@empline/preflight 1.1.11 → 1.1.13

package/dist/checks/consolidated/hardened-checks.js

@@ -0,0 +1,3056 @@
+"use strict";
+/**
+ * Hardened Preflight Checks
+ *
+ * CRITICAL checks that block deployment to prevent production issues.
+ * These are the "iron-clad" rules that cannot be violated.
+ *
+ * Checks included:
+ * 1. DRAFT Status Enforcement - No direct ACTIVE listing creation
+ * 2. Async/Await Error Handling - All async code must have error handling
+ * 3. Console Cleanup - No console.log in production code
+ * 4. Secret Detection - No hardcoded API keys or secrets
+ * 5. React Hook Rules - Hooks must follow rules of hooks
+ * 6. Promise Handling - No floating promises
+ * 7. CVA Enforcement - Components with variants MUST use CVA
+ * 8. Type Safety - No unsafe type assertions in critical paths
+ * 9. ESLint Concurrency - ESLint commands must use multithreading
+ * 10. CardGraded Semantics - Prevent WATA in catalogNonSportsCards
+ * 11. Card Grade Field Consistency - prevent mixed grade fields
+ * 12. Serial Number Consistency - serialNumbered requires serialNumber
+ * 13. Autograph Consistency - auth flags require autographed
+ * 14. Video Game Grading Consistency - graded/grader/wata fields
+ * 15. Syndication Consistency - syndicated flags require platform IDs
+ * 16. Featured Consistency - featuredUntil requires featured
+ * 17. Flagging Consistency - flagged fields require isFlagged
+ * 18. Soft Delete Consistency - deletedBy requires deletedAt
+ * 19. Seller Approval Consistency - sellerApprovedAt requires sellerApproved
+ * 20. Recognition Metadata Consistency - recognitionConfidence/jobId require method
+ * 21. Autograph Grade Field Consistency - prevent mixed autograph grade systems
+ * 22. Autograph Grading Metadata Consistency - autographGraded required for autograph grades
+ *
+ * Usage:
+ *   pnpm preflight:hardened                    # All hardened checks
+ *   pnpm preflight:hardened draft              # DRAFT status only
+ *   pnpm preflight:hardened async              # Async error handling only
+ *   pnpm preflight:hardened console            # Console cleanup only
+ *   pnpm preflight:hardened secrets            # Secret detection only
+ *   pnpm preflight:hardened hooks              # React hook rules only
+ *   pnpm preflight:hardened promises           # Promise handling only
+ *   pnpm preflight:hardened cva                # CVA enforcement only
+ *   pnpm preflight:hardened types              # Type safety only
+ *   pnpm preflight:hardened eslint-concurrency  # ESLint concurrency enforcement only
+ *
+ * All checks are BLOCKING by default.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HardenedPreflightModule = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const file_cache_1 = require("../../shared/file-cache");
+const glob_patterns_1 = require("../../shared/glob-patterns");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+const concurrency_config_1 = require("../../shared/concurrency-config");
+// Use shared excludes + hardened-specific exclusions
+const EXCLUDED = (0, glob_patterns_1.extendExcludes)(glob_patterns_1.STANDARD_EXCLUDES, [
+    "**/test-results/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/*.stories.*",
+    "**/lib/examples/**",
+    "**/scripts/active/preflights/**",
+    "**/scripts/archived/**",
+    "**/__mocks__/**",
+]);
+// CACHED FILE LISTS - Scan once, use everywhere
+let cachedAppLibFiles = null;
+let cachedAppLibScriptsFiles = null;
+let cachedApiFiles = null;
+let cachedComponentFiles = null;
+async function getAppLibFiles() {
+    if (!cachedAppLibFiles) {
+        cachedAppLibFiles = await file_cache_1.fileCache.getFiles("{app,lib}/**/*.{ts,tsx}", { ignore: EXCLUDED });
+    }
+    return cachedAppLibFiles;
+}
+async function getAppLibScriptsFiles() {
+    if (!cachedAppLibScriptsFiles) {
+        cachedAppLibScriptsFiles = await file_cache_1.fileCache.getFiles("{app,lib,scripts}/**/*.{ts,tsx,js,jsx}", {
+            ignore: EXCLUDED,
+        });
+    }
+    return cachedAppLibScriptsFiles;
+}
+async function getApiFiles() {
+    if (!cachedApiFiles) {
+        cachedApiFiles = await file_cache_1.fileCache.getFiles("app/api/**/*.{ts,tsx}", { ignore: EXCLUDED });
+    }
+    return cachedApiFiles;
+}
+async function getComponentHookFiles() {
+    if (!cachedComponentFiles) {
+        cachedComponentFiles = await file_cache_1.fileCache.getFiles("{app,components,hooks}/**/*.{tsx,jsx}", {
+            ignore: EXCLUDED,
+        });
+    }
+    return cachedComponentFiles;
+}
+// Get concurrency from shared config (respects PREFLIGHT_CONCURRENCY env var)
+const concurrencyConfig = (0, concurrency_config_1.getConcurrencyConfig)();
+class HardenedPreflightModule {
+    verbose;
+    parallel = false;
+    constructor(options = {}) {
+        this.verbose = options.verbose || false;
+        this.parallel = options.parallel || concurrencyConfig.parallel;
+    }
+    /**
+     * Check 1: DRAFT Status Enforcement (BLOCKING)
+     *
+     * CRITICAL: Listings MUST be created in DRAFT or PENDING status.
+     * No direct ACTIVE creation allowed - saves $19.2K/year from fraud prevention.
+     */
+    async checkDraftStatusEnforcement() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibFiles();
+        // Files that are ALLOWED to set ACTIVE status (admin approval flows)
+        const allowedActivePatterns = [
+            "admin/listings/approve",
+            "admin/listings/[id]",
+            "admin/listing-approval",
+            "admin/listings/republish",
+            "admin/listings/bulk-approve",
+            "lib/actions/admin",
+        ];
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            // Normalize path for cross-platform matching
+            const normalizedFile = file.replace(/\\/g, "/");
+            const isAllowedFile = allowedActivePatterns.some((allowed) => normalizedFile.includes(allowed));
+            lines.forEach((line, index) => {
+                // Skip comments
+                if (line.trim().startsWith("//") || line.trim().startsWith("*"))
+                    return;
+                // Pattern 1: Direct ACTIVE creation in data objects
+                // Match: listingStatus: "ACTIVE" or listingStatus: 'ACTIVE'
+                // But exclude: where: { listingStatus: "ACTIVE" } (queries are OK)
+                if (/listingStatus:\s*["']ACTIVE["']/.test(line)) {
+                    // Check if this is within a 'data:' block (creation) vs 'where:' (query)
+                    const contextStart = Math.max(0, index - 10);
+                    const context = lines.slice(contextStart, index + 1).join("\n");
+                    // If there's a 'data:' or 'create(' or 'createMany(' before this, it's a creation
+                    const isCreation = /(?:data\s*:|create\s*\(|createMany\s*\(|upsert\s*\()[^}]*listingStatus:\s*["']ACTIVE["']/s.test(context);
+                    // Query patterns are OK
+                    const isQuery = /(?:where\s*:|findFirst|findMany|findUnique)[^}]*listingStatus:\s*["']ACTIVE["']/s.test(context);
+                    if (isCreation && !isQuery && !isAllowedFile) {
+                        issues.push({
+                            file,
+                            line: index + 1,
+                            type: "direct-active-creation",
+                            severity: "error",
+                            message: "CRITICAL: Direct ACTIVE listing creation detected",
+                            suggestion: 'Create with listingStatus: "DRAFT" or "PENDING". Admin approval required for ACTIVE.',
+                            snippet: line.trim().substring(0, 100),
+                        });
+                    }
+                }
+                // Pattern 2: Status update to ACTIVE outside admin context
+                if (/update\s*\([^)]*listingStatus:\s*["']ACTIVE["']/.test(line) && !isAllowedFile) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "unauthorized-active-update",
+                        severity: "error",
+                        message: "Unauthorized ACTIVE status update detected",
+                        suggestion: "Only admin approval routes can set ACTIVE status",
+                        snippet: line.trim().substring(0, 100),
+                    });
+                }
+            });
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "DRAFT Status Enforcement",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 2: Async/Await Error Handling (BLOCKING)
+     *
+     * Unhandled promise rejections crash the server.
+     * All async functions in API routes must have try/catch.
+     */
+    async checkAsyncErrorHandling() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getApiFiles();
+        // Exclude simple test/health routes that don't need error handling
+        const simpleRoutePatterns = [
+            "test-vercel",
+            "test-route",
+            "auth\\test", // Windows path
+            "auth/test", // Unix path
+            "clear-cookies",
+            "health",
+            "ping",
+            "status",
+        ];
+        for (const file of files) {
+            // Skip simple test routes
+            const isSimpleRoute = simpleRoutePatterns.some((pattern) => file.includes(pattern));
+            if (isSimpleRoute)
+                continue;
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            // Skip if this is a simple wrapper/delegator route (just calls another function)
+            const isDelegator = /return\s+\w+\s*\(request/.test(content) && lines.length < 30;
+            if (isDelegator)
+                continue;
+            // Check if file has async functions
+            const hasAsyncExport = /export\s+(?:async\s+)?function\s+(?:GET|POST|PUT|DELETE|PATCH)/i.test(content);
+            if (hasAsyncExport) {
+                // Check if there's a try/catch block
+                const hasTryCatch = /try\s*\{/.test(content);
+                // Check if using a wrapper that handles errors
+                const hasErrorWrapper = /withErrorHandler|handleApiError|apiHandler|catchAsync/.test(content);
+                if (!hasTryCatch && !hasErrorWrapper) {
+                    // Find the line with the async export
+                    lines.forEach((line, index) => {
+                        if (/export\s+(?:async\s+)?function\s+(?:GET|POST|PUT|DELETE|PATCH)/i.test(line)) {
+                            issues.push({
+                                file,
+                                line: index + 1,
+                                type: "missing-try-catch",
+                                severity: "error",
+                                message: "API route handler missing try/catch error handling",
+                                suggestion: "Wrap handler body in try/catch or use withErrorHandler wrapper",
+                                snippet: line.trim().substring(0, 100),
+                            });
+                        }
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Async Error Handling",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 3: Console Cleanup (WARNING)
+     *
+     * console.log statements should not be in production code.
