@empline/preflight 1.1.0

package/dist/checks/runtime/json-parse-safety.js

@@ -0,0 +1,179 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * JSON.parse Safety Preflight (BLOCKING)
+ *
+ * Prevent runtime crashes from JSON.parse() on untrusted request bodies
+ * without guardrails.
+ *
+ * Scope:
+ * - app/api/ (route handlers)
+ *
+ * Heuristic:
+ * - Taint variables assigned from `await request.text()`
+ * - Flag `JSON.parse(taintedVar)` unless the file appears to have try/catch
+ *   or a safe helper is used.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const console_chars_1 = require("../../utils/console-chars");
+const file_cache_1 = require("../../shared/file-cache");
+const glob_patterns_1 = require("../../shared/glob-patterns");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+const findings_writer_1 = require("../../utils/findings-writer");
+// Check metadata
+exports.id = "runtime/json-parse-safety";
+exports.name = "Json Parse Safety";
+exports.category = "runtime";
+exports.blocking = true;
+exports.description = "JSON.parse Safety Preflight (BLOCKING)";
+exports.tags = ["runtime"];
+const EXCLUDED = (0, glob_patterns_1.extendExcludes)(glob_patterns_1.STANDARD_EXCLUDES_WITH_TESTS, [
+    "**/scripts/**",
+    "**/test-results/**",
+]);
+function normalizeRel(p) {
+    return p.replace(/\\/g, "/");
+}
+function snippetFrom(text, idx) {
+    const start = Math.max(0, idx - 60);
+    const end = Math.min(text.length, idx + 120);
+    return text.slice(start, end).replace(/\s+/g, " ").trim();
+}
+function taintRequestTextAssignments(content) {
+    const tainted = new Set();
+    // Matches: const rawBody = await request.text();
+    const assignRe = /(const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*await\s+\w+\s*\.\s*text\s*\(\s*\)\s*;/g;
+    let m;
+    while ((m = assignRe.exec(content)) !== null) {
+        if (m[2])
+            tainted.add(m[2]);
+    }
+    return tainted;
+}
+function fileHasTryCatch(content) {
+    return /\btry\s*\{/.test(content) && /\bcatch\s*\(/.test(content);
+}
+function isSafeParseUsage(argExpr) {
+    const expr = argExpr.trim();
+    if (!expr)
+        return true;
+    // Safe: JSON.parse(JSON.stringify(...)) used to deep clone known-good objects
+    if (/JSON\.parse\s*\(\s*JSON\.stringify\s*\(/.test(expr))
+        return true;
+    // Safe helpers
+    if (/safeJsonParse\s*\(/.test(expr))
+        return true;
+    if (/parseJsonSafely\s*\(/.test(expr))
+        return true;
+    return false;
+}
+async function main() {
+    console.log(`\n${console_chars_1.emoji.lightning} JSON.parse SAFETY (BLOCKING)`);
+    console.log((0, console_chars_1.createDivider)(80, "heavy"));
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)("JSON.parse Safety");
+    const files = await file_cache_1.fileCache.getFiles("app/api/**/*.{ts,tsx}", { ignore: EXCLUDED });
+    const issues = [];
+    await reporter.processFiles(files, async (file) => {
+        const rel = normalizeRel(path.relative(process.cwd(), file));
+        const content = fs.readFileSync(file, "utf8");
+        if (!content.includes("JSON.parse("))
+            return;
+        const taintedVars = taintRequestTextAssignments(content);
+        if (taintedVars.size === 0)
+            return;
+        const hasTryCatch = fileHasTryCatch(content);
+        // Find JSON.parse calls
+        const parseRe = /JSON\.parse\s*\(\s*([^\)\n;]+)\s*\)/g;
+        let m;
+        while ((m = parseRe.exec(content)) !== null) {
+            const arg = (m[1] || "").trim();
+            if (!arg)
+                continue;
+            if (isSafeParseUsage(m[0]))
+                continue;
+            const simpleArg = arg.replace(/\s+/g, "");
+            const isTainted = taintedVars.has(simpleArg);
+            if (!isTainted)
+                continue;
+            // If the file already has a try/catch (common for API routes), we consider this protected.
+            // This is a pragmatic heuristic to avoid noisy false positives.
+            if (hasTryCatch)
+                continue;
+            const lc = (0, findings_writer_1.indexToLineCol)(content, m.index);
+            issues.push({
+                file: rel,
+                line: lc.line,
+                col: lc.col,
+                message: "JSON.parse() on request.text() data without try/catch",
+                suggestion: "Wrap parsing in try/catch and return 400 on invalid JSON, or use a safeJsonParse() helper.",
+                snippet: snippetFrom(content, m.index),
+            });
+        }
+    });
+    const findings = issues.map((i) => ({
+        severity: "error",
+        code: "json_parse_unguarded",
+        message: `${i.message}. ${i.suggestion}`,
+        file: i.file,
+        range: { startLine: i.line, startColumn: i.col },
+    }));
+    (0, findings_writer_1.writeFindings)(findings);
+    if (issues.length > 0) {
+        console.log(`\n${console_chars_1.emoji.error} BLOCKING: ${issues.length} JSON.parse issue(s) found`);
+        console.log((0, console_chars_1.createDivider)(80, "heavy"));
+        for (const i of issues.slice(0, 25)) {
+            console.log(`${console_chars_1.emoji.error} ${i.file}:${i.line}:${i.col}`);
+            console.log(`  ${i.message}`);
+            console.log(`  Suggestion: ${i.suggestion}`);
+            console.log(`  Snippet: ${i.snippet}`);
+            console.log();
+        }
+        if (issues.length > 25) {
+            console.log(`... and ${issues.length - 25} more`);
+        }
+        process.exit(1);
+    }
+    console.log(`\n${console_chars_1.emoji.success} JSON.parse usage appears guarded for request bodies`);
+    process.exit(0);
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=json-parse-safety.js.map

