@agent-native/core 0.109.3 → 0.110.0

package/dist/cli/doctor.d.ts

@@ -1,4 +1,5 @@
-export type GuardName = "no-drizzle-push" | "no-unscoped-credentials" | "no-unscoped-queries" | "no-env-credentials" | "db-tool-scoping" | "no-env-mutation" | "no-localhost-fallback";
+import { type MigrationManifest } from "../package-lifecycle/index.js";
+export type GuardName = "no-drizzle-push" | "no-unscoped-credentials" | "no-unscoped-queries" | "no-env-credentials" | "db-tool-scoping" | "no-env-mutation" | "no-localhost-fallback" | "migration-manifest";
 export declare const ALL_GUARD_NAMES: GuardName[];
 export interface DoctorConfig {
     disabledGuards: string[];
@@ -14,6 +15,7 @@ export interface DoctorFinding {
 export interface DoctorReport {
     ok: boolean;
     findings: DoctorFinding[];
+    warnings: DoctorFinding[];
     guardsRun: string[];
 }
 /**
@@ -29,6 +31,7 @@ export interface RunDoctorScanOptions {
      * are silently ignored here — the CLI layer (`runDoctor`) validates
      * `--only` and reports a usage error before calling this. */
     only?: string[];
+    migrationManifests?: MigrationManifest[];
 }
 /** Pure scan orchestrator: runs the selected guards against `root` and
  * returns a flat report. No I/O beyond reading `agent-native.json` and the

package/dist/cli/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAoCA,MAAM,MAAM,SAAS,GACjB,iBAAiB,GACjB,yBAAyB,GACzB,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,uBAAuB,CAAC;AAE5B,eAAO,MAAM,eAAe,EAAE,SAAS,EAQtC,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,WAAW,EAAE,OAAO,CAAC;CACtB;AAQD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CA6B3D;AA4BD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb;;;iEAG6D;IAC7D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;qDAEqD;AACrD,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,YAAY,CA4BzE;AAED;;;sDAGsD;AACtD,wBAAgB,eAAe,CAC7B,WAAW,EAAE,OAAO,EACpB,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAChD,OAAO,CAET;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAsBD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAuBhE;AASD,wBAAgB,eAAe,CAAC,EAAE,GAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAa,GAAG,IAAI,CAwB3E;AAED;+DAC+D;AAC/D,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,GAAE,QAAoB,GACvB,OAAO,CAAC,MAAM,CAAC,CAyDjB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC;8DAC0D;IAC1D,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,sBAAsB,EAC/B,EAAE,GAAE,QAAoB,GACvB,OAAO,CAAC,qBAAqB,CAAC,CAyBhC"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAmCA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,SAAS,GACjB,iBAAiB,GACjB,yBAAyB,GACzB,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,uBAAuB,GACvB,oBAAoB,CAAC;AAEzB,eAAO,MAAM,eAAe,EAAE,SAAS,EAStC,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,WAAW,EAAE,OAAO,CAAC;CACtB;AAQD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAMD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CA6B3D;AAoDD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb;;;iEAG6D;IAC7D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC1C;AAED;;qDAEqD;AACrD,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,YAAY,CA0CzE;AAED;;;sDAGsD;AACtD,wBAAgB,eAAe,CAC7B,WAAW,EAAE,OAAO,EACpB,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAChD,OAAO,CAET;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AA8BD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAuBhE;AASD,wBAAgB,eAAe,CAAC,EAAE,GAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAa,GAAG,IAAI,CAyB3E;AAED;+DAC+D;AAC/D,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,GAAE,QAAoB,GACvB,OAAO,CAAC,MAAM,CAAC,CAyDjB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC;8DAC0D;IAC1D,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,sBAAsB,EAC/B,EAAE,GAAE,QAAoB,GACvB,OAAO,CAAC,qBAAqB,CAAC,CAmChC"}

package/dist/cli/doctor.js

@@ -4,7 +4,7 @@
  * itself via `scripts/guard-*.mjs` (see
  * `advisor-plans/reports/005-doctor-design.md` for the full design and
  * `advisor-plans/015-doctor-v1-implementation.md` for the implementation
- * plan). v1 ships 7 of those guards, ported to work against a single
+ * plan). v1 ships 8 of those guards, ported to work against a single
  * generated app root instead of this monorepo's multi-template layout —
  * see `../guards/index.ts`.
  *
@@ -23,6 +23,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { scanDbToolScoping, scanDrizzlePush, scanEnvCredentials, scanEnvMutation, scanLocalhostFallback, scanUnscopedCredentials, scanUnscopedQueries, } from "../guards/index.js";
+import { AGENT_NATIVE_UPGRADE_CODEMOD_COMMAND, scanDeprecatedImports, } from "../package-lifecycle/index.js";
 export const ALL_GUARD_NAMES = [
     "no-drizzle-push",
     "no-unscoped-credentials",
@@ -31,6 +32,7 @@ export const ALL_GUARD_NAMES = [
     "db-tool-scoping",
     "no-env-mutation",
     "no-localhost-fallback",
+    "migration-manifest",
 ];
 const DEFAULT_DOCTOR_CONFIG = {
     disabledGuards: [],
@@ -65,7 +67,7 @@ export function readDoctorConfig(root) {
         return { ...DEFAULT_DOCTOR_CONFIG, dbToolScopingDenylist: {} };
     }
 }
-function runGuard(name, root, config) {
+function runGuard(name, root, config, migrationManifests) {
     switch (name) {
         case "no-drizzle-push":
             return scanDrizzlePush({ root });
@@ -84,6 +86,29 @@ function runGuard(name, root, config) {
             return scanEnvMutation({ root });
         case "no-localhost-fallback":
             return scanLocalhostFallback({ root, extraExemptPaths: [] });
+        case "migration-manifest": {
+            const imports = scanDeprecatedImports({
+                root,
+                manifests: migrationManifests,
+            });
+            return {
+                name,
+                findings: imports
+                    .filter((finding) => finding.status === "active")
+                    .map((finding) => ({
+                    file: path.relative(root, finding.file),
+                    line: finding.line,
+                    message: `${finding.from} moves to ${finding.to.join(", ")}. Run: ${AGENT_NATIVE_UPGRADE_CODEMOD_COMMAND}`,
+                })),
+                warnings: imports
+                    .filter((finding) => finding.status === "planned")
+                    .map((finding) => ({
+                    file: path.relative(root, finding.file),
+                    line: finding.line,
