@empline/preflight 1.1.11 → 1.1.13

package/dist/checks/consolidated/security.js

@@ -0,0 +1,404 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Consolidated Security Preflight
+ *
+ * Combines 3 security checks into one module:
+ * - api-route-validation (API security)
+ * - external-link-security (external links)
+ * - xss-prevention-validation (XSS prevention)
+ *
+ * Usage:
+ *   pnpm preflight:security-checks           # All checks
+ *   pnpm preflight:security-checks api       # API routes only
+ *   pnpm preflight:security-checks links     # External links only
+ *   pnpm preflight:security-checks xss       # XSS prevention only
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityPreflightModule = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const concurrency_config_1 = require("../../shared/concurrency-config");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Get concurrency from shared config (respects PREFLIGHT_CONCURRENCY env var)
+const concurrencyConfig = (0, concurrency_config_1.getConcurrencyConfig)();
+const file_cache_1 = require("../../shared/file-cache");
+const glob_patterns_1 = require("../../shared/glob-patterns");
+const EXCLUDED = [...glob_patterns_1.STANDARD_EXCLUDES];
+// CACHED FILE LISTS - Scan once, use everywhere
+let _cachedAppComponentsTsxFiles = null;
+async function getAppComponentsTsxFiles() {
+    if (!_cachedAppComponentsTsxFiles) {
+        _cachedAppComponentsTsxFiles = await file_cache_1.fileCache.getAppAndComponentsTSX();
+    }
+    return _cachedAppComponentsTsxFiles;
+}
+class SecurityPreflightModule {
+    verbose;
+    parallel;
+    constructor(options = {}) {
+        this.verbose = options.verbose || false;
+        this.parallel = options.parallel || concurrencyConfig.parallel;
+    }
+    /**
+     * API Route Security Check
+     *
+     * NOTE: Most API routes use Prisma ORM which prevents SQL injection.
+     * Missing auth/rate-limit warnings are informational - many public routes
+     * (search, product listings) intentionally don't require auth.
+     */
+    async checkApiRoutes() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await file_cache_1.fileCache.getAppApiFiles();
+        // Public routes that intentionally don't require auth
+        const publicRoutes = [
+            "api/search",
+            "api/products",
+            "api/listings",
+            "api/cards",
+            "api/categories",
+            "api/brands",
+            "api/sets",
+            "api/store",
+            "api/stores",
+            "api/reviews",
+            "api/health",
+            "api/sitemap",
+            "api/og",
+            "api/webhooks",
+        ];
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            const isPublicRoute = publicRoutes.some((route) => file.includes(route.replace("api/", "api\\")));
+            // Check for missing auth checks - only warn for non-public mutation routes
+            if (!content.includes("getServerSession") &&
+                !content.includes("auth(") &&
+                !content.includes("requireAuth")) {
+                if (!isPublicRoute &&
+                    (content.includes("POST") || content.includes("PUT") || content.includes("DELETE"))) {
+                    issues.push({
+                        file,
+                        type: "no-auth",
+                        severity: "info",
+                        message: "API route without auth check",
+                        suggestion: "Add getServerSession() or auth() check",
+                    });
+                }
+            }
+            // Check for missing rate limiting - info only, not blocking
+            if (!content.includes("rateLimit") && !content.includes("checkRateLimit")) {
+                if (content.includes("POST") || content.includes("PUT")) {
+                    issues.push({
+                        file,
+                        type: "no-rate-limit",
+                        severity: "info",
+                        message: "API route without rate limiting",
+                        suggestion: "Consider adding rate limiting",
+                    });
+                }
+            }
+            lines.forEach((line, index) => {
+                // Check for SQL injection risks - only flag raw SQL (Prisma ORM is safe)
+                if (/\$\{.*\}.*(?:SELECT|INSERT|UPDATE|DELETE|WHERE)/i.test(line)) {
+                    // Verify it's not within a Prisma query (which is safe)
+                    if (!content.includes("prisma.") && !content.includes("$queryRaw")) {
+                        issues.push({
+                            file,
+                            line: index + 1,
+                            type: "sql-injection",
+                            severity: "error",
+                            message: "Potential SQL injection",
+                            suggestion: "Use parameterized queries",
+                        });
+                    }
+                }
+            });
+        }
+        // Only block on actual SQL injection issues (security errors)
+        const hasErrors = issues.some((i) => i.severity === "error");
+        // Non-blocking: auth/rate-limit are informational improvements
+        return {
+            name: "API Route Security",
+            passed: true,
+            blocking: false,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * External Link Security Check
+     *
+     * NOTE: Next.js Link components automatically add rel="noopener" for target="_blank".
