@opensip-cli/checks-typescript 0.1.10 → 0.1.11

package/dist/checks/quality/patterns/toctou-race-condition-classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toctou-race-condition-classify.js","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/toctou-race-condition-classify.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,GAE5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,sCAAsC,CAAC;AAW9C,SAAS,kBAAkB,CAAC,IAAuB;IACjD,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK;QAC1F,OAAO,IAAI,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAuB;IACnD,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7C,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB;IAC9C,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,IAAI,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CACtB,QAAgD,EAChD,GAIC;IAED,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CACL,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvC,GAAG,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChD,2BAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,IAAuB,EACvB,GAIC;IAED,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAClE,IAAI,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAEpE,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAEvD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;AAClE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,qBAAqB,CACnC,IAAsB,EACtB,gBAA6B,EAC7B,gBAA6B,EAC7B,yBAAsC;IAEtC,MAAM,GAAG,GAAG,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IAC9E,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC1E,IAAI,wBAAwB,GAAG,KAAK,CAAC;IACrC,IAAI,0BAA0B,GAAG,KAAK,CAAC;IAEvC,MAAM,KAAK,GAAG,CAAC,CAAU,EAAQ,EAAE;QACjC,IAAI,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,OAAO;QAChD,IAAI,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC/D,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACjC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,KAAK,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;wBACvC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC9B,CAAC;oBACD,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;wBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;;wBAC7C,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;wBAAE,wBAAwB,GAAG,IAAI,CAAC;;wBAC3D,0BAA0B,GAAG,IAAI,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IACD,IAAI,wBAAwB,IAAI,0BAA0B,EAAE,CAAC;QAC3D,OAAO,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,oCAAoC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC;AACD,gDAAgD"}

package/dist/checks/quality/patterns/toctou-race-condition-collection.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Local-collection and interface-field collection helpers for TOCTOU detection.
+ */
+import * as ts from 'typescript';
+/** Function-like node types that can have TOCTOU patterns */
+export type FunctionLikeNode = ts.FunctionDeclaration | ts.MethodDeclaration | ts.ArrowFunction | ts.FunctionExpression;
+/** Check if node is a function-like node */
+export declare function isFunctionLikeNode(node: ts.Node): node is FunctionLikeNode;
+/** Heuristic for in-process cache fields (`this.#cache`, `this.headerCache`, etc.). */
+export declare function isInMemoryCacheReceiverText(text: string): boolean;
+/** Full dotted receiver chain for a property-access call target. */
+export declare function getReceiverChainText(expr: ts.Expression): string | null;
+/** `const { byId } = this` aliases for class-owned Map/Set fields. */
+export declare function collectThisCollectionFieldAliases(node: FunctionLikeNode, classCacheFields: ReadonlySet<string>): Set<string>;
+/** Map/Set names declared in enclosing functions (closure-visible locals). */
+export declare function collectEnclosingLocalCollectionNames(node: FunctionLikeNode): Set<string>;
+/** Collect local Map/Set variable names within a function. */
+export declare function collectLocalCollectionNames(node: FunctionLikeNode): Set<string>;
+export declare function collectClassInMemoryFieldNames(node: FunctionLikeNode): Set<string>;
+/** Index file-local interface/type declarations to Map/Set field names. */
+export declare function collectInterfaceCollectionFields(sourceFile: ts.SourceFile): Map<string, Set<string>>;
+/** Collect `<receiver>.<field>` keys for state-bag Map/Set fields. */
+export declare function collectLocalObjectCollectionFieldKeys(node: FunctionLikeNode, interfaceCollectionFields: ReadonlyMap<string, Set<string>>): Set<string>;
+//# sourceMappingURL=toctou-race-condition-collection.d.ts.map

package/dist/checks/quality/patterns/toctou-race-condition-collection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toctou-race-condition-collection.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/toctou-race-condition-collection.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GACxB,EAAE,CAAC,mBAAmB,GACtB,EAAE,CAAC,iBAAiB,GACpB,EAAE,CAAC,aAAa,GAChB,EAAE,CAAC,kBAAkB,CAAC;AAE1B,4CAA4C;AAC5C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,IAAI,gBAAgB,CAO1E;AA+BD,uFAAuF;AACvF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUjE;AAED,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,GAAG,MAAM,GAAG,IAAI,CAQvE;AA2CD,sEAAsE;AACtE,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,gBAAgB,EACtB,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GACpC,GAAG,CAAC,MAAM,CAAC,CAkBb;AAED,8EAA8E;AAC9E,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,CAkBxF;AAED,8DAA8D;AAC9D,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,CAsB/E;AAGD,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,CA2BlF;AAED,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,EAAE,CAAC,UAAU,GACxB,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAyB1B;AAED,sEAAsE;AACtE,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,gBAAgB,EACtB,yBAAyB,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GAC1D,GAAG,CAAC,MAAM,CAAC,CAmBb"}

package/dist/checks/quality/patterns/toctou-race-condition-collection.js

@@ -0,0 +1,248 @@
+/**
+ * Local-collection and interface-field collection helpers for TOCTOU detection.
