@empline/preflight 1.0.20

package/dist/checks/runtime/gtm-installation.js

@@ -0,0 +1,341 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Runtime GTM Installation Preflight (BLOCKING)
+ *
+ * Ensures GTM is installed in a nominal, maintainable way:
+ * - Root layout includes the GTM script loader + <noscript> iframe
+ * - Installation is gated by NEXT_PUBLIC_ENABLE_ANALYTICS and NEXT_PUBLIC_GTM_ID
+ * - publicEnv exposes NEXT_PUBLIC_GTM_ID
+ * - Env templates default analytics off for local/preview and on for production
+ * - Templates include NEXT_PUBLIC_GTM_ID where expected
+ *
+ * Note: This is intentionally a static check. It does NOT validate your GTM container
+ * setup or whether Tag Gateway rewrites the gtm.js host at runtime.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+// Check metadata
+exports.id = "runtime/gtm-installation";
+exports.name = "Gtm Installation";
+exports.category = "runtime";
+exports.blocking = true;
+exports.description = "Runtime GTM Installation Preflight (BLOCKING)";
+exports.tags = ["runtime"];
+function rel(filePath) {
+    return path.relative(process.cwd(), filePath).replace(/\\/g, "/");
+}
+function readTextOrEmpty(filePath) {
+    try {
+        return fs.readFileSync(filePath, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+function requireIncludes(opts) {
+    const { issues, filePath, content, description, needles } = opts;
+    for (const needle of needles) {
+        const ok = typeof needle === "string" ? content.includes(needle) : needle.test(content);
+        if (!ok) {
+            issues.push({
+                file: filePath,
+                severity: "error",
+                message: `${description} is missing required marker: ${String(needle)}`,
+            });
+        }
+    }
+}
+function getEnvValueFromTemplate(content, key) {
+    const lines = content.split(/\r?\n/);
+    for (const rawLine of lines) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        if (!line.startsWith(key + "="))
+            continue;
+        return line.slice((key + "=").length).trim();
+    }
+    return null;
+}
+function normalizeEnvScalar(value) {
+    if (!value)
+        return "";
+    return value.replace(/^"|"$/g, "").replace(/^'|'$/g, "").trim();
+}
+function ensureEnvKeyExists(opts) {
+    const { issues, filePath, content, key } = opts;
+    if (!content) {
+        issues.push({
+            file: filePath,
+            severity: "error",
+            message: `Missing ${rel(filePath)} (required for GTM env defaults check).`,
+        });
+        return;
+    }
+    const actualRaw = getEnvValueFromTemplate(content, key);
+    if (actualRaw === null) {
+        issues.push({
+            file: filePath,
+            severity: "error",
+            message: `Missing ${key} in ${rel(filePath)}.`,
+        });
+    }
+}
+function ensureCspAllowsGtm(opts) {
+    const { issues, filePath, content } = opts;
+    if (!content) {
+        issues.push({
+            file: filePath,
+            severity: "error",
+            message: `Missing ${rel(filePath)} (required for GTM CSP allowlist check).`,
+        });
+        return;
+    }
+    const hasGtmHost = /googletagmanager\.com/i.test(content);
+    const hasScriptSrcElem = /script-src-elem/i.test(content);
+    const hasScriptSrc = /script-src\b/i.test(content);
+    if (!hasGtmHost || (!hasScriptSrcElem && !hasScriptSrc)) {
+        issues.push({
+            file: filePath,
+            severity: "error",
+            message: "CSP must allow https://www.googletagmanager.com (via script-src-elem or script-src) so gtm.js can load in production.",
+        });
+    }
+    // Check that script-src-elem includes 'unsafe-inline' for GTM inline scripts
+    // GTM injects inline scripts that will be blocked without this directive
+    const scriptSrcElemMatch = content.match(/script-src-elem\s+([^;]+)/i);
+    if (scriptSrcElemMatch) {
+        const scriptSrcElemValue = scriptSrcElemMatch[1];
+        if (!/'unsafe-inline'/.test(scriptSrcElemValue)) {
+            issues.push({
+                file: filePath,
+                severity: "error",
+                message: "CSP script-src-elem must include 'unsafe-inline' for GTM inline scripts to execute. Without this, GTM will fail with CSP violations.",
+            });
+        }
+    }
+}
+async function main() {
+    const issues = [];
+    const layoutPath = path.join(process.cwd(), "app", "layout.tsx");
+    const publicEnvPath = path.join(process.cwd(), "lib", "public-env.ts");
+    const proxyPath = path.join(process.cwd(), "proxy.ts");
+    const layout = readTextOrEmpty(layoutPath);
+    const publicEnv = readTextOrEmpty(publicEnvPath);
+    const proxyFile = readTextOrEmpty(proxyPath);
+    if (!layout) {
+        issues.push({
+            file: layoutPath,
+            severity: "error",
+            message: "Missing app/layout.tsx (required for GTM installation check).",
+        });
+    }
+    else {
+        requireIncludes({
+            issues,
+            filePath: layoutPath,
+            content: layout,
+            description: "Root layout GTM gating",
+            needles: [
+                "NEXT_PUBLIC_ENABLE_ANALYTICS",
+                "NEXT_PUBLIC_GTM_ID",
+                // Keep these checks flexible to survive formatting changes.
