@empline/preflight 1.1.11 → 1.1.13

package/dist/checks/consolidated/hardened-checks.d.ts

@@ -0,0 +1,276 @@
+/**
+ * Hardened Preflight Checks
+ *
+ * CRITICAL checks that block deployment to prevent production issues.
+ * These are the "iron-clad" rules that cannot be violated.
+ *
+ * Checks included:
+ * 1. DRAFT Status Enforcement - No direct ACTIVE listing creation
+ * 2. Async/Await Error Handling - All async code must have error handling
+ * 3. Console Cleanup - No console.log in production code
+ * 4. Secret Detection - No hardcoded API keys or secrets
+ * 5. React Hook Rules - Hooks must follow rules of hooks
+ * 6. Promise Handling - No floating promises
+ * 7. CVA Enforcement - Components with variants MUST use CVA
+ * 8. Type Safety - No unsafe type assertions in critical paths
+ * 9. ESLint Concurrency - ESLint commands must use multithreading
+ * 10. CardGraded Semantics - Prevent WATA in catalogNonSportsCards
+ * 11. Card Grade Field Consistency - prevent mixed grade fields
+ * 12. Serial Number Consistency - serialNumbered requires serialNumber
+ * 13. Autograph Consistency - auth flags require autographed
+ * 14. Video Game Grading Consistency - graded/grader/wata fields
+ * 15. Syndication Consistency - syndicated flags require platform IDs
+ * 16. Featured Consistency - featuredUntil requires featured
+ * 17. Flagging Consistency - flagged fields require isFlagged
+ * 18. Soft Delete Consistency - deletedBy requires deletedAt
+ * 19. Seller Approval Consistency - sellerApprovedAt requires sellerApproved
+ * 20. Recognition Metadata Consistency - recognitionConfidence/jobId require method
+ * 21. Autograph Grade Field Consistency - prevent mixed autograph grade systems
+ * 22. Autograph Grading Metadata Consistency - autographGraded required for autograph grades
+ *
+ * Usage:
+ *   pnpm preflight:hardened                    # All hardened checks
+ *   pnpm preflight:hardened draft              # DRAFT status only
+ *   pnpm preflight:hardened async              # Async error handling only
+ *   pnpm preflight:hardened console            # Console cleanup only
+ *   pnpm preflight:hardened secrets            # Secret detection only
+ *   pnpm preflight:hardened hooks              # React hook rules only
+ *   pnpm preflight:hardened promises           # Promise handling only
+ *   pnpm preflight:hardened cva                # CVA enforcement only
+ *   pnpm preflight:hardened types              # Type safety only
+ *   pnpm preflight:hardened eslint-concurrency  # ESLint concurrency enforcement only
+ *
+ * All checks are BLOCKING by default.
+ */
+interface Issue {
+    file: string;
+    line: number;
+    type: string;
+    severity: "error" | "warning" | "info";
+    message: string;
+    suggestion?: string;
+    snippet?: string;
+}
+interface CheckResult {
+    name: string;
+    passed: boolean;
+    blocking: boolean;
+    issues: Issue[];
+    duration: number;
+}
+interface ModuleResult {
+    module: string;
+    passed: boolean;
+    totalDuration: number;
+    checks: CheckResult[];
+    summary: {
+        total: number;
+        passed: number;
+        failed: number;
+        errors: number;
+        warnings: number;
+    };
+}
+declare class HardenedPreflightModule {
+    private verbose;
+    private parallel;
+    constructor(options?: {
+        verbose?: boolean;
+        parallel?: boolean;
+    });
+    /**
+     * Check 1: DRAFT Status Enforcement (BLOCKING)
+     *
+     * CRITICAL: Listings MUST be created in DRAFT or PENDING status.
+     * No direct ACTIVE creation allowed - saves $19.2K/year from fraud prevention.
+     */
+    checkDraftStatusEnforcement(): Promise<CheckResult>;
+    /**
+     * Check 2: Async/Await Error Handling (BLOCKING)
+     *
+     * Unhandled promise rejections crash the server.