+ */
+import * as ts from 'typescript';
+/** Check if node is a function-like node */
+export function isFunctionLikeNode(node) {
+    return (ts.isFunctionDeclaration(node) ||
+        ts.isMethodDeclaration(node) ||
+        ts.isArrowFunction(node) ||
+        ts.isFunctionExpression(node));
+}
+const IN_MEMORY_COLLECTION_TYPE_NAMES = new Set([
+    'Map',
+    'WeakMap',
+    'ReadonlyMap',
+    'Set',
+    'WeakSet',
+    'ReadonlySet',
+]);
+function isInMemoryCollectionTypeNode(typeNode) {
+    if (!typeNode)
+        return false;
+    if (ts.isTypeReferenceNode(typeNode)) {
+        const name = typeNode.typeName;
+        if (ts.isIdentifier(name)) {
+            if (IN_MEMORY_COLLECTION_TYPE_NAMES.has(name.text))
+                return true;
+            if (name.text.endsWith('Cache'))
+                return true;
+        }
+    }
+    return false;
+}
+function isInMemoryCollectionInitializer(init) {
+    if (!init)
+        return false;
+    if (ts.isNewExpression(init) && ts.isIdentifier(init.expression)) {
+        return IN_MEMORY_COLLECTION_TYPE_NAMES.has(init.expression.text);
+    }
+    return false;
+}
+/** Heuristic for in-process cache fields (`this.#cache`, `this.headerCache`, etc.). */
+export function isInMemoryCacheReceiverText(text) {
+    const normalized = text.replace(/^[#_]/, '');
+    if (normalized === 'cache')
+        return true;
+    if (normalized.endsWith('Cache'))
+        return true;
+    if (normalized.endsWith('.filteredContent'))
+        return true;
+    if (normalized.includes('parseCache'))
+        return true;
+    if (normalized === 'byId' || normalized === 'byName')
+        return true;
+    if (normalized.endsWith('.byId') || normalized.endsWith('.byName'))
+        return true;
+    if (normalized.endsWith('Handlers'))
+        return true;
+    return false;
+}
+/** Full dotted receiver chain for a property-access call target. */
+export function getReceiverChainText(expr) {
+    if (ts.isIdentifier(expr))
+        return expr.text;
+    if (expr.kind === ts.SyntaxKind.ThisKeyword)
+        return 'this';
+    if (ts.isPropertyAccessExpression(expr)) {
+        const base = getReceiverChainText(expr.expression);
+        if (base)
+            return `${base}.${expr.name.text}`;
+    }
+    return null;
+}
+function collectThisDestructuringAliases(decl, classCacheFields, aliases) {
+    if (!ts.isObjectBindingPattern(decl.name) ||
+        decl.initializer?.kind !== ts.SyntaxKind.ThisKeyword) {
+        return;
+    }
+    for (const element of decl.name.elements) {
+        if (!ts.isBindingElement(element) || !ts.isIdentifier(element.name))
+            continue;
+        const propName = element.propertyName && ts.isIdentifier(element.propertyName)
+            ? element.propertyName.text
+            : element.name.text;
+        if (classCacheFields.has(propName)) {
+            aliases.add(element.name.text);
+        }
+    }
+}
+function collectThisPropertyAccessAlias(decl, classCacheFields, aliases) {
+    const init = decl.initializer;
+    if (!ts.isIdentifier(decl.name) ||
+        !init ||
+        !ts.isPropertyAccessExpression(init) ||
+        init.expression.kind !== ts.SyntaxKind.ThisKeyword ||
+        !classCacheFields.has(init.name.text)) {
+        return;
+    }
+    aliases.add(decl.name.text);
+}
+/** `const { byId } = this` aliases for class-owned Map/Set fields. */
+export function collectThisCollectionFieldAliases(node, classCacheFields) {
+    const aliases = new Set();
+    if (classCacheFields.size === 0)
+        return aliases;
+    const visit = (n) => {
+        if (n !== node && isFunctionLikeNode(n))
+            return;
+        if (!ts.isVariableDeclaration(n) || !n.initializer) {
+            ts.forEachChild(n, visit);
+            return;
+        }
+        collectThisDestructuringAliases(n, classCacheFields, aliases);
+        collectThisPropertyAccessAlias(n, classCacheFields, aliases);
+        ts.forEachChild(n, visit);
+    };
+    if (node.body)
+        visit(node.body);
+    return aliases;
+}
+/** Map/Set names declared in enclosing functions (closure-visible locals). */
+export function collectEnclosingLocalCollectionNames(node) {
+    const names = new Set();
+    let current = node.parent;
+    while (current) {
+        if (isFunctionLikeNode(current)) {
+            for (const name of collectLocalCollectionNames(current)) {
+                names.add(name);
+            }
+            const classFields = collectClassInMemoryFieldNames(current);
