teamshare-bridge 0.3.0 → 0.4.0

package/dist/lib/audit/errors.js

@@ -0,0 +1,154 @@
+"use strict";
+/**
+ * Error handling checker — verifies that the backend uses the response
+ * envelope with proper exception filters and interceptors, and that
+ * the frontend has structured API error handling.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runErrorChecks = runErrorChecks;
+const types_1 = require("./types");
+const RAW_THROW = /throw\s+(?:new\s+)?Error\(/;
+/**
+ * Check backend for throw new Error() without a code property.
+ * These become 500 Internal Server Errors without useful context.
+ */
+function checkRawThrows(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        if (!RAW_THROW.test(lines[i]))
+            continue;
+        // Check if the error has a code property — look ahead up to 5 lines
+        let hasCode = false;
+        const end = Math.min(lines.length - 1, i + 5);
+        for (let j = i; j <= end; j++) {
+            if (/code[:\s]/.test(lines[j])) {
+                hasCode = true;
+                break;
+            }
+        }
+        if (!hasCode) {
+            findings.push({
+                severity: types_1.Severity.Medium,
+                category: types_1.Category.Errors,
+                file: rel,
+                line: i + 1,
+                message: 'Raw throw Error() without code — will surface as generic 500',
+                evidence: lines[i].trim(),
+                suggestedFix: 'Use a typed exception (e.g., new NotFoundException()) or include a code property.',
+                rule: 'ERR-001',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Check that the HTTP exception filter exists.
+ */
+function checkExceptionFilter(ctx) {
+    const findings = [];
+    const filterExists = ctx.fileExists('src/common/filters/http-exception.filter.ts') ||
+        ctx.fileExists('src/common/filters/all-exceptions.filter.ts') ||
+        ctx.fileExists('src/common/filters/exception.filter.ts');
+    if (!filterExists) {
+        findings.push({
+            severity: types_1.Severity.High,
+            category: types_1.Category.Errors,
+            file: 'src/common/filters/',
+            message: 'Missing HTTP exception filter — errors may leak stack traces',
+            suggestedFix: 'Create src/common/filters/http-exception.filter.ts that formats errors into the standard envelope.',
+            rule: 'ERR-002',
+        });
+    }
+    return findings;
+}
+/**
+ * Check that the transform interceptor exists (response envelope).
+ */
+function checkTransformInterceptor(ctx) {
+    const findings = [];
+    const exists = ctx.fileExists('src/common/interceptors/transform.interceptor.ts') ||
+        ctx.fileExists('src/common/interceptors/response.interceptor.ts');
+    if (!exists) {
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.Errors,
+            file: 'src/common/interceptors/',
+            message: 'Missing transform interceptor — responses may not follow the envelope format',
+            suggestedFix: 'Create src/common/interceptors/transform.interceptor.ts wrapping responses in { success, data }.',
+            rule: 'ERR-003',
+        });
+    }
+    return findings;
+}
+/**
+ * Check that the frontend API client exists and has an ApiError class.
+ */
+function checkFrontendAPIClient(ctx) {
+    const findings = [];
+    const clientPath = 'src/lib/api/client.ts';
+    if (!ctx.fileExists(clientPath)) {
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.Errors,
+            file: clientPath,
+            message: 'Missing API client — no structured error handling for HTTP requests',
+            suggestedFix: 'Create src/lib/api/client.ts with a typed fetch wrapper and ApiError class.',
+            rule: 'ERR-004',
+        });
+        return findings;
+    }
+    const content = ctx.readFile(clientPath);
+    if (!content)
+        return findings;
+    if (!/class\s+ApiError/.test(content)) {
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.Errors,
+            file: clientPath,
+            message: 'API client missing ApiError class — errors not typed',
+            suggestedFix: 'Add an ApiError class extending Error with status, code, and details fields.',
+            rule: 'ERR-005',
+        });
+    }
+    if (!/onUnauthorized|401/.test(content)) {
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.Errors,
+            file: clientPath,
+            message: 'API client missing 401/unauthorized handling',
+            suggestedFix: 'Add a 401 response handler that triggers logout or token refresh.',
+            rule: 'ERR-006',
+        });
+    }
+    return findings;
+}
+/**
+ * Run all error handling checks against the repository.
+ *
+ * Type-aware: NestJS-specific checks (exception filter, envelope
+ * interceptor, raw-throw 500s) run ONLY for backend repos. The frontend
+ * API-client check runs only for web/mobile. Generic repos (repoType
+ * "unknown", e.g. plain Node CLIs) get no false-positive backend findings.
+ */
+function runErrorChecks(ctx) {
+    const findings = [];
+    if (ctx.repoType === 'backend') {
+        const tsFiles = ctx.listFiles('**/*.ts');
+        for (const rel of tsFiles) {
+            if (/node_modules|dist|generated|\.d\.ts/.test(rel))
+                continue;
+            const content = ctx.readFile(rel);
+            if (!content)
+                continue;
+            findings.push(...checkRawThrows(content, rel));
+        }
+        findings.push(...checkExceptionFilter(ctx));
+        findings.push(...checkTransformInterceptor(ctx));
+    }
+    if (ctx.repoType === 'web' || ctx.repoType === 'mobile') {
+        findings.push(...checkFrontendAPIClient(ctx));
+    }
+    return findings;
+}
+//# sourceMappingURL=errors.js.map