+     * All async functions in API routes must have try/catch.
+     */
+    checkAsyncErrorHandling(): Promise<CheckResult>;
+    /**
+     * Check 3: Console Cleanup (WARNING)
+     *
+     * console.log statements should not be in production code.
+     * Use proper logging with log levels instead.
+     */
+    checkConsoleCleanup(): Promise<CheckResult>;
+    /**
+     * Check 4: Secret Detection (BLOCKING)
+     *
+     * Hardcoded secrets in code are a security vulnerability.
+     */
+    checkSecretDetection(): Promise<CheckResult>;
+    /**
+     * Check 5: React Hook Rules (BLOCKING)
+     *
+     * Hooks must follow the rules of hooks:
+     * - Only call hooks at the top level
+     * - Only call hooks from React functions
+     *
+     * This is a simplified heuristic check - use ESLint react-hooks plugin for comprehensive coverage.
+     * Only flags obvious violations: hooks directly inside if/else/switch/try/catch blocks.
+     */
+    checkReactHookRules(): Promise<CheckResult>;
+    /**
+     * Check 9: Prisma Enum Literal Validation (BLOCKING)
+     *
+     * Prevents runtime PrismaClientValidationError caused by passing incorrect
+     * enum values (commonly lowercase strings) into Prisma queries/mutations.
+     */
+    checkPrismaEnumLiterals(): Promise<CheckResult>;
+    /**
+     * Check 6: Floating Promise Detection (BLOCKING)
+     *
+     * Promises that are not awaited or handled can cause silent failures.
+     */
+    checkFloatingPromises(): Promise<CheckResult>;
+    /**
+     * Check 7: CVA Enforcement for Variant Components (WARNING ${chars.arrow} BLOCKING after migration)
+     *
+     * Components with variant/size props MUST use CVA for type-safe, consistent styling.
+     */
+    checkCvaEnforcement(): Promise<CheckResult>;
+    /**
+     * Check 8: Unsafe Type Assertions in Critical Paths (WARNING)
+     *
+     * Excessive 'as any' or 'as unknown' can hide type errors.
+     */
+    checkTypeSafety(): Promise<CheckResult>;
+    /**
+     * Check 9: ESLint Concurrency Enforcement (BLOCKING)
+     *
+     * ESLint must run with multithreading enabled in our scripts/preflights.
+     * ESLint v9 defaults to `--concurrency off`, so we hard-fail if any
+     * maintained runner regresses and drops the flag.
+     */
+    checkEslintConcurrencyEnforcement(): Promise<CheckResult>;
+    /**
+     * Check 10: CardGraded Semantics (BLOCKING)
+     *
+     * Guardrail: WATA is a video-game grader and must not appear as a `CardGraded`
+     * value on catalogNonSportsCards writes (create/upsert/update).
+     */
+    checkCardGradedSemantics(): Promise<CheckResult>;
+    /**
+     * Check 11: Card grade-field consistency (BLOCKING)
+     *
+     * Prevents semantically invalid grader/grade-field combinations:
+     * - graded: "PSA" + bgsGrade set
+     * - graded: "BGS" + psaGrade set
+     * - graded: "CGC" + psaGrade/bgsGrade/sgcGrade set
+     * - graded: "SGC" + psaGrade/bgsGrade/cgcGrade set
+     * - graded: "UNGRADED" + any grade field set
+     */
+    checkCardGradeFieldConsistency(): Promise<CheckResult>;
+    /**
+     * Check 12: Serial number consistency (BLOCKING)
+     *
+     * Invariant:
+     * - If serialNumbered is true, serialNumber must be present and non-empty.
+     *
+     * This catches common catalog/listing data-quality bugs in write payloads.
+     */
+    checkSerialNumberConsistency(): Promise<CheckResult>;
+    /**
+     * Check 13: Autograph consistency (BLOCKING)
+     *
+     * Invariants:
+     * - If autographedAuthenticated/autographAuthenticated is true, autographed must be true.