+            for (const alias of collectThisCollectionFieldAliases(current, classFields)) {
+                names.add(alias);
+            }
+        }
+        current = current.parent;
+    }
+    return names;
+}
+/** Collect local Map/Set variable names within a function. */
+export function collectLocalCollectionNames(node) {
+    const names = new Set();
+    for (const param of node.parameters) {
+        if (ts.isIdentifier(param.name) && isInMemoryCollectionTypeNode(param.type)) {
+            names.add(param.name.text);
+        }
+    }
+    const visit = (n) => {
+        if (n !== node && isFunctionLikeNode(n))
+            return;
+        if (ts.isVariableDeclaration(n) &&
+            ts.isIdentifier(n.name) &&
+            (isInMemoryCollectionInitializer(n.initializer) || isInMemoryCollectionTypeNode(n.type))) {
+            names.add(n.name.text);
+        }
+        ts.forEachChild(n, visit);
+    };
+    if (node.body)
+        visit(node.body);
+    return names;
+}
+// eslint-disable-next-line sonarjs/cognitive-complexity -- AST walk over class members
+export function collectClassInMemoryFieldNames(node) {
+    const names = new Set();
+    let cls = node.parent;
+    while (cls && !ts.isClassDeclaration(cls) && !ts.isClassExpression(cls)) {
+        cls = cls.parent;
+    }
+    if (!cls)
+        return names;
+    const classNode = cls;
+    for (const member of classNode.members) {
+        if (ts.isPropertyDeclaration(member)) {
+            const memberName = member.name;
+            let fieldName;
+            if (ts.isIdentifier(memberName)) {
+                fieldName = memberName.text;
+            }
+            else if (ts.isPrivateIdentifier(memberName)) {
+                fieldName = memberName.text.replace(/^#/, '');
+            }
+            if (!fieldName)
+                continue;
+            if (isInMemoryCollectionInitializer(member.initializer) ||
+                isInMemoryCollectionTypeNode(member.type)) {
+                names.add(fieldName);
+            }
+        }
+    }
+    return names;
+}
+/** Index file-local interface/type declarations to Map/Set field names. */
+export function collectInterfaceCollectionFields(sourceFile) {
+    const byType = new Map();
+    const fieldsFrom = (members) => {
+        const fields = new Set();
+        for (const member of members) {
+            if (ts.isPropertySignature(member) &&
+                ts.isIdentifier(member.name) &&
+                isInMemoryCollectionTypeNode(member.type)) {
+                fields.add(member.name.text);
+            }
+        }
+        return fields;
+    };
+    for (const stmt of sourceFile.statements) {
+        if (ts.isInterfaceDeclaration(stmt)) {
+            const fields = fieldsFrom(stmt.members);
+            if (fields.size > 0)
+                byType.set(stmt.name.text, fields);
+        }
+        else if (ts.isTypeAliasDeclaration(stmt) && ts.isTypeLiteralNode(stmt.type)) {
+            const fields = fieldsFrom(stmt.type.members);
+            if (fields.size > 0)
+                byType.set(stmt.name.text, fields);
+        }
+    }
+    return byType;
+}
+/** Collect `<receiver>.<field>` keys for state-bag Map/Set fields. */
+export function collectLocalObjectCollectionFieldKeys(node, interfaceCollectionFields) {
+    const keys = new Set();
+    const addFor = (name, typeNode) => {
+        if (!typeNode || !ts.isTypeReferenceNode(typeNode))
+            return;
+        if (!ts.isIdentifier(typeNode.typeName))
+            return;
+        const fields = interfaceCollectionFields.get(typeNode.typeName.text);
+        if (!fields)
+            return;
+        for (const field of fields)
+            keys.add(`${name}.${field}`);
+    };
+    for (const param of node.parameters) {
+        if (ts.isIdentifier(param.name))
+            addFor(param.name.text, param.type);
+    }
+    const visit = (n) => {
+        if (n !== node && isFunctionLikeNode(n))
+            return;
+        if (ts.isVariableDeclaration(n) && ts.isIdentifier(n.name))
+            addFor(n.name.text, n.type);
+        ts.forEachChild(n, visit);
+    };
+    if (node.body)
+        visit(node.body);
+    return keys;
+}
+//# sourceMappingURL=toctou-race-condition-collection.js.map

