@opensip-cli/checks-typescript 0.1.0

package/dist/checks/quality/patterns/toctou-race-condition.js

@@ -0,0 +1,639 @@
+// @fitness-ignore-file file-length-limit -- cohesive single-check module; splitting risks breaking the detector contract
+/**
+ * @fileoverview TOCTOU Race Condition Detection Check
+ *
+ * Detects Time-of-Check-Time-of-Use race conditions where data is read,
+ * then updated without passing version/condition for atomic updates.
+ *
+ * Refinement notes (Wave E lane E6-redo):
+ * The original implementation was a regex-only test for the presence of
+ * `.get/.find/...` and `.update/.set/...` strings inside the same function
+ * body. That broad pattern produced false positives on:
+ *   - Local `Map.get` / `Map.set` accumulator idioms (count++ via map).
+ *   - In-process cache fields (`this.#cache.get` then `this.#cache.set`)
+ *     used as single-threaded coalescing structures.
+ *   - Read-only DB functions that build local Maps for grouping
+ *     (`db.select(...)` → `new Map().set(...)`).
+ *   - Single-statement atomic SQL writes (`tx.execute(sql`UPDATE...`)`).
+ *
+ * Refinement strategy: classify each `.get/.set/.update/...` call by its
+ * receiver. A function only flags as TOCTOU if there is at least one
+ * read+update pair on a *non-local* receiver (i.e. not a local Map/Set,
+ * not a "Cache"-named field, and not a tx/db where writes are atomic
+ * SQL). All-local-receiver patterns are excluded.
+ */
+import { defineCheck, getCheckConfig, isTestFile } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/** Patterns that indicate proper atomic update handling */
+const ATOMIC_PATTERNS = [
+    /expectedVersion/i,
+    /version\s*:/,
+    /ConditionExpression/,
+    /conditionalUpdate/i,
+    /atomicUpdate/i,
+    /compareAndSwap/i,
+    /optimisticLock/i,
+    /CONCURRENCY SAFE/,
+    // Transaction patterns
+    /transaction/i,
+    /beginTransaction/i,
+    /withTransaction/i,
+    /runInTransaction/i,
+    // Lock patterns
+    /acquireLock/i,
+    /withLock/i,
+    /mutex/i,
+    // Idempotency patterns
+    /idempotent/i,
+    /idempotencyKey/i,
+    // Single-threaded/in-memory safety comments
+    /single-threaded/i,
+    /in-memory/i,
+    /atomic in.*Node/i,
+    // Documented coalescing/event-loop safety patterns commonly used in Node single-threaded code
+    /single-threaded coalesce/i, // explicit coalescing-cache documentation
+    /Node single-threaded/i, // explicit Node single-threaded documentation
+    /event-loop semantics/i, // explicit event-loop atomicity documentation
+];
+/**
+ * Paths where TOCTOU is typically not a concern
+ * (in-memory caches, rate limiters, local state managers)
+ */
+const SAFE_TOCTOU_PATHS = [
+    // In-memory data structures
+    /\/cache\//i,
+    /\/caching\//i,
+    /memory-backend/i,
+    /memory-cache/i,
+    /memory-store/i,
+    /in-memory/i,
+    // Filename conventions — `*-cache.ts` and `*-prefetcher.ts` are
+    // single-threaded coalescing structures by convention (Node event-loop
+    // semantics make the .get-then-.set pattern safe). The path-segment
+    // /cache/ skip above misses files at top of a package's src/ tree.
+    /-cache\.tsx?$/i,
+    /-prefetcher\.tsx?$/i,
+    // Rate limiting (bounded operations)
+    /rate-limit/i,
+    /rate_limit/i,
+    // Local state management
+    /local-storage/i,
+    /local-state/i,
+    /state-manager/i,
+    // CLI/scripts (single user, non-concurrent)
+    // CLI commands use local Map/Set operations that are not shared-state TOCTOU risks.
+    // Server lifecycle TOCTOU issues are better caught by the reentrancy-guard check.
+    /\/cli\//,
+    /\/scripts\//,
+    // Test utilities
+    /\/testing\//,
+    /test-utils/,
+    // Configuration/Registry (startup-time operations)
+    /\/config\//,
+    /\/registry\//,
+    /\/di-registration\//,
+    /\/factories\//,
+    // Route handlers — request-scoped Map/Set ops are not shared-state TOCTOU; route handlers are dominated by Zod.pick/parse and per-request local maps that the regex misreads as TOCTOU.
+    /\/routes\//,
+    // DI composition — fragment graphs construct a per-startup map of providers; not concurrent shared state.