+                /analyticsEnabled/,
+                /shouldLoadGtm/,
+            ],
+        });
+        requireIncludes({
+            issues,
+            filePath: layoutPath,
+            content: layout,
+            description: "Root layout GTM script snippet",
+            needles: ["https://www.googletagmanager.com/gtm.js?id=", "dataLayer", "gtm.js"],
+        });
+        requireIncludes({
+            issues,
+            filePath: layoutPath,
+            content: layout,
+            description: "Root layout noscript fallback",
+            needles: ["<noscript>", "https://www.googletagmanager.com/ns.html?id="],
+        });
+    }
+    if (!publicEnv) {
+        issues.push({
+            file: publicEnvPath,
+            severity: "error",
+            message: "Missing lib/public-env.ts (required for GTM env wiring check).",
+        });
+    }
+    else {
+        requireIncludes({
+            issues,
+            filePath: publicEnvPath,
+            content: publicEnv,
+            description: "publicEnv exposure",
+            needles: ["NEXT_PUBLIC_GTM_ID"],
+        });
+    }
+    // CSP should allow GTM script load (gtm.js). We enforce this in proxy.ts, not middleware.
+    ensureCspAllowsGtm({ issues, filePath: proxyPath, content: proxyFile });
+    // Env template expectations
+    const localTemplate = path.join(process.cwd(), "docs", "env-templates", ".env.local.template");
+    const localExample = path.join(process.cwd(), "docs", "env-templates", ".env.local.example");
+    const previewTemplate = path.join(process.cwd(), "docs", "env-templates", ".env.preview.template");
+    const productionTemplate = path.join(process.cwd(), "docs", "env-templates", ".env.production.template");
+    const rootEnvExample = path.join(process.cwd(), ".env.example");
+    const vercelTemplate = path.join(process.cwd(), "docs", "env-templates", ".env.vercel.template");
+    const localTemplateText = readTextOrEmpty(localTemplate);
+    const localExampleText = readTextOrEmpty(localExample);
+    const previewTemplateText = readTextOrEmpty(previewTemplate);
+    const productionTemplateText = readTextOrEmpty(productionTemplate);
+    const rootEnvExampleText = readTextOrEmpty(rootEnvExample);
+    const vercelTemplateText = readTextOrEmpty(vercelTemplate);
+    const ensureEnvValue = (filePath, content, key, expected) => {
+        if (!content) {
+            issues.push({
+                file: filePath,
+                severity: "error",
+                message: `Missing ${rel(filePath)} (required for GTM env defaults check).`,
+            });
+            return;
+        }
+        const actualRaw = getEnvValueFromTemplate(content, key);
+        const actual = normalizeEnvScalar(actualRaw);
+        if (actualRaw === null) {
+            issues.push({
+                file: filePath,
+                severity: "error",
+                message: `Missing ${key} in ${rel(filePath)} (expected ${expected}).`,
+            });
+            return;
+        }
+        if (actual.toLowerCase() !== expected.toLowerCase()) {
+            issues.push({
+                file: filePath,
+                severity: "error",
+                message: `${key} in ${rel(filePath)} is ${JSON.stringify(actual)}; expected ${JSON.stringify(expected)}.`,
+            });
+        }
+    };
+    // Local/dev defaults OFF
+    ensureEnvValue(localTemplate, localTemplateText, "NEXT_PUBLIC_ENABLE_ANALYTICS", "false");
+    ensureEnvValue(localExample, localExampleText, "NEXT_PUBLIC_ENABLE_ANALYTICS", "false");
+    ensureEnvKeyExists({
+        issues,
+        filePath: localTemplate,
+        content: localTemplateText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    ensureEnvKeyExists({
+        issues,
+        filePath: localExample,
+        content: localExampleText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    // Preview defaults OFF
+    ensureEnvValue(previewTemplate, previewTemplateText, "NEXT_PUBLIC_ENABLE_ANALYTICS", "false");
+    ensureEnvKeyExists({
+        issues,
+        filePath: previewTemplate,
+        content: previewTemplateText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    // Production defaults ON
+    ensureEnvValue(productionTemplate, productionTemplateText, "NEXT_PUBLIC_ENABLE_ANALYTICS", "true");
+    ensureEnvKeyExists({
+        issues,
+        filePath: productionTemplate,
+        content: productionTemplateText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    // Root env example should include analytics keys for discovery.