package/dist/checks/quality/patterns/toctou-race-condition-collection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toctou-race-condition-collection.js","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/toctou-race-condition-collection.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AASjC,4CAA4C;AAC5C,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,OAAO,CACL,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC9B,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC5B,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;QACxB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,KAAK;IACL,SAAS;IACT,aAAa;IACb,KAAK;IACL,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AAEH,SAAS,4BAA4B,CAAC,QAAiC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC/B,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChE,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,+BAA+B,CAAC,IAA+B;IACtE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,OAAO,+BAA+B,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,IAAI;YAAE,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,+BAA+B,CACtC,IAA4B,EAC5B,gBAAqC,EACrC,OAAoB;IAEpB,IACE,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW,EACpD,CAAC;QACD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QAC9E,MAAM,QAAQ,GACZ,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3D,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI;YAC3B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACxB,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CACrC,IAA4B,EAC5B,gBAAqC,EACrC,OAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;IAC9B,IACE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,CAAC,IAAI;QACL,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW;QAClD,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EACrC,CAAC;QACD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iCAAiC,CAC/C,IAAsB,EACtB,gBAAqC;IAErC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,gBAAgB,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAEhD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAQ,EAAE;QACjC,IAAI,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,OAAO;QAChD,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnD,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,+BAA+B,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC9D,8BAA8B,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC7D,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oCAAoC,CAAC,IAAsB;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,OAAO,GAAwB,IAAI,CAAC,MAAM,CAAC;IAE/C,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,WAAW,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;YAC5D,KAAK,MAAM,KAAK,IAAI,iCAAiC,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC5E,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,2BAA2B,CAAC,IAAsB;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,CAAU,EAAQ,EAAE;QACjC,IAAI,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,OAAO;QAChD,IACE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC3B,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YACvB,CAAC,+BAA+B,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EACxF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,8BAA8B,CAAC,IAAsB;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,GAAG,GAAwB,IAAI,CAAC,MAAM,CAAC;IAC3C,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,CAAC;IACtB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;YAC/B,IAAI,SAA6B,CAAC;YAClC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC;YAC9B,CAAC;iBAAM,IAAI,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,IACE,+BAA+B,CAAC,MAAM,CAAC,WAAW,CAAC;gBACnD,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,EACzC,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gCAAgC,CAC9C,UAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,UAAU,GAAG,CAAC,OAAqC,EAAe,EAAE;QACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IACE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBAC9B,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC5B,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,EACzC,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;aAAM,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,qCAAqC,CACnD,IAAsB,EACtB,yBAA2D;IAE3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,QAAiC,EAAQ,EAAE;QACvE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC3D,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO;QAChD,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAQ,EAAE;QACjC,IAAI,CAAC,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,OAAO;QAChD,IAAI,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACxF,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/checks/quality/patterns/toctou-race-condition-constants.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Constants and safe-path configuration for the TOCTOU race-condition check.
