@opensip-cli/checks-typescript 0.1.0

package/dist/checks/quality/observability/pii-exposure-in-logs.js

@@ -0,0 +1,212 @@
+/**
+ * @fileoverview PII Exposure in Logs Check
+ *
+ * Uses AST analysis to detect PII exposure in log statements.
+ * Walks call expressions to find logger.info/warn/error/debug/trace/fatal calls,
+ * then inspects arguments for PII field names. AST context eliminates false
+ * positives from PII field names in non-log contexts (type definitions,
+ * variable names, string constants).
+ *
+ * @see Logging Standards
+ */
+import { defineCheck } from '@opensip-cli/fitness';
+import { parseSource, walkNodes, getPropertyChain, getLineNumber, } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+// PII field names that should never be logged directly
+const PII_FIELD_NAMES = new Set([
+    'email',
+    'emailaddress',
+    'email_address',
+    'phone',
+    'phonenumber',
+    'phone_number',
+    'ssn',
+    'socialsecurity',
+    'social_security',
+    'socialsecuritynumber',
+    'social_security_number',
+    'creditcard',
+    'credit_card',
+    'cardnumber',
+    'card_number',
+    'cvv',
+    'cvc',
+    'passport',
+    'driverlicense',
+    'driver_license',
+    'bankaccount',
+    'bank_account',
+    'routingnumber',
+    'routing_number',
+    'password',
+    'passwd',
+    'pwd',
+    'secret',
+    'apikey',
+    'api_key',
+    'accesstoken',
+    'access_token',
+    'refreshtoken',
+    'refresh_token',
+    'privatekey',
+    'private_key',
+    'address',
+    'streetaddress',
+    'street_address',
+    'ipaddress',
+    'ip_address',
+    'dateofbirth',
+    'date_of_birth',
+    'dob',
+]);
+/** Logger method names that indicate a log call */
+const LOG_METHOD_NAMES = new Set(['trace', 'debug', 'info', 'warn', 'error', 'fatal']);
+/** Logger object names (L is our shorthand, logger is standard) */
+const LOGGER_OBJECT_NAMES = new Set(['L', 'logger', 'log']);
+/** Safe function calls that indicate the PII field value is sanitized */
+const SAFE_WRAPPER_FUNCTIONS = new Set([
+    'hashpii',
+    'hash',
+    'redact',
+    'mask',
+    'sanitize',
+    'encrypt',
+    'hashpiifield',
+    'redactfield',
+    'maskfield',
+]);
+/**
+ * Check if a node is a logger call expression.
+ * Matches: logger.info(...), L.warn(...), log.error(...), this.logger.debug(...)
+ */
+function isLoggerCall(node) {
+    const expr = node.expression;
+    if (!ts.isPropertyAccessExpression(expr))
+        return false;
+    if (!LOG_METHOD_NAMES.has(expr.name.text))
+        return false;
+    const chain = getPropertyChain(expr.expression);
+    // Direct logger call: logger.info, L.warn
+    if (LOGGER_OBJECT_NAMES.has(chain))
+        return true;
+    // Nested: this.logger.info, context.logger.warn
+    if (chain.endsWith('.logger') || chain.endsWith('.L') || chain.endsWith('.log'))
+        return true;
+    return false;
+}
+/**
+ * Check if a property value expression is wrapped in a sanitization function.
+ * E.g., hashPii(email), mask(phone), redact(ssn)
+ */
+function isWrappedInSafeCall(node) {
+    if (ts.isCallExpression(node)) {
+        const callee = node.expression;
+        if (ts.isIdentifier(callee) && SAFE_WRAPPER_FUNCTIONS.has(callee.text.toLowerCase())) {
+            return true;
+        }
+        if (ts.isPropertyAccessExpression(callee) &&
+            SAFE_WRAPPER_FUNCTIONS.has(callee.name.text.toLowerCase())) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Inspect an object literal for PII field names in its properties.
+ * Returns the first PII field found, or null if none.
+ */
+function findPiiFieldInObject(obj) {
+    for (const prop of obj.properties) {
+        if (!ts.isPropertyAssignment(prop))
+            continue;
+        let propName = '';
+        if (ts.isIdentifier(prop.name)) {
+            propName = prop.name.text;
+        }
+        else if (ts.isStringLiteral(prop.name)) {
+            propName = prop.name.text;
+        }
+        else if (ts.isComputedPropertyName(prop.name)) {
+            continue; // skip computed properties
+        }
+        if (PII_FIELD_NAMES.has(propName.toLowerCase())) {