+                    message: `${finding.from} is planned to move to ${finding.to.join(", ")} in a future release. No rewrite is available yet.`,
+                })),
+            };
+        }
     }
 }
 /** Pure scan orchestrator: runs the selected guards against `root` and
@@ -101,8 +126,9 @@ export function runDoctorScan(options) {
         names = ALL_GUARD_NAMES.filter((n) => !config.disabledGuards.includes(n));
     }
     const findings = [];
+    const warnings = [];
     for (const name of names) {
-        const result = runGuard(name, root, config);
+        const result = runGuard(name, root, config, options.migrationManifests);
         for (const f of result.findings) {
             findings.push({
                 guard: name,
@@ -111,8 +137,21 @@ export function runDoctorScan(options) {
                 message: f.message,
             });
         }
+        for (const warning of result.warnings ?? []) {
+            warnings.push({
+                guard: name,
+                file: warning.file,
+                line: warning.line,
+                message: warning.message,
+            });
+        }
     }
-    return { ok: findings.length === 0, findings, guardsRun: names };
+    return {
+        ok: findings.length === 0,
+        findings,
+        warnings,
+        guardsRun: names,
+    };
 }
 /** Pure escalation rule shared by the CLI (`--strict`) and the `build`
  * pre-step (`--strict` / `agent-native.json` `doctor.failOnBuild`). Doctor
@@ -138,6 +177,12 @@ function formatDoctorHuman(report, root) {
             lines.push(`  [${f.guard}] ${f.file}:${f.line} — ${f.message}`);
         }
     }
+    if (report.warnings.length > 0) {
+        lines.push(`${report.warnings.length} warning(s):`);
+        for (const warning of report.warnings) {
+            lines.push(`  [${warning.guard}] ${warning.file}:${warning.line} — ${warning.message}`);
+        }
+    }
     return lines.join("\n");
 }
 export function parseDoctorArgs(argv) {
@@ -181,7 +226,7 @@ export function printDoctorHelp(io = defaultIo) {
     io.log([
         "Usage:",
         "  agent-native doctor                        Scan app source for security-critical guard violations",
-        "  agent-native doctor --json                 Machine-readable report: { ok, findings, guardsRun, strict }",
+        "  agent-native doctor --json                 Machine-readable report: { ok, findings, warnings, guardsRun, strict }",
         "  agent-native doctor --only <guard,guard>   Run only the named guard(s)",
         "  agent-native doctor --strict                Escalate findings to a hard failure when used by `agent-native build --strict`",
         "  agent-native doctor --cwd <dir>             Run against a project root other than the current directory",
@@ -198,6 +243,7 @@ export function printDoctorHelp(io = defaultIo) {
         "",
         "For dependency-pin health (framework overrides/patches, stale",
         "@agent-native/* pins), run `agent-native upgrade check` instead.",
+        `For import migrations, run \`${AGENT_NATIVE_UPGRADE_CODEMOD_COMMAND}\`.`,
     ].join("\n"));
 }
 /** `agent-native doctor` CLI entrypoint. Returns the process exit code —
@@ -269,6 +315,12 @@ export async function runDoctorBuildHook(options, io = defaultIo) {
             io.err(`  [${f.guard}] ${f.file}:${f.line} — ${f.message}`);
         }
     }
+    if (report.warnings.length > 0) {
+        io.err(`\n[doctor] ${report.warnings.length} planned migration warning(s) — no rewrite is available yet.`);
+        for (const warning of report.warnings) {
+            io.err(`  [${warning.guard}] ${warning.file}:${warning.line} — ${warning.message}`);
+        }
+    }
     const fail = shouldFailBuild(report.findings.length > 0, {
         strict: options.strict,
         failOnBuild: config.failOnBuild,

package/dist/cli/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAY5B,MAAM,CAAC,MAAM,eAAe,GAAgB;IAC1C,iBAAiB;IACjB,yBAAyB;IACzB,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,iBAAiB;IACjB,uBAAuB;CACxB,CAAC;AAQF,MAAM,qBAAqB,GAAiB;IAC1C,cAAc,EAAE,EAAE;IAClB,qBAAqB,EAAE,EAAE;IACzB,WAAW,EAAE,KAAK;CACnB,CAAC;AAeF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,qBAAqB,GACzB,MAAM,CAAC,qBAAqB;YAC5B,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ;YAC9C,CAAC,CAAE,MAAM,CAAC,WAAW,CACjB,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,qBAAgD,CACxD,CAAC,MAAM,CACN,CAAC,KAAK,EAA6B,EAAE,CACnC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAC/B,CACyB;YAC9B,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC;QAChD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,IAAe,EACf,IAAY,EACZ,MAAoB;IAEpB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,KAAK,yBAAyB;YAC5B,OAAO,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,KAAK,qBAAqB;YACxB,OAAO,mBAAmB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7D,KAAK,oBAAoB;YACvB,OAAO,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,KAAK,iBAAiB;YACpB,OAAO,iBAAiB,CAAC;gBACvB,IAAI;gBACJ,QAAQ,EAAE,MAAM,CAAC,qBAAqB;aACvC,CAAC,CAAC;QACL,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,KAAK,uBAAuB;YAC1B,OAAO,qBAAqB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAWD;;qDAEqD;AACrD,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEtC,IAAI,KAAkB,CAAC;IACvB,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CACzD,eAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC1C,CAAC;QACF,KAAK,GAAG,SAAS,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACnE,CAAC;AAED;;;sDAGsD;AACtD,MAAM,UAAU,eAAe,CAC7B,WAAoB,EACpB,IAAiD;IAEjD,OAAO,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC;AAOD,MAAM,SAAS,GAAa;IAC1B,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACtC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;CACzC,CAAC;AAEF,SAAS,iBAAiB,CAAC,MAAoB,EAAE,IAAY;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAWD,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAE,GAA0B,SAAS;IACnE,EAAE,CAAC,GAAG,CACJ;QACE,QAAQ;QACR,qGAAqG;QACrG,2GAA2G;QAC3G,0EAA0E;QAC1E,8HAA8H;QAC9H,2GAA2G;QAC3G,+EAA+E;QAC/E,8DAA8D;QAC9D,EAAE;QACF,WAAW,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACvC,EAAE;QACF,mEAAmE;QACnE,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,+DAA+D;QAC/D,EAAE;QACF,+DAA+D;QAC/D,kEAAkE;KACnE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED;+DAC+D;AAC/D,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAc,EACd,EAAE,GAAa,SAAS;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