package/dist/checks/runtime/json-parse-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-parse-safety.js","sourceRoot":"","sources":["../../../src/checks/runtime/json-parse-safety.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,4CAA8B;AAC9B,gDAAkC;AAClC,6DAAiE;AACjE,wDAAoD;AACpD,8DAA0F;AAC1F,uFAAwF;AACxF,iEAAmG;AAGnG,iBAAiB;AACJ,QAAA,EAAE,GAAG,2BAA2B,CAAC;AACjC,QAAA,IAAI,GAAG,mBAAmB,CAAC;AAC3B,QAAA,QAAQ,GAAG,SAAS,CAAC;AACrB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,wCAAwC,CAAC;AACvD,QAAA,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAWhC,MAAM,QAAQ,GAAG,IAAA,8BAAc,EAAC,4CAA4B,EAAE;IAC5D,eAAe;IACf,oBAAoB;CACrB,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,iDAAiD;IACjD,MAAM,QAAQ,GAAG,+EAA+E,CAAC;IACjG,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,8EAA8E;IAC9E,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,eAAe;IACf,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,SAAS,+BAA+B,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,mBAAmB,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,sBAAS,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEtF,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO;QAE7C,MAAM,WAAW,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAEnC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAE7C,wBAAwB;QACxB,MAAM,OAAO,GAAG,sCAAsC,CAAC;QACvD,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAErC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,2FAA2F;YAC3F,gEAAgE;YAChE,IAAI,WAAW;gBAAE,SAAS;YAE1B,MAAM,EAAE,GAAG,IAAA,gCAAc,EAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,GAAG,EAAE,EAAE,CAAC,GAAG;gBACX,OAAO,EAAE,uDAAuD;gBAChE,UAAU,EACR,4FAA4F;gBAC9F,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAuB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,UAAU,EAAE;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;KACjD,CAAC,CAAC,CAAC;IACJ,IAAA,+BAAa,EAAC,QAAQ,CAAC,CAAC;IAExB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,cAAc,MAAM,CAAC,MAAM,4BAA4B,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,sDAAsD,CAAC,CAAC;IACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/checks/runtime/missing-public-env-import.d.ts

@@ -0,0 +1,26 @@
+#!/usr/bin/env tsx
+/**
+ * Preflight: Ensure publicEnv usage has an import
+ *
+ * Guards against runtime errors like:
+ *   ReferenceError: publicEnv is not defined
+ * when someone uses `publicEnv.*` in a client file but forgets to import it.
+ *
+ * Rule:
+ * - For any client component ("use client" in first ~10 lines) OR any file under hooks/, if it
+ *   contains `publicEnv.` then it must include an import from "@/lib/public-env".
+ *
+ * Opt-out per file (rare): add `preflight:allow-missing-publicenv-import`.
+ */
+export declare const id = "runtime/missing-public-env-import";
+export declare const name = "Missing Public Env Import";
+export declare const category = "runtime";
+export declare const blocking = false;
+export declare const description = "Preflight: Ensure publicEnv usage has an import";
+export declare const tags: string[];
+export declare const requires: string[];
+export declare function run(): Promise<{
+    errors: number;
+    warnings: number;
+}>;
+//# sourceMappingURL=missing-public-env-import.d.ts.map