+            const safe = isWrappedInSafeCall(prop.initializer);
+            return { fieldName: propName, safe };
+        }
+        // Check nested object literals
+        if (ts.isObjectLiteralExpression(prop.initializer)) {
+            const nested = findPiiFieldInObject(prop.initializer);
+            if (nested)
+                return nested;
+        }
+    }
+    return null;
+}
+/**
+ * Check: quality/pii-exposure-in-logs
+ *
+ * Detects potential PII exposure in log statements using AST analysis.
+ * Walks call expressions to find logger calls, then inspects arguments
+ * for PII field names in object literals.
+ *
+ * @see Logging Standards
+ */
+export const piiExposureInLogs = defineCheck({
+    id: 'afe54c52-c75d-4078-a81d-94bf80281e13',
+    slug: 'pii-exposure-in-logs',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    confidence: 'high',
+    description: 'Detects potential PII exposure in log statements',
+    longDescription: `**Purpose:** Detects potential PII (Personally Identifiable Information) exposure in log statements using TypeScript AST analysis, ensuring sensitive data is never logged in plaintext.
+
+**Detects:**
+- PII field names (\`email\`, \`phone\`, \`ssn\`, \`creditcard\`, \`cvv\`, \`passport\`, \`driverLicense\`, \`bankAccount\`, \`routingNumber\`, \`password\`, \`apikey\`, \`accesstoken\`, \`address\`, \`dob\`, and variants) used as property keys in object literals passed to logger calls
+- Logger calls on objects named \`logger\`, \`L\`, or \`log\` with methods \`trace\`, \`debug\`, \`info\`, \`warn\`, \`error\`, \`fatal\`
+- Nested object literals containing PII fields within log arguments
+- Exempts fields wrapped in safe sanitization calls: \`hashPii\`, \`hash\`, \`redact\`, \`mask\`, \`sanitize\`, \`encrypt\`
+
+**Why it matters:** Logging PII in plaintext violates data protection regulations and creates security/compliance risks if logs are accessed by unauthorized parties.
+
+**Scope:** General best practice (logging standards). Analyzes each file individually using TypeScript AST walking.`,
+    tags: ['security', 'compliance', 'quality'],
+    fileTypes: ['ts'],
+    // @fitness-ignore-next-line no-hardcoded-timeouts -- framework default for fitness check execution
+    timeout: 180_000, // 3 minutes - scans all log statements
+    analyze(content, filePath) {
+        // Quick filter: skip files without logger patterns
+        if (!content.includes('logger.') && !content.includes('L.') && !content.includes('log.')) {
+            return [];
+        }
+        const sourceFile = parseSource(content, filePath);
+        /* v8 ignore next -- defensive guard */
+        if (!sourceFile)
+            return [];
+        const violations = [];
+        walkNodes(sourceFile, (node) => {
+            if (!ts.isCallExpression(node))
+                return;
+            if (!isLoggerCall(node))
+                return;
+            // Inspect each argument for PII fields
+            for (const arg of node.arguments) {
+                if (ts.isObjectLiteralExpression(arg)) {
+                    const piiField = findPiiFieldInObject(arg);
+                    if (piiField && !piiField.safe) {
+                        violations.push({
+                            line: getLineNumber(node, sourceFile),
+                            column: 0,
+                            message: `Potential PII field '${piiField.fieldName}' in log call (should be hashed/sanitized)`,
+                            severity: 'error',
+                            suggestion: `Use a centralized PII masking utility before logging: hash or redact sensitive fields, e.g. log { ${piiField.fieldName}: hashPii(${piiField.fieldName}) } or redact the field entirely`,
+                            match: node.getText().length > 200 ? node.getText().slice(0, 200) + '...' : node.getText(),
+                            filePath,
+                        });
+                        break; // one violation per log call is sufficient
+                    }
+                }
+            }
+        });
+        return violations;
+    },
+});
+//# sourceMappingURL=pii-exposure-in-logs.js.map