,eAAe,CAAC,EAAE,CAAC,CAAC;QACpB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,GAAG,CACJ,uHAAuH,CACxH,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,oDAAoD,IAAI,EAAE,CAAC;QAC3E,IAAI,IAAI,CAAC,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;YAClE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,eAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtH,IAAI,IAAI,CAAC,IAAI;gBAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;gBAClE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,sEAAsE;QACtE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,EAAE,CAAC,GAAG,CACJ,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CACrE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACX,EAAE,CAAC,GAAG,CACJ,8HAA8H,CAC/H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAeD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA+B,EAC/B,EAAE,GAAa,SAAS;IAExB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,GAAG,CACJ,cAAc,MAAM,CAAC,QAAQ,CAAC,MAAM,oLAAoL,CACzN,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;QACvD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,IAAI,IAAI,EAAE,CAAC;QACT,EAAE,CAAC,GAAG,CACJ,6BAA6B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gDAAgD,GAAG,CAC1H,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * `agent-native doctor` — scan an app's source tree for the security-\n * critical code-safety invariants this monorepo already enforces on\n * itself via `scripts/guard-*.mjs` (see\n * `advisor-plans/reports/005-doctor-design.md` for the full design and\n * `advisor-plans/015-doctor-v1-implementation.md` for the implementation\n * plan). v1 ships 7 of those guards, ported to work against a single\n * generated app root instead of this monorepo's multi-template layout —\n * see `../guards/index.ts`.\n *\n * This is a NEW top-level command, deliberately kept separate from the two\n * existing \"doctor\" precedents in this CLI:\n *   - `agent-native upgrade check` (`upgrade.ts`) — dependency-pin health.\n *   - `agent-native recap doctor` (`recap.ts`) — PR Visual Recap config health.\n * Each diagnoses a different domain; none are folded into a shared\n * mega-doctor (see report 005, \"Relationship to upgrade doctor and recap\n * doctor\").\n *\n * `--fix` is reserved, not implemented in v1 — it prints a message and\n * exits 2 rather than silently no-op, so a future implementation doesn't\n * collide with a script already passing the flag.\n */\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nimport {\n  scanDbToolScoping,\n  scanDrizzlePush,\n  scanEnvCredentials,\n  scanEnvMutation,\n  scanLocalhostFallback,\n  scanUnscopedCredentials,\n  scanUnscopedQueries,\n} from \"../guards/index.js\";\nimport type { GuardResult } from \"../guards/index.js\";\n\nexport type GuardName =\n  | \"no-drizzle-push\"\n  | \"no-unscoped-credentials\"\n  | \"no-unscoped-queries\"\n  | \"no-env-credentials\"\n  | \"db-tool-scoping\"\n  | \"no-env-mutation\"\n  | \"no-localhost-fallback\";\n\nexport const ALL_GUARD_NAMES: GuardName[] = [\n  \"no-drizzle-push\",\n  \"no-unscoped-credentials\",\n  \"no-unscoped-queries\",\n  \"no-env-credentials\",\n  \"db-tool-scoping\",\n  \"no-env-mutation\",\n  \"no-localhost-fallback\",\n];\n\nexport interface DoctorConfig {\n  disabledGuards: string[];\n  dbToolScopingDenylist: Record<string, string>;\n  failOnBuild: boolean;\n}\n\nconst DEFAULT_DOCTOR_CONFIG: DoctorConfig = {\n  disabledGuards: [],\n  dbToolScopingDenylist: {},\n  failOnBuild: false,\n};\n\nexport interface DoctorFinding {\n  guard: string;\n  file: string;\n  line: number;\n  message: string;\n}\n\nexport interface DoctorReport {\n  ok: boolean;\n  findings: DoctorFinding[];\n  guardsRun: string[];\n}\n\n/**\n * Reads the optional `\"doctor\"` key from `<root>/agent-native.json`. All\n * fields are optional with sane empty defaults — an app needs zero config\n * to run `agent-native doctor` with every v1 guard enabled.\n */\nexport function readDoctorConfig(root: string): DoctorConfig {\n  const manifestPath = path.join(root, \"agent-native.json\");\n  if (!fs.existsSync(manifestPath)) {\n    return { ...DEFAULT_DOCTOR_CONFIG, dbToolScopingDenylist: {} };\n  }\n  try {\n    const raw = fs.readFileSync(manifestPath, \"utf-8\");\n    const parsed = JSON.parse(raw) as { doctor?: Record<string, unknown> };\n    const doctor = parsed.doctor ?? {};\n    const disabledGuards = Array.isArray(doctor.disabledGuards)\n      ? doctor.disabledGuards.filter((v): v is string => typeof v === \"string\")\n      : [];\n    const dbToolScopingDenylist =\n      doctor.dbToolScopingDenylist &&\n      typeof doctor.dbToolScopingDenylist === \"object\"\n        ? (Object.fromEntries(\n            Object.entries(\n              doctor.dbToolScopingDenylist as Record<string, unknown>,\n            ).filter(\n              (entry): entry is [string, string] =>\n                typeof entry[1] === \"string\",\n            ),\n          ) as Record<string, string>)\n        : {};\n    const failOnBuild = doctor.failOnBuild === true;\n    return { disabledGuards, dbToolScopingDenylist, failOnBuild };\n  } catch {\n    return { ...DEFAULT_DOCTOR_CONFIG, dbToolScopingDenylist: {} };\n  }\n}\n\nfunction runGuard(\n  name: GuardName,\n  root: string,\n  config: DoctorConfig,\n): GuardResult {\n  switch (name) {\n    case \"no-drizzle-push\":\n      return scanDrizzlePush({ root });\n    case \"no-unscoped-credentials\":\n      return scanUnscopedCredentials({ root });\n    case \"no-unscoped-queries\":\n      return scanUnscopedQueries({ root, extraExemptPaths: [] });\n    case \"no-env-credentials\":\n      return scanEnvCredentials({ root });\n    case \"db-tool-scoping\":\n      return scanDbToolScoping({\n        root,\n        denylist: config.dbToolScopingDenylist,\n      });\n    case \"no-env-mutation\":\n      return scanEnvMutation({ root });\n    case \"no-localhost-fallback\":\n      return scanLocalhostFallback({ root, extraExemptPaths: [] });\n  }\n}\n\nexport interface RunDoctorScanOptions {\n  root: string;\n  /** Restrict to these guard names. When omitted, runs every guard not\n   * listed in `agent-native.json`'s `doctor.disabledGuards`. Unknown names\n   * are silently ignored here — the CLI layer (`runDoctor`) validates\n   * `--only` and reports a usage error before calling this. */\n  only?: string[];\n}\n\n/** Pure scan orchestrator: runs the selected guards against `root` and\n * returns