+    /\/di\//,
+    // Schema declarations — Drizzle/Zod schema files are pure declarative builders, no runtime read/update race surface.
+    /\/schema\//,
+    // NOTE: opensip-specific paths (e.g. `/chain-walker/` for audit-chain
+    // walkers) are NOT defaults. They live in opensip's recipe under
+    // `checks.config['toctou-race-condition'].additionalSafeTOCTOUPaths`.
+];
+/**
+ * Compile recipe-provided string entries to case-insensitive RegExp values.
+ */
+function buildEffectiveSafePaths() {
+    const cfg = getCheckConfig('toctou-race-condition');
+    const extras = (cfg.additionalSafeTOCTOUPaths ?? []).map((src) => new RegExp(src, 'i'));
+    return [...SAFE_TOCTOU_PATHS, ...extras];
+}
+/**
+ * Check if a file path is in a safe TOCTOU context. Combines built-in
+ * defaults with the recipe-config augmentation.
+ */
+function isSafeToctouPath(filePath, safePaths) {
+    return safePaths.some((pattern) => pattern.test(filePath));
+}
+/** Read operation method names */
+const READ_METHODS = new Set([
+    'get',
+    'find',
+    'findOne',
+    'findFirst',
+    'findMany',
+    'getById',
+    'fetch',
+    'load',
+    'read',
+]);
+/** Update operation method names */
+const UPDATE_METHODS = new Set(['update', 'save', 'put', 'set', 'patch', 'modify']);
+/**
+ * Check if content has atomic patterns
+ */
+function hasAtomicPatterns(content) {
+    return ATOMIC_PATTERNS.some((p) => p.test(content));
+}
+/**
+ * Get function name from a function-like node
+ */
+function getFunctionNameFromNode(node, sourceFile) {
+    if (ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)) {
+        return node.name?.getText(sourceFile) ?? 'anonymous';
+    }
+    if (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) {
+        const parent = node.parent;
+        if (ts.isVariableDeclaration(parent) && ts.isIdentifier(parent.name)) {
+            return parent.name.getText(sourceFile);
+        }
+    }
+    return 'anonymous';
+}
+/**
+ * Check if node is a function-like node
+ */
+function isFunctionLikeNode(node) {
+    return (ts.isFunctionDeclaration(node) ||
+        ts.isMethodDeclaration(node) ||
+        ts.isArrowFunction(node) ||
+        ts.isFunctionExpression(node));
+}
+/**
+ * Identify TypeNodes that name an in-memory keyed collection — these are
+ * not shared persistent state and read+set on them is not a TOCTOU risk.
+ */
+const IN_MEMORY_COLLECTION_TYPE_NAMES = new Set([
+    'Map',
+    'WeakMap',
+    'ReadonlyMap',
+    'Set',
+    'WeakSet',
+    'ReadonlySet',
+]);
+function isInMemoryCollectionTypeNode(typeNode) {
+    if (!typeNode)
+        return false;
+    if (ts.isTypeReferenceNode(typeNode)) {
+        const name = typeNode.typeName;
+        if (ts.isIdentifier(name)) {
+            if (IN_MEMORY_COLLECTION_TYPE_NAMES.has(name.text))
+                return true;
+            // Type names ending in `Cache` (e.g. `SecretsCache`) are an
+            // OpenSIP-wide convention for in-process keyed coalescing
+            // structures. Treating them as local-collection eliminates the
+            // FP class where a service-level `cache: XCache` parameter is
+            // read+written within a function body.
+            if (name.text.endsWith('Cache'))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Identify variable initializers that construct an in-memory collection,
+ * e.g. `const counts = new Map()`, `new Set<string>()`.
+ */
+function isInMemoryCollectionInitializer(init) {
+    if (!init)
+        return false;
+    if (ts.isNewExpression(init) && ts.isIdentifier(init.expression)) {
+        return IN_MEMORY_COLLECTION_TYPE_NAMES.has(init.expression.text);
+    }
+    return false;
+}
+/**
+ * Heuristic: a property access like `this.#cache`, `this.headerCache`,
+ * `this._cache` is treated as an in-process cache field. The `*Cache`
+ * suffix and `_cache` / `#cache` conventions are strong signals that the
+ * field is a coalescing in-memory structure (single-threaded Node).
+ *
+ * This is intentionally narrow: only matches `this.<name>` shapes whose
+ * `<name>` has the `Cache` suffix or is exactly `cache`.
