewLoggingRules_1 = require("./logging/NewLoggingRules");
 // Import all rules - Standards
 const ChoiceAntiPatternRule_1 = require("./standards/ChoiceAntiPatternRule");
 const DwlStandardsRule_1 = require("./standards/DwlStandardsRule");
@@ -53,6 +58,7 @@ const MissingDocNameRule_1 = require("./documentation/MissingDocNameRule");
 const ScatterGatherRoutesRule_1 = require("./performance/ScatterGatherRoutesRule");
 const AsyncErrorHandlerRule_1 = require("./performance/AsyncErrorHandlerRule");
 const LargeChoiceBlockRule_1 = require("./performance/LargeChoiceBlockRule");
+const ConnectionPoolingRule_1 = require("./performance/ConnectionPoolingRule");
 // Import all rules - Complexity
 const FlowComplexityRule_1 = require("./complexity/FlowComplexityRule");
 // Import all rules - YAML
@@ -126,7 +132,7 @@ var LargeChoiceBlockRule_2 = require("./performance/LargeChoiceBlockRule");
 Object.defineProperty(exports, "LargeChoiceBlockRule", { enumerable: true, get: function () { return LargeChoiceBlockRule_2.LargeChoiceBlockRule; } });
 /**
  * All available rules - instantiated and ready to use
- * Total: 26 rules
+ * Total: 48 rules (including 7 new 2025-2026 best practices rules)
  */
 exports.ALL_RULES = [
     // Error Handling Rules (MULE-001, 003, 005, 007, 009)
@@ -135,6 +141,7 @@ exports.ALL_RULES = [
     new HttpStatusRule_1.HttpStatusRule(),
     new CorrelationIdRule_1.CorrelationIdRule(),
     new GenericErrorRule_1.GenericErrorRule(),
+    new TryScopeRule_1.TryScopeRule(), // ERR-001: Try Scope Best Practice
     // Naming Rules (MULE-002, 101, 102)
     new FlowNamingRule_1.FlowNamingRule(),
     new FlowCasingRule_1.FlowCasingRule(),
@@ -143,10 +150,15 @@ exports.ALL_RULES = [
     new HardcodedHttpRule_1.HardcodedHttpRule(),
     new HardcodedCredentialsRule_1.HardcodedCredentialsRule(),
     new InsecureTlsRule_1.InsecureTlsRule(),
+    new TlsVersionRule_1.TlsVersionRule(), // SEC-002: TLS Version Check
+    new RateLimitingRule_1.RateLimitingRule(), // SEC-003: Rate Limiting
+    new InputValidationRule_1.InputValidationRule(), // SEC-004: Input Validation
     // Logging Rules (MULE-006, 301, 303)
     new LoggerCategoryRule_1.LoggerCategoryRule(),
     new LoggerPayloadRule_1.LoggerPayloadRule(),
     new LoggerInUntilSuccessfulRule_1.LoggerInUntilSuccessfulRule(),
+    new NewLoggingRules_1.StructuredLoggingRule(), // LOG-001: Structured Logging
+    new NewLoggingRules_1.SensitiveDataLoggingRule(), // LOG-004: Sensitive Data in Logs
     // Standards Rules (MULE-008, 010, 701)
     new ChoiceAntiPatternRule_1.ChoiceAntiPatternRule(),
     new DwlStandardsRule_1.DwlStandardsRule(),
@@ -162,6 +174,7 @@ exports.ALL_RULES = [
     new ScatterGatherRoutesRule_1.ScatterGatherRoutesRule(),
     new AsyncErrorHandlerRule_1.AsyncErrorHandlerRule(),
     new LargeChoiceBlockRule_1.LargeChoiceBlockRule(),
+    new ConnectionPoolingRule_1.ConnectionPoolingRule(), // PERF-002: Connection Pooling
     // Complexity Rules (MULE-801)
     new FlowComplexityRule_1.FlowComplexityRule(),
     // YAML Rules (YAML-001, 003, 004)