a flat report. No I/O beyond reading `agent-native.json` and the\n * app source tree — no printing, no process.exit. */\nexport function runDoctorScan(options: RunDoctorScanOptions): DoctorReport {\n  const root = options.root;\n  const config = readDoctorConfig(root);\n\n  let names: GuardName[];\n  if (options.only && options.only.length > 0) {\n    const knownOnly = options.only.filter((n): n is GuardName =>\n      (ALL_GUARD_NAMES as string[]).includes(n),\n    );\n    names = knownOnly;\n  } else {\n    names = ALL_GUARD_NAMES.filter((n) => !config.disabledGuards.includes(n));\n  }\n\n  const findings: DoctorFinding[] = [];\n  for (const name of names) {\n    const result = runGuard(name, root, config);\n    for (const f of result.findings) {\n      findings.push({\n        guard: name,\n        file: f.file,\n        line: f.line,\n        message: f.message,\n      });\n    }\n  }\n\n  return { ok: findings.length === 0, findings, guardsRun: names };\n}\n\n/** Pure escalation rule shared by the CLI (`--strict`) and the `build`\n * pre-step (`--strict` / `agent-native.json` `doctor.failOnBuild`). Doctor\n * findings never fail anything on their own — only `strict` or\n * `failOnBuild` turn findings into a hard failure. */\nexport function shouldFailBuild(\n  hasFindings: boolean,\n  opts: { strict?: boolean; failOnBuild?: boolean },\n): boolean {\n  return hasFindings && Boolean(opts.strict || opts.failOnBuild);\n}\n\nexport interface DoctorIo {\n  log: (message: string) => void;\n  err: (message: string) => void;\n}\n\nconst defaultIo: DoctorIo = {\n  log: (message) => console.log(message),\n  err: (message) => console.error(message),\n};\n\nfunction formatDoctorHuman(report: DoctorReport, root: string): string {\n  const lines: string[] = [];\n  lines.push(`agent-native doctor: ${root}`);\n  lines.push(`Guards run: ${report.guardsRun.join(\", \") || \"(none)\"}`);\n  if (report.findings.length === 0) {\n    lines.push(\"Clean — no findings.\");\n  } else {\n    lines.push(`${report.findings.length} finding(s):`);\n    for (const f of report.findings) {\n      lines.push(`  [${f.guard}] ${f.file}:${f.line} — ${f.message}`);\n    }\n  }\n  return lines.join(\"\\n\");\n}\n\nexport interface DoctorCliOptions {\n  json?: boolean;\n  cwd?: string;\n  only?: string[];\n  strict?: boolean;\n  help?: boolean;\n  fix?: boolean;\n}\n\nexport function parseDoctorArgs(argv: string[]): DoctorCliOptions {\n  const opts: DoctorCliOptions = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    if (arg === \"--help\" || arg === \"-h\") {\n      opts.help = true;\n    } else if (arg === \"--json\") {\n      opts.json = true;\n    } else if (arg === \"--strict\") {\n      opts.strict = true;\n    } else if (arg === \"--fix\") {\n      opts.fix = true;\n    } else if (arg === \"--cwd\" && argv[i + 1] !== undefined) {\n      opts.cwd = argv[++i];\n    } else if (arg.startsWith(\"--cwd=\")) {\n      opts.cwd = arg.slice(\"--cwd=\".length);\n    } else if (arg === \"--only\" && argv[i + 1] !== undefined) {\n      opts.only = splitGuardList(argv[++i]);\n    } else if (arg.startsWith(\"--only=\")) {\n      opts.only = splitGuardList(arg.slice(\"--only=\".length));\n    }\n  }\n  return opts;\n}\n\nfunction splitGuardList(value: string): string[] {\n  return value\n    .split(\",\")\n    .map((s) => s.trim())\n    .filter((s) => s.length > 0);\n}\n\nexport function printDoctorHelp(io: Pick<DoctorIo, \"log\"> = defaultIo): void {\n  io.log(\n    [\n      \"Usage:\",\n      \"  agent-native doctor                        Scan app source for security-critical guard violations\",\n      \"  agent-native doctor --json                 Machine-readable report: { ok, findings, guardsRun, strict }\",\n      \"  agent-native doctor --only <guard,guard>   Run only the named guard(s)\",\n      \"  agent-native doctor --strict                Escalate findings to a hard failure when used by `agent-native build --strict`\",\n      \"  agent-native doctor --cwd <dir>             Run against a project root other than the current directory\",\n      \"  agent-native doctor --fix                   Not implemented in this version\",\n      \"  agent-native doctor --help                  Show this help\",\n      \"\",\n      `Guards: ${ALL_GUARD_NAMES.join(\", \")}`,\n      \"\",\n      \"Exit codes: 0 clean, 1 findings present, 2 usage/execution error.\",\n      \"\",\n      \"`agent-native build` runs doctor as a warn-only pre-step by default — it\",\n      \"never fails the build unless `agent-native build --strict` is passed or\",\n      'agent-native.json sets { \"doctor\": { \"failOnBuild\": true } }.',\n      \"\",\n      \"For dependency-pin health (framework overrides/patches, stale\",\n      \"@agent-native/* pins), run `agent-native upgrade check` instead.\",\n    ].join(\"\\n\"),\n  );\n}\n\n/** `agent-native doctor` CLI entrypoint. Returns the process exit code —\n * callers are responsible for calling `process.exit(code)`. */\nexport async function runDoctor(\n  argv: string[],\n  io: DoctorIo = defaultIo,\n): Promise<number> {\n  const opts = parseDoctorArgs(argv);\n\n  if (opts.help) {\n    printDoctorHelp(io);\n    return 0;\n  }\n\n  if (opts.fix) {\n    io.err(\n      \"agent-native doctor --fix is not implemented in this version. Fix findings manually and re-run `agent-native doctor`.\",\n    );\n    return 2;\n  }\n\n  const root = path.resolve(opts.cwd ?? process.cwd());\n  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) {\n    const message = `--cwd path does not exist or is not a directory: ${root}`;\n    if (opts.json) io.err(JSON.stringify({ ok: false, message }, null, 2));\n    else io.err(message);\n    return 2;\n  }\n\n  if (opts.only) {\n    const unknown = opts.only.filter(\n      (n) => !(ALL_GUARD_NAMES as string[]).includes(n),\n    );\n    if (unknown.length > 0) {\n      const message = `Unknown guard name(s) in --only: ${unknown.join(\", \")}. Known guards: ${ALL_GUARD_NAMES.join(\", \")}`;\n      if (opts.json) io.err(JSON.stringify({ ok: false, message }, null, 2));\n      else io.err(message);\n      return 2;\n    }\n  }\n\n  const report = runDoctorScan({ root, only: opts.only });\n\n  if (opts.json) {\n    // The machine-readable report always goes to stdout (io.log), whether\n    // or not findings are present, so `agent-native doctor --json >\n    // report.json` in CI always captures the report. Only the usage/\n    // execution error payloads above (bad --cwd, unknown --only) go to\n    // stderr — those are diagnostics for exit code 2, not the report.