@neurcode-ai/cli 0.9.63 → 0.9.65

package/dist/structural-rules/rules/SR011-event-listener-leak.js

@@ -0,0 +1,208 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SR011EventListenerLeak = void 0;
+const ts = __importStar(require("typescript"));
+function getLineAndCol(sf, pos) {
+    const lc = sf.getLineAndCharacterOfPosition(pos);
+    return { line: lc.line + 1, column: lc.character + 1 };
+}
+function getEvidenceLines(sourceText, line, extra = 1) {
+    const lines = sourceText.split('\n');
+    return lines.slice(line - 1, Math.min(line - 1 + extra, lines.length)).map(l => l.slice(0, 120)).join('\n');
+}
+/** Walk up AST to find the nearest containing class declaration/expression. */
+function getEnclosingClass(node) {
+    let current = node.parent;
+    while (current) {
+        if (ts.isClassDeclaration(current) || ts.isClassExpression(current)) {
+            return current;
+        }
+        current = current.parent;
+    }
+    return undefined;
+}
+/** Check if the node is directly inside an arrow function that is NOT a class method. */
+function isInsideNonMethodArrowFunction(node) {
+    let current = node.parent;
+    while (current) {
+        if (ts.isArrowFunction(current)) {
+            // If the arrow function is a method body, it's OK
+            const parent = current.parent;
+            if (ts.isMethodDeclaration(parent) || ts.isPropertyDeclaration(parent)) {
+                return false;
+            }
+            // Arrow function that is NOT a class method
+            const enclosingClass = getEnclosingClass(current);
+            if (!enclosingClass) {
+                return true;
+            }
+        }
+        if (ts.isClassDeclaration(current) || ts.isClassExpression(current)) {
+            break;
+        }
+        current = current.parent;
+    }
+    return false;
+}
+/** Extract the event string literal from addEventListener/on call (first arg). */
+function extractEventName(args) {
+    if (args.length < 2)
+        return undefined;
+    const firstArg = args[0];
+    if (ts.isStringLiteral(firstArg)) {
+        return firstArg.text;
+    }
+    return undefined;
+}
+/** Check if the third arg is { once: true }. */
+function hasOnceOption(args) {
+    if (args.length < 3)
+        return false;
+    const optArg = args[2];
+    if (ts.isObjectLiteralExpression(optArg)) {
+        for (const prop of optArg.properties) {
+            if (ts.isPropertyAssignment(prop) &&
+                ts.isIdentifier(prop.name) &&
+                prop.name.text === 'once' &&
+                prop.initializer.kind === ts.SyntaxKind.TrueKeyword) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/** Collect the text of a class body to search for removal calls. */
+function getClassBodyText(classNode) {
+    return classNode.members.map(m => m.getText()).join('\n');
+}
+/** Check if there's a removeEventListener or .off( call in the class body text for the given event. */
+function hasRemovalInClass(classNode, eventName) {
+    const bodyText = getClassBodyText(classNode);
+    const hasRemoveEventListener = bodyText.includes('removeEventListener');
+    const hasOff = bodyText.includes('.off(');
+    if (!eventName) {
+        // Without a known event name, check if any removal exists
+        return hasRemoveEventListener || hasOff;
+    }
+    // Check if the event name is referenced near the removal call
+    if (hasRemoveEventListener && bodyText.includes(eventName)) {
+        // crude but effective: if both the removal method and the event name appear, accept it
+        return true;
+    }
+    if (hasOff && bodyText.includes(eventName)) {
+        return true;
+    }
+    return false;
+}
+class SR011EventListenerLeak {
+    id = 'SR011';
+    name = 'Event listener leak (missing removal)';
+    policyRef = 'SR011';
+    severity = 'BLOCKING';
+    languages = ['typescript', 'javascript'];
+    description = 'addEventListener() or .on() calls inside a class with no corresponding removeEventListener()/.off() ' +