+     * Use proper logging with log levels instead.
+     */
+    async checkConsoleCleanup() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await file_cache_1.fileCache.getFiles("{app,components,lib,hooks}/**/*.{ts,tsx}", {
+            ignore: EXCLUDED,
+        });
+        // Allowed console usage patterns
+        const allowedPatterns = [
+            /console\.error/, // Errors are OK
+            /console\.warn/, // Warnings are OK (for deprecation notices)
+            /\/\/.*console/, // Commented out
+            /['"]console/, // String containing 'console'
+        ];
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            lines.forEach((line, index) => {
+                // Skip if line is a comment
+                if (line.trim().startsWith("//") || line.trim().startsWith("*"))
+                    return;
+                // Check for console.log, console.debug, console.info, console.table
+                if (/console\.(?:log|debug|info|table|dir|trace)\s*\(/.test(line)) {
+                    // Check if it's an allowed pattern
+                    const isAllowed = allowedPatterns.some((pattern) => pattern.test(line));
+                    if (!isAllowed) {
+                        issues.push({
+                            file,
+                            line: index + 1,
+                            type: "console-log",
+                            severity: "warning",
+                            message: "console.log detected in production code",
+                            suggestion: "Remove or use a proper logging utility with log levels",
+                            snippet: line.trim().substring(0, 80),
+                        });
+                    }
+                }
+            });
+        }
+        // Warning only - doesn't block deployment
+        return {
+            name: "Console Cleanup",
+            passed: true,
+            blocking: false,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 4: Secret Detection (BLOCKING)
+     *
+     * Hardcoded secrets in code are a security vulnerability.
+     */
+    async checkSecretDetection() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await file_cache_1.fileCache.getFiles("{app,components,lib,hooks}/**/*.{ts,tsx,js,jsx}", {
+            ignore: EXCLUDED,
+        });
+        // Patterns that indicate hardcoded secrets
+        const secretPatterns = [
+            {
+                pattern: /["']sk-[a-zA-Z0-9]{20,}["']/,
+                type: "openai-key",
+                message: "Hardcoded OpenAI API key",
+            },
+            {
+                pattern: /["']pk_(?:live|test)_[a-zA-Z0-9]{20,}["']/,
+                type: "stripe-key",
+                message: "Hardcoded Stripe API key",
+            },
+            {
+                pattern: /["']ghp_[a-zA-Z0-9]{36}["']/,
+                type: "github-token",
+                message: "Hardcoded GitHub token",
+            },
+            { pattern: /["']AKIA[A-Z0-9]{16}["']/, type: "aws-key", message: "Hardcoded AWS access key" },
+            {
+                pattern: /["'](?:password|passwd|pwd)\s*[:=]\s*["'][^"']{8,}["']/,
+                type: "password",
+                message: "Hardcoded password",
+            },
+            {
+                pattern: /["'](?:secret|api_?key)\s*[:=]\s*["'][^"']{10,}["']/i,
+                type: "generic-secret",
+                message: "Potential hardcoded secret",
+            },
+            {
+                pattern: /Authorization.*Bearer\s+[a-zA-Z0-9._-]{20,}/,
+                type: "bearer-token",
+                message: "Hardcoded bearer token",
+            },
+        ];
+        // False positive patterns (environment variable references, etc.)
+        const falsePositivePatterns = [
+            /process\.env\./,
+            /env\(\)/,
+            /getEnv/,
+            /["']sk-\[/, // Placeholder
+            /["']sk-xxx/i, // Placeholder
+            /["']your[-_]?api[-_]?key/i,
+        ];
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            lines.forEach((line, index) => {
+                // Skip comments
+                if (line.trim().startsWith("//") || line.trim().startsWith("*"))
+                    return;
+                // Skip if it's a false positive pattern
+                if (falsePositivePatterns.some((fp) => fp.test(line)))
+                    return;
+                for (const { pattern, type, message } of secretPatterns) {
+                    if (pattern.test(line)) {
+                        issues.push({
+                            file,
+                            line: index + 1,
+                            type,
+                            severity: "error",
+                            message,
+                            suggestion: "Move to environment variables and use process.env",
+                            snippet: line.trim().substring(0, 60) + "...[REDACTED]",
+                        });
+                    }
+                }
+            });
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Secret Detection",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 5: React Hook Rules (BLOCKING)
+     *
+     * Hooks must follow the rules of hooks:
+     * - Only call hooks at the top level
+     * - Only call hooks from React functions
+     *
+     * This is a simplified heuristic check - use ESLint react-hooks plugin for comprehensive coverage.
+     * Only flags obvious violations: hooks directly inside if/else/switch/try/catch blocks.
+     */
+    async checkReactHookRules() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getComponentHookFiles();
+        // Known hook patterns
+        const hookPattern = /\b(use[A-Z]\w+|useState|useEffect|useCallback|useMemo|useRef|useContext|useReducer|useLayoutEffect|useImperativeHandle|useDebugValue)\s*\(/;
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            lines.forEach((line, index) => {
+                // Skip comments
+                const trimmed = line.trim();
+                if (trimmed.startsWith("//") || trimmed.startsWith("*") || trimmed.startsWith("/*"))
+                    return;
+                // Look for hooks that appear immediately after conditional keywords
+                // Pattern: if (...) { useState(...) } or if (...) useState(...)
+                // Check for hook on a line that starts with conditional pattern
+                const conditionalHookPattern = /^\s*(if|else|switch|case|default|try|catch|finally)\s*[\({].*use[A-Z]\w+\s*\(/;
+                if (conditionalHookPattern.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "conditional-hook-inline",
+                        severity: "error",
+                        message: "Hook called in conditional statement - violates Rules of Hooks",
+                        suggestion: "Move hook call to top level of component, before any conditionals",
+                        snippet: trimmed.substring(0, 80),
+                    });
+                    return;
+                }
+                // Check for hooks inside callback functions that might be called conditionally
+                // Example: .filter(x => useHook())
+                if (/\.\s*(filter|find|some|every|reduce|map|forEach)\s*\([^)]*use[A-Z]\w+/.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "callback-hook",
+                        severity: "error",
+                        message: "Hook called inside array callback - violates Rules of Hooks",
+                        suggestion: "Extract the hook to component level and pass values to callback",
+                        snippet: trimmed.substring(0, 80),
+                    });
+                    return;
+                }
+                // Check for ternary operators with hooks
+                // Example: condition ? useHookA() : useHookB()
+                if (/\?\s*use[A-Z]\w+\s*\(|\:\s*use[A-Z]\w+\s*\(/.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "ternary-hook",
+                        severity: "error",
+                        message: "Hook called in ternary expression - violates Rules of Hooks",
+                        suggestion: "Call both hooks unconditionally and choose result conditionally",
+                        snippet: trimmed.substring(0, 80),
+                    });
+                    return;
+                }
+                // Check for hooks in logical expressions
+                // Example: condition && useHook()
+                if (/\&\&\s*use[A-Z]\w+\s*\(|\|\|\s*use[A-Z]\w+\s*\(/.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "logical-hook",
+                        severity: "error",
+                        message: "Hook called in logical expression - violates Rules of Hooks",
+                        suggestion: "Call hooks unconditionally at component top level",
+                        snippet: trimmed.substring(0, 80),
+                    });
+                }
+            });
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "React Hook Rules",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 9: Prisma Enum Literal Validation (BLOCKING)
+     *
+     * Prevents runtime PrismaClientValidationError caused by passing incorrect
+     * enum values (commonly lowercase strings) into Prisma queries/mutations.
+     */
+    async checkPrismaEnumLiterals() {
+        const startTime = Date.now();
+        const issues = [];
+        const schemaPath = path.join(process.cwd(), "prisma", "schema.prisma");
+        if (!fs.existsSync(schemaPath)) {
+            return {
+                name: "Prisma Enum Literals",
+                passed: false,
+                blocking: true,
+                issues: [
+                    {
+                        file: schemaPath,
+                        line: 0,
+                        type: "missing-schema",
+                        severity: "error",
+                        message: "Missing prisma/schema.prisma - cannot validate enum literals",
+                    },
+                ],
+                duration: Date.now() - startTime,
+            };
+        }
+        const schema = fs.readFileSync(schemaPath, "utf8");
+        // Parse enums: enum Name { VALUE ... }
+        const enumValues = new Map();
+        const enumValueByLower = new Map();
+        {
+            const enumRegex = /\benum\s+(\w+)\s*\{([\s\S]*?)\n\}/g;
+            let match;
+            while ((match = enumRegex.exec(schema))) {
+                const enumName = match[1];
+                const body = match[2] ?? "";
+                const values = body
+                    .split("\n")
+                    .map((line) => line.replace(/\/\/.*$/, "").trim())
+                    .filter((line) => line.length > 0)
+                    .map((line) => line.split(/\s+/)[0] ?? "")
+                    .filter((token) => token.length > 0 && token !== "}" && token !== "{");
+                if (values.length > 0) {
+                    enumValues.set(enumName, values);
+                    const lowerMap = new Map();
+                    for (const value of values) {
+                        lowerMap.set(value.toLowerCase(), value);
+                    }
+                    enumValueByLower.set(enumName, lowerMap);
+                }
+            }
+        }
+        if (enumValues.size === 0) {
+            return {
+                name: "Prisma Enum Literals",
+                passed: true,
+                blocking: true,
+                issues: [],
+                duration: Date.now() - startTime,
+            };
+        }
+        // Parse model fields whose type is an enum.