package/dist/src/rules/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rules/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAkMA,gDAEC;AAKD,kCAEC;AAKD,sCAEC;AAlND,mBAAmB;AACnB,kDAAgC;AAEhC,oCAAoC;AACpC,oFAAiF;AACjF,sFAAmF;AACnF,oEAAiE;AACjE,0EAAuE;AACvE,wEAAqE;AAErE,4BAA4B;AAC5B,4DAAyD;AACzD,4DAAyD;AACzD,oEAAiE;AAEjE,8BAA8B;AAC9B,oEAAiE;AACjE,kFAA+E;AAC/E,gEAA6D;AAE7D,6BAA6B;AAC7B,qEAAkE;AAClE,mEAAgE;AAChE,uFAAoF;AAEpF,+BAA+B;AAC/B,6EAA0E;AAC1E,mEAAgE;AAChE,iFAA8E;AAE9E,0BAA0B;AAC1B,gEAA6D;AAC7D,oEAAiE;AACjE,4DAAyD;AAEzD,mCAAmC;AACnC,6EAA0E;AAC1E,2EAAwE;AAExE,iCAAiC;AACjC,mFAAgF;AAChF,+EAA4E;AAC5E,6EAA0E;AAE1E,gCAAgC;AAChC,wEAAqE;AAErE,0BAA0B;AAC1B,gDAAkG;AAElG,+BAA+B;AAC/B,+DAIoC;AAEpC,+BAA+B;AAC/B,+DAA4F;AAC5F,qFAAkF;AAElF,6BAA6B;AAC7B,uDAA+F;AAE/F,kCAAkC;AAClC,wEAI0C;AAI1C,2CAA2C;AAC3C,kFAAiF;AAAxE,gIAAA,sBAAsB,OAAA;AAC/B,oFAAmF;AAA1E,kIAAA,uBAAuB,OAAA;AAChC,kEAAiE;AAAxD,gHAAA,cAAc,OAAA;AACvB,wEAAuE;AAA9D,sHAAA,iBAAiB,OAAA;AAC1B,sEAAqE;AAA5D,oHAAA,gBAAgB,OAAA;AAEzB,mCAAmC;AACnC,0DAAyD;AAAhD,gHAAA,cAAc,OAAA;AACvB,0DAAyD;AAAhD,gHAAA,cAAc,OAAA;AACvB,kEAAiE;AAAxD,wHAAA,kBAAkB,OAAA;AAE3B,qCAAqC;AACrC,kEAAiE;AAAxD,sHAAA,iBAAiB,OAAA;AAC1B,gFAA+E;AAAtE,oIAAA,wBAAwB,OAAA;AACjC,8DAA6D;AAApD,kHAAA,eAAe,OAAA;AAExB,oCAAoC;AACpC,mEAAkE;AAAzD,wHAAA,kBAAkB,OAAA;AAC3B,iEAAgE;AAAvD,sHAAA,iBAAiB,OAAA;AAC1B,qFAAoF;AAA3E,0IAAA,2BAA2B,OAAA;AAEpC,sCAAsC;AACtC,2EAA0E;AAAjE,8HAAA,qBAAqB,OAAA;AAC9B,iEAAgE;AAAvD,oHAAA,gBAAgB,OAAA;AACzB,+EAA8E;AAArE,kIAAA,uBAAuB,OAAA;AAEhC,iCAAiC;AACjC,8DAA6D;AAApD,sHAAA,iBAAiB,OAAA;AAC1B,kEAAiE;AAAxD,0HAAA,mBAAmB,OAAA;AAC5B,0DAAyD;AAAhD,kHAAA,eAAe,OAAA;AAExB,0CAA0C;AAC1C,2EAA0E;AAAjE,0HAAA,mBAAmB,OAAA;AAC5B,yEAAwE;AAA/D,wHAAA,kBAAkB,OAAA;AAE3B,wCAAwC;AACxC,iFAAgF;AAAvE,kIAAA,uBAAuB,OAAA;AAChC,6EAA4E;AAAnE,8HAAA,qBAAqB,OAAA;AAC9B,2EAA0E;AAAjE,4HAAA,oBAAoB,OAAA;AAE7B;;;GAGG;AACU,QAAA,SAAS,GAAW;IAC7B,sDAAsD;IACtD,IAAI,+CAAsB,EAAE;IAC5B,IAAI,iDAAuB,EAAE;IAC7B,IAAI,+BAAc,EAAE;IACpB,IAAI,qCAAiB,EAAE;IACvB,IAAI,mCAAgB,EAAE;IAEtB,oCAAoC;IACpC,IAAI,+BAAc,EAAE;IACpB,IAAI,+BAAc,EAAE;IACpB,IAAI,uCAAkB,EAAE;IAExB,sCAAsC;IACtC,IAAI,qCAAiB,EAAE;IACvB,IAAI,mDAAwB,EAAE;IAC9B,IAAI,iCAAe,EAAE;IAErB,qCAAqC;IACrC,IAAI,uCAAkB,EAAE;IACxB,IAAI,qCAAiB,EAAE;IACvB,IAAI,yDAA2B,EAAE;IAEjC,uCAAuC;IACvC,IAAI,6CAAqB,EAAE;IAC3B,IAAI,mCAAgB,EAAE;IACtB,IAAI,iDAAuB,EAAE;IAE7B,kCAAkC;IAClC,IAAI,qCAAiB,EAAE;IACvB,IAAI,yCAAmB,EAAE;IACzB,IAAI,iCAAe,EAAE;IAErB,sCAAsC;IACtC,IAAI,yCAAmB,EAAE;IACzB,IAAI,uCAAkB,EAAE;IAExB,yCAAyC;IACzC,IAAI,iDAAuB,EAAE;IAC7B,IAAI,6CAAqB,EAAE;IAC3B,IAAI,2CAAoB,EAAE;IAE1B,8BAA8B;IAC9B,IAAI,uCAAkB,EAAE;IAExB,kCAAkC;IAClC,IAAI,gCAAoB,EAAE;IAC1B,IAAI,8BAAkB,EAAE;IACxB,IAAI,gCAAoB,EAAE;IAE1B,uCAAuC;IACvC,IAAI,qCAAoB,EAAE;IAC1B,IAAI,iCAAgB,EAAE;IACtB,IAAI,kCAAiB,EAAE;IAEvB,0CAA0C;IAC1C,IAAI,gCAAe,EAAE;IACrB,IAAI,8BAAa,EAAE;IACnB,IAAI,+BAAc,EAAE;IACpB,IAAI,qDAAyB,EAAE;IAE/B,oCAAoC;IAEpC,IAAI,iCAAmB,EAAE;IACzB,IAAI,8BAAgB,EAAE;IACtB,IAAI,6BAAe,EAAE;IAErB,yCAAyC;IACzC,IAAI,oCAAgB,EAAE;IACtB,IAAI,6CAAyB,EAAE;IAC/B,IAAI,qCAAiB,EAAE;CAC1B,CAAC;AAEF;;GAEG;AACH,SAAgB,kBAAkB,CAAC,QAAgB;IAC/C,OAAO,iBAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,EAAU;IAClC,OAAO,iBAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa;IACzB,OAAO,iBAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rules/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA+MA,gDAEC;AAKD,kCAEC;AAKD,sCAEC;AA/ND,mBAAmB;AACnB,kDAAgC;AAEhC,oCAAoC;AACpC,oFAAiF