package/dist/lib/audit/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/lib/audit/errors.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAwJH,wCAwBC;AA9KD,mCAA6C;AAG7C,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAExC,oEAAoE;QACpE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9B,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;gBACzB,QAAQ,EAAE,gBAAQ,CAAC,MAAM;gBACzB,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,8DAA8D;gBACvE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACzB,YAAY,EACV,mFAAmF;gBACrF,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAmB;IAC/C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,YAAY,GAChB,GAAG,CAAC,UAAU,CAAC,6CAA6C,CAAC;QAC7D,GAAG,CAAC,UAAU,CAAC,6CAA6C,CAAC;QAC7D,GAAG,CAAC,UAAU,CAAC,wCAAwC,CAAC,CAAC;IAE3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,8DAA8D;YACvE,YAAY,EACV,oGAAoG;YACtG,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,GAAmB;IACpD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,MAAM,GACV,GAAG,CAAC,UAAU,CAAC,kDAAkD,CAAC;QAClE,GAAG,CAAC,UAAU,CAAC,iDAAiD,CAAC,CAAC;IAEpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,8EAA8E;YACvF,YAAY,EACV,kGAAkG;YACpG,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,GAAmB;IACjD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,MAAM,UAAU,GAAG,uBAAuB,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,qEAAqE;YAC9E,YAAY,EAAE,6EAA6E;YAC3F,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,sDAAsD;YAC/D,YAAY,EAAE,8EAA8E;YAC5F,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,8CAA8C;YACvD,YAAY,EAAE,mEAAmE;YACjF,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,GAAmB;IAChD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAE9D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/audit/gates.d.ts

@@ -0,0 +1,2 @@
+import type { CheckerContext, GateResult } from './types';
+export declare function runGateChecks(ctx: CheckerContext): GateResult[];

package/dist/lib/audit/gates.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runGateChecks = runGateChecks;
+/**
+ * Build/typecheck gate checks — runs build and typecheck, reports pass/fail.
+ */
+const node_child_process_1 = require("node:child_process");
+function runGateChecks(ctx) {
+    const results = [];
+    // Detect project type from package.json
+    const pkgJson = ctx.readFile('package.json');
+    if (!pkgJson) {
+        results.push({ name: 'package.json', passed: false, error: 'No package.json found' });
+        return results;
+    }
+    const pkg = JSON.parse(pkgJson);
+    const deps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
+    // Frontend (Next.js)
+    if (deps['next'] || deps['next.js']) {
+        results.push(runCommand(ctx.root, 'npm run build', 'next-build'));
+    }
+    // Backend (NestJS)
+    if (deps['@nestjs/core'] || deps['@nestjs/common']) {
+        results.push(runCommand(ctx.root, 'npm run build', 'nest-build'));
+    }
+    // Mobile (Expo)
+    if (deps['expo']) {
+        results.push(runCommand(ctx.root, 'npx expo export --dump-sourcemap', 'expo-export'));
+    }
+    // TypeScript check
+    if (deps['typescript']) {
+        results.push(runCommand(ctx.root, 'npx tsc --noEmit', 'typecheck'));
+    }
+    return results;
+}
+function runCommand(cwd, command, name) {
+    try {
+        const output = (0, node_child_process_1.execSync)(command, {
+            cwd,
+            timeout: 120_000,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: { ...process.env, CI: 'true' },
+        });
+        return { name, passed: true, output: output.slice(0, 2000) };
+    }
+    catch (err) {
+        const e = err;
+        return {
+            name,
+            passed: false,
+            output: (e.stdout ?? '').slice(0, 2000),
+            error: (e.stderr ?? e.message ?? 'Unknown error').slice(0, 2000),
+        };
+    }
+}
+//# sourceMappingURL=gates.js.map