+        // Map: fieldName -> set(enumName)
+        const enumFieldNames = new Map();
+        {
+            const modelRegex = /\bmodel\s+(\w+)\s*\{([\s\S]*?)\n\}/g;
+            let match;
+            while ((match = modelRegex.exec(schema))) {
+                const body = match[2] ?? "";
+                for (const rawLine of body.split("\n")) {
+                    const line = rawLine.replace(/\/\/.*$/, "").trim();
+                    if (!line)
+                        continue;
+                    if (line.startsWith("@@"))
+                        continue;
+                    if (line.startsWith("@"))
+                        continue;
+                    const parts = line.split(/\s+/);
+                    const fieldName = parts[0];
+                    const typeTokenRaw = parts[1];
+                    if (!fieldName || !typeTokenRaw)
+                        continue;
+                    const typeToken = typeTokenRaw.replace(/\?$/, "").replace(/\[\]$/, "");
+                    if (!enumValues.has(typeToken))
+                        continue;
+                    const set = enumFieldNames.get(fieldName) ?? new Set();
+                    set.add(typeToken);
+                    enumFieldNames.set(fieldName, set);
+                }
+            }
+        }
+        if (enumFieldNames.size === 0) {
+            return {
+                name: "Prisma Enum Literals",
+                passed: true,
+                blocking: true,
+                issues: [],
+                duration: Date.now() - startTime,
+            };
+        }
+        const files = await file_cache_1.fileCache.getFiles("{app/api,lib}/**/*.{ts,tsx}", { ignore: EXCLUDED });
+        const keyValueRegex = /\b([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(['"])([A-Za-z_][A-Za-z0-9_]*)\2/g;
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!content.includes("prisma."))
+                continue;
+            const lines = content.split("\n");
+            const prismaLineIndexes = [];
+            for (let i = 0; i < lines.length; i++) {
+                if ((lines[i] ?? "").includes("prisma."))
+                    prismaLineIndexes.push(i);
+            }
+            // Heuristic ignore: progress callback payloads often have `status: "processing"`
+            // and other literals that are NOT Prisma enum fields, but may be located near Prisma
+            // usage in the same file. This avoids false positives without weakening Prisma writes.
+            const ignoreEnumLiteralLine = new Array(lines.length).fill(false);
+            {
+                let inOnProgressObject = false;
+                let inInterfaceOrType = false;
+                let inResultsPush = false;
+                let braceDepth = 0;
+                for (let i = 0; i < lines.length; i++) {
+                    const raw = lines[i] ?? "";
+                    // Track interface/type definitions (not Prisma writes)
+                    if (!inInterfaceOrType && /^\s*(?:interface|type)\s+\w+/.test(raw)) {
+                        inInterfaceOrType = true;
+                        braceDepth = 0;
+                    }
+                    if (inInterfaceOrType) {
+                        braceDepth += (raw.match(/\{/g) || []).length;
+                        braceDepth -= (raw.match(/\}/g) || []).length;
+                        ignoreEnumLiteralLine[i] = true;
+                        if (braceDepth <= 0 && raw.includes("}")) {
+                            inInterfaceOrType = false;
+                        }
+                    }
+                    // Track results.push({ ... }) patterns (local result objects, not Prisma)
+                    if (!inResultsPush && /results\.push\s*\(\s*\{/.test(raw)) {
+                        inResultsPush = true;
+                    }
+                    if (inResultsPush) {
+                        ignoreEnumLiteralLine[i] = true;
+                        if (/\}\s*\)\s*;/.test(raw) || raw.includes("});")) {
+                            inResultsPush = false;
+                        }
+                    }
+                    // Track onProgress callback payloads
+                    if (!inOnProgressObject && /\bonProgress\?\.\s*\(\s*\{/.test(raw)) {
+                        inOnProgressObject = true;
+                    }
+                    if (inOnProgressObject) {
+                        ignoreEnumLiteralLine[i] = true;
+                        if (/\}\s*\)\s*;/.test(raw) || raw.includes("});")) {
+                            inOnProgressObject = false;
+                        }
+                    }
+                }
+            }
+            // Cheap guard: if no Prisma usage, skip
+            if (prismaLineIndexes.length === 0)
+                continue;
+            for (let index = 0; index < lines.length; index++) {
+                const rawLine = lines[index] ?? "";
+                const line = rawLine.trim();
+                if (ignoreEnumLiteralLine[index])
+                    continue;
+                // Skip comment-only lines
+                if (line.startsWith("//") || line.startsWith("*"))
+                    continue;
+                // Only consider lines near Prisma usage to reduce false positives.
+                const minDistance = prismaLineIndexes.reduce((min, prismaIndex) => {
+                    const dist = Math.abs(prismaIndex - index);
+                    return dist < min ? dist : min;
+                }, Number.POSITIVE_INFINITY);
+                if (minDistance > 50)
+                    continue;
+                keyValueRegex.lastIndex = 0;
+                let m;
+                while ((m = keyValueRegex.exec(rawLine))) {
+                    const fieldName = m[1];
+                    const literal = m[3];
+                    const enumCandidates = enumFieldNames.get(fieldName);
+                    if (!enumCandidates)
+                        continue;
+                    const lower = literal.toLowerCase();
+                    for (const enumName of enumCandidates) {
+                        const lowerMap = enumValueByLower.get(enumName);
+                        if (!lowerMap)
+                            continue;
+                        const expected = lowerMap.get(lower);
+                        if (!expected)
+                            continue;
+                        // If the literal matches a known enum value case-insensitively, require exact match.
+                        if (literal !== expected) {
+                            issues.push({
+                                file,
+                                line: index + 1,
+                                type: "prisma-enum-literal",
+                                severity: "error",
+                                message: `Prisma enum field "${fieldName}" uses "${literal}" but schema expects ${enumName}.${expected}`,
+                                suggestion: `Use ${enumName}.${expected} (import from @prisma/client) or the exact string "${expected}"`,
+                                snippet: rawLine.trim().substring(0, 140),
+                            });
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Prisma Enum Literals",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 6: Floating Promise Detection (BLOCKING)
+     *
+     * Promises that are not awaited or handled can cause silent failures.
+     */
+    async checkFloatingPromises() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibFiles();
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            lines.forEach((line, index) => {
+                // Skip comments
+                if (line.trim().startsWith("//") || line.trim().startsWith("*"))
+                    return;
+                // Pattern: Calling async function without await, .then(), or .catch()
+                // This is a simplified check - comprehensive check needs TypeScript analysis
+                // Check for Promise.all/Promise.race/Promise.allSettled without await
+                if (/(?<!await\s+)Promise\.(all|race|allSettled)\s*\(/.test(line) &&
+                    !/\.then\(|\.catch\(|await/.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "floating-promise",
+                        severity: "warning",
+                        message: "Promise.* call may not be awaited",
+                        suggestion: "Add await or handle with .then()/.catch()",
+                        snippet: line.trim().substring(0, 80),
+                    });
+                }
+                // Check for fetch() without await
+                if (/(?<!await\s+)fetch\s*\(/.test(line) &&
+                    !/\.then\(|\.catch\(|await|=\s*fetch/.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "floating-fetch",
+                        severity: "warning",
+                        message: "fetch() call may not be awaited",
+                        suggestion: "Add await or handle the promise",
+                        snippet: line.trim().substring(0, 80),
+                    });
+                }
+            });
+        }
+        // These are warnings, not blocking
+        return {
+            name: "Floating Promise Detection",
+            passed: true,
+            blocking: false,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 7: CVA Enforcement for Variant Components (WARNING ${chars.arrow} BLOCKING after migration)
+     *
+     * Components with variant/size props MUST use CVA for type-safe, consistent styling.
+     */
+    async checkCvaEnforcement() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await file_cache_1.fileCache.getFiles("components/**/*.{tsx,jsx}", {
+            ignore: [...EXCLUDED, "**/ui/**"], // Skip UI package which should already use CVA
+        });
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            // Check if component declares variant/size props
+            const hasVariantProp = /\bvariant\s*[?:]?\s*:\s*(?:string|['"][^'"]+['"]|VariantProps)/.test(content);
+            const hasSizeProp = /\bsize\s*[?:]?\s*:\s*(?:string|['"][^'"]+['"])/.test(content);
+            // Check if using CVA
+            const hasCva = /import.*\bcva\b|from\s+['"]class-variance-authority['"]/.test(content);
+            // Heuristic: only require CVA when variant/size appear to be used for runtime styling/branching.
+            // This avoids false positives for thin wrapper components that simply type and forward variant/size
+            // into a downstream CVA-backed UI component.
