@warlock.js/core 5.30.0 → 5.31.0

package/esm/cli/commands/doctor/boot-for-diagnostics.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"boot-for-diagnostics.mjs","names":[],"sources":["../../../../../../../../../../packages/core/src/cli/commands/doctor/boot-for-diagnostics.ts"],"sourcesContent":["import { config } from \"../../../config/config-getter\";\nimport { connectorsManager } from \"../../../connectors/connectors-manager\";\nimport { registerConfiguredConnectors } from \"../../../connectors/register-configured-connectors\";\nimport { ConnectorLifecyclePhase } from \"../../../connectors/types\";\nimport { container } from \"../../../container\";\nimport { filesOrchestrator } from \"../../../dev-server/files-orchestrator\";\nimport { ModuleLoadError } from \"../../../dev-server/module-loader\";\nimport { router } from \"../../../router/router\";\nimport type { DoctorBootContext, ModuleFailure } from \"./check.types\";\n\n/**\n * @fileoverview The boot pass `warlock doctor` runs before its checks.\n *\n * THE RULE: **doctor boots, it never starts.**\n *\n * The connector contract already splits the two things doctor needs to keep\n * apart. `boot()` is where a connector REGISTERS — the HTTP connector builds a\n * Fastify instance and adds `/health` + `/ready` to it, the web connector\n * installs one route per page on the app router — and `start()` is where it\n * CONNECTS: opens the database, dials the cache, binds the port. Doctor runs\n * every `boot()` and no `start()`, so it sees the exact surface a served app\n * would have while opening no connection and binding no port.\n *\n * That seam is what makes the checks true. Before it existed here, doctor\n * preloaded config and framework bootstrap only: no app module was ever\n * imported, so no route module ever ran, so `routes` reported `0` on an app\n * `warlock dev` served 14 routes for — while `health` reported the endpoints as\n * \"registered\" from a config flag alone. Two checks, one app, contradictory\n * answers, and the wrong one was the one users acted on.\n *\n * ORDERING mirrors `DevelopmentServer.start()` exactly, because the route\n * surface is order-dependent: early connectors boot, then models (decorator\n * registries the route modules resolve against), then locales/events/mains/\n * routes, then late connectors — which is where `web` turns pages into routes.\n * Get the order wrong and the count is wrong, which is the defect this replaces.\n *\n * NOT read-only in one narrow sense: it imports the app's own modules, so\n * whatever a module does at import time happens. That is unavoidable — routes\n * only exist as the side effect of importing the file that declares them — and\n * it is the same import the dev server performs. It also refreshes\n * `.warlock/manifest.json`, the framework's own file cache. Nothing in the\n * app's data, and no network, is touched.\n */\n\n/**\n * The one connector whose `boot()` can bind a port. See {@link shouldSkipBoot}.\n */\nconst SOCKET_CONNECTOR = \"socket\";\n\n/**\n * Normalize anything thrown into a one-line message.\n */\nfunction messageOf(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/**\n * Whether doctor must refuse to boot this connector, and why.\n *\n * Exactly one case, and it is not a taste call: `SocketConnector.boot()` shares\n * the HTTP connector's raw server when there is one, and CREATES its own —\n * `server.listen(socketConfig.port)` — when there is not. The HTTP connector\n * boots first (lower priority number), so the shared path is what normally\n * happens; an app that configures `socket` without `http` is the exception, and\n * for that app booting socket would make a diagnostic command open a listening\n * port. Detected by asking the container what HTTP actually left behind rather\n * than by re-deriving the condition from config.\n */\nfunction shouldSkipBoot(name: string): string | undefined {\n  if (name === SOCKET_CONNECTOR && !container.has(\"http.server\")) {\n    return \"no http connector to share a server with — booting it would bind a port\";\n  }\n\n  return undefined;\n}\n\n/**\n * Boot every registered connector in one lifecycle phase, isolating failures.\n *\n * A connector that throws on boot is recorded and the loop continues: one bad\n * connector must not hide the rest of the report, and \"which connector failed\n * to boot\" is itself a finding worth printing.\n */\nasync function bootPhase(\n  phase: ConnectorLifecyclePhase,\n  connectors: DoctorBootContext[\"connectors\"],\n): Promise<void> {\n  for (const connector of connectorsManager.list()) {\n    if (connector.lifecyclePhase !== phase) continue;\n\n    const skipReason = shouldSkipBoot(connector.name);\n\n    if (skipReason) {\n      connectors.skipped.push({ name: connector.name, reason: skipReason });\n      continue;\n    }\n\n    try {\n      await connector.boot();\n      connectors.booted.push(connector.name);\n    } catch (error) {\n      connectors.failures.push({ name: connector.name, message: messageOf(error) });\n    }\n  }\n}\n\n/**\n * Import every app module the dev server imports at boot, collecting failures\n * instead of letting the first one abort the pass.\n *\n * `loadAll()` is deliberately reused rather than reimplemented: it owns the\n * canonical order (locale → event → main → route) and the `withSourceFile`\n * scoping that gives each route its origin file. It aggregates its failures and\n * throws them at the end, which is exactly the shape needed here — every module\n * is attempted, and one broken route file cannot mask another.\n */\nasync function loadAppModules(): Promise<ModuleFailure[]> {\n  try {\n    await filesOrchestrator.moduleLoader.loadAll();\n    return [];\n  } catch (error) {\n    if (error instanceof AggregateError) {\n      return (error.errors as unknown[]).map((failure) => {\n        return failure instanceof ModuleLoadError\n          ? { file: failure.file.relativePath, message: messageOf(failure.cause) }\n          : { file: \"unknown\", message: messageOf(failure) };\n      });\n    }\n\n    return [{ file: \"unknown\", message: messageOf(error) }];\n  }\n}\n\n/**\n * Eagerly import model files so the decorator-driven registries the route\n * modules resolve names against are populated first — the same reason\n * `DevelopmentServer.autoDiscoverFiles()` exists, and it must keep the same\n * position in the sequence.\n */\nasync function discoverModels(): Promise<ModuleFailure[]> {\n  const failures: ModuleFailure[] = [];\n\n  for (const file of filesOrchestrator.files.values()) {\n    if (file.type !== \"model\") continue;\n\n    try {\n      await filesOrchestrator.moduleLoader.loadModule(file, \"model\");\n    } catch (error) {\n      failures.push({\n        file: file.relativePath,\n        message: error instanceof ModuleLoadError ? messageOf(error.cause) : messageOf(error),\n      });\n    }\n  }\n\n  return failures;\n}\n\n/**\n * Run the boot pass and report what it found.\n *\n * Never throws. Every failure mode — a connector array the config manager\n * refuses, a connector that throws on boot, a route module that fails to\n * import — becomes a field on the returned context, which the checks turn into\n * a printed verdict. A diagnostic command that crashes while diagnosing tells\n * the user nothing.\n */\nexport async function bootForDiagnostics(): Promise<DoctorBootContext> {\n  const connectors: DoctorBootContext[\"connectors\"] = {\n    registered: [],\n    configured: [],\n    booted: [],\n    skipped: [],\n    failures: [],\n  };\n\n  const context: DoctorBootContext = {\n    booted: false,\n    routeModules: 0,\n    appRoutes: 0,\n    totalRoutes: 0,\n    moduleFailures: [],\n    connectors,\n  };\n\n  try {\n    // `init()` is idempotent and the preloader already ran it; calling it again\n    // costs nothing and keeps this function honest on its own.\n    await filesOrchestrator.init();\n    await filesOrchestrator.initializeAll();\n\n    filesOrchestrator.specialFilesCollector.collect(filesOrchestrator.getFiles());\n\n    context.routeModules = filesOrchestrator.specialFilesCollector.getFilesByType(\"route\").length;\n  } catch (error) {\n    context.moduleFailures.push({ file: \"src/\", message: messageOf(error) });\n\n    return context;\n  }\n\n  // The app's own connectors (`warlock.config.ts > connectors`) must be\n  // registered before any phase boots, exactly as the dev preloader does it —\n  // otherwise doctor would report on the eleven built-ins alone and miss the\n  // connector the app actually configured. This is also the call that refuses a\n  // duplicate or reserved connector name, so a config that would crash the next\n  // real boot is caught here instead.\n  try {\n    registerConfiguredConnectors();\n  } catch (error) {\n    connectors.registrationError = messageOf(error);\n  }\n\n  connectors.registered = connectorsManager.list().map((connector) => connector.name);\n  connectors.configured = connectors.registered.filter((name) => {\n    return !connectorsManager.isBuiltInName(name);\n  });\n\n  await bootPhase(ConnectorLifecyclePhase.Early, connectors);\n\n  context.moduleFailures.push(...(await discoverModels()));\n  context.moduleFailures.push(...(await loadAppModules()));\n\n  // Snapshot BEFORE the late phase: everything the app's own route modules\n  // registered. The difference between this and the total is what connectors\n  // contributed (pages, for `web`), and reporting the two separately is what\n  // lets a user reconcile doctor's number with the dev server's.\n  context.appRoutes = router.routeCount();\n\n  await bootPhase(ConnectorLifecyclePhase.Late, connectors);\n\n  context.totalRoutes = router.routeCount();\n\n  context.booted = true;\n\n  return context;\n}\n\n/**\n * Whether the app declares an HTTP surface at all. Checks that only make sense\n * for a served app use this to opt out instead of inventing a verdict.\n */\nexport function hasHttpConfig(): boolean {\n  return Boolean(config.get(\"http\"));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,MAAM,mBAAmB;;;;AAKzB,SAAS,UAAU,OAAwB;CACzC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;;;;;;;;;;;;AAcA,SAAS,eAAe,MAAkC;CACxD,IAAI,SAAS,oBAAoB,CAAC,UAAU,IAAI,aAAa,GAC3D,OAAO;AAIX;;;;;;;;AASA,eAAe,UACb,OACA,YACe;CACf,KAAK,MAAM,aAAa,kBAAkB,KAAK,GAAG;EAChD,IAAI,UAAU,mBAAmB,OAAO;EAExC,MAAM,aAAa,eAAe,UAAU,IAAI;EAEhD,IAAI,YAAY;GACd,WAAW,QAAQ,KAAK;IAAE,MAAM,UAAU;IAAM,QAAQ;GAAW,CAAC;GACpE;EACF;EAEA,IAAI;GACF,MAAM,UAAU,KAAK;GACrB,WAAW,OAAO,KAAK,UAAU,IAAI;EACvC,SAAS,OAAO;GACd,WAAW,SAAS,KAAK;IAAE,MAAM,UAAU;IAAM,SAAS,UAAU,KAAK;GAAE,CAAC;EAC9E;CACF;AACF;;;;;;;;;;;AAYA,eAAe,iBAA2C;CACxD,IAAI;EACF,MAAM,kBAAkB,aAAa,QAAQ;EAC7C,OAAO,CAAC;CACV,SAAS,OAAO;EACd,IAAI,iBAAiB,gBACnB,OAAQ,MAAM,OAAqB,KAAK,YAAY;GAClD,OAAO,mBAAmB,kBACtB;IAAE,MAAM,QAAQ,KAAK;IAAc,SAAS,UAAU,QAAQ,KAAK;GAAE,IACrE;IAAE,MAAM;IAAW,SAAS,UAAU,OAAO;GAAE;EACrD,CAAC;EAGH,OAAO,CAAC;GAAE,MAAM;GAAW,SAAS,UAAU,KAAK;EAAE,CAAC;CACxD;AACF;;;;;;;AAQA,eAAe,iBAA2C;CACxD,MAAM,WAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,kBAAkB,MAAM,OAAO,GAAG;EACnD,IAAI,KAAK,SAAS,SAAS;EAE3B,IAAI;GACF,MAAM,kBAAkB,aAAa,WAAW,MAAM,OAAO;EAC/D,SAAS,OAAO;GACd,SAAS,KAAK;IACZ,MAAM,KAAK;IACX,SAAS,iBAAiB,kBAAkB,UAAU,MAAM,KAAK,IAAI,UAAU,KAAK;GACtF,CAAC;EACH;CACF;CAEA,OAAO;AACT;;;;;;;;;;AAWA,eAAsB,qBAAiD;CACrE,MAAM,aAA8C;EAClD,YAAY,CAAC;EACb,YAAY,CAAC;EACb,QAAQ,CAAC;EACT,SAAS,CAAC;EACV,UAAU,CAAC;CACb;CAEA,MAAM,UAA6B;EACjC,QAAQ;EACR,cAAc;EACd,WAAW;EACX,aAAa;EACb,gBAAgB,CAAC;EACjB;CACF;CAEA,IAAI;EAGF,MAAM,kBAAkB,KAAK;EAC7B,MAAM,kBAAkB,cAAc;EAEtC,kBAAkB,sBAAsB,QAAQ,kBAAkB,SAAS,CAAC;EAE5E,QAAQ,eAAe,kBAAkB,sBAAsB,eAAe,OAAO,CAAC,CAAC;CACzF,SAAS,OAAO;EACd,QAAQ,eAAe,KAAK;GAAE,MAAM;GAAQ,SAAS,UAAU,KAAK;EAAE,CAAC;EAEvE,OAAO;CACT;CAQA,IAAI;EACF,6BAA6B;CAC/B,SAAS,OAAO;EACd,WAAW,oBAAoB,UAAU,KAAK;CAChD;CAEA,WAAW,aAAa,kBAAkB,KAAK,CAAC,CAAC,KAAK,cAAc,UAAU,IAAI;CAClF,WAAW,aAAa,WAAW,WAAW,QAAQ,SAAS;EAC7D,OAAO,CAAC,kBAAkB,cAAc,IAAI;CAC9C,CAAC;CAED,MAAM,mBAAyC,UAAU;CAEzD,QAAQ,eAAe,KAAK,GAAI,MAAM,eAAe,CAAE;CACvD,QAAQ,eAAe,KAAK,GAAI,MAAM,eAAe,CAAE;CAMvD,QAAQ,YAAY,OAAO,WAAW;CAEtC,MAAM,kBAAwC,UAAU;CAExD,QAAQ,cAAc,OAAO,WAAW;CAExC,QAAQ,SAAS;CAEjB,OAAO;AACT"}
+{"version":3,"file":"boot-for-diagnostics.mjs","names":[],"sources":["../../../../../../../../../../packages/core/src/cli/commands/doctor/boot-for-diagnostics.ts"],"sourcesContent":["import { config } from \"../../../config/config-getter\";\nimport { connectorsManager } from \"../../../connectors/connectors-manager\";\nimport { registerConfiguredConnectors } from \"../../../connectors/register-configured-connectors\";\nimport { ConnectorLifecyclePhase } from \"../../../connectors/types\";\nimport { container } from \"../../../container\";\nimport { filesOrchestrator } from \"../../../dev-server/files-orchestrator\";\nimport { ModuleLoadError } from \"../../../dev-server/module-loader\";\nimport { router } from \"../../../router/router\";\nimport type { DoctorBootContext, ModelModule, ModuleFailure } from \"./check.types\";\n\n/**\n * @fileoverview The boot pass `warlock doctor` runs before its checks.\n *\n * THE RULE: **doctor boots, it never starts.**\n *\n * The connector contract already splits the two things doctor needs to keep\n * apart. `boot()` is where a connector REGISTERS — the HTTP connector builds a\n * Fastify instance and adds `/health` + `/ready` to it, the web connector\n * installs one route per page on the app router — and `start()` is where it\n * CONNECTS: opens the database, dials the cache, binds the port. Doctor runs\n * every `boot()` and no `start()`, so it sees the exact surface a served app\n * would have while opening no connection and binding no port.\n *\n * That seam is what makes the checks true. Before it existed here, doctor\n * preloaded config and framework bootstrap only: no app module was ever\n * imported, so no route module ever ran, so `routes` reported `0` on an app\n * `warlock dev` served 14 routes for — while `health` reported the endpoints as\n * \"registered\" from a config flag alone. Two checks, one app, contradictory\n * answers, and the wrong one was the one users acted on.\n *\n * ORDERING mirrors `DevelopmentServer.start()` exactly, because the route\n * surface is order-dependent: early connectors boot, then models (decorator\n * registries the route modules resolve against), then locales/events/mains/\n * routes, then late connectors — which is where `web` turns pages into routes.\n * Get the order wrong and the count is wrong, which is the defect this replaces.\n *\n * NOT read-only in one narrow sense: it imports the app's own modules, so\n * whatever a module does at import time happens. That is unavoidable — routes\n * only exist as the side effect of importing the file that declares them — and\n * it is the same import the dev server performs. It also refreshes\n * `.warlock/manifest.json`, the framework's own file cache. Nothing in the\n * app's data, and no network, is touched.\n */\n\n/**\n * The one connector whose `boot()` can bind a port. See {@link shouldSkipBoot}.\n */\nconst SOCKET_CONNECTOR = \"socket\";\n\n/**\n * Normalize anything thrown into a one-line message.\n */\nfunction messageOf(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/**\n * Whether doctor must refuse to boot this connector, and why.\n *\n * Exactly one case, and it is not a taste call: `SocketConnector.boot()` shares\n * the HTTP connector's raw server when there is one, and CREATES its own —\n * `server.listen(socketConfig.port)` — when there is not. The HTTP connector\n * boots first (lower priority number), so the shared path is what normally\n * happens; an app that configures `socket` without `http` is the exception, and\n * for that app booting socket would make a diagnostic command open a listening\n * port. Detected by asking the container what HTTP actually left behind rather\n * than by re-deriving the condition from config.\n */\nfunction shouldSkipBoot(name: string): string | undefined {\n  if (name === SOCKET_CONNECTOR && !container.has(\"http.server\")) {\n    return \"no http connector to share a server with — booting it would bind a port\";\n  }\n\n  return undefined;\n}\n\n/**\n * Boot every registered connector in one lifecycle phase, isolating failures.\n *\n * A connector that throws on boot is recorded and the loop continues: one bad\n * connector must not hide the rest of the report, and \"which connector failed\n * to boot\" is itself a finding worth printing.\n */\nasync function bootPhase(\n  phase: ConnectorLifecyclePhase,\n  connectors: DoctorBootContext[\"connectors\"],\n): Promise<void> {\n  for (const connector of connectorsManager.list()) {\n    if (connector.lifecyclePhase !== phase) continue;\n\n    const skipReason = shouldSkipBoot(connector.name);\n\n    if (skipReason) {\n      connectors.skipped.push({ name: connector.name, reason: skipReason });\n      continue;\n    }\n\n    try {\n      await connector.boot();\n      connectors.booted.push(connector.name);\n    } catch (error) {\n      connectors.failures.push({ name: connector.name, message: messageOf(error) });\n    }\n  }\n}\n\n/**\n * Import every app module the dev server imports at boot, collecting failures\n * instead of letting the first one abort the pass.\n *\n * `loadAll()` is deliberately reused rather than reimplemented: it owns the\n * canonical order (locale → event → main → route) and the `withSourceFile`\n * scoping that gives each route its origin file. It aggregates its failures and\n * throws them at the end, which is exactly the shape needed here — every module\n * is attempted, and one broken route file cannot mask another.\n */\nasync function loadAppModules(): Promise<ModuleFailure[]> {\n  try {\n    await filesOrchestrator.moduleLoader.loadAll();\n    return [];\n  } catch (error) {\n    if (error instanceof AggregateError) {\n      return (error.errors as unknown[]).map((failure) => {\n        return failure instanceof ModuleLoadError\n          ? { file: failure.file.relativePath, message: messageOf(failure.cause) }\n          : { file: \"unknown\", message: messageOf(failure) };\n      });\n    }\n\n    return [{ file: \"unknown\", message: messageOf(error) }];\n  }\n}\n\n/**\n * Eagerly import model files so the decorator-driven registries the route\n * modules resolve names against are populated first — the same reason\n * `DevelopmentServer.autoDiscoverFiles()` exists, and it must keep the same\n * position in the sequence.\n */\nasync function discoverModels(modules: ModelModule[]): Promise<ModuleFailure[]> {\n  const failures: ModuleFailure[] = [];\n\n  for (const file of filesOrchestrator.files.values()) {\n    if (file.type !== \"model\") continue;\n\n    try {\n      const exports = await filesOrchestrator.moduleLoader.loadModule<unknown>(file, \"model\");\n\n      if (typeof exports === \"object\" && exports !== null) {\n        modules.push({ file: file.relativePath, exports: { ...exports } });\n      }\n    } catch (error) {\n      failures.push({\n        file: file.relativePath,\n        message: error instanceof ModuleLoadError ? messageOf(error.cause) : messageOf(error),\n      });\n    }\n  }\n\n  return failures;\n}\n\n/**\n * Run the boot pass and report what it found.\n *\n * Never throws. Every failure mode — a connector array the config manager\n * refuses, a connector that throws on boot, a route module that fails to\n * import — becomes a field on the returned context, which the checks turn into\n * a printed verdict. A diagnostic command that crashes while diagnosing tells\n * the user nothing.\n */\nexport async function bootForDiagnostics(): Promise<DoctorBootContext> {\n  const connectors: DoctorBootContext[\"connectors\"] = {\n    registered: [],\n    configured: [],\n    booted: [],\n    skipped: [],\n    failures: [],\n  };\n\n  const context: DoctorBootContext = {\n    booted: false,\n    routeModules: 0,\n    appRoutes: 0,\n    totalRoutes: 0,\n    moduleFailures: [],\n    modelModules: [],\n    connectors,\n  };\n\n  try {\n    // `init()` is idempotent and the preloader already ran it; calling it again\n    // costs nothing and keeps this function honest on its own.\n    await filesOrchestrator.init();\n    await filesOrchestrator.initializeAll();\n\n    filesOrchestrator.specialFilesCollector.collect(filesOrchestrator.getFiles());\n\n    context.routeModules = filesOrchestrator.specialFilesCollector.getFilesByType(\"route\").length;\n  } catch (error) {\n    context.moduleFailures.push({ file: \"src/\", message: messageOf(error) });\n\n    return context;\n  }\n\n  // The app's own connectors (`warlock.config.ts > connectors`) must be\n  // registered before any phase boots, exactly as the dev preloader does it —\n  // otherwise doctor would report on the eleven built-ins alone and miss the\n  // connector the app actually configured. This is also the call that refuses a\n  // duplicate or reserved connector name, so a config that would crash the next\n  // real boot is caught here instead.\n  try {\n    registerConfiguredConnectors();\n  } catch (error) {\n    connectors.registrationError = messageOf(error);\n  }\n\n  connectors.registered = connectorsManager.list().map((connector) => connector.name);\n  connectors.configured = connectors.registered.filter((name) => {\n    return !connectorsManager.isBuiltInName(name);\n  });\n\n  await bootPhase(ConnectorLifecyclePhase.Early, connectors);\n\n  context.moduleFailures.push(...(await discoverModels(context.modelModules)));\n  context.moduleFailures.push(...(await loadAppModules()));\n\n  // Snapshot BEFORE the late phase: everything the app's own route modules\n  // registered. The difference between this and the total is what connectors\n  // contributed (pages, for `web`), and reporting the two separately is what\n  // lets a user reconcile doctor's number with the dev server's.\n  context.appRoutes = router.routeCount();\n\n  await bootPhase(ConnectorLifecyclePhase.Late, connectors);\n\n  context.totalRoutes = router.routeCount();\n\n  context.booted = true;\n\n  return context;\n}\n\n/**\n * Whether the app declares an HTTP surface at all. Checks that only make sense\n * for a served app use this to opt out instead of inventing a verdict.\n */\nexport function hasHttpConfig(): boolean {\n  return Boolean(config.get(\"http\"));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,MAAM,mBAAmB;;;;AAKzB,SAAS,UAAU,OAAwB;CACzC,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;;;;;;;;;;;;AAcA,SAAS,eAAe,MAAkC;CACxD,IAAI,SAAS,oBAAoB,CAAC,UAAU,IAAI,aAAa,GAC3D,OAAO;AAIX;;;;;;;;AASA,eAAe,UACb,OACA,YACe;CACf,KAAK,MAAM,aAAa,kBAAkB,KAAK,GAAG;EAChD,IAAI,UAAU,mBAAmB,OAAO;EAExC,MAAM,aAAa,eAAe,UAAU,IAAI;EAEhD,IAAI,YAAY;GACd,WAAW,QAAQ,KAAK;IAAE,MAAM,UAAU;IAAM,QAAQ;GAAW,CAAC;GACpE;EACF;EAEA,IAAI;GACF,MAAM,UAAU,KAAK;GACrB,WAAW,OAAO,KAAK,UAAU,IAAI;EACvC,SAAS,OAAO;GACd,WAAW,SAAS,KAAK;IAAE,MAAM,UAAU;IAAM,SAAS,UAAU,KAAK;GAAE,CAAC;EAC9E;CACF;AACF;;;;;;;;;;;AAYA,eAAe,iBAA2C;CACxD,IAAI;EACF,MAAM,kBAAkB,aAAa,QAAQ;EAC7C,OAAO,CAAC;CACV,SAAS,OAAO;EACd,IAAI,iBAAiB,gBACnB,OAAQ,MAAM,OAAqB,KAAK,YAAY;GAClD,OAAO,mBAAmB,kBACtB;IAAE,MAAM,QAAQ,KAAK;IAAc,SAAS,UAAU,QAAQ,KAAK;GAAE,IACrE;IAAE,MAAM;IAAW,SAAS,UAAU,OAAO;GAAE;EACrD,CAAC;EAGH,OAAO,CAAC;GAAE,MAAM;GAAW,SAAS,UAAU,KAAK;EAAE,CAAC;CACxD;AACF;;;;;;;AAQA,eAAe,eAAe,SAAkD;CAC9E,MAAM,WAA4B,CAAC;CAEnC,KAAK,MAAM,QAAQ,kBAAkB,MAAM,OAAO,GAAG;EACnD,IAAI,KAAK,SAAS,SAAS;EAE3B,IAAI;GACF,MAAM,UAAU,MAAM,kBAAkB,aAAa,WAAoB,MAAM,OAAO;GAEtF,IAAI,OAAO,YAAY,YAAY,YAAY,MAC7C,QAAQ,KAAK;IAAE,MAAM,KAAK;IAAc,SAAS,EAAE,GAAG,QAAQ;GAAE,CAAC;EAErE,SAAS,OAAO;GACd,SAAS,KAAK;IACZ,MAAM,KAAK;IACX,SAAS,iBAAiB,kBAAkB,UAAU,MAAM,KAAK,IAAI,UAAU,KAAK;GACtF,CAAC;EACH;CACF;CAEA,OAAO;AACT;;;;;;;;;;AAWA,eAAsB,qBAAiD;CACrE,MAAM,aAA8C;EAClD,YAAY,CAAC;EACb,YAAY,CAAC;EACb,QAAQ,CAAC;EACT,SAAS,CAAC;EACV,UAAU,CAAC;CACb;CAEA,MAAM,UAA6B;EACjC,QAAQ;EACR,cAAc;EACd,WAAW;EACX,aAAa;EACb,gBAAgB,CAAC;EACjB,cAAc,CAAC;EACf;CACF;CAEA,IAAI;EAGF,MAAM,kBAAkB,KAAK;EAC7B,MAAM,kBAAkB,cAAc;EAEtC,kBAAkB,sBAAsB,QAAQ,kBAAkB,SAAS,CAAC;EAE5E,QAAQ,eAAe,kBAAkB,sBAAsB,eAAe,OAAO,CAAC,CAAC;CACzF,SAAS,OAAO;EACd,QAAQ,eAAe,KAAK;GAAE,MAAM;GAAQ,SAAS,UAAU,KAAK;EAAE,CAAC;EAEvE,OAAO;CACT;CAQA,IAAI;EACF,6BAA6B;CAC/B,SAAS,OAAO;EACd,WAAW,oBAAoB,UAAU,KAAK;CAChD;CAEA,WAAW,aAAa,kBAAkB,KAAK,CAAC,CAAC,KAAK,cAAc,UAAU,IAAI;CAClF,WAAW,aAAa,WAAW,WAAW,QAAQ,SAAS;EAC7D,OAAO,CAAC,kBAAkB,cAAc,IAAI;CAC9C,CAAC;CAED,MAAM,mBAAyC,UAAU;CAEzD,QAAQ,eAAe,KAAK,GAAI,MAAM,eAAe,QAAQ,YAAY,CAAE;CAC3E,QAAQ,eAAe,KAAK,GAAI,MAAM,eAAe,CAAE;CAMvD,QAAQ,YAAY,OAAO,WAAW;CAEtC,MAAM,kBAAwC,UAAU;CAExD,QAAQ,cAAc,OAAO,WAAW;CAExC,QAAQ,SAAS;CAEjB,OAAO;AACT"}