+    ensureEnvKeyExists({
+        issues,
+        filePath: rootEnvExample,
+        content: rootEnvExampleText,
+        key: "NEXT_PUBLIC_ENABLE_ANALYTICS",
+    });
+    ensureEnvKeyExists({
+        issues,
+        filePath: rootEnvExample,
+        content: rootEnvExampleText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    // Vercel template should include analytics keys.
+    ensureEnvKeyExists({
+        issues,
+        filePath: vercelTemplate,
+        content: vercelTemplateText,
+        key: "NEXT_PUBLIC_ENABLE_ANALYTICS",
+    });
+    ensureEnvKeyExists({
+        issues,
+        filePath: vercelTemplate,
+        content: vercelTemplateText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    // Ensure production GTM id is at least placeholder-shaped (GTM-XXXXXXX)
+    if (productionTemplateText) {
+        const raw = getEnvValueFromTemplate(productionTemplateText, "NEXT_PUBLIC_GTM_ID");
+        const normalized = normalizeEnvScalar(raw);
+        if (normalized && !/^GTM-/i.test(normalized)) {
+            issues.push({
+                file: productionTemplate,
+                severity: "error",
+                message: `NEXT_PUBLIC_GTM_ID in ${rel(productionTemplate)} should look like a GTM container id (e.g. GTM-XXXXXXX).`,
+            });
+        }
+    }
+    if (issues.length === 0) {
+        console.log(`${console_chars_1.emoji.success} Runtime GTM Installation: OK`);
+        return;
+    }
+    console.error(`${console_chars_1.emoji.error} Runtime GTM Installation: FAILED`);
+    for (const issue of issues) {
+        console.error(`- ${rel(issue.file)}: ${issue.message}`);
+    }
+    process.exit(1);
+}
+main().catch((err) => {
+    // eslint-disable-next-line no-console
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=gtm-installation.js.map

package/dist/checks/runtime/gtm-installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gtm-installation.js","sourceRoot":"","sources":["../../../src/checks/runtime/gtm-installation.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAE7B,6DAAkD;AAGlD,iBAAiB;AACJ,QAAA,EAAE,GAAG,0BAA0B,CAAC;AAChC,QAAA,IAAI,GAAG,kBAAkB,CAAC;AAC1B,QAAA,QAAQ,GAAG,SAAS,CAAC;AACrB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,+CAA+C,CAAC;AAC9D,QAAA,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAQhC,SAAS,GAAG,CAAC,QAAgB;IAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAMxB;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAEjE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAExF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,GAAG,WAAW,gCAAgC,MAAM,CAAC,MAAM,CAAC,EAAE;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;YAAE,SAAS;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAoB;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAK3B;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEhD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,WAAW,GAAG,CAAC,QAAQ,CAAC,yCAAyC;SAC3E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,WAAW,GAAG,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA4D;IACtF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,WAAW,GAAG,CAAC,QAAQ,CAAC,0CAA0C;SAC5E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EACL,uHAAuH;SAC1H,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACvE,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,sIAAsI;aACzI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAE7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,+DAA+D;SACzE,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,eAAe,CAAC;YACd,MAAM;YACN,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,wBAAwB;YACrC,OAAO,EAAE;gBACP,8BAA8B;gBAC9B,oBAAoB;gBACpB,4DAA4D;gBAC5D,kBAAkB;gBAClB,eAAe;aAChB;SACF,CAAC,CAAC;QAEH,eAAe,CAAC;YACd,MAAM;YACN,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,gCAAgC;YAC7C,OAAO,EAAE,CAAC,6CAA6C,EAAE,WAAW,EAAE,QAAQ,CAAC;SAChF,CAAC,CAAC;QAEH,eAAe,CAAC;YACd,MAAM;YACN,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,+BAA+B;YAC5C,OAAO,EAAE,CAAC,YAAY,EAAE,8CAA8C,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,eAAe,CAAC;YACd,MAAM;YACN,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,oBAAoB;YACjC,OAAO,EAAE,CAAC,oBAAoB,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,0FAA0F;IAC1F,kBAAkB