package/dist/checks/runtime/missing-public-env-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-public-env-import.d.ts","sourceRoot":"","sources":["../../../src/checks/runtime/missing-public-env-import.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAYH,eAAO,MAAM,EAAE,sCAAsC,CAAC;AACtD,eAAO,MAAM,IAAI,8BAA8B,CAAC;AAChD,eAAO,MAAM,QAAQ,YAAY,CAAC;AAClC,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,WAAW,oDAAoD,CAAC;AAC7E,eAAO,MAAM,IAAI,UAAc,CAAC;AAChC,eAAO,MAAM,QAAQ,UAAW,CAAC;AAoGjC,wBAAsB,GAAG,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAuCzE"}

package/dist/checks/runtime/missing-public-env-import.js

@@ -0,0 +1,181 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Preflight: Ensure publicEnv usage has an import
+ *
+ * Guards against runtime errors like:
+ *   ReferenceError: publicEnv is not defined
+ * when someone uses `publicEnv.*` in a client file but forgets to import it.
+ *
+ * Rule:
+ * - For any client component ("use client" in first ~10 lines) OR any file under hooks/, if it
+ *   contains `publicEnv.` then it must include an import from "@/lib/public-env".
+ *
+ * Opt-out per file (rare): add `preflight:allow-missing-publicenv-import`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requires = exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.run = run;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const findings_writer_1 = require("../../utils/findings-writer");
+const exclusions_1 = require("../../shared/exclusions");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Check metadata
+exports.id = "runtime/missing-public-env-import";
+exports.name = "Missing Public Env Import";
+exports.category = "runtime";
+exports.blocking = false;
+exports.description = "Preflight: Ensure publicEnv usage has an import";
+exports.tags = ["runtime"];
+exports.requires = ["next"];
+const WORKSPACE_ROOT = process.cwd();
+const ROOTS = ["app", "components", "contexts", "hooks"];
+const ALLOWED_EXTS = new Set([".ts", ".tsx", ".js", ".jsx"]);
+const ALLOW_COMMENT = "preflight:allow-missing-publicenv-import";
+// App-level exclusions loaded from config
+let appExclusions = [];
+// Essential defaults (node_modules, __mocks__, .next, dist, coverage)
+function shouldSkipDirName(dirName) {
+    return (dirName === "node_modules" ||
+        dirName === ".next" ||
+        dirName === "dist" ||
+        dirName === "coverage" ||
+        dirName === "__mocks__");
+}
+function collectFiles(dir, out) {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (shouldSkipDirName(entry.name))
+                continue;
+            if (fullPath.includes(`${path.sep}app${path.sep}api${path.sep}`))
+                continue;
+            collectFiles(fullPath, out);
+            continue;
+        }
+        const ext = path.extname(entry.name);
+        if (!ALLOWED_EXTS.has(ext))
+            continue;
+        out.push(fullPath);
+    }
+}
+function hasUseClientDirective(fileContent) {
+    const lines = fileContent.split(/\r?\n/);
+    const firstLines = lines
+        .slice(0, 10)
+        .map((l) => l.trim())
+        .filter(Boolean);
+    return firstLines.some((l) => l === '"use client";' ||
+        l === "'use client';" ||
+        l === '"use client"' ||
+        l === "'use client'");
+}
+function hasPublicEnvImport(fileContent) {
+    // Allow any import style that resolves to @/lib/public-env
+    // Examples:
+    //   import { publicEnv } from "@/lib/public-env";
+    //   import { publicEnv } from '@/lib/public-env';
+    return /from\s+["']@\/lib\/public-env["']/.test(fileContent);
+}
+function analyzeFile(filePath) {
+    // Check app-level exclusions
+    if ((0, exclusions_1.shouldExcludeFile)(filePath, appExclusions))
+        return [];
+    const content = fs.readFileSync(filePath, "utf8");
+    if (content.includes(ALLOW_COMMENT))
+        return [];
+    const rel = path.relative(WORKSPACE_ROOT, filePath);
+    const isHooksFile = rel.startsWith(`hooks${path.sep}`);
+    const isClientFile = hasUseClientDirective(content);
+    if (!isHooksFile && !isClientFile)
+        return [];
+    if (!/\bpublicEnv\s*\./.test(content))
+        return [];
+    if (hasPublicEnvImport(content))
+        return [];
+    const firstIdx = content.search(/\bpublicEnv\s*\./);
+    const loc = firstIdx >= 0 ? (0, findings_writer_1.indexToLineCol)(content, firstIdx) : undefined;
+    return [
+        {
+            file: rel.replaceAll(path.sep, "/"),
+            line: loc?.line,
+            column: loc?.col,
+            message: "Uses publicEnv.* but is missing import from '@/lib/public-env'",
+        },
+    ];
+}
+async function run() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(exports.name);
+    const files = [];
+    for (const root of ROOTS) {
+        const abs = path.join(WORKSPACE_ROOT, root);
+        if (fs.existsSync(abs))
+            collectFiles(abs, files);
+    }
+    const findings = files.flatMap(analyzeFile);
+    (0, findings_writer_1.writeFindings)(findings.map((f) => ({
+        severity: "error",
+        message: f.message,
+        file: f.file,
+        range: {
+            startLine: f.line,
+            startColumn: f.column,
+        },
+    })));
+    if (findings.length === 0) {
+        console.log(`${console_chars_1.emoji.success} Preflight: publicEnv imports look good`);
+        return { errors: 0, warnings: 0 };
+    }
+    console.log(`${console_chars_1.emoji.error} Preflight: Found ${findings.length} file(s) using publicEnv without import`);
+    console.log('   Fix: add `import { publicEnv } from "@/lib/public-env";`.');
+    console.log("");
+    for (const f of findings) {
+        console.log(`- ${f.file}`);
+        console.log(`  ${f.message}`);
+    }
+    return { errors: findings.length, warnings: 0 };
+}
+if (require.main === module) {
+    (async () => {
+        appExclusions = await (0, exclusions_1.getExclusions)(exports.id);
+        const result = await run();
+        process.exit(result.errors > 0 ? 1 : 0);
+    })();
+}
+//# sourceMappingURL=missing-public-env-import.js.map