package/esm/cli/commands/doctor/check.types.d.mts

@@ -0,0 +1,76 @@
+//#region ../../packages/core/src/cli/commands/doctor/check.types.d.ts
+/**
+ * @fileoverview Shared types for the `warlock doctor` diagnostics command.
+ * @description A doctor check is a self-contained probe of one facet of the
+ * application. Each check is handed the {@link DoctorBootContext} produced by
+ * the boot pass (see `boot-for-diagnostics.ts`) and resolves to a
+ * {@link CheckResult} — or to `undefined`, meaning the check does not apply to
+ * this project and must not appear in the report at all. The runner aggregates
+ * the results into a {@link DoctorReport} and derives an exit code. Checks must
+ * never throw out — a thrown check is caught by the runner and recorded as a
+ * `fail` so `doctor` itself can never crash.
+ *
+ * THE STANDARD EVERY CHECK IS HELD TO: a warning that a healthy project
+ * triggers is a bug, not a nuance. Doctor's only asset is being believed, and
+ * every false positive is spent from the same budget the one true finding will
+ * need. If a check cannot say something that is both true and actionable about
+ * a given project, it returns `undefined` and stays silent.
+ */
+/**
+ * A module the boot pass could not import, and why.
+ */
+type ModuleFailure = {
+  /** Project-relative path of the file that failed. */file: string; /** The underlying error message (the cause, not the wrapper). */
+  message: string;
+};
+/**
+ * A model module the boot pass imported, with its exports — what `warlock
+ * inspect` reads the app's model classes from.
+ */
+type ModelModule = {
+  /** Project-relative path of the model file. */file: string; /** The module's exports (a shallow copy of its namespace). */
+  exports: Record<string, unknown>;
+};
+/**
+ * What the boot pass observed. Handed to every check so no check has to boot
+ * anything itself — and so the report cannot contain two checks that booted the
+ * app differently and disagreed about it.
+ */
+type DoctorBootContext = {
+  /**
+   * Whether the pass completed. `false` means app discovery itself failed and
+   * every app-dependent check must say so rather than report a zero.
+   */
+  booted: boolean; /** Number of `src/app/<module>/routes.ts` files found on disk. */
+  routeModules: number; /** Routes registered by app modules alone, before late connectors booted. */
+  appRoutes: number; /** Routes on the app router once every connector had booted. */
+  totalRoutes: number; /** Every app module that failed to import, in load order. */
+  moduleFailures: ModuleFailure[]; /** The model modules that imported, with their exports, in load order. */
+  modelModules: ModelModule[]; /** What happened to the connectors. */
+  connectors: {
+    /** Names of every registered connector (built-ins + the app's own). */registered: string[];
+    /**
+     * The connectors the APP configured, i.e. registered names that are not
+     * framework built-ins. This is the part of the list that varies between
+     * projects — the built-in count is a constant and diagnoses nothing.
+     */
+    configured: string[]; /** Names that booted without throwing. */
+    booted: string[]; /** Connectors doctor deliberately did not boot, with the reason. */
+    skipped: {
+      name: string;
+      reason: string;
+    }[]; /** Connectors whose `boot()` threw, with the message. */
+    failures: {
+      name: string;
+      message: string;
+    }[];
+    /**
+     * Set when `warlock.config.ts > connectors` was itself refused (duplicate
+     * or reserved name) — a config that would crash the next real boot.
+     */
+    registrationError?: string;
+  };
+};
+//#endregion
+export { DoctorBootContext };
+//# sourceMappingURL=check.types.d.mts.map

package/esm/cli/commands/doctor/check.types.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.types.d.mts","names":[],"sources":["../../../../../../../../../../packages/core/src/cli/commands/doctor/check.types.ts"],"mappings":";AAuBA;;;;AAKS;AAOT;;;;;;;;AAKiB;AAQjB;;;;;;KAzBY,aAAA;EAuCV,qDArCA,IAAA,UAwCgB;EArChB,OAAO;AAAA;;;;;KAOG,WAAA;EAmDG,+CAjDb,IAAA,UAoDE;EAjDF,OAAA,EAAS,MAAM;AAAA;;;AAuDI;;;KA/CT,iBAAA;;;;;EAKV,MAAA;EAGA,YAAA;EAGA,SAAA;EAGA,WAAA;EAGA,cAAA,EAAgB,aAAA;EAGhB,YAAA,EAAc,WAAW;EAGzB,UAAA;2EAEE,UAAA;;;;;;IAOA,UAAA;IAGA,MAAA;IAGA,OAAA;MAAW,IAAA;MAAc,MAAA;IAAA;IAGzB,QAAA;MAAY,IAAA;MAAc,OAAA;IAAA;;;;;IAM1B,iBAAA;EAAA;AAAA"}

package/esm/cli/commands/doctor/checks/config.check.mjs

@@ -30,6 +30,7 @@ const configCheck = {
 		if (missing.length > 0) return {
 			name: "config",
 			status: "fail",
+			code: "WL1001",
 			detail: `missing required config section(s): ${missing.join(", ")}`
 		};
 		return {