+     * Manual <a> tags with target="_blank" need explicit rel attributes.
+     */
+    async checkExternalLinks() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppComponentsTsxFiles();
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            lines.forEach((line, index) => {
+                // Only check native <a> tags, not Next.js Link components (which auto-add rel)
+                // Check for target="_blank" without rel on native anchor tags
+                if (/<a[^>]*target=["']_blank["']/.test(line) && !/rel=["'][^"']*noopener/.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "unsafe-blank",
+                        severity: "warning",
+                        message: 'target="_blank" without rel="noopener noreferrer"',
+                        suggestion: 'Add rel="noopener noreferrer"',
+                    });
+                }
+                // Check for external links without security attributes (native <a> only)
+                if (/<a[^>]*href=["']https?:\/\/(?!supercatch\.com)/.test(line) && !/rel=["']/.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "external-no-rel",
+                        severity: "info",
+                        message: "External link without rel attribute",
+                        suggestion: 'Add rel="noopener noreferrer"',
+                    });
+                }
+            });
+        }
+        // Non-blocking: these are best practices, not critical security issues
+        return {
+            name: "External Link Security",
+            passed: true,
+            blocking: false,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    /**
+     * XSS Prevention Check
+     *
+     * NOTE: dangerouslySetInnerHTML for JSON-LD structured data is safe when:
+     * - Content is server-generated (not user input)
+     * - Used for SEO schema markup (script type="application/ld+json")
+     */
+    async checkXssPrevention() {
+        const startTime = Date.now();
+        const issues = [];
+        const files = await getAppComponentsTsxFiles();
+        // Files that legitimately use dangerouslySetInnerHTML for structured data
+        const safeStructuredDataFiles = [
+            "StructuredData.tsx",
+            "Breadcrumbs.tsx",
+            "ProductBreadcrumbs.tsx",
+            "layout.tsx",
+            "JsonLd.tsx",
+            "SEO.tsx",
+            "schema.tsx",
+        ];
+        for (const file of files) {
+            const content = fs.readFileSync(file, "utf8");
+            const lines = content.split("\n");
+            const filename = file.split(/[\\/]/).pop() || "";
+            const isSafeStructuredDataFile = safeStructuredDataFiles.some((f) => filename.includes(f));
+            lines.forEach((line, index) => {
+                // Check for dangerouslySetInnerHTML without sanitization
+                if (/dangerouslySetInnerHTML/.test(line)) {
+                    const context = lines
+                        .slice(Math.max(0, index - 5), Math.min(lines.length, index + 5))
+                        .join("\n");
+                    // Safe cases: DOMPurify, sanitize, JSON-LD structured data, or known safe files
+                    const isSafe = context.includes("DOMPurify") ||
+                        context.includes("sanitize") ||
+                        context.includes("application/ld+json") ||
+                        context.includes("JSON.stringify") ||
+                        isSafeStructuredDataFile;
+                    if (!isSafe) {
+                        issues.push({
+                            file,
+                            line: index + 1,
+                            type: "unsafe-html",
+                            severity: "warning",
+                            message: "dangerouslySetInnerHTML - verify content is sanitized",
+                            suggestion: "Use DOMPurify.sanitize() for user-generated content",
+                        });
+                    }
+                }
+                // Check for innerHTML usage - this is always risky
+                if (/\.innerHTML\s*=/.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "innerHTML",
+                        severity: "error",
+                        message: "Direct innerHTML assignment",
+                        suggestion: "Use React rendering or DOMPurify",
+                    });
+                }
+                // Check for eval usage - critical security issue
+                if (/\beval\s*\(/.test(line)) {
+                    issues.push({
+                        file,
+                        line: index + 1,
+                        type: "eval",
+                        severity: "error",
+                        message: "eval() usage detected",
+                        suggestion: "Avoid eval - use safer alternatives",
+                    });
+                }