+ */
+function isInMemoryCacheReceiverText(text) {
+    // strip a leading `#` (private field) and `_` (convention)
+    const normalized = text.replace(/^[#_]/, '');
+    if (normalized === 'cache')
+        return true;
+    if (normalized.endsWith('Cache'))
+        return true;
+    return false;
+}
+/**
+ * Collect names of local variables/parameters within a function that
+ * refer to in-memory keyed collections (`Map`, `Set`, etc.). Names are
+ * matched against the simple receiver of `<name>.get/set/...` calls.
+ */
+function collectLocalCollectionNames(node) {
+    const names = new Set();
+    // Parameters typed as Map/Set
+    for (const param of node.parameters) {
+        if (ts.isIdentifier(param.name) && isInMemoryCollectionTypeNode(param.type)) {
+            names.add(param.name.text);
+        }
+    }
+    // Local `const x = new Map()` / `new Set()` declarations anywhere in body.
+    const visit = (n) => {
+        // Don't descend into nested functions — their locals belong to a
+        // different scope.
+        if (n !== node && isFunctionLikeNode(n))
+            return;
+        if (ts.isVariableDeclaration(n) &&
+            ts.isIdentifier(n.name) &&
+            (isInMemoryCollectionInitializer(n.initializer) || isInMemoryCollectionTypeNode(n.type))) {
+            names.add(n.name.text);
+        }
+        ts.forEachChild(n, visit);
+    };
+    if (node.body)
+        visit(node.body);
+    return names;
+}
+/**
+ * Collect class-level field names that are initialized to an in-memory
+ * collection (`new Map()` / `new Set()`). Used so that `this.#cache`-style
+ * access in a method does not look like shared persistent state.
+ *
+ * Walks up to the containing ClassDeclaration / ClassExpression. Returns
+ * the simple field name (no `#` prefix) for matching against
+ * `this.<name>.get/set` receivers.
+ */
+// eslint-disable-next-line sonarjs/cognitive-complexity -- AST walk over class members: nested type checks reflect the TypeScript AST shape
+function collectClassInMemoryFieldNames(node) {
+    const names = new Set();
+    let cls = node.parent;
+    while (cls && !ts.isClassDeclaration(cls) && !ts.isClassExpression(cls)) {
+        cls = cls.parent;
+    }
+    if (!cls)
+        return names;
+    const classNode = cls;
+    for (const member of classNode.members) {
+        if (ts.isPropertyDeclaration(member)) {
+            const memberName = member.name;
+            let fieldName;
+            if (ts.isIdentifier(memberName)) {
+                fieldName = memberName.text;
+            }
+            else if (ts.isPrivateIdentifier(memberName)) {
+                fieldName = memberName.text.replace(/^#/, '');
+            }
+            if (!fieldName)
+                continue;
+            if (isInMemoryCollectionInitializer(member.initializer) ||
+                isInMemoryCollectionTypeNode(member.type)) {
+                names.add(fieldName);
+            }
+        }
+    }
+    return names;
+}
+/**
+ * Index file-local `interface` / `type` declarations to the set of field
+ * names whose declared type is an in-memory keyed collection (`Map`/`Set`/…).
+ *
+ * Used to treat `<stateObj>.<mapField>.get/set(...)` as a *local-collection*
+ * access. The "state bag of Maps" pattern — an interface bundling several
+ * `Map`/`Set` fields, threaded as a parameter through the steps of an
+ * iterative graph / DP algorithm (e.g. Tarjan SCC's `TarjanState`) — is
+ * single-threaded in-memory work, not a shared-state read-then-update race.
+ * The receiver `state.lowlink` is a *chained* access that the simple-receiver
+ * classifier would otherwise treat conservatively as shared.
+ */
+function collectInterfaceCollectionFields(sourceFile) {
+    const byType = new Map();
+    const fieldsFrom = (members) => {
+        const fields = new Set();
+        for (const member of members) {
+            if (ts.isPropertySignature(member) &&
+                ts.isIdentifier(member.name) &&
+                isInMemoryCollectionTypeNode(member.type)) {
+                fields.add(member.name.text);
+            }
+        }
+        return fields;
+    };
+    for (const stmt of sourceFile.statements) {
+        if (ts.isInterfaceDeclaration(stmt)) {
+            const fields = fieldsFrom(stmt.members);
+            if (fields.size > 0)
+                byType.set(stmt.name.text, fields);
+        }
+        else if (ts.isTypeAliasDeclaration(stmt) && ts.isTypeLiteralNode(stmt.type)) {
+            const fields = fieldsFrom(stmt.type.members);
+            if (fields.size > 0)
+                byType.set(stmt.name.text, fields);
+        }
+    }
+    return byType;
+}
+/**
+ * Collect `<receiver>.<field>` keys for parameters/locals whose declared type
+ * is a file-local interface/type that declares `Map`/`Set` fields. Those
+ * `<obj>.<field>` accesses behave like local collections (see
+ * {@link collectInterfaceCollectionFields}).
