@empline/preflight 1.1.0

package/dist/checks/runtime/dev-error-monitoring-system.js

@@ -0,0 +1,210 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Preflight: Dev Error Monitoring System
+ *
+ * Enforces that our dev-only error monitoring (runtime-errors.json + /dev/errors dashboard)
+ * is wired correctly and remains available for `pnpm dev` workflows.
+ *
+ * This preflight is intentionally static (file/regex checks only) so it can run in CI/Vercel
+ * without depending on runtime filesystem state.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.run = run;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const findings_writer_1 = require("../../utils/findings-writer");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Check metadata
+exports.id = "runtime/dev-error-monitoring-system";
+exports.name = "Dev Error Monitoring System";
+exports.category = "runtime";
+exports.blocking = false;
+exports.description = "Preflight: Dev Error Monitoring System";
+exports.tags = ["runtime"];
+const WORKSPACE_ROOT = process.cwd();
+const REQUIRED_FILES = [
+    "components/dev/DevErrorBoundary.tsx",
+    "app/providers.tsx",
+    "app/api/dev/errors/route.ts",
+    "app/dev/errors/page.tsx",
+    ".kiro/hooks/on-runtime-error.js",
+    ".gitignore",
+];
+function readFile(relPath) {
+    const abs = path.join(WORKSPACE_ROOT, relPath);
+    if (!fs.existsSync(abs))
+        return null;
+    return fs.readFileSync(abs, "utf8");
+}
+function fileExists(relPath) {
+    return fs.existsSync(path.join(WORKSPACE_ROOT, relPath));
+}
+function findFirstLineNumber(content, needle) {
+    const idx = content.indexOf(needle);
+    if (idx < 0)
+        return undefined;
+    return content.slice(0, idx).split(/\r?\n/).length;
+}
+async function run() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(exports.name);
+    const findings = [];
+    for (const rel of REQUIRED_FILES) {
+        if (!fileExists(rel)) {
+            findings.push({
+                severity: "error",
+                message: `Missing required dev error monitoring file: ${rel}`,
+                file: rel,
+            });
+        }
+    }
+    const devBoundary = readFile("components/dev/DevErrorBoundary.tsx");
+    if (devBoundary) {
+        if (!devBoundary.includes("/api/dev/errors")) {
+            findings.push({
+                severity: "error",
+                message: "DevErrorBoundary must POST to /api/dev/errors",
+                file: "components/dev/DevErrorBoundary.tsx",
+                line: findFirstLineNumber(devBoundary, "DevErrorBoundary") || 1,
+            });
+        }
+        if (!devBoundary.includes("publicEnv.NODE_ENV")) {
+            findings.push({
+                severity: "warning",
+                message: "DevErrorBoundary should be gated by publicEnv.NODE_ENV for dev-only behavior",
+                file: "components/dev/DevErrorBoundary.tsx",
+                line: 1,
+            });
+        }
+    }
+    const providers = readFile("app/providers.tsx");
+    if (providers) {
+        if (!providers.includes("DevErrorBoundary")) {
+            findings.push({
+                severity: "error",
+                message: "app/providers.tsx must mount <DevErrorBoundary> so React errors are captured in dev",
+                file: "app/providers.tsx",
+                line: findFirstLineNumber(providers, "export function Providers") || 1,
+            });
+        }
+        if (!providers.includes("<DevErrorBoundary")) {
+            findings.push({
+                severity: "error",
+                message: "app/providers.tsx must wrap children with <DevErrorBoundary>",
+                file: "app/providers.tsx",
+                line: findFirstLineNumber(providers, "DevErrorBoundary") || 1,
+            });
+        }
+    }
+    const apiRoute = readFile("app/api/dev/errors/route.ts");
+    if (apiRoute) {
+        if (!apiRoute.includes("env.NODE_ENV") || !apiRoute.includes("development")) {
+            findings.push({
+                severity: "error",
+                message: "app/api/dev/errors/route.ts must be dev-only gated (env.NODE_ENV !== 'development')",
+                file: "app/api/dev/errors/route.ts",
+                line: 1,