package/esm/cli/commands/doctor/checks/config.check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/config.check.ts"],"sourcesContent":["import { config } from \"../../../../config/config-getter\";\nimport type { DoctorCheck } from \"../check.types\";\n\n/**\n * Config sections that a typical Warlock HTTP application is expected to\n * register. A missing section here is release/runtime-blocking, so absence is\n * a `fail` rather than a warning.\n */\nconst REQUIRED_CONFIG_SECTIONS = [\"app\", \"http\"] as const;\n\n/**\n * `@mongez/config` returns `null` (not `undefined`) for an unregistered key,\n * so treat both nullish values as \"missing\".\n */\nfunction isPresent(value: unknown): boolean {\n  return value !== null && value !== undefined;\n}\n\n/**\n * Verifies that the required top-level config sections are present.\n *\n * NEEDS NO BOOTED APP — config files are loaded by the command's preloaders,\n * before the boot pass. Reads each section via `config.get` only; never mutates\n * configuration.\n */\nexport const configCheck: DoctorCheck = {\n  name: \"config\",\n  run: () => {\n    const missing = REQUIRED_CONFIG_SECTIONS.filter((section) => {\n      return !isPresent(config.get(section));\n    });\n\n    if (missing.length > 0) {\n      return {\n        name: \"config\",\n        status: \"fail\",\n        detail: `missing required config section(s): ${missing.join(\", \")}`,\n      };\n    }\n\n    return {\n      name: \"config\",\n      status: \"ok\",\n      detail: `required sections present (${REQUIRED_CONFIG_SECTIONS.join(\", \")})`,\n    };\n  },\n};\n"],"mappings":";;;;;;;;AAQA,MAAM,2BAA2B,CAAC,OAAO,MAAM;;;;;AAM/C,SAAS,UAAU,OAAyB;CAC1C,OAAO,UAAU,QAAQ,UAAU;AACrC;;;;;;;;AASA,MAAa,cAA2B;CACtC,MAAM;CACN,WAAW;EACT,MAAM,UAAU,yBAAyB,QAAQ,YAAY;GAC3D,OAAO,CAAC,UAAU,OAAO,IAAI,OAAO,CAAC;EACvC,CAAC;EAED,IAAI,QAAQ,SAAS,GACnB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,uCAAuC,QAAQ,KAAK,IAAI;EAClE;EAGF,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,8BAA8B,yBAAyB,KAAK,IAAI,EAAE;EAC5E;CACF;AACF"}
+{"version":3,"file":"config.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/config.check.ts"],"sourcesContent":["import { config } from \"../../../../config/config-getter\";\nimport type { DoctorCheck } from \"../check.types\";\n\n/**\n * Config sections that a typical Warlock HTTP application is expected to\n * register. A missing section here is release/runtime-blocking, so absence is\n * a `fail` rather than a warning.\n */\nconst REQUIRED_CONFIG_SECTIONS = [\"app\", \"http\"] as const;\n\n/**\n * `@mongez/config` returns `null` (not `undefined`) for an unregistered key,\n * so treat both nullish values as \"missing\".\n */\nfunction isPresent(value: unknown): boolean {\n  return value !== null && value !== undefined;\n}\n\n/**\n * Verifies that the required top-level config sections are present.\n *\n * NEEDS NO BOOTED APP — config files are loaded by the command's preloaders,\n * before the boot pass. Reads each section via `config.get` only; never mutates\n * configuration.\n */\nexport const configCheck: DoctorCheck = {\n  name: \"config\",\n  run: () => {\n    const missing = REQUIRED_CONFIG_SECTIONS.filter((section) => {\n      return !isPresent(config.get(section));\n    });\n\n    if (missing.length > 0) {\n      return {\n        name: \"config\",\n        status: \"fail\",\n        code: \"WL1001\",\n        detail: `missing required config section(s): ${missing.join(\", \")}`,\n      };\n    }\n\n    return {\n      name: \"config\",\n      status: \"ok\",\n      detail: `required sections present (${REQUIRED_CONFIG_SECTIONS.join(\", \")})`,\n    };\n  },\n};\n"],"mappings":";;;;;;;;AAQA,MAAM,2BAA2B,CAAC,OAAO,MAAM;;;;;AAM/C,SAAS,UAAU,OAAyB;CAC1C,OAAO,UAAU,QAAQ,UAAU;AACrC;;;;;;;;AASA,MAAa,cAA2B;CACtC,MAAM;CACN,WAAW;EACT,MAAM,UAAU,yBAAyB,QAAQ,YAAY;GAC3D,OAAO,CAAC,UAAU,OAAO,IAAI,OAAO,CAAC;EACvC,CAAC;EAED,IAAI,QAAQ,SAAS,GACnB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QAAQ,uCAAuC,QAAQ,KAAK,IAAI;EAClE;EAGF,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,8BAA8B,yBAAyB,KAAK,IAAI,EAAE;EAC5E;CACF;AACF"}

package/esm/cli/commands/doctor/checks/connectors.check.mjs

@@ -32,11 +32,13 @@ const connectorsCheck = {
 		if (connectors.registrationError) return {
 			name: "connectors",
 			status: "fail",
+			code: "WL1009",
 			detail: `warlock.config.ts > connectors was refused: ${connectors.registrationError}`
 		};
 		if (connectors.failures.length > 0) return {
 			name: "connectors",
 			status: "fail",
+			code: "WL2003",
 			detail: `${connectors.failures.length} connector(s) failed to boot:\n` + connectors.failures.map((failure) => `  - ${failure.name}: ${failure.message}`).join("\n")
 		};
 		if (!context.booted) return;

package/esm/cli/commands/doctor/checks/connectors.check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"connectors.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/connectors.check.ts"],"sourcesContent":["import type { DoctorCheck } from \"../check.types\";\n\n/**\n * Reports whether the app's connectors survive boot.\n *\n * NEEDS A BOOTED APP: the boot pass runs every connector's `boot()` and no\n * `start()`, and this check reads the outcome.\n *\n * WHAT THIS REPLACED, AND WHY: the previous version printed\n * `11 registered, none active`. Both halves were tautologies. Eleven is the\n * number of built-in connectors the manager constructs when its module is\n * imported — it is the same on every project that has ever existed and says\n * nothing about the app. And \"none active\" was guaranteed, because `active` is\n * set by `start()` and doctor deliberately never starts anything: the warning\n * could not be absent from a healthy app, so it could not mean anything on a\n * broken one.\n *\n * What is reported instead is a fact that varies with the project and can be\n * wrong: the connectors the app itself configured, and whether each of them\n * boots. A connector that throws on boot is a boot-time crash the user has not\n * hit yet.\n *\n * Verdicts:\n * - `warlock.config.ts > connectors` refused (duplicate or reserved name) →\n *   `fail`. The next real boot would throw the same error;\n * - a connector's `boot()` threw → `fail`, named, with the message;\n * - otherwise → `ok`, listing what booted.\n */\nexport const connectorsCheck: DoctorCheck = {\n  name: \"connectors\",\n  run: (context) => {\n    const { connectors } = context;\n\n    if (connectors.registrationError) {\n      return {\n        name: \"connectors\",\n        status: \"fail\",\n        detail: `warlock.config.ts > connectors was refused: ${connectors.registrationError}`,\n      };\n    }\n\n    if (connectors.failures.length > 0) {\n      return {\n        name: \"connectors\",\n        status: \"fail\",\n        detail:\n          `${connectors.failures.length} connector(s) failed to boot:\\n` +\n          connectors.failures\n            .map((failure) => `  - ${failure.name}: ${failure.message}`)\n            .join(\"\\n\"),\n      };\n    }\n\n    if (!context.booted) {\n      return undefined;\n    }\n\n    const skipped = connectors.skipped\n      .map((entry) => `; skipped ${entry.name} (${entry.reason})`)\n      .join(\"\");\n\n    const configured =\n      connectors.configured.length > 0\n        ? `${connectors.configured.join(\", \")} from warlock.config.ts + ` +\n          `${connectors.registered.length - connectors.configured.length} built-in`\n        : `${connectors.registered.length} built-in, none configured in warlock.config.ts`;\n\n    return {\n      name: \"connectors\",\n      status: \"ok\",\n      detail: `all booted without error (${configured})${skipped}`,\n    };\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,kBAA+B;CAC1C,MAAM;CACN,MAAM,YAAY;EAChB,MAAM,EAAE,eAAe;EAEvB,IAAI,WAAW,mBACb,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,+CAA+C,WAAW;EACpE;EAGF,IAAI,WAAW,SAAS,SAAS,GAC/B,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QACE,GAAG,WAAW,SAAS,OAAO,mCAC9B,WAAW,SACR,KAAK,YAAY,OAAO,QAAQ,KAAK,IAAI,QAAQ,SAAS,CAAC,CAC3D,KAAK,IAAI;EAChB;EAGF,IAAI,CAAC,QAAQ,QACX;EAGF,MAAM,UAAU,WAAW,QACxB,KAAK,UAAU,aAAa,MAAM,KAAK,IAAI,MAAM,OAAO,EAAE,CAAC,CAC3D,KAAK,EAAE;EAQV,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,6BARR,WAAW,WAAW,SAAS,IAC3B,GAAG,WAAW,WAAW,KAAK,IAAI,EAAE,4BACjC,WAAW,WAAW,SAAS,WAAW,WAAW,OAAO,aAC/D,GAAG,WAAW,WAAW,OAAO,iDAKY,GAAG;EACrD;CACF;AACF"}
+{"version":3,"file":"connectors.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/connectors.check.ts"],"sourcesContent":["import type { DoctorCheck } from \"../check.types\";\n\n/**\n * Reports whether the app's connectors survive boot.\n *\n * NEEDS A BOOTED APP: the boot pass runs every connector's `boot()` and no\n * `start()`, and this check reads the outcome.\n *\n * WHAT THIS REPLACED, AND WHY: the previous version printed\n * `11 registered, none active`. Both halves were tautologies. Eleven is the\n * number of built-in connectors the manager constructs when its module is\n * imported — it is the same on every project that has ever existed and says\n * nothing about the app. And \"none active\" was guaranteed, because `active` is\n * set by `start()` and doctor deliberately never starts anything: the warning\n * could not be absent from a healthy app, so it could not mean anything on a\n * broken one.\n *\n * What is reported instead is a fact that varies with the project and can be\n * wrong: the connectors the app itself configured, and whether each of them\n * boots. A connector that throws on boot is a boot-time crash the user has not\n * hit yet.\n *\n * Verdicts:\n * - `warlock.config.ts > connectors` refused (duplicate or reserved name) →\n *   `fail`. The next real boot would throw the same error;\n * - a connector's `boot()` threw → `fail`, named, with the message;\n * - otherwise → `ok`, listing what booted.\n */\nexport const connectorsCheck: DoctorCheck = {\n  name: \"connectors\",\n  run: (context) => {\n    const { connectors } = context;\n\n    if (connectors.registrationError) {\n      return {\n        name: \"connectors\",\n        status: \"fail\",\n        code: \"WL1009\",\n        detail: `warlock.config.ts > connectors was refused: ${connectors.registrationError}`,\n      };\n    }\n\n    if (connectors.failures.length > 0) {\n      return {\n        name: \"connectors\",\n        status: \"fail\",\n        code: \"WL2003\",\n        detail:\n          `${connectors.failures.length} connector(s) failed to boot:\\n` +\n          connectors.failures\n            .map((failure) => `  - ${failure.name}: ${failure.message}`)\n            .join(\"\\n\"),\n      };\n    }\n\n    if (!context.booted) {\n      return undefined;\n    }\n\n    const skipped = connectors.skipped\n      .map((entry) => `; skipped ${entry.name} (${entry.reason})`)\n      .join(\"\");\n\n    const configured =\n      connectors.configured.length > 0\n        ? `${connectors.configured.join(\", \")} from warlock.config.ts + ` +\n          `${connectors.registered.length - connectors.configured.length} built-in`\n        : `${connectors.registered.length} built-in, none configured in warlock.config.ts`;\n\n    return {\n      name: \"connectors\",\n      status: \"ok\",\n      detail: `all booted without error (${configured})${skipped}`,\n    };\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,kBAA+B;CAC1C,MAAM;CACN,MAAM,YAAY;EAChB,MAAM,EAAE,eAAe;EAEvB,IAAI,WAAW,mBACb,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QAAQ,+CAA+C,WAAW;EACpE;EAGF,IAAI,WAAW,SAAS,SAAS,GAC/B,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QACE,GAAG,WAAW,SAAS,OAAO,mCAC9B,WAAW,SACR,KAAK,YAAY,OAAO,QAAQ,KAAK,IAAI,QAAQ,SAAS,CAAC,CAC3D,KAAK,IAAI;EAChB;EAGF,IAAI,CAAC,QAAQ,QACX;EAGF,MAAM,UAAU,WAAW,QACxB,KAAK,UAAU,aAAa,MAAM,KAAK,IAAI,MAAM,OAAO,EAAE,CAAC,CAC3D,KAAK,EAAE;EAQV,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,6BARR,WAAW,WAAW,SAAS,IAC3B,GAAG,WAAW,WAAW,KAAK,IAAI,EAAE,4BACjC,WAAW,WAAW,SAAS,WAAW,WAAW,OAAO,aAC/D,GAAG,WAAW,WAAW,OAAO,iDAKY,GAAG;EACrD;CACF;AACF"}

package/esm/cli/commands/doctor/checks/handler-signature.check.mjs

@@ -34,6 +34,7 @@ const handlerSignatureCheck = {
 		return {
 			name: "handler-signature",
 			status: "warn",
+			code: "WL3006",
 			detail: `${suspects.length === 1 ? "1 handler looks like the v4 positional signature" : `${suspects.length} handlers look like the v4 positional signature`}:\n` + suspects.map((suspect) => `  - ${describePositionalHandlerSuspect(suspect)}`).join("\n")
 		};
 	}

package/esm/cli/commands/doctor/checks/handler-signature.check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"handler-signature.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/handler-signature.check.ts"],"sourcesContent":["import {\n  describePositionalHandlerSuspect,\n  listPositionalHandlerSuspects,\n} from \"../../../../router/positional-handler-diagnostics\";\nimport type { DoctorCheck } from \"../check.types\";\n\n/**\n * Surfaces route handlers still written against the v4 positional signature,\n * `(request, response)`. v5 calls a handler with a single context object, so\n * the second parameter is always `undefined` and the route fails on its first\n * request with a `TypeError` that names nothing.\n *\n * Verdicts:\n * - one or more suspects → `warn`;\n * - otherwise → `ok`.\n *\n * `warn`, never `fail`: the detection is a heuristic on the handler's declared\n * parameters, so a false positive is possible and must not break a build.\n *\n * NEEDS A BOOTED APP: the router collects suspects as routes register, so this\n * reads a list the boot pass filled. Before that pass existed the list was\n * always empty and this check always passed — it was green because it had\n * nothing to look at, which is indistinguishable from green because the app is\n * fine. It stays silent when there are no routes for the same reason: a check\n * with no input reports nothing rather than a clean bill of health.\n */\nexport const handlerSignatureCheck: DoctorCheck = {\n  name: \"handler-signature\",\n  run: (context) => {\n    if (context.totalRoutes === 0) {\n      return undefined;\n    }\n\n    const suspects = listPositionalHandlerSuspects();\n\n    if (suspects.length === 0) {\n      return {\n        name: \"handler-signature\",\n        status: \"ok\",\n        detail: \"no handlers look like the v4 positional signature\",\n      };\n    }\n\n    const headline =\n      suspects.length === 1\n        ? \"1 handler looks like the v4 positional signature\"\n        : `${suspects.length} handlers look like the v4 positional signature`;\n\n    return {\n      name: \"handler-signature\",\n      status: \"warn\",\n      detail:\n        `${headline}:\\n` +\n        suspects.map((suspect) => `  - ${describePositionalHandlerSuspect(suspect)}`).join(\"\\n\"),\n    };\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA0BA,MAAa,wBAAqC;CAChD,MAAM;CACN,MAAM,YAAY;EAChB,IAAI,QAAQ,gBAAgB,GAC1B;EAGF,MAAM,WAAW,8BAA8B;EAE/C,IAAI,SAAS,WAAW,GACtB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ;EACV;EAQF,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QACE,GARF,SAAS,WAAW,IAChB,qDACA,GAAG,SAAS,OAAO,iDAMT,OACZ,SAAS,KAAK,YAAY,OAAO,iCAAiC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI;EAC3F;CACF;AACF"}
+{"version":3,"file":"handler-signature.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/handler-signature.check.ts"],"sourcesContent":["import {\n  describePositionalHandlerSuspect,\n  listPositionalHandlerSuspects,\n} from \"../../../../router/positional-handler-diagnostics\";\nimport type { DoctorCheck } from \"../check.types\";\n\n/**\n * Surfaces route handlers still written against the v4 positional signature,\n * `(request, response)`. v5 calls a handler with a single context object, so\n * the second parameter is always `undefined` and the route fails on its first\n * request with a `TypeError` that names nothing.\n *\n * Verdicts:\n * - one or more suspects → `warn`;\n * - otherwise → `ok`.\n *\n * `warn`, never `fail`: the detection is a heuristic on the handler's declared\n * parameters, so a false positive is possible and must not break a build.\n *\n * NEEDS A BOOTED APP: the router collects suspects as routes register, so this\n * reads a list the boot pass filled. Before that pass existed the list was\n * always empty and this check always passed — it was green because it had\n * nothing to look at, which is indistinguishable from green because the app is\n * fine. It stays silent when there are no routes for the same reason: a check\n * with no input reports nothing rather than a clean bill of health.\n */\nexport const handlerSignatureCheck: DoctorCheck = {\n  name: \"handler-signature\",\n  run: (context) => {\n    if (context.totalRoutes === 0) {\n      return undefined;\n    }\n\n    const suspects = listPositionalHandlerSuspects();\n\n    if (suspects.length === 0) {\n      return {\n        name: \"handler-signature\",\n        status: \"ok\",\n        detail: \"no handlers look like the v4 positional signature\",\n      };\n    }\n\n    const headline =\n      suspects.length === 1\n        ? \"1 handler looks like the v4 positional signature\"\n        : `${suspects.length} handlers look like the v4 positional signature`;\n\n    return {\n      name: \"handler-signature\",\n      status: \"warn\",\n      code: \"WL3006\",\n      detail:\n        `${headline}:\\n` +\n        suspects.map((suspect) => `  - ${describePositionalHandlerSuspect(suspect)}`).join(\"\\n\"),\n    };\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA0BA,MAAa,wBAAqC;CAChD,MAAM;CACN,MAAM,YAAY;EAChB,IAAI,QAAQ,gBAAgB,GAC1B;EAGF,MAAM,WAAW,8BAA8B;EAE/C,IAAI,SAAS,WAAW,GACtB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ;EACV;EAQF,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QACE,GATF,SAAS,WAAW,IAChB,qDACA,GAAG,SAAS,OAAO,iDAOT,OACZ,SAAS,KAAK,YAAY,OAAO,iCAAiC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI;EAC3F;CACF;AACF"}

