@lukoweb/apitogo 0.2.22 → 0.2.24

package/src/config/v2/rules.ts

@@ -1,714 +1,714 @@
-import { readFile, stat } from "node:fs/promises";
-import path from "node:path";
-import { glob } from "glob";
-import { parse as parseYaml } from "yaml";
-import type { ConfigIssue } from "./errors.js";
-import type { ResolvedConfigV2 } from "./resolve.js";
-import type { ConfigV2 } from "./schema.js";
-
-/**
- * The rules of `apitogo check` that need no network (Reference, section 2). Online rules (provider capabilities,
- * origin reachability, OIDC discovery, tier limits) are not here: they run against the platform in a later phase.
- *
- * Every problem carries a stable code, the config path and a hint. All problems are collected, never just the first.
- * Services with `enabled: false` are ignored, as the Tenant Service Model says.
- */
-export type CheckReport = {
-  errors: ConfigIssue[];
-  warnings: ConfigIssue[];
-  /** Rules that did not run, so a clean report is never mistaken for "everything was checked". */
-  skipped: string[];
-};
-
-export type CheckContext = {
-  /** Names of the project's secrets, when they are known. Leave undefined when they cannot be listed. */
-  knownSecrets?: ReadonlySet<string>;
-};
-
-type Collector = {
-  error: (issue: ConfigIssue) => void;
-  warn: (issue: ConfigIssue) => void;
-};
-
-const SPEC_MAX_BYTES = 5 * 1024 * 1024;
-const SECRET_REFERENCE = /^secret:([A-Za-z_][A-Za-z0-9_]*)$/;
-
-async function isFile(target: string): Promise<boolean> {
-  return (await stat(target).catch(() => undefined))?.isFile() === true;
-}
-
-async function isDirectory(target: string): Promise<boolean> {
-  return (await stat(target).catch(() => undefined))?.isDirectory() === true;
-}
-
-/** Every `secret:NAME` reference in the config, with the path it was found at. */
-export function collectSecretRefs(
-  config: unknown,
-): { name: string; path: string }[] {
-  const found: { name: string; path: string }[] = [];
-  const walk = (value: unknown, at: string) => {
-    if (typeof value === "string") {
-      const match = SECRET_REFERENCE.exec(value);
-      if (match?.[1]) found.push({ name: match[1], path: at });
-    } else if (Array.isArray(value)) {
-      value.forEach((item, index) => walk(item, `${at}[${index}]`));
-    } else if (typeof value === "object" && value !== null) {
-      for (const [key, item] of Object.entries(value))
-        walk(item, at === "" ? key : `${at}.${key}`);
-    }
-  };
-  walk(config, "");
-  return found;
-}
-
-// --- dependencies between services (2.1) ----------------------------------------------------------------------------
-
-function dependencyRules(
-  config: ConfigV2,
-  resolved: ResolvedConfigV2,
-  out: Collector,
-) {
-  const gatewayOn = resolved.gateway?.enabled === true;
-  const identityOn = resolved.identity?.enabled === true;
-  const oidcGateway = gatewayOn && resolved.gateway?.auth?.mode === "oidc";
-  const hasIdentitySource = identityOn || oidcGateway;
-
-  if (resolved.plans?.enabled) {
-    if (!gatewayOn) {
-      out.error({
-        code: "PLANS_GATEWAY_REQUIRED",
-        path: "plans",
-        message:
-          "plans needs the gateway service: entitlements and API keys are enforced there.",
-        hint: "Enable it with `apitogo add gateway`.",
-      });
-    }
-    if (!hasIdentitySource) {
-      out.error({
-        code: "PLANS_IDENTITY_REQUIRED",
-        path: "plans",
-        message: "plans needs an identity source to know who subscribes.",
-        hint: "Enable identity (apitogo add identity) or set gateway.auth.mode to oidc.",
-      });
-    }
-  }
-
-  const requireAuth = config.portal?.requireAuth;
-  if (
-    resolved.portal?.enabled &&
-    requireAuth !== undefined &&
-    requireAuth !== false &&
-    !hasIdentitySource
-  ) {
-    out.error({
-      code: "PORTAL_CAPABILITY_MISSING",
-      path: "portal.requireAuth",
-      message:
-        "portal.requireAuth needs an identity source. Enable identity (apitogo add identity) or set gateway.auth.mode to oidc.",
-    });
-  }
-}
-
-/** Only the dependency rules (2.1), for commands that edit the config before any file exists. */
-export function checkDependencies(
-  config: ConfigV2,
-  resolved: ResolvedConfigV2,
-): ConfigIssue[] {
-  const issues: ConfigIssue[] = [];
-  dependencyRules(config, resolved, {
-    error: (issue) => void issues.push(issue),
-    warn: () => undefined,
-  });
-  return issues;
-}
-
-// --- portal (2.3) ---------------------------------------------------------------------------------------------------
-
-async function portalRules(
-  config: ConfigV2,
-  resolved: ResolvedConfigV2,
-  out: Collector,
-) {
-  const portal = resolved.portal;
-  if (!portal?.enabled) return;
-
-  if (!portal.docs.enabled && !portal.console.enabled) {
-    out.error({
-      code: "PORTAL_NOTHING_ENABLED",
-      path: "portal",
-      message:
-        "portal has docs and console both disabled, so there is nothing to build.",
-      hint: "Enable portal.docs or portal.console, or switch the portal off with portal.enabled: false.",
-    });
-  }
-
-  if (portal.docs.enabled) {
-    if (portal.docs.provider === "external") {
-      if (!config.portal?.docs?.url) {
-        out.error({
-          code: "PORTAL_DOCS_URL_INVALID",
-          path: "portal.docs.url",
-          message:
-            "portal.docs.url is required when docs.provider is external.",
-          hint: 'For example: "url": "https://docs.acme.com".',
-        });
-      }
-      if (config.portal?.docs?.content !== undefined) {
-        out.error({
-          code: "PORTAL_CONFIG_INVALID",
-          path: "portal.docs.content",
-          message:
-            "portal.docs.content is not allowed when docs.provider is external: the docs live in the external tool.",
