@empline/preflight 1.0.20

package/dist/checks/auth/session-update-safety.js

@@ -0,0 +1,697 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Session Update Safety Preflight
+ *
+ * Comprehensive session handling validation to prevent auth-related bugs
+ * like unexpected login redirects, stale sessions, and UI flashes.
+ *
+ * BLOCKING ERRORS:
+ * - update() called in render path (causes infinite loops)
+ *
+ * WARNINGS:
+ * - Unhandled update() return values (can cause silent failures)
+ * - Idle refresh without activity timestamp reset (repeated refreshes)
+ * - Login redirect without session validation (unnecessary redirects)
+ *
+ * INFO (Best Practices):
+ * - update() without session status check
+ * - Session-dependent UI without loading state
+ * - signOut() without storage cleanup
+ *
+ * Usage:
+ *   pnpm preflight:session-update-safety
+ *   pnpm preflight:session-update-safety --verbose
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.checkIdleRefreshPattern = checkIdleRefreshPattern;
+exports.checkProgrammaticLoginRedirect = checkProgrammaticLoginRedirect;
+exports.checkSessionLoadingState = checkSessionLoadingState;
+exports.checkSessionStatusBeforeUpdate = checkSessionStatusBeforeUpdate;
+exports.checkSignOutCleanup = checkSignOutCleanup;
+exports.checkUnhandledUpdateReturn = checkUnhandledUpdateReturn;
+exports.checkUpdateInRenderPath = checkUpdateInRenderPath;
+const fs = __importStar(require("fs"));
+const console_chars_1 = require("../../utils/console-chars");
+const file_cache_1 = require("../../shared/file-cache");
+const glob_patterns_1 = require("../../shared/glob-patterns");
+// Check metadata
+exports.id = "auth/session-update-safety";
+exports.name = "Session Update Safety";
+exports.category = "auth";
+exports.blocking = true;
+exports.description = "Session Update Safety Preflight";
+exports.tags = ["auth"];
+// Cache for component files
+let _cachedComponentFiles = null;
+async function getComponentFiles() {
+    if (!_cachedComponentFiles) {
+        _cachedComponentFiles = await file_cache_1.fileCache.getFiles("**/*.{tsx,ts}", {
+            ignore: [...glob_patterns_1.STANDARD_EXCLUDES, "**/node_modules/**", "**/*.test.*", "**/*.spec.*"],
+        });
+    }
+    return _cachedComponentFiles;
+}
+/**
+ * Check 1: Unhandled update() Return Value
+ *
+ * Detects when update() is called but its return value is ignored.
+ * The return value indicates if the session was successfully refreshed.
+ */
+async function checkUnhandledUpdateReturn() {
+    const issues = [];
+    const files = await getComponentFiles();
+    for (const file of files) {
+        // Skip non-client components, test files, and this preflight itself
+        if (file.includes(".test.") ||
+            file.includes(".spec.") ||
+            file.includes("__tests__") ||
+            file.includes("session-update-safety.ts")) {
+            continue;
+        }
+        const content = fs.readFileSync(file, "utf8");
+        // Only check files that use useSession
+        if (!content.includes("useSession") && !content.includes("update()")) {
+            continue;
+        }
+        const lines = content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const lineNum = i + 1;
+            const trimmedLine = line.trim();
+            // Skip comment lines
+            if (trimmedLine.startsWith("//") ||
+                trimmedLine.startsWith("*") ||
+                trimmedLine.startsWith("/*")) {
+                continue;
+            }
+            // Pattern 1: await update(); without capturing return value
+            // This is dangerous because update() can return null if session expired
+            if (line.match(/await\s+update\s*\(\s*\)\s*;/) && !line.includes("=")) {
+                // Check if it's inside a try-catch with proper handling
+                const contextStart = Math.max(0, i - 10);
+                const contextEnd = Math.min(lines.length, i + 5);
+                const context = lines.slice(contextStart, contextEnd).join("\n");
+                // Check for proper error handling
+                const hasTryCatch = context.includes("try {") && context.includes("catch");
+                const hasNullCheck = context.includes("if (!") ||
+                    context.includes("if (result") ||
+                    context.includes("if (updated");
+                if (!hasTryCatch || !hasNullCheck) {
+                    issues.push({
+                        file,
+                        line: lineNum,
+                        type: "unhandled-update-return",
+                        severity: "warning",
+                        message: "update() return value ignored - can cause silent failures or redirects",
+                        suggestion: "Capture return: const result = await update(); if (!result) { /* handle */ }",
+                        code: line.trim(),
+                    });
+                }
+            }
+            // Pattern 2: update() in onClick without protection
+            if (line.includes("onClick") && (line.includes("update()") || line.includes("update("))) {
+                const contextEnd = Math.min(lines.length, i + 15);