package/esm/cli/commands/doctor/checks/health.check.mjs

@@ -73,6 +73,7 @@ const healthCheck = {
 		if (collisions.length > 0) return {
 			name: "health",
 			status: "fail",
+			code: "WL5002",
 			detail: `an app route already claims ${collisions.join(" and ")} — Fastify refuses the duplicate registration and the server will not start. Move the app route, or rename the probe via http.health.path / http.health.readinessPath`
 		};
 		if (!context.connectors.booted.includes("http")) return;
@@ -80,12 +81,14 @@ const healthCheck = {
 		if (registered.some((answer) => answer === void 0)) return {
 			name: "health",
 			status: "warn",
+			code: "WL5003",
 			detail: `could not read the http server's route table — ${livenessPath} + ${readinessPath} unverified`
 		};
 		const missing = [livenessPath, readinessPath].filter((_path, index) => !registered[index]);
 		if (missing.length > 0) return {
 			name: "health",
 			status: "fail",
+			code: "WL5003",
 			detail: `enabled in config but not registered on the http server: ${missing.join(", ")}`
 		};
 		return {

package/esm/cli/commands/doctor/checks/health.check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"health.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/health.check.ts"],"sourcesContent":["import { config } from \"../../../../config/config-getter\";\nimport { container } from \"../../../../container\";\nimport { router } from \"../../../../router/router\";\nimport type { DoctorCheck } from \"../check.types\";\n\n/**\n * Ask the booted Fastify instance whether a GET route exists at this path.\n *\n * `hasRoute` is the instance's own answer, not a re-derivation of the config\n * that was supposed to produce it — which is the entire point of asking it.\n * Guarded because it is the one part of this check that depends on a Fastify\n * API: if the instance cannot answer, the check says so instead of inventing a\n * verdict from the config flag it is meant to be verifying.\n */\nfunction fastifyHasGet(path: string): boolean | undefined {\n  const http = container.tryGet<any>(\"http.server\");\n\n  if (!http || typeof http.hasRoute !== \"function\") return undefined;\n\n  try {\n    return Boolean(http.hasRoute({ method: \"GET\", url: path }));\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Whether an app route already claims this path. The HTTP connector puts the\n * probes on the Fastify instance directly and the router scans app routes onto\n * the same instance at `start()`, so a collision is a duplicate registration:\n * Fastify refuses it and the server does not start.\n */\nfunction appRouteClaims(path: string): boolean {\n  return router.list().some((route) => {\n    const method = String(route.method).toUpperCase();\n\n    return route.path === path && (method === \"GET\" || method === \"ALL\");\n  });\n}\n\n/**\n * Confirms the liveness (`/health`) and readiness (`/ready`) endpoints are\n * really there.\n *\n * NEEDS A BOOTED APP: the HTTP connector registers the probes during `boot()`,\n * which the boot pass runs. Previously this check read `http.health.enabled`\n * and reported the endpoints as \"registered\" on that basis alone — in the same\n * report where `routes` said zero, because nothing had been booted at all. It\n * was reporting an intention as a fact, and the two lines contradicted each\n * other in the owner's own run.\n *\n * Verdicts:\n * - no `http` config → not applicable, no line;\n * - `http.health.enabled = false` → `ok`. Turning the probes off is a supported\n *   choice, and a warning that fires on a deliberate setting every single run\n *   is not read by the time it matters;\n * - an app route already claims a probe's path → `fail`: Fastify will refuse\n *   the duplicate and the server will not start;\n * - the instance says the route is absent → `fail`;\n * - otherwise → `ok`, with the paths that are actually registered.\n */\nexport const healthCheck: DoctorCheck = {\n  name: \"health\",\n  run: (context) => {\n    if (!config.get(\"http\")) {\n      return undefined;\n    }\n\n    const healthConfig = config.get(\"http.health\");\n\n    if (healthConfig?.enabled === false) {\n      return {\n        name: \"health\",\n        status: \"ok\",\n        detail: \"probes disabled by config (http.health.enabled = false)\",\n      };\n    }\n\n    const livenessPath = healthConfig?.path ?? \"/health\";\n    const readinessPath = healthConfig?.readinessPath ?? \"/ready\";\n\n    const collisions = [livenessPath, readinessPath].filter(appRouteClaims);\n\n    if (collisions.length > 0) {\n      return {\n        name: \"health\",\n        status: \"fail\",\n        detail:\n          `an app route already claims ${collisions.join(\" and \")} — Fastify refuses the ` +\n          \"duplicate registration and the server will not start. Move the app route, or \" +\n          \"rename the probe via http.health.path / http.health.readinessPath\",\n      };\n    }\n\n    // The HTTP connector is what registers the probes. If it did not boot, the\n    // connectors check already says so with the reason — reporting the same\n    // defect a second time here as a health failure would inflate one problem\n    // into two.\n    if (!context.connectors.booted.includes(\"http\")) {\n      return undefined;\n    }\n\n    const registered = [livenessPath, readinessPath].map(fastifyHasGet);\n\n    if (registered.some((answer) => answer === undefined)) {\n      return {\n        name: \"health\",\n        status: \"warn\",\n        detail:\n          \"could not read the http server's route table — \" +\n          `${livenessPath} + ${readinessPath} unverified`,\n      };\n    }\n\n    const missing = [livenessPath, readinessPath].filter((_path, index) => !registered[index]);\n\n    if (missing.length > 0) {\n      return {\n        name: \"health\",\n        status: \"fail\",\n        detail: `enabled in config but not registered on the http server: ${missing.join(\", \")}`,\n      };\n    }\n\n    return {\n      name: \"health\",\n      status: \"ok\",\n      detail: `liveness ${livenessPath} + readiness ${readinessPath} registered`,\n    };\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;AAcA,SAAS,cAAc,MAAmC;CACxD,MAAM,OAAO,UAAU,OAAY,aAAa;CAEhD,IAAI,CAAC,QAAQ,OAAO,KAAK,aAAa,YAAY,OAAO;CAEzD,IAAI;EACF,OAAO,QAAQ,KAAK,SAAS;GAAE,QAAQ;GAAO,KAAK;EAAK,CAAC,CAAC;CAC5D,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAS,eAAe,MAAuB;CAC7C,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,UAAU;EACnC,MAAM,SAAS,OAAO,MAAM,MAAM,CAAC,CAAC,YAAY;EAEhD,OAAO,MAAM,SAAS,SAAS,WAAW,SAAS,WAAW;CAChE,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,cAA2B;CACtC,MAAM;CACN,MAAM,YAAY;EAChB,IAAI,CAAC,OAAO,IAAI,MAAM,GACpB;EAGF,MAAM,eAAe,OAAO,IAAI,aAAa;EAE7C,IAAI,cAAc,YAAY,OAC5B,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ;EACV;EAGF,MAAM,eAAe,cAAc,QAAQ;EAC3C,MAAM,gBAAgB,cAAc,iBAAiB;EAErD,MAAM,aAAa,CAAC,cAAc,aAAa,CAAC,CAAC,OAAO,cAAc;EAEtE,IAAI,WAAW,SAAS,GACtB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QACE,+BAA+B,WAAW,KAAK,OAAO,EAAE;EAG5D;EAOF,IAAI,CAAC,QAAQ,WAAW,OAAO,SAAS,MAAM,GAC5C;EAGF,MAAM,aAAa,CAAC,cAAc,aAAa,CAAC,CAAC,IAAI,aAAa;EAElE,IAAI,WAAW,MAAM,WAAW,WAAW,MAAS,GAClD,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QACE,kDACG,aAAa,KAAK,cAAc;EACvC;EAGF,MAAM,UAAU,CAAC,cAAc,aAAa,CAAC,CAAC,QAAQ,OAAO,UAAU,CAAC,WAAW,MAAM;EAEzF,IAAI,QAAQ,SAAS,GACnB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,4DAA4D,QAAQ,KAAK,IAAI;EACvF;EAGF,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,YAAY,aAAa,eAAe,cAAc;EAChE;CACF;AACF"}
+{"version":3,"file":"health.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/health.check.ts"],"sourcesContent":["import { config } from \"../../../../config/config-getter\";\nimport { container } from \"../../../../container\";\nimport { router } from \"../../../../router/router\";\nimport type { DoctorCheck } from \"../check.types\";\n\n/**\n * Ask the booted Fastify instance whether a GET route exists at this path.\n *\n * `hasRoute` is the instance's own answer, not a re-derivation of the config\n * that was supposed to produce it — which is the entire point of asking it.\n * Guarded because it is the one part of this check that depends on a Fastify\n * API: if the instance cannot answer, the check says so instead of inventing a\n * verdict from the config flag it is meant to be verifying.\n */\nfunction fastifyHasGet(path: string): boolean | undefined {\n  const http = container.tryGet<any>(\"http.server\");\n\n  if (!http || typeof http.hasRoute !== \"function\") return undefined;\n\n  try {\n    return Boolean(http.hasRoute({ method: \"GET\", url: path }));\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Whether an app route already claims this path. The HTTP connector puts the\n * probes on the Fastify instance directly and the router scans app routes onto\n * the same instance at `start()`, so a collision is a duplicate registration:\n * Fastify refuses it and the server does not start.\n */\nfunction appRouteClaims(path: string): boolean {\n  return router.list().some((route) => {\n    const method = String(route.method).toUpperCase();\n\n    return route.path === path && (method === \"GET\" || method === \"ALL\");\n  });\n}\n\n/**\n * Confirms the liveness (`/health`) and readiness (`/ready`) endpoints are\n * really there.\n *\n * NEEDS A BOOTED APP: the HTTP connector registers the probes during `boot()`,\n * which the boot pass runs. Previously this check read `http.health.enabled`\n * and reported the endpoints as \"registered\" on that basis alone — in the same\n * report where `routes` said zero, because nothing had been booted at all. It\n * was reporting an intention as a fact, and the two lines contradicted each\n * other in the owner's own run.\n *\n * Verdicts:\n * - no `http` config → not applicable, no line;\n * - `http.health.enabled = false` → `ok`. Turning the probes off is a supported\n *   choice, and a warning that fires on a deliberate setting every single run\n *   is not read by the time it matters;\n * - an app route already claims a probe's path → `fail`: Fastify will refuse\n *   the duplicate and the server will not start;\n * - the instance says the route is absent → `fail`;\n * - otherwise → `ok`, with the paths that are actually registered.\n */\nexport const healthCheck: DoctorCheck = {\n  name: \"health\",\n  run: (context) => {\n    if (!config.get(\"http\")) {\n      return undefined;\n    }\n\n    const healthConfig = config.get(\"http.health\");\n\n    if (healthConfig?.enabled === false) {\n      return {\n        name: \"health\",\n        status: \"ok\",\n        detail: \"probes disabled by config (http.health.enabled = false)\",\n      };\n    }\n\n    const livenessPath = healthConfig?.path ?? \"/health\";\n    const readinessPath = healthConfig?.readinessPath ?? \"/ready\";\n\n    const collisions = [livenessPath, readinessPath].filter(appRouteClaims);\n\n    if (collisions.length > 0) {\n      return {\n        name: \"health\",\n        status: \"fail\",\n        code: \"WL5002\",\n        detail:\n          `an app route already claims ${collisions.join(\" and \")} — Fastify refuses the ` +\n          \"duplicate registration and the server will not start. Move the app route, or \" +\n          \"rename the probe via http.health.path / http.health.readinessPath\",\n      };\n    }\n\n    // The HTTP connector is what registers the probes. If it did not boot, the\n    // connectors check already says so with the reason — reporting the same\n    // defect a second time here as a health failure would inflate one problem\n    // into two.\n    if (!context.connectors.booted.includes(\"http\")) {\n      return undefined;\n    }\n\n    const registered = [livenessPath, readinessPath].map(fastifyHasGet);\n\n    if (registered.some((answer) => answer === undefined)) {\n      return {\n        name: \"health\",\n        status: \"warn\",\n        code: \"WL5003\",\n        detail:\n          \"could not read the http server's route table — \" +\n          `${livenessPath} + ${readinessPath} unverified`,\n      };\n    }\n\n    const missing = [livenessPath, readinessPath].filter((_path, index) => !registered[index]);\n\n    if (missing.length > 0) {\n      return {\n        name: \"health\",\n        status: \"fail\",\n        code: \"WL5003\",\n        detail: `enabled in config but not registered on the http server: ${missing.join(\", \")}`,\n      };\n    }\n\n    return {\n      name: \"health\",\n      status: \"ok\",\n      detail: `liveness ${livenessPath} + readiness ${readinessPath} registered`,\n    };\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;AAcA,SAAS,cAAc,MAAmC;CACxD,MAAM,OAAO,UAAU,OAAY,aAAa;CAEhD,IAAI,CAAC,QAAQ,OAAO,KAAK,aAAa,YAAY,OAAO;CAEzD,IAAI;EACF,OAAO,QAAQ,KAAK,SAAS;GAAE,QAAQ;GAAO,KAAK;EAAK,CAAC,CAAC;CAC5D,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,SAAS,eAAe,MAAuB;CAC7C,OAAO,OAAO,KAAK,CAAC,CAAC,MAAM,UAAU;EACnC,MAAM,SAAS,OAAO,MAAM,MAAM,CAAC,CAAC,YAAY;EAEhD,OAAO,MAAM,SAAS,SAAS,WAAW,SAAS,WAAW;CAChE,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,cAA2B;CACtC,MAAM;CACN,MAAM,YAAY;EAChB,IAAI,CAAC,OAAO,IAAI,MAAM,GACpB;EAGF,MAAM,eAAe,OAAO,IAAI,aAAa;EAE7C,IAAI,cAAc,YAAY,OAC5B,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ;EACV;EAGF,MAAM,eAAe,cAAc,QAAQ;EAC3C,MAAM,gBAAgB,cAAc,iBAAiB;EAErD,MAAM,aAAa,CAAC,cAAc,aAAa,CAAC,CAAC,OAAO,cAAc;EAEtE,IAAI,WAAW,SAAS,GACtB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QACE,+BAA+B,WAAW,KAAK,OAAO,EAAE;EAG5D;EAOF,IAAI,CAAC,QAAQ,WAAW,OAAO,SAAS,MAAM,GAC5C;EAGF,MAAM,aAAa,CAAC,cAAc,aAAa,CAAC,CAAC,IAAI,aAAa;EAElE,IAAI,WAAW,MAAM,WAAW,WAAW,MAAS,GAClD,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QACE,kDACG,aAAa,KAAK,cAAc;EACvC;EAGF,MAAM,UAAU,CAAC,cAAc,aAAa,CAAC,CAAC,QAAQ,OAAO,UAAU,CAAC,WAAW,MAAM;EAEzF,IAAI,QAAQ,SAAS,GACnB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QAAQ,4DAA4D,QAAQ,KAAK,IAAI;EACvF;EAGF,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,YAAY,aAAa,eAAe,cAAc;EAChE;CACF;AACF"}