\n    io.log(\n      JSON.stringify({ ...report, strict: Boolean(opts.strict) }, null, 2),\n    );\n  } else {\n    io.log(formatDoctorHuman(report, root));\n    if (!report.ok) {\n      io.err(\"\");\n      io.err(\n        \"agent-native doctor found issues above. Fix them, or add a `// guard:allow-<check> — reason` opt-out with reviewer approval.\",\n      );\n    }\n  }\n\n  return report.ok ? 0 : 1;\n}\n\nexport interface DoctorBuildHookOptions {\n  cwd: string;\n  /** Set when the caller passed `agent-native build --strict`. */\n  strict?: boolean;\n}\n\nexport interface DoctorBuildHookResult {\n  /** False only when findings are present AND (`strict` was requested OR\n   * `agent-native.json`'s `doctor.failOnBuild` is true). */\n  ok: boolean;\n  report: DoctorReport;\n}\n\n/**\n * `agent-native build`'s doctor pre-step. Always runs every enabled guard\n * and always prints findings (as warnings) to `io.err` — never silent.\n * Never causes the build to fail unless `strict` was passed or\n * `agent-native.json` sets `doctor.failOnBuild: true` (see report 005,\n * \"Where it runs\" — the v1 doctor has zero field mileage against arbitrary\n * app layouts, so shipping fail-by-default would risk breaking a first\n * deploy on a false positive).\n */\nexport async function runDoctorBuildHook(\n  options: DoctorBuildHookOptions,\n  io: DoctorIo = defaultIo,\n): Promise<DoctorBuildHookResult> {\n  const root = path.resolve(options.cwd);\n  const config = readDoctorConfig(root);\n  const report = runDoctorScan({ root });\n\n  if (report.findings.length > 0) {\n    io.err(\n      `\\n[doctor] ${report.findings.length} finding(s) from \\`agent-native doctor\\` — run it directly for details. This does not fail the build unless --strict was passed or agent-native.json's doctor.failOnBuild is true.`,\n    );\n    for (const f of report.findings) {\n      io.err(`  [${f.guard}] ${f.file}:${f.line} — ${f.message}`);\n    }\n  }\n\n  const fail = shouldFailBuild(report.findings.length > 0, {\n    strict: options.strict,\n    failOnBuild: config.failOnBuild,\n  });\n  if (fail) {\n    io.err(\n      `\\n[doctor] Failing build: ${options.strict ? \"--strict was passed\" : \"agent-native.json's doctor.failOnBuild is true\"}.`,\n    );\n  }\n\n  return { ok: !fail, report };\n}\n"]}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GAEtB,MAAM,+BAA+B,CAAC;AAYvC,MAAM,CAAC,MAAM,eAAe,GAAgB;IAC1C,iBAAiB;IACjB,yBAAyB;IACzB,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,iBAAiB;IACjB,uBAAuB;IACvB,oBAAoB;CACrB,CAAC;AAQF,MAAM,qBAAqB,GAAiB;IAC1C,cAAc,EAAE,EAAE;IAClB,qBAAqB,EAAE,EAAE;IACzB,WAAW,EAAE,KAAK;CACnB,CAAC;AAoBF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,qBAAqB,GACzB,MAAM,CAAC,qBAAqB;YAC5B,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ;YAC9C,CAAC,CAAE,MAAM,CAAC,WAAW,CACjB,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,qBAAgD,CACxD,CAAC,MAAM,CACN,CAAC,KAAK,EAA6B,EAAE,CACnC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAC/B,CACyB;YAC9B,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC;QAChD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,WAAW,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,qBAAqB,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,IAAe,EACf,IAAY,EACZ,MAAoB,EACpB,kBAAwC;IAExC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,KAAK,yBAAyB;YAC5B,OAAO,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,KAAK,qBAAqB;YACxB,OAAO,mBAAmB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7D,KAAK,oBAAoB;YACvB,OAAO,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,KAAK,iBAAiB;YACpB,OAAO,iBAAiB,CAAC;gBACvB,IAAI;gBACJ,QAAQ,EAAE,MAAM,CAAC,qBAAqB;aACvC,CAAC,CAAC;QACL,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,KAAK,uBAAuB;YAC1B,OAAO,qBAAqB,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,KAAK,oBAAoB,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,qBAAqB,CAAC;gBACpC,IAAI;gBACJ,SAAS,EAAE,kBAAkB;aAC9B,CAAC,CAAC;YACH,OAAO;gBACL,IAAI;gBACJ,QAAQ,EAAE,OAAO;qBACd,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;qBAChD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACjB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;oBACvC,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,aAAa,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,oCAAoC,EAAE;iBAC3G,CAAC,CAAC;gBACL,QAAQ,EAAE,OAAO;qBACd,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;qBACjD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACjB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;oBACvC,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,0BAA0B,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD;iBAC5H,CAAC,CAAC;aACN,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAYD;;qDAEqD;AACrD,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEtC,IAAI,KAAkB,CAAC;IACvB,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CACzD,eAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC1C,CAAC;QACF,KAAK,GAAG,SAAS,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,QAAQ;QACR,QAAQ;QACR,SAAS,EAAE,KAAK;KACjB,CAAC;AACJ,CAAC;AAED;;;sDAGsD;AACtD,MAAM,UAAU,eAAe,CAC7B,WAAoB,EACpB,IAAiD;IAEjD,OAAO,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC;AAOD,MAAM,SAAS,GAAa;IAC1B,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACtC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;CACzC,CAAC;AAEF,SAAS,iBAAiB,CAAC,MAAoB,EAAE,IAAY;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;QACpD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CACR,MAAM,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAWD,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAE,GAA0B,SAAS;IACnE,EAAE,CAAC,GAAG,CACJ;QACE,QAAQ;QACR,qGAAqG;QACrG,qHAAqH;QACrH,0EAA0E;QAC1E,8HAA8H;QAC9H,2GAA2G;QAC3G,+EAA+E;QAC/E,8DAA8D;QAC9D,EAAE;QACF,WAAW,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACvC,EAAE;QACF,mEAAmE;QACnE,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,+DAA+D;QAC/D,EAAE;QACF,+DAA+D;QAC/D,kEAAkE;QAClE,gCAAgC,oCAAoC,KAAK;KAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED;+DAC+D;AAC/D,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAc,EACd,EAAE,GAAa,SAAS;IAExB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,eAAe,CAAC,EAAE,CAAC,CAAC;QACpB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,GAAG,CACJ,uHAAuH,CACxH,