+            const usesVariantAtRuntime = lines.some((line) => {
+                const trimmed = line.trim();
+                if (trimmed.startsWith("//") || trimmed.startsWith("*"))
+                    return false;
+                // Only flag when variant/size drive style branching (not simple forwarding)
+                if (/\bvariant\b\s*===?/.test(trimmed))
+                    return true;
+                if (/\bsize\b\s*===?/.test(trimmed))
+                    return true;
+                if (/\bswitch\s*\(\s*variant\s*\)/.test(trimmed))
+                    return true;
+                if (/\bswitch\s*\(\s*size\s*\)/.test(trimmed))
+                    return true;
+                if (/\$\{\s*variant\s*\}/.test(trimmed))
+                    return true;
+                if (/\$\{\s*size\s*\}/.test(trimmed))
+                    return true;
+                return false;
+            });
+            if ((hasVariantProp || hasSizeProp) && usesVariantAtRuntime && !hasCva) {
+                // Find the first line that defines variant/size to point the developer at the API surface.
+                for (let index = 0; index < lines.length; index++) {
+                    const line = lines[index] ?? "";
+                    if (/\bvariant\s*[?:]?\s*:/.test(line) || /\bsize\s*[?:]?\s*:/.test(line)) {
+                        issues.push({
+                            file,
+                            line: index + 1,
+                            type: "missing-cva",
+                            severity: "warning", // Will become 'error' after migration
+                            message: "Component uses variant/size for styling but is missing CVA",
+                            suggestion: 'Import cva from "class-variance-authority" and define variants',
+                            snippet: line.trim().substring(0, 120),
+                        });
+                        break;
+                    }
+                }
+            }
+            // Check for manual variant handling
+            lines.forEach((line, index) => {
+                // Pattern: variant === "primary" ? "..." : "..."
+                if (/variant\s*===?\s*["'][^"']+["']\s*\?/.test(line)) {
+                    if (!hasCva) {
+                        issues.push({
+                            file,
+                            line: index + 1,
+                            type: "manual-variant-handling",
+                            severity: "warning",
+                            message: "Manual variant ternary should use CVA variants",
+                            suggestion: "Define variants with cva() for type-safe styling",
+                            snippet: line.trim().substring(0, 80),
+                        });
+                    }
+                }
+            });
+        }
+        // Currently warning-only during migration
+        return {
+            name: "CVA Enforcement",
+            passed: true,
+            blocking: false, // Will become blocking after migration complete
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 8: Unsafe Type Assertions in Critical Paths (WARNING)
+     *
+     * Excessive 'as any' or 'as unknown' can hide type errors.
+     */
+    async checkTypeSafety() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await file_cache_1.fileCache.getFiles("{app/api,lib/api}/**/*.{ts,tsx}", { ignore: EXCLUDED });
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            lines.forEach((line, index) => {
+                // Skip comments
+                if (line.trim().startsWith("//") || line.trim().startsWith("*"))
+                    return;
+                // Check for dangerous patterns
+                if (/as\s+any\s*\)\./.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "dangerous-any-chain",
+                        severity: "warning",
+                        message: '"as any" followed by property access - potential runtime error',
+                        suggestion: "Use proper type narrowing or type guards",
+                        snippet: line.trim().substring(0, 80),
+                    });
+                }
+                // Check for 'as unknown as X' pattern (double casting)
+                if (/as\s+unknown\s+as\s+/.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "double-cast",
+                        severity: "warning",
+                        message: "Double type assertion (as unknown as X) - indicates type mismatch",
+                        suggestion: "Review types and fix the underlying type issue",
+                        snippet: line.trim().substring(0, 80),
+                    });
+                }
+            });
+        }
+        return {
+            name: "Type Safety",
+            passed: true,
+            blocking: false,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 9: ESLint Concurrency Enforcement (BLOCKING)
+     *
+     * ESLint must run with multithreading enabled in our scripts/preflights.
+     * ESLint v9 defaults to `--concurrency off`, so we hard-fail if any
+     * maintained runner regresses and drops the flag.
+     */
+    async checkEslintConcurrencyEnforcement() {
+        const startTime = Date.now();
+        const issues = [];
+        const requiredScriptKeys = [
+            { key: "lint", suggestion: "Ensure lint script includes `--concurrency auto`." },
+            { key: "lint:fix", suggestion: "Ensure lint:fix script includes `--concurrency auto`." },
+        ];
+        const requiredFiles = [
+            {
+                file: "scripts/active/preflights/specialized/lint-validation.ts",
+                mustInclude: /--concurrency\s+auto/,
+                suggestion: "Add `--concurrency auto` to the ESLint command used by lint-validation preflight.",
+            },
+            {
+                file: "scripts/active/preflights/utils/eslint-integration.ts",
+                mustInclude: /--concurrency\s+auto/,
+                suggestion: "Ensure ESLintIntegration always adds `--concurrency auto` when invoking ESLint.",
+            },
+        ];
+        const lineOfIndex = (content, index) => {
+            if (index <= 0)
+                return 1;
+            return content.slice(0, index).split("\n").length;
+        };
+        const readText = (relPath) => {
+            const abs = path.join(process.cwd(), relPath);
+            return { abs, content: fs.readFileSync(abs, "utf8") };
+        };
+        // 1) package.json scripts must include --concurrency (and not off)
+        try {
+            const { abs, content } = readText("package.json");
+            const parsed = JSON.parse(content);
+            const scripts = parsed?.scripts;
+            if (!scripts) {
+                issues.push({
+                    file: abs,
+                    line: 1,
+                    type: "missing-scripts",
+                    severity: "error",
+                    message: "package.json missing scripts section",
+                });
+            }
+            else {
+                for (const { key, suggestion } of requiredScriptKeys) {
+                    const value = scripts[key];
+                    if (!value) {
+                        issues.push({
+                            file: abs,
+                            line: 1,
+                            type: "missing-script",
+                            severity: "error",
+                            message: `package.json scripts.${key} is missing`,
+                            suggestion,
+                        });
+                        continue;
+                    }
+                    const hasConcurrency = /--concurrency\b/.test(value);
+                    const explicitlyOff = /--concurrency\s+off\b/.test(value);
+                    if (!hasConcurrency || explicitlyOff) {
+                        const idx = content.indexOf(`\"${key}\"`);
+                        issues.push({
+                            file: abs,
+                            line: lineOfIndex(content, idx),
+                            type: "eslint-concurrency-missing",
+                            severity: "error",
+                            message: `package.json scripts.${key} must enable ESLint multithreading (missing/disabled --concurrency)`,
+                            suggestion,
+                            snippet: value.substring(0, 140),
+                        });
+                    }
+                }
+            }
+        }
+        catch (error) {
+            issues.push({
+                file: "package.json",
+                line: 1,
+                type: "package-json-read-failed",
+                severity: "error",
+                message: `Failed reading/parsing package.json: ${error?.message ?? String(error)}`,
+            });
+        }
+        // 2) Known maintained runners must include concurrency
+        for (const entry of requiredFiles) {
+            try {
+                const { abs, content } = readText(entry.file);
+                if (!entry.mustInclude.test(content)) {
+                    issues.push({
+                        file: abs,
+                        line: 1,
+                        type: "eslint-concurrency-missing",
+                        severity: "error",
+                        message: `Missing required ESLint concurrency flag in ${entry.file}`,
+                        suggestion: entry.suggestion,
+                    });
+                }
+            }
+            catch (error) {
+                issues.push({
+                    file: entry.file,
+                    line: 1,
+                    type: "file-read-failed",
+                    severity: "error",
+                    message: `Failed to read ${entry.file}: ${error?.message ?? String(error)}`,
+                });
+            }
+        }
+        // 3) Scan preflight scripts for direct execSync('...eslint...') usage without concurrency
+        try {
+            const preflightFiles = await file_cache_1.fileCache.getFiles("scripts/active/preflights/**/*.{ts,js,mjs,cjs}", { ignore: EXCLUDED });
+            const literalRe = /execSync\(\s*([`"'])([\s\S]*?)\1\s*(?:,|\))/g;
+            for (const file of preflightFiles) {
+                const content = fs.readFileSync(file, "utf8");
+                let match;
+                // eslint-disable-next-line no-cond-assign
+                while ((match = literalRe.exec(content))) {
+                    const cmd = match[2] ?? "";
+                    if (!/\beslint\b/.test(cmd))
+                        continue;
+                    // Allow non-lint informational calls
+                    if (/\beslint\b\s+--(?:help|version)\b/.test(cmd))
+                        continue;
+                    const hasConcurrency = /--concurrency\b/.test(cmd);
+                    const explicitlyOff = /--concurrency\s+off\b/.test(cmd);
+                    if (!hasConcurrency || explicitlyOff) {
+                        issues.push({
+                            file,
+                            line: lineOfIndex(content, match.index),
+                            type: "eslint-concurrency-missing",
+                            severity: "error",
+                            message: "Preflight execSync ESLint command missing `--concurrency` (defaults to off)",
+                            suggestion: "Add `--concurrency auto` to the ESLint command string.",
+                            snippet: cmd.replace(/\s+/g, " ").trim().substring(0, 140),
+                        });
+                    }
+                }
+            }
+        }
+        catch (error) {
+            issues.push({
+                file: "scripts/active/preflights/**",
+                line: 1,
+                type: "preflight-scan-failed",
+                severity: "warning",
+                message: `Failed scanning preflight scripts for ESLint commands: ${error?.message ?? String(error)}`,
+            });
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "ESLint Concurrency Enforcement",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 10: CardGraded Semantics (BLOCKING)
+     *
+     * Guardrail: WATA is a video-game grader and must not appear as a `CardGraded`
+     * value on catalogNonSportsCards writes (create/upsert/update).