-        });
-      }
-      if (config.portal?.search !== undefined) {
-        out.error({
-          code: "PORTAL_CONFIG_INVALID",
-          path: "portal.search",
-          message:
-            "portal.search is not allowed when docs.provider is external: the external tool does the searching.",
-        });
-      }
-      if (resolved.gateway?.enabled !== true) {
-        out.error({
-          code: "PORTAL_EXTERNAL_DOCS_NO_SPEC",
-          path: "portal.docs",
-          message:
-            "docs.provider external needs an OpenAPI source, but the gateway is not enabled.",
-          hint: "Enable the gateway with specs: its OpenAPI export is what the external docs tool reads.",
-        });
-      }
-    } else {
-      if (config.portal?.docs?.url !== undefined) {
-        out.error({
-          code: "PORTAL_CONFIG_INVALID",
-          path: "portal.docs.url",
-          message:
-            'portal.docs.url is only used when docs.provider is "external".',
-        });
-      }
-      await docsContentRule(config, portal.docs.content, resolved, out);
-    }
-  }
-
-  if (
-    portal.console.enabled &&
-    !portal.docs.enabled &&
-    !resolved.identity?.enabled &&
-    !resolved.plans?.enabled
-  ) {
-    out.warn({
-      code: "PORTAL_CONSOLE_EMPTY",
-      path: "portal.console",
-      message:
-        "the console is enabled but no service feeds it, so it has no sign-in, pricing, keys or usage pages.",
-      hint: "Enable identity or plans, or enable portal.docs.",
-    });
-  }
-
-  if (await isFile(portal.theme)) {
-    try {
-      JSON.parse(await readFile(portal.theme, "utf8"));
-    } catch (error) {
-      out.error({
-        code: "PORTAL_THEME_INVALID",
-        path: "portal.theme",
-        message: `the theme file is not valid JSON (${error instanceof Error ? error.message : String(error)}).`,
-        hint: path.relative(resolved.configDir, portal.theme),
-      });
-    }
-  }
-}
-
-async function docsContentRule(
-  config: ConfigV2,
-  patterns: readonly string[],
-  resolved: ResolvedConfigV2,
-  out: Collector,
-) {
-  const include = patterns.filter((pattern) => !pattern.startsWith("!"));
-  const ignore = patterns
-    .filter((pattern) => pattern.startsWith("!"))
-    .map((pattern) => pattern.slice(1));
-  const matches =
-    include.length > 0
-      ? await glob(include, { nodir: true, ignore, absolute: true })
-      : [];
-  if (matches.length > 0) return;
-
-  const shown = config.portal?.docs?.content ?? [
-    path.relative(resolved.configDir, patterns[0] ?? ""),
-  ];
-  out.warn({
-    code: "PORTAL_DOCS_EMPTY",
-    path: "portal.docs",
-    message: `portal.docs matched 0 files (${shown.join(", ")}). The site will only contain the API reference.`,
-    hint: "Add .md or .mdx files, or point docs.content at your existing docs.",
-  });
-}
-
-// --- gateway (2.4) --------------------------------------------------------------------------------------------------
-
-function isIpLiteral(hostname: string): boolean {
-  return /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname) || hostname.startsWith("[");
-}
-
-/** The credential the gateway sends to the origin: a header needs a name and a secret; mtls is not available yet. */
-function originAuthRules(
-  origin: NonNullable<ResolvedConfigV2["gateway"]>["origin"],
-  out: Collector,
-) {
-  const auth = origin.auth;
-  if (!auth) return;
-  const base = "gateway.origin.auth";
-  if (auth.type === "header") {
-    if (!auth.name)
-      out.error({
-        code: "GATEWAY_ORIGIN_INCOMPLETE",
-        path: `${base}.name`,
-        message: "origin.auth.type is header, so origin.auth.name is required.",
-        hint: 'For example: "X-Origin-Key".',
-      });
-    if (!auth.value)
-      out.error({
-        code: "GATEWAY_ORIGIN_INCOMPLETE",
-        path: `${base}.value`,
-        message:
-          "origin.auth.type is header, so origin.auth.value is required.",
-        hint: 'A secret reference, for example "secret:ORIGIN_KEY". Store it with `apitogo secrets set ORIGIN_KEY`.',
-      });
-  } else if (auth.type === "none" && (auth.name || auth.value)) {
-    out.error({
-      code: "GATEWAY_ORIGIN_INVALID",
-      path: base,
-      message: "origin.auth.type is none, but a name or value is set.",
-      hint: 'Remove them, or set the type to "header".',
-    });
-  } else if (auth.type === "mtls") {
-    out.error({
-      code: "GATEWAY_CAPABILITY_UNSUPPORTED",
-      path: `${base}.type`,
-      message:
-        "Client certificates (mtls) for the origin are not available yet.",
-      hint: 'Use type "header" with a secret.',
-    });
-  }
-}
-
-async function gatewayRules(resolved: ResolvedConfigV2, out: Collector) {
-  const gateway = resolved.gateway;
-  if (!gateway?.enabled) return;
-  const origin = gateway.origin;
-
-  (gateway.policies.cors ?? []).forEach((site, index) => {
-    const { pathname, search, hash } = new URL(site);
-    if (pathname === "/" && !search && !hash && !site.endsWith("/")) return;
-    out.error({
-      code: "GATEWAY_CORS_ORIGIN_INVALID",
-      path: `gateway.policies.cors[${index}]`,
-      message: `"${site}" is not a browser origin: it has a path, a query or a trailing slash.`,
-      hint: `Use only scheme and host, for example "${new URL(site).origin}".`,
-    });
-  });
-
-  if (origin.mode === "managed") {
-    for (const field of ["source", "runtime", "runtimeVersion"] as const) {
-      if (!origin[field]) {
-        out.error({
-          code: "GATEWAY_ORIGIN_INCOMPLETE",
-          path: `gateway.origin.${field}`,
-          message: `gateway.origin.${field} is required when origin.mode is managed.`,
-          hint:
-            field === "runtimeVersion"
-              ? 'For example: "NODE_22_LTS". The platform publishes the allowed values.'