+            });
+        }
+        if (!apiRoute.includes("runtime-errors.json")) {
+            findings.push({
+                severity: "error",
+                message: "app/api/dev/errors/route.ts must read/write runtime-errors.json",
+                file: "app/api/dev/errors/route.ts",
+                line: 1,
+            });
+        }
+    }
+    const dashboard = readFile("app/dev/errors/page.tsx");
+    if (dashboard) {
+        if (!dashboard.includes("/api/dev/errors")) {
+            findings.push({
+                severity: "error",
+                message: "Dev errors dashboard must call /api/dev/errors",
+                file: "app/dev/errors/page.tsx",
+                line: 1,
+            });
+        }
+        if (!dashboard.includes("publicEnv.NODE_ENV")) {
+            findings.push({
+                severity: "warning",
+                message: "Dev errors dashboard should be gated by publicEnv.NODE_ENV (dev-only UX)",
+                file: "app/dev/errors/page.tsx",
+                line: 1,
+            });
+        }
+    }
+    const gitignore = readFile(".gitignore");
+    if (gitignore && !gitignore.split(/\r?\n/).some((l) => l.trim() === "runtime-errors.json")) {
+        findings.push({
+            severity: "error",
+            message: "runtime-errors.json must be gitignored",
+            file: ".gitignore",
+            line: findFirstLineNumber(gitignore, "runtime-errors.json"),
+        });
+    }
+    (0, findings_writer_1.writeFindings)(findings.map((f) => ({
+        severity: f.severity,
+        message: f.message,
+        file: f.file,
+        range: f.line
+            ? { startLine: f.line, startColumn: 1, endLine: f.line, endColumn: 1 }
+            : undefined,
+    })));
+    const errors = findings.filter((f) => f.severity === "error").length;
+    const warnings = findings.filter((f) => f.severity === "warning").length;
+    if (errors === 0 && warnings === 0) {
+        console.log(`${console_chars_1.emoji.success} Preflight: Dev error monitoring system is wired`);
+        return { errors: 0, warnings: 0 };
+    }
+    if (errors > 0) {
+        console.log(`${console_chars_1.emoji.error} Preflight: Dev error monitoring system has ${errors} error(s)`);
+    }
+    else {
+        console.log(`${console_chars_1.emoji.warning} Preflight: Dev error monitoring system has ${warnings} warning(s)`);
+    }
+    for (const f of findings) {
+        const loc = f.line ? `:${f.line}` : "";
+        console.log(`- [${f.severity}] ${f.file}${loc} - ${f.message}`);
+    }
+    return { errors, warnings };
+}
+if (require.main === module) {
+    run().catch(console.error);
+}
+//# sourceMappingURL=dev-error-monitoring-system.js.map

package/dist/checks/runtime/dev-error-monitoring-system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-error-monitoring-system.js","sourceRoot":"","sources":["../../../src/checks/runtime/dev-error-monitoring-system.ts"],"names":[],"mappings":";;AACA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDH,kBA+IC;AAjMD,uCAAyB;AACzB,2CAA6B;AAE7B,6DAAkD;AAClD,iEAA4D;AAC5D,uFAAwF;AAGxF,iBAAiB;AACJ,QAAA,EAAE,GAAG,qCAAqC,CAAC;AAC3C,QAAA,IAAI,GAAG,6BAA6B,CAAC;AACrC,QAAA,QAAQ,GAAG,SAAS,CAAC;AACrB,QAAA,QAAQ,GAAG,KAAK,CAAC;AACjB,QAAA,WAAW,GAAG,wCAAwC,CAAC;AACvD,QAAA,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAShC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAErC,MAAM,cAAc,GAAG;IACrB,qCAAqC;IACrC,mBAAmB;IACnB,6BAA6B;IAC7B,yBAAyB;IACzB,iCAAiC;IACjC,YAAY;CACJ,CAAC;AAEX,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe,EAAE,MAAc;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC;AAEM,KAAK,UAAU,GAAG;IACvB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,YAAI,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,+CAA+C,GAAG,EAAE;gBAC7D,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IACpE,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,+CAA+C;gBACxD,IAAI,EAAE,qCAAqC;gBAC3C,IAAI,EAAE,mBAAmB,CAAC,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,8EAA8E;gBACvF,IAAI,EAAE,qCAAqC;gBAC3C,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,qFAAqF;gBACvF,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,mBAAmB,CAAC,SAAS,EAAE,2BAA2B,CAAC,IAAI,CAAC;aACvE