+                const handlerContext = lines.slice(i, contextEnd).join("\n");
+                if (handlerContext.includes("update()") &&
+                    !handlerContext.includes("try") &&
+                    !handlerContext.includes("catch")) {
+                    issues.push({
+                        file,
+                        line: lineNum,
+                        type: "unprotected-click-update",
+                        severity: "warning",
+                        message: "update() in click handler without try/catch - can redirect on failure",
+                        suggestion: "Wrap in try/catch and handle null return gracefully",
+                        code: line.trim(),
+                    });
+                }
+            }
+        }
+    }
+    const hasErrors = issues.some((i) => i.severity === "error");
+    return {
+        name: "Unhandled update() Return",
+        passed: !hasErrors,
+        blocking: false,
+        issues,
+    };
+}
+/**
+ * Check 2: Idle Refresh Without Activity Reset
+ *
+ * Detects idle-based session refresh that doesn't reset the activity timestamp,
+ * which can cause repeated refresh attempts.
+ */
+async function checkIdleRefreshPattern() {
+    const issues = [];
+    const files = await getComponentFiles();
+    for (const file of files) {
+        // Skip this preflight file itself
+        if (file.includes("session-update-safety.ts")) {
+            continue;
+        }
+        const content = fs.readFileSync(file, "utf8");
+        // Look for idle detection patterns combined with update() calls
+        if (!content.includes("IDLE_THRESHOLD") && !content.includes("idleTime")) {
+            continue;
+        }
+        if (!content.includes("update()") && !content.includes("await update")) {
+            continue;
+        }
+        const lines = content.split("\n");
+        // Find functions that have idle checks AND call update()
+        // Look for the function that contains both patterns
+        let inIdleFunction = false;
+        let functionStartLine = 0;
+        let braceDepth = 0;
+        let functionContent = "";
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // Detect start of a function that checks idle time
+            if ((line.includes("refreshSessionIfStale") ||
+                line.includes("refreshIfIdle") ||
+                line.includes("checkIdle")) &&
+                (line.includes("=>") || line.includes("function") || line.includes("useCallback"))) {
+                inIdleFunction = true;
+                functionStartLine = i + 1;
+                braceDepth = 0;
+                functionContent = "";
+            }
+            if (inIdleFunction) {
+                functionContent += line + "\n";
+                braceDepth += (line.match(/\{/g) || []).length;
+                braceDepth -= (line.match(/\}/g) || []).length;
+                // End of function
+                if (braceDepth <= 0 && functionContent.length > 50) {
+                    // Check if this function has update() and proper activity reset
+                    if (functionContent.includes("update()") || functionContent.includes("await update")) {
+                        // Look for activity reset AFTER the update call
+                        const updateIndex = functionContent.indexOf("update");
+                        const afterUpdate = functionContent.substring(updateIndex);
+                        // Check for proper reset pattern in finally block or after try/catch
+                        const hasProperReset = (afterUpdate.includes("finally") &&
+                            afterUpdate.substring(afterUpdate.indexOf("finally")).includes("lastActivity") &&
+                            afterUpdate.substring(afterUpdate.indexOf("finally")).includes("Date.now()")) ||
+                            (afterUpdate.includes("lastActivity") &&
+                                afterUpdate.includes("Date.now()") &&
+                                afterUpdate.indexOf("lastActivity") > 10); // Not just the idle check
+                        if (!hasProperReset) {
+                            issues.push({
+                                file,
+                                line: functionStartLine,
+                                type: "idle-refresh-no-reset",
+                                severity: "warning",
+                                message: "Idle-based session refresh without activity timestamp reset in finally block",
+                                suggestion: "Add lastActivityRef.current = Date.now() in finally block after refresh",
+                            });
+                        }
+                    }
+                    inIdleFunction = false;
+                    functionContent = "";
+                }
+            }
+        }
+    }
+    return {
+        name: "Idle Refresh Activity Reset",
+        passed: issues.length === 0,
+        blocking: false,
+        issues,
+    };
+}
+/**
+ * Check 3: Session Update in Render Path
+ *
+ * Detects update() calls that could be triggered during render,
+ * causing infinite loops or unexpected behavior.