-              : undefined,
-        });
-      }
-    }
-    if (origin.source) {
-      const inside = path.relative(resolved.configDir, origin.source);
-      if (inside.startsWith("..") || path.isAbsolute(inside)) {
-        out.error({
-          code: "GATEWAY_ORIGIN_INVALID",
-          path: "gateway.origin.source",
-          message:
-            "gateway.origin.source must stay inside the project directory.",
-        });
-      } else if (!(await isDirectory(origin.source))) {
-        out.error({
-          code: "GATEWAY_ORIGIN_INVALID",
-          path: "gateway.origin.source",
-          message: `gateway.origin.source does not exist: ${inside === "" ? "." : inside}.`,
-          hint: "Point it at the folder that holds your backend code.",
-        });
-      }
-    }
-    if (origin.url !== undefined) {
-      out.error({
-        code: "GATEWAY_ORIGIN_INVALID",
-        path: "gateway.origin.url",
-        message: "gateway.origin.url is only used when origin.mode is proxy.",
-      });
-    }
-  } else {
-    if (!origin.url) {
-      out.error({
-        code: "GATEWAY_ORIGIN_INVALID_URL",
-        path: "gateway.origin.url",
-        message: "gateway.origin.url is required when origin.mode is proxy.",
-        hint: 'For example: "https://api.acme.com".',
-      });
-    } else {
-      const url = new URL(origin.url);
-      if (url.username !== "" || url.password !== "") {
-        out.error({
-          code: "GATEWAY_ORIGIN_INVALID_URL",
-          path: "gateway.origin.url",
-          message: "gateway.origin.url must not contain credentials.",
-          hint: "Use an origin secret header instead.",
-        });
-      }
-      if (isIpLiteral(url.hostname)) {
-        out.error({
-          code: "GATEWAY_ORIGIN_INVALID_URL",
-          path: "gateway.origin.url",
-          message:
-            "gateway.origin.url must use a host name, not an IP address.",
-        });
-      }
-    }
-    for (const field of [
-      "source",
-      "runtime",
-      "runtimeVersion",
-      "exclude",
-    ] as const) {
-      if (origin[field] !== undefined) {
-        out.error({
-          code: "GATEWAY_ORIGIN_INVALID",
-          path: `gateway.origin.${field}`,
-          message: `gateway.origin.${field} is only used when origin.mode is managed.`,
-        });
-      }
-    }
-  }
-
-  originAuthRules(origin, out);
-  if (gateway.specs.length > 1) {
-    out.warn({
-      code: "GATEWAY_SPEC_INVALID",
-      path: "gateway.specs",
-      message:
-        "gateway.specs lists several files, but the platform takes one OpenAPI file per gateway, so deploy will refuse it.",
-      hint: "Merge them into one file.",
-    });
-  }
-
-  for (const [index, spec] of gateway.specs.entries())
-    await specRule(spec, index, resolved, out);
-
-  authRule(resolved, out);
-}
-
-async function specRule(
-  spec: string,
-  index: number,
-  resolved: ResolvedConfigV2,
-  out: Collector,
-) {
-  const at = `gateway.specs[${index}]`;
-  const shown = path.relative(resolved.configDir, spec);
-  const info = await stat(spec).catch(() => undefined);
-  if (!info?.isFile()) {
-    out.error({
-      code: "GATEWAY_SPEC_INVALID",
-      path: at,
-      message: `OpenAPI file not found: ${shown}.`,
-    });
-    return;
-  }
-  if (info.size > SPEC_MAX_BYTES) {
-    out.error({
-      code: "GATEWAY_SPEC_INVALID",
-      path: at,
-      message: `${shown} is ${(info.size / 1024 / 1024).toFixed(1)} MB; the limit is 5 MB.`,
-    });
-    return;
-  }
-  let document: unknown;
-  try {
-    const text = await readFile(spec, "utf8");
-    document = spec.toLowerCase().endsWith(".json")
-      ? JSON.parse(text)
-      : parseYaml(text);
-  } catch (error) {
-    out.error({
-      code: "GATEWAY_SPEC_INVALID",
-      path: at,
-      message: `${shown} cannot be parsed (${error instanceof Error ? error.message.split("\n")[0] : String(error)}).`,
-    });
-    return;
-  }
-  const version = (document as { openapi?: unknown } | null)?.openapi;
-  if (typeof version !== "string" || !/^3\.[01]\./.test(version)) {
-    out.error({
-      code: "GATEWAY_SPEC_INVALID",
-      path: at,
-      message: `${shown} is not an OpenAPI 3.0 or 3.1 document.`,
-      hint: 'It needs a top-level "openapi": "3.0.x" or "3.1.x".',
-    });
-  }
-}
-
-function authRule(resolved: ResolvedConfigV2, out: Collector) {
-  const auth = resolved.gateway?.auth;
-  if (!auth) return;
-
-  if (auth.mode === "identity") {
-    if (!resolved.identity?.enabled) {
-      out.error({
-        code: "GATEWAY_AUTH_INCOMPLETE",
-        path: "gateway.auth.mode",
-        message:
-          "gateway.auth.mode is identity but the identity service is not enabled.",
-        hint: "Enable it with `apitogo add identity`, or use gateway.auth.mode oidc with your own provider.",
-      });
-    }
-    return;
-  }
-
-  const parts = {
-    metadataUrl: auth.metadataUrl ? 1 : 0,
-    issuers: auth.issuers?.length ?? 0,
-    audiences: auth.audiences?.length ?? 0,
-  };
-  const present = Object.entries(parts)
-    .filter(([, count]) => count > 0)
-    .map(([name]) => name);
-  const missing = Object.entries(parts)
-    .filter(([, count]) => count === 0)
-    .map(([name]) => name);
-  if (missing.length === 0) return;
-
-  const blocked = "Token validation would be skipped, so deploy is blocked.";
-  if (present.length === 0) {
-    out.error({
-      code: "GATEWAY_AUTH_INCOMPLETE",
-      path: "gateway.auth",
-      message: `gateway.auth.mode is oidc but metadataUrl, issuers and audiences are all empty. ${blocked}`,
-    });
-    return;
-  }
-  for (const name of missing) {
-    out.error({
-      code: "GATEWAY_AUTH_INCOMPLETE",
-      path: "gateway.auth",
-      message: `gateway.auth: ${present[0]} is set but ${name} is empty. ${blocked}`,
-    });
-  }
-}
-
-// --- identity (2.5) -------------------------------------------------------------------------------------------------
-
-function isLocalHost(hostname: string): boolean {
-  return (
-    hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]"
-  );
-}
-
-function identityRules(
-  config: ConfigV2,
-  resolved: ResolvedConfigV2,
-  out: Collector,
-) {
-  const identity = resolved.identity;
-  const raw = config.identity;
-  if (!identity?.enabled || !raw) return;
-  const invalid = (at: string, message: string, hint?: string) =>
-    out.error({ code: "IDENTITY_CONFIG_INVALID", path: at, message, hint });
-
-  if (identity.provider === "oidc") {
-    if (!raw.issuer)
-      invalid("identity.issuer", 'identity.provider "oidc" requires "issuer".');