+     * - If autographed is explicitly false, autograph auth fields should not be populated.
+     */
+    checkAutographConsistency(): Promise<CheckResult>;
+    /**
+     * Check 14: Video game grading consistency (BLOCKING)
+     *
+     * Invariants (conservative / low false positives):
+     * - If graded is explicitly true, grader must be present and not null/undefined.
+     * - If graded is explicitly false, grader/wataGrade/wataSealGrade must not be populated.
+     * - If wataSealGrade is set and grader is an explicit literal, it must be WATA.
+     */
+    checkVideoGameGradingConsistency(): Promise<CheckResult>;
+    /**
+     * Check 15: Syndication consistency (BLOCKING)
+     *
+     * Invariant:
+     * - If syndicatedToEbay/Amazon/Tcgplayer/Preplo is true, the corresponding
+     *   platform listing id must be present and non-empty.
+     */
+    checkSyndicationConsistency(): Promise<CheckResult>;
+    /**
+     * Check 16: Featured consistency (BLOCKING)
+     *
+     * Invariants (low false positives):
+     * - If featuredUntil is set (non-null), featured must be true.
+     * - If featured is explicitly false, featuredUntil must not be populated.
+     */
+    checkFeaturedConsistency(): Promise<CheckResult>;
+    /**
+     * Check 17: Flagging consistency (BLOCKING)
+     *
+     * Invariants (low false positives):
+     * - If isFlagged is explicitly false, flaggedAt/flaggedReason/flaggedBy must not be populated.
+     * - If any flagged metadata is populated, isFlagged must be true.
+     */
+    checkFlaggingConsistency(): Promise<CheckResult>;
+    /**
+     * Check 18: Soft delete consistency (BLOCKING)
+     *
+     * Invariants (low false positives):
+     * - If deletedBy is set (non-empty), deletedAt must be set (non-null).
+     * - If deletedAt is explicitly null/undefined, deletedBy must not be populated.
+     */
+    checkSoftDeleteConsistency(): Promise<CheckResult>;
+    /**
+     * Check 19: Seller approval consistency (BLOCKING)
+     *
+     * Invariants (low false positives):
+     * - If sellerApproved is true, sellerApprovedAt must be set (non-null).
+     * - If sellerApprovedAt is set, sellerApproved must be true.
+     * - If sellerApproved is explicitly false, sellerApprovedAt must not be populated.
+     */
+    checkSellerApprovalConsistency(): Promise<CheckResult>;
+    /**
+     * Check 20: AI recognition metadata consistency (BLOCKING)
+     *
+     * Invariants (low false positives):
+     * - If recognitionConfidence is set, recognitionMethod must be set (non-empty).
+     * - If recognitionJobId is set, recognitionMethod must be set (non-empty).
+     */
+    checkRecognitionMetadataConsistency(): Promise<CheckResult>;
+    /**
+     * Check 21: Autograph grade-field consistency (BLOCKING)
+     *
+     * IMPORTANT: This is ONLY about autograph grading systems.
+     * It is VALID to have a card grade + autograph grade at the same time:
+     * - Example: psaGrade (card) + autographPsaGrade (PSA/DNA autograph) ${emoji.success}
+     * - Example: bgsGrade (card) + autographBgsGrade (BGS autograph) ${emoji.success}
+     *
+     * Invariant:
+     * - At most one of autographPsaGrade/autographBgsGrade/autographJsaGrade/autographSgcGrade
+     *   may be populated in a single coreListings write payload.
+     */
+    checkAutographGradeFieldConsistency(): Promise<CheckResult>;
+    /**
+     * Check 22: Autograph grading metadata consistency (BLOCKING)
+     *
+     * Best-practice invariants (low false positives):
+     * - If an autograph numeric grade is provided (autograph*Grade), `autographGraded` must also be set.
+     * - If `autographGraded` is a string literal, it must match the grading system used.