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,8DAA8D;gBACvE,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,mBAAmB,CAAC,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IACzD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5E,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,qFAAqF;gBACvF,IAAI,EAAE,6BAA6B;gBACnC,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,iEAAiE;gBAC1E,IAAI,EAAE,6BAA6B;gBACnC,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IACtD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,gDAAgD;gBACzD,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,0EAA0E;gBACnF,IAAI,EAAE,yBAAyB;gBAC/B,IAAI,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,qBAAqB,CAAC,EAAE,CAAC;QAC3F,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,wCAAwC;YACjD,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,mBAAmB,CAAC,SAAS,EAAE,qBAAqB,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,IAAA,+BAAa,EACX,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,IAAI;YACX,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;YACtE,CAAC,CAAC,SAAS;KACd,CAAC,CAAC,CACJ,CAAC;IAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAEzE,IAAI,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;QAChF,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,+CAA+C,MAAM,WAAW,CAAC,CAAC;IAC9F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,OAAO,+CAA+C,QAAQ,aAAa,CACrF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/checks/runtime/gtm-installation.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env tsx
+/**
+ * Runtime GTM Installation Preflight (BLOCKING)
+ *
+ * Ensures GTM is installed in a nominal, maintainable way:
+ * - Root layout includes the GTM script loader + <noscript> iframe
+ * - Installation is gated by NEXT_PUBLIC_ENABLE_ANALYTICS and NEXT_PUBLIC_GTM_ID
+ * - publicEnv exposes NEXT_PUBLIC_GTM_ID
+ * - Env templates default analytics off for local/preview and on for production
+ * - Templates include NEXT_PUBLIC_GTM_ID where expected
+ *
+ * Note: This is intentionally a static check. It does NOT validate your GTM container
+ * setup or whether Tag Gateway rewrites the gtm.js host at runtime.
+ */
+export declare const id = "runtime/gtm-installation";
+export declare const name = "Gtm Installation";
+export declare const category = "runtime";
+export declare const blocking = true;
+export declare const description = "Runtime GTM Installation Preflight (BLOCKING)";
+export declare const tags: string[];
+export declare function run(): Promise<void>;
+//# sourceMappingURL=gtm-installation.d.ts.map

package/dist/checks/runtime/gtm-installation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gtm-installation.d.ts","sourceRoot":"","sources":["../../../src/checks/runtime/gtm-installation.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAUH,eAAO,MAAM,EAAE,6BAA6B,CAAC;AAC7C,eAAO,MAAM,IAAI,qBAAqB,CAAC;AACvC,eAAO,MAAM,QAAQ,YAAY,CAAC;AAClC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,kDAAkD,CAAC;AAC3E,eAAO,MAAM,IAAI,UAAc,CAAC;AA8HhC,wBAAsB,GAAG,kBAwNxB"}

package/dist/checks/runtime/gtm-installation.js

@@ -0,0 +1,343 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Runtime GTM Installation Preflight (BLOCKING)
+ *
+ * Ensures GTM is installed in a nominal, maintainable way:
+ * - Root layout includes the GTM script loader + <noscript> iframe
+ * - Installation is gated by NEXT_PUBLIC_ENABLE_ANALYTICS and NEXT_PUBLIC_GTM_ID
+ * - publicEnv exposes NEXT_PUBLIC_GTM_ID
+ * - Env templates default analytics off for local/preview and on for production
+ * - Templates include NEXT_PUBLIC_GTM_ID where expected
+ *
+ * Note: This is intentionally a static check. It does NOT validate your GTM container
+ * setup or whether Tag Gateway rewrites the gtm.js host at runtime.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.run = run;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Check metadata
+exports.id = "runtime/gtm-installation";
+exports.name = "Gtm Installation";
+exports.category = "runtime";
+exports.blocking = true;
+exports.description = "Runtime GTM Installation Preflight (BLOCKING)";
+exports.tags = ["runtime"];
+function rel(filePath) {
+    return path.relative(process.cwd(), filePath).replace(/\\/g, "/");