package/esm/cli/commands/doctor/checks/jwt-secret.check.mjs

@@ -45,6 +45,7 @@ const jwtSecretCheck = {
 		return {
 			name: "jwt-secret",
 			status,
+			code: "WL1002",
 			detail: "auth is configured (auth.userType) but no JWT signing secret is set — every login and token operation will fail with a generic 500. Run `warlock jwt.generate` to create one, or set `auth.accessToken.secret`."
 		};
 	}

package/esm/cli/commands/doctor/checks/jwt-secret.check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-secret.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/jwt-secret.check.ts"],"sourcesContent":["import { config } from \"../../../../config/config-getter\";\nimport type { CheckStatus, DoctorCheck } from \"../check.types\";\n\n/**\n * A non-empty string, or `undefined`. A secret arrives from `env(...)`; an\n * unset variable yields `undefined` and a `.env` line with nothing after the\n * `=` yields `\"\"` — both are \"not configured\".\n */\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim().length > 0 ? value.trim() : undefined;\n}\n\n/**\n * Fails when the app has configured auth but no JWT signing secret is set.\n *\n * WHY THIS EXISTS. `authConfig.accessToken.secret()` throws \"no JWT secret\n * configured\" — but LAZILY, the first time a token is signed (a login). A fresh\n * scaffold's `src/config/auth.ts` reads `env(\"JWT_SECRET\")`, and a fresh `.env`\n * has none, so the app BOOTS clean and then 500s on the very first login, with\n * the real message going only to server stderr (finding 7b606e38). `doctor`\n * turns that first-login surprise into a pre-flight failure that names the fix.\n *\n * NEEDS NO BOOTED APP — it reads config only, like `optional-peers`.\n *\n * OPTS OUT when auth is not in use. The signal is `auth.userType`: the config\n * an app fills in to declare its authenticatable models (`{ user: User }`). An\n * app with no userType configured is not doing auth, so a missing secret is not\n * a finding for it — silence keeps the doctor's false-positive budget intact.\n *\n * The secret is resolved from BOTH the current key (`auth.accessToken.secret`)\n * and the legacy one (`auth.jwt.secret`) the scaffold still emits, so this does\n * not fire on a project that is simply using the older, still-supported shape.\n */\nexport const jwtSecretCheck: DoctorCheck = {\n  name: \"jwt-secret\",\n  run: () => {\n    const userType = config.get(\"auth.userType\");\n\n    const authInUse =\n      typeof userType === \"object\" && userType !== null && Object.keys(userType).length > 0;\n\n    if (!authInUse) return undefined;\n\n    const secret =\n      text(config.get(\"auth.accessToken.secret\")) ?? text(config.get(\"auth.jwt.secret\"));\n\n    const status: CheckStatus = secret ? \"ok\" : \"fail\";\n\n    if (secret) {\n      return { name: \"jwt-secret\", status, detail: \"A JWT signing secret is configured.\" };\n    }\n\n    return {\n      name: \"jwt-secret\",\n      status,\n      detail:\n        \"auth is configured (auth.userType) but no JWT signing secret is set — \" +\n        \"every login and token operation will fail with a generic 500. \" +\n        \"Run `warlock jwt.generate` to create one, or set `auth.accessToken.secret`.\",\n    };\n  },\n};\n"],"mappings":";;;;;;;;AAQA,SAAS,KAAK,OAAoC;CAChD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,iBAA8B;CACzC,MAAM;CACN,WAAW;EACT,MAAM,WAAW,OAAO,IAAI,eAAe;EAK3C,IAAI,EAFF,OAAO,aAAa,YAAY,aAAa,QAAQ,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,IAEtE,OAAO;EAEvB,MAAM,SACJ,KAAK,OAAO,IAAI,yBAAyB,CAAC,KAAK,KAAK,OAAO,IAAI,iBAAiB,CAAC;EAEnF,MAAM,SAAsB,SAAS,OAAO;EAE5C,IAAI,QACF,OAAO;GAAE,MAAM;GAAc;GAAQ,QAAQ;EAAsC;EAGrF,OAAO;GACL,MAAM;GACN;GACA,QACE;EAGJ;CACF;AACF"}
+{"version":3,"file":"jwt-secret.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/jwt-secret.check.ts"],"sourcesContent":["import { config } from \"../../../../config/config-getter\";\nimport type { CheckStatus, DoctorCheck } from \"../check.types\";\n\n/**\n * A non-empty string, or `undefined`. A secret arrives from `env(...)`; an\n * unset variable yields `undefined` and a `.env` line with nothing after the\n * `=` yields `\"\"` — both are \"not configured\".\n */\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim().length > 0 ? value.trim() : undefined;\n}\n\n/**\n * Fails when the app has configured auth but no JWT signing secret is set.\n *\n * WHY THIS EXISTS. `authConfig.accessToken.secret()` throws \"no JWT secret\n * configured\" — but LAZILY, the first time a token is signed (a login). A fresh\n * scaffold's `src/config/auth.ts` reads `env(\"JWT_SECRET\")`, and a fresh `.env`\n * has none, so the app BOOTS clean and then 500s on the very first login, with\n * the real message going only to server stderr (finding 7b606e38). `doctor`\n * turns that first-login surprise into a pre-flight failure that names the fix.\n *\n * NEEDS NO BOOTED APP — it reads config only, like `optional-peers`.\n *\n * OPTS OUT when auth is not in use. The signal is `auth.userType`: the config\n * an app fills in to declare its authenticatable models (`{ user: User }`). An\n * app with no userType configured is not doing auth, so a missing secret is not\n * a finding for it — silence keeps the doctor's false-positive budget intact.\n *\n * The secret is resolved from BOTH the current key (`auth.accessToken.secret`)\n * and the legacy one (`auth.jwt.secret`) the scaffold still emits, so this does\n * not fire on a project that is simply using the older, still-supported shape.\n */\nexport const jwtSecretCheck: DoctorCheck = {\n  name: \"jwt-secret\",\n  run: () => {\n    const userType = config.get(\"auth.userType\");\n\n    const authInUse =\n      typeof userType === \"object\" && userType !== null && Object.keys(userType).length > 0;\n\n    if (!authInUse) return undefined;\n\n    const secret =\n      text(config.get(\"auth.accessToken.secret\")) ?? text(config.get(\"auth.jwt.secret\"));\n\n    const status: CheckStatus = secret ? \"ok\" : \"fail\";\n\n    if (secret) {\n      return { name: \"jwt-secret\", status, detail: \"A JWT signing secret is configured.\" };\n    }\n\n    return {\n      name: \"jwt-secret\",\n      status,\n      code: \"WL1002\",\n      detail:\n        \"auth is configured (auth.userType) but no JWT signing secret is set — \" +\n        \"every login and token operation will fail with a generic 500. \" +\n        \"Run `warlock jwt.generate` to create one, or set `auth.accessToken.secret`.\",\n    };\n  },\n};\n"],"mappings":";;;;;;;;AAQA,SAAS,KAAK,OAAoC;CAChD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,iBAA8B;CACzC,MAAM;CACN,WAAW;EACT,MAAM,WAAW,OAAO,IAAI,eAAe;EAK3C,IAAI,EAFF,OAAO,aAAa,YAAY,aAAa,QAAQ,OAAO,KAAK,QAAQ,CAAC,CAAC,SAAS,IAEtE,OAAO;EAEvB,MAAM,SACJ,KAAK,OAAO,IAAI,yBAAyB,CAAC,KAAK,KAAK,OAAO,IAAI,iBAAiB,CAAC;EAEnF,MAAM,SAAsB,SAAS,OAAO;EAE5C,IAAI,QACF,OAAO;GAAE,MAAM;GAAc;GAAQ,QAAQ;EAAsC;EAGrF,OAAO;GACL,MAAM;GACN;GACA,MAAM;GACN,QACE;EAGJ;CACF;AACF"}

package/esm/cli/commands/doctor/checks/locales-ts-deprecated.check.mjs

@@ -158,6 +158,7 @@ const localesTsDeprecatedCheck = {
 		return {
 			name: "locales-ts-deprecated",
 			status: "warn",
+			code: "WL9101",
 			detail: `${sources.map((source) => {
 				return `${path.relative(process.cwd(), source.file).replaceAll("\\", "/")}: ${source.convertible ? "auto-convertible" : "manual"} (${source.reason})`;
 			}).join("; ")}. Auto-loaded locales.ts goes away in v6; run \`warlock doctor --fix\` to convert auto-convertible files.`