+     *
+     * NOTE: This does NOT require the card itself to be graded. It's valid for:
+     * - graded: UNGRADED + autographPsaGrade set ${emoji.success}
+     */
+    checkAutographGradingMetadataConsistency(): Promise<CheckResult>;
+    /**
+     * Run all hardened checks
+     */
+    runAll(): Promise<ModuleResult>;
+    private printResults;
+}
+export { HardenedPreflightModule };
+//# sourceMappingURL=hardened-checks.d.ts.map

package/dist/checks/consolidated/hardened-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardened-checks.d.ts","sourceRoot":"","sources":["../../../src/checks/consolidated/hardened-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAUH,UAAU,KAAK;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAuDD,cAAM,uBAAuB;IAC3B,OAAO,CAAC,OAAO,CAAU;IAEzB,OAAO,CAAC,QAAQ,CAAkB;gBACtB,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO;IAKnE;;;;;OAKG;IACG,2BAA2B,IAAI,OAAO,CAAC,WAAW,CAAC;IAsFzD;;;;;OAKG;IACG,uBAAuB,IAAI,OAAO,CAAC,WAAW,CAAC;IAuErD;;;;;OAKG;IACG,mBAAmB,IAAI,OAAO,CAAC,WAAW,CAAC;IAqDjD;;;;OAIG;IACG,oBAAoB,IAAI,OAAO,CAAC,WAAW,CAAC;IAyFlD;;;;;;;;;OASG;IACG,mBAAmB,IAAI,OAAO,CAAC,WAAW,CAAC;IA6FjD;;;;;OAKG;IACG,uBAAuB,IAAI,OAAO,CAAC,WAAW,CAAC;IAqOrD;;;;OAIG;IACG,qBAAqB,IAAI,OAAO,CAAC,WAAW,CAAC;IA4DnD;;;;OAIG;IACG,mBAAmB,IAAI,OAAO,CAAC,WAAW,CAAC;IAsFjD;;;;OAIG;IACG,eAAe,IAAI,OAAO,CAAC,WAAW,CAAC;IAkD7C;;;;;;OAMG;IACG,iCAAiC,IAAI,OAAO,CAAC,WAAW,CAAC;IAyK/D;;;;;OAKG;IACG,wBAAwB,IAAI,OAAO,CAAC,WAAW,CAAC;IA6CtD;;;;;;;;;OASG;IACG,8BAA8B,IAAI,OAAO,CAAC,WAAW,CAAC;IAwN5D;;;;;;;OAOG;IACG,4BAA4B,IAAI,OAAO,CAAC,WAAW,CAAC;IAoI1D;;;;;;OAMG;IACG,yBAAyB,IAAI,OAAO,CAAC,WAAW,CAAC;IA6LvD;;;;;;;OAOG;IACG,gCAAgC,IAAI,OAAO,CAAC,WAAW,CAAC;IA4K9D;;;;;;OAMG;IACG,2BAA2B,IAAI,OAAO,CAAC,WAAW,CAAC;IA+IzD;;;;;;OAMG;IACG,wBAAwB,IAAI,OAAO,CAAC,WAAW,CAAC;IA0ItD;;;;;;OAMG;IACG,wBAAwB,IAAI,OAAO,CAAC,WAAW,CAAC;IAiJtD;;;;;;OAMG;IACG,0BAA0B,IAAI,OAAO,CAAC,WAAW,CAAC;IA2IxD;;;;;;;OAOG;IACG,8BAA8B,IAAI,OAAO,CAAC,WAAW,CAAC;IAyJ5D;;;;;;OAMG;IACG,mCAAmC,IAAI,OAAO,CAAC,WAAW,CAAC;IAiIjE;;;;;;;;;;;OAWG;IACG,mCAAmC,IAAI,OAAO,CAAC,WAAW,CAAC;IA4IjE;;;;;;;;;OASG;IACG,wCAAwC,IAAI,OAAO,CAAC,WAAW,CAAC;IAiLtE;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC;IAyDrC,OAAO,CAAC,YAAY;CA0DrB;AA+FD,OAAO,EAAE,uBAAuB,EAAE,CAAC"}