+}
+function readTextOrEmpty(filePath) {
+    try {
+        return fs.readFileSync(filePath, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+function requireIncludes(opts) {
+    const { issues, filePath, content, description, needles } = opts;
+    for (const needle of needles) {
+        const ok = typeof needle === "string" ? content.includes(needle) : needle.test(content);
+        if (!ok) {
+            issues.push({
+                file: filePath,
+                severity: "error",
+                message: `${description} is missing required marker: ${String(needle)}`,
+            });
+        }
+    }
+}
+function getEnvValueFromTemplate(content, key) {
+    const lines = content.split(/\r?\n/);
+    for (const rawLine of lines) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        if (!line.startsWith(key + "="))
+            continue;
+        return line.slice((key + "=").length).trim();
+    }
+    return null;
+}
+function normalizeEnvScalar(value) {
+    if (!value)
+        return "";
+    return value.replace(/^"|"$/g, "").replace(/^'|'$/g, "").trim();
+}
+function ensureEnvKeyExists(opts) {
+    const { issues, filePath, content, key } = opts;
+    if (!content) {
+        issues.push({
+            file: filePath,
+            severity: "error",
+            message: `Missing ${rel(filePath)} (required for GTM env defaults check).`,
+        });
+        return;
+    }
+    const actualRaw = getEnvValueFromTemplate(content, key);
+    if (actualRaw === null) {
+        issues.push({
+            file: filePath,
+            severity: "error",
+            message: `Missing ${key} in ${rel(filePath)}.`,
+        });
+    }
+}
+function ensureCspAllowsGtm(opts) {
+    const { issues, filePath, content } = opts;
+    if (!content) {
+        issues.push({
+            file: filePath,
+            severity: "error",
+            message: `Missing ${rel(filePath)} (required for GTM CSP allowlist check).`,
+        });
+        return;
+    }
+    const hasGtmHost = /googletagmanager\.com/i.test(content);
+    const hasScriptSrcElem = /script-src-elem/i.test(content);
+    const hasScriptSrc = /script-src\b/i.test(content);
+    if (!hasGtmHost || (!hasScriptSrcElem && !hasScriptSrc)) {
+        issues.push({
+            file: filePath,
+            severity: "error",
+            message: "CSP must allow https://www.googletagmanager.com (via script-src-elem or script-src) so gtm.js can load in production.",
+        });
+    }
+    // Check that script-src-elem includes 'unsafe-inline' for GTM inline scripts
+    // GTM injects inline scripts that will be blocked without this directive
+    const scriptSrcElemMatch = content.match(/script-src-elem\s+([^;]+)/i);
+    if (scriptSrcElemMatch) {
+        const scriptSrcElemValue = scriptSrcElemMatch[1];
+        if (!/'unsafe-inline'/.test(scriptSrcElemValue)) {
+            issues.push({
+                file: filePath,
+                severity: "error",
+                message: "CSP script-src-elem must include 'unsafe-inline' for GTM inline scripts to execute. Without this, GTM will fail with CSP violations.",
+            });
+        }
+    }
+}
+async function run() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(exports.name);
+    const issues = [];
+    const layoutPath = path.join(process.cwd(), "app", "layout.tsx");
+    const publicEnvPath = path.join(process.cwd(), "lib", "public-env.ts");
+    const proxyPath = path.join(process.cwd(), "proxy.ts");
+    const layout = readTextOrEmpty(layoutPath);
+    const publicEnv = readTextOrEmpty(publicEnvPath);
+    const proxyFile = readTextOrEmpty(proxyPath);
+    if (!layout) {
+        issues.push({
+            file: layoutPath,
+            severity: "error",
+            message: "Missing app/layout.tsx (required for GTM installation check).",
+        });
+    }
+    else {
+        requireIncludes({
+            issues,
+            filePath: layoutPath,
+            content: layout,
+            description: "Root layout GTM gating",
+            needles: [
+                "NEXT_PUBLIC_ENABLE_ANALYTICS",
+                "NEXT_PUBLIC_GTM_ID",
+                // Keep these checks flexible to survive formatting changes.