+ */
+async function checkUpdateInRenderPath() {
+    const issues = [];
+    const files = await getComponentFiles();
+    for (const file of files) {
+        const content = fs.readFileSync(file, "utf8");
+        if (!content.includes("update()") && !content.includes("update(")) {
+            continue;
+        }
+        const lines = content.split("\n");
+        // Track if we're inside useEffect
+        let inUseEffect = false;
+        let useEffectDepth = 0;
+        let useEffectStartLine = 0;
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // Track useEffect boundaries
+            if (line.includes("useEffect(")) {
+                inUseEffect = true;
+                useEffectDepth = 1;
+                useEffectStartLine = i;
+            }
+            if (inUseEffect) {
+                useEffectDepth += (line.match(/\{/g) || []).length;
+                useEffectDepth -= (line.match(/\}/g) || []).length;
+                if (useEffectDepth <= 0) {
+                    inUseEffect = false;
+                }
+            }
+            // Check for update() calls
+            if (line.includes("update()") || line.match(/\bupdate\s*\(/)) {
+                // Skip if it's in a callback, handler, or useEffect
+                const isInCallback = line.includes("onClick") ||
+                    line.includes("onSubmit") ||
+                    line.includes("onChange") ||
+                    line.includes("=> {") ||
+                    line.includes("async (");
+                const isInUseCallback = content.substring(0, content.indexOf(line)).includes("useCallback") &&
+                    !content.substring(content.indexOf(line)).startsWith("useCallback");
+                if (!inUseEffect && !isInCallback && !isInUseCallback) {
+                    // Check if it's at component body level (dangerous)
+                    const beforeLine = lines.slice(0, i).join("\n");
+                    const isTopLevel = !beforeLine.includes("const handle") &&
+                        !beforeLine.includes("function handle") &&
+                        !beforeLine.includes("async function") &&
+                        !beforeLine.includes("useCallback");
+                    if (isTopLevel && line.trim().startsWith("update")) {
+                        issues.push({
+                            file,
+                            line: i + 1,
+                            type: "update-in-render",
+                            severity: "error",
+                            message: "update() called in render path - can cause infinite loops",
+                            suggestion: "Move update() call to useEffect, useCallback, or event handler",
+                            code: line.trim(),
+                        });
+                    }
+                }
+            }
+        }
+    }
+    const hasErrors = issues.some((i) => i.severity === "error");
+    return {
+        name: "Update in Render Path",
+        passed: !hasErrors,
+        blocking: true,
+        issues,
+    };
+}
+/**
+ * Check 5: Programmatic Login Redirect Without Session Check
+ *
+ * Detects router.push('/login') calls that don't first verify the session
+ * is actually invalid, which can cause unnecessary redirects.