package/dist/checks/runtime/missing-public-env-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-public-env-import.js","sourceRoot":"","sources":["../../../src/checks/runtime/missing-public-env-import.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsHH,kBAuCC;AA3JD,uCAAyB;AACzB,2CAA6B;AAE7B,6DAAkD;AAClD,iEAA4E;AAC5E,wDAA2E;AAC3E,uFAAwF;AAGxF,iBAAiB;AACJ,QAAA,EAAE,GAAG,mCAAmC,CAAC;AACzC,QAAA,IAAI,GAAG,2BAA2B,CAAC;AACnC,QAAA,QAAQ,GAAG,SAAS,CAAC;AACrB,QAAA,QAAQ,GAAG,KAAK,CAAC;AACjB,QAAA,WAAW,GAAG,iDAAiD,CAAC;AAChE,QAAA,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AACnB,QAAA,QAAQ,GAAG,CAAC,MAAM,CAAC,CAAC;AASjC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAErC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AACzD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D,MAAM,aAAa,GAAG,0CAA0C,CAAC;AAEjE,0CAA0C;AAC1C,IAAI,aAAa,GAAa,EAAE,CAAC;AAEjC,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,CACL,OAAO,KAAK,cAAc;QAC1B,OAAO,KAAK,OAAO;QACnB,OAAO,KAAK,MAAM;QAClB,OAAO,KAAK,UAAU;QACtB,OAAO,KAAK,WAAW,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,GAAa;IAC9C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5C,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAE,SAAS;YAC3E,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAmB;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,KAAK;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,eAAe;QACrB,CAAC,KAAK,eAAe;QACrB,CAAC,KAAK,cAAc;QACpB,CAAC,KAAK,cAAc,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,2DAA2D;IAC3D,YAAY;IACZ,kDAAkD;IAClD,kDAAkD;IAClD,OAAO,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB;IACnC,6BAA6B;IAC7B,IAAI,IAAA,8BAAiB,EAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1D,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAEpD,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAE3C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,gCAAc,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1E,OAAO;QACL;YACE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;YACnC,IAAI,EAAE,GAAG,EAAE,IAAI;YACf,MAAM,EAAE,GAAG,EAAE,GAAG;YAChB,OAAO,EAAE,gEAAgE;SAC1E;KACF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,GAAG;IACvB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,YAAI,CAAC,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAE5C,IAAA,+BAAa,EACX,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE;YACL,SAAS,EAAE,CAAC,CAAC,IAAI;YACjB,WAAW,EAAE,CAAC,CAAC,MAAM;SACtB;KACF,CAAC,CAAC,CACJ,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;QACvE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,KAAK,qBAAqB,QAAQ,CAAC,MAAM,yCAAyC,CAC5F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,CAAC,KAAK,IAAI,EAAE;QACV,aAAa,GAAG,MAAM,IAAA,0BAAa,EAAC,UAAE,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,EAAE,CAAC;AACP,CAAC"}