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAExE,4BAA4B;IAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IAC7F,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,OAAO,CAAC,GAAG,EAAE,EACb,MAAM,EACN,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAClC,OAAO,CAAC,GAAG,EAAE,EACb,MAAM,EACN,eAAe,EACf,0BAA0B,CAC3B,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAEjG,MAAM,iBAAiB,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,sBAAsB,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;IACnE,MAAM,kBAAkB,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,kBAAkB,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAE3D,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,QAAgB,EAAE,EAAE;QAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,WAAW,GAAG,CAAC,QAAQ,CAAC,yCAAyC;aAC3E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAE7C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,WAAW,GAAG,OAAO,GAAG,CAAC,QAAQ,CAAC,cAAc,QAAQ,IAAI;aACtE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,GAAG,GAAG,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;aAC1G,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,yBAAyB;IACzB,cAAc,CAAC,aAAa,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,OAAO,CAAC,CAAC;IAC1F,cAAc,CAAC,YAAY,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,OAAO,CAAC,CAAC;IACxF,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,iBAAiB;QAC1B,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IACH,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,gBAAgB;QACzB,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IAEH,uBAAuB;IACvB,cAAc,CAAC,eAAe,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,OAAO,CAAC,CAAC;IAC9F,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,eAAe;QACzB,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IAEH,yBAAyB;IACzB,cAAc,CACZ,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,MAAM,CACP,CAAC;IACF,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,sBAAsB;QAC/B,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IAEH,gEAAgE;IAChE,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,8BAA8B;KACpC,CAAC,CAAC;IACH,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IAEH,iDAAiD;IACjD,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,8BAA8B;KACpC,CAAC,CAAC;IACH,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IAEH,wEAAwE;IACxE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,uBAAuB,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;QAClF,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,yBAAyB,GAAG,CAAC,kBAAkB,CAAC,0DAA0D;aACpH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,GAAG,qBAAK,CAAC,KAAK,mCAAmC,CAAC,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/checks/runtime/json-parse-safety.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env tsx
+/**
+ * JSON.parse Safety Preflight (BLOCKING)
+ *
+ * Prevent runtime crashes from JSON.parse() on untrusted request bodies
+ * without guardrails.
+ *
+ * Scope:
+ * - app/api/ (route handlers)
+ *
+ * Heuristic:
+ * - Taint variables assigned from `await request.text()`
+ * - Flag `JSON.parse(taintedVar)` unless the file appears to have try/catch
+ *   or a safe helper is used.
+ */
+export declare const id = "runtime/json-parse-safety";
+export declare const name = "Json Parse Safety";
+export declare const category = "runtime";
+export declare const blocking = true;
+export declare const description = "JSON.parse Safety Preflight (BLOCKING)";
+export declare const tags: string[];
+//# sourceMappingURL=json-parse-safety.d.ts.map

package/dist/checks/runtime/json-parse-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-parse-safety.d.ts","sourceRoot":"","sources":["../../../src/checks/runtime/json-parse-safety.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG;AAYH,eAAO,MAAM,EAAE,8BAA8B,CAAC;AAC9C,eAAO,MAAM,IAAI,sBAAsB,CAAC;AACxC,eAAO,MAAM,QAAQ,YAAY,CAAC;AAClC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,2CAA2C,CAAC;AACpE,eAAO,MAAM,IAAI,UAAc,CAAC"}

package/dist/checks/runtime/json-parse-safety.js

@@ -0,0 +1,179 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * JSON.parse Safety Preflight (BLOCKING)
+ *
+ * Prevent runtime crashes from JSON.parse() on untrusted request bodies
+ * without guardrails.