+ */
+async function checkProgrammaticLoginRedirect() {
+    const issues = [];
+    const files = await getComponentFiles();
+    for (const file of files) {
+        // Skip this preflight file and test files
+        if (file.includes("session-update-safety.ts") ||
+            file.includes(".test.") ||
+            file.includes(".spec.")) {
+            continue;
+        }
+        const content = fs.readFileSync(file, "utf8");
+        // Only check files that have router and login redirect
+        if (!content.includes("router") || !content.includes("/login")) {
+            continue;
+        }
+        // Skip registration/auth flow pages where login redirect is intentional
+        if (file.includes("/register/") ||
+            file.includes("/reset-password/") ||
+            file.includes("/verify-email/") ||
+            file.includes("/forgot-password/")) {
+            continue;
+        }
+        const lines = content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const trimmedLine = line.trim();
+            // Skip comments
+            if (trimmedLine.startsWith("//") || trimmedLine.startsWith("*")) {
+                continue;
+            }
+            // Look for router.push('/login') or router.replace('/login')
+            if ((line.includes("router.push") || line.includes("router.replace")) &&
+                (line.includes("/login") || line.includes('"/login"') || line.includes("'/login'"))) {
+                // Check context for proper session validation or intentional redirect
+                const contextStart = Math.max(0, i - 15);
+                const contextEnd = Math.min(lines.length, i + 3);
+                const context = lines.slice(contextStart, contextEnd).join("\n");
+                const hasSessionCheck = context.includes("!session") ||
+                    context.includes("session === null") ||
+                    context.includes('status === "unauthenticated"') ||
+                    context.includes('status === "unauthenticated"') ||
+                    context.includes('status !== "authenticated"') ||
+                    context.includes("!user") ||
+                    context.includes("catch") || // In error handler is OK
+                    context.includes("signOut") || // Part of logout flow is OK
+                    context.includes("handleLogin") || // Login handler is OK
+                    context.includes("handleLogout") || // Logout handler is OK
+                    context.includes("success") || // Success redirect is OK
+                    context.includes("registration") || // Registration flow is OK
+                    context.includes("message="); // Redirect with message is intentional
+                if (!hasSessionCheck) {
+                    issues.push({
+                        file,
+                        line: i + 1,
+                        type: "login-redirect-no-session-check",
+                        severity: "warning",
+                        message: "Redirect to /login without verifying session is invalid",
+                        suggestion: "Check session/status before redirecting: if (!session) router.push('/login')",
+                        code: trimmedLine,
+                    });
+                }
+            }
+        }
+    }
+    return {
+        name: "Login Redirect Validation",
+        passed: issues.length === 0,
+        blocking: false,
+        issues,
+    };
+}
+/**
+ * Check 6: Session-Dependent UI Without Loading State
+ *
+ * Detects components that render session-dependent content without
+ * handling the loading state, which can cause flash of wrong content.
+ */
+async function checkSessionLoadingState() {
+    const issues = [];
+    const files = await getComponentFiles();
+    for (const file of files) {
+        // Skip non-component files and this preflight
+        if (!file.endsWith(".tsx") ||
+            file.includes("session-update-safety.ts") ||
+            file.includes(".test.") ||
+            file.includes(".spec.")) {
+            continue;
+        }
+        const content = fs.readFileSync(file, "utf8");
+        // Only check files that use useSession
+        if (!content.includes("useSession")) {
+            continue;
+        }
+        // Check if status is destructured from useSession
+        const hasStatusDestructure = content.includes("status") &&
+            (content.includes("useSession()") || content.includes("useSession("));
+        // Check if there's a loading state check
+        const hasLoadingCheck = content.includes('status === "loading"') ||
+            content.includes("status === 'loading'") ||
+            content.includes('status === "authenticated"') ||
+            content.includes("isLoading") ||
+            content.includes("loading &&") ||
+            content.includes("loading ?");
+        // Check if session is used in conditional rendering
+        const usesSessionInRender = content.includes("session?.") ||
+            content.includes("session &&") ||
+            content.includes("session ?") ||
+            content.includes("{session.") ||
+            content.includes("!session");
+        if (usesSessionInRender && !hasLoadingCheck && !hasStatusDestructure) {
+            // Find the line where useSession is called
+            const lines = content.split("\n");
+            let useSessionLine = 1;
+            for (let i = 0; i < lines.length; i++) {
+                if (lines[i].includes("useSession")) {
+                    useSessionLine = i + 1;
+                    break;
+                }
+            }
+            issues.push({
+                file,
+                line: useSessionLine,
+                type: "session-no-loading-state",
+                severity: "info",
+                message: "Session used in render without loading state check - may cause content flash",
+                suggestion: 'Destructure status and check: if (status === "loading") return <Loading />',
+            });
+        }
+    }
+    return {
+        name: "Session Loading State",
+        passed: true, // Info only
+        blocking: false,
+        issues,
+    };
+}
+/**
+ * Check 7: SignOut Without Cleanup
+ *
+ * Detects signOut() calls that don't clear local state/storage,
+ * which can leave stale data after logout.