-    const consoleOn =
-      resolved.portal?.enabled === true && resolved.portal.console.enabled;
-    if (consoleOn && !raw.clientId) {
-      invalid(
-        "identity.clientId",
-        'identity.provider "oidc" needs "clientId" when the portal console is enabled.',
-        "It is the public client (PKCE, no secret) the portal signs in with.",
-      );
-    }
-    for (const field of ["native", "connections", "clients"] as const) {
-      if (raw[field] !== undefined)
-        invalid(
-          `identity.${field}`,
-          `identity.${field} is not available with provider "oidc": your own provider handles it.`,
-        );
-    }
-    if (raw.providerOptions?.mfa !== undefined) {
-      invalid(
-        "identity.providerOptions.mfa",
-        'identity.providerOptions.mfa is not available with provider "oidc".',
-      );
-    }
-  } else {
-    for (const field of ["issuer", "clientId"] as const) {
-      if (raw[field] !== undefined)
-        invalid(
-          `identity.${field}`,
-          `identity.${field} is only used with provider "oidc".`,
-        );
-    }
-  }
-
-  for (const [list, label] of [
-    [identity.connections, "connections"],
-    [identity.clients, "clients"],
-  ] as const) {
-    const seen = new Set<string>();
-    for (const [index, item] of list.entries()) {
-      if (seen.has(item.id)) {
-        out.error({
-          code: "IDENTITY_DUPLICATE_ID",
-          path: `identity.${label}[${index}].id`,
-          message: `the id "${item.id}" is used more than once in identity.${label}.`,
-        });
-      }
-      seen.add(item.id);
-    }
-  }
-
-  for (const [index, client] of identity.clients.entries()) {
-    if ((client.type === "web" || client.type === "m2m") && !client.secret) {
-      invalid(
-        `identity.clients[${index}].secret`,
-        `a ${client.type} client needs a secret.`,
-        'Set it to a secret reference, for example "secret:WORKER_SECRET".',
-      );
-    }
-    for (const [uriIndex, uri] of (client.redirectUris ?? []).entries()) {
-      try {
-        const url = new URL(uri);
-        if (url.protocol !== "https:" && !isLocalHost(url.hostname)) {
-          invalid(
-            `identity.clients[${index}].redirectUris[${uriIndex}]`,
-            "redirect URIs must use https, except for localhost.",
-          );
-        }
-      } catch {
-        invalid(
-          `identity.clients[${index}].redirectUris[${uriIndex}]`,
-          `"${uri}" is not a valid URL.`,
-        );
-      }
-    }
-  }
-}
-
-// --- plans (2.6) ----------------------------------------------------------------------------------------------------
-
-async function plansRules(
-  config: ConfigV2,
-  resolved: ResolvedConfigV2,
-  out: Collector,
-) {
-  const plans = resolved.plans;
-  if (!plans?.enabled) return;
-
-  if (!(await isFile(plans.file))) {
-    out.error({
-      code: "PLANS_FILE_INVALID",
-      path: "plans.file",
-      message: `the plan catalog was not found: ${path.relative(resolved.configDir, plans.file)}.`,
-      hint: "Create it with `apitogo add plans`.",
-    });
-  } else {
-    try {
-      JSON.parse(await readFile(plans.file, "utf8"));
-    } catch (error) {
-      out.error({
-        code: "PLANS_FILE_INVALID",
-        path: "plans.file",
-        message: `the plan catalog is not valid JSON (${error instanceof Error ? error.message : String(error)}).`,
-      });
-    }
-  }
-
-  if (plans.billing.provider === "stripe") {
-    if (!config.plans?.billing?.apiKey) {
-      out.error({
-        code: "PLANS_BILLING_INCOMPLETE",
-        path: "plans.billing.apiKey",
-        message:
-          "plans.billing.apiKey is required when billing.provider is stripe.",
-        hint: 'Set it to a secret reference, for example "secret:STRIPE_API_KEY".',
-      });
-    }
-    const headless = !(resolved.portal?.enabled === true);
-    for (const field of ["successUrl", "cancelUrl"] as const) {
-      if (headless && !plans.billing[field]) {
-        out.error({
-          code: "PLANS_BILLING_INCOMPLETE",
-          path: `plans.billing.${field}`,
-          message: `plans.billing.${field} is required when there is no portal.`,
-          hint: "Checkout needs somewhere to send the customer back to.",
-        });
-      }
-    }
-  }
-}
-
-// --- secrets (2.2) --------------------------------------------------------------------------------------------------
-
-function secretRules(
-  config: ConfigV2,
-  context: CheckContext,
-  out: Collector,
-  skipped: string[],
-) {
-  const refs = collectSecretRefs(config);
-  if (refs.length === 0) return;
-  if (!context.knownSecrets) {
-    skipped.push(
-      `secret references (${new Set(refs.map((r) => r.name)).size} found) were not checked: the project's secrets were not available (offline, not logged in, or this folder is not linked to a project)`,
-    );
-    return;
-  }
-  for (const ref of refs) {
-    if (!context.knownSecrets.has(ref.name)) {
-      out.error({
-        code: "SECRET_NOT_SET",
-        path: ref.path,
-        message: `secret ${ref.name} is not set.`,
-        hint: `Run: apitogo secrets set ${ref.name}`,
-      });
-    }
-  }
-}
-
-/** Runs every offline rule and returns the full report. */
-export async function checkConfigV2(
-  config: ConfigV2,
-  resolved: ResolvedConfigV2,
-  context: CheckContext = {},
-): Promise<CheckReport> {
-  const errors: ConfigIssue[] = [];
-  const warnings: ConfigIssue[] = [];
-  const skipped = [
-    "online rules were not run (provider capabilities, origin reachability, OIDC discovery, tier limits)",
-  ];
-  const out: Collector = {
-    error: (issue) => errors.push(issue),
-    warn: (issue) => warnings.push(issue),
-  };
-
-  dependencyRules(config, resolved, out);
-  secretRules(config, context, out, skipped);
-  await portalRules(config, resolved, out);
-  await gatewayRules(resolved, out);
-  identityRules(config, resolved, out);
-  await plansRules(config, resolved, out);
-
-  return { errors, warnings, skipped };
-}
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { glob } from "glob";
+import { parse as parseYaml } from "yaml";
+import type { ConfigIssue } from "./errors.js";
+import type { ResolvedConfigV2 } from "./resolve.js";
+import type { ConfigV2 } from "./schema.js";
+
+/**
+ * The rules of `apitogo check` that need no network (Reference, section 2). Online rules (provider capabilities,
+ * origin reachability, OIDC discovery, tier limits) are not here: they run against the platform in a later phase.