;AACjF,sFAAmF;AACnF,oEAAiE;AACjE,0EAAuE;AACvE,wEAAqE;AACrE,gEAA6D;AAE7D,4BAA4B;AAC5B,4DAAyD;AACzD,4DAAyD;AACzD,oEAAiE;AAEjE,8BAA8B;AAC9B,oEAAiE;AACjE,kFAA+E;AAC/E,gEAA6D;AAC7D,8DAA2D;AAC3D,kEAA+D;AAC/D,wEAAqE;AAErE,6BAA6B;AAC7B,qEAAkE;AAClE,mEAAgE;AAChE,uFAAoF;AACpF,+DAA4F;AAE5F,+BAA+B;AAC/B,6EAA0E;AAC1E,mEAAgE;AAChE,iFAA8E;AAE9E,0BAA0B;AAC1B,gEAA6D;AAC7D,oEAAiE;AACjE,4DAAyD;AAEzD,mCAAmC;AACnC,6EAA0E;AAC1E,2EAAwE;AAExE,iCAAiC;AACjC,mFAAgF;AAChF,+EAA4E;AAC5E,6EAA0E;AAC1E,+EAA4E;AAE5E,gCAAgC;AAChC,wEAAqE;AAErE,0BAA0B;AAC1B,gDAAkG;AAElG,+BAA+B;AAC/B,+DAIoC;AAEpC,+BAA+B;AAC/B,+DAA4F;AAC5F,qFAAkF;AAElF,6BAA6B;AAC7B,uDAA+F;AAE/F,kCAAkC;AAClC,wEAI0C;AAI1C,2CAA2C;AAC3C,kFAAiF;AAAxE,gIAAA,sBAAsB,OAAA;AAC/B,oFAAmF;AAA1E,kIAAA,uBAAuB,OAAA;AAChC,kEAAiE;AAAxD,gHAAA,cAAc,OAAA;AACvB,wEAAuE;AAA9D,sHAAA,iBAAiB,OAAA;AAC1B,sEAAqE;AAA5D,oHAAA,gBAAgB,OAAA;AAEzB,mCAAmC;AACnC,0DAAyD;AAAhD,gHAAA,cAAc,OAAA;AACvB,0DAAyD;AAAhD,gHAAA,cAAc,OAAA;AACvB,kEAAiE;AAAxD,wHAAA,kBAAkB,OAAA;AAE3B,qCAAqC;AACrC,kEAAiE;AAAxD,sHAAA,iBAAiB,OAAA;AAC1B,gFAA+E;AAAtE,oIAAA,wBAAwB,OAAA;AACjC,8DAA6D;AAApD,kHAAA,eAAe,OAAA;AAExB,oCAAoC;AACpC,mEAAkE;AAAzD,wHAAA,kBAAkB,OAAA;AAC3B,iEAAgE;AAAvD,sHAAA,iBAAiB,OAAA;AAC1B,qFAAoF;AAA3E,0IAAA,2BAA2B,OAAA;AAEpC,sCAAsC;AACtC,2EAA0E;AAAjE,8HAAA,qBAAqB,OAAA;AAC9B,iEAAgE;AAAvD,oHAAA,gBAAgB,OAAA;AACzB,+EAA8E;AAArE,kIAAA,uBAAuB,OAAA;AAEhC,iCAAiC;AACjC,8DAA6D;AAApD,sHAAA,iBAAiB,OAAA;AAC1B,kEAAiE;AAAxD,0HAAA,mBAAmB,OAAA;AAC5B,0DAAyD;AAAhD,kHAAA,eAAe,OAAA;AAExB,0CAA0C;AAC1C,2EAA0E;AAAjE,0HAAA,mBAAmB,OAAA;AAC5B,yEAAwE;AAA/D,wHAAA,kBAAkB,OAAA;AAE3B,wCAAwC;AACxC,iFAAgF;AAAvE,kIAAA,uBAAuB,OAAA;AAChC,6EAA4E;AAAnE,8HAAA,qBAAqB,OAAA;AAC9B,2EAA0E;AAAjE,4HAAA,oBAAoB,OAAA;AAE7B;;;GAGG;AACU,QAAA,SAAS,GAAW;IAC7B,sDAAsD;IACtD,IAAI,+CAAsB,EAAE;IAC5B,IAAI,iDAAuB,EAAE;IAC7B,IAAI,+BAAc,EAAE;IACpB,IAAI,qCAAiB,EAAE;IACvB,IAAI,mCAAgB,EAAE;IACtB,IAAI,2BAAY,EAAE,EAAG,mCAAmC;IAExD,oCAAoC;IACpC,IAAI,+BAAc,EAAE;IACpB,IAAI,+BAAc,EAAE;IACpB,IAAI,uCAAkB,EAAE;IAExB,sCAAsC;IACtC,IAAI,qCAAiB,EAAE;IACvB,IAAI,mDAAwB,EAAE;IAC9B,IAAI,iCAAe,EAAE;IACrB,IAAI,+BAAc,EAAE,EAAQ,6BAA6B;IACzD,IAAI,mCAAgB,EAAE,EAAM,yBAAyB;IACrD,IAAI,yCAAmB,EAAE,EAAG,4BAA4B;IAExD,qCAAqC;IACrC,IAAI,uCAAkB,EAAE;IACxB,IAAI,qCAAiB,EAAE;IACvB,IAAI,yDAA2B,EAAE;IACjC,IAAI,uCAAqB,EAAE,EAAM,8BAA8B;IAC/D,IAAI,0CAAwB,EAAE,EAAG,kCAAkC;IAEnE,uCAAuC;IACvC,IAAI,6CAAqB,EAAE;IAC3B,IAAI,mCAAgB,EAAE;IACtB,IAAI,iDAAuB,EAAE;IAE7B,kCAAkC;IAClC,IAAI,qCAAiB,EAAE;IACvB,IAAI,yCAAmB,EAAE;IACzB,IAAI,iCAAe,EAAE;IAErB,sCAAsC;IACtC,IAAI,yCAAmB,EAAE;IACzB,IAAI,uCAAkB,EAAE;IAExB,yCAAyC;IACzC,IAAI,iDAAuB,EAAE;IAC7B,IAAI,6CAAqB,EAAE;IAC3B,IAAI,2CAAoB,EAAE;IAC1B,IAAI,6CAAqB,EAAE,EAAG,+BAA+B;IAE7D,8BAA8B;IAC9B,IAAI,uCAAkB,EAAE;IAExB,kCAAkC;IAClC,IAAI,gCAAoB,EAAE;IAC1B,IAAI,8BAAkB,EAAE;IACxB,IAAI,gCAAoB,EAAE;IAE1B,uCAAuC;IACvC,IAAI,qCAAoB,EAAE;IAC1B,IAAI,iCAAgB,EAAE;IACtB,IAAI,kCAAiB,EAAE;IAEvB,0CAA0C;IAC1C,IAAI,gCAAe,EAAE;IACrB,IAAI,8BAAa,EAAE;IACnB,IAAI,+BAAc,EAAE;IACpB,IAAI,qDAAyB,EAAE;IAE/B,oCAAoC;IAEpC,IAAI,iCAAmB,EAAE;IACzB,IAAI,8BAAgB,EAAE;IACtB,IAAI,6BAAe,EAAE;IAErB,yCAAyC;IACzC,IAAI,oCAAgB,EAAE;IACtB,IAAI,6CAAyB,EAAE;IAC/B,IAAI,qCAAiB,EAAE;CAC1B,CAAC;AAEF;;GAEG;AACH,SAAgB,kBAAkB,CAAC,QAAgB;IAC/C,OAAO,iBAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,EAAU;IAClC,OAAO,iBAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa;IACzB,OAAO,iBAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/src/rules/logging/NewLoggingRules.d.ts