package/esm/cli/commands/doctor/checks/locales-ts-deprecated.check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"locales-ts-deprecated.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/locales-ts-deprecated.check.ts"],"sourcesContent":["import { existsSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport ts from \"typescript\";\nimport { config } from \"../../../../config/config-getter\";\nimport {\n  parseLocaleDictionary,\n  type LocaleDictionaryEntries,\n} from \"../../../../localization/parse-locale-dictionary\";\nimport { appPath, rootPath } from \"../../../../utils/paths\";\nimport type { DoctorCheck } from \"../check.types\";\n\ntype LocaleSource = {\n  file: string;\n  module: string;\n};\n\nexport type LocaleInspection = LocaleSource & {\n  convertible: boolean;\n  reason: string;\n  group?: string;\n  dictionary?: Record<string, unknown>;\n  entries?: LocaleDictionaryEntries;\n};\n\nfunction localeSources(): LocaleSource[] {\n  const appDirectory = appPath();\n  if (!existsSync(appDirectory)) return [];\n\n  return readdirSync(appDirectory, { withFileTypes: true })\n    .filter((entry) => entry.isDirectory())\n    .map((entry) => ({\n      file: path.join(appDirectory, entry.name, \"utils\", \"locales.ts\"),\n      module: entry.name,\n    }))\n    .filter(({ file }) => existsSync(file));\n}\n\nfunction propertyName(property: ts.PropertyAssignment): string | undefined {\n  if (ts.isIdentifier(property.name) || ts.isStringLiteral(property.name))\n    return property.name.text;\n  return undefined;\n}\n\nfunction literalObject(node: ts.Expression): Record<string, unknown> | undefined {\n  if (!ts.isObjectLiteralExpression(node)) return undefined;\n  const value: Record<string, unknown> = Object.create(null);\n  for (const member of node.properties) {\n    if (!ts.isPropertyAssignment(member)) return undefined;\n    const key = propertyName(member);\n    if (key === undefined) return undefined;\n    if (ts.isStringLiteral(member.initializer) || ts.isNumericLiteral(member.initializer)) {\n      value[key] = ts.isNumericLiteral(member.initializer)\n        ? Number(member.initializer.text)\n        : member.initializer.text;\n      continue;\n    }\n    const nested = literalObject(member.initializer);\n    if (nested === undefined) return undefined;\n    value[key] = nested;\n  }\n  return value;\n}\n\nfunction flattenLiteral(\n  value: Record<string, unknown>,\n  group: string,\n  entries: LocaleDictionaryEntries,\n): boolean {\n  const values = Object.values(value);\n  if (values.every((item) => typeof item === \"string\" || typeof item === \"number\")) {\n    if (group === \"\") return false;\n    if (!values.every((item) => typeof item === \"string\")) return false;\n    entries[group] = value as Record<string, string>;\n    return true;\n  }\n  if (!values.every((item) => item !== null && typeof item === \"object\" && !Array.isArray(item)))\n    return false;\n  return Object.entries(value).every(([key, nested]) =>\n    flattenLiteral(\n      nested as Record<string, unknown>,\n      group === \"\" ? key : `${group}.${key}`,\n      entries,\n    ),\n  );\n}\n\nfunction inspect(source: LocaleSource): LocaleInspection {\n  const jsonFile = path.join(path.dirname(source.file), \"locales.json\");\n  if (existsSync(jsonFile))\n    return { ...source, convertible: false, reason: \"locales.json already exists\" };\n\n  const text = readFileSync(source.file, \"utf8\");\n  const program = ts.createSourceFile(source.file, text, ts.ScriptTarget.Latest, true);\n  const syntaxDiagnostics = ts.transpileModule(text, {\n    fileName: source.file,\n    reportDiagnostics: true,\n  }).diagnostics;\n  if (syntaxDiagnostics !== undefined && syntaxDiagnostics.length > 0)\n    return { ...source, convertible: false, reason: \"TypeScript syntax is invalid\" };\n  const [importStatement, callStatement] = program.statements;\n  if (\n    !importStatement ||\n    !ts.isImportDeclaration(importStatement) ||\n    !ts.isStringLiteral(importStatement.moduleSpecifier) ||\n    importStatement.moduleSpecifier.text !== \"@warlock.js/core\" ||\n    !importStatement.importClause ||\n    importStatement.importClause.isTypeOnly ||\n    importStatement.importClause.name ||\n    !importStatement.importClause.namedBindings ||\n    !ts.isNamedImports(importStatement.importClause.namedBindings) ||\n    importStatement.importClause.namedBindings.elements.length !== 1 ||\n    importStatement.importClause.namedBindings.elements[0]?.name.text !== \"groupedTranslations\" ||\n    importStatement.importClause.namedBindings.elements[0]?.propertyName\n  )\n    return {\n      ...source,\n      convertible: false,\n      reason: \"must import only groupedTranslations from @warlock.js/core\",\n    };\n\n  if (program.statements.length !== 2)\n    return {\n      ...source,\n      convertible: false,\n      reason: \"must contain only the groupedTranslations import and one call\",\n    };\n\n  if (\n    !callStatement ||\n    !ts.isExpressionStatement(callStatement) ||\n    !ts.isCallExpression(callStatement.expression)\n  )\n    return {\n      ...source,\n      convertible: false,\n      reason: \"must contain one top-level groupedTranslations call\",\n    };\n  const call = callStatement.expression;\n  if (\n    !ts.isIdentifier(call.expression) ||\n    call.expression.text !== \"groupedTranslations\" ||\n    call.arguments.length !== 2 ||\n    !ts.isStringLiteral(call.arguments[0]!)\n  )\n    return {\n      ...source,\n      convertible: false,\n      reason: \"must call groupedTranslations with a string group and object\",\n    };\n  const dictionary = literalObject(call.arguments[1]!);\n  if (!dictionary)\n    return {\n      ...source,\n      convertible: false,\n      reason: \"translation object must contain only literal keys, objects, strings, or numbers\",\n    };\n  const group = call.arguments[0].text;\n  const entries: LocaleDictionaryEntries = Object.create(null);\n  if (!flattenLiteral(dictionary, group, entries))\n    return {\n      ...source,\n      convertible: false,\n      reason: \"translation object has no valid literal locale entries\",\n    };\n  return {\n    ...source,\n    convertible: true,\n    reason: \"pure groupedTranslations literal\",\n    group,\n    dictionary,\n    entries,\n  };\n}\n\nexport function inspectLocaleSources(): LocaleInspection[] {\n  return localeSources().map(inspect);\n}\n\nfunction localeCodes(): readonly string[] | undefined {\n  const configured = config.key<unknown>(\"app.localeCodes\");\n  return Array.isArray(configured) && configured.every((code) => typeof code === \"string\")\n    ? configured\n    : undefined;\n}\n\nfunction sameEntries(left: LocaleDictionaryEntries, right: LocaleDictionaryEntries): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\n/** Convert safe legacy locale sources, retaining a TS file whenever verification cannot prove equivalence. */\nexport function fixLocaleSources(): LocaleInspection[] {\n  return inspectLocaleSources().map((result) => {\n    if (!result.convertible || !result.group || !result.dictionary || !result.entries)\n      return result;\n    const jsonFile = path.join(path.dirname(result.file), \"locales.json\");\n    const document: Record<string, unknown> =\n      result.group === result.module\n        ? result.dictionary\n        : { $group: result.group, ...result.dictionary };\n    const json = `${JSON.stringify(document, null, 2)}\\n`;\n    writeFileSync(jsonFile, json);\n    try {\n      const parsed = parseLocaleDictionary({\n        sourceFile: rootPath(path.relative(process.cwd(), jsonFile)),\n        source: json,\n        defaultNamespace: result.module,\n        localeCodes: localeCodes(),\n      });\n      if (!sameEntries(result.entries, parsed.entries)) throw new Error(\"flattened entries differ\");\n    } catch (error) {\n      unlinkSync(jsonFile);\n      return {\n        ...result,\n        convertible: false,\n        reason: `verification failed: ${error instanceof Error ? error.message : String(error)}`,\n      };\n    }\n    unlinkSync(result.file);\n    return {\n      ...result,\n      reason: \"converted (comments in the TypeScript source are not retained)\",\n    };\n  });\n}\n\nexport const localesTsDeprecatedCheck: DoctorCheck = {\n  name: \"locales-ts-deprecated\",\n  run: () => {\n    const sources = inspectLocaleSources();\n    if (sources.length === 0) return undefined;\n    const details = sources.map((source) => {\n      const label = path.relative(process.cwd(), source.file).replaceAll(\"\\\\\", \"/\");\n      return `${label}: ${source.convertible ? \"auto-convertible\" : \"manual\"} (${source.reason})`;\n    });\n    return {\n      name: \"locales-ts-deprecated\",\n      status: \"warn\",\n      detail:\n        `${details.join(\"; \")}. Auto-loaded locales.ts goes away in v6; ` +\n        \"run `warlock doctor --fix` to convert auto-convertible files.\",\n    };\n  },\n};\n"],"mappings":";;;;;;;;AAwBA,SAAS,gBAAgC;CACvC,MAAM,eAAe,QAAQ;CAC7B,IAAI,CAAC,WAAW,YAAY,GAAG,OAAO,CAAC;CAEvC,OAAO,YAAY,cAAc,EAAE,eAAe,KAAK,CAAC,CAAC,CACtD,QAAQ,UAAU,MAAM,YAAY,CAAC,CAAC,CACtC,KAAK,WAAW;EACf,MAAM,KAAK,KAAK,cAAc,MAAM,MAAM,SAAS,YAAY;EAC/D,QAAQ,MAAM;CAChB,EAAE,CAAC,CACF,QAAQ,EAAE,WAAW,WAAW,IAAI,CAAC;AAC1C;AAEA,SAAS,aAAa,UAAqD;CACzE,IAAI,GAAG,aAAa,SAAS,IAAI,KAAK,GAAG,gBAAgB,SAAS,IAAI,GACpE,OAAO,SAAS,KAAK;AAEzB;AAEA,SAAS,cAAc,MAA0D;CAC/E,IAAI,CAAC,GAAG,0BAA0B,IAAI,GAAG,OAAO;CAChD,MAAM,QAAiC,OAAO,OAAO,IAAI;CACzD,KAAK,MAAM,UAAU,KAAK,YAAY;EACpC,IAAI,CAAC,GAAG,qBAAqB,MAAM,GAAG,OAAO;EAC7C,MAAM,MAAM,aAAa,MAAM;EAC/B,IAAI,QAAQ,QAAW,OAAO;EAC9B,IAAI,GAAG,gBAAgB,OAAO,WAAW,KAAK,GAAG,iBAAiB,OAAO,WAAW,GAAG;GACrF,MAAM,OAAO,GAAG,iBAAiB,OAAO,WAAW,IAC/C,OAAO,OAAO,YAAY,IAAI,IAC9B,OAAO,YAAY;GACvB;EACF;EACA,MAAM,SAAS,cAAc,OAAO,WAAW;EAC/C,IAAI,WAAW,QAAW,OAAO;EACjC,MAAM,OAAO;CACf;CACA,OAAO;AACT;AAEA,SAAS,eACP,OACA,OACA,SACS;CACT,MAAM,SAAS,OAAO,OAAO,KAAK;CAClC,IAAI,OAAO,OAAO,SAAS,OAAO,SAAS,YAAY,OAAO,SAAS,QAAQ,GAAG;EAChF,IAAI,UAAU,IAAI,OAAO;EACzB,IAAI,CAAC,OAAO,OAAO,SAAS,OAAO,SAAS,QAAQ,GAAG,OAAO;EAC9D,QAAQ,SAAS;EACjB,OAAO;CACT;CACA,IAAI,CAAC,OAAO,OAAO,SAAS,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC,GAC3F,OAAO;CACT,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,YACxC,eACE,QACA,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,OACjC,OACF,CACF;AACF;AAEA,SAAS,QAAQ,QAAwC;CAEvD,IAAI,WADa,KAAK,KAAK,KAAK,QAAQ,OAAO,IAAI,GAAG,cAChC,CAAC,GACrB,OAAO;EAAE,GAAG;EAAQ,aAAa;EAAO,QAAQ;CAA8B;CAEhF,MAAM,OAAO,aAAa,OAAO,MAAM,MAAM;CAC7C,MAAM,UAAU,GAAG,iBAAiB,OAAO,MAAM,MAAM,GAAG,aAAa,QAAQ,IAAI;CACnF,MAAM,oBAAoB,GAAG,gBAAgB,MAAM;EACjD,UAAU,OAAO;EACjB,mBAAmB;CACrB,CAAC,CAAC,CAAC;CACH,IAAI,sBAAsB,UAAa,kBAAkB,SAAS,GAChE,OAAO;EAAE,GAAG;EAAQ,aAAa;EAAO,QAAQ;CAA+B;CACjF,MAAM,CAAC,iBAAiB,iBAAiB,QAAQ;CACjD,IACE,CAAC,mBACD,CAAC,GAAG,oBAAoB,eAAe,KACvC,CAAC,GAAG,gBAAgB,gBAAgB,eAAe,KACnD,gBAAgB,gBAAgB,SAAS,sBACzC,CAAC,gBAAgB,gBACjB,gBAAgB,aAAa,cAC7B,gBAAgB,aAAa,QAC7B,CAAC,gBAAgB,aAAa,iBAC9B,CAAC,GAAG,eAAe,gBAAgB,aAAa,aAAa,KAC7D,gBAAgB,aAAa,cAAc,SAAS,WAAW,KAC/D,gBAAgB,aAAa,cAAc,SAAS,EAAE,EAAE,KAAK,SAAS,yBACtE,gBAAgB,aAAa,cAAc,SAAS,EAAE,EAAE,cAExD,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CAEF,IAAI,QAAQ,WAAW,WAAW,GAChC,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CAEF,IACE,CAAC,iBACD,CAAC,GAAG,sBAAsB,aAAa,KACvC,CAAC,GAAG,iBAAiB,cAAc,UAAU,GAE7C,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CACF,MAAM,OAAO,cAAc;CAC3B,IACE,CAAC,GAAG,aAAa,KAAK,UAAU,KAChC,KAAK,WAAW,SAAS,yBACzB,KAAK,UAAU,WAAW,KAC1B,CAAC,GAAG,gBAAgB,KAAK,UAAU,EAAG,GAEtC,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CACF,MAAM,aAAa,cAAc,KAAK,UAAU,EAAG;CACnD,IAAI,CAAC,YACH,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CACF,MAAM,QAAQ,KAAK,UAAU,EAAE,CAAC;CAChC,MAAM,UAAmC,OAAO,OAAO,IAAI;CAC3D,IAAI,CAAC,eAAe,YAAY,OAAO,OAAO,GAC5C,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CACF,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;EACR;EACA;EACA;CACF;AACF;AAEA,SAAgB,uBAA2C;CACzD,OAAO,cAAc,CAAC,CAAC,IAAI,OAAO;AACpC;AAEA,SAAS,cAA6C;CACpD,MAAM,aAAa,OAAO,IAAa,iBAAiB;CACxD,OAAO,MAAM,QAAQ,UAAU,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,QAAQ,IACnF,aACA;AACN;AAEA,SAAS,YAAY,MAA+B,OAAyC;CAC3F,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;;AAGA,SAAgB,mBAAuC;CACrD,OAAO,qBAAqB,CAAC,CAAC,KAAK,WAAW;EAC5C,IAAI,CAAC,OAAO,eAAe,CAAC,OAAO,SAAS,CAAC,OAAO,cAAc,CAAC,OAAO,SACxE,OAAO;EACT,MAAM,WAAW,KAAK,KAAK,KAAK,QAAQ,OAAO,IAAI,GAAG,cAAc;EACpE,MAAM,WACJ,OAAO,UAAU,OAAO,SACpB,OAAO,aACP;GAAE,QAAQ,OAAO;GAAO,GAAG,OAAO;EAAW;EACnD,MAAM,OAAO,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE;EAClD,cAAc,UAAU,IAAI;EAC5B,IAAI;GACF,MAAM,SAAS,sBAAsB;IACnC,YAAY,SAAS,KAAK,SAAS,QAAQ,IAAI,GAAG,QAAQ,CAAC;IAC3D,QAAQ;IACR,kBAAkB,OAAO;IACzB,aAAa,YAAY;GAC3B,CAAC;GACD,IAAI,CAAC,YAAY,OAAO,SAAS,OAAO,OAAO,GAAG,MAAM,IAAI,MAAM,0BAA0B;EAC9F,SAAS,OAAO;GACd,WAAW,QAAQ;GACnB,OAAO;IACL,GAAG;IACH,aAAa;IACb,QAAQ,wBAAwB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvF;EACF;EACA,WAAW,OAAO,IAAI;EACtB,OAAO;GACL,GAAG;GACH,QAAQ;EACV;CACF,CAAC;AACH;AAEA,MAAa,2BAAwC;CACnD,MAAM;CACN,WAAW;EACT,MAAM,UAAU,qBAAqB;EACrC,IAAI,QAAQ,WAAW,GAAG,OAAO;EAKjC,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QACE,GARY,QAAQ,KAAK,WAAW;IAEtC,OAAO,GADO,KAAK,SAAS,QAAQ,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,WAAW,MAAM,GAC3D,EAAE,IAAI,OAAO,cAAc,qBAAqB,SAAS,IAAI,OAAO,OAAO;GAC3F,CAKa,CAAC,CAAC,KAAK,IAAI,EAAE;EAE1B;CACF;AACF"}