+ *
+ * Every problem carries a stable code, the config path and a hint. All problems are collected, never just the first.
+ * Services with `enabled: false` are ignored, as the Tenant Service Model says.
+ */
+export type CheckReport = {
+  errors: ConfigIssue[];
+  warnings: ConfigIssue[];
+  /** Rules that did not run, so a clean report is never mistaken for "everything was checked". */
+  skipped: string[];
+};
+
+export type CheckContext = {
+  /** Names of the project's secrets, when they are known. Leave undefined when they cannot be listed. */
+  knownSecrets?: ReadonlySet<string>;
+};
+
+type Collector = {
+  error: (issue: ConfigIssue) => void;
+  warn: (issue: ConfigIssue) => void;
+};
+
+const SPEC_MAX_BYTES = 5 * 1024 * 1024;
+const SECRET_REFERENCE = /^secret:([A-Za-z_][A-Za-z0-9_]*)$/;
+
+async function isFile(target: string): Promise<boolean> {
+  return (await stat(target).catch(() => undefined))?.isFile() === true;
+}
+
+async function isDirectory(target: string): Promise<boolean> {
+  return (await stat(target).catch(() => undefined))?.isDirectory() === true;
+}
+
+/** Every `secret:NAME` reference in the config, with the path it was found at. */
+export function collectSecretRefs(
+  config: unknown,
+): { name: string; path: string }[] {
+  const found: { name: string; path: string }[] = [];
+  const walk = (value: unknown, at: string) => {
+    if (typeof value === "string") {
+      const match = SECRET_REFERENCE.exec(value);
+      if (match?.[1]) found.push({ name: match[1], path: at });
+    } else if (Array.isArray(value)) {
+      value.forEach((item, index) => walk(item, `${at}[${index}]`));
+    } else if (typeof value === "object" && value !== null) {
+      for (const [key, item] of Object.entries(value))
+        walk(item, at === "" ? key : `${at}.${key}`);
+    }
+  };
+  walk(config, "");
+  return found;
+}
+
+// --- dependencies between services (2.1) ----------------------------------------------------------------------------
+
+function dependencyRules(
+  config: ConfigV2,
+  resolved: ResolvedConfigV2,
+  out: Collector,
+) {
+  const gatewayOn = resolved.gateway?.enabled === true;
+  const identityOn = resolved.identity?.enabled === true;
+  const oidcGateway = gatewayOn && resolved.gateway?.auth?.mode === "oidc";
+  const hasIdentitySource = identityOn || oidcGateway;
+
+  if (resolved.plans?.enabled) {
+    if (!gatewayOn) {
+      out.error({
+        code: "PLANS_GATEWAY_REQUIRED",
+        path: "plans",
+        message:
+          "plans needs the gateway service: entitlements and API keys are enforced there.",
+        hint: "Enable it with `apitogo add gateway`.",
+      });
+    }
+    if (!hasIdentitySource) {
+      out.error({
+        code: "PLANS_IDENTITY_REQUIRED",
+        path: "plans",
+        message: "plans needs an identity source to know who subscribes.",
+        hint: "Enable identity (apitogo add identity) or set gateway.auth.mode to oidc.",
+      });
+    }
+  }
+
+  const requireAuth = config.portal?.requireAuth;
+  if (
+    resolved.portal?.enabled &&
+    requireAuth !== undefined &&
+    requireAuth !== false &&
+    !hasIdentitySource
+  ) {
+    out.error({
+      code: "PORTAL_CAPABILITY_MISSING",
+      path: "portal.requireAuth",
+      message:
+        "portal.requireAuth needs an identity source. Enable identity (apitogo add identity) or set gateway.auth.mode to oidc.",
+    });
+  }
+}
+
+/** Only the dependency rules (2.1), for commands that edit the config before any file exists. */
+export function checkDependencies(
+  config: ConfigV2,
+  resolved: ResolvedConfigV2,
+): ConfigIssue[] {
+  const issues: ConfigIssue[] = [];
+  dependencyRules(config, resolved, {
+    error: (issue) => void issues.push(issue),
+    warn: () => undefined,
+  });
+  return issues;
+}
+
+// --- portal (2.3) ---------------------------------------------------------------------------------------------------
+
+async function portalRules(
+  config: ConfigV2,
+  resolved: ResolvedConfigV2,
+  out: Collector,
+) {
+  const portal = resolved.portal;
+  if (!portal?.enabled) return;
+
+  if (!portal.docs.enabled && !portal.console.enabled) {
+    out.error({
+      code: "PORTAL_NOTHING_ENABLED",
+      path: "portal",
+      message:
+        "portal has docs and console both disabled, so there is nothing to build.",
+      hint: "Enable portal.docs or portal.console, or switch the portal off with portal.enabled: false.",
+    });
+  }
+
+  if (portal.docs.enabled) {
+    if (portal.docs.provider === "external") {
+      if (!config.portal?.docs?.url) {
+        out.error({
+          code: "PORTAL_DOCS_URL_INVALID",
+          path: "portal.docs.url",
+          message:
+            "portal.docs.url is required when docs.provider is external.",
+          hint: 'For example: "url": "https://docs.acme.com".',
+        });
+      }
+      if (config.portal?.docs?.content !== undefined) {
+        out.error({
+          code: "PORTAL_CONFIG_INVALID",
+          path: "portal.docs.content",
+          message:
+            "portal.docs.content is not allowed when docs.provider is external: the docs live in the external tool.",
+        });
+      }
+      if (config.portal?.search !== undefined) {
+        out.error({
+          code: "PORTAL_CONFIG_INVALID",
+          path: "portal.search",
+          message:
+            "portal.search is not allowed when docs.provider is external: the external tool does the searching.",
+        });