+     */
+    async checkCardGradedSemantics() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await file_cache_1.fileCache.getFiles("{app,lib,scripts,components}/**/*.{ts,tsx,js,jsx}", {
+            ignore: EXCLUDED,
+        });
+        const callPattern = /catalogNonSportsCards\.(?:create|createMany|upsert|update|updateMany)\s*\(/;
+        const violationPattern = /catalogNonSportsCards\.(?:create|createMany|upsert|update|updateMany)\s*\([\s\S]{0,2500}?\bgraded\s*:\s*(?:CardGraded\.)?["']WATA["']/;
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!callPattern.test(content))
+                continue;
+            // Fast path: no WATA anywhere in the file
+            if (!/\bWATA\b/.test(content))
+                continue;
+            const match = content.match(violationPattern);
+            if (!match)
+                continue;
+            issues.push({
+                file,
+                line: 1,
+                type: "cardgraded-wata-in-nonsports-write",
+                severity: "error",
+                message: "Invalid CardGraded usage: catalogNonSportsCards write sets graded to WATA",
+                suggestion: 'Use graded: "UNGRADED" (or another card-appropriate value). Video-game grading belongs in catalogVideoGames fields (grader/wataGrade/wataSealGrade).',
+                snippet: match[0].replace(/\s+/g, " ").trim().substring(0, 160),
+            });
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "CardGraded Semantics (No WATA in catalogNonSportsCards)",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 11: Card grade-field consistency (BLOCKING)
+     *
+     * Prevents semantically invalid grader/grade-field combinations:
+     * - graded: "PSA" + bgsGrade set
+     * - graded: "BGS" + psaGrade set
+     * - graded: "CGC" + psaGrade/bgsGrade/sgcGrade set
+     * - graded: "SGC" + psaGrade/bgsGrade/cgcGrade set
+     * - graded: "UNGRADED" + any grade field set
+     */
+    async checkCardGradeFieldConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /(?:catalog(?:SportsCards|NonSportsCards|TcgCards)|coreListings)\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const hasNonNullPsaGrade = /\bpsaGrade\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullBgsGrade = /\bbgsGrade\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullCgcGrade = /\bcgcGrade\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullSgcGrade = /\bsgcGrade\s*:\s*(?!null\b|undefined\b)/;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/(?:catalog(?:SportsCards|NonSportsCards|TcgCards)|coreListings)\./.test(content))
+                continue;
+            if (!/\bgraded\b|\bpsaGrade\b|\bbgsGrade\b|\bcgcGrade\b|\bsgcGrade\b/.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                const isPSA = /\bgraded\s*:\s*(?:CardGraded\.)?["']PSA["']/.test(window);
+                const isBGS = /\bgraded\s*:\s*(?:CardGraded\.)?["']BGS["']/.test(window);
+                const isCGC = /\bgraded\s*:\s*(?:CardGraded\.)?['"]CGC['"]/.test(window);
+                const isSGC = /\bgraded\s*:\s*(?:CardGraded\.)?['"]SGC['"]/.test(window);
+                const isUngraded = /\bgraded\s*:\s*(?:CardGraded\.)?["']UNGRADED["']/.test(window);
+                if (isPSA &&
+                    (hasNonNullBgsGrade.test(window) ||
+                        hasNonNullCgcGrade.test(window) ||
+                        hasNonNullSgcGrade.test(window))) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "grading-field-mismatch",
+                        severity: "error",
+                        message: "Invalid grading payload: graded is PSA but a non-PSA grade field is set",
+                        suggestion: "Clear bgsGrade/cgcGrade/sgcGrade (or change graded to match the grade field).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (isBGS &&
+                    (hasNonNullPsaGrade.test(window) ||
+                        hasNonNullCgcGrade.test(window) ||
+                        hasNonNullSgcGrade.test(window))) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "grading-field-mismatch",
+                        severity: "error",
+                        message: "Invalid grading payload: graded is BGS but a non-BGS grade field is set",
+                        suggestion: "Clear psaGrade/cgcGrade/sgcGrade (or change graded to match the grade field).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (isCGC &&
+                    (hasNonNullPsaGrade.test(window) ||
+                        hasNonNullBgsGrade.test(window) ||
+                        hasNonNullSgcGrade.test(window))) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "grading-field-mismatch",
+                        severity: "error",
+                        message: "Invalid grading payload: graded is CGC but a non-CGC grade field is set",
+                        suggestion: "Clear psaGrade/bgsGrade/sgcGrade (or change graded to match the grade field).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (isSGC &&
+                    (hasNonNullPsaGrade.test(window) ||
+                        hasNonNullBgsGrade.test(window) ||
+                        hasNonNullCgcGrade.test(window))) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "grading-field-mismatch",
+                        severity: "error",
+                        message: "Invalid grading payload: graded is SGC but a non-SGC grade field is set",
+                        suggestion: "Clear psaGrade/bgsGrade/cgcGrade (or change graded to match the grade field).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (isUngraded &&
+                    (hasNonNullPsaGrade.test(window) ||
+                        hasNonNullBgsGrade.test(window) ||
+                        hasNonNullCgcGrade.test(window) ||
+                        hasNonNullSgcGrade.test(window))) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "grading-field-mismatch",
+                        severity: "error",
+                        message: "Invalid grading payload: graded is UNGRADED but a grade field is set",
+                        suggestion: 'Either set graded to the correct grader (e.g., "PSA"/"BGS"/"CGC"/"SGC") or clear psaGrade/bgsGrade/cgcGrade/sgcGrade.',
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Card Grade Field Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 12: Serial number consistency (BLOCKING)
+     *
+     * Invariant:
+     * - If serialNumbered is true, serialNumber must be present and non-empty.
+     *
+     * This catches common catalog/listing data-quality bugs in write payloads.
+     */
+    async checkSerialNumberConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /(catalog(?:SportsCards|NonSportsCards|TcgCards)|coreListings)\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const serialFlagTrue = /\bserialNumbered\s*:\s*true\b/;
+        const hasSerialField = /\bserialNumber\s*:/;
+        const serialEmpty = /\bserialNumber\s*:\s*(?:''|""|null|undefined)\b/;
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/serialNumbered|serialNumber/.test(content))
+                continue;
+            if (!/(catalog(?:SportsCards|NonSportsCards|TcgCards)|coreListings)\./.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                if (!serialFlagTrue.test(window))
+                    continue;
+                if (!hasSerialField.test(window) || serialEmpty.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "serial-number-missing",
+                        severity: "error",
+                        message: "Invalid payload: serialNumbered is true but serialNumber is missing/empty",
+                        suggestion: "Provide a non-empty serialNumber when serialNumbered is true (or set serialNumbered to false).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Serial Number Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 13: Autograph consistency (BLOCKING)
+     *
+     * Invariants:
+     * - If autographedAuthenticated/autographAuthenticated is true, autographed must be true.
+     * - If autographed is explicitly false, autograph auth fields should not be populated.
+     */
+    async checkAutographConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /(catalog(?:SportsCards|NonSportsCards|TcgCards)|coreListings)\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const autographedTrue = /\bautographed\s*:\s*true\b/;
+        const autographedFalse = /\bautographed\s*:\s*false\b/;
+        const authenticatedTrue = /\b(?:autographedAuthenticated|autographAuthenticated)\s*:\s*true\b/;
+        const hasAuthenticationValue = /\bautographAuthentication\s*:\s*(?!null\b|undefined\b|''|""\b)/;
+        const hasSigners = /\bautographSigners\s*:\s*\[/;
+        const hasAutographGradedValue = /\bautographGraded\s*:\s*(?!null\b|undefined\b|''|""\b)/;
+        const hasAutographGradeField = /\b(?:autographPsaGrade|autographBgsGrade|autographJsaGrade|autographSgcGrade)\s*:\s*(?!null\b|undefined\b)/;
+        const hasAutographGradeMetadata = (w) => hasAutographGradedValue.test(w) || hasAutographGradeField.test(w);
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/autograph|autographed/.test(content))
+                continue;
+            if (!/(catalog(?:SportsCards|NonSportsCards|TcgCards)|coreListings)\./.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                const isAutographed = autographedTrue.test(window);
+                if (authenticatedTrue.test(window) && !isAutographed) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "autograph-auth-without-autograph",
+                        severity: "error",
+                        message: "Invalid payload: autograph authenticated flag is true but autographed is not true",
+                        suggestion: "Set autographed: true when setting autographAuthenticated/autographedAuthenticated: true.",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (authenticatedTrue.test(window) && !hasAuthenticationValue.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "autograph-auth-missing-authentication-method",
+                        severity: "error",
+                        message: "Invalid payload: autograph authenticated flag is true but autographAuthentication is missing/empty",
+                        suggestion: 'Provide autographAuthentication (e.g., "PSA/DNA", "BGS", "JSA") when setting autographAuthenticated/autographedAuthenticated: true.',
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (hasAutographGradeMetadata(window) && !isAutographed) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "autograph-grade-without-autograph",
+                        severity: "error",
+                        message: "Invalid payload: autograph grading fields are populated but autographed is not true",
+                        suggestion: "Set autographed: true when setting autographGraded/autograph*Grade fields (or clear those fields).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (autographedFalse.test(window) &&
+                    (hasAuthenticationValue.test(window) ||
+                        hasSigners.test(window) ||
+                        authenticatedTrue.test(window) ||
+                        hasAutographGradeMetadata(window))) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "autograph-fields-with-autographed-false",
+                        severity: "error",
+                        message: "Invalid payload: autographed is false but autograph fields/auth flags are populated",
+                        suggestion: "Either set autographed: true or clear autographAuthentication/autographSigners/auth flags and any autograph grading fields.",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Autograph Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 14: Video game grading consistency (BLOCKING)
+     *
+     * Invariants (conservative / low false positives):
+     * - If graded is explicitly true, grader must be present and not null/undefined.