package/dist/lib/audit/gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gates.js","sourceRoot":"","sources":["../../../src/lib/audit/gates.ts"],"names":[],"mappings":";;AAMA,sCAkCC;AAxCD;;GAEG;AACH,2DAA8C;AAG9C,SAAgB,aAAa,CAAC,GAAmB;IAC/C,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,wCAAwC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACtF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;IAC3D,MAAM,IAAI,GAAG,EAAE,GAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA4B,EAAE,GAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAA4B,EAAE,CAAC;IAErI,qBAAqB;IACrB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,mBAAmB;IACnB,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,gBAAgB;IAChB,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,kCAAkC,EAAE,aAAa,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,mBAAmB;IACnB,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,OAAe,EAAE,IAAY;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,6BAAQ,EAAC,OAAO,EAAE;YAC/B,GAAG;YACH,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAA6D,CAAC;QACxE,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;YACvC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/audit/modularity.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Modularity checker — enforces vendor boundary rules, modular layouts,
+ * and structural conventions for backend and frontend repos.
+ */
+import type { Finding, CheckerContext } from './types';
+/**
+ * Run all modularity checks against the repository.
+ *
+ * Type-aware: vendor-boundary, shared-index and folder-naming checks are
+ * frontend-specific and run only for web/mobile repos; NestJS layout
+ * checks run only for backend repos.
+ */
+export declare function runModularityChecks(ctx: CheckerContext): Finding[];