+ */
+function collectLocalObjectCollectionFieldKeys(node, interfaceCollectionFields) {
+    const keys = new Set();
+    const addFor = (name, typeNode) => {
+        if (!typeNode || !ts.isTypeReferenceNode(typeNode))
+            return;
+        if (!ts.isIdentifier(typeNode.typeName))
+            return;
+        const fields = interfaceCollectionFields.get(typeNode.typeName.text);
+        if (!fields)
+            return;
+        for (const field of fields)
+            keys.add(`${name}.${field}`);
+    };
+    for (const param of node.parameters) {
+        if (ts.isIdentifier(param.name))
+            addFor(param.name.text, param.type);
+    }
+    const visit = (n) => {
+        if (n !== node && isFunctionLikeNode(n))
+            return;
+        if (ts.isVariableDeclaration(n) && ts.isIdentifier(n.name))
+            addFor(n.name.text, n.type);
+        ts.forEachChild(n, visit);
+    };
+    if (node.body)
+        visit(node.body);
+    return keys;
+}
+/** Call-site classification kinds — narrow string literal alias set. */
+const KIND_READ_SHARED = 'read-shared';
+const KIND_UPDATE_SHARED = 'update-shared';
+const KIND_READ_LOCAL = 'read-local';
+const KIND_UPDATE_LOCAL = 'update-local';
+/**
+ * Return true if a call expression is `<tx-or-db>.execute(sql\`...\`)`
+ * with a single SQL statement — those writes are atomic at the DB layer
+ * (single statement, no separate read-then-update window).
+ */
+function isAtomicSqlExecute(call) {
+    if (!ts.isPropertyAccessExpression(call.expression))
+        return false;
+    if (call.expression.name.text !== 'execute')
+        return false;
+    const arg = call.arguments[0];
+    if (!arg)
+        return false;
+    if (ts.isTaggedTemplateExpression(arg) && // `sql\`...\``
+        ts.isIdentifier(arg.tag) &&
+        arg.tag.text === 'sql')
+        return true;
+    return false;
+}
+/**
+ * Drizzle-style ORM writes. `db.update(table)`, `db.insert(table)`,
+ * `db.delete(table)` each produce a single atomic SQL statement when
+ * awaited — they are not separate-read-then-update sequences.
+ *
+ * We treat these as `atomic-sql-write` so the function is not flagged
+ * unless there is an *actual* read-then-update on a shared receiver
+ * elsewhere.
+ */
+const DRIZZLE_ATOMIC_WRITE_METHODS = new Set(['update', 'insert', 'delete']);
+function isDrizzleAtomicWrite(call) {
+    if (!ts.isPropertyAccessExpression(call.expression))
+        return false;
+    const methodName = call.expression.name.text;
+    if (!DRIZZLE_ATOMIC_WRITE_METHODS.has(methodName))
+        return false;
+    // Heuristic: receiver looks like a db/tx (named `db`, `tx`, ends in `Db`/`Tx`).
+    const receiver = call.expression.expression;
+    if (ts.isIdentifier(receiver)) {
+        const r = receiver.text;
+        if (r === 'db' || r === 'tx' || /Db$|Tx$/.test(r))
+            return true;
+    }
+    return false;
+}
+/**
+ * Get the simple receiver name from a call expression like
+ * `<receiver>.method(...)`. For `this.<name>.method(...)` returns
+ * `this.<name>` collapsed; for `<id>.method(...)` returns `<id>`.
+ * Returns null if the receiver isn't a simple identifier or this-property.
+ */
+function getReceiverName(call) {
+    if (!ts.isPropertyAccessExpression(call.expression))
+        return null;
+    const receiver = call.expression.expression;
+    if (ts.isIdentifier(receiver)) {
+        return { name: receiver.text, isThisField: false };
+    }
+    if (ts.isPropertyAccessExpression(receiver) &&
+        receiver.expression.kind === ts.SyntaxKind.ThisKeyword) {
+        return { name: receiver.name.text, isThisField: true };
+    }
+    // `<id>.<field>.method()` — a dotted receiver key (e.g. `state.lowlink`).
+    // Keying per `<id>.<field>` is strictly more precise than the old
+    // "deep chain → unknown receiver" fallback: a read on `x.a` and an update
+    // on `x.b` no longer collide, and it lets the classifier match a
+    // state-object's Map/Set field against the local-collection key set.