+     * - If graded is explicitly false, grader/wataGrade/wataSealGrade must not be populated.
+     * - If wataSealGrade is set and grader is an explicit literal, it must be WATA.
+     */
+    async checkVideoGameGradingConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /catalogVideoGames\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const gradedTrue = /\bgraded\s*:\s*true\b/;
+        const gradedFalse = /\bgraded\s*:\s*false\b/;
+        const hasGraderField = /\bgrader\s*:/;
+        const graderEmpty = /\bgrader\s*:\s*(?:null|undefined)\b/;
+        const graderNonNull = /\bgrader\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullWataGrade = /\bwataGrade\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullWataSealGrade = /\bwataSealGrade\s*:\s*(?!null\b|undefined\b)/;
+        const graderLiteralNotWata = /\bgrader\s*:\s*(?:GameGrader\.)?['"](?!WATA\b)[A-Z_]+['"]/;
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/catalogVideoGames\./.test(content))
+                continue;
+            if (!/\bgraded\b|\bgrader\b|\bwataGrade\b|\bwataSealGrade\b/.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                if (gradedTrue.test(window)) {
+                    if (!hasGraderField.test(window) || graderEmpty.test(window)) {
+                        issues.push({
+                            file,
+                            line: 1,
+                            type: "videogame-grading-missing-grader",
+                            severity: "error",
+                            message: "Invalid payload: catalogVideoGames graded is true but grader is missing/empty",
+                            suggestion: 'Set grader when graded: true (e.g., "WATA"/"VGA"/"CGC_GAMES") or set graded to false.',
+                            snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                        });
+                    }
+                }
+                if (gradedFalse.test(window)) {
+                    if (graderNonNull.test(window) ||
+                        hasNonNullWataGrade.test(window) ||
+                        hasNonNullWataSealGrade.test(window)) {
+                        issues.push({
+                            file,
+                            line: 1,
+                            type: "videogame-grading-fields-while-ungraded",
+                            severity: "error",
+                            message: "Invalid payload: catalogVideoGames graded is false but grading fields are populated",
+                            suggestion: "Clear grader/wataGrade/wataSealGrade when graded is false (or set graded to true).",
+                            snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                        });
+                    }
+                }
+                if (hasNonNullWataSealGrade.test(window) && graderLiteralNotWata.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "videogame-watasealgrade-nonwata",
+                        severity: "error",
+                        message: "Invalid payload: wataSealGrade is set but grader is explicitly not WATA",
+                        suggestion: 'Only set wataSealGrade with grader: "WATA" (or clear wataSealGrade).',
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Video Game Grading Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 15: Syndication consistency (BLOCKING)
+     *
+     * Invariant:
+     * - If syndicatedToEbay/Amazon/Tcgplayer/Preplo is true, the corresponding
+     *   platform listing id must be present and non-empty.
+     */
+    async checkSyndicationConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /coreListings\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const makeFlagTrue = (flag) => new RegExp(`\\b${flag}\\s*:\\s*true\\b`);
+        const makeIdField = (idField) => new RegExp(`\\b${idField}\\s*:`);
+        const makeIdEmpty = (idField) => new RegExp(`\\b${idField}\\s*:\\s*(?:''|\"\"|null|undefined)\\b`);
+        const rules = [
+            { flag: "syndicatedToEbay", id: "ebayListingId" },
+            { flag: "syndicatedToAmazon", id: "amazonListingId" },
+            { flag: "syndicatedToTcgplayer", id: "tcgPlayerListingId" },
+            { flag: "syndicatedToPreplo", id: "preploListingId" },
+        ];
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/coreListings\./.test(content))
+                continue;
+            if (!/syndicatedTo(Ebay|Amazon|Tcgplayer|Preplo)|ListingId/.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                for (const rule of rules) {
+                    const flagTrue = makeFlagTrue(rule.flag);
+                    if (!flagTrue.test(window))
+                        continue;
+                    const hasId = makeIdField(rule.id).test(window);
+                    const idEmpty = makeIdEmpty(rule.id).test(window);
+                    if (!hasId || idEmpty) {
+                        issues.push({
+                            file,
+                            line: 1,
+                            type: "syndication-missing-platform-id",
+                            severity: "error",
+                            message: `Invalid payload: ${rule.flag} is true but ${rule.id} is missing/empty`,
+                            suggestion: `Provide ${rule.id} when setting ${rule.flag}: true (or set ${rule.flag}: false).`,
+                            snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                        });
+                    }
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Syndication Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 16: Featured consistency (BLOCKING)
+     *
+     * Invariants (low false positives):
+     * - If featuredUntil is set (non-null), featured must be true.
+     * - If featured is explicitly false, featuredUntil must not be populated.
+     */
+    async checkFeaturedConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /coreListings\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const featuredTrue = /\bfeatured\s*:\s*true\b/;
+        const featuredFalse = /\bfeatured\s*:\s*false\b/;
+        const featuredUntilNonNull = /\bfeaturedUntil\s*:\s*(?!null\b|undefined\b)/;
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/coreListings\./.test(content))
+                continue;
+            if (!/\bfeatured\b|\bfeaturedUntil\b/.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                if (featuredUntilNonNull.test(window) && !featuredTrue.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "featured-until-without-featured",
+                        severity: "error",
+                        message: "Invalid payload: featuredUntil is set but featured is not true",
+                        suggestion: "Set featured: true when setting featuredUntil (or clear featuredUntil).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (featuredFalse.test(window) && featuredUntilNonNull.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "featured-false-with-featureduntil",
+                        severity: "error",
+                        message: "Invalid payload: featured is false but featuredUntil is populated",
+                        suggestion: "Clear featuredUntil when featured is false (or set featured: true).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Featured Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 17: Flagging consistency (BLOCKING)
+     *
+     * Invariants (low false positives):
+     * - If isFlagged is explicitly false, flaggedAt/flaggedReason/flaggedBy must not be populated.
+     * - If any flagged metadata is populated, isFlagged must be true.
+     */
+    async checkFlaggingConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /coreListings\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const flaggedTrue = /\bisFlagged\s*:\s*true\b/;
+        const flaggedFalse = /\bisFlagged\s*:\s*false\b/;
+        const flaggedReasonNonNull = /\bflaggedReason\s*:\s*(?!null\b|undefined\b|''|""\b)/;
+        const flaggedAtNonNull = /\bflaggedAt\s*:\s*(?!null\b|undefined\b)/;
+        const flaggedByNonNull = /\bflaggedBy\s*:\s*(?!null\b|undefined\b|''|""\b)/;
+        const anyFlagMetadata = (w) => flaggedReasonNonNull.test(w) || flaggedAtNonNull.test(w) || flaggedByNonNull.test(w);
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/coreListings\./.test(content))
+                continue;
+            if (!/isFlagged|flaggedReason|flaggedAt|flaggedBy/.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                if (flaggedFalse.test(window) && anyFlagMetadata(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "flag-metadata-while-unflagged",
+                        severity: "error",
+                        message: "Invalid payload: isFlagged is false but flagged metadata is populated",
+                        suggestion: "Clear flaggedReason/flaggedAt/flaggedBy when isFlagged is false (or set isFlagged: true).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (anyFlagMetadata(window) && !flaggedTrue.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "flag-metadata-without-flag",
+                        severity: "error",
+                        message: "Invalid payload: flagged metadata is populated but isFlagged is not true",
+                        suggestion: "Set isFlagged: true when setting flaggedReason/flaggedAt/flaggedBy (or clear the metadata).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Flagging Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 18: Soft delete consistency (BLOCKING)
+     *
+     * Invariants (low false positives):
+     * - If deletedBy is set (non-empty), deletedAt must be set (non-null).
+     * - If deletedAt is explicitly null/undefined, deletedBy must not be populated.
+     */
+    async checkSoftDeleteConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /coreListings\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const deletedByNonEmpty = /\bdeletedBy\s*:\s*(?!null\b|undefined\b|''|""\b)/;
+        const deletedAtNonNull = /\bdeletedAt\s*:\s*(?!null\b|undefined\b)/;
+        const deletedAtExplicitlyEmpty = /\bdeletedAt\s*:\s*(?:null|undefined)\b/;
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/coreListings\./.test(content))
+                continue;
+            if (!/deletedAt|deletedBy/.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                if (deletedByNonEmpty.test(window) && !deletedAtNonNull.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "deletedby-without-deletedat",
+                        severity: "error",
+                        message: "Invalid payload: deletedBy is set but deletedAt is not set",
+                        suggestion: "Set deletedAt when setting deletedBy (or clear deletedBy).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (deletedAtExplicitlyEmpty.test(window) && deletedByNonEmpty.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "deletedat-empty-with-deletedby",
+                        severity: "error",
+                        message: "Invalid payload: deletedAt is null/undefined but deletedBy is populated",
+                        suggestion: "Clear deletedBy when deletedAt is null/undefined (or set deletedAt to a timestamp).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Soft Delete Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 19: Seller approval consistency (BLOCKING)
+     *
+     * Invariants (low false positives):
+     * - If sellerApproved is true, sellerApprovedAt must be set (non-null).
+     * - If sellerApprovedAt is set, sellerApproved must be true.
+     * - If sellerApproved is explicitly false, sellerApprovedAt must not be populated.