@@ -0,0 +1,35 @@
+import { ValidationContext, Issue } from '../../types';
+import { BaseRule } from '../base/BaseRule';
+/**
+ * LOG-001: Structured Logging Check
+ *
+ * Recommends JSON logger format over plain text for production
+ * applications to enable better log parsing and analysis.
+ */
+export declare class StructuredLoggingRule extends BaseRule {
+    id: string;
+    name: string;
+    description: string;
+    severity: "info";
+    category: "logging";
+    validate(doc: Document, context: ValidationContext): Issue[];
+}
+/**
+ * LOG-004: Sensitive Data Logging Check
+ *
+ * Detects logging of sensitive data patterns (passwords, SSN, credit cards)
+ * which is a security and compliance violation.
+ *
+ * This rule looks for patterns where sensitive VARIABLE VALUES are being logged,
+ * not just contextual words like "token expired" or "password reset".
+ */
+export declare class SensitiveDataLoggingRule extends BaseRule {
+    id: string;
+    name: string;
+    description: string;
+    severity: "error";
+    category: "logging";
+    private readonly sensitiveValuePatterns;
+    validate(doc: Document, _context: ValidationContext): Issue[];
+}
+//# sourceMappingURL=NewLoggingRules.d.ts.map

package/dist/src/rules/logging/NewLoggingRules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NewLoggingRules.d.ts","sourceRoot":"","sources":["../../../../src/rules/logging/NewLoggingRules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,QAAQ;IAC/C,EAAE,SAAa;IACf,IAAI,SAAwB;IAC5B,WAAW,SAAkD;IAC7D,QAAQ,EAAG,MAAM,CAAU;IAC3B,QAAQ,EAAG,SAAS,CAAU;IAE9B,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK,EAAE;CAoC/D;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,QAAQ;IAClD,EAAE,SAAa;IACf,IAAI,SAA4B;IAChC,WAAW,SAA6D;IACxE,QAAQ,EAAG,OAAO,CAAU;IAC5B,QAAQ,EAAG,SAAS,CAAU;IAI9B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAQrC;IAEF,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,GAAG,KAAK,EAAE;CAmChE"}

package/dist/src/rules/logging/NewLoggingRules.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SensitiveDataLoggingRule = exports.StructuredLoggingRule = void 0;
+const BaseRule_1 = require("../base/BaseRule");
+/**
+ * LOG-001: Structured Logging Check
+ *
+ * Recommends JSON logger format over plain text for production
+ * applications to enable better log parsing and analysis.
+ */
+class StructuredLoggingRule extends BaseRule_1.BaseRule {
+    id = 'LOG-001';
+    name = 'Structured Logging';
+    description = 'Recommend JSON logger format over plain text';
+    severity = 'info';
+    category = 'logging';
+    validate(doc, context) {
+        const issues = [];
+        // Check if this is global.xml or a config file
+        if (!context.relativePath.includes('global') &&
+            !context.relativePath.includes('config')) {
+            return issues;
+        }
+        // Look for JSON logger module configuration
+        const jsonLoggerConfig = this.select('//*[contains(local-name(), "json-logger") or contains(local-name(), "jsonlogger")]', doc);
+        // Look for standard logger elements
+        const standardLoggers = this.select('//*[local-name()="logger"]', doc);
+        // If using standard loggers but no JSON logger configured
+        if (standardLoggers.length > 0 && jsonLoggerConfig.length === 0) {
+            issues.push(this.createIssue(standardLoggers[0], 'Project uses standard logger instead of JSON structured logging', {
+                suggestion: 'Consider using JSON Logger Module for structured logging in production. This enables better log aggregation and analysis.',
+            }));
+        }
+        return issues;
+    }
+}
+exports.StructuredLoggingRule = StructuredLoggingRule;
+/**
+ * LOG-004: Sensitive Data Logging Check
+ *
+ * Detects logging of sensitive data patterns (passwords, SSN, credit cards)
+ * which is a security and compliance violation.
+ *
+ * This rule looks for patterns where sensitive VARIABLE VALUES are being logged,
+ * not just contextual words like "token expired" or "password reset".
+ */
+class SensitiveDataLoggingRule extends BaseRule_1.BaseRule {
+    id = 'LOG-004';
+    name = 'Sensitive Data in Logs';
+    description = 'Log statements should not contain sensitive data values';
+    severity = 'error';
+    category = 'logging';
+    // Patterns that suggest actual sensitive VALUES are being logged
+    // e.g., "password: " ++ password, vars.token, payload.secret
+    sensitiveValuePatterns = [
+        /vars\.(password|secret|token|apiKey|privateKey|accessToken|refreshToken|ssn|pin)\b/i,
+        /payload\.(password|secret|token|apiKey|privateKey|accessToken|refreshToken|ssn|pin)\b/i,
+        /attributes\.(password|secret|token)\b/i,
+        /\$\{.*password.*\}/i,
+        /\$\{.*secret.*\}/i,
+        /\$\{secure::.*\}/i, // Logging secure properties is bad
+        /\+\+\s*(password|secret|token|apiKey)\b/i, // Concatenating sensitive vars
+    ];
+    validate(doc, _context) {
+        const issues = [];
+        // Find all logger elements (standard and json-logger)
+        const loggers = this.select('//*[local-name()="logger"]', doc);
+        for (const logger of loggers) {
+            const element = logger;
+            const message = element.getAttribute('message') || '';
+            // Only check if it contains DataWeave expressions
+            if (!message.includes('#[') && !message.includes('${')) {
+                continue;
+            }
+            // Check for patterns that suggest actual values are being logged
+            for (const pattern of this.sensitiveValuePatterns) {
+                if (pattern.test(message)) {
+                    issues.push(this.createIssue(logger, `Logger may expose sensitive data value: pattern "${pattern.source}" detected`, {
+                        suggestion: 'Mask sensitive data before logging using DataWeave masking functions or remove the sensitive variable reference',
+                    }));
+                    break; // Only report once per logger
+                }
+            }
+        }
+        return issues;
+    }
+}
+exports.SensitiveDataLoggingRule = SensitiveDataLoggingRule;
+//# sourceMappingURL=NewLoggingRules.js.map