+                /analyticsEnabled/,
+                /shouldLoadGtm/,
+            ],
+        });
+        requireIncludes({
+            issues,
+            filePath: layoutPath,
+            content: layout,
+            description: "Root layout GTM script snippet",
+            needles: ["https://www.googletagmanager.com/gtm.js?id=", "dataLayer", "gtm.js"],
+        });
+        requireIncludes({
+            issues,
+            filePath: layoutPath,
+            content: layout,
+            description: "Root layout noscript fallback",
+            needles: ["<noscript>", "https://www.googletagmanager.com/ns.html?id="],
+        });
+    }
+    if (!publicEnv) {
+        issues.push({
+            file: publicEnvPath,
+            severity: "error",
+            message: "Missing lib/public-env.ts (required for GTM env wiring check).",
+        });
+    }
+    else {
+        requireIncludes({
+            issues,
+            filePath: publicEnvPath,
+            content: publicEnv,
+            description: "publicEnv exposure",
+            needles: ["NEXT_PUBLIC_GTM_ID"],
+        });
+    }
+    // CSP should allow GTM script load (gtm.js). We enforce this in proxy.ts, not middleware.
+    ensureCspAllowsGtm({ issues, filePath: proxyPath, content: proxyFile });
+    // Env template expectations
+    const localTemplate = path.join(process.cwd(), "docs", "env-templates", ".env.local.template");
+    const localExample = path.join(process.cwd(), "docs", "env-templates", ".env.local.example");
+    const previewTemplate = path.join(process.cwd(), "docs", "env-templates", ".env.preview.template");
+    const productionTemplate = path.join(process.cwd(), "docs", "env-templates", ".env.production.template");
+    const rootEnvExample = path.join(process.cwd(), ".env.example");
+    const vercelTemplate = path.join(process.cwd(), "docs", "env-templates", ".env.vercel.template");
+    const localTemplateText = readTextOrEmpty(localTemplate);
+    const localExampleText = readTextOrEmpty(localExample);
+    const previewTemplateText = readTextOrEmpty(previewTemplate);
+    const productionTemplateText = readTextOrEmpty(productionTemplate);
+    const rootEnvExampleText = readTextOrEmpty(rootEnvExample);
+    const vercelTemplateText = readTextOrEmpty(vercelTemplate);
+    const ensureEnvValue = (filePath, content, key, expected) => {
+        if (!content) {
+            issues.push({
+                file: filePath,
+                severity: "error",
+                message: `Missing ${rel(filePath)} (required for GTM env defaults check).`,
+            });
+            return;
+        }
+        const actualRaw = getEnvValueFromTemplate(content, key);
+        const actual = normalizeEnvScalar(actualRaw);
+        if (actualRaw === null) {
+            issues.push({
+                file: filePath,
+                severity: "error",
+                message: `Missing ${key} in ${rel(filePath)} (expected ${expected}).`,
+            });
+            return;
+        }
+        if (actual.toLowerCase() !== expected.toLowerCase()) {
+            issues.push({
+                file: filePath,
+                severity: "error",
+                message: `${key} in ${rel(filePath)} is ${JSON.stringify(actual)}; expected ${JSON.stringify(expected)}.`,
+            });
+        }
+    };
+    // Local/dev defaults OFF
+    ensureEnvValue(localTemplate, localTemplateText, "NEXT_PUBLIC_ENABLE_ANALYTICS", "false");
+    ensureEnvValue(localExample, localExampleText, "NEXT_PUBLIC_ENABLE_ANALYTICS", "false");
+    ensureEnvKeyExists({
+        issues,
+        filePath: localTemplate,
+        content: localTemplateText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    ensureEnvKeyExists({
+        issues,
+        filePath: localExample,
+        content: localExampleText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    // Preview defaults OFF
+    ensureEnvValue(previewTemplate, previewTemplateText, "NEXT_PUBLIC_ENABLE_ANALYTICS", "false");
+    ensureEnvKeyExists({
+        issues,
+        filePath: previewTemplate,
+        content: previewTemplateText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    // Production defaults ON
+    ensureEnvValue(productionTemplate, productionTemplateText, "NEXT_PUBLIC_ENABLE_ANALYTICS", "true");
+    ensureEnvKeyExists({
+        issues,
+        filePath: productionTemplate,
+        content: productionTemplateText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    // Root env example should include analytics keys for discovery.