+ *
+ * Scope:
+ * - app/api/ (route handlers)
+ *
+ * Heuristic:
+ * - Taint variables assigned from `await request.text()`
+ * - Flag `JSON.parse(taintedVar)` unless the file appears to have try/catch
+ *   or a safe helper is used.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const console_chars_1 = require("../../utils/console-chars");
+const file_cache_1 = require("../../shared/file-cache");
+const glob_patterns_1 = require("../../shared/glob-patterns");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+const findings_writer_1 = require("../../utils/findings-writer");
+// Check metadata
+exports.id = "runtime/json-parse-safety";
+exports.name = "Json Parse Safety";
+exports.category = "runtime";
+exports.blocking = true;
+exports.description = "JSON.parse Safety Preflight (BLOCKING)";
+exports.tags = ["runtime"];
+const EXCLUDED = (0, glob_patterns_1.extendExcludes)(glob_patterns_1.STANDARD_EXCLUDES_WITH_TESTS, [
+    "**/scripts/**",
+    "**/test-results/**",
+]);
+function normalizeRel(p) {
+    return p.replace(/\\/g, "/");
+}
+function snippetFrom(text, idx) {
+    const start = Math.max(0, idx - 60);
+    const end = Math.min(text.length, idx + 120);
+    return text.slice(start, end).replace(/\s+/g, " ").trim();
+}
+function taintRequestTextAssignments(content) {
+    const tainted = new Set();
+    // Matches: const rawBody = await request.text();
+    const assignRe = /(const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*await\s+\w+\s*\.\s*text\s*\(\s*\)\s*;/g;
+    let m;
+    while ((m = assignRe.exec(content)) !== null) {
+        if (m[2])
+            tainted.add(m[2]);
+    }
+    return tainted;
+}
+function fileHasTryCatch(content) {
+    return /\btry\s*\{/.test(content) && /\bcatch\s*\(/.test(content);
+}
+function isSafeParseUsage(argExpr) {
+    const expr = argExpr.trim();
+    if (!expr)
+        return true;
+    // Safe: JSON.parse(JSON.stringify(...)) used to deep clone known-good objects
+    if (/JSON\.parse\s*\(\s*JSON\.stringify\s*\(/.test(expr))
+        return true;
+    // Safe helpers
+    if (/safeJsonParse\s*\(/.test(expr))
+        return true;
+    if (/parseJsonSafely\s*\(/.test(expr))
+        return true;
+    return false;
+}
+async function main() {
+    console.log(`\n${console_chars_1.emoji.lightning} JSON.parse SAFETY (BLOCKING)`);
+    console.log((0, console_chars_1.createDivider)(80, "heavy"));
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)("JSON.parse Safety");
+    const files = await file_cache_1.fileCache.getFiles("app/api/**/*.{ts,tsx}", { ignore: EXCLUDED });
+    const issues = [];
+    await reporter.processFiles(files, async (file) => {
+        const rel = normalizeRel(path.relative(process.cwd(), file));
+        const content = fs.readFileSync(file, "utf8");
+        if (!content.includes("JSON.parse("))
+            return;
+        const taintedVars = taintRequestTextAssignments(content);
+        if (taintedVars.size === 0)
+            return;
+        const hasTryCatch = fileHasTryCatch(content);
+        // Find JSON.parse calls
+        const parseRe = /JSON\.parse\s*\(\s*([^\)\n;]+)\s*\)/g;
+        let m;
+        while ((m = parseRe.exec(content)) !== null) {
+            const arg = (m[1] || "").trim();
+            if (!arg)
+                continue;
+            if (isSafeParseUsage(m[0]))
+                continue;
+            const simpleArg = arg.replace(/\s+/g, "");
+            const isTainted = taintedVars.has(simpleArg);
+            if (!isTainted)
+                continue;
+            // If the file already has a try/catch (common for API routes), we consider this protected.
+            // This is a pragmatic heuristic to avoid noisy false positives.