+    if (ts.isPropertyAccessExpression(receiver) && ts.isIdentifier(receiver.expression)) {
+        return { name: `${receiver.expression.text}.${receiver.name.text}`, isThisField: false };
+    }
+    return null;
+}
+/**
+ * Classify a single call expression for TOCTOU purposes.
+ */
+function classifyCall(call, ctx) {
+    // First, atomic SQL writes anywhere short-circuit.
+    if (isAtomicSqlExecute(call))
+        return { kind: 'atomic-sql-write' };
+    if (isDrizzleAtomicWrite(call))
+        return { kind: 'atomic-sql-write' };
+    if (!ts.isPropertyAccessExpression(call.expression))
+        return { kind: 'unrelated' };
+    const methodName = call.expression.name.text;
+    const isRead = READ_METHODS.has(methodName);
+    const isUpdate = UPDATE_METHODS.has(methodName);
+    if (!isRead && !isUpdate)
+        return { kind: 'unrelated' };
+    const receiver = getReceiverName(call);
+    if (!receiver) {
+        // chained / non-simple receiver — treat as shared
+        return { kind: isRead ? KIND_READ_SHARED : KIND_UPDATE_SHARED };
+    }
+    if (isLocalReceiver(receiver, ctx)) {
+        return { kind: isRead ? KIND_READ_LOCAL : KIND_UPDATE_LOCAL };
+    }
+    return { kind: isRead ? KIND_READ_SHARED : KIND_UPDATE_SHARED };
+}
+/**
+ * Decide whether a classified receiver refers to a local in-memory collection
+ * (so reads/updates on it are not shared-state TOCTOU). Covers: local
+ * `Map`/`Set` names, the `<stateObj>.<mapField>` "state bag" key, `this.<cache>`
+ * class fields, and the `cache`-named convention.
+ */
+function isLocalReceiver(receiver, ctx) {
+    if (receiver.isThisField) {
+        return ctx.classCacheFields.has(receiver.name) || isInMemoryCacheReceiverText(receiver.name);
+    }
+    return (ctx.localCollections.has(receiver.name) ||
+        // `<stateObj>.<mapField>` dotted key resolved to a file-local interface/
+        // type whose field is a Map/Set — the "state bag" pattern.
+        ctx.localObjectCollectionKeys.has(receiver.name) ||
+        // bare `cache` / `<X>Cache` naming convention.
+        isInMemoryCacheReceiverText(receiver.name));
+}
+/**
+ * Walk a function body and classify every call expression.
+ *
+ * Tracks reads and updates *per receiver* — TOCTOU is fundamentally
+ * read-X-then-update-X on the same shared object. A function with a
+ * read on receiver A and an update on receiver B is not a TOCTOU.
+ */
+/* eslint-disable sonarjs/cognitive-complexity -- TOCTOU classifier and its inner AST visitor: branches reflect AST node taxonomy; flatter shape would hide the read/update pairing logic */
+function classifyFunctionCalls(node, localCollections, classCacheFields, localObjectCollectionKeys) {
+    const ctx = { localCollections, classCacheFields, localObjectCollectionKeys };
+    // receiver-key → { read, update }. Receiver-key is `<name>` for plain
+    // identifiers and `this.<name>` for this-field accesses.
+    const perReceiver = new Map();
+    let hasReadOnUnknownReceiver = false;
+    let hasUpdateOnUnknownReceiver = false;
+    const visit = (n) => {
+        if (n !== node && isFunctionLikeNode(n))
+            return;
+        if (ts.isCallExpression(n)) {
+            const cls = classifyCall(n, ctx);
+            if (cls.kind === 'read-shared' || cls.kind === 'update-shared') {
+                const recv = getReceiverName(n);
+                if (recv) {
+                    const key = recv.isThisField ? `this.${recv.name}` : recv.name;
+                    let entry = perReceiver.get(key);
+                    if (!entry) {
+                        entry = { read: false, update: false };
+                        perReceiver.set(key, entry);
+                    }
+                    if (cls.kind === 'read-shared')
+                        entry.read = true;
+                    else
+                        entry.update = true;
+                }
+                else {
+                    if (cls.kind === 'read-shared')
+                        hasReadOnUnknownReceiver = true;
+                    else
+                        hasUpdateOnUnknownReceiver = true;
+                }
+            }
+        }
+        ts.forEachChild(n, visit);
+    };
+    if (node.body)
+        visit(node.body);
+    for (const entry of perReceiver.values()) {
+        if (entry.read && entry.update) {
+            return { hasSharedReadAndUpdateOnSameReceiver: true };
+        }
+    }
+    // Conservative fallback: if we have unknown-receiver reads paired with
+    // unknown-receiver updates, treat as shared (chained / dynamic call).