package/dist/src/rules/logging/NewLoggingRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NewLoggingRules.js","sourceRoot":"","sources":["../../../../src/rules/logging/NewLoggingRules.ts"],"names":[],"mappings":";;;AACA,+CAA4C;AAE5C;;;;;GAKG;AACH,MAAa,qBAAsB,SAAQ,mBAAQ;IAC/C,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,oBAAoB,CAAC;IAC5B,WAAW,GAAG,8CAA8C,CAAC;IAC7D,QAAQ,GAAG,MAAe,CAAC;IAC3B,QAAQ,GAAG,SAAkB,CAAC;IAE9B,QAAQ,CAAC,GAAa,EAAE,OAA0B;QAC9C,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,+CAA+C;QAC/C,IACI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxC,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC1C,CAAC;YACC,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,4CAA4C;QAC5C,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAChC,oFAAoF,EACpF,GAAG,CACN,CAAC;QAEF,oCAAoC;QACpC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QAEvE,0DAA0D;QAC1D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,WAAW,CACZ,eAAe,CAAC,CAAC,CAAC,EAClB,iEAAiE,EACjE;gBACI,UAAU,EACN,2HAA2H;aAClI,CACJ,CACJ,CAAC;QACN,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AA3CD,sDA2CC;AAED;;;;;;;;GAQG;AACH,MAAa,wBAAyB,SAAQ,mBAAQ;IAClD,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,wBAAwB,CAAC;IAChC,WAAW,GAAG,yDAAyD,CAAC;IACxE,QAAQ,GAAG,OAAgB,CAAC;IAC5B,QAAQ,GAAG,SAAkB,CAAC;IAE9B,iEAAiE;IACjE,6DAA6D;IAC5C,sBAAsB,GAAG;QACtC,qFAAqF;QACrF,wFAAwF;QACxF,wCAAwC;QACxC,qBAAqB;QACrB,mBAAmB;QACnB,mBAAmB,EAAE,mCAAmC;QACxD,0CAA0C,EAAE,+BAA+B;KAC9E,CAAC;IAEF,QAAQ,CAAC,GAAa,EAAE,QAA2B;QAC/C,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,sDAAsD;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QAE/D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAiB,CAAC;YAClC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAEtD,kDAAkD;YAClD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrD,SAAS;YACb,CAAC;YAED,iEAAiE;YACjE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAChD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,WAAW,CACZ,MAAM,EACN,oDAAoD,OAAO,CAAC,MAAM,YAAY,EAC9E;wBACI,UAAU,EACN,iHAAiH;qBACxH,CACJ,CACJ,CAAC;oBACF,MAAM,CAAC,8BAA8B;gBACzC,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAtDD,4DAsDC"}

package/dist/src/rules/performance/ConnectionPoolingRule.d.ts

@@ -0,0 +1,17 @@
+import { ValidationContext, Issue } from '../../types';
+import { BaseRule } from '../base/BaseRule';
+/**
+ * PERF-002: Connection Pooling Check
+ *
+ * DB and HTTP connectors should configure connection pools
+ * for optimal performance and resource management.
+ */
+export declare class ConnectionPoolingRule extends BaseRule {
+    id: string;
+    name: string;
+    description: string;
+    severity: "warning";
+    category: "performance";
+    validate(doc: Document, _context: ValidationContext): Issue[];
+}
+//# sourceMappingURL=ConnectionPoolingRule.d.ts.map

package/dist/src/rules/performance/ConnectionPoolingRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConnectionPoolingRule.d.ts","sourceRoot":"","sources":["../../../../src/rules/performance/ConnectionPoolingRule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,QAAQ;IAC/C,EAAE,SAAc;IAChB,IAAI,SAAwB;IAC5B,WAAW,SAA0D;IACrE,QAAQ,EAAG,SAAS,CAAU;IAC9B,QAAQ,EAAG,aAAa,CAAU;IAElC,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,GAAG,KAAK,EAAE;CA+DhE"}

package/dist/src/rules/performance/ConnectionPoolingRule.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectionPoolingRule = void 0;
+const BaseRule_1 = require("../base/BaseRule");
+/**
+ * PERF-002: Connection Pooling Check
+ *
+ * DB and HTTP connectors should configure connection pools
+ * for optimal performance and resource management.
+ */
+class ConnectionPoolingRule extends BaseRule_1.BaseRule {
+    id = 'PERF-002';
+    name = 'Connection Pooling';
+    description = 'DB/HTTP connectors should configure connection pools';
+    severity = 'warning';
+    category = 'performance';
+    validate(doc, _context) {
+        const issues = [];
+        // Check HTTP request configurations
+        const httpConfigs = this.select('//*[local-name()="request-config" and namespace-uri()="http://www.mulesoft.org/schema/mule/http"]', doc);
+        for (const config of httpConfigs) {
+            const element = config;
+            const name = element.getAttribute('name') || 'unnamed';
+            // Check for connection pooling attributes
+            const hasPooling = element.hasAttribute('maxConnections') ||
+                element.hasAttribute('connectionIdleTimeout') ||
+                this.select('.//*[local-name()="pooling-profile"]', config).length > 0;
+            if (!hasPooling) {
+                issues.push(this.createIssue(config, `HTTP request config "${name}" has no connection pooling configured`, {
+                    suggestion: 'Add maxConnections and connectionIdleTimeout for optimal connection management',
+                }));
+            }
+        }
+        // Check Database configurations
+        const dbConfigs = this.select('//*[local-name()="config" and namespace-uri()="http://www.mulesoft.org/schema/mule/db"]', doc);
+        for (const config of dbConfigs) {
+            const element = config;
+            const name = element.getAttribute('name') || 'unnamed';
+            // Check for pooling profile
+            const hasPooling = this.select('.//*[local-name()="pooling-profile"]', config).length > 0;
+            if (!hasPooling) {
+                issues.push(this.createIssue(config, `Database config "${name}" has no connection pooling configured`, {
+                    suggestion: 'Add db:pooling-profile with maxPoolSize and minPoolSize for optimal performance',
+                }));
+            }
+        }
+        return issues;
+    }
+}
+exports.ConnectionPoolingRule = ConnectionPoolingRule;
+//# sourceMappingURL=ConnectionPoolingRule.js.map