package/dist/lib/audit/modularity.js

@@ -0,0 +1,200 @@
+"use strict";
+/**
+ * Modularity checker — enforces vendor boundary rules, modular layouts,
+ * and structural conventions for backend and frontend repos.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runModularityChecks = runModularityChecks;
+const types_1 = require("./types");
+const VENDOR_UI_IMPORT = /from\s+['"]@\/components\/ui\//;
+const LUCIDE_IMPORT = /from\s+['"]lucide-react(-native)?['"]/;
+const MODULE_FOLDER_PATTERN = /^src\/modules\/([^/]+)\//;
+const KEBAB_CASE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+const BACKEND_MODULE_FILES = ['controller', 'service', 'dto', 'module'];
+const BACKEND_COMMON_DIRS = [
+    'guards',
+    'filters',
+    'interceptors',
+    'pipes',
+    'swagger',
+    'constants',
+    'utils',
+    'prisma',
+];
+/**
+ * Check for direct imports of vendor ui/ components from app code.
+ * App code should import from @/components/shared, not ui/ directly.
+ */
+function checkVendorBoundary(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    // Allow imports inside components/ui/ itself and components/shared/
+    if (/^src\/components\/(ui|shared)\//.test(rel))
+        return findings;
+    for (let i = 0; i < lines.length; i++) {
+        if (VENDOR_UI_IMPORT.test(lines[i])) {
+            findings.push({
+                severity: types_1.Severity.High,
+                category: types_1.Category.Modularity,
+                file: rel,
+                line: i + 1,
+                message: 'Direct import from vendor ui/ boundary — must use shared TS* wrappers',
+                evidence: lines[i].trim(),
+                suggestedFix: 'Import from @/components/shared instead of @/components/ui/.',
+                rule: 'MOD-001',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Check for lucide-react imports outside of vendor ui/ components.
+ */
+function checkLucideBoundary(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    if (/^src\/components\/ui\//.test(rel))
+        return findings;
+    for (let i = 0; i < lines.length; i++) {
+        if (LUCIDE_IMPORT.test(lines[i])) {
+            findings.push({
+                severity: types_1.Severity.High,
+                category: types_1.Category.Modularity,
+                file: rel,
+                line: i + 1,
+                message: 'Direct lucide-react import outside vendor ui/ — use IconSax icons instead',
+                evidence: lines[i].trim(),
+                suggestedFix: 'Replace with iconsax-react (web) or iconsax-react-native (mobile). See ui-style-guide.md section 6.4.',
+                rule: 'MOD-002',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Check that module folders use kebab-case naming.
+ */
+function checkModuleFolderNames(files) {
+    const findings = [];
+    const moduleFolders = new Set();
+    for (const rel of files) {
+        const match = rel.match(MODULE_FOLDER_PATTERN);
+        if (match) {
+            moduleFolders.add(match[1]);
+        }
+    }
+    for (const folder of Array.from(moduleFolders)) {
+        if (!KEBAB_CASE.test(folder)) {
+            findings.push({
+                severity: types_1.Severity.Low,
+                category: types_1.Category.Modularity,
+                file: `src/modules/${folder}/`,
+                message: `Module folder "${folder}" is not kebab-case`,
+                suggestedFix: `Rename to "${folder.replace(/([A-Z])/g, '-$1').toLowerCase().replace(/^-/, '')}".`,
+                rule: 'MOD-003',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Check that each backend module has controller, service, dto, and module files.
+ */
+function checkBackendModuleStructure(ctx) {
+    const findings = [];
+    const files = ctx.listFiles('src/modules/*/');
+    const moduleFolders = new Set();
+    for (const rel of files) {
+        const match = rel.match(MODULE_FOLDER_PATTERN);
+        if (match) {
+            moduleFolders.add(match[1]);
+        }
+    }
+    for (const folder of Array.from(moduleFolders)) {
+        for (const suffix of BACKEND_MODULE_FILES) {
+            const pattern = `src/modules/${folder}/${folder}.${suffix}.ts`;
+            if (!ctx.fileExists(pattern)) {
+                findings.push({
+                    severity: types_1.Severity.Medium,
+                    category: types_1.Category.Modularity,
+                    file: `src/modules/${folder}/`,
+                    message: `Module "${folder}" missing ${suffix} file`,
+                    suggestedFix: `Create ${folder}.${suffix}.ts following the existing module pattern.`,
+                    rule: 'MOD-004',
+                });
+            }
+        }
+    }
+    return findings;
+}
+/**
+ * Check that backend common/ directory has required subfolders.
+ */
+function checkBackendCommonDirs(ctx) {
+    const findings = [];
+    for (const dir of BACKEND_COMMON_DIRS) {
+        if (!ctx.fileExists(`src/common/${dir}/`)) {
+            findings.push({
+                severity: types_1.Severity.Low,
+                category: types_1.Category.Modularity,
+                file: `src/common/${dir}/`,
+                message: `Backend missing src/common/${dir}/ directory`,
+                suggestedFix: `Create src/common/${dir}/ and add the relevant files.`,
+                rule: 'MOD-005',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Check that the shared components index file exists.
+ *
+ * Frontend-only check — a repo without src/components/shared is not a
+ * frontend and must not be flagged.
+ */
+function checkSharedIndex(ctx) {
+    const findings = [];
+    if (!ctx.fileExists('src/components/shared/index.ts') &&
+        !ctx.fileExists('src/components/shared/index.tsx')) {
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.Modularity,
+            file: 'src/components/shared/index.ts',
+            message: 'Missing shared components index file — shared components not re-exported',
+            suggestedFix: 'Create src/components/shared/index.ts that re-exports all shared wrapper components.',
+            rule: 'MOD-006',
+        });
+    }
+    return findings;
+}
+/**
+ * Run all modularity checks against the repository.
+ *
+ * Type-aware: vendor-boundary, shared-index and folder-naming checks are
+ * frontend-specific and run only for web/mobile repos; NestJS layout
+ * checks run only for backend repos.
+ */
+function runModularityChecks(ctx) {
+    const findings = [];
+    if (ctx.repoType === 'backend') {
+        findings.push(...checkBackendModuleStructure(ctx));
+        findings.push(...checkBackendCommonDirs(ctx));
+        return findings;
+    }
+    if (ctx.repoType !== 'web' && ctx.repoType !== 'mobile')
+        return findings;
+    const files = ctx.listFiles('**/*.{ts,tsx}');
+    for (const rel of files) {
+        if (/node_modules|dist|generated/.test(rel))
+            continue;
+        const content = ctx.readFile(rel);
+        if (!content)
+            continue;
+        findings.push(...checkVendorBoundary(content, rel));
+        findings.push(...checkLucideBoundary(content, rel));
+    }
+    findings.push(...checkModuleFolderNames(files));
+    findings.push(...checkSharedIndex(ctx));
+    return findings;
+}
+//# sourceMappingURL=modularity.js.map