+    if (hasReadOnUnknownReceiver && hasUpdateOnUnknownReceiver) {
+        return { hasSharedReadAndUpdateOnSameReceiver: true };
+    }
+    return { hasSharedReadAndUpdateOnSameReceiver: false };
+}
+/**
+ * Check a function for TOCTOU patterns
+ */
+function checkFunctionForToctou(options) {
+    const { node, sourceFile, interfaceCollectionFields } = options;
+    if (!node.body)
+        return null;
+    // Atomic-comment escape hatch retained from the regex implementation —
+    // a function (or its surrounding scope) that documents single-threaded
+    // / coalescing semantics is treated as safe.
+    const funcText = node.getText(sourceFile);
+    if (hasAtomicPatterns(funcText))
+        return null;
+    const localCollections = collectLocalCollectionNames(node);
+    const classCacheFields = collectClassInMemoryFieldNames(node);
+    const localObjectCollectionKeys = collectLocalObjectCollectionFieldKeys(node, interfaceCollectionFields);
+    const { hasSharedReadAndUpdateOnSameReceiver } = classifyFunctionCalls(node, localCollections, classCacheFields, localObjectCollectionKeys);
+    if (!hasSharedReadAndUpdateOnSameReceiver)
+        return null;
+    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    const lineNum = line + 1;
+    const funcName = getFunctionNameFromNode(node, sourceFile);
+    return {
+        line: lineNum,
+        column: character + 1,
+        message: `Function '${funcName}' has read-then-update pattern without atomic guarantees`,
+        severity: 'warning',
+        suggestion: 'Use optimistic locking: pass expectedVersion to update, or use ConditionExpression for DynamoDB, or wrap in a transaction with SELECT FOR UPDATE for SQL',
+        match: funcName,
+    };
+}
+/**
+ * Analyze a file for TOCTOU race conditions. Exported for the FP-regression
+ * suite (see `__tests__/toctou-fp.test.ts`).
+ */
+export function analyzeFileForToctou(filePath, content) {
+    const violations = [];
+    // Skip files in safe TOCTOU paths (caches, rate limiters, CLI, etc.).
+    // Merge built-in defaults with recipe config once per file.
+    const safePaths = buildEffectiveSafePaths();
+    if (isSafeToctouPath(filePath, safePaths)) {
+        return violations;
+    }
+    // Skip if the whole file documents atomic / single-threaded semantics.
+    if (hasAtomicPatterns(content)) {
+        return violations;
+    }
+    const sourceFile = getSharedSourceFile(filePath, content);
+    if (!sourceFile)
+        return [];
+    const interfaceCollectionFields = collectInterfaceCollectionFields(sourceFile);
+    const visit = (node) => {
+        if (isFunctionLikeNode(node)) {
+            const violation = checkFunctionForToctou({ node, sourceFile, interfaceCollectionFields });
+            if (violation) {
+                violations.push(violation);
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return violations;
+}
+/**
+ * Check: quality/toctou-race-condition
+ *
+ * Detects read-then-update patterns without atomic guarantees.
+ */
+export const toctouRaceCondition = defineCheck({
+    id: 'eb67d6f3-c984-485d-b077-1ebabea0d894',
+    slug: 'toctou-race-condition',
+    scope: { languages: ['typescript'], concerns: ['backend', 'server'] },
+    contentFilter: 'strip-strings',
+    confidence: 'high',
+    description: 'Detects read-then-update patterns without atomic guarantees',
+    longDescription: `**Purpose:** Detects Time-of-Check-Time-of-Use (TOCTOU) race conditions where data is read then updated without atomic guarantees.
+
+**Detects:** Walks the TypeScript AST per-function. Flags a function only when both (a) at least one read call (\`.get(\`, \`.find(\`, \`.findOne(\`, \`.findFirst(\`, \`.findMany(\`, \`.getById(\`, \`.fetch(\`, \`.load(\`, \`.read(\`) and (b) at least one update call (\`.update(\`, \`.save(\`, \`.put(\`, \`.set(\`, \`.patch(\`, \`.modify(\`) target a *shared* receiver — i.e. neither a local \`Map\`/\`Set\` declared in the function nor a parameter typed \`Map<...>\`/\`Set<...>\`, nor a class field initialized to \`new Map()\`/\`new Set()\`, nor a cache-named field (\`this.cache\`, \`this.#cache\`, \`this.<X>Cache\`). Single-statement atomic SQL writes (\`tx.execute(sql\`UPDATE...\`)\`, \`tx.update(table)\`, \`tx.insert(table)\`, \`tx.delete(table)\`) are not counted as the "update" side. Skips safe contexts: in-memory caches, rate limiters, CLI/scripts, config/registry files, and functions whose body documents atomic / single-threaded semantics (\`single-threaded coalesce\`, \`Node single-threaded\`, \`event-loop semantics\`).