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,oDAAoD,IAAI,EAAE,CAAC;QAC3E,IAAI,IAAI,CAAC,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;YAClE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,eAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtH,IAAI,IAAI,CAAC,IAAI;gBAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;gBAClE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,sEAAsE;QACtE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,EAAE,CAAC,GAAG,CACJ,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CACrE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACX,EAAE,CAAC,GAAG,CACJ,8HAA8H,CAC/H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAeD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA+B,EAC/B,EAAE,GAAa,SAAS;IAExB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,GAAG,CACJ,cAAc,MAAM,CAAC,QAAQ,CAAC,MAAM,oLAAoL,CACzN,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,GAAG,CACJ,cAAc,MAAM,CAAC,QAAQ,CAAC,MAAM,8DAA8D,CACnG,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,EAAE,CAAC,GAAG,CACJ,MAAM,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;QACvD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,IAAI,IAAI,EAAE,CAAC;QACT,EAAE,CAAC,GAAG,CACJ,6BAA6B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gDAAgD,GAAG,CAC1H,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * `agent-native doctor` — scan an app's source tree for the security-\n * critical code-safety invariants this monorepo already enforces on\n * itself via `scripts/guard-*.mjs` (see\n * `advisor-plans/reports/005-doctor-design.md` for the full design and\n * `advisor-plans/015-doctor-v1-implementation.md` for the implementation\n * plan). v1 ships 8 of those guards, ported to work against a single\n * generated app root instead of this monorepo's multi-template layout —\n * see `../guards/index.ts`.\n *\n * This is a NEW top-level command, deliberately kept separate from the two\n * existing \"doctor\" precedents in this CLI:\n *   - `agent-native upgrade check` (`upgrade.ts`) — dependency-pin health.\n *   - `agent-native recap doctor` (`recap.ts`) — PR Visual Recap config health.\n * Each diagnoses a different domain; none are folded into a shared\n * mega-doctor (see report 005, \"Relationship to upgrade doctor and recap\n * doctor\").\n *\n * `--fix` is reserved, not implemented in v1 — it prints a message and\n * exits 2 rather than silently no-op, so a future implementation doesn't\n * collide with a script already passing the flag.\n */\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nimport {\n  scanDbToolScoping,\n  scanDrizzlePush,\n  scanEnvCredentials,\n  scanEnvMutation,\n  scanLocalhostFallback,\n  scanUnscopedCredentials,\n  scanUnscopedQueries,\n} from \"../guards/index.js\";\nimport type { GuardFinding, GuardResult } from \"../guards/index.js\";\nimport {\n  AGENT_NATIVE_UPGRADE_CODEMOD_COMMAND,\n  scanDeprecatedImports,\n  type MigrationManifest,\n} from \"../package-lifecycle/index.js\";\n\nexport type GuardName =\n  | \"no-drizzle-push\"\n  | \"no-unscoped-credentials\"\n  | \"no-unscoped-queries\"\n  | \"no-env-credentials\"\n  | \"db-tool-scoping\"\n  | \"no-env-mutation\"\n  | \"no-localhost-fallback\"\n  | \"migration-manifest\";\n\nexport const ALL_GUARD_NAMES: GuardName[] = [\n  \"no-drizzle-push\",\n  \"no-unscoped-credentials\",\n  \"no-unscoped-queries\",\n  \"no-env-credentials\",\n  \"db-tool-scoping\",\n  \"no-env-mutation\",\n  \"no-localhost-fallback\",\n  \"migration-manifest\",\n];\n\nexport interface DoctorConfig {\n  disabledGuards: string[];\n  dbToolScopingDenylist: Record<string, string>;\n  failOnBuild: boolean;\n}\n\nconst DEFAULT_DOCTOR_CONFIG: DoctorConfig = {\n  disabledGuards: [],\n  dbToolScopingDenylist: {},\n  failOnBuild: false,\n};\n\nexport interface DoctorFinding {\n  guard: string;\n  file: string;\n  line: number;\n  message: string;\n}\n\nexport interface DoctorReport {\n  ok: boolean;\n  findings: DoctorFinding[];\n  warnings: DoctorFinding[];\n  guardsRun: string[];\n}\n\ninterface DoctorGuardResult extends GuardResult {\n  warnings?: GuardFinding[];\n}\n\n/**\n * Reads the optional `\"doctor\"` key from `<root>/agent-native.json`. All\n * fields are optional with sane empty defaults — an app needs zero config\n * to run `agent-native doctor` with every v1 guard enabled.\n */\nexport function readDoctorConfig(root: string): DoctorConfig {\n  const manifestPath = path.join(root, \"agent-native.json\");\n  if (!fs.existsSync(manifestPath)) {\n    return { ...DEFAULT_DOCTOR_CONFIG, dbToolScopingDenylist: {} };\n  }\n  try {\n    const raw = fs.readFileSync(manifestPath, \"utf-8\");\n    const parsed = JSON.parse(raw) as { doctor?: Record<string, unknown> };\n    const doctor = parsed.doctor ?? {};\n    const disabledGuards = Array.isArray(doctor.disabledGuards)\n      ? doctor.disabledGuards.filter((v): v is string => typeof v === \"string\")\n      : [];\n    const dbToolScopingDenylist =\n      doctor.dbToolScopingDenylist &&\n      typeof doctor.dbToolScopingDenylist === \"object\"\n        ? (Object.fromEntries(\n            Object.entries(\n              doctor.dbToolScopingDenylist as Record<string, unknown>,\n            ).filter(\n              (entry): entry is [string, string] =>\n                typeof entry[1] === \"string\",\n            ),\n          ) as Record<string, string>)\n        : {};\n    const failOnBuild = doctor.failOnBuild === true;\n    return { disabledGuards, dbToolScopingDenylist, failOnBuild };\n  } catch {\n    return { ...DEFAULT_DOCTOR_CONFIG, dbToolScopingDenylist: {} };\n  }\n}\n\nfunction runGuard(\n  name: GuardName,\n  root: string,\n  config: DoctorConfig,\n  migrationManifests?: MigrationManifest[],\n): DoctorGuardResult {\n  switch (name) {\n    case \"no-drizzle-push\":\n      return scanDrizzlePush({ root });\n    case \"no-unscoped-credentials\":\n      return scanUnscopedCredentials({ root });\n    case \"no-unscoped-queries\":\n      return scanUnscopedQueries({ root, extraExemptPaths: [] });\n    case \"no-env-credentials\":\n      return scanEnvCredentials({ root });\n    case \"db-tool-scoping\":\n      return scanDbToolScoping({\n        root,\n        denylist: config.dbToolScopingDenylist,\n      });\n    case \"no-env-mutation\":\n      return scanEnvMutation({ root });\n    case \"no-localhost-fallback\":\n      return scanLocalhostFallback({ root, extraExemptPaths: [] });\n    case \"migration-manifest\": {\n      const imports = scanDeprecatedImports({\n        root,\n        manifests: migrationManifests,\n      });\n      return {\n        name,\n        findings: imports\n          .filter((finding) => finding.status === \"active\")\n          .map((finding) => ({\n            file: path.relative(root, finding.file),\n            line: finding.line,\n            message: `${finding.from} moves to ${finding.to.join(\", \")}. Run: ${AGENT_NATIVE_UPGRADE_CODEMOD_COMMAND}`,\n          })),\n        warnings: imports\n          .filter((finding) => finding.status === \"planned\")\n          .map((finding) => ({\n            file: path.relative(root, finding.file),\n            line: finding.line,\n            message: `${finding.from} is planned to move to ${finding.to.join(\", \")} in a future release. No rewrite is available yet.