+            });
+        }
+        // Only block on critical XSS issues (eval, innerHTML)
+        const hasErrors = issues.some((i) => i.severity === "error");
+        return {
+            name: "XSS Prevention",
+            passed: !hasErrors,
+            blocking: true,
+            issues,
+            duration: Date.now() - startTime,
+        };
+    }
+    async runAll() {
+        const startTime = Date.now();
+        console.log(`\n${console_chars_1.emoji.lock} CONSOLIDATED SECURITY PREFLIGHT`);
+        console.log((0, console_chars_1.createDivider)(80, "heavy"));
+        let checks;
+        if (this.parallel) {
+            // Run checks in parallel
+            checks = await Promise.all([
+                this.checkApiRoutes(),
+                this.checkExternalLinks(),
+                this.checkXssPrevention(),
+            ]);
+        }
+        else {
+            // Sequential execution
+            checks = [];
+            checks.push(await this.checkApiRoutes());
+            checks.push(await this.checkExternalLinks());
+            checks.push(await this.checkXssPrevention());
+        }
+        const totalDuration = Date.now() - startTime;
+        const allIssues = checks.flatMap((c) => c.issues);
+        const hasBlockingFailure = checks.some((c) => !c.passed && c.blocking);
+        const summary = {
+            total: checks.length,
+            passed: checks.filter((c) => c.passed).length,
+            failed: checks.filter((c) => !c.passed).length,
+            errors: allIssues.filter((i) => i.severity === "error").length,
+            warnings: allIssues.filter((i) => i.severity === "warning").length,
+        };
+        this.printResults(checks, totalDuration, summary, hasBlockingFailure);
+        return { module: "security", passed: !hasBlockingFailure, totalDuration, checks, summary };
+    }
+    printResults(checks, totalDuration, summary, hasBlockingFailure) {
+        console.log("\n" + (0, console_chars_1.createDivider)(80, "heavy"));
+        console.log(`${console_chars_1.emoji.chart} SECURITY RESULTS`);
+        console.log((0, console_chars_1.createDivider)(80, "heavy"));
+        checks.forEach((check) => {
+            const icon = check.passed
+                ? `${console_chars_1.emoji.success}`
+                : check.blocking
+                    ? `${console_chars_1.emoji.error}`
+                    : `${console_chars_1.emoji.warning}`;
+            const count = check.issues.length > 0 ? ` (${check.issues.length} issues)` : "";
+            console.log(`${icon} ${check.name.padEnd(30)} ${(check.duration / 1000).toFixed(1)}s${count}`);
+        });
+        console.log((0, console_chars_1.createDivider)(80, "heavy"));
+        console.log(`Errors: ${summary.errors} | Warnings: ${summary.warnings} | Time: ${(totalDuration / 1000).toFixed(1)}s`);
+        if (hasBlockingFailure) {
+            console.log(`\n${console_chars_1.emoji.error} SECURITY FAILED (blocking errors found)`);
+        }
+        else {
+            console.log(`\n${console_chars_1.emoji.success} SECURITY PASSED`);
+        }
+    }
+}
+exports.SecurityPreflightModule = SecurityPreflightModule;
+async function main() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(path.basename(__filename, ".ts"));
+    const args = process.argv.slice(2);
+    const mode = args.find((a) => !a.startsWith("-")) || "all";
+    const verbose = args.includes("--verbose") || args.includes("-v");
+    const parallel = args.includes("--parallel") || args.includes("-p");
+    const module = new SecurityPreflightModule({ verbose, parallel });
+    const runSingle = async (name, fn) => {
+        const check = await fn();
+        const hasBlockingFailure = !check.passed && check.blocking;
+        console.log(`\n${check.passed ? "${emoji.success}" : "${emoji.error}"} ${check.name}: ${check.issues.length} issues`);
+        if (check.issues.length > 0) {
+            check.issues
+                .slice(0, 5)
+                .forEach((i) => console.log(`   ${i.file}${i.line ? `:${i.line}` : ""} - ${i.message}`));
+            if (check.issues.length > 5)
+                console.log(`   ... and ${check.issues.length - 5} more`);
+        }
+        return {
+            module: `security:${name}`,
+            passed: !hasBlockingFailure,
+            totalDuration: check.duration,
+            checks: [check],
+            summary: {
+                total: 1,
+                passed: check.passed ? 1 : 0,
+                failed: check.passed ? 0 : 1,
+                errors: check.issues.filter((i) => i.severity === "error").length,
+                warnings: check.issues.filter((i) => i.severity === "warning").length,
+            },
+        };
+    };
+    let result;
+    switch (mode) {
+        case "api":
+            result = await runSingle("api", () => module.checkApiRoutes());