package/dist/checks/quality/observability/pii-exposure-in-logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-exposure-in-logs.js","sourceRoot":"","sources":["../../../../src/checks/quality/observability/pii-exposure-in-logs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,WAAW,EACX,SAAS,EACT,gBAAgB,EAChB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,uDAAuD;AACvD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,OAAO;IACP,cAAc;IACd,eAAe;IACf,OAAO;IACP,aAAa;IACb,cAAc;IACd,KAAK;IACL,gBAAgB;IAChB,iBAAiB;IACjB,sBAAsB;IACtB,wBAAwB;IACxB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,aAAa;IACb,KAAK;IACL,KAAK;IACL,UAAU;IACV,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,UAAU;IACV,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,YAAY;IACZ,aAAa;IACb,SAAS;IACT,eAAe;IACf,gBAAgB;IAChB,WAAW;IACX,YAAY;IACZ,aAAa;IACb,eAAe;IACf,KAAK;CACN,CAAC,CAAC;AAEH,mDAAmD;AACnD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvF,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAE5D,yEAAyE;AACzE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,SAAS;IACT,MAAM;IACN,QAAQ;IACR,MAAM;IACN,UAAU;IACV,SAAS;IACT,cAAc;IACd,aAAa;IACb,WAAW;CACZ,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAuB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAExD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,0CAA0C;IAC1C,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,gDAAgD;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,IAAmB;IAC9C,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/B,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;YACrC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAC1D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,GAA+B;IAE/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAAE,SAAS;QAE7C,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,CAAC;aAAM,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,CAAC;aAAM,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,SAAS,CAAC,2BAA2B;QACvC,CAAC;QAED,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,+BAA+B;QAC/B,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IAErE,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,kDAAkD;IAC/D,eAAe,EAAE;;;;;;;;;;oHAUiG;IAClH,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC;IAC3C,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,mGAAmG;IACnG,OAAO,EAAE,OAAO,EAAE,uCAAuC;IAEzD,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,uCAAuC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7B,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;gBAAE,OAAO;YACvC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEhC,uCAAuC;YACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,IAAI,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;oBAC3C,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;wBAC/B,UAAU,CAAC,IAAI,CAAC;4BACd,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC;4BACrC,MAAM,EAAE,CAAC;4BACT,OAAO,EAAE,wBAAwB,QAAQ,CAAC,SAAS,4CAA4C;4BAC/F,QAAQ,EAAE,OAAO;4BACjB,UAAU,EAAE,qGAAqG,QAAQ,CAAC,SAAS,aAAa,QAAQ,CAAC,SAAS,kCAAkC;4BACpM,KAAK,EACH,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE;4BACrF,QAAQ;yBACT,CAAC,CAAC;wBACH,MAAM,CAAC,2CAA2C;oBACpD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/quality/observability/pii-exposure-in-logs.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Field-coverage regression test for pii-exposure-in-logs.
+ *
+ * The check's PII_FIELD_NAMES set absorbed the field list from the retired
+ * regex-based `pii-logging` check (checks-universal) during dedup. These
+ * cases pin the ported categories so a future edit to the set can't silently
+ * drop them. Runs the check in-process via the engine's fixture-coverage
+ * helper rather than reaching into its private analyze().
+ */
+export {};
+//# sourceMappingURL=pii-exposure-in-logs.test.d.ts.map

package/dist/checks/quality/observability/pii-exposure-in-logs.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-exposure-in-logs.test.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/observability/pii-exposure-in-logs.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/checks/quality/observability/pii-exposure-in-logs.test.js