package/dist/src/rules/performance/ConnectionPoolingRule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConnectionPoolingRule.js","sourceRoot":"","sources":["../../../../src/rules/performance/ConnectionPoolingRule.ts"],"names":[],"mappings":";;;AACA,+CAA4C;AAE5C;;;;;GAKG;AACH,MAAa,qBAAsB,SAAQ,mBAAQ;IAC/C,EAAE,GAAG,UAAU,CAAC;IAChB,IAAI,GAAG,oBAAoB,CAAC;IAC5B,WAAW,GAAG,sDAAsD,CAAC;IACrE,QAAQ,GAAG,SAAkB,CAAC;IAC9B,QAAQ,GAAG,aAAsB,CAAC;IAElC,QAAQ,CAAC,GAAa,EAAE,QAA2B;QAC/C,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,oCAAoC;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAC3B,mGAAmG,EACnG,GAAG,CACN,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAiB,CAAC;YAClC,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;YAEvD,0CAA0C;YAC1C,MAAM,UAAU,GACZ,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC;gBACtC,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,sCAAsC,EAAE,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAE3E,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,WAAW,CACZ,MAAM,EACN,wBAAwB,IAAI,wCAAwC,EACpE;oBACI,UAAU,EACN,gFAAgF;iBACvF,CACJ,CACJ,CAAC;YACN,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CACzB,yFAAyF,EACzF,GAAG,CACN,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,MAAiB,CAAC;YAClC,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;YAEvD,4BAA4B;YAC5B,MAAM,UAAU,GACZ,IAAI,CAAC,MAAM,CAAC,sCAAsC,EAAE,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAE3E,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,WAAW,CACZ,MAAM,EACN,oBAAoB,IAAI,wCAAwC,EAChE;oBACI,UAAU,EACN,iFAAiF;iBACxF,CACJ,CACJ,CAAC;YACN,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAtED,sDAsEC"}

package/dist/src/rules/security/InputValidationRule.d.ts

@@ -0,0 +1,17 @@
+import { ValidationContext, Issue } from '../../types';
+import { BaseRule } from '../base/BaseRule';
+/**
+ * SEC-004: Input Validation Check
+ *
+ * Incoming payloads should be validated using JSON or XML schema validation
+ * to prevent injection attacks and malformed data processing.
+ */
+export declare class InputValidationRule extends BaseRule {
+    id: string;
+    name: string;
+    description: string;
+    severity: "warning";
+    category: "security";
+    validate(doc: Document, context: ValidationContext): Issue[];
+}
+//# sourceMappingURL=InputValidationRule.d.ts.map

package/dist/src/rules/security/InputValidationRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InputValidationRule.d.ts","sourceRoot":"","sources":["../../../../src/rules/security/InputValidationRule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IAC7C,EAAE,SAAa;IACf,IAAI,SAAsB;IAC1B,WAAW,SAAkE;IAC7E,QAAQ,EAAG,SAAS,CAAU;IAC9B,QAAQ,EAAG,UAAU,CAAU;IAE/B,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK,EAAE;CAgE/D"}

package/dist/src/rules/security/InputValidationRule.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InputValidationRule = void 0;
+const BaseRule_1 = require("../base/BaseRule");
+/**
+ * SEC-004: Input Validation Check
+ *
+ * Incoming payloads should be validated using JSON or XML schema validation
+ * to prevent injection attacks and malformed data processing.
+ */
+class InputValidationRule extends BaseRule_1.BaseRule {
+    id = 'SEC-004';
+    name = 'Input Validation';
+    description = 'Incoming payloads should be validated with schema validation';
+    severity = 'warning';
+    category = 'security';
+    validate(doc, context) {
+        const issues = [];
+        // Skip non-interface files
+        if (!context.relativePath.includes('interface') && !context.relativePath.includes('impl')) {
+            return issues;
+        }
+        // Find HTTP listeners that accept POST/PUT/PATCH
+        const flows = this.select('//*[local-name()="flow"]', doc);
+        for (const flow of flows) {
+            const flowElement = flow;
+            const flowName = flowElement.getAttribute('name') || '';
+            // Check if flow has HTTP listener with body-accepting methods
+            const listeners = this.select('.//*[local-name()="listener"]', flow);
+            if (listeners.length === 0)
+                continue;
+            // Check for POST, PUT, PATCH patterns in flow name (APIKit generated)
+            const acceptsBody = flowName.includes('post:') ||
+                flowName.includes('put:') ||
+                flowName.includes('patch:');
+            if (!acceptsBody)
+                continue;
+            // Check for validation in the flow
+            const hasValidation = this.select('.//*[local-name()="validate-schema" or local-name()="json-schema-validator" or local-name()="schema-validator" or contains(local-name(), "validation")]', flow).length > 0;
+            // Check for DataWeave validation patterns
+            const transforms = this.select('.//*[local-name()="transform"]', flow);
+            let hasInlineValidation = false;
+            for (const transform of transforms) {
+                const content = transform.textContent || '';
+                if (content.includes('validate') || content.includes('match')) {
+                    hasInlineValidation = true;
+                    break;
+                }
+            }
+            if (!hasValidation && !hasInlineValidation) {
+                issues.push(this.createIssue(flow, `Flow "${flowName}" accepts request body but has no input validation`, {
+                    suggestion: 'Add JSON/XML schema validation or DataWeave validation to prevent injection attacks',
+                }));
+            }
+        }
+        return issues;
+    }
+}
+exports.InputValidationRule = InputValidationRule;
+//# sourceMappingURL=InputValidationRule.js.map