`,\n          })),\n      };\n    }\n  }\n}\n\nexport interface RunDoctorScanOptions {\n  root: string;\n  /** Restrict to these guard names. When omitted, runs every guard not\n   * listed in `agent-native.json`'s `doctor.disabledGuards`. Unknown names\n   * are silently ignored here — the CLI layer (`runDoctor`) validates\n   * `--only` and reports a usage error before calling this. */\n  only?: string[];\n  migrationManifests?: MigrationManifest[];\n}\n\n/** Pure scan orchestrator: runs the selected guards against `root` and\n * returns a flat report. No I/O beyond reading `agent-native.json` and the\n * app source tree — no printing, no process.exit. */\nexport function runDoctorScan(options: RunDoctorScanOptions): DoctorReport {\n  const root = options.root;\n  const config = readDoctorConfig(root);\n\n  let names: GuardName[];\n  if (options.only && options.only.length > 0) {\n    const knownOnly = options.only.filter((n): n is GuardName =>\n      (ALL_GUARD_NAMES as string[]).includes(n),\n    );\n    names = knownOnly;\n  } else {\n    names = ALL_GUARD_NAMES.filter((n) => !config.disabledGuards.includes(n));\n  }\n\n  const findings: DoctorFinding[] = [];\n  const warnings: DoctorFinding[] = [];\n  for (const name of names) {\n    const result = runGuard(name, root, config, options.migrationManifests);\n    for (const f of result.findings) {\n      findings.push({\n        guard: name,\n        file: f.file,\n        line: f.line,\n        message: f.message,\n      });\n    }\n    for (const warning of result.warnings ?? []) {\n      warnings.push({\n        guard: name,\n        file: warning.file,\n        line: warning.line,\n        message: warning.message,\n      });\n    }\n  }\n\n  return {\n    ok: findings.length === 0,\n    findings,\n    warnings,\n    guardsRun: names,\n  };\n}\n\n/** Pure escalation rule shared by the CLI (`--strict`) and the `build`\n * pre-step (`--strict` / `agent-native.json` `doctor.failOnBuild`). Doctor\n * findings never fail anything on their own — only `strict` or\n * `failOnBuild` turn findings into a hard failure. */\nexport function shouldFailBuild(\n  hasFindings: boolean,\n  opts: { strict?: boolean; failOnBuild?: boolean },\n): boolean {\n  return hasFindings && Boolean(opts.strict || opts.failOnBuild);\n}\n\nexport interface DoctorIo {\n  log: (message: string) => void;\n  err: (message: string) => void;\n}\n\nconst defaultIo: DoctorIo = {\n  log: (message) => console.log(message),\n  err: (message) => console.error(message),\n};\n\nfunction formatDoctorHuman(report: DoctorReport, root: string): string {\n  const lines: string[] = [];\n  lines.push(`agent-native doctor: ${root}`);\n  lines.push(`Guards run: ${report.guardsRun.join(\", \") || \"(none)\"}`);\n  if (report.findings.length === 0) {\n    lines.push(\"Clean — no findings.\");\n  } else {\n    lines.push(`${report.findings.length} finding(s):`);\n    for (const f of report.findings) {\n      lines.push(`  [${f.guard}] ${f.file}:${f.line} — ${f.message}`);\n    }\n  }\n  if (report.warnings.length > 0) {\n    lines.push(`${report.warnings.length} warning(s):`);\n    for (const warning of report.warnings) {\n      lines.push(\n        `  [${warning.guard}] ${warning.file}:${warning.line} — ${warning.message}`,\n      );\n    }\n  }\n  return lines.join(\"\\n\");\n}\n\nexport interface DoctorCliOptions {\n  json?: boolean;\n  cwd?: string;\n  only?: string[];\n  strict?: boolean;\n  help?: boolean;\n  fix?: boolean;\n}\n\nexport function parseDoctorArgs(argv: string[]): DoctorCliOptions {\n  const opts: DoctorCliOptions = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    if (arg === \"--help\" || arg === \"-h\") {\n      opts.help = true;\n    } else if (arg === \"--json\") {\n      opts.json = true;\n    } else if (arg === \"--strict\") {\n      opts.strict = true;\n    } else if (arg === \"--fix\") {\n      opts.fix = true;\n    } else if (arg === \"--cwd\" && argv[i + 1] !== undefined) {\n      opts.cwd = argv[++i];\n    } else if (arg.startsWith(\"--cwd=\")) {\n      opts.cwd = arg.slice(\"--cwd=\".length);\n    } else if (arg === \"--only\" && argv[i + 1] !== undefined) {\n      opts.only = splitGuardList(argv[++i]);\n    } else if (arg.startsWith(\"--only=\")) {\n      opts.only = splitGuardList(arg.slice(\"--only=\".length));\n    }\n  }\n  return opts;\n}\n\nfunction splitGuardList(value: string): string[] {\n  return value\n    .split(\",\")\n    .map((s) => s.trim())\n    .filter((s) => s.length > 0);\n}\n\nexport function printDoctorHelp(io: Pick<DoctorIo, \"log\"> = defaultIo): void {\n  io.log(\n    [\n      \"Usage:\",\n      \"  agent-native doctor                        Scan app source for security-critical guard violations\",\n      \"  agent-native doctor --json                 Machine-readable report: { ok, findings, warnings, guardsRun, strict }\",\n      \"  agent-native doctor --only <guard,guard>   Run only the named guard(s)\",\n      \"  agent-native doctor --strict                Escalate findings to a hard failure when used by `agent-native build --strict`\",\n      \"  agent-native doctor --cwd <dir>             Run against a project root other than the current directory\",\n      \"  agent-native doctor --fix                   Not implemented in this version\",\n      \"  agent-native doctor --help                  Show this help\",\n      \"\",\n      `Guards: ${ALL_GUARD_NAMES.join(\", \")}`,\n      \"\",\n      \"Exit codes: 0 clean, 1 findings present, 2 usage/execution error.