+     */
+    async checkSellerApprovalConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /coreListings\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const approvedTrue = /\bsellerApproved\s*:\s*true\b/;
+        const approvedFalse = /\bsellerApproved\s*:\s*false\b/;
+        const approvedAtNonNull = /\bsellerApprovedAt\s*:\s*(?!null\b|undefined\b)/;
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/coreListings\./.test(content))
+                continue;
+            if (!/sellerApproved|sellerApprovedAt/.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                if (approvedTrue.test(window) && !approvedAtNonNull.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "seller-approved-missing-approvedat",
+                        severity: "error",
+                        message: "Invalid payload: sellerApproved is true but sellerApprovedAt is not set",
+                        suggestion: "Set sellerApprovedAt when setting sellerApproved: true (or set sellerApproved: false).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (approvedAtNonNull.test(window) && !approvedTrue.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "seller-approvedat-without-approved",
+                        severity: "error",
+                        message: "Invalid payload: sellerApprovedAt is set but sellerApproved is not true",
+                        suggestion: "Set sellerApproved: true when setting sellerApprovedAt (or clear sellerApprovedAt).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+                if (approvedFalse.test(window) && approvedAtNonNull.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "seller-approved-false-with-approvedat",
+                        severity: "error",
+                        message: "Invalid payload: sellerApproved is false but sellerApprovedAt is populated",
+                        suggestion: "Clear sellerApprovedAt when sellerApproved is false (or set sellerApproved: true).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Seller Approval Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 20: AI recognition metadata consistency (BLOCKING)
+     *
+     * Invariants (low false positives):
+     * - If recognitionConfidence is set, recognitionMethod must be set (non-empty).
+     * - If recognitionJobId is set, recognitionMethod must be set (non-empty).
+     */
+    async checkRecognitionMetadataConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /coreListings\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const confidenceNonNull = /\brecognitionConfidence\s*:\s*(?!null\b|undefined\b)/;
+        const jobIdNonEmpty = /\brecognitionJobId\s*:\s*(?!null\b|undefined\b|''|""\b)/;
+        const methodNonEmpty = /\brecognitionMethod\s*:\s*(?!null\b|undefined\b|''|""\b)/;
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/coreListings\./.test(content))
+                continue;
+            if (!/recognitionConfidence|recognitionJobId|recognitionMethod/.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                const needsMethod = confidenceNonNull.test(window) || jobIdNonEmpty.test(window);
+                if (needsMethod && !methodNonEmpty.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "recognition-metadata-missing-method",
+                        severity: "error",
+                        message: "Invalid payload: recognitionConfidence/recognitionJobId is set but recognitionMethod is missing/empty",
+                        suggestion: "Set recognitionMethod when setting recognitionConfidence/recognitionJobId (or clear those fields).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Recognition Metadata Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 21: Autograph grade-field consistency (BLOCKING)
+     *
+     * IMPORTANT: This is ONLY about autograph grading systems.
+     * It is VALID to have a card grade + autograph grade at the same time:
+     * - Example: psaGrade (card) + autographPsaGrade (PSA/DNA autograph) ${emoji.success}
+     * - Example: bgsGrade (card) + autographBgsGrade (BGS autograph) ${emoji.success}
+     *
+     * Invariant:
+     * - At most one of autographPsaGrade/autographBgsGrade/autographJsaGrade/autographSgcGrade
+     *   may be populated in a single coreListings write payload.
+     */
+    async checkAutographGradeFieldConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /coreListings\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const hasNonNullAutographPsaGrade = /\bautographPsaGrade\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullAutographBgsGrade = /\bautographBgsGrade\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullAutographJsaGrade = /\bautographJsaGrade\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullAutographSgcGrade = /\bautographSgcGrade\s*:\s*(?!null\b|undefined\b)/;
+        const countAutographGradeSystems = (w) => {
+            let count = 0;
+            if (hasNonNullAutographPsaGrade.test(w))
+                count++;
+            if (hasNonNullAutographBgsGrade.test(w))
+                count++;
+            if (hasNonNullAutographJsaGrade.test(w))
+                count++;
+            if (hasNonNullAutographSgcGrade.test(w))
+                count++;
+            return count;
+        };
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/coreListings\./.test(content))
+                continue;
+            if (!/autographPsaGrade|autographBgsGrade|autographJsaGrade|autographSgcGrade/.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                const gradeSystemsSet = countAutographGradeSystems(window);
+                if (gradeSystemsSet <= 1)
+                    continue;
+                issues.push({
+                    file,
+                    line: 1,
+                    type: "autograph-grade-field-mismatch",
+                    severity: "error",
+                    message: "Invalid payload: multiple autograph grade systems are populated in one write (PSA/BGS/JSA/SGC)",
+                    suggestion: "Only set one of autographPsaGrade/autographBgsGrade/autographJsaGrade/autographSgcGrade per listing. Card grade fields (psaGrade/bgsGrade/cgcGrade/sgcGrade) are separate and can coexist with a single autograph grade.",
+                    snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                });
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Autograph Grade Field Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Check 22: Autograph grading metadata consistency (BLOCKING)
+     *
+     * Best-practice invariants (low false positives):
+     * - If an autograph numeric grade is provided (autograph*Grade), `autographGraded` must also be set.
+     * - If `autographGraded` is a string literal, it must match the grading system used.
+     *
+     * NOTE: This does NOT require the card itself to be graded. It's valid for:
+     * - graded: UNGRADED + autographPsaGrade set ${emoji.success}
+     */
+    async checkAutographGradingMetadataConsistency() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppLibScriptsFiles();
+        const writeCallPattern = /coreListings\.(?:create|createMany|upsert|update|updateMany)\s*\(/g;
+        const extractCallObjectLiteral = (content, callStartIndex) => {
+            const firstBrace = content.indexOf("{", callStartIndex);
+            if (firstBrace === -1)
+                return null;
+            let depth = 0;
+            let inSingle = false;
+            let inDouble = false;
+            let inTemplate = false;
+            let inLineComment = false;
+            let inBlockComment = false;
+            let escaped = false;
+            for (let i = firstBrace; i < content.length; i++) {
+                const ch = content[i];
+                const next = content[i + 1];
+                if (inLineComment) {
+                    if (ch === "\n")
+                        inLineComment = false;
+                    continue;
+                }
+                if (inBlockComment) {
+                    if (ch === "*" && next === "/") {
+                        inBlockComment = false;
+                        i++;
+                    }
+                    continue;
+                }
+                if (!inSingle && !inDouble && !inTemplate) {
+                    if (ch === "/" && next === "/") {
+                        inLineComment = true;
+                        i++;
+                        continue;
+                    }
+                    if (ch === "/" && next === "*") {
+                        inBlockComment = true;
+                        i++;
+                        continue;
+                    }
+                }
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === "\\" && (inSingle || inDouble || inTemplate)) {
+                    escaped = true;
+                    continue;
+                }
+                if (!inDouble && !inTemplate && ch === "'") {
+                    inSingle = !inSingle;
+                    continue;
+                }
+                if (!inSingle && !inTemplate && ch === '"') {
+                    inDouble = !inDouble;
+                    continue;
+                }
+                if (!inSingle && !inDouble && ch === "`") {
+                    inTemplate = !inTemplate;
+                    continue;
+                }
+                if (inSingle || inDouble || inTemplate)
+                    continue;
+                if (ch === "{") {
+                    depth++;
+                    continue;
+                }
+                if (ch === "}") {
+                    depth--;
+                    if (depth === 0) {
+                        return content.slice(firstBrace, i + 1);
+                    }
+                }
+            }
+            return null;
+        };
+        const hasNonNullAutographPsaGrade = /\bautographPsaGrade\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullAutographBgsGrade = /\bautographBgsGrade\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullAutographJsaGrade = /\bautographJsaGrade\s*:\s*(?!null\b|undefined\b)/;
+        const hasNonNullAutographSgcGrade = /\bautographSgcGrade\s*:\s*(?!null\b|undefined\b)/;
+        const anyAutographGrade = (w) => hasNonNullAutographPsaGrade.test(w) ||
+            hasNonNullAutographBgsGrade.test(w) ||
+            hasNonNullAutographJsaGrade.test(w) ||
+            hasNonNullAutographSgcGrade.test(w);
+        const autographGradedNonEmpty = /\bautographGraded\s*:\s*(?!null\b|undefined\b|''|""\b)/;
+        const autographGradedLiteral = /\bautographGraded\s*:\s*['"]([^'\"]+)['"]/;
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            if (!/coreListings\./.test(content))
+                continue;
+            if (!/autographGraded|autographPsaGrade|autographBgsGrade|autographJsaGrade|autographSgcGrade/.test(content))
+                continue;
+            writeCallPattern.lastIndex = 0;
+            let match;
+            while ((match = writeCallPattern.exec(content)) !== null) {
+                const window = extractCallObjectLiteral(content, match.index);
+                if (!window)
+                    continue;