package/dist/src/rules/security/InputValidationRule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InputValidationRule.js","sourceRoot":"","sources":["../../../../src/rules/security/InputValidationRule.ts"],"names":[],"mappings":";;;AACA,+CAA4C;AAE5C;;;;;GAKG;AACH,MAAa,mBAAoB,SAAQ,mBAAQ;IAC7C,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,kBAAkB,CAAC;IAC1B,WAAW,GAAG,8DAA8D,CAAC;IAC7E,QAAQ,GAAG,SAAkB,CAAC;IAC9B,QAAQ,GAAG,UAAmB,CAAC;IAE/B,QAAQ,CAAC,GAAa,EAAE,OAA0B;QAC9C,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,2BAA2B;QAC3B,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxF,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,iDAAiD;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QAE3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,IAAe,CAAC;YACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAExD,8DAA8D;YAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CACzB,+BAA+B,EAC/B,IAAI,CACP,CAAC;YAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAErC,sEAAsE;YACtE,MAAM,WAAW,GACb,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC1B,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACzB,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEhC,IAAI,CAAC,WAAW;gBAAE,SAAS;YAE3B,mCAAmC;YACnC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAC7B,yJAAyJ,EACzJ,IAAI,CACP,CAAC,MAAM,GAAG,CAAC,CAAC;YAEb,0CAA0C;YAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,gCAAgC,EAAE,IAAI,CAAC,CAAC;YACvE,IAAI,mBAAmB,GAAG,KAAK,CAAC;YAChC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAI,SAAqB,CAAC,WAAW,IAAI,EAAE,CAAC;gBACzD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5D,mBAAmB,GAAG,IAAI,CAAC;oBAC3B,MAAM;gBACV,CAAC;YACL,CAAC;YAED,IAAI,CAAC,aAAa,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,WAAW,CACZ,IAAI,EACJ,SAAS,QAAQ,oDAAoD,EACrE;oBACI,UAAU,EACN,qFAAqF;iBAC5F,CACJ,CACJ,CAAC;YACN,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAvED,kDAuEC"}

package/dist/src/rules/security/RateLimitingRule.d.ts

@@ -0,0 +1,17 @@
+import { ValidationContext, Issue } from '../../types';
+import { BaseRule } from '../base/BaseRule';
+/**
+ * SEC-003: Rate Limiting Policy Check
+ *
+ * Production APIs should have rate limiting or throttling configured
+ * to prevent DoS attacks and manage API consumption.
+ */
+export declare class RateLimitingRule extends BaseRule {
+    id: string;
+    name: string;
+    description: string;
+    severity: "warning";
+    category: "security";
+    validate(doc: Document, context: ValidationContext): Issue[];
+}
+//# sourceMappingURL=RateLimitingRule.d.ts.map

package/dist/src/rules/security/RateLimitingRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitingRule.d.ts","sourceRoot":"","sources":["../../../../src/rules/security/RateLimitingRule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;IAC1C,EAAE,SAAa;IACf,IAAI,SAA0B;IAC9B,WAAW,SAA6D;IACxE,QAAQ,EAAG,SAAS,CAAU;IAC9B,QAAQ,EAAG,UAAU,CAAU;IAE/B,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,GAAG,KAAK,EAAE;CA+C/D"}

package/dist/src/rules/security/RateLimitingRule.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RateLimitingRule = void 0;
+const BaseRule_1 = require("../base/BaseRule");
+/**
+ * SEC-003: Rate Limiting Policy Check
+ *
+ * Production APIs should have rate limiting or throttling configured
+ * to prevent DoS attacks and manage API consumption.
+ */
+class RateLimitingRule extends BaseRule_1.BaseRule {
+    id = 'SEC-003';
+    name = 'Rate Limiting Policy';
+    description = 'APIs should have rate limiting or throttling configured';
+    severity = 'warning';
+    category = 'security';
+    validate(doc, context) {
+        const issues = [];
+        // Skip if not an API listener (interface.xml or similar)
+        if (!context.relativePath.includes('interface') && !context.relativePath.includes('api')) {
+            return issues;
+        }
+        // Find HTTP listeners
+        const httpListeners = this.select('//*[local-name()="listener" and namespace-uri()="http://www.mulesoft.org/schema/mule/http"]', doc);
+        if (httpListeners.length === 0) {
+            return issues;
+        }
+        // Check for rate limiting policies (apikit-config, throttling-policy, etc.)
+        const rateLimitingElements = this.select('//*[contains(local-name(), "rate") or contains(local-name(), "throttl") or contains(local-name(), "spike")]', doc);
+        // Check for policy references in API Kit router
+        const policyRefs = this.select('//*[local-name()="policy" or contains(@policies, "rate") or contains(@policies, "throttl")]', doc);
+        // If no rate limiting found and this looks like an API
+        if (rateLimitingElements.length === 0 && policyRefs.length === 0) {
+            // Only report once per file, on the first listener
+            issues.push(this.createIssue(httpListeners[0], 'API endpoint has no rate limiting or throttling configured', {
+                suggestion: 'Configure rate limiting via API Manager policies or add throttling:config to protect against DoS attacks',
+            }));
+        }
+        return issues;
+    }
+}
+exports.RateLimitingRule = RateLimitingRule;
+//# sourceMappingURL=RateLimitingRule.js.map

package/dist/src/rules/security/RateLimitingRule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitingRule.js","sourceRoot":"","sources":["../../../../src/rules/security/RateLimitingRule.ts"],"names":[],"mappings":";;;AACA,+CAA4C;AAE5C;;;;;GAKG;AACH,MAAa,gBAAiB,SAAQ,mBAAQ;IAC1C,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,sBAAsB,CAAC;IAC9B,WAAW,GAAG,yDAAyD,CAAC;IACxE,QAAQ,GAAG,SAAkB,CAAC;IAC9B,QAAQ,GAAG,UAAmB,CAAC;IAE/B,QAAQ,CAAC,GAAa,EAAE,OAA0B;QAC9C,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,yDAAyD;QACzD,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvF,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,sBAAsB;QACtB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAC7B,6FAA6F,EAC7F,GAAG,CACN,CAAC;QAEF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,4EAA4E;QAC5E,MAAM,oBAAoB,GAAG,IAAI,CAAC,MAAM,CACpC,6GAA6G,EAC7G,GAAG,CACN,CAAC;QAEF,gDAAgD;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAC1B,6FAA6F,EAC7F,GAAG,CACN,CAAC;QAEF,uDAAuD;QACvD,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,mDAAmD;YACnD,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,WAAW,CACZ,aAAa,CAAC,CAAC,CAAC,EAChB,4DAA4D,EAC5D;gBACI,UAAU,EACN,0GAA0G;aACjH,CACJ,CACJ,CAAC;QACN,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAtDD,4CAsDC"}