+{"version":3,"file":"locales-ts-deprecated.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/locales-ts-deprecated.check.ts"],"sourcesContent":["import { existsSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport ts from \"typescript\";\nimport { config } from \"../../../../config/config-getter\";\nimport {\n  parseLocaleDictionary,\n  type LocaleDictionaryEntries,\n} from \"../../../../localization/parse-locale-dictionary\";\nimport { appPath, rootPath } from \"../../../../utils/paths\";\nimport type { DoctorCheck } from \"../check.types\";\n\ntype LocaleSource = {\n  file: string;\n  module: string;\n};\n\nexport type LocaleInspection = LocaleSource & {\n  convertible: boolean;\n  reason: string;\n  group?: string;\n  dictionary?: Record<string, unknown>;\n  entries?: LocaleDictionaryEntries;\n};\n\nfunction localeSources(): LocaleSource[] {\n  const appDirectory = appPath();\n  if (!existsSync(appDirectory)) return [];\n\n  return readdirSync(appDirectory, { withFileTypes: true })\n    .filter((entry) => entry.isDirectory())\n    .map((entry) => ({\n      file: path.join(appDirectory, entry.name, \"utils\", \"locales.ts\"),\n      module: entry.name,\n    }))\n    .filter(({ file }) => existsSync(file));\n}\n\nfunction propertyName(property: ts.PropertyAssignment): string | undefined {\n  if (ts.isIdentifier(property.name) || ts.isStringLiteral(property.name))\n    return property.name.text;\n  return undefined;\n}\n\nfunction literalObject(node: ts.Expression): Record<string, unknown> | undefined {\n  if (!ts.isObjectLiteralExpression(node)) return undefined;\n  const value: Record<string, unknown> = Object.create(null);\n  for (const member of node.properties) {\n    if (!ts.isPropertyAssignment(member)) return undefined;\n    const key = propertyName(member);\n    if (key === undefined) return undefined;\n    if (ts.isStringLiteral(member.initializer) || ts.isNumericLiteral(member.initializer)) {\n      value[key] = ts.isNumericLiteral(member.initializer)\n        ? Number(member.initializer.text)\n        : member.initializer.text;\n      continue;\n    }\n    const nested = literalObject(member.initializer);\n    if (nested === undefined) return undefined;\n    value[key] = nested;\n  }\n  return value;\n}\n\nfunction flattenLiteral(\n  value: Record<string, unknown>,\n  group: string,\n  entries: LocaleDictionaryEntries,\n): boolean {\n  const values = Object.values(value);\n  if (values.every((item) => typeof item === \"string\" || typeof item === \"number\")) {\n    if (group === \"\") return false;\n    if (!values.every((item) => typeof item === \"string\")) return false;\n    entries[group] = value as Record<string, string>;\n    return true;\n  }\n  if (!values.every((item) => item !== null && typeof item === \"object\" && !Array.isArray(item)))\n    return false;\n  return Object.entries(value).every(([key, nested]) =>\n    flattenLiteral(\n      nested as Record<string, unknown>,\n      group === \"\" ? key : `${group}.${key}`,\n      entries,\n    ),\n  );\n}\n\nfunction inspect(source: LocaleSource): LocaleInspection {\n  const jsonFile = path.join(path.dirname(source.file), \"locales.json\");\n  if (existsSync(jsonFile))\n    return { ...source, convertible: false, reason: \"locales.json already exists\" };\n\n  const text = readFileSync(source.file, \"utf8\");\n  const program = ts.createSourceFile(source.file, text, ts.ScriptTarget.Latest, true);\n  const syntaxDiagnostics = ts.transpileModule(text, {\n    fileName: source.file,\n    reportDiagnostics: true,\n  }).diagnostics;\n  if (syntaxDiagnostics !== undefined && syntaxDiagnostics.length > 0)\n    return { ...source, convertible: false, reason: \"TypeScript syntax is invalid\" };\n  const [importStatement, callStatement] = program.statements;\n  if (\n    !importStatement ||\n    !ts.isImportDeclaration(importStatement) ||\n    !ts.isStringLiteral(importStatement.moduleSpecifier) ||\n    importStatement.moduleSpecifier.text !== \"@warlock.js/core\" ||\n    !importStatement.importClause ||\n    importStatement.importClause.isTypeOnly ||\n    importStatement.importClause.name ||\n    !importStatement.importClause.namedBindings ||\n    !ts.isNamedImports(importStatement.importClause.namedBindings) ||\n    importStatement.importClause.namedBindings.elements.length !== 1 ||\n    importStatement.importClause.namedBindings.elements[0]?.name.text !== \"groupedTranslations\" ||\n    importStatement.importClause.namedBindings.elements[0]?.propertyName\n  )\n    return {\n      ...source,\n      convertible: false,\n      reason: \"must import only groupedTranslations from @warlock.js/core\",\n    };\n\n  if (program.statements.length !== 2)\n    return {\n      ...source,\n      convertible: false,\n      reason: \"must contain only the groupedTranslations import and one call\",\n    };\n\n  if (\n    !callStatement ||\n    !ts.isExpressionStatement(callStatement) ||\n    !ts.isCallExpression(callStatement.expression)\n  )\n    return {\n      ...source,\n      convertible: false,\n      reason: \"must contain one top-level groupedTranslations call\",\n    };\n  const call = callStatement.expression;\n  if (\n    !ts.isIdentifier(call.expression) ||\n    call.expression.text !== \"groupedTranslations\" ||\n    call.arguments.length !== 2 ||\n    !ts.isStringLiteral(call.arguments[0]!)\n  )\n    return {\n      ...source,\n      convertible: false,\n      reason: \"must call groupedTranslations with a string group and object\",\n    };\n  const dictionary = literalObject(call.arguments[1]!);\n  if (!dictionary)\n    return {\n      ...source,\n      convertible: false,\n      reason: \"translation object must contain only literal keys, objects, strings, or numbers\",\n    };\n  const group = call.arguments[0].text;\n  const entries: LocaleDictionaryEntries = Object.create(null);\n  if (!flattenLiteral(dictionary, group, entries))\n    return {\n      ...source,\n      convertible: false,\n      reason: \"translation object has no valid literal locale entries\",\n    };\n  return {\n    ...source,\n    convertible: true,\n    reason: \"pure groupedTranslations literal\",\n    group,\n    dictionary,\n    entries,\n  };\n}\n\nexport function inspectLocaleSources(): LocaleInspection[] {\n  return localeSources().map(inspect);\n}\n\nfunction localeCodes(): readonly string[] | undefined {\n  const configured = config.key<unknown>(\"app.localeCodes\");\n  return Array.isArray(configured) && configured.every((code) => typeof code === \"string\")\n    ? configured\n    : undefined;\n}\n\nfunction sameEntries(left: LocaleDictionaryEntries, right: LocaleDictionaryEntries): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\n/** Convert safe legacy locale sources, retaining a TS file whenever verification cannot prove equivalence. */\nexport function fixLocaleSources(): LocaleInspection[] {\n  return inspectLocaleSources().map((result) => {\n    if (!result.convertible || !result.group || !result.dictionary || !result.entries)\n      return result;\n    const jsonFile = path.join(path.dirname(result.file), \"locales.json\");\n    const document: Record<string, unknown> =\n      result.group === result.module\n        ? result.dictionary\n        : { $group: result.group, ...result.dictionary };\n    const json = `${JSON.stringify(document, null, 2)}\\n`;\n    writeFileSync(jsonFile, json);\n    try {\n      const parsed = parseLocaleDictionary({\n        sourceFile: rootPath(path.relative(process.cwd(), jsonFile)),\n        source: json,\n        defaultNamespace: result.module,\n        localeCodes: localeCodes(),\n      });\n      if (!sameEntries(result.entries, parsed.entries)) throw new Error(\"flattened entries differ\");\n    } catch (error) {\n      unlinkSync(jsonFile);\n      return {\n        ...result,\n        convertible: false,\n        reason: `verification failed: ${error instanceof Error ? error.message : String(error)}`,\n      };\n    }\n    unlinkSync(result.file);\n    return {\n      ...result,\n      reason: \"converted (comments in the TypeScript source are not retained)\",\n    };\n  });\n}\n\nexport const localesTsDeprecatedCheck: DoctorCheck = {\n  name: \"locales-ts-deprecated\",\n  run: () => {\n    const sources = inspectLocaleSources();\n    if (sources.length === 0) return undefined;\n    const details = sources.map((source) => {\n      const label = path.relative(process.cwd(), source.file).replaceAll(\"\\\\\", \"/\");\n      return `${label}: ${source.convertible ? \"auto-convertible\" : \"manual\"} (${source.reason})`;\n    });\n    return {\n      name: \"locales-ts-deprecated\",\n      status: \"warn\",\n      code: \"WL9101\",\n      detail:\n        `${details.join(\"; \")}. Auto-loaded locales.ts goes away in v6; ` +\n        \"run `warlock doctor --fix` to convert auto-convertible files.\",\n    };\n  },\n};\n"],"mappings":";;;;;;;;AAwBA,SAAS,gBAAgC;CACvC,MAAM,eAAe,QAAQ;CAC7B,IAAI,CAAC,WAAW,YAAY,GAAG,OAAO,CAAC;CAEvC,OAAO,YAAY,cAAc,EAAE,eAAe,KAAK,CAAC,CAAC,CACtD,QAAQ,UAAU,MAAM,YAAY,CAAC,CAAC,CACtC,KAAK,WAAW;EACf,MAAM,KAAK,KAAK,cAAc,MAAM,MAAM,SAAS,YAAY;EAC/D,QAAQ,MAAM;CAChB,EAAE,CAAC,CACF,QAAQ,EAAE,WAAW,WAAW,IAAI,CAAC;AAC1C;AAEA,SAAS,aAAa,UAAqD;CACzE,IAAI,GAAG,aAAa,SAAS,IAAI,KAAK,GAAG,gBAAgB,SAAS,IAAI,GACpE,OAAO,SAAS,KAAK;AAEzB;AAEA,SAAS,cAAc,MAA0D;CAC/E,IAAI,CAAC,GAAG,0BAA0B,IAAI,GAAG,OAAO;CAChD,MAAM,QAAiC,OAAO,OAAO,IAAI;CACzD,KAAK,MAAM,UAAU,KAAK,YAAY;EACpC,IAAI,CAAC,GAAG,qBAAqB,MAAM,GAAG,OAAO;EAC7C,MAAM,MAAM,aAAa,MAAM;EAC/B,IAAI,QAAQ,QAAW,OAAO;EAC9B,IAAI,GAAG,gBAAgB,OAAO,WAAW,KAAK,GAAG,iBAAiB,OAAO,WAAW,GAAG;GACrF,MAAM,OAAO,GAAG,iBAAiB,OAAO,WAAW,IAC/C,OAAO,OAAO,YAAY,IAAI,IAC9B,OAAO,YAAY;GACvB;EACF;EACA,MAAM,SAAS,cAAc,OAAO,WAAW;EAC/C,IAAI,WAAW,QAAW,OAAO;EACjC,MAAM,OAAO;CACf;CACA,OAAO;AACT;AAEA,SAAS,eACP,OACA,OACA,SACS;CACT,MAAM,SAAS,OAAO,OAAO,KAAK;CAClC,IAAI,OAAO,OAAO,SAAS,OAAO,SAAS,YAAY,OAAO,SAAS,QAAQ,GAAG;EAChF,IAAI,UAAU,IAAI,OAAO;EACzB,IAAI,CAAC,OAAO,OAAO,SAAS,OAAO,SAAS,QAAQ,GAAG,OAAO;EAC9D,QAAQ,SAAS;EACjB,OAAO;CACT;CACA,IAAI,CAAC,OAAO,OAAO,SAAS,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,CAAC,GAC3F,OAAO;CACT,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,YACxC,eACE,QACA,UAAU,KAAK,MAAM,GAAG,MAAM,GAAG,OACjC,OACF,CACF;AACF;AAEA,SAAS,QAAQ,QAAwC;CAEvD,IAAI,WADa,KAAK,KAAK,KAAK,QAAQ,OAAO,IAAI,GAAG,cAChC,CAAC,GACrB,OAAO;EAAE,GAAG;EAAQ,aAAa;EAAO,QAAQ;CAA8B;CAEhF,MAAM,OAAO,aAAa,OAAO,MAAM,MAAM;CAC7C,MAAM,UAAU,GAAG,iBAAiB,OAAO,MAAM,MAAM,GAAG,aAAa,QAAQ,IAAI;CACnF,MAAM,oBAAoB,GAAG,gBAAgB,MAAM;EACjD,UAAU,OAAO;EACjB,mBAAmB;CACrB,CAAC,CAAC,CAAC;CACH,IAAI,sBAAsB,UAAa,kBAAkB,SAAS,GAChE,OAAO;EAAE,GAAG;EAAQ,aAAa;EAAO,QAAQ;CAA+B;CACjF,MAAM,CAAC,iBAAiB,iBAAiB,QAAQ;CACjD,IACE,CAAC,mBACD,CAAC,GAAG,oBAAoB,eAAe,KACvC,CAAC,GAAG,gBAAgB,gBAAgB,eAAe,KACnD,gBAAgB,gBAAgB,SAAS,sBACzC,CAAC,gBAAgB,gBACjB,gBAAgB,aAAa,cAC7B,gBAAgB,aAAa,QAC7B,CAAC,gBAAgB,aAAa,iBAC9B,CAAC,GAAG,eAAe,gBAAgB,aAAa,aAAa,KAC7D,gBAAgB,aAAa,cAAc,SAAS,WAAW,KAC/D,gBAAgB,aAAa,cAAc,SAAS,EAAE,EAAE,KAAK,SAAS,yBACtE,gBAAgB,aAAa,cAAc,SAAS,EAAE,EAAE,cAExD,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CAEF,IAAI,QAAQ,WAAW,WAAW,GAChC,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CAEF,IACE,CAAC,iBACD,CAAC,GAAG,sBAAsB,aAAa,KACvC,CAAC,GAAG,iBAAiB,cAAc,UAAU,GAE7C,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CACF,MAAM,OAAO,cAAc;CAC3B,IACE,CAAC,GAAG,aAAa,KAAK,UAAU,KAChC,KAAK,WAAW,SAAS,yBACzB,KAAK,UAAU,WAAW,KAC1B,CAAC,GAAG,gBAAgB,KAAK,UAAU,EAAG,GAEtC,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CACF,MAAM,aAAa,cAAc,KAAK,UAAU,EAAG;CACnD,IAAI,CAAC,YACH,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CACF,MAAM,QAAQ,KAAK,UAAU,EAAE,CAAC;CAChC,MAAM,UAAmC,OAAO,OAAO,IAAI;CAC3D,IAAI,CAAC,eAAe,YAAY,OAAO,OAAO,GAC5C,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;CACV;CACF,OAAO;EACL,GAAG;EACH,aAAa;EACb,QAAQ;EACR;EACA;EACA;CACF;AACF;AAEA,SAAgB,uBAA2C;CACzD,OAAO,cAAc,CAAC,CAAC,IAAI,OAAO;AACpC;AAEA,SAAS,cAA6C;CACpD,MAAM,aAAa,OAAO,IAAa,iBAAiB;CACxD,OAAO,MAAM,QAAQ,UAAU,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,QAAQ,IACnF,aACA;AACN;AAEA,SAAS,YAAY,MAA+B,OAAyC;CAC3F,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;;AAGA,SAAgB,mBAAuC;CACrD,OAAO,qBAAqB,CAAC,CAAC,KAAK,WAAW;EAC5C,IAAI,CAAC,OAAO,eAAe,CAAC,OAAO,SAAS,CAAC,OAAO,cAAc,CAAC,OAAO,SACxE,OAAO;EACT,MAAM,WAAW,KAAK,KAAK,KAAK,QAAQ,OAAO,IAAI,GAAG,cAAc;EACpE,MAAM,WACJ,OAAO,UAAU,OAAO,SACpB,OAAO,aACP;GAAE,QAAQ,OAAO;GAAO,GAAG,OAAO;EAAW;EACnD,MAAM,OAAO,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE;EAClD,cAAc,UAAU,IAAI;EAC5B,IAAI;GACF,MAAM,SAAS,sBAAsB;IACnC,YAAY,SAAS,KAAK,SAAS,QAAQ,IAAI,GAAG,QAAQ,CAAC;IAC3D,QAAQ;IACR,kBAAkB,OAAO;IACzB,aAAa,YAAY;GAC3B,CAAC;GACD,IAAI,CAAC,YAAY,OAAO,SAAS,OAAO,OAAO,GAAG,MAAM,IAAI,MAAM,0BAA0B;EAC9F,SAAS,OAAO;GACd,WAAW,QAAQ;GACnB,OAAO;IACL,GAAG;IACH,aAAa;IACb,QAAQ,wBAAwB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvF;EACF;EACA,WAAW,OAAO,IAAI;EACtB,OAAO;GACL,GAAG;GACH,QAAQ;EACV;CACF,CAAC;AACH;AAEA,MAAa,2BAAwC;CACnD,MAAM;CACN,WAAW;EACT,MAAM,UAAU,qBAAqB;EACrC,IAAI,QAAQ,WAAW,GAAG,OAAO;EAKjC,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QACE,GATY,QAAQ,KAAK,WAAW;IAEtC,OAAO,GADO,KAAK,SAAS,QAAQ,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,WAAW,MAAM,GAC3D,EAAE,IAAI,OAAO,cAAc,qBAAqB,SAAS,IAAI,OAAO,OAAO;GAC3F,CAMa,CAAC,CAAC,KAAK,IAAI,EAAE;EAE1B;CACF;AACF"}