+        'for the same event — leaked listeners accumulate and prevent GC of the enclosing object.';
+    check(filePath, sourceText) {
+        try {
+            const violations = [];
+            const ext = filePath.endsWith('.tsx')
+                ? ts.ScriptKind.TSX
+                : filePath.endsWith('.jsx')
+                    ? ts.ScriptKind.JSX
+                    : filePath.endsWith('.js')
+                        ? ts.ScriptKind.JS
+                        : ts.ScriptKind.TS;
+            const sf = ts.createSourceFile(filePath, sourceText, ts.ScriptTarget.Latest, true, ext);
+            const visit = (node) => {
+                if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+                    const methodName = node.expression.name.text;
+                    const isAddEventListener = methodName === 'addEventListener';
+                    const isOnCall = methodName === 'on';
+                    if (isAddEventListener || isOnCall) {
+                        // Exclude arrow function bodies that are not class methods
+                        if (isInsideNonMethodArrowFunction(node)) {
+                            ts.forEachChild(node, visit);
+                            return;
+                        }
+                        // Must be inside a class
+                        const enclosingClass = getEnclosingClass(node);
+                        if (!enclosingClass) {
+                            ts.forEachChild(node, visit);
+                            return;
+                        }
+                        // Exclude { once: true } option
+                        if (isAddEventListener && hasOnceOption(node.arguments)) {
+                            ts.forEachChild(node, visit);
+                            return;
+                        }
+                        const eventName = extractEventName(node.arguments);
+                        // Check if removal exists in the class
+                        if (!hasRemovalInClass(enclosingClass, eventName)) {
+                            const { line, column } = getLineAndCol(sf, node.expression.name.getStart(sf));
+                            const evidence = getEvidenceLines(sourceText, line, 2);
+                            violations.push({
+                                ruleId: this.id,
+                                ruleName: this.name,
+                                policyRef: this.policyRef,
+                                severity: this.severity,
+                                filePath,
+                                line,
+                                column,
+                                evidence,
+                                operationalRisk: 'Every listener registration without a paired removal leaks memory proportional to ' +
+                                    'listener count × retained closure size. Common in WebSocket handlers, Node.js ' +
+                                    'EventEmitters, and browser DOM events in long-lived objects.',
+                                remediation: 'Store the handler reference and call `emitter.off(event, handler)` in a ' +
+                                    'dispose/cleanup method, or use `{ once: true }` for one-shot listeners.',
+                                determinism: 'deterministic-structural',
+                                confidence: 0.88,
+                                language: filePath.match(/\.(js|jsx)$/) ? 'javascript' : 'typescript',
+                            });
+                        }
+                    }
+                }
+                ts.forEachChild(node, visit);
+            };
+            ts.forEachChild(sf, visit);
+            return violations;
+        }
+        catch {
+            return [];
+        }
+    }
+}
+exports.SR011EventListenerLeak = SR011EventListenerLeak;
+//# sourceMappingURL=SR011-event-listener-leak.js.map