@@ -0,0 +1,46 @@
+/**
+ * Field-coverage regression test for pii-exposure-in-logs.
+ *
+ * The check's PII_FIELD_NAMES set absorbed the field list from the retired
+ * regex-based `pii-logging` check (checks-universal) during dedup. These
+ * cases pin the ported categories so a future edit to the set can't silently
+ * drop them. Runs the check in-process via the engine's fixture-coverage
+ * helper rather than reaching into its private analyze().
+ */
+import { runCheckOnFixture } from '@opensip-cli/test-support';
+import { describe, expect, it } from 'vitest';
+import { piiExposureInLogs } from './pii-exposure-in-logs.js';
+function logCall(body) {
+    return `import { logger } from './logger.js'\nexport function run(value: string): void {\n  logger.info({ ${body} })\n}\n`;
+}
+describe('pii-exposure-in-logs · ported field coverage', () => {
+    // Fields inherited from the retired `pii-logging` regex check.
+    const portedFields = [
+        'cvv',
+        'cvc',
+        'passport',
+        'driverLicense',
+        'driver_license',
+        'bankAccount',
+        'bank_account',
+        'routingNumber',
+        'routing_number',
+        'socialSecurity',
+        'social_security',
+    ];
+    for (const field of portedFields) {
+        it(`flags '${field}' in a logger call`, async () => {
+            const { findings } = await runCheckOnFixture(piiExposureInLogs, {
+                files: [{ path: 'handler.ts', content: logCall(`${field}: value`) }],
+            });
+            expect(findings).toHaveLength(1);
+        });
+    }
+    it('still exempts a ported field wrapped in a safe sanitizer', async () => {
+        const { findings } = await runCheckOnFixture(piiExposureInLogs, {
+            files: [{ path: 'handler.ts', content: logCall('passport: redact(value)') }],
+        });
+        expect(findings).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=pii-exposure-in-logs.test.js.map

package/dist/checks/quality/observability/pii-exposure-in-logs.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-exposure-in-logs.test.js","sourceRoot":"","sources":["../../../../src/checks/quality/observability/pii-exposure-in-logs.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,qGAAqG,IAAI,UAAU,CAAC;AAC7H,CAAC;AAED,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,+DAA+D;IAC/D,MAAM,YAAY,GAAG;QACnB,KAAK;QACL,KAAK;QACL,UAAU;QACV,eAAe;QACf,gBAAgB;QAChB,aAAa;QACb,cAAc;QACd,eAAe;QACf,gBAAgB;QAChB,gBAAgB;QAChB,iBAAiB;KAClB,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,EAAE,CAAC,UAAU,KAAK,oBAAoB,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;gBAC9D,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;YAC9D,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/quality/patterns/__tests__/toctou-fp.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @fileoverview Regression tests for the `toctou-race-condition` FP fix.
+ *
+ * The classifier treated a *chained* receiver (`state.lowlink.get(...)` then
+ * `state.lowlink.set(...)`) as an unknown — hence shared — receiver, so the
+ * "state bag of Maps" pattern common to iterative graph/DP algorithms (e.g.
+ * Tarjan SCC's `TarjanState`) was flagged as a TOCTOU even though it is
+ * single-threaded in-memory work. The fix recognizes `<obj>.<field>` where
+ * `<obj>` is a parameter/local typed as a file-local interface/type whose
+ * `<field>` is a `Map`/`Set`. These tests pin the FP and confirm genuine
+ * read-then-update on shared persistent state still fires.
+ */
+export {};
+//# sourceMappingURL=toctou-fp.test.d.ts.map

package/dist/checks/quality/patterns/__tests__/toctou-fp.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toctou-fp.test.d.ts","sourceRoot":"","sources":["../../../../../src/checks/quality/patterns/__tests__/toctou-fp.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/checks/quality/patterns/__tests__/toctou-fp.test.js