+ */
+async function checkSignOutCleanup() {
+    const issues = [];
+    const files = await getComponentFiles();
+    for (const file of files) {
+        // Skip this preflight, test files, and auth config files
+        if (file.includes("session-update-safety.ts") ||
+            file.includes(".test.") ||
+            file.includes(".spec.") ||
+            file.includes("lib/auth.ts") || // Auth config has event handlers, not actual calls
+            file.includes("lib/auth-") // Auth utility files
+        ) {
+            continue;
+        }
+        const content = fs.readFileSync(file, "utf8");
+        // Only check files that call signOut
+        if (!content.includes("signOut")) {
+            continue;
+        }
+        const lines = content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const trimmedLine = line.trim();
+            // Skip comments, imports, exports, and event handlers
+            if (trimmedLine.startsWith("//") ||
+                trimmedLine.startsWith("*") ||
+                trimmedLine.startsWith("import") ||
+                trimmedLine.startsWith("export") ||
+                trimmedLine.includes("async signOut()") || // Event handler definition
+                trimmedLine.includes("signOut:") // Object property
+            ) {
+                continue;
+            }
+            // Look for actual signOut() function calls (not definitions)
+            if (line.includes("signOut(") && line.includes("{") === false && !line.includes("import")) {
+                // Check surrounding context for cleanup
+                const contextStart = Math.max(0, i - 20);
+                const contextEnd = Math.min(lines.length, i + 5);
+                const context = lines.slice(contextStart, contextEnd).join("\n");
+                const hasCleanup = context.includes("localStorage") ||
+                    context.includes("sessionStorage") ||
+                    context.includes("clear()") ||
+                    context.includes("removeItem") ||
+                    context.includes("clearCookies") ||
+                    context.includes("clear-cookies") ||
+                    context.includes("reset") ||
+                    context.includes("cleanup");
+                if (!hasCleanup) {
+                    issues.push({
+                        file,
+                        line: i + 1,
+                        type: "signout-no-cleanup",
+                        severity: "info",
+                        message: "signOut() called without clearing local storage/state",
+                        suggestion: "Consider clearing localStorage/sessionStorage before signOut to prevent stale data",
+                        code: trimmedLine,
+                    });
+                }
+            }
+        }
+    }
+    return {
+        name: "SignOut Cleanup",
+        passed: true, // Info only
+        blocking: false,
+        issues,
+    };
+}
+/**
+ * Check 4: Missing Session Status Check Before Update
+ *
+ * Detects update() calls that don't check session status first,
+ * which can cause unnecessary API calls or errors.
+ */
+async function checkSessionStatusBeforeUpdate() {
+    const issues = [];
+    const files = await getComponentFiles();
+    for (const file of files) {
+        // Skip this preflight file itself
+        if (file.includes("session-update-safety.ts")) {
+            continue;
+        }
+        const content = fs.readFileSync(file, "utf8");
+        // Only check files with useSession and update
+        if (!content.includes("useSession") || !content.includes("update")) {
+            continue;
+        }
+        const lines = content.split("\n");
+        // Find functions that call update()
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const trimmedLine = line.trim();
+            // Skip comments
+            if (trimmedLine.startsWith("//") || trimmedLine.startsWith("*")) {
+                continue;
+            }
+            if (line.includes("await update()") || line.match(/await\s+update\s*\(/)) {
+                // Look at wider context - the whole function or 30 lines
+                const contextStart = Math.max(0, i - 30);
+                const context = lines.slice(contextStart, i + 1).join("\n");
+                // Check if there's a session/status check anywhere in the function context
+                const hasSessionCheck = context.includes("if (session)") ||
+                    context.includes("if (!session)") ||
+                    context.includes("session &&") ||
+                    context.includes("&& session") ||
+                    context.includes("status ===") ||
+                    context.includes("status !==") ||
+                    context.includes('status === "authenticated"') ||
+                    context.includes("IDLE_THRESHOLD") || // Idle check implies session awareness
+                    context.includes("idleTime"); // Idle check implies session awareness
+                if (!hasSessionCheck) {
+                    issues.push({
+                        file,
+                        line: i + 1,
+                        type: "update-without-session-check",
+                        severity: "info",