package/dist/checks/runtime/node-deprecations.d.ts

@@ -0,0 +1,24 @@
+#!/usr/bin/env tsx
+/**
+ * Node Deprecations Preflight (Warning)
+ *
+ * Purpose:
+ * - Surface known Node.js deprecation sources early (during build), before they show up
+ *   as runtime warnings in dev servers / Playwright.
+ *
+ * Current focus:
+ * - DEP0169: url.parse() is deprecated. We currently see this emitted by Next.js internals.
+ *
+ * Notes:
+ * - We do NOT mutate node_modules.
+ * - This is warning-only because some deprecations are controlled by upstream (Next.js).
+ */
+export declare const id = "runtime/node-deprecations";
+export declare const name = "Node Deprecations";
+export declare const category = "runtime";
+export declare const blocking = false;
+export declare const description = "Node Deprecations Preflight (Warning)";
+export declare const tags: string[];
+import { PreflightCheckResult } from "../../core/types";
+export declare function run(): Promise<PreflightCheckResult>;
+//# sourceMappingURL=node-deprecations.d.ts.map

package/dist/checks/runtime/node-deprecations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-deprecations.d.ts","sourceRoot":"","sources":["../../../src/checks/runtime/node-deprecations.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;GAaG;AASH,eAAO,MAAM,EAAE,8BAA8B,CAAC;AAC9C,eAAO,MAAM,IAAI,sBAAsB,CAAC;AACxC,eAAO,MAAM,QAAQ,YAAY,CAAC;AAClC,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,WAAW,0CAA0C,CAAC;AACnE,eAAO,MAAM,IAAI,UAAc,CAAC;AA8GhC,OAAO,EAAE,oBAAoB,EAAoB,MAAM,kBAAkB,CAAC;AAE1E,wBAAsB,GAAG,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiDzD"}