package/dist/structural-rules/rules/SR011-event-listener-leak.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SR011-event-listener-leak.js","sourceRoot":"","sources":["../../../src/structural-rules/rules/SR011-event-listener-leak.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AAGjC,SAAS,aAAa,CAAC,EAAiB,EAAE,GAAW;IACnD,MAAM,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAE,IAAY,EAAE,KAAK,GAAG,CAAC;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9G,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,OAAO,GAAwB,IAAI,CAAC,MAAM,CAAC;IAC/C,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yFAAyF;AACzF,SAAS,8BAA8B,CAAC,IAAa;IACnD,IAAI,OAAO,GAAwB,IAAI,CAAC,MAAM,CAAC;IAC/C,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,kDAAkD;YAClD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,4CAA4C;YAC5C,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,MAAM;QACR,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,IAAiC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,SAAS,aAAa,CAAC,IAAiC;IACtD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACrC,IACE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAC7B,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM;gBACzB,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,EACnD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,SAAS,gBAAgB,CAAC,SAAmD;IAC3E,OAAO,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,uGAAuG;AACvG,SAAS,iBAAiB,CACxB,SAAmD,EACnD,SAA6B;IAE7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,sBAAsB,GAAG,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,0DAA0D;QAC1D,OAAO,sBAAsB,IAAI,MAAM,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAC9D,IAAI,sBAAsB,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,uFAAuF;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAa,sBAAsB;IACjC,EAAE,GAAG,OAAO,CAAC;IACb,IAAI,GAAG,uCAAuC,CAAC;IAC/C,SAAS,GAAG,OAAO,CAAC;IACpB,QAAQ,GAAG,UAAmB,CAAC;IAC/B,SAAS,GAAmB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACzD,WAAW,GACT,sGAAsG;QACtG,0FAA0F,CAAC;IAE7F,KAAK,CAAC,QAAgB,EAAE,UAAkB;QACxC,IAAI,CAAC;YACH,MAAM,UAAU,GAA0B,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG;gBACnB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC3B,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG;oBACnB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;wBAC1B,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE;wBAClB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YAErB,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAExF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;gBACpC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC7C,MAAM,kBAAkB,GAAG,UAAU,KAAK,kBAAkB,CAAC;oBAC7D,MAAM,QAAQ,GAAG,UAAU,KAAK,IAAI,CAAC;oBAErC,IAAI,kBAAkB,IAAI,QAAQ,EAAE,CAAC;wBACnC,2DAA2D;wBAC3D,IAAI,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC;4BACzC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;4BAC7B,OAAO;wBACT,CAAC;wBAED,yBAAyB;wBACzB,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;wBAC/C,IAAI,CAAC,cAAc,EAAE,CAAC;4BACpB,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;4BAC7B,OAAO;wBACT,CAAC;wBAED,gCAAgC;wBAChC,IAAI,kBAAkB,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;4BACxD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;4BAC7B,OAAO;wBACT,CAAC;wBAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;wBAEnD,uCAAuC;wBACvC,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;4BAClD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;4BAC9E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;4BACvD,UAAU,CAAC,IAAI,CAAC;gCACd,MAAM,EAAE,IAAI,CAAC,EAAE;gCACf,QAAQ,EAAE,IAAI,CAAC,IAAI;gCACnB,SAAS,EAAE,IAAI,CAAC,SAAS;gCACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gCACvB,QAAQ;gCACR,IAAI;gCACJ,MAAM;gCACN,QAAQ;gCACR,eAAe,EACb,oFAAoF;oCACpF,gFAAgF;oCAChF,8DAA8D;gCAChE,WAAW,EACT,0EAA0E;oCAC1E,yEAAyE;gCAC3E,WAAW,EAAE,0BAA0B;gCACvC,UAAU,EAAE,IAAI;gCAChB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;6BACtE,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC,CAAC;YAEF,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAxFD,wDAwFC"}