+                        message: "update() called without checking session status first",
+                        suggestion: 'Consider checking session exists or status === "authenticated" before update()',
+                    });
+                }
+            }
+        }
+    }
+    return {
+        name: "Session Status Check",
+        passed: true, // Info only
+        blocking: false,
+        issues,
+    };
+}
+function printResults(checks, verbose) {
+    console.log(`\n${console_chars_1.emoji.refresh} SESSION UPDATE SAFETY PREFLIGHT`);
+    console.log(`${console_chars_1.box.doubleHorizontal}`.repeat(70));
+    let totalErrors = 0;
+    let totalWarnings = 0;
+    let totalInfo = 0;
+    for (const check of checks) {
+        const icon = check.passed
+            ? `${console_chars_1.emoji.success}`
+            : check.blocking
+                ? `${console_chars_1.emoji.error}`
+                : `${console_chars_1.emoji.warning}`;
+        const issueCount = check.issues.length > 0 ? ` (${check.issues.length} issues)` : "";
+        console.log(`\n${icon} ${check.name}${issueCount}`);
+        if (check.issues.length > 0) {
+            const errors = check.issues.filter((i) => i.severity === "error");
+            const warnings = check.issues.filter((i) => i.severity === "warning");
+            const infos = check.issues.filter((i) => i.severity === "info");
+            totalErrors += errors.length;
+            totalWarnings += warnings.length;
+            totalInfo += infos.length;
+            if (errors.length > 0) {
+                console.log(`\n   ${console_chars_1.emoji.error} ERRORS (${errors.length}):`);
+                for (const issue of errors) {
+                    console.log(`      ${issue.file}:${issue.line}`);
+                    console.log(`         ${issue.message}`);
+                    if (issue.code)
+                        console.log(`         Code: ${issue.code}`);
+                    if (issue.suggestion)
+                        console.log(`         ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+                }
+            }
+            if (warnings.length > 0) {
+                console.log(`\n   ${console_chars_1.emoji.warning} WARNINGS (${warnings.length}):`);
+                for (const issue of warnings) {
+                    console.log(`      ${issue.file}:${issue.line}`);
+                    console.log(`         ${issue.message}`);
+                    if (verbose && issue.code)
+                        console.log(`         Code: ${issue.code}`);
+                    if (issue.suggestion)
+                        console.log(`         ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+                }
+            }
+            if (verbose && infos.length > 0) {
+                console.log(`\n   ${console_chars_1.emoji.info} INFO (${infos.length}):`);
+                for (const issue of infos) {
+                    console.log(`      ${issue.file}:${issue.line}`);
+                    console.log(`         ${issue.message}`);
+                }
+            }
+        }
+    }
+    console.log("\n" + `${console_chars_1.box.doubleHorizontal}`.repeat(70));
+    console.log(`${console_chars_1.emoji.chart} Summary: ${totalErrors} errors | ${totalWarnings} warnings | ${totalInfo} info`);
+    console.log(`${console_chars_1.box.doubleHorizontal}`.repeat(70));
+    const hasBlockingFailure = checks.some((c) => !c.passed && c.blocking);
+    if (hasBlockingFailure) {
+        console.log(`\n${console_chars_1.emoji.error} SESSION UPDATE SAFETY FAILED - fix errors before deploying\n`);
+    }
+    else if (totalWarnings > 0) {
+        console.log(`\n${console_chars_1.emoji.warning} SESSION UPDATE SAFETY PASSED with warnings\n`);
+    }
+    else {
+        console.log(`\n${console_chars_1.emoji.success} SESSION UPDATE SAFETY PASSED\n`);
+    }
+    console.log(`${console_chars_1.emoji.clipboard} Safe update() Patterns:`);
+    console.log(`   ${console_chars_1.chars.bullet} Always capture return: const result = await update();`);
+    console.log(`   ${console_chars_1.chars.bullet} Handle null gracefully: if (!result) { /* don't redirect */ }`);
+    console.log(`   ${console_chars_1.chars.bullet} Wrap in try/catch for click handlers`);
+    console.log(`   ${console_chars_1.chars.bullet} Reset activity timestamp after idle refresh attempts\n`);
+    return hasBlockingFailure;
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const verbose = args.includes("--verbose") || args.includes("-v");
+    const checks = [];
+    // Core checks (warnings/errors)
+    checks.push(await checkUnhandledUpdateReturn());
+    checks.push(await checkIdleRefreshPattern());
+    checks.push(await checkUpdateInRenderPath());
+    checks.push(await checkProgrammaticLoginRedirect());
+    // Info-level checks (best practices)
+    checks.push(await checkSessionStatusBeforeUpdate());
+    checks.push(await checkSessionLoadingState());
+    checks.push(await checkSignOutCleanup());
+    const failed = printResults(checks, verbose);
+    process.exit(failed ? 1 : 0);
+}
+main().catch(console.error);
+//# sourceMappingURL=session-update-safety.js.map