+ */
+/**
+ * Recipe-config shape for toctou-race-condition. Project-specific safe-paths
+ * belong in a recipe's `checks.config['toctou-race-condition']` block.
+ */
+export interface TocTouConfig extends Record<string, unknown> {
+    /**
+     * Additional path patterns where TOCTOU is not a concern. Each entry is
+     * compiled to a case-insensitive RegExp via `new RegExp(entry, 'i')`.
+     */
+    additionalSafeTOCTOUPaths?: readonly string[];
+}
+/** Patterns that indicate proper atomic update handling */
+export declare const ATOMIC_PATTERNS: RegExp[];
+/** Paths where TOCTOU is typically not a concern */
+export declare const SAFE_TOCTOU_PATHS: RegExp[];
+export declare function isReadMethod(methodName: string): boolean;
+export declare function isUpdateMethod(methodName: string): boolean;
+export declare function isDrizzleAtomicWriteMethod(methodName: string): boolean;
+export declare const KIND_READ_SHARED: "read-shared";
+export declare const KIND_UPDATE_SHARED: "update-shared";
+export declare const KIND_READ_LOCAL: "read-local";
+export declare const KIND_UPDATE_LOCAL: "update-local";
+/** Compile recipe-provided string entries to case-insensitive RegExp values. */
+export declare function buildEffectiveSafePaths(): readonly RegExp[];
+/** Check if a file path is in a safe TOCTOU context. */
+export declare function isSafeToctouPath(filePath: string, safePaths: readonly RegExp[]): boolean;
+/** Check if content has atomic patterns */
+export declare function hasAtomicPatterns(content: string): boolean;
+//# sourceMappingURL=toctou-race-condition-constants.d.ts.map

package/dist/checks/quality/patterns/toctou-race-condition-constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toctou-race-condition-constants.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/toctou-race-condition-constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;GAGG;AACH,MAAM,WAAW,YAAa,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC3D;;;OAGG;IACH,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,2DAA2D;AAC3D,eAAO,MAAM,eAAe,UAwB3B,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,UAuC7B,CAAC;AAqBF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,eAAO,MAAM,gBAAgB,EAAG,aAAsB,CAAC;AACvD,eAAO,MAAM,kBAAkB,EAAG,eAAwB,CAAC;AAC3D,eAAO,MAAM,eAAe,EAAG,YAAqB,CAAC;AACrD,eAAO,MAAM,iBAAiB,EAAG,cAAuB,CAAC;AAEzD,gFAAgF;AAChF,wBAAgB,uBAAuB,IAAI,SAAS,MAAM,EAAE,CAI3D;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAExF;AAED,2CAA2C;AAC3C,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D"}

package/dist/checks/quality/patterns/toctou-race-condition-constants.js

@@ -0,0 +1,115 @@
+/**
+ * Constants and safe-path configuration for the TOCTOU race-condition check.