package/dist/lib/audit/modularity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modularity.js","sourceRoot":"","sources":["../../../src/lib/audit/modularity.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAuMH,kDA2BC;AAhOD,mCAA6C;AAG7C,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAC1D,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAC9D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AACzD,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAEnD,MAAM,oBAAoB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AACxE,MAAM,mBAAmB,GAAG;IAC1B,QAAQ;IACR,SAAS;IACT,cAAc;IACd,OAAO;IACP,SAAS;IACT,WAAW;IACX,OAAO;IACP,QAAQ;CACT,CAAC;AAEF;;;GAGG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,oEAAoE;IACpE,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAQ,CAAC,IAAI;gBACvB,QAAQ,EAAE,gBAAQ,CAAC,UAAU;gBAC7B,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,uEAAuE;gBAChF,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACzB,YAAY,EAAE,8DAA8D;gBAC5E,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAQ,CAAC,IAAI;gBACvB,QAAQ,EAAE,gBAAQ,CAAC,UAAU;gBAC7B,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,2EAA2E;gBACpF,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACzB,YAAY,EACV,uGAAuG;gBACzG,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,KAAe;IAC7C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACV,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAQ,CAAC,GAAG;gBACtB,QAAQ,EAAE,gBAAQ,CAAC,UAAU;gBAC7B,IAAI,EAAE,eAAe,MAAM,GAAG;gBAC9B,OAAO,EAAE,kBAAkB,MAAM,qBAAqB;gBACtD,YAAY,EAAE,cAAc,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI;gBACjG,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAAC,GAAmB;IACtD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC/C,IAAI,KAAK,EAAE,CAAC;YACV,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,eAAe,MAAM,IAAI,MAAM,IAAI,MAAM,KAAK,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;oBACzB,QAAQ,EAAE,gBAAQ,CAAC,UAAU;oBAC7B,IAAI,EAAE,eAAe,MAAM,GAAG;oBAC9B,OAAO,EAAE,WAAW,MAAM,aAAa,MAAM,OAAO;oBACpD,YAAY,EAAE,UAAU,MAAM,IAAI,MAAM,4CAA4C;oBACpF,IAAI,EAAE,SAAS;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,GAAmB;IACjD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAQ,CAAC,GAAG;gBACtB,QAAQ,EAAE,gBAAQ,CAAC,UAAU;gBAC7B,IAAI,EAAE,cAAc,GAAG,GAAG;gBAC1B,OAAO,EAAE,8BAA8B,GAAG,aAAa;gBACvD,YAAY,EAAE,qBAAqB,GAAG,+BAA+B;gBACrE,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAmB;IAC3C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,gCAAgC,CAAC;QACjD,CAAC,GAAG,CAAC,UAAU,CAAC,iCAAiC,CAAC,EAClD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,UAAU;YAC7B,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,0EAA0E;YACnF,YAAY,EACV,sFAAsF;YACxF,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,GAAmB;IACrD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAEzE,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAE7C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAEtD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAExC,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/audit/quality.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Code quality checker — flags eslint-disable comments, TypeScript
+ * suppressions, TODO/FIXME markers, and excessively long lines.
+ */
+import type { Finding, CheckerContext } from './types';
+/**
+ * Run all code quality checks against the repository.
+ */
+export declare function runQualityChecks(ctx: CheckerContext): Finding[];