+    ensureEnvKeyExists({
+        issues,
+        filePath: rootEnvExample,
+        content: rootEnvExampleText,
+        key: "NEXT_PUBLIC_ENABLE_ANALYTICS",
+    });
+    ensureEnvKeyExists({
+        issues,
+        filePath: rootEnvExample,
+        content: rootEnvExampleText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    // Vercel template should include analytics keys.
+    ensureEnvKeyExists({
+        issues,
+        filePath: vercelTemplate,
+        content: vercelTemplateText,
+        key: "NEXT_PUBLIC_ENABLE_ANALYTICS",
+    });
+    ensureEnvKeyExists({
+        issues,
+        filePath: vercelTemplate,
+        content: vercelTemplateText,
+        key: "NEXT_PUBLIC_GTM_ID",
+    });
+    // Ensure production GTM id is at least placeholder-shaped (GTM-XXXXXXX)
+    if (productionTemplateText) {
+        const raw = getEnvValueFromTemplate(productionTemplateText, "NEXT_PUBLIC_GTM_ID");
+        const normalized = normalizeEnvScalar(raw);
+        if (normalized && !/^GTM-/i.test(normalized)) {
+            issues.push({
+                file: productionTemplate,
+                severity: "error",
+                message: `NEXT_PUBLIC_GTM_ID in ${rel(productionTemplate)} should look like a GTM container id (e.g. GTM-XXXXXXX).`,
+            });
+        }
+    }
+    if (issues.length === 0) {
+        console.log(`${console_chars_1.emoji.success} Runtime GTM Installation: OK`);
+        return;
+    }
+    console.error(`${console_chars_1.emoji.error} Runtime GTM Installation: FAILED`);
+    for (const issue of issues) {
+        console.error(`- ${rel(issue.file)}: ${issue.message}`);
+    }
+    process.exit(1);
+}
+// Allow direct execution
+if (require.main === module) {
+    run().catch(console.error);
+}
+//# sourceMappingURL=gtm-installation.js.map

package/dist/checks/runtime/gtm-installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gtm-installation.js","sourceRoot":"","sources":["../../../src/checks/runtime/gtm-installation.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6IH,kBAwNC;AAnWD,uCAAyB;AACzB,2CAA6B;AAE7B,6DAAkD;AAClD,uFAAwF;AAGxF,iBAAiB;AACJ,QAAA,EAAE,GAAG,0BAA0B,CAAC;AAChC,QAAA,IAAI,GAAG,kBAAkB,CAAC;AAC1B,QAAA,QAAQ,GAAG,SAAS,CAAC;AACrB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,+CAA+C,CAAC;AAC9D,QAAA,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAQhC,SAAS,GAAG,CAAC,QAAgB;IAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAMxB;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAEjE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAExF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,GAAG,WAAW,gCAAgC,MAAM,CAAC,MAAM,CAAC,EAAE;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;YAAE,SAAS;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAoB;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAK3B;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEhD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,WAAW,GAAG,CAAC,QAAQ,CAAC,yCAAyC;SAC3E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,WAAW,GAAG,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA4D;IACtF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,WAAW,GAAG,CAAC,QAAQ,CAAC,0CAA0C;SAC5E,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,OAAO;YACjB,OAAO,EACL,uHAAuH;SAC1H,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACvE,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,sIAAsI;aACzI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,GAAG;IACvB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,YAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAE7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,+DAA+D;SACzE,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,eAAe,CAAC;YACd,MAAM;YACN,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,wBAAwB;YACrC,OAAO,EAAE;gBACP,8BAA8B;gBAC9B,oBAAoB;gBACpB,4DAA4D;gBAC5D,kBAAkB;gBAClB,eAAe;aAChB;SACF,CAAC,CAAC;QAEH,eAAe,CAAC;YACd,MAAM;YACN,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,gCAAgC;YAC7C,OAAO,EAAE,CAAC,6CAA6C,EAAE,WAAW,EAAE,QAAQ,CAAC;SAChF,CAAC,CAAC;QAEH,eAAe,CAAC;YACd,MAAM;YACN,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,+BAA+B;YAC5C,OAAO,EAAE,CAAC,YAAY,EAAE,8CAA8C,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,eAAe,CAAC;YACd,MAAM;YACN,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,oBAAoB;YACjC,OAAO,EAAE,CAAC,oBAAoB,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,0FAA0F;IAC1F,kBAAkB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAExE,4BAA4B;IAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IAC7F,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,OAAO,CAAC,GAAG,EAAE,EACb,MAAM,EACN,eAAe,EACf,uBAAuB,CACxB,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAClC,OAAO,CAAC,GAAG,EAAE,EACb,MAAM,EACN,eAAe,EACf,0BAA0B,CAC3B,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAEjG,MAAM,iBAAiB,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,sBAAsB,GAAG,eAAe,CAAC,kBAAkB,CAAC,CAAC;IACnE,MAAM,kBAAkB,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,kBAAkB,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAE3D,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,QAAgB,EAAE,EAAE;QAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,WAAW,GAAG,CAAC,QAAQ,CAAC,yCAAyC;aAC3E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAE7C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,WAAW,GAAG,OAAO,GAAG,CAAC,QAAQ,CAAC,cAAc,QAAQ,IAAI;aACtE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,GAAG,GAAG,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;aAC1G,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,yBAAyB;IACzB,cAAc,CAAC,aAAa,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,OAAO,CAAC,CAAC;IAC1F,cAAc,CAAC,YAAY,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,OAAO,CAAC,CAAC;IACxF,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,iBAAiB;QAC1B,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IACH,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,gBAAgB;QACzB,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IAEH,uBAAuB;IACvB,cAAc,CAAC,eAAe,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,OAAO,CAAC,CAAC;IAC9F,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,eAAe;QACzB,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IAEH,yBAAyB;IACzB,cAAc,CACZ,kBAAkB,EAClB,sBAAsB,EACtB,8BAA8B,EAC9B,MAAM,CACP,CAAC;IACF,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,sBAAsB;QAC/B,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IAEH,gEAAgE;IAChE,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,8BAA8B;KACpC,CAAC,CAAC;IACH,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IAEH,iDAAiD;IACjD,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,8BAA8B;KACpC,CAAC,CAAC;IACH,kBAAkB,CAAC;QACjB,MAAM;QACN,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,oBAAoB;KAC1B,CAAC,CAAC;IAEH,wEAAwE;IACxE,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,uBAAuB,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;QAClF,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,yBAAyB,GAAG,CAAC,kBAAkB,CAAC,0DAA0D;aACpH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,GAAG,qBAAK,CAAC,KAAK,mCAAmC,CAAC,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAGD,yBAAyB;AACzB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/checks/runtime/json-parse-safety.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env tsx
+/**
+ * JSON.parse Safety Preflight (BLOCKING)
+ *
+ * Prevent runtime crashes from JSON.parse() on untrusted request bodies
+ * without guardrails.
+ *
+ * Scope:
+ * - app/api/ (route handlers)
+ *
+ * Heuristic:
+ * - Taint variables assigned from `await request.text()`
+ * - Flag `JSON.parse(taintedVar)` unless the file appears to have try/catch
+ *   or a safe helper is used.
+ */
+export declare const id = "runtime/json-parse-safety";
+export declare const name = "Json Parse Safety";
+export declare const category = "runtime";
+export declare const blocking = true;
+export declare const description = "JSON.parse Safety Preflight (BLOCKING)";
+export declare const tags: string[];
+//# sourceMappingURL=json-parse-safety.d.ts.map

package/dist/checks/runtime/json-parse-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-parse-safety.d.ts","sourceRoot":"","sources":["../../../src/checks/runtime/json-parse-safety.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG;AAYH,eAAO,MAAM,EAAE,8BAA8B,CAAC;AAC9C,eAAO,MAAM,IAAI,sBAAsB,CAAC;AACxC,eAAO,MAAM,QAAQ,YAAY,CAAC;AAClC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,2CAA2C,CAAC;AACpE,eAAO,MAAM,IAAI,UAAc,CAAC"}