+ */
+import { getCheckConfig } from '@opensip-cli/fitness';
+/** Patterns that indicate proper atomic update handling */
+export const ATOMIC_PATTERNS = [
+    /expectedVersion/i,
+    /version\s*:/,
+    /ConditionExpression/,
+    /conditionalUpdate/i,
+    /atomicUpdate/i,
+    /compareAndSwap/i,
+    /optimisticLock/i,
+    /CONCURRENCY SAFE/,
+    /transaction/i,
+    /beginTransaction/i,
+    /withTransaction/i,
+    /runInTransaction/i,
+    /acquireLock/i,
+    /withLock/i,
+    /mutex/i,
+    /idempotent/i,
+    /idempotencyKey/i,
+    /single-threaded/i,
+    /in-memory/i,
+    /atomic in.*Node/i,
+    /single-threaded coalesce/i,
+    /Node single-threaded/i,
+    /event-loop semantics/i,
+];
+/** Paths where TOCTOU is typically not a concern */
+export const SAFE_TOCTOU_PATHS = [
+    /\/cache\//i,
+    /\/caching\//i,
+    /memory-backend/i,
+    /memory-cache/i,
+    /memory-store/i,
+    /in-memory/i,
+    /-cache\.tsx?$/i,
+    /-prefetcher\.tsx?$/i,
+    /rate-limit/i,
+    /rate_limit/i,
+    /local-storage/i,
+    /local-state/i,
+    /state-manager/i,
+    /\/cli\//,
+    /\/scripts\//,
+    /\/testing\//,
+    /test-utils/,
+    /\/config\//,
+    /\/registry\//,
+    /\/di-registration\//,
+    /\/factories\//,
+    /\/routes\//,
+    /\/di\//,
+    /\/schema\//,
+    /\/detectors\//i,
+    /\/dashboard\/src\//i,
+    /parse-cache/i,
+    /import-graph/i,
+    /check-result-processor/i,
+    /phantom-dependency/i,
+    /unused-config-options/i,
+    /duplicate-utility-functions/i,
+    /test-only-frontend-modules/i,
+    /interface-implementation-consistency/i,
+    /\/discover\.ts$/i,
+    /\/filter\.ts$/i,
+    /\/loader\.ts$/i,
+    /registry\.ts$/i,
+];
+/** Read operation method names */
+const READ_METHOD_NAMES = [
+    'get',
+    'find',
+    'findOne',
+    'findFirst',
+    'findMany',
+    'getById',
+    'fetch',
+    'load',
+    'read',
+];
+/** Update operation method names */
+const UPDATE_METHOD_NAMES = ['update', 'save', 'put', 'set', 'patch', 'modify'];
+/** Drizzle-style ORM writes treated as atomic SQL. */
+const DRIZZLE_ATOMIC_WRITE_METHOD_NAMES = ['update', 'insert', 'delete'];
+export function isReadMethod(methodName) {
+    return READ_METHOD_NAMES.includes(methodName);
+}
+export function isUpdateMethod(methodName) {
+    return UPDATE_METHOD_NAMES.includes(methodName);
+}
+export function isDrizzleAtomicWriteMethod(methodName) {
+    return DRIZZLE_ATOMIC_WRITE_METHOD_NAMES.includes(methodName);
+}
+export const KIND_READ_SHARED = 'read-shared';
+export const KIND_UPDATE_SHARED = 'update-shared';
+export const KIND_READ_LOCAL = 'read-local';
+export const KIND_UPDATE_LOCAL = 'update-local';
+/** Compile recipe-provided string entries to case-insensitive RegExp values. */
+export function buildEffectiveSafePaths() {
+    const cfg = getCheckConfig('toctou-race-condition');
+    const extras = (cfg.additionalSafeTOCTOUPaths ?? []).map((src) => new RegExp(src, 'i'));
+    return [...SAFE_TOCTOU_PATHS, ...extras];
+}
+/** Check if a file path is in a safe TOCTOU context. */
+export function isSafeToctouPath(filePath, safePaths) {
+    return safePaths.some((pattern) => pattern.test(filePath));
+}
+/** Check if content has atomic patterns */
+export function hasAtomicPatterns(content) {
+    return ATOMIC_PATTERNS.some((p) => p.test(content));
+}
+//# sourceMappingURL=toctou-race-condition-constants.js.map

package/dist/checks/quality/patterns/toctou-race-condition-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toctou-race-condition-constants.js","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/toctou-race-condition-constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AActD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,kBAAkB;IAClB,aAAa;IACb,qBAAqB;IACrB,oBAAoB;IACpB,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,cAAc;IACd,WAAW;IACX,QAAQ;IACR,aAAa;IACb,iBAAiB;IACjB,kBAAkB;IAClB,YAAY;IACZ,kBAAkB;IAClB,2BAA2B;IAC3B,uBAAuB;IACvB,uBAAuB;CACxB,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,eAAe;IACf,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,SAAS;IACT,aAAa;IACb,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,cAAc;IACd,eAAe;IACf,yBAAyB;IACzB,qBAAqB;IACrB,wBAAwB;IACxB,8BAA8B;IAC9B,6BAA6B;IAC7B,uCAAuC;IACvC,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;CACjB,CAAC;AAEF,kCAAkC;AAClC,MAAM,iBAAiB,GAAG;IACxB,KAAK;IACL,MAAM;IACN,SAAS;IACT,WAAW;IACX,UAAU;IACV,SAAS;IACT,OAAO;IACP,MAAM;IACN,MAAM;CACE,CAAC;AAEX,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAEzF,sDAAsD;AACtD,MAAM,iCAAiC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAElF,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAQ,iCAAuD,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAsB,CAAC;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAwB,CAAC;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG,YAAqB,CAAC;AACrD,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAuB,CAAC;AAEzD,gFAAgF;AAChF,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,GAAG,cAAc,CAAe,uBAAuB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,iBAAiB,EAAE,GAAG,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,SAA4B;IAC7E,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/checks/quality/patterns/toctou-race-condition.d.ts

@@ -3,37 +3,8 @@
  *
  * Detects Time-of-Check-Time-of-Use race conditions where data is read,
  * then updated without passing version/condition for atomic updates.
- *
- * Refinement notes (Wave E lane E6-redo):
- * The original implementation was a regex-only test for the presence of
- * `.get/.find/...` and `.update/.set/...` strings inside the same function
- * body. That broad pattern produced false positives on:
- *   - Local `Map.get` / `Map.set` accumulator idioms (count++ via map).
- *   - In-process cache fields (`this.#cache.get` then `this.#cache.set`)
- *     used as single-threaded coalescing structures.
- *   - Read-only DB functions that build local Maps for grouping
- *     (`db.select(...)` → `new Map().set(...)`).
- *   - Single-statement atomic SQL writes (`tx.execute(sql`UPDATE...`)`).
- *
- * Refinement strategy: classify each `.get/.set/.update/...` call by its
- * receiver. A function only flags as TOCTOU if there is at least one
- * read+update pair on a *non-local* receiver (i.e. not a local Map/Set,
- * not a "Cache"-named field, and not a tx/db where writes are atomic
- * SQL). All-local-receiver patterns are excluded.
  */
 import { type CheckViolation } from '@opensip-cli/fitness';
-/**
- * Recipe-config shape for toctou-race-condition. Project-specific safe-paths
- * (e.g. opensip's `/chain-walker/`) belong in a recipe's
- * `checks.config['toctou-race-condition']` block, not in built-in defaults.
- */
-export interface TocTouConfig extends Record<string, unknown> {
-    /**
-     * Additional path patterns where TOCTOU is not a concern. Each entry is
-     * compiled to a case-insensitive RegExp via `new RegExp(entry, 'i')`.
-     */
-    additionalSafeTOCTOUPaths?: readonly string[];
-}
 /**
  * Analyze a file for TOCTOU race conditions. Exported for the FP-regression
  * suite (see `__tests__/toctou-fp.test.ts`).
@@ -45,4 +16,5 @@ export declare function analyzeFileForToctou(filePath: string, content: string):
  * Detects read-then-update patterns without atomic guarantees.
  */
 export declare const toctouRaceCondition: import("@opensip-cli/fitness").Check;
+export { type TocTouConfig } from './toctou-race-condition-constants.js';
 //# sourceMappingURL=toctou-race-condition.d.ts.map

package/dist/checks/quality/patterns/toctou-race-condition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toctou-race-condition.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/toctou-race-condition.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAA2C,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAIpG;;;;GAIG;AACH,MAAM,WAAW,YAAa,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC3D;;;OAGG;IACH,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AA8mBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAgCxF;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,sCAyB9B,CAAC"}
+{"version":3,"file":"toctou-race-condition.d.ts","sourceRoot":"","sources":["../../../../src/checks/quality/patterns/toctou-race-condition.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAmFpF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CA6BxF;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,sCAwB9B,CAAC;AAEH,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,sCAAsC,CAAC"}