package/dist/checks/runtime/node-deprecations.js

@@ -0,0 +1,168 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Node Deprecations Preflight (Warning)
+ *
+ * Purpose:
+ * - Surface known Node.js deprecation sources early (during build), before they show up
+ *   as runtime warnings in dev servers / Playwright.
+ *
+ * Current focus:
+ * - DEP0169: url.parse() is deprecated. We currently see this emitted by Next.js internals.
+ *
+ * Notes:
+ * - We do NOT mutate node_modules.
+ * - This is warning-only because some deprecations are controlled by upstream (Next.js).
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.run = run;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const console_chars_1 = require("../../utils/console-chars");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Check metadata
+exports.id = "runtime/node-deprecations";
+exports.name = "Node Deprecations";
+exports.category = "runtime";
+exports.blocking = false;
+exports.description = "Node Deprecations Preflight (Warning)";
+exports.tags = ["runtime"];
+function safeReadText(filePath) {
+    try {
+        return node_fs_1.default.readFileSync(filePath, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+function exists(filePath) {
+    try {
+        return node_fs_1.default.existsSync(filePath);
+    }
+    catch {
+        return false;
+    }
+}
+function findNextUrlParseUsages() {
+    const candidates = [
+        "node_modules/next/dist/esm/server/lib/router-server.js",
+        "node_modules/next/dist/esm/server/lib/router-utils/resolve-routes.js",
+        "node_modules/next/dist/esm/server/lib/router-utils/setup-dev-bundler.js",
+        "node_modules/next/dist/esm/server/image-optimizer.js",
+    ];
+    const hits = [];
+    for (const rel of candidates) {
+        const abs = node_path_1.default.join(process.cwd(), rel);
+        if (!exists(abs))
+            continue;
+        const text = safeReadText(abs);
+        if (!text)
+            continue;
+        if (text.includes("url.parse(") || text.includes("nodeUrl.parse(")) {
+            hits.push({
+                kind: "next-url-parse",
+                message: "Next.js internal code contains url.parse() usage (triggers Node DEP0169 deprecation warnings).",
+                file: rel,
+            });
+        }
+    }
+    return hits;
+}
+function findSourceUrlParseUsages() {
+    const roots = ["app", "components", "contexts", "hooks", "lib", "scripts", "tests", "types"];
+    const hits = [];
+    const visit = (dir) => {
+        let entries = [];
+        try {
+            entries = node_fs_1.default.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const abs = node_path_1.default.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (entry.name === "node_modules" || entry.name === ".next" || entry.name === "dist")
+                    continue;
+                visit(abs);
+                continue;
+            }
+            if (!/\.(ts|tsx|js|jsx|mjs|cjs)$/.test(entry.name))
+                continue;
+            const text = safeReadText(abs);
+            if (!text)
+                continue;
+            if (text.includes("url.parse(")) {
+                hits.push({
+                    kind: "source-url-parse",
+                    message: "Source code contains url.parse() usage (deprecated in Node; prefer new URL()).",
+                    file: node_path_1.default.relative(process.cwd(), abs).replace(/\\/g, "/"),
+                });
+            }
+        }
+    };
+    for (const root of roots) {
+        const abs = node_path_1.default.join(process.cwd(), root);
+        if (exists(abs))
+            visit(abs);
+    }
+    return hits;
+}
+function readNextVersion() {
+    const nextPkg = node_path_1.default.join(process.cwd(), "node_modules", "next", "package.json");
+    const raw = safeReadText(nextPkg);
+    if (!raw)
+        return null;
+    try {
+        const json = JSON.parse(raw);
+        return json.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function run() {
+    const startTime = Date.now();
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(node_path_1.default.basename(__filename, ".ts"));
+    const nodeVersion = process.version;
+    const nextVersion = readNextVersion();
+    const findings = [...findSourceUrlParseUsages(), ...findNextUrlParseUsages()];
+    const preflightFindings = [];
+    console.log("\n🧯 NODE DEPRECATIONS PREFLIGHT");
+    console.log((0, console_chars_1.createDivider)(80, "heavy"));
+    console.log(`Node: ${nodeVersion}${nextVersion ? ` | Next: ${nextVersion}` : ""}`);
+    if (findings.length === 0) {
+        console.log(`${console_chars_1.emoji.success} No known deprecation patterns detected.`);
+        return { passed: true, findings: [], duration: Date.now() - startTime };
+    }
+    console.log(`${console_chars_1.emoji.warning} Warning: ${findings.length} potential deprecation sources found.\n`);
+    for (const f of findings.slice(0, 30)) {
+        console.log(`- ${f.message}${f.file ? `\n  at: ${f.file}` : ""}`);
+        preflightFindings.push({
+            level: "warning",
+            message: f.message,
+            file: f.file,
+        });
+    }
+    if (findings.length > 30) {
+        console.log(`\n${console_chars_1.chars.ellipsis}and ${findings.length - 30} more.`);
+    }
+    const nextUrlParseCount = findings.filter((f) => f.kind === "next-url-parse").length;
+    if (nextUrlParseCount > 0) {
+        console.log("\nRecommended actions (DEP0169 url.parse):");
+        console.log("- If you can: upgrade Next.js to a version that removes url.parse().");
+        console.log("- Otherwise: pin Node to the project engine (see package.json) or LTS if newer Node emits extra warnings.");
+        console.log("- You can silence warnings locally with NODE_OPTIONS=--no-deprecation, but that hides signal rather than fixing root cause.");
+    }
+    // Warning-only preflight - always passes
+    return { passed: true, findings: preflightFindings, duration: Date.now() - startTime };
+}
+// CLI execution
+if (require.main === module) {
+    run().then(() => process.exit(0)).catch(() => process.exit(1));
+}
+//# sourceMappingURL=node-deprecations.js.map