\",\n      \"\",\n      \"`agent-native build` runs doctor as a warn-only pre-step by default — it\",\n      \"never fails the build unless `agent-native build --strict` is passed or\",\n      'agent-native.json sets { \"doctor\": { \"failOnBuild\": true } }.',\n      \"\",\n      \"For dependency-pin health (framework overrides/patches, stale\",\n      \"@agent-native/* pins), run `agent-native upgrade check` instead.\",\n      `For import migrations, run \\`${AGENT_NATIVE_UPGRADE_CODEMOD_COMMAND}\\`.`,\n    ].join(\"\\n\"),\n  );\n}\n\n/** `agent-native doctor` CLI entrypoint. Returns the process exit code —\n * callers are responsible for calling `process.exit(code)`. */\nexport async function runDoctor(\n  argv: string[],\n  io: DoctorIo = defaultIo,\n): Promise<number> {\n  const opts = parseDoctorArgs(argv);\n\n  if (opts.help) {\n    printDoctorHelp(io);\n    return 0;\n  }\n\n  if (opts.fix) {\n    io.err(\n      \"agent-native doctor --fix is not implemented in this version. Fix findings manually and re-run `agent-native doctor`.\",\n    );\n    return 2;\n  }\n\n  const root = path.resolve(opts.cwd ?? process.cwd());\n  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) {\n    const message = `--cwd path does not exist or is not a directory: ${root}`;\n    if (opts.json) io.err(JSON.stringify({ ok: false, message }, null, 2));\n    else io.err(message);\n    return 2;\n  }\n\n  if (opts.only) {\n    const unknown = opts.only.filter(\n      (n) => !(ALL_GUARD_NAMES as string[]).includes(n),\n    );\n    if (unknown.length > 0) {\n      const message = `Unknown guard name(s) in --only: ${unknown.join(\", \")}. Known guards: ${ALL_GUARD_NAMES.join(\", \")}`;\n      if (opts.json) io.err(JSON.stringify({ ok: false, message }, null, 2));\n      else io.err(message);\n      return 2;\n    }\n  }\n\n  const report = runDoctorScan({ root, only: opts.only });\n\n  if (opts.json) {\n    // The machine-readable report always goes to stdout (io.log), whether\n    // or not findings are present, so `agent-native doctor --json >\n    // report.json` in CI always captures the report. Only the usage/\n    // execution error payloads above (bad --cwd, unknown --only) go to\n    // stderr — those are diagnostics for exit code 2, not the report.\n    io.log(\n      JSON.stringify({ ...report, strict: Boolean(opts.strict) }, null, 2),\n    );\n  } else {\n    io.log(formatDoctorHuman(report, root));\n    if (!report.ok) {\n      io.err(\"\");\n      io.err(\n        \"agent-native doctor found issues above. Fix them, or add a `// guard:allow-<check> — reason` opt-out with reviewer approval.\",\n      );\n    }\n  }\n\n  return report.ok ? 0 : 1;\n}\n\nexport interface DoctorBuildHookOptions {\n  cwd: string;\n  /** Set when the caller passed `agent-native build --strict`. */\n  strict?: boolean;\n}\n\nexport interface DoctorBuildHookResult {\n  /** False only when findings are present AND (`strict` was requested OR\n   * `agent-native.json`'s `doctor.failOnBuild` is true). */\n  ok: boolean;\n  report: DoctorReport;\n}\n\n/**\n * `agent-native build`'s doctor pre-step. Always runs every enabled guard\n * and always prints findings (as warnings) to `io.err` — never silent.\n * Never causes the build to fail unless `strict` was passed or\n * `agent-native.json` sets `doctor.failOnBuild: true` (see report 005,\n * \"Where it runs\" — the v1 doctor has zero field mileage against arbitrary\n * app layouts, so shipping fail-by-default would risk breaking a first\n * deploy on a false positive).\n */\nexport async function runDoctorBuildHook(\n  options: DoctorBuildHookOptions,\n  io: DoctorIo = defaultIo,\n): Promise<DoctorBuildHookResult> {\n  const root = path.resolve(options.cwd);\n  const config = readDoctorConfig(root);\n  const report = runDoctorScan({ root });\n\n  if (report.findings.length > 0) {\n    io.err(\n      `\\n[doctor] ${report.findings.length} finding(s) from \\`agent-native doctor\\` — run it directly for details. This does not fail the build unless --strict was passed or agent-native.json's doctor.failOnBuild is true.`,\n    );\n    for (const f of report.findings) {\n      io.err(`  [${f.guard}] ${f.file}:${f.line} — ${f.message}`);\n    }\n  }\n  if (report.warnings.length > 0) {\n    io.err(\n      `\\n[doctor] ${report.warnings.length} planned migration warning(s) — no rewrite is available yet.`,\n    );\n    for (const warning of report.warnings) {\n      io.err(\n        `  [${warning.guard}] ${warning.file}:${warning.line} — ${warning.message}`,\n      );\n    }\n  }\n\n  const fail = shouldFailBuild(report.findings.length > 0, {\n    strict: options.strict,\n    failOnBuild: config.failOnBuild,\n  });\n  if (fail) {\n    io.err(\n      `\\n[doctor] Failing build: ${options.strict ? \"--strict was passed\" : \"agent-native.json's doctor.failOnBuild is true\"}.`,\n    );\n  }\n\n  return { ok: !fail, report };\n}\n"]}

package/dist/cli/migration-codemod.d.ts

@@ -0,0 +1,21 @@
+import { type MigrationManifest } from "../package-lifecycle/migration-manifest.js";
+export interface MigrationCodemodFileChange {
+    file: string;
+    before: string;
+    after: string;
+}
+export interface MigrationCodemodResult {
+    changes: MigrationCodemodFileChange[];
+    dependencyFiles: string[];
+    warnings: string[];
+}
+export interface RunMigrationCodemodsOptions {
+    root: string;
+    manifests?: MigrationManifest[];
+    apply?: boolean;
+    targetExists?: (specifier: string) => boolean;
+}
+export declare function loadMigrationManifests(projectRoot: string): MigrationManifest[];
+export declare function runMigrationCodemods(options: RunMigrationCodemodsOptions): MigrationCodemodResult;
+export declare function formatMigrationCodemodDiff(result: MigrationCodemodResult, root: string): string;
+//# sourceMappingURL=migration-codemod.d.ts.map

package/dist/cli/migration-codemod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-codemod.d.ts","sourceRoot":"","sources":["../../src/cli/migration-codemod.ts"],"names":[],"mappings":"AAYA,OAAO,EAML,KAAK,iBAAiB,EAEvB,MAAM,4CAA4C,CAAC;AAcpD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACtC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAChC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CAC/C;AAqCD,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,GAClB,iBAAiB,EAAE,CAKrB;AAkXD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,sBAAsB,CA6DxB;AAiCD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,GACX,MAAM,CAIR"}