package/dist/structural-rules/rules/SR012-promise-race-leak.d.ts

@@ -0,0 +1,11 @@
+import { StructuralRule, StructuralViolation, RuleLanguage } from '../types';
+export declare class SR012PromiseRaceLeak implements StructuralRule {
+    id: string;
+    name: string;
+    policyRef: string;
+    severity: "ADVISORY";
+    languages: RuleLanguage[];
+    description: string;
+    check(filePath: string, sourceText: string): StructuralViolation[];
+}
+//# sourceMappingURL=SR012-promise-race-leak.d.ts.map

package/dist/structural-rules/rules/SR012-promise-race-leak.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SR012-promise-race-leak.d.ts","sourceRoot":"","sources":["../../../src/structural-rules/rules/SR012-promise-race-leak.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAkE7E,qBAAa,oBAAqB,YAAW,cAAc;IACzD,EAAE,SAAW;IACb,IAAI,SAAkD;IACtD,SAAS,SAAW;IACpB,QAAQ,EAAG,UAAU,CAAU;IAC/B,SAAS,EAAE,YAAY,EAAE,CAAgC;IACzD,WAAW,SAEqF;IAEhG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mBAAmB,EAAE;CAmGnE"}

package/dist/structural-rules/rules/SR012-promise-race-leak.js

@@ -0,0 +1,191 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SR012PromiseRaceLeak = void 0;
+const ts = __importStar(require("typescript"));
+function getLineAndCol(sf, pos) {
+    const lc = sf.getLineAndCharacterOfPosition(pos);
+    return { line: lc.line + 1, column: lc.character + 1 };
+}
+function getEvidenceLines(sourceText, line, extra = 1) {
+    const lines = sourceText.split('\n');
+    return lines.slice(line - 1, Math.min(line - 1 + extra, lines.length)).map(l => l.slice(0, 120)).join('\n');
+}
+/**
+ * Check if an expression looks like a timeout promise:
+ * - `new Promise(resolve => setTimeout(...))`
+ * - an identifier whose name contains 'timeout' or 'Timeout'
+ */
+function looksLikeTimeout(node) {
+    // new Promise(resolve => setTimeout(...))
+    if (ts.isNewExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === 'Promise') {
+        const args = node.arguments;
+        if (args && args.length > 0) {
+            const executor = args[0];
+            if (ts.isArrowFunction(executor) || ts.isFunctionExpression(executor)) {
+                let hasSetTimeout = false;
+                const scanForSetTimeout = (n) => {
+                    if (ts.isCallExpression(n) &&
+                        ts.isIdentifier(n.expression) &&
+                        n.expression.text === 'setTimeout') {
+                        hasSetTimeout = true;
+                    }
+                    if (!hasSetTimeout)
+                        ts.forEachChild(n, scanForSetTimeout);
+                };
+                scanForSetTimeout(executor);
+                if (hasSetTimeout)
+                    return true;
+            }
+        }
+    }
+    // identifier or property access with 'timeout' or 'Timeout' in the name
+    if (ts.isIdentifier(node)) {
+        const lower = node.text.toLowerCase();
+        if (lower.includes('timeout'))
+            return true;
+    }
+    if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.name)) {
+        const lower = node.name.text.toLowerCase();
+        if (lower.includes('timeout'))
+            return true;
+    }
+    return false;
+}
+/** Check if text of a node or its subtree contains AbortController / .abort() / cleanup references. */
+function containsAbortOrCleanup(node, sf) {
+    const text = node.getText(sf);
+    return (text.includes('AbortController') ||
+        text.includes('.abort()') ||
+        text.includes('.abort(') ||
+        text.includes('cleanup') ||
+        text.includes('cancel'));
+}
+class SR012PromiseRaceLeak {
+    id = 'SR012';
+    name = 'Promise.race timeout leak (no abort/cleanup)';
+    policyRef = 'SR012';
+    severity = 'ADVISORY';
+    languages = ['typescript', 'javascript'];
+    description = 'Promise.race() with a timeout branch but no AbortController/.abort()/cleanup — ' +
+        'when the timeout wins, the losing promise(s) continue running, leaking connections and CPU.';
+    check(filePath, sourceText) {
+        try {
+            const violations = [];
+            const ext = filePath.endsWith('.tsx')
+                ? ts.ScriptKind.TSX
+                : filePath.endsWith('.jsx')
+                    ? ts.ScriptKind.JSX
+                    : filePath.endsWith('.js')
+                        ? ts.ScriptKind.JS