package/dist/src/rules/security/TlsVersionRule.d.ts

@@ -0,0 +1,18 @@
+import { ValidationContext, Issue } from '../../types';
+import { BaseRule } from '../base/BaseRule';
+/**
+ * SEC-002: TLS Version Check
+ *
+ * Detects use of deprecated TLS versions (< 1.2) which are security vulnerabilities.
+ * TLS 1.0 and 1.1 are deprecated and should not be used per 2025 security standards.
+ */
+export declare class TlsVersionRule extends BaseRule {
+    id: string;
+    name: string;
+    description: string;
+    severity: "error";
+    category: "security";
+    private readonly deprecatedProtocols;
+    validate(doc: Document, _context: ValidationContext): Issue[];
+}
+//# sourceMappingURL=TlsVersionRule.d.ts.map

package/dist/src/rules/security/TlsVersionRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TlsVersionRule.d.ts","sourceRoot":"","sources":["../../../../src/rules/security/TlsVersionRule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IACxC,EAAE,SAAa;IACf,IAAI,SAAuB;IAC3B,WAAW,SAAmD;IAC9D,QAAQ,EAAG,OAAO,CAAU;IAC5B,QAAQ,EAAG,UAAU,CAAU;IAE/B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqD;IAEzF,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,GAAG,KAAK,EAAE;CA+DhE"}

package/dist/src/rules/security/TlsVersionRule.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TlsVersionRule = void 0;
+const BaseRule_1 = require("../base/BaseRule");
+/**
+ * SEC-002: TLS Version Check
+ *
+ * Detects use of deprecated TLS versions (< 1.2) which are security vulnerabilities.
+ * TLS 1.0 and 1.1 are deprecated and should not be used per 2025 security standards.
+ */
+class TlsVersionRule extends BaseRule_1.BaseRule {
+    id = 'SEC-002';
+    name = 'TLS Version Check';
+    description = 'Detect use of deprecated TLS versions (< 1.2)';
+    severity = 'error';
+    category = 'security';
+    deprecatedProtocols = ['TLSv1', 'TLSv1.0', 'TLSv1.1', 'SSLv3', 'SSLv2'];
+    validate(doc, _context) {
+        const issues = [];
+        // Find all TLS context configurations
+        const tlsContexts = this.select('//*[local-name()="context"]', doc);
+        for (const context of tlsContexts) {
+            const element = context;
+            const enabledProtocols = element.getAttribute('enabledProtocols');
+            if (enabledProtocols) {
+                const protocols = enabledProtocols.split(',').map((p) => p.trim());
+                const deprecated = protocols.filter((p) => this.deprecatedProtocols.some((dp) => p.toUpperCase() === dp.toUpperCase()));
+                if (deprecated.length > 0) {
+                    issues.push(this.createIssue(context, `Deprecated TLS protocol(s) enabled: ${deprecated.join(', ')}`, {
+                        suggestion: 'Use TLSv1.2 or TLSv1.3 only. Remove deprecated protocols from enabledProtocols',
+                    }));
+                }
+            }
+        }
+        // Check for explicit protocol configurations in tls:context
+        const protocolElements = this.select('//*[local-name()="enabled-protocols"]/*[local-name()="protocol"]', doc);
+        for (const protocol of protocolElements) {
+            const element = protocol;
+            const value = element.textContent?.trim() || '';
+            if (this.deprecatedProtocols.some((dp) => value.toUpperCase() === dp.toUpperCase())) {
+                issues.push(this.createIssue(protocol, `Deprecated TLS protocol configured: ${value}`, {
+                    suggestion: 'Remove deprecated protocol. Use TLSv1.2 or TLSv1.3 only',
+                }));
+            }
+        }
+        return issues;
+    }
+}
+exports.TlsVersionRule = TlsVersionRule;
+//# sourceMappingURL=TlsVersionRule.js.map

package/dist/src/rules/security/TlsVersionRule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TlsVersionRule.js","sourceRoot":"","sources":["../../../../src/rules/security/TlsVersionRule.ts"],"names":[],"mappings":";;;AACA,+CAA4C;AAE5C;;;;;GAKG;AACH,MAAa,cAAe,SAAQ,mBAAQ;IACxC,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,mBAAmB,CAAC;IAC3B,WAAW,GAAG,+CAA+C,CAAC;IAC9D,QAAQ,GAAG,OAAgB,CAAC;IAC5B,QAAQ,GAAG,UAAmB,CAAC;IAEd,mBAAmB,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAEzF,QAAQ,CAAC,GAAa,EAAE,QAA2B;QAC/C,MAAM,MAAM,GAAY,EAAE,CAAC;QAE3B,sCAAsC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAEpE,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,OAAkB,CAAC;YACnC,MAAM,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;YAElE,IAAI,gBAAgB,EAAE,CAAC;gBACnB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnE,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CACzB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,CAC/C,CACJ,CAAC;gBAEF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,WAAW,CACZ,OAAO,EACP,uCAAuC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC9D;wBACI,UAAU,EACN,gFAAgF;qBACvF,CACJ,CACJ,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QAED,4DAA4D;QAC5D,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAChC,kEAAkE,EAClE,GAAG,CACN,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,QAAmB,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAEhD,IACI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CACzB,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,CACnD,EACH,CAAC;gBACC,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,WAAW,CACZ,QAAQ,EACR,uCAAuC,KAAK,EAAE,EAC9C;oBACI,UAAU,EACN,yDAAyD;iBAChE,CACJ,CACJ,CAAC;YACN,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAxED,wCAwEC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@sfdxy/mule-lint",
-    "version": "1.8.2",
+    "version": "1.9.0",
     "description": "Static analysis tool for MuleSoft applications - supports humans, AI agents, and CI/CD pipelines",
     "author": "Avinava",
     "license": "MIT",
@@ -70,4 +70,4 @@
         "url": "https://github.com/Avinava/mule-lint/issues"
     },
     "homepage": "https://github.com/Avinava/mule-lint#readme"
-}
+}