@@ -0,0 +1,61 @@
+/**
+ * @fileoverview Regression tests for the `toctou-race-condition` FP fix.
+ *
+ * The classifier treated a *chained* receiver (`state.lowlink.get(...)` then
+ * `state.lowlink.set(...)`) as an unknown — hence shared — receiver, so the
+ * "state bag of Maps" pattern common to iterative graph/DP algorithms (e.g.
+ * Tarjan SCC's `TarjanState`) was flagged as a TOCTOU even though it is
+ * single-threaded in-memory work. The fix recognizes `<obj>.<field>` where
+ * `<obj>` is a parameter/local typed as a file-local interface/type whose
+ * `<field>` is a `Map`/`Set`. These tests pin the FP and confirm genuine
+ * read-then-update on shared persistent state still fires.
+ */
+import { describe, expect, it } from 'vitest';
+import { analyzeFileForToctou } from '../toctou-race-condition.js';
+function analyze(src) {
+    // src/svc/* avoids the cache/cli/config/etc. safe-path skips.
+    return analyzeFileForToctou('src/svc/sample.ts', src);
+}
+describe('toctou-race-condition — state-bag-of-Maps FP regression', () => {
+    it('does NOT flag read-then-update on a state object whose interface fields are Maps', () => {
+        const src = `
+      interface TarjanState {
+        readonly index: Map<string, number>;
+        readonly lowlink: Map<string, number>;
+        readonly onStack: Set<string>;
+      }
+      function step(state: TarjanState, v: string): void {
+        const iv = state.lowlink.get(v);
+        state.index.get(v);
+        if (iv !== undefined) state.lowlink.set(v, iv);
+        state.onStack.has(v);
+      }
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('recognizes the same pattern for a locally-declared state variable', () => {
+        const src = `
+      type Acc = { counts: Map<string, number> };
+      function tally(keys: string[]): Acc {
+        const acc: Acc = { counts: new Map() };
+        for (const k of keys) {
+          const cur = acc.counts.get(k) ?? 0;
+          acc.counts.set(k, cur + 1);
+        }
+        return acc;
+      }
+    `;
+        expect(analyze(src)).toHaveLength(0);
+    });
+    it('STILL flags genuine read-then-update on a shared persistent receiver', () => {
+        const src = `
+      async function updateUser(userRepo: UserRepository, id: string): Promise<void> {
+        const user = await userRepo.findOne(id);
+        user.lastSeen = Date.now();
+        await userRepo.save(user);
+      }
+    `;
+        expect(analyze(src).length).toBeGreaterThan(0);
+    });
+});
+//# sourceMappingURL=toctou-fp.test.js.map

package/dist/checks/quality/patterns/__tests__/toctou-fp.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toctou-fp.test.js","sourceRoot":"","sources":["../../../../../src/checks/quality/patterns/__tests__/toctou-fp.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,SAAS,OAAO,CAAC,GAAW;IAC1B,8DAA8D;IAC9D,OAAO,oBAAoB,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,GAAG,GAAG;;;;;;;;;;;;KAYX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG;;;;;;;;;;KAUX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,GAAG,GAAG;;;;;;KAMX,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/quality/patterns/async-waterfall-detection.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @fileoverview Async Waterfall Detection Check
+ *
+ * Detects sequential await statements that could potentially be parallelized
+ * with Promise.all(). Uses AST-aware heuristics:
+ * - Looks for consecutive lines with await expressions
+ * - Flags when the second await doesn't reference the variable from the first
+ * - Skips awaits in different conditional branches (if/else, ternary, switch)
+ * - Recognizes dynamic import destructuring dependencies
+ * - Skips mutex/lock acquire-then-execute patterns
+ * - Skips sleep/delay in polling loops
+ */
+/**
+ * Check: quality/async-waterfall-detection
+ *
+ * Detects sequential await statements that could potentially be parallelized.
+ * Uses AST-aware heuristics including:
+ * - Consecutive await detection within a configurable line gap
+ * - Variable dependency tracking (simple names and destructured bindings)
+ * - Conditional branch awareness (if/else, ternary, switch/case)
+ * - Dynamic import recognition
+ * - Mutex/lock acquire pattern exclusion
+ * - Sleep/delay pattern exclusion
+ */
+export declare const asyncWaterfallDetection: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=async-waterfall-detection.d.ts.map

package/dist/checks/quality/patterns/async-waterfall-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-waterfall-detection.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/async-waterfall-detection.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAybH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,sCAsClC,CAAC"}