package/dist/checks/runtime/node-deprecations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-deprecations.js","sourceRoot":"","sources":["../../../src/checks/runtime/node-deprecations.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;GAaG;;;;;;AA8HH,kBAiDC;AA7KD,sDAAyB;AACzB,0DAA6B;AAC7B,6DAAwE;AACxE,uFAAwF;AAGxF,iBAAiB;AACJ,QAAA,EAAE,GAAG,2BAA2B,CAAC;AACjC,QAAA,IAAI,GAAG,mBAAmB,CAAC;AAC3B,QAAA,QAAQ,GAAG,SAAS,CAAC;AACrB,QAAA,QAAQ,GAAG,KAAK,CAAC;AACjB,QAAA,WAAW,GAAG,uCAAuC,CAAC;AACtD,QAAA,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAQhC,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,OAAO,iBAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB;IAC9B,IAAI,CAAC;QACH,OAAO,iBAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,UAAU,GAAG;QACjB,wDAAwD;QACxD,sEAAsE;QACtE,yEAAyE;QACzE,sDAAsD;KACvD,CAAC;IAEF,MAAM,IAAI,GAAc,EAAE,CAAC;IAE3B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,SAAS;QAE3B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EACL,gGAAgG;gBAClG,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAc,EAAE,CAAC;IAE3B,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE;QAC5B,IAAI,OAAO,GAAgB,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,iBAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,mBAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;oBAClF,SAAS;gBACX,KAAK,CAAC,GAAG,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YAED,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAE7D,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,gFAAgF;oBACzF,IAAI,EAAE,mBAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;iBAC5D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,OAAO,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAIM,KAAK,UAAU,GAAG;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,mBAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IACpC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IAEtC,MAAM,QAAQ,GAAG,CAAC,GAAG,wBAAwB,EAAE,EAAE,GAAG,sBAAsB,EAAE,CAAC,CAAC;IAC9E,MAAM,iBAAiB,GAAuB,EAAE,CAAC;IAEjD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,SAAS,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEnF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;QACxE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IAC1E,CAAC;IAED,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,OAAO,aAAa,QAAQ,CAAC,MAAM,yCAAyC,CACtF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,iBAAiB,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,QAAQ,OAAO,QAAQ,CAAC,MAAM,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,MAAM,CAAC;IACrF,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CACT,2GAA2G,CAC5G,CAAC;QACF,OAAO,CAAC,GAAG,CACT,6HAA6H,CAC9H,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;AACzF,CAAC;AAED,gBAAgB;AAChB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/checks/runtime/node25-compatibility.d.ts

@@ -0,0 +1,30 @@
+#!/usr/bin/env tsx
+/**
+ * Node 25 Compatibility Preflight (Static)
+ *
+ * Goal:
+ * - Catch dependency engine ranges that explicitly exclude Node 25.
+ * - Runs fast and deterministically during build (after install).
+ *
+ * What it does:
+ * - Scans installed package.json files under pnpm's node_modules layout.
+ * - Flags packages whose `engines.node` appears capped below 25.
+ *
+ * Important:
+ * - This does NOT prove runtime compatibility.
+ * - It is an early warning system that catches obvious engine incompat.
+ *
+ * Usage:
+ *   pnpm -s tsx scripts/active/preflights/runtime/node25-compatibility.ts
+ *   pnpm -s tsx scripts/active/preflights/runtime/node25-compatibility.ts --mode=warn
+ *   pnpm -s tsx scripts/active/preflights/runtime/node25-compatibility.ts --blocking
+ */
+export declare const id = "runtime/node25-compatibility";
+export declare const name = "Node25 Compatibility";
+export declare const category = "runtime";
+export declare const blocking = false;
+export declare const description = "Node 25 Compatibility Preflight (Static)";
+export declare const tags: string[];
+import { PreflightCheckResult } from "../../core/types";
+export declare function run(): Promise<PreflightCheckResult>;
+//# sourceMappingURL=node25-compatibility.d.ts.map

package/dist/checks/runtime/node25-compatibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node25-compatibility.d.ts","sourceRoot":"","sources":["../../../src/checks/runtime/node25-compatibility.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;GAmBG;AAcH,eAAO,MAAM,EAAE,iCAAiC,CAAC;AACjD,eAAO,MAAM,IAAI,yBAAyB,CAAC;AAC3C,eAAO,MAAM,QAAQ,YAAY,CAAC;AAClC,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,WAAW,6CAA6C,CAAC;AACtE,eAAO,MAAM,IAAI,UAAc,CAAC;AA0FhC,OAAO,EAAE,oBAAoB,EAAoB,MAAM,kBAAkB,CAAC;AAE1E,wBAAsB,GAAG,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAwHzD"}