+                        : ts.ScriptKind.TS;
+            const sf = ts.createSourceFile(filePath, sourceText, ts.ScriptTarget.Latest, true, ext);
+            const visit = (node) => {
+                // Looking for: Promise.race([...])
+                if (ts.isCallExpression(node) &&
+                    ts.isPropertyAccessExpression(node.expression) &&
+                    ts.isIdentifier(node.expression.expression) &&
+                    node.expression.expression.text === 'Promise' &&
+                    node.expression.name.text === 'race') {
+                    const args = node.arguments;
+                    if (args.length !== 1) {
+                        ts.forEachChild(node, visit);
+                        return;
+                    }
+                    const arrayArg = args[0];
+                    if (!ts.isArrayLiteralExpression(arrayArg)) {
+                        ts.forEachChild(node, visit);
+                        return;
+                    }
+                    // Check if one element is clearly a timeout
+                    const hasTimeout = arrayArg.elements.some(el => looksLikeTimeout(el));
+                    if (!hasTimeout) {
+                        ts.forEachChild(node, visit);
+                        return;
+                    }
+                    // Check if any array element references AbortController or cleanup
+                    const hasCleanup = arrayArg.elements.some(el => containsAbortOrCleanup(el, sf));
+                    // Also check a .finally() chained on the race call
+                    let hasFinallyAbort = false;
+                    const parent = node.parent;
+                    if (ts.isPropertyAccessExpression(parent) && parent.name.text === 'finally') {
+                        const grandParent = parent.parent;
+                        if (ts.isCallExpression(grandParent)) {
+                            hasFinallyAbort = containsAbortOrCleanup(grandParent, sf);
+                        }
+                    }
+                    // Also look in the enclosing statement for abort references
+                    let enclosingStatement = node;
+                    while (enclosingStatement.parent && !ts.isBlock(enclosingStatement.parent)) {
+                        enclosingStatement = enclosingStatement.parent;
+                    }
+                    const statementText = enclosingStatement.getText(sf);
+                    const nearbyHasAbort = statementText.includes('.abort(') ||
+                        statementText.includes('AbortController');
+                    if (!hasCleanup && !hasFinallyAbort && !nearbyHasAbort) {
+                        const { line, column } = getLineAndCol(sf, node.expression.name.getStart(sf));
+                        const evidence = getEvidenceLines(sourceText, line, 2);
+                        violations.push({
+                            ruleId: this.id,
+                            ruleName: this.name,
+                            policyRef: this.policyRef,
+                            severity: this.severity,
+                            filePath,
+                            line,
+                            column,
+                            evidence,
+                            operationalRisk: 'When the timeout wins the race, the original operations continue running in the background, ' +
+                                'consuming connections, CPU, and memory. In high-traffic systems this creates phantom load ' +
+                                'that grows until process restart.',
+                            remediation: 'Use AbortController: `const ac = new AbortController(); ' +
+                                'Promise.race([fetchWithSignal(ac.signal), timeout]).finally(() => ac.abort())`.',
+                            determinism: 'heuristic-advisory',
+                            confidence: 0.80,
+                            language: filePath.match(/\.(js|jsx)$/) ? 'javascript' : 'typescript',
+                        });
+                    }
+                }
+                ts.forEachChild(node, visit);
+            };
+            ts.forEachChild(sf, visit);
+            return violations;
+        }
+        catch {
+            return [];
+        }
+    }
+}
+exports.SR012PromiseRaceLeak = SR012PromiseRaceLeak;
+//# sourceMappingURL=SR012-promise-race-leak.js.map