package/esm/cli/commands/doctor/checks/optional-peers.check.mjs

@@ -139,6 +139,7 @@ const optionalPeersCheck = {
 		if (missing.length > 0) return {
 			name: "optional-peers",
 			status,
+			code: "WL2007",
 			detail: `${missing.length} configured feature(s) have no driver installed:\n` + missing.map((peer) => `  - ${peer.package} — required by ${peer.because}`).join("\n")
 		};
 		return {

package/esm/cli/commands/doctor/checks/optional-peers.check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"optional-peers.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/optional-peers.check.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport { config } from \"../../../../config/config-getter\";\nimport type { CheckStatus, DoctorCheck } from \"../check.types\";\n\n/**\n * A package this project's own configuration requires, and what asked for it.\n */\ntype RequiredPeer = {\n  /** The npm package name to probe via `require.resolve`. */\n  package: string;\n\n  /** The config that asked for it, quoted back to the user verbatim. */\n  because: string;\n};\n\n/**\n * Resolve from the project's working directory, not from core's own\n * `node_modules`, so the probe reflects what the *consuming app* has installed.\n */\nconst projectRequire = createRequire(`${process.cwd()}/package.json`);\n\n/**\n * Whether a package can be resolved from the project. A failed resolve (the\n * normal \"not installed\" case) is swallowed and reported as missing.\n */\nfunction isInstalled(packageName: string): boolean {\n  try {\n    projectRequire.resolve(packageName);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * A non-empty string, or `undefined`. Config values arrive from `env(...)` and\n * an unset variable yields `undefined` — but a `.env` line with nothing after\n * the `=` yields `\"\"`, which is \"not configured\" just as much.\n */\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim().length > 0 ? value.trim() : undefined;\n}\n\n/**\n * The database driver's package. `driver` is a closed union in cascade\n * (`mongodb | postgres | mysql`) and mysql is not implemented by cascade, so it\n * has no peer to report; an unrecognised value means the config is\n * wrong in a way this check is not the right one to report.\n */\nfunction databasePeer(): RequiredPeer | undefined {\n  const driver = text(config.get(\"database.driver\"));\n\n  const packageName =\n    driver === \"mongodb\"\n      ? \"mongodb\"\n      : driver === \"postgres\"\n        ? \"pg\"\n        : undefined;\n\n  return packageName\n    ? { package: packageName, because: `database.driver = \"${driver}\"` }\n    : undefined;\n}\n\n/**\n * The selected cache driver. Only the DEFAULT matters: `cache.drivers` is a\n * menu the scaffold fills in for every driver the framework ships, and warning\n * about a menu entry nobody selected is the false positive this whole check was\n * rewritten to remove.\n */\nfunction cachePeer(): RequiredPeer | undefined {\n  const selected = text(config.get(\"cache.default\"));\n\n  if (!selected || !/redis/i.test(selected)) return undefined;\n\n  return { package: \"redis\", because: `cache.default = \"${selected}\"` };\n}\n\n/**\n * The selected storage driver, read through its canonical `driver` field\n * (`local` / `s3` / `r2` / `spaces`) rather than the key the app happened to\n * name it, so a driver called \"cdn\" is still recognised as S3.\n */\nfunction storagePeer(): RequiredPeer | undefined {\n  const selected = text(config.get(\"storage.default\"));\n\n  if (!selected) return undefined;\n\n  const driver = text(config.get(`storage.drivers.${selected}.driver`));\n\n  if (!driver || driver === \"local\") return undefined;\n\n  return {\n    package: \"@aws-sdk/client-s3\",\n    because: `storage.default = \"${selected}\" (driver \"${driver}\")`,\n  };\n}\n\n/**\n * The mail transport. A `mail` config with no host and no driver is the\n * scaffold's placeholder — every field is an unset env var — so it asks for\n * nothing and this stays quiet.\n */\nfunction mailPeer(): RequiredPeer | undefined {\n  const driver = text(config.get(\"mail.driver\"));\n\n  if (driver === \"ses\") {\n    return { package: \"@aws-sdk/client-sesv2\", because: `mail.driver = \"ses\"` };\n  }\n\n  const host = text(config.get(\"mail.host\"));\n\n  if (!host) return undefined;\n\n  return { package: \"nodemailer\", because: `mail.host = \"${host}\"` };\n}\n\n/**\n * Realtime sockets. The connector no-ops without a `socket` config, so the\n * presence of that config is exactly the request for the peer.\n */\nfunction socketPeer(): RequiredPeer | undefined {\n  if (!config.get(\"socket\")) return undefined;\n\n  return { package: \"socket.io\", because: \"a socket config is present\" };\n}\n\n/**\n * Every peer THIS project's configuration asks for.\n */\nfunction requiredPeers(): RequiredPeer[] {\n  return [databasePeer(), cachePeer(), storagePeer(), mailPeer(), socketPeer()].filter(\n    (peer): peer is RequiredPeer => Boolean(peer),\n  );\n}\n\n/**\n * Checks that every optional peer the project's own configuration selects is\n * actually installed.\n *\n * NEEDS NO BOOTED APP — it reads config and resolves module paths. It runs after\n * the boot pass only because config is loaded by then.\n *\n * WHAT THIS REPLACED, AND WHY: the previous version probed nine packages and\n * warned about every one that was absent. Every one of them is an OPTIONAL\n * peer — a fresh app installs none of them by design — so the check warned, at\n * length, about the framework's own default state. \"No MySQL driver installed\"\n * is not a diagnosis for someone who never wanted MySQL; it is noise that\n * teaches the reader to skim past the line where a real finding will one day\n * appear.\n *\n * Inverted, it becomes a genuine one: a project whose config selects a driver\n * whose package is missing is broken — it will throw the first time that\n * feature is used — so a missing peer here is a `fail`, not a warning.\n */\nexport const optionalPeersCheck: DoctorCheck = {\n  name: \"optional-peers\",\n  run: () => {\n    const required = requiredPeers();\n\n    if (required.length === 0) {\n      return undefined;\n    }\n\n    const missing = required.filter((peer) => !isInstalled(peer.package));\n\n    const status: CheckStatus = missing.length > 0 ? \"fail\" : \"ok\";\n\n    if (missing.length > 0) {\n      return {\n        name: \"optional-peers\",\n        status,\n        detail:\n          `${missing.length} configured feature(s) have no driver installed:\\n` +\n          missing.map((peer) => `  - ${peer.package} — required by ${peer.because}`).join(\"\\n\"),\n      };\n    }\n\n    return {\n      name: \"optional-peers\",\n      status,\n      detail: `every configured driver is installed (${required\n        .map((peer) => peer.package)\n        .join(\", \")})`,\n    };\n  },\n};\n"],"mappings":";;;;;;;;AAmBA,MAAM,iBAAiB,cAAc,GAAG,QAAQ,IAAI,EAAE,cAAc;;;;;AAMpE,SAAS,YAAY,aAA8B;CACjD,IAAI;EACF,eAAe,QAAQ,WAAW;EAClC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;AAOA,SAAS,KAAK,OAAoC;CAChD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;;;;;;;AAQA,SAAS,eAAyC;CAChD,MAAM,SAAS,KAAK,OAAO,IAAI,iBAAiB,CAAC;CAEjD,MAAM,cACJ,WAAW,YACP,YACA,WAAW,aACT,OACA;CAER,OAAO,cACH;EAAE,SAAS;EAAa,SAAS,sBAAsB,OAAO;CAAG,IACjE;AACN;;;;;;;AAQA,SAAS,YAAsC;CAC7C,MAAM,WAAW,KAAK,OAAO,IAAI,eAAe,CAAC;CAEjD,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,QAAQ,GAAG,OAAO;CAElD,OAAO;EAAE,SAAS;EAAS,SAAS,oBAAoB,SAAS;CAAG;AACtE;;;;;;AAOA,SAAS,cAAwC;CAC/C,MAAM,WAAW,KAAK,OAAO,IAAI,iBAAiB,CAAC;CAEnD,IAAI,CAAC,UAAU,OAAO;CAEtB,MAAM,SAAS,KAAK,OAAO,IAAI,mBAAmB,SAAS,QAAQ,CAAC;CAEpE,IAAI,CAAC,UAAU,WAAW,SAAS,OAAO;CAE1C,OAAO;EACL,SAAS;EACT,SAAS,sBAAsB,SAAS,aAAa,OAAO;CAC9D;AACF;;;;;;AAOA,SAAS,WAAqC;CAG5C,IAFe,KAAK,OAAO,IAAI,aAAa,CAEnC,MAAM,OACb,OAAO;EAAE,SAAS;EAAyB,SAAS;CAAsB;CAG5E,MAAM,OAAO,KAAK,OAAO,IAAI,WAAW,CAAC;CAEzC,IAAI,CAAC,MAAM,OAAO;CAElB,OAAO;EAAE,SAAS;EAAc,SAAS,gBAAgB,KAAK;CAAG;AACnE;;;;;AAMA,SAAS,aAAuC;CAC9C,IAAI,CAAC,OAAO,IAAI,QAAQ,GAAG,OAAO;CAElC,OAAO;EAAE,SAAS;EAAa,SAAS;CAA6B;AACvE;;;;AAKA,SAAS,gBAAgC;CACvC,OAAO;EAAC,aAAa;EAAG,UAAU;EAAG,YAAY;EAAG,SAAS;EAAG,WAAW;CAAC,CAAC,CAAC,QAC3E,SAA+B,QAAQ,IAAI,CAC9C;AACF;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qBAAkC;CAC7C,MAAM;CACN,WAAW;EACT,MAAM,WAAW,cAAc;EAE/B,IAAI,SAAS,WAAW,GACtB;EAGF,MAAM,UAAU,SAAS,QAAQ,SAAS,CAAC,YAAY,KAAK,OAAO,CAAC;EAEpE,MAAM,SAAsB,QAAQ,SAAS,IAAI,SAAS;EAE1D,IAAI,QAAQ,SAAS,GACnB,OAAO;GACL,MAAM;GACN;GACA,QACE,GAAG,QAAQ,OAAO,sDAClB,QAAQ,KAAK,SAAS,OAAO,KAAK,QAAQ,iBAAiB,KAAK,SAAS,CAAC,CAAC,KAAK,IAAI;EACxF;EAGF,OAAO;GACL,MAAM;GACN;GACA,QAAQ,yCAAyC,SAC9C,KAAK,SAAS,KAAK,OAAO,CAAC,CAC3B,KAAK,IAAI,EAAE;EAChB;CACF;AACF"}
+{"version":3,"file":"optional-peers.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/optional-peers.check.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport { config } from \"../../../../config/config-getter\";\nimport type { CheckStatus, DoctorCheck } from \"../check.types\";\n\n/**\n * A package this project's own configuration requires, and what asked for it.\n */\ntype RequiredPeer = {\n  /** The npm package name to probe via `require.resolve`. */\n  package: string;\n\n  /** The config that asked for it, quoted back to the user verbatim. */\n  because: string;\n};\n\n/**\n * Resolve from the project's working directory, not from core's own\n * `node_modules`, so the probe reflects what the *consuming app* has installed.\n */\nconst projectRequire = createRequire(`${process.cwd()}/package.json`);\n\n/**\n * Whether a package can be resolved from the project. A failed resolve (the\n * normal \"not installed\" case) is swallowed and reported as missing.\n */\nfunction isInstalled(packageName: string): boolean {\n  try {\n    projectRequire.resolve(packageName);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * A non-empty string, or `undefined`. Config values arrive from `env(...)` and\n * an unset variable yields `undefined` — but a `.env` line with nothing after\n * the `=` yields `\"\"`, which is \"not configured\" just as much.\n */\nfunction text(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim().length > 0 ? value.trim() : undefined;\n}\n\n/**\n * The database driver's package. `driver` is a closed union in cascade\n * (`mongodb | postgres | mysql`) and mysql is not implemented by cascade, so it\n * has no peer to report; an unrecognised value means the config is\n * wrong in a way this check is not the right one to report.\n */\nfunction databasePeer(): RequiredPeer | undefined {\n  const driver = text(config.get(\"database.driver\"));\n\n  const packageName = driver === \"mongodb\" ? \"mongodb\" : driver === \"postgres\" ? \"pg\" : undefined;\n\n  return packageName\n    ? { package: packageName, because: `database.driver = \"${driver}\"` }\n    : undefined;\n}\n\n/**\n * The selected cache driver. Only the DEFAULT matters: `cache.drivers` is a\n * menu the scaffold fills in for every driver the framework ships, and warning\n * about a menu entry nobody selected is the false positive this whole check was\n * rewritten to remove.\n */\nfunction cachePeer(): RequiredPeer | undefined {\n  const selected = text(config.get(\"cache.default\"));\n\n  if (!selected || !/redis/i.test(selected)) return undefined;\n\n  return { package: \"redis\", because: `cache.default = \"${selected}\"` };\n}\n\n/**\n * The selected storage driver, read through its canonical `driver` field\n * (`local` / `s3` / `r2` / `spaces`) rather than the key the app happened to\n * name it, so a driver called \"cdn\" is still recognised as S3.\n */\nfunction storagePeer(): RequiredPeer | undefined {\n  const selected = text(config.get(\"storage.default\"));\n\n  if (!selected) return undefined;\n\n  const driver = text(config.get(`storage.drivers.${selected}.driver`));\n\n  if (!driver || driver === \"local\") return undefined;\n\n  return {\n    package: \"@aws-sdk/client-s3\",\n    because: `storage.default = \"${selected}\" (driver \"${driver}\")`,\n  };\n}\n\n/**\n * The mail transport. A `mail` config with no host and no driver is the\n * scaffold's placeholder — every field is an unset env var — so it asks for\n * nothing and this stays quiet.\n */\nfunction mailPeer(): RequiredPeer | undefined {\n  const driver = text(config.get(\"mail.driver\"));\n\n  if (driver === \"ses\") {\n    return { package: \"@aws-sdk/client-sesv2\", because: `mail.driver = \"ses\"` };\n  }\n\n  const host = text(config.get(\"mail.host\"));\n\n  if (!host) return undefined;\n\n  return { package: \"nodemailer\", because: `mail.host = \"${host}\"` };\n}\n\n/**\n * Realtime sockets. The connector no-ops without a `socket` config, so the\n * presence of that config is exactly the request for the peer.\n */\nfunction socketPeer(): RequiredPeer | undefined {\n  if (!config.get(\"socket\")) return undefined;\n\n  return { package: \"socket.io\", because: \"a socket config is present\" };\n}\n\n/**\n * Every peer THIS project's configuration asks for.\n */\nfunction requiredPeers(): RequiredPeer[] {\n  return [databasePeer(), cachePeer(), storagePeer(), mailPeer(), socketPeer()].filter(\n    (peer): peer is RequiredPeer => Boolean(peer),\n  );\n}\n\n/**\n * Checks that every optional peer the project's own configuration selects is\n * actually installed.\n *\n * NEEDS NO BOOTED APP — it reads config and resolves module paths. It runs after\n * the boot pass only because config is loaded by then.\n *\n * WHAT THIS REPLACED, AND WHY: the previous version probed nine packages and\n * warned about every one that was absent. Every one of them is an OPTIONAL\n * peer — a fresh app installs none of them by design — so the check warned, at\n * length, about the framework's own default state. \"No MySQL driver installed\"\n * is not a diagnosis for someone who never wanted MySQL; it is noise that\n * teaches the reader to skim past the line where a real finding will one day\n * appear.\n *\n * Inverted, it becomes a genuine one: a project whose config selects a driver\n * whose package is missing is broken — it will throw the first time that\n * feature is used — so a missing peer here is a `fail`, not a warning.\n */\nexport const optionalPeersCheck: DoctorCheck = {\n  name: \"optional-peers\",\n  run: () => {\n    const required = requiredPeers();\n\n    if (required.length === 0) {\n      return undefined;\n    }\n\n    const missing = required.filter((peer) => !isInstalled(peer.package));\n\n    const status: CheckStatus = missing.length > 0 ? \"fail\" : \"ok\";\n\n    if (missing.length > 0) {\n      return {\n        name: \"optional-peers\",\n        status,\n        code: \"WL2007\",\n        detail:\n          `${missing.length} configured feature(s) have no driver installed:\\n` +\n          missing.map((peer) => `  - ${peer.package} — required by ${peer.because}`).join(\"\\n\"),\n      };\n    }\n\n    return {\n      name: \"optional-peers\",\n      status,\n      detail: `every configured driver is installed (${required\n        .map((peer) => peer.package)\n        .join(\", \")})`,\n    };\n  },\n};\n"],"mappings":";;;;;;;;AAmBA,MAAM,iBAAiB,cAAc,GAAG,QAAQ,IAAI,EAAE,cAAc;;;;;AAMpE,SAAS,YAAY,aAA8B;CACjD,IAAI;EACF,eAAe,QAAQ,WAAW;EAClC,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;;;AAOA,SAAS,KAAK,OAAoC;CAChD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;;;;;;;AAQA,SAAS,eAAyC;CAChD,MAAM,SAAS,KAAK,OAAO,IAAI,iBAAiB,CAAC;CAEjD,MAAM,cAAc,WAAW,YAAY,YAAY,WAAW,aAAa,OAAO;CAEtF,OAAO,cACH;EAAE,SAAS;EAAa,SAAS,sBAAsB,OAAO;CAAG,IACjE;AACN;;;;;;;AAQA,SAAS,YAAsC;CAC7C,MAAM,WAAW,KAAK,OAAO,IAAI,eAAe,CAAC;CAEjD,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,QAAQ,GAAG,OAAO;CAElD,OAAO;EAAE,SAAS;EAAS,SAAS,oBAAoB,SAAS;CAAG;AACtE;;;;;;AAOA,SAAS,cAAwC;CAC/C,MAAM,WAAW,KAAK,OAAO,IAAI,iBAAiB,CAAC;CAEnD,IAAI,CAAC,UAAU,OAAO;CAEtB,MAAM,SAAS,KAAK,OAAO,IAAI,mBAAmB,SAAS,QAAQ,CAAC;CAEpE,IAAI,CAAC,UAAU,WAAW,SAAS,OAAO;CAE1C,OAAO;EACL,SAAS;EACT,SAAS,sBAAsB,SAAS,aAAa,OAAO;CAC9D;AACF;;;;;;AAOA,SAAS,WAAqC;CAG5C,IAFe,KAAK,OAAO,IAAI,aAAa,CAEnC,MAAM,OACb,OAAO;EAAE,SAAS;EAAyB,SAAS;CAAsB;CAG5E,MAAM,OAAO,KAAK,OAAO,IAAI,WAAW,CAAC;CAEzC,IAAI,CAAC,MAAM,OAAO;CAElB,OAAO;EAAE,SAAS;EAAc,SAAS,gBAAgB,KAAK;CAAG;AACnE;;;;;AAMA,SAAS,aAAuC;CAC9C,IAAI,CAAC,OAAO,IAAI,QAAQ,GAAG,OAAO;CAElC,OAAO;EAAE,SAAS;EAAa,SAAS;CAA6B;AACvE;;;;AAKA,SAAS,gBAAgC;CACvC,OAAO;EAAC,aAAa;EAAG,UAAU;EAAG,YAAY;EAAG,SAAS;EAAG,WAAW;CAAC,CAAC,CAAC,QAC3E,SAA+B,QAAQ,IAAI,CAC9C;AACF;;;;;;;;;;;;;;;;;;;;AAqBA,MAAa,qBAAkC;CAC7C,MAAM;CACN,WAAW;EACT,MAAM,WAAW,cAAc;EAE/B,IAAI,SAAS,WAAW,GACtB;EAGF,MAAM,UAAU,SAAS,QAAQ,SAAS,CAAC,YAAY,KAAK,OAAO,CAAC;EAEpE,MAAM,SAAsB,QAAQ,SAAS,IAAI,SAAS;EAE1D,IAAI,QAAQ,SAAS,GACnB,OAAO;GACL,MAAM;GACN;GACA,MAAM;GACN,QACE,GAAG,QAAQ,OAAO,sDAClB,QAAQ,KAAK,SAAS,OAAO,KAAK,QAAQ,iBAAiB,KAAK,SAAS,CAAC,CAAC,KAAK,IAAI;EACxF;EAGF,OAAO;GACL,MAAM;GACN;GACA,QAAQ,yCAAyC,SAC9C,KAAK,SAAS,KAAK,OAAO,CAAC,CAC3B,KAAK,IAAI,EAAE;EAChB;CACF;AACF"}

package/esm/cli/commands/doctor/checks/release-hygiene.check.mjs

@@ -56,22 +56,26 @@ const releaseHygieneCheck = {
 		if (typeof pkgVersion !== "string") return {
 			name: "release-hygiene",
 			status: "fail",
+			code: "WL9102",
 			detail: "package.json is publishable but has no string version field"
 		};
 		if (!existsSync(changelogPath)) return {
 			name: "release-hygiene",
 			status: "warn",
+			code: "WL9103",
 			detail: `no CHANGELOG.md at project root (package.json is ${pkgVersion})`
 		};
 		const heading = parseTopHeading(readFileSync(changelogPath, "utf8"));
 		if (!heading) return {
 			name: "release-hygiene",
 			status: "warn",
+			code: "WL9103",
 			detail: "CHANGELOG.md has no parseable `## x.y.z` heading"
 		};
 		if (heading.version !== pkgVersion) return {
 			name: "release-hygiene",
 			status: "fail",
+			code: "WL9102",
 			detail: `package.json ${pkgVersion} ≠ top CHANGELOG heading ${heading.version}`
 		};
 		return {

package/esm/cli/commands/doctor/checks/release-hygiene.check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"release-hygiene.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/release-hygiene.check.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { rootPath } from \"../../../../utils/paths\";\nimport type { DoctorCheck } from \"../check.types\";\n\n/**\n * A `## x.y.z` changelog heading with an optional ` - YYYY-MM-DD` suffix.\n * Mirrors the shape parsed by the tier-0 release-hygiene unit guard; inlined\n * here because that guard lives in the test tree and is not importable from\n * `src`.\n */\ntype ChangelogHeading = {\n  version: string;\n  date?: string;\n};\n\n/**\n * The parts of `package.json` this check reads.\n */\ntype ProjectManifest = {\n  version?: unknown;\n  private?: unknown;\n  name?: unknown;\n};\n\n/**\n * Parse the top-most `## x.y.z[ - YYYY-MM-DD]` heading out of a CHANGELOG body.\n * Returns `undefined` when no version heading is present.\n */\nfunction parseTopHeading(changelog: string): ChangelogHeading | undefined {\n  const match = changelog.match(/^##\\s+(\\d+)\\.(\\d+)\\.(\\d+)(?:\\s*[-–]\\s*(\\d{4}-\\d{2}-\\d{2}))?\\s*$/m);\n\n  if (!match) {\n    return undefined;\n  }\n\n  const [, major, minor, patch, date] = match;\n\n  return {\n    version: `${major}.${minor}.${patch}`,\n    date,\n  };\n}\n\n/**\n * Whether this project is something anyone could `npm publish`.\n *\n * THE GATE, and the reason it exists: a changelog is a promise to the people\n * who install your package. An application has no such people. Running this\n * check on every project projected the framework monorepo's own release\n * practice onto users building an app, who were told — on every single run,\n * forever — that their private application was missing a CHANGELOG.md it had no\n * reason to have. `\"private\": true` is exactly the field npm itself reads to\n * refuse a publish, so it is the honest test of whether the concern applies.\n */\nfunction isPublishable(manifest: ProjectManifest): boolean {\n  return manifest.private !== true && typeof manifest.name === \"string\";\n}\n\n/**\n * Checks that a PUBLISHABLE package's `package.json` version matches the\n * top-most `## x.y.z` heading in `CHANGELOG.md` — the same version↔changelog\n * invariant the release-hygiene unit guard enforces, surfaced as a