+
+**Why it matters:** TOCTOU bugs allow concurrent requests to overwrite each other's changes, causing silent data loss that only manifests under load.
+
+**Scope:** General best practice`,
+    tags: ['quality', 'performance', 'best-practices'],
+    fileTypes: ['ts'],
+    // @fitness-ignore-next-line no-hardcoded-timeouts -- framework default for fitness check execution
+    timeout: 180_000, // 3 minutes - analyzes read-then-update patterns
+    analyze(content, filePath) {
+        // Skip test files — TOCTOU patterns in tests are low-risk
+        if (isTestFile(filePath))
+            return [];
+        return analyzeFileForToctou(filePath, content);
+    },
+});
+//# sourceMappingURL=toctou-race-condition.js.map

package/dist/checks/quality/patterns/toctou-race-condition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toctou-race-condition.js","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/toctou-race-condition.ts"],"names":[],"mappings":"AAAA,yHAAyH;AACzH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAejC,2DAA2D;AAC3D,MAAM,eAAe,GAAG;IACtB,kBAAkB;IAClB,aAAa;IACb,qBAAqB;IACrB,oBAAoB;IACpB,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,uBAAuB;IACvB,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,WAAW;IACX,QAAQ;IACR,uBAAuB;IACvB,aAAa;IACb,iBAAiB;IACjB,4CAA4C;IAC5C,kBAAkB;IAClB,YAAY;IACZ,kBAAkB;IAClB,8FAA8F;IAC9F,2BAA2B,EAAE,0CAA0C;IACvE,uBAAuB,EAAE,8CAA8C;IACvE,uBAAuB,EAAE,8CAA8C;CACxE,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAAG;IACxB,4BAA4B;IAC5B,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,YAAY;IACZ,gEAAgE;IAChE,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,gBAAgB;IAChB,qBAAqB;IACrB,qCAAqC;IACrC,aAAa;IACb,aAAa;IACb,yBAAyB;IACzB,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,4CAA4C;IAC5C,oFAAoF;IACpF,kFAAkF;IAClF,SAAS;IACT,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,mDAAmD;IACnD,YAAY;IACZ,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,wLAAwL;IACxL,YAAY;IACZ,0GAA0G;IAC1G,QAAQ;IACR,qHAAqH;IACrH,YAAY;IACZ,sEAAsE;IACtE,iEAAiE;IACjE,sEAAsE;CACvE,CAAC;AAEF;;GAEG;AACH,SAAS,uBAAuB;IAC9B,MAAM,GAAG,GAAG,cAAc,CAAe,uBAAuB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,iBAAiB,EAAE,GAAG,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,SAA4B;IACtE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,kCAAkC;AAClC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,KAAK;IACL,MAAM;IACN,SAAS;IACT,WAAW;IACX,UAAU;IACV,SAAS;IACT,OAAO;IACP,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,oCAAoC;AACpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEpF;;GAEG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC;AAWD;;GAEG;AACH,SAAS,uBAAuB,CAAC,IAAsB,EAAE,UAAyB;IAChF,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC;IACvD,CAAC;IACD,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,IAAa;IACvC,OAAO,CACL,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC9B,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC5B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;QACxB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,KAAK;IACL,SAAS;IACT,aAAa;IACb,KAAK;IACL,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AAEH,SAAS,4BAA4B,CAAC,QAAiC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC/B,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChE,4DAA4D;YAC5D,0DAA0D;YAC1D,+DAA+D;YAC/D,8DAA8D;YAC9D,uCAAuC;YACvC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,+BAA+B,CAAC,IAA+B;IACtE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAAC,IAAY;IAC/C,2DAA2D;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,IAAsB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,8BAA8B;IAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,KAAK,GAAG,CAAC,CAAU,EAAQ,EAAE;QACjC,iEAAiE;QACjE,mBAAmB;QACnB,IAAI,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,OAAO;QAChD,IACE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC3B,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YACvB,CAAC,+BAA+B,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EACxF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,4IAA4I;AAC5I,SAAS,8BAA8B,CAAC,IAAsB;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,GAAG,GAAwB,IAAI,CAAC,MAAM,CAAC;IAC3C,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,CAAC;IACtB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;YAC/B,IAAI,SAA6B,CAAC;YAClC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC;YAC9B,CAAC;iBAAM,IAAI,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,IACE,+BAA+B,CAAC,MAAM,CAAC,WAAW,CAAC;gBACnD,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,EACzC,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,gCAAgC,CAAC,UAAyB;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,UAAU,GAAG,CAAC,OAAqC,EAAe,EAAE;QACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IACE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBAC9B,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC5B,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