package/dist/structural-rules/rules/SR012-promise-race-leak.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SR012-promise-race-leak.js","sourceRoot":"","sources":["../../../src/structural-rules/rules/SR012-promise-race-leak.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AAGjC,SAAS,aAAa,CAAC,EAAiB,EAAE,GAAW;IACnD,MAAM,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAE,IAAY,EAAE,KAAK,GAAG,CAAC;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,0CAA0C;IAC1C,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5B,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtE,IAAI,aAAa,GAAG,KAAK,CAAC;gBAC1B,MAAM,iBAAiB,GAAG,CAAC,CAAU,EAAQ,EAAE;oBAC7C,IACE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;wBACtB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;wBAC7B,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY,EAClC,CAAC;wBACD,aAAa,GAAG,IAAI,CAAC;oBACvB,CAAC;oBACD,IAAI,CAAC,aAAa;wBAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;gBAC5D,CAAC,CAAC;gBACF,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBAC5B,IAAI,aAAa;oBAAE,OAAO,IAAI,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uGAAuG;AACvG,SAAS,sBAAsB,CAAC,IAAa,EAAE,EAAiB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,MAAa,oBAAoB;IAC/B,EAAE,GAAG,OAAO,CAAC;IACb,IAAI,GAAG,8CAA8C,CAAC;IACtD,SAAS,GAAG,OAAO,CAAC;IACpB,QAAQ,GAAG,UAAmB,CAAC;IAC/B,SAAS,GAAmB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACzD,WAAW,GACT,iFAAiF;QACjF,6FAA6F,CAAC;IAEhG,KAAK,CAAC,QAAgB,EAAE,UAAkB;QACxC,IAAI,CAAC;YACH,MAAM,UAAU,GAA0B,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG;gBACnB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC3B,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG;oBACnB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;wBAC1B,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE;wBAClB,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YAErB,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAExF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;gBACpC,mCAAmC;gBACnC,IACE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;oBACzB,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;oBAC9C,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;oBAC3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS;oBAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EACpC,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;oBAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACtB,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBAED,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;oBACzB,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC3C,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBAED,4CAA4C;oBAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;oBACtE,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBAC7B,OAAO;oBACT,CAAC;oBAED,mEAAmE;oBACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;oBAEhF,mDAAmD;oBACnD,IAAI,eAAe,GAAG,KAAK,CAAC;oBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;oBAC3B,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;wBAClC,IAAI,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;4BACrC,eAAe,GAAG,sBAAsB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;wBAC5D,CAAC;oBACH,CAAC;oBAED,4DAA4D;oBAC5D,IAAI,kBAAkB,GAAY,IAAI,CAAC;oBACvC,OAAO,kBAAkB,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC3E,kBAAkB,GAAG,kBAAkB,CAAC,MAAM,CAAC;oBACjD,CAAC;oBACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACrD,MAAM,cAAc,GAClB,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;wBACjC,aAAa,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;oBAE5C,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;wBACvD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;wBAC9E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;wBACvD,UAAU,CAAC,IAAI,CAAC;4BACd,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,QAAQ,EAAE,IAAI,CAAC,IAAI;4BACnB,SAAS,EAAE,IAAI,CAAC,SAAS;4BACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,QAAQ;4BACR,IAAI;4BACJ,MAAM;4BACN,QAAQ;4BACR,eAAe,EACb,8FAA8F;gCAC9F,4FAA4F;gCAC5F,mCAAmC;4BACrC,WAAW,EACT,0DAA0D;gCAC1D,iFAAiF;4BACnF,WAAW,EAAE,oBAAoB;4BACjC,UAAU,EAAE,IAAI;4BAChB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;yBACtE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC,CAAC;YAEF,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AA7GD,oDA6GC"}

package/dist/structural-rules/rules/SR013-missing-idempotency-key.d.ts

@@ -0,0 +1,11 @@
+import { StructuralRule, StructuralViolation, RuleLanguage } from '../types';
+export declare class SR013MissingIdempotencyKey implements StructuralRule {
+    id: string;
+    name: string;
+    policyRef: string;
+    severity: "ADVISORY";
+    languages: RuleLanguage[];
+    description: string;
+    check(filePath: string, sourceText: string): StructuralViolation[];
+}
+//# sourceMappingURL=SR013-missing-idempotency-key.d.ts.map

package/dist/structural-rules/rules/SR013-missing-idempotency-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SR013-missing-idempotency-key.d.ts","sourceRoot":"","sources":["../../../src/structural-rules/rules/SR013-missing-idempotency-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAsE7E,qBAAa,0BAA2B,YAAW,cAAc;IAC/D,EAAE,SAAW;IACb,IAAI,SAAgD;IACpD,SAAS,SAAW;IACpB,QAAQ,EAAG,UAAU,CAAU;IAC/B,SAAS,EAAE,YAAY,EAAE,CAAgC;IACzD,WAAW,SAE+C;IAE1D,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mBAAmB,EAAE;CA2HnE"}