+            if (hasTryCatch)
+                continue;
+            const lc = (0, findings_writer_1.indexToLineCol)(content, m.index);
+            issues.push({
+                file: rel,
+                line: lc.line,
+                col: lc.col,
+                message: "JSON.parse() on request.text() data without try/catch",
+                suggestion: "Wrap parsing in try/catch and return 400 on invalid JSON, or use a safeJsonParse() helper.",
+                snippet: snippetFrom(content, m.index),
+            });
+        }
+    });
+    const findings = issues.map((i) => ({
+        severity: "error",
+        code: "json_parse_unguarded",
+        message: `${i.message}. ${i.suggestion}`,
+        file: i.file,
+        range: { startLine: i.line, startColumn: i.col },
+    }));
+    (0, findings_writer_1.writeFindings)(findings);
+    if (issues.length > 0) {
+        console.log(`\n${console_chars_1.emoji.error} BLOCKING: ${issues.length} JSON.parse issue(s) found`);
+        console.log((0, console_chars_1.createDivider)(80, "heavy"));
+        for (const i of issues.slice(0, 25)) {
+            console.log(`${console_chars_1.emoji.error} ${i.file}:${i.line}:${i.col}`);
+            console.log(`  ${i.message}`);
+            console.log(`  Suggestion: ${i.suggestion}`);
+            console.log(`  Snippet: ${i.snippet}`);
+            console.log();
+        }
+        if (issues.length > 25) {
+            console.log(`... and ${issues.length - 25} more`);
+        }
+        process.exit(1);
+    }
+    console.log(`\n${console_chars_1.emoji.success} JSON.parse usage appears guarded for request bodies`);
+    process.exit(0);
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=json-parse-safety.js.map

package/dist/checks/runtime/json-parse-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-parse-safety.js","sourceRoot":"","sources":["../../../src/checks/runtime/json-parse-safety.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,4CAA8B;AAC9B,gDAAkC;AAClC,6DAAiE;AACjE,wDAAoD;AACpD,8DAA0F;AAC1F,uFAAwF;AACxF,iEAAmG;AAGnG,iBAAiB;AACJ,QAAA,EAAE,GAAG,2BAA2B,CAAC;AACjC,QAAA,IAAI,GAAG,mBAAmB,CAAC;AAC3B,QAAA,QAAQ,GAAG,SAAS,CAAC;AACrB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,wCAAwC,CAAC;AACvD,QAAA,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAWhC,MAAM,QAAQ,GAAG,IAAA,8BAAc,EAAC,4CAA4B,EAAE;IAC5D,eAAe;IACf,oBAAoB;CACrB,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,iDAAiD;IACjD,MAAM,QAAQ,GAAG,+EAA+E,CAAC;IACjG,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,8EAA8E;IAC9E,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,eAAe;IACf,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,SAAS,+BAA+B,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,mBAAmB,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,sBAAS,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtF,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO;QAE7C,MAAM,WAAW,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAEnC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAE7C,wBAAwB;QACxB,MAAM,OAAO,GAAG,sCAAsC,CAAC;QACvD,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAErC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,2FAA2F;YAC3F,gEAAgE;YAChE,IAAI,WAAW;gBAAE,SAAS;YAE1B,MAAM,EAAE,GAAG,IAAA,gCAAc,EAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,GAAG,EAAE,EAAE,CAAC,GAAG;gBACX,OAAO,EAAE,uDAAuD;gBAChE,UAAU,EACR,4FAA4F;gBAC9F,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAuB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,UAAU,EAAE;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;KACjD,CAAC,CAAC,CAAC;IACJ,IAAA,+BAAa,EAAC,QAAQ,CAAC,CAAC;IAExB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,cAAc,MAAM,CAAC,MAAM,4BAA4B,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/checks/runtime/missing-public-env-import.d.ts

@@ -0,0 +1,26 @@
+#!/usr/bin/env tsx
+/**
+ * Preflight: Ensure publicEnv usage has an import
+ *
+ * Guards against runtime errors like:
+ *   ReferenceError: publicEnv is not defined
+ * when someone uses `publicEnv.*` in a client file but forgets to import it.
+ *
+ * Rule:
+ * - For any client component ("use client" in first ~10 lines) OR any file under hooks/, if it
+ *   contains `publicEnv.` then it must include an import from "@/lib/public-env".
+ *
+ * Opt-out per file (rare): add `preflight:allow-missing-publicenv-import`.
+ */
+export declare const id = "runtime/missing-public-env-import";
+export declare const name = "Missing Public Env Import";
+export declare const category = "runtime";
+export declare const blocking = false;
+export declare const description = "Preflight: Ensure publicEnv usage has an import";
+export declare const tags: string[];
+declare function run(): {
+    errors: number;
+    warnings: number;
+};
+export { run };
+//# sourceMappingURL=missing-public-env-import.d.ts.map

package/dist/checks/runtime/missing-public-env-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-public-env-import.d.ts","sourceRoot":"","sources":["../../../src/checks/runtime/missing-public-env-import.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAUH,eAAO,MAAM,EAAE,sCAAsC,CAAC;AACtD,eAAO,MAAM,IAAI,8BAA8B,CAAC;AAChD,eAAO,MAAM,QAAQ,YAAY,CAAC;AAClC,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,WAAW,oDAAoD,CAAC;AAC7E,eAAO,MAAM,IAAI,UAAc,CAAC;AAoGhC,iBAAS,GAAG,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAsCnD;AAOD,OAAO,EAAE,GAAG,EAAE,CAAC"}