package/dist/lib/audit/quality.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * Code quality checker — flags eslint-disable comments, TypeScript
+ * suppressions, TODO/FIXME markers, and excessively long lines.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runQualityChecks = runQualityChecks;
+const types_1 = require("./types");
+const ESLINT_DISABLE = /(\/\/\s*eslint-disable|\/\*\s*eslint-disable)/;
+const ESLINT_DISABLE_RULE = /eslint-disable(?:-next-line|-once)?\s*(?:\(([^)]+)\))?/;
+const TS_IGNORE = /(@ts-ignore|@ts-expect-error)/;
+const TODO_FIXME = /(TODO|FIXME)\b\s*[:\-]?\s*(.*)/;
+const SKIP_PATHS = /node_modules|dist|generated|\.d\.ts/;
+/**
+ * Check for eslint-disable comments and extract the rule being disabled.
+ */
+function checkESLintDisables(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        if (!ESLINT_DISABLE.test(lines[i]))
+            continue;
+        const ruleMatch = lines[i].match(ESLINT_DISABLE_RULE);
+        const rule = ruleMatch?.[1] || 'all rules';
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.Quality,
+            file: rel,
+            line: i + 1,
+            message: `eslint-disable used — suppressing ${rule}`,
+            evidence: lines[i].trim(),
+            suggestedFix: 'Fix the underlying issue instead of disabling the lint rule.',
+            rule: 'QUA-001',
+        });
+    }
+    return findings;
+}
+/**
+ * Check for TypeScript error suppressions.
+ */
+function checkTSSuppressions(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const match = lines[i].match(TS_IGNORE);
+        if (!match)
+            continue;
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.Quality,
+            file: rel,
+            line: i + 1,
+            message: `TypeScript error suppressed with ${match[1]}`,
+            evidence: lines[i].trim(),
+            suggestedFix: 'Fix the underlying type error instead of suppressing it.',
+            rule: 'QUA-002',
+        });
+    }
+    return findings;
+}
+/**
+ * Check for TODO and FIXME comments and extract the note text.
+ */
+function checkTodoFixme(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const match = lines[i].match(TODO_FIXME);
+        if (!match)
+            continue;
+        const marker = match[1];
+        const note = match[2]?.trim() || '(no description)';
+        findings.push({
+            severity: types_1.Severity.Low,
+            category: types_1.Category.Quality,
+            file: rel,
+            line: i + 1,
+            message: `${marker}: ${note}`,
+            evidence: lines[i].trim(),
+            rule: 'QUA-003',
+        });
+    }
+    return findings;
+}
+/**
+ * Count lines exceeding 120 characters in a file.
+ */
+function checkLongLines(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    let longCount = 0;
+    for (let i = 0; i < lines.length; i++) {
+        if (lines[i].length > 120) {
+            longCount++;
+        }
+    }
+    if (longCount > 10) {
+        findings.push({
+            severity: types_1.Severity.Low,
+            category: types_1.Category.Quality,
+            file: rel,
+            message: `${longCount} lines exceed 120 characters`,
+            suggestedFix: 'Break long lines for readability. Consider extracting long strings or arguments.',
+            rule: 'QUA-004',
+        });
+    }
+    return findings;
+}
+/**
+ * Run all code quality checks against the repository.
+ */
+function runQualityChecks(ctx) {
+    const findings = [];
+    const files = ctx.listFiles('**/*.{ts,tsx}');
+    for (const rel of files) {
+        if (SKIP_PATHS.test(rel))
+            continue;
+        const content = ctx.readFile(rel);
+        if (!content)
+            continue;
+        findings.push(...checkESLintDisables(content, rel));
+        findings.push(...checkTSSuppressions(content, rel));
+        findings.push(...checkTodoFixme(content, rel));
+        findings.push(...checkLongLines(content, rel));
+    }
+    return findings;
+}
+//# sourceMappingURL=quality.js.map

package/dist/lib/audit/quality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality.js","sourceRoot":"","sources":["../../../src/lib/audit/quality.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA6HH,4CAiBC;AA5ID,mCAA6C;AAG7C,MAAM,cAAc,GAAG,+CAA+C,CAAC;AACvE,MAAM,mBAAmB,GAAG,wDAAwD,CAAC;AACrF,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAClD,MAAM,UAAU,GAAG,gCAAgC,CAAC;AAEpD,MAAM,UAAU,GAAG,qCAAqC,CAAC;AAEzD;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAE7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;QAE3C,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,OAAO;YAC1B,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,OAAO,EAAE,qCAAqC,IAAI,EAAE;YACpD,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACzB,YAAY,EAAE,8DAA8D;YAC5E,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,OAAO;YAC1B,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,OAAO,EAAE,oCAAoC,KAAK,CAAC,CAAC,CAAC,EAAE;YACvD,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACzB,YAAY,EAAE,0DAA0D;YACxE,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,kBAAkB,CAAC;QAEpD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,GAAG;YACtB,QAAQ,EAAE,gBAAQ,CAAC,OAAO;YAC1B,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,OAAO,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE;YAC7B,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACzB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1B,SAAS,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,EAAE,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,GAAG;YACtB,QAAQ,EAAE,gBAAQ,CAAC,OAAO;YAC1B,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,GAAG,SAAS,8BAA8B;YACnD,YAAY,EAAE,kFAAkF;YAChG,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,GAAmB;IAClD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAE7C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAEnC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/audit/rbac.d.ts

@@ -0,0 +1,14 @@
+/**
+ * RBAC checker — verifies that backend controllers have proper access
+ * metadata on every method, that auth guards exist and are registered
+ * globally, and that the RBAC constants file is present.
+ */
+import type { Finding, CheckerContext } from './types';
+/**
+ * Run all RBAC checks against the repository.
+ *
+ * Type-aware: all checks are NestJS-backend-specific, so they run only
+ * when the repo is a backend. Generic repos (repoType "unknown") are not
+ * flagged for missing guards/rbac constants they never promised to have.
+ */
+export declare function runRBACChecks(ctx: CheckerContext): Finding[];