,EACzC,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,qCAAqC,CAC5C,IAAsB,EACtB,yBAA2D;IAE3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,QAAiC,EAAQ,EAAE;QACvE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC3D,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO;QAChD,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAQ,EAAE;QACjC,IAAI,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,OAAO;QAChD,IAAI,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACxF,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,aAAsB,CAAC;AAChD,MAAM,kBAAkB,GAAG,eAAwB,CAAC;AACpD,MAAM,eAAe,GAAG,YAAqB,CAAC;AAC9C,MAAM,iBAAiB,GAAG,cAAuB,CAAC;AAalD;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAuB;IACjD,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IACE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,eAAe;QACrD,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK;QAEtB,OAAO,IAAI,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE7E,SAAS,oBAAoB,CAAC,IAAuB;IACnD,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7C,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,gFAAgF;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAuB;IAC9C,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IACD,IACE,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC;QACvC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,EACtD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IACD,0EAA0E;IAC1E,kEAAkE;IAClE,0EAA0E;IAC1E,iEAAiE;IACjE,qEAAqE;IACrE,IAAI,EAAE,CAAC,0BAA0B,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,IAAuB,EACvB,GAIC;IAED,mDAAmD;IACnD,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAClE,IAAI,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAEpE,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAEvD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,kDAAkD;QAClD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAgD,EAChD,GAIC;IAED,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CACL,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvC,yEAAyE;QACzE,2DAA2D;QAC3D,GAAG,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChD,+CAA+C;QAC/C,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,4LAA4L;AAC5L,SAAS,qBAAqB,CAC5B,IAAsB,EACtB,gBAA6B,EAC7B,gBAA6B,EAC7B,yBAAsC;IAEtC,MAAM,GAAG,GAAG,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IAC9E,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC1E,IAAI,wBAAwB,GAAG,KAAK,CAAC;IACrC,IAAI,0BAA0B,GAAG,KAAK,CAAC;IAEvC,MAAM,KAAK,GAAG,CAAC,CAAU,EAAQ,EAAE;QACjC,IAAI,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,OAAO;QAChD,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC/D,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACjC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,KAAK,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;wBACvC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC9B,CAAC;oBACD,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;wBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;;wBAC7C,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;wBAAE,wBAAwB,GAAG,IAAI,CAAC;;wBAC3D,0BAA0B,GAAG,IAAI,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,wBAAwB,IAAI,0BAA0B,EAAE,CAAC;QAC3D,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,oCAAoC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC;AAaD;;GAEG;AACH,SAAS,sBAAsB,CAAC,OAAsC;IACpE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,yBAAyB,EAAE,GAAG,OAAO,CAAC;IAChE,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAE5B,uEAAuE;IACvE,uEAAuE;IACvE,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,yBAAyB,GAAG,qCAAqC,CACrE,IAAI,EACJ,yBAAyB,CAC1B,CAAC;IACF,MAAM,EAAE,oCAAoC,EAAE,GAAG,qBAAqB,CACpE,IAAI,EACJ,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,CAC1B,CAAC;IAEF,IAAI,CAAC,oCAAoC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAE3D,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,SAAS,GAAG,CAAC;QACrB,OAAO,EAAE,aAAa,QAAQ,0DAA0D;QACxF,QAAQ,EAAE,SAAS;QACnB,UAAU,EACR,0JAA0J;QAC5J,KAAK,EAAE,QAAQ;KAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IACpE,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,IAAI,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,uEAAuE;IACvE,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,MAAM,yBAAyB,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAE/E,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC1F,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,KAAK,CAAC,UAAU,CAAC,CAAC;IAClB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;IACrE,aAAa,EAAE,eAAe;IAE9B,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,6DAA6D;IAC1E,eAAe,EAAE;;;;;;iCAMc;IAC/B,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,CAAC;IAClD,SAAS,EAAE,CAAC,IAAI,CAAC;IACjB,mGAAmG;IACnG,OAAO,EAAE,OAAO,EAAE,iDAAiD;IAEnE,OAAO,CAAC,OAAO,EAAE,QAAQ;QACvB,0DAA0D;QAC1D,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,OAAO,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;CACF,CAAC,CAAC"}