+      }
+      if (resolved.gateway?.enabled !== true) {
+        out.error({
+          code: "PORTAL_EXTERNAL_DOCS_NO_SPEC",
+          path: "portal.docs",
+          message:
+            "docs.provider external needs an OpenAPI source, but the gateway is not enabled.",
+          hint: "Enable the gateway with specs: its OpenAPI export is what the external docs tool reads.",
+        });
+      }
+    } else {
+      if (config.portal?.docs?.url !== undefined) {
+        out.error({
+          code: "PORTAL_CONFIG_INVALID",
+          path: "portal.docs.url",
+          message:
+            'portal.docs.url is only used when docs.provider is "external".',
+        });
+      }
+      await docsContentRule(config, portal.docs.content, resolved, out);
+    }
+  }
+
+  if (
+    portal.console.enabled &&
+    !portal.docs.enabled &&
+    !resolved.identity?.enabled &&
+    !resolved.plans?.enabled
+  ) {
+    out.warn({
+      code: "PORTAL_CONSOLE_EMPTY",
+      path: "portal.console",
+      message:
+        "the console is enabled but no service feeds it, so it has no sign-in, pricing, keys or usage pages.",
+      hint: "Enable identity or plans, or enable portal.docs.",
+    });
+  }
+
+  if (await isFile(portal.theme)) {
+    try {
+      JSON.parse(await readFile(portal.theme, "utf8"));
+    } catch (error) {
+      out.error({
+        code: "PORTAL_THEME_INVALID",
+        path: "portal.theme",
+        message: `the theme file is not valid JSON (${error instanceof Error ? error.message : String(error)}).`,
+        hint: path.relative(resolved.configDir, portal.theme),
+      });
+    }
+  }
+}
+
+async function docsContentRule(
+  config: ConfigV2,
+  patterns: readonly string[],
+  resolved: ResolvedConfigV2,
+  out: Collector,
+) {
+  const include = patterns.filter((pattern) => !pattern.startsWith("!"));
+  const ignore = patterns
+    .filter((pattern) => pattern.startsWith("!"))
+    .map((pattern) => pattern.slice(1));
+  const matches =
+    include.length > 0
+      ? await glob(include, { nodir: true, ignore, absolute: true })
+      : [];
+  if (matches.length > 0) return;
+
+  const shown = config.portal?.docs?.content ?? [
+    path.relative(resolved.configDir, patterns[0] ?? ""),
+  ];
+  out.warn({
+    code: "PORTAL_DOCS_EMPTY",
+    path: "portal.docs",
+    message: `portal.docs matched 0 files (${shown.join(", ")}). The site will only contain the API reference.`,
+    hint: "Add .md or .mdx files, or point docs.content at your existing docs.",
+  });
+}
+
+// --- gateway (2.4) --------------------------------------------------------------------------------------------------
+
+function isIpLiteral(hostname: string): boolean {
+  return /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname) || hostname.startsWith("[");
+}
+
+/** The credential the gateway sends to the origin: a header needs a name and a secret; mtls is not available yet. */
+function originAuthRules(
+  origin: NonNullable<ResolvedConfigV2["gateway"]>["origin"],
+  out: Collector,
+) {
+  const auth = origin.auth;
+  if (!auth) return;
+  const base = "gateway.origin.auth";
+  if (auth.type === "header") {
+    if (!auth.name)
+      out.error({
+        code: "GATEWAY_ORIGIN_INCOMPLETE",
+        path: `${base}.name`,
+        message: "origin.auth.type is header, so origin.auth.name is required.",
+        hint: 'For example: "X-Origin-Key".',
+      });
+    if (!auth.value)
+      out.error({
+        code: "GATEWAY_ORIGIN_INCOMPLETE",
+        path: `${base}.value`,
+        message:
+          "origin.auth.type is header, so origin.auth.value is required.",
+        hint: 'A secret reference, for example "secret:ORIGIN_KEY". Store it with `apitogo secrets set ORIGIN_KEY`.',
+      });
+  } else if (auth.type === "none" && (auth.name || auth.value)) {
+    out.error({
+      code: "GATEWAY_ORIGIN_INVALID",
+      path: base,
+      message: "origin.auth.type is none, but a name or value is set.",
+      hint: 'Remove them, or set the type to "header".',
+    });
+  } else if (auth.type === "mtls") {
+    out.error({
+      code: "GATEWAY_CAPABILITY_UNSUPPORTED",
+      path: `${base}.type`,
+      message:
+        "Client certificates (mtls) for the origin are not available yet.",
+      hint: 'Use type "header" with a secret.',
+    });
+  }
+}
+
+async function gatewayRules(resolved: ResolvedConfigV2, out: Collector) {
+  const gateway = resolved.gateway;
+  if (!gateway?.enabled) return;
+  const origin = gateway.origin;
+
+  (gateway.policies.cors ?? []).forEach((site, index) => {
+    const { pathname, search, hash } = new URL(site);
+    if (pathname === "/" && !search && !hash && !site.endsWith("/")) return;
+    out.error({
+      code: "GATEWAY_CORS_ORIGIN_INVALID",
+      path: `gateway.policies.cors[${index}]`,
+      message: `"${site}" is not a browser origin: it has a path, a query or a trailing slash.`,
+      hint: `Use only scheme and host, for example "${new URL(site).origin}".`,
+    });
+  });
+
+  if (origin.mode === "managed") {
+    for (const field of ["source", "runtime", "runtimeVersion"] as const) {
+      if (!origin[field]) {
+        out.error({
+          code: "GATEWAY_ORIGIN_INCOMPLETE",
+          path: `gateway.origin.${field}`,
+          message: `gateway.origin.${field} is required when origin.mode is managed.`,
+          hint:
+            field === "runtimeVersion"
+              ? 'For example: "NODE_22_LTS". The platform publishes the allowed values.'