+                if (!anyAutographGrade(window))
+                    continue;
+                if (!autographGradedNonEmpty.test(window)) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "autograph-grade-missing-autographgraded",
+                        severity: "error",
+                        message: "Invalid payload: autograph grade is set but autographGraded is missing/empty",
+                        suggestion: 'Set autographGraded (e.g., "PSA/DNA", "BGS", "JSA", "SGC") when setting autographPsaGrade/autographBgsGrade/autographJsaGrade/autographSgcGrade.',
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                    continue;
+                }
+                const lit = window.match(autographGradedLiteral);
+                if (!lit)
+                    continue;
+                const value = (lit[1] ?? "").toLowerCase();
+                const expectsPsa = hasNonNullAutographPsaGrade.test(window);
+                const expectsBgs = hasNonNullAutographBgsGrade.test(window);
+                const expectsJsa = hasNonNullAutographJsaGrade.test(window);
+                const expectsSgc = hasNonNullAutographSgcGrade.test(window);
+                const matchesPsa = /psa|dna/.test(value);
+                const matchesBgs = /bgs|beckett/.test(value);
+                const matchesJsa = /jsa/.test(value);
+                const matchesSgc = /sgc/.test(value);
+                const mismatch = (expectsPsa && !matchesPsa) ||
+                    (expectsBgs && !matchesBgs) ||
+                    (expectsJsa && !matchesJsa) ||
+                    (expectsSgc && !matchesSgc);
+                if (mismatch) {
+                    issues.push({
+                        file,
+                        line: 1,
+                        type: "autograph-grade-autographgraded-mismatch",
+                        severity: "error",
+                        message: "Invalid payload: autograph grade system does not match autographGraded",
+                        suggestion: "Align autographGraded with the autograph grade field being set (PSA/DNA ↔ autographPsaGrade, BGS ↔ autographBgsGrade, JSA ↔ autographJsaGrade, SGC ↔ autographSgcGrade).",
+                        snippet: window.replace(/\s+/g, " ").trim().substring(0, 180),
+                    });
+                }
+            }
+        }
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "Autograph Grading Metadata Consistency",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * Run all hardened checks
+     */
+    async runAll() {
+        const startTime = Date.now();
+        console.log(`\n${console_chars_1.emoji.shield}  HARDENED PREFLIGHT CHECKS`);
+        console.log((0, console_chars_1.createDivider)(80, "heavy"));
+        const checks = [];
+        // BLOCKING CHECKS
+        checks.push(await this.checkEslintConcurrencyEnforcement());
+        checks.push(await this.checkDraftStatusEnforcement());
+        checks.push(await this.checkAsyncErrorHandling());
+        checks.push(await this.checkPrismaEnumLiterals());
+        checks.push(await this.checkCardGradedSemantics());
+        checks.push(await this.checkCardGradeFieldConsistency());
+        checks.push(await this.checkSerialNumberConsistency());
+        checks.push(await this.checkAutographConsistency());
+        checks.push(await this.checkVideoGameGradingConsistency());
+        checks.push(await this.checkSyndicationConsistency());
+        checks.push(await this.checkFeaturedConsistency());
+        checks.push(await this.checkFlaggingConsistency());
+        checks.push(await this.checkSoftDeleteConsistency());
+        checks.push(await this.checkSellerApprovalConsistency());
+        checks.push(await this.checkRecognitionMetadataConsistency());
+        checks.push(await this.checkAutographGradeFieldConsistency());
+        checks.push(await this.checkAutographGradingMetadataConsistency());
+        checks.push(await this.checkSecretDetection());
+        checks.push(await this.checkReactHookRules());
+        // WARNING CHECKS
+        checks.push(await this.checkConsoleCleanup());
+        checks.push(await this.checkFloatingPromises());
+        checks.push(await this.checkCvaEnforcement());
+        checks.push(await this.checkTypeSafety());
+        const totalDuration = Date.now() - startTime;
+        const allIssues = checks.flatMap((c) => c.issues);
+        const hasBlockingFailure = checks.some((c) => !c.passed && c.blocking);
+        const summary = {
+            total: checks.length,
+            passed: checks.filter((c) => c.passed).length,
+            failed: checks.filter((c) => !c.passed).length,
+            errors: allIssues.filter((i) => i.severity === "error").length,
+            warnings: allIssues.filter((i) => i.severity === "warning").length,
+        };
+        this.printResults(checks, totalDuration, summary, hasBlockingFailure);
+        return {
+            module: "hardened",
+            passed: !hasBlockingFailure,
+            totalDuration,
+            checks,
+            summary,
+        };
+    }
+    printResults(checks, totalDuration, summary, hasBlockingFailure) {
+        console.log("\n" + (0, console_chars_1.createDivider)(80, "heavy"));
+        console.log(`${console_chars_1.emoji.chart} HARDENED CHECK RESULTS`);
+        console.log((0, console_chars_1.createDivider)(80, "heavy"));
+        checks.forEach((check) => {
+            const icon = check.passed
+                ? `${console_chars_1.emoji.success}`
+                : check.blocking
+                    ? `${console_chars_1.emoji.error}`
+                    : `${console_chars_1.emoji.warning}`;
+            const count = check.issues.length > 0 ? ` (${check.issues.length} issues)` : "";
+            const blocking = check.blocking ? " [BLOCKING]" : "";
+            console.log(`${icon} ${check.name.padEnd(35)} ${(check.duration / 1000).toFixed(1)}s${count}${blocking}`);
+            // Show first few issues
+            if (check.issues.length > 0 && (this.verbose || !check.passed)) {
+                const showIssues = check.issues.slice(0, this.verbose ? 10 : 3);
+                showIssues.forEach((issue) => {
+                    const loc = issue.line ? `:${issue.line}` : "";
+                    console.log(`   ${issue.severity === "error" ? "${emoji.error}" : "${emoji.warning}"} ${issue.file}${loc}`);
+                    console.log(`      ${issue.message}`);
+                    if (issue.suggestion) {
+                        console.log(`      ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+                    }
+                });
+                if (check.issues.length > showIssues.length) {
+                    console.log(`   ... and ${check.issues.length - showIssues.length} more`);
+                }
+            }
+        });
+        console.log((0, console_chars_1.createDivider)(80, "heavy"));
+        console.log(`Total Checks: ${summary.total} | Passed: ${summary.passed} | Failed: ${summary.failed}`);
+        console.log(`Errors: ${summary.errors} | Warnings: ${summary.warnings}`);
+        console.log(`Time: ${(totalDuration / 1000).toFixed(1)}s`);
+        console.log((0, console_chars_1.createDivider)(80, "heavy"));
+        if (hasBlockingFailure) {
+            console.log(`\n${console_chars_1.emoji.error} HARDENED CHECKS FAILED`);
+            console.log("   Fix blocking errors before deployment\n");
+        }
+        else if (summary.warnings > 0) {
+            console.log(`\n${console_chars_1.emoji.warning}  HARDENED CHECKS PASSED (with warnings)\n`);
+        }
+        else {
+            console.log(`\n${console_chars_1.emoji.success} HARDENED CHECKS PASSED\n`);
+        }
+    }
+}
+exports.HardenedPreflightModule = HardenedPreflightModule;
+// CLI
+async function main() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(path.basename(__filename, ".ts"));
+    const args = process.argv.slice(2);
+    const mode = args[0] || "all";
+    const verbose = args.includes("--verbose") || args.includes("-v");
+    const parallel = args.includes("--parallel") || args.includes("-p");
+    const module = new HardenedPreflightModule({ verbose, parallel });
+    const runSingle = async (name, fn) => {
+        const result = await fn();
+        const icon = result.passed
+            ? `${console_chars_1.emoji.success}`
+            : result.blocking
+                ? `${console_chars_1.emoji.error}`
+                : `${console_chars_1.emoji.warning}`;
+        console.log(`\n${icon} ${result.name}: ${result.issues.length} issues`);
+        if (result.issues.length > 0) {
+            const showCount = verbose ? result.issues.length : 5;
+            result.issues.slice(0, showCount).forEach((i) => {
+                console.log(`   ${i.file}${i.line ? `:${i.line}` : ""} - ${i.message}`);
+            });
+            if (!verbose && result.issues.length > 5) {
+                console.log(`   ... and ${result.issues.length - 5} more`);
+            }
+        }
+        return {
+            module: `hardened:${name}`,
+            passed: result.passed || !result.blocking,
+            totalDuration: result.duration,
+            checks: [result],
+            summary: {
+                total: 1,
+                passed: result.passed ? 1 : 0,
+                failed: result.passed ? 0 : 1,
+                errors: result.issues.filter((i) => i.severity === "error").length,
+                warnings: result.issues.filter((i) => i.severity === "warning").length,
+            },
+        };
+    };
+    let result;
+    switch (mode) {
+        case "eslint-concurrency":
+            result = await runSingle("eslint-concurrency", () => module.checkEslintConcurrencyEnforcement());
+            break;
+        case "draft":
+            result = await runSingle("draft", () => module.checkDraftStatusEnforcement());
+            break;
+        case "async":
+            result = await runSingle("async", () => module.checkAsyncErrorHandling());
+            break;
+        case "console":
+            result = await runSingle("console", () => module.checkConsoleCleanup());
+            break;
+        case "secrets":
+            result = await runSingle("secrets", () => module.checkSecretDetection());
+            break;
+        case "hooks":
+            result = await runSingle("hooks", () => module.checkReactHookRules());
+            break;
+        case "enums":
+        case "prisma-enums":
+            result = await runSingle("prisma-enums", () => module.checkPrismaEnumLiterals());
+            break;
+        case "promises":
+            result = await runSingle("promises", () => module.checkFloatingPromises());
+            break;
+        case "cva":
+            result = await runSingle("cva", () => module.checkCvaEnforcement());
+            break;
+        case "types":
+            result = await runSingle("types", () => module.checkTypeSafety());
+            break;
+        default:
+            result = await module.runAll();
+            break;
+    }
+    process.exit(result.passed ? 0 : 1);
+}
+if (require.main === module) {
+    main();
+}
+//# sourceMappingURL=hardened-checks.js.map