+            break;
+        case "links":
+            result = await runSingle("links", () => module.checkExternalLinks());
+            break;
+        case "xss":
+            result = await runSingle("xss", () => module.checkXssPrevention());
+            break;
+        default:
+            result = await module.runAll();
+            break;
+    }
+    process.exit(result.passed ? 0 : 1);
+}
+if (require.main === module) {
+    main();
+}
+//# sourceMappingURL=security.js.map

package/dist/checks/consolidated/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/checks/consolidated/security.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,6DAAiE;AACjE,wEAAuE;AACvE,uFAAwF;AAExF,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,IAAA,yCAAoB,GAAE,CAAC;AA2BjD,wDAAoD;AACpD,8DAA+D;AAE/D,MAAM,QAAQ,GAAG,CAAC,GAAG,iCAAiB,CAAC,CAAC;AAExC,gDAAgD;AAEhD,IAAI,4BAA4B,GAAoB,IAAI,CAAC;AACzD,KAAK,UAAU,wBAAwB;IACrC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,MAAM,sBAAS,CAAC,sBAAsB,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,4BAA4B,CAAC;AACtC,CAAC;AAED,MAAM,uBAAuB;IACnB,OAAO,CAAU;IACjB,QAAQ,CAAU;IAE1B,YAAY,UAAqD,EAAE;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAY,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,sBAAS,CAAC,cAAc,EAAE,CAAC;QAE/C,sDAAsD;QACtD,MAAM,YAAY,GAAG;YACnB,YAAY;YACZ,cAAc;YACd,cAAc;YACd,WAAW;YACX,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,WAAW;YACX,YAAY;YACZ,aAAa;YACb,YAAY;YACZ,aAAa;YACb,QAAQ;YACR,cAAc;SACf,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAC9C,CAAC;YAEF,2EAA2E;YAC3E,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBACrC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC1B,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAChC,CAAC;gBACD,IACE,CAAC,aAAa;oBACd,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EACnF,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI;wBACJ,IAAI,EAAE,SAAS;wBACf,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,8BAA8B;wBACvC,UAAU,EAAE,wCAAwC;qBACrD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC1E,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxD,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI;wBACJ,IAAI,EAAE,eAAe;wBACrB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,iCAAiC;wBAC1C,UAAU,EAAE,+BAA+B;qBAC5C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC5B,yEAAyE;gBACzE,IAAI,kDAAkD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClE,wDAAwD;oBACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;wBACnE,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI;4BACJ,IAAI,EAAE,KAAK,GAAG,CAAC;4BACf,IAAI,EAAE,eAAe;4BACrB,QAAQ,EAAE,OAAO;4BACjB,OAAO,EAAE,yBAAyB;4BAClC,UAAU,EAAE,2BAA2B;yBACxC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QAC7D,+DAA+D;QAC/D,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAY,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAE/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAElC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC5B,+EAA+E;gBAC/E,8DAA8D;gBAC9D,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtF,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI;wBACJ,IAAI,EAAE,KAAK,GAAG,CAAC;wBACf,IAAI,EAAE,cAAc;wBACpB,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,mDAAmD;wBAC5D,UAAU,EAAE,+BAA+B;qBAC5C,CAAC,CAAC;gBACL,CAAC;gBAED,yEAAyE;gBACzE,IAAI,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1F,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI;wBACJ,IAAI,EAAE,KAAK,GAAG,CAAC;wBACf,IAAI,EAAE,iBAAiB;wBACvB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,qCAAqC;wBAC9C,UAAU,EAAE,+BAA+B;qBAC5C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,KAAK;YACf,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAY,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAE/C,0EAA0E;QAC1E,MAAM,uBAAuB,GAAG;YAC9B,oBAAoB;YACpB,iBAAiB;YACjB,wBAAwB;YACxB,YAAY;YACZ,YAAY;YACZ,SAAS;YACT,YAAY;SACb,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YACjD,MAAM,wBAAwB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAE3F,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC5B,yDAAyD;gBACzD,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzC,MAAM,OAAO,GAAG,KAAK;yBAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;yBAChE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAEd,gFAAgF;oBAChF,MAAM,MAAM,GACV,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;wBAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAC5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;wBACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;wBAClC,wBAAwB,CAAC;oBAE3B,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI;4BACJ,IAAI,EAAE,KAAK,GAAG,CAAC;4BACf,IAAI,EAAE,aAAa;4BACnB,QAAQ,EAAE,SAAS;4BACnB,OAAO,EAAE,uDAAuD;4BAChE,UAAU,EAAE,qDAAqD;yBAClE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,mDAAmD;gBACnD,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI;wBACJ,IAAI,EAAE,KAAK,GAAG,CAAC;wBACf,IAAI,EAAE,WAAW;wBACjB,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,6BAA6B;wBACtC,UAAU,EAAE,kCAAkC;qBAC/C,CAAC,CAAC;gBACL,CAAC;gBAED,iDAAiD;gBACjD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI;wBACJ,IAAI,EAAE,KAAK,GAAG,CAAC;wBACf,IAAI,EAAE,MAAM;wBACZ,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,uBAAuB;wBAChC,UAAU,EAAE,qCAAqC;qBAClD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,sDAAsD;QACtD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,CAAC,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,IAAI,kCAAkC,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAExC,IAAI,MAAqB,CAAC;QAE1B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,yBAAyB;YACzB,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACzB,IAAI,CAAC,cAAc,EAAE;gBACrB,IAAI,CAAC,kBAAkB,EAAE;gBACzB,IAAI,CAAC,kBAAkB,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,uBAAuB;YACvB,MAAM,GAAG,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG;YACd,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;YAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;YAC9C,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM;YAC9D,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;SACnE,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,kBAAkB,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7F,CAAC;IAEO,YAAY,CAClB,MAAqB,EACrB,aAAqB,EACrB,OAAY,EACZ,kBAA2B;QAE3B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,mBAAmB,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAExC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACvB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM;gBACvB,CAAC,CAAC,GAAG,qBAAK,CAAC,OAAO,EAAE;gBACpB,CAAC,CAAC,KAAK,CAAC,QAAQ;oBACd,CAAC,CAAC,GAAG,qBAAK,CAAC,KAAK,EAAE;oBAClB,CAAC,CAAC,GAAG,qBAAK,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAClF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CACT,WAAW,OAAO,CAAC,MAAM,gBAAgB,OAAO,CAAC,QAAQ,YAAY,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC1G,CAAC;QAEF,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,0CAA0C,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF;AA2DQ,0DAAuB;AAzDhC,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAE,EAA8B,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;QACzB,MAAM,kBAAkB,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC;QAC3D,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,SAAS,CACzG,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,MAAM;iBACT,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3F,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;QACzF,CAAC;QACD,OAAO;YACL,MAAM,EAAE,YAAY,IAAI,EAAE;YAC1B,MAAM,EAAE,CAAC,kBAAkB;YAC3B,aAAa,EAAE,KAAK,CAAC,QAAQ;YAC7B,MAAM,EAAE,CAAC,KAAK,CAAC;YACf,OAAO,EAAE;gBACP,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM;gBACjE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;aACtE;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,MAAoB,CAAC;IACzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK;YACR,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;YAC/D,MAAM;QACR,KAAK,OAAO;YACV,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC;YACrE,MAAM;QACR,KAAK,KAAK;YACR,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC;YACnE,MAAM;QACR;YACE,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM;IACV,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/checks/consolidated/seo.d.ts

@@ -0,0 +1,31 @@
+#!/usr/bin/env tsx
+/**
+ * SEO Preflight (Authoritative)
+ *
+ * This module is used in two ways:
+ * 1) Imported by the main preflight system (via the consolidated module runner)
+ *    - Should be non-blocking by default (returns passed=true with warnings)
+ * 2) Executed directly via `pnpm preflight:seo` (package.json)
+ *    - Supports `--strict` to fail on blocking issues
+ *
+ * Goals:
+ * - Single source of truth for SEO validation.
+ * - Keep legacy node-based SEO checks (already battle-tested).
+ * - Add missing coverage: metadata presence/quality, OG/Twitter correctness,
+ *   robots/sitemap safety rails, and crawlable internal linking.
+ */
+export interface PreflightResult {
+    passed: boolean;
+    errors: string[];
+    warnings: string[];
+    info?: string[];
+}
+interface RunOptions {
+    strict?: boolean;
+    verbose?: boolean;
+    /** When true, upgrades selected best-practice warnings to blocking. */
+    ci?: boolean;
+}
+export default function run(options?: RunOptions): Promise<PreflightResult>;
+export {};
+//# sourceMappingURL=seo.d.ts.map

package/dist/checks/consolidated/seo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seo.d.ts","sourceRoot":"","sources":["../../../src/checks/consolidated/seo.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAmBH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,EAAE,CAAC,EAAE,OAAO,CAAC;CACd;AAm6CD,wBAA8B,GAAG,CAAC,OAAO,GAAE,UAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CA8IpF"}