+              : undefined,
+        });
+      }
+    }
+    if (origin.source) {
+      const inside = path.relative(resolved.configDir, origin.source);
+      if (inside.startsWith("..") || path.isAbsolute(inside)) {
+        out.error({
+          code: "GATEWAY_ORIGIN_INVALID",
+          path: "gateway.origin.source",
+          message:
+            "gateway.origin.source must stay inside the project directory.",
+        });
+      } else if (!(await isDirectory(origin.source))) {
+        out.error({
+          code: "GATEWAY_ORIGIN_INVALID",
+          path: "gateway.origin.source",
+          message: `gateway.origin.source does not exist: ${inside === "" ? "." : inside}.`,
+          hint: "Point it at the folder that holds your backend code.",
+        });
+      }
+    }
+    if (origin.url !== undefined) {
+      out.error({
+        code: "GATEWAY_ORIGIN_INVALID",
+        path: "gateway.origin.url",
+        message: "gateway.origin.url is only used when origin.mode is proxy.",
+      });
+    }
+  } else {
+    if (!origin.url) {
+      out.error({
+        code: "GATEWAY_ORIGIN_INVALID_URL",
+        path: "gateway.origin.url",
+        message: "gateway.origin.url is required when origin.mode is proxy.",
+        hint: 'For example: "https://api.acme.com".',
+      });
+    } else {
+      const url = new URL(origin.url);
+      if (url.username !== "" || url.password !== "") {
+        out.error({
+          code: "GATEWAY_ORIGIN_INVALID_URL",
+          path: "gateway.origin.url",
+          message: "gateway.origin.url must not contain credentials.",
+          hint: "Use an origin secret header instead.",
+        });
+      }
+      if (isIpLiteral(url.hostname)) {
+        out.error({
+          code: "GATEWAY_ORIGIN_INVALID_URL",
+          path: "gateway.origin.url",
+          message:
+            "gateway.origin.url must use a host name, not an IP address.",
+        });
+      }
+    }
+    for (const field of [
+      "source",
+      "runtime",
+      "runtimeVersion",
+      "exclude",
+    ] as const) {
+      if (origin[field] !== undefined) {
+        out.error({
+          code: "GATEWAY_ORIGIN_INVALID",
+          path: `gateway.origin.${field}`,
+          message: `gateway.origin.${field} is only used when origin.mode is managed.`,
+        });
+      }
+    }
+  }
+
+  originAuthRules(origin, out);
+  if (gateway.specs.length > 1) {
+    out.warn({
+      code: "GATEWAY_SPEC_INVALID",
+      path: "gateway.specs",
+      message:
+        "gateway.specs lists several files, but the platform takes one OpenAPI file per gateway, so deploy will refuse it.",
+      hint: "Merge them into one file.",
+    });
+  }
+
+  for (const [index, spec] of gateway.specs.entries())
+    await specRule(spec, index, resolved, out);
+
+  authRule(resolved, out);
+}
+
+async function specRule(
+  spec: string,
+  index: number,
+  resolved: ResolvedConfigV2,
+  out: Collector,
+) {
+  const at = `gateway.specs[${index}]`;
+  const shown = path.relative(resolved.configDir, spec);
+  const info = await stat(spec).catch(() => undefined);
+  if (!info?.isFile()) {
+    out.error({
+      code: "GATEWAY_SPEC_INVALID",
+      path: at,
+      message: `OpenAPI file not found: ${shown}.`,
+    });
+    return;
+  }
+  if (info.size > SPEC_MAX_BYTES) {
+    out.error({
+      code: "GATEWAY_SPEC_INVALID",
+      path: at,
+      message: `${shown} is ${(info.size / 1024 / 1024).toFixed(1)} MB; the limit is 5 MB.`,
+    });
+    return;
+  }
+  let document: unknown;
+  try {
+    const text = await readFile(spec, "utf8");
+    document = spec.toLowerCase().endsWith(".json")
+      ? JSON.parse(text)
+      : parseYaml(text);
+  } catch (error) {
+    out.error({
+      code: "GATEWAY_SPEC_INVALID",
+      path: at,
+      message: `${shown} cannot be parsed (${error instanceof Error ? error.message.split("\n")[0] : String(error)}).`,
+    });
+    return;
+  }
+  const version = (document as { openapi?: unknown } | null)?.openapi;
+  if (typeof version !== "string" || !/^3\.[01]\./.test(version)) {
+    out.error({
+      code: "GATEWAY_SPEC_INVALID",
+      path: at,
+      message: `${shown} is not an OpenAPI 3.0 or 3.1 document.`,
+      hint: 'It needs a top-level "openapi": "3.0.x" or "3.1.x".',
+    });
+  }
+}
+
+function authRule(resolved: ResolvedConfigV2, out: Collector) {
+  const auth = resolved.gateway?.auth;
+  if (!auth) return;
+
+  if (auth.mode === "identity") {
+    if (!resolved.identity?.enabled) {
+      out.error({
+        code: "GATEWAY_AUTH_INCOMPLETE",
+        path: "gateway.auth.mode",
+        message:
+          "gateway.auth.mode is identity but the identity service is not enabled.",
+        hint: "Enable it with `apitogo add identity`, or use gateway.auth.mode oidc with your own provider.",
+      });
+    }
+    return;
+  }
+
+  const parts = {
+    metadataUrl: auth.metadataUrl ? 1 : 0,
+    issuers: auth.issuers?.length ?? 0,
+    audiences: auth.audiences?.length ?? 0,
+  };
+  const present = Object.entries(parts)
+    .filter(([, count]) => count > 0)
+    .map(([name]) => name);
+  const missing = Object.entries(parts)
+    .filter(([, count]) => count === 0)
+    .map(([name]) => name);
+  if (missing.length === 0) return;
+
+  const blocked = "Token validation would be skipped, so deploy is blocked.";
+  if (present.length === 0) {
+    out.error({
+      code: "GATEWAY_AUTH_INCOMPLETE",
+      path: "gateway.auth",
+      message: `gateway.auth.mode is oidc but metadataUrl, issuers and audiences are all empty. ${blocked}`,
+    });
+    return;
+  }
+  for (const name of missing) {
+    out.error({
+      code: "GATEWAY_AUTH_INCOMPLETE",
+      path: "gateway.auth",
+      message: `gateway.auth: ${present[0]} is set but ${name} is empty. ${blocked}`,
+    });
+  }
+}
+
+// --- identity (2.5) -------------------------------------------------------------------------------------------------
+
+function isLocalHost(hostname: string): boolean {
+  return (
+    hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]"
+  );
+}
+
+function identityRules(
+  config: ConfigV2,
+  resolved: ResolvedConfigV2,
+  out: Collector,
+) {
+  const identity = resolved.identity;
+  const raw = config.identity;
+  if (!identity?.enabled || !raw) return;
+  const invalid = (at: string, message: string, hint?: string) =>
+    out.error({ code: "IDENTITY_CONFIG_INVALID", path: at, message, hint });
+
+  if (identity.provider === "oidc") {
+    if (!raw.issuer)
+      invalid("identity.issuer", 'identity.provider "oidc" requires "issuer".');
+    const consoleOn =
+      resolved.portal?.enabled === true && resolved.portal.console.enabled;
+    if (consoleOn && !raw.clientId) {
+      invalid(
+        "identity.clientId",
+        'identity.provider "oidc" needs "clientId" when the portal console is enabled.',
+        "It is the public client (PKCE, no secret) the portal signs in with.",
+      );
+    }
+    for (const field of ["native", "connections", "clients"] as const) {
+      if (raw[field] !== undefined)
+        invalid(
+          `identity.${field}`,
+          `identity.${field} is not available with provider "oidc": your own provider handles it.`,
+        );
+    }
+    if (raw.providerOptions?.mfa !== undefined) {
+      invalid(
+        "identity.providerOptions.mfa",
+        'identity.providerOptions.mfa is not available with provider "oidc".',
+      );
+    }
+  } else {
+    for (const field of ["issuer", "clientId"] as const) {
+      if (raw[field] !== undefined)
+        invalid(
+          `identity.${field}`,
+          `identity.${field} is only used with provider "oidc".`,
+        );
+    }
+  }
+
+  for (const [list, label] of [
+    [identity.connections, "connections"],
+    [identity.clients, "clients"],
+  ] as const) {
+    const seen = new Set<string>();
+    for (const [index, item] of list.entries()) {
+      if (seen.has(item.id)) {
+        out.error({
+          code: "IDENTITY_DUPLICATE_ID",
+          path: `identity.${label}[${index}].id`,
+          message: `the id "${item.id}" is used more than once in identity.${label}.`,
+        });
+      }
+      seen.add(item.id);
+    }
+  }
+
+  for (const [index, client] of identity.clients.entries()) {
+    if ((client.type === "web" || client.type === "m2m") && !client.secret) {
+      invalid(
+        `identity.clients[${index}].secret`,
+        `a ${client.type} client needs a secret.`,
+        'Set it to a secret reference, for example "secret:WORKER_SECRET".',
+      );
+    }
+    for (const [uriIndex, uri] of (client.redirectUris ?? []).entries()) {
+      try {
+        const url = new URL(uri);
+        if (url.protocol !== "https:" && !isLocalHost(url.hostname)) {
+          invalid(
+            `identity.clients[${index}].redirectUris[${uriIndex}]`,
+            "redirect URIs must use https, except for localhost.",
+          );
+        }
+      } catch {
+        invalid(
+          `identity.clients[${index}].redirectUris[${uriIndex}]`,
+          `"${uri}" is not a valid URL.`,
+        );
+      }
+    }
+  }
+}
+
+// --- plans (2.6) ----------------------------------------------------------------------------------------------------
+
+async function plansRules(
+  config: ConfigV2,
+  resolved: ResolvedConfigV2,
+  out: Collector,
+) {
+  const plans = resolved.plans;
+  if (!plans?.enabled) return;
+
+  if (!(await isFile(plans.file))) {
+    out.error({
+      code: "PLANS_FILE_INVALID",
+      path: "plans.file",
+      message: `the plan catalog was not found: ${path.relative(resolved.configDir, plans.file)}.`,
+      hint: "Create it with `apitogo add plans`.",
+    });
+  } else {
+    try {
+      JSON.parse(await readFile(plans.file, "utf8"));
+    } catch (error) {
+      out.error({
+        code: "PLANS_FILE_INVALID",
+        path: "plans.file",
+        message: `the plan catalog is not valid JSON (${error instanceof Error ? error.message : String(error)}).`,
+      });
+    }
+  }
+
+  if (plans.billing.provider === "stripe") {
+    if (!config.plans?.billing?.apiKey) {
+      out.error({
+        code: "PLANS_BILLING_INCOMPLETE",
+        path: "plans.billing.apiKey",
+        message:
+          "plans.billing.apiKey is required when billing.provider is stripe.",
+        hint: 'Set it to a secret reference, for example "secret:STRIPE_API_KEY".',
+      });
+    }
+    const headless = !(resolved.portal?.enabled === true);
+    for (const field of ["successUrl", "cancelUrl"] as const) {
+      if (headless && !plans.billing[field]) {
+        out.error({
+          code: "PLANS_BILLING_INCOMPLETE",
+          path: `plans.billing.${field}`,
+          message: `plans.billing.${field} is required when there is no portal.`,
+          hint: "Checkout needs somewhere to send the customer back to.",
+        });
+      }
+    }
+  }
+}
+
+// --- secrets (2.2) --------------------------------------------------------------------------------------------------
+
+function secretRules(
+  config: ConfigV2,
+  context: CheckContext,
+  out: Collector,
+  skipped: string[],
+) {
+  const refs = collectSecretRefs(config);
+  if (refs.length === 0) return;
+  if (!context.knownSecrets) {
+    skipped.push(
+      `secret references (${new Set(refs.map((r) => r.name)).size} found) were not checked: the project's secrets were not available (offline, not logged in, or this folder is not linked to a project)`,
+    );
+    return;
+  }
+  for (const ref of refs) {
+    if (!context.knownSecrets.has(ref.name)) {
+      out.error({
+        code: "SECRET_NOT_SET",
+        path: ref.path,
+        message: `secret ${ref.name} is not set.`,
+        hint: `Run: apitogo secrets set ${ref.name}`,
+      });
+    }
+  }
+}
+
+/** Runs every offline rule and returns the full report. */
+export async function checkConfigV2(
+  config: ConfigV2,
+  resolved: ResolvedConfigV2,
+  context: CheckContext = {},
+): Promise<CheckReport> {
+  const errors: ConfigIssue[] = [];
+  const warnings: ConfigIssue[] = [];
+  const skipped = [
+    "online rules were not run (provider capabilities, origin reachability, OIDC discovery, tier limits)",
+  ];
+  const out: Collector = {
+    error: (issue) => errors.push(issue),
+    warn: (issue) => warnings.push(issue),
+  };
+
+  dependencyRules(config, resolved, out);
+  secretRules(config, context, out, skipped);
+  await portalRules(config, resolved, out);
+  await gatewayRules(resolved, out);
+  identityRules(config, resolved, out);
+  await plansRules(config, resolved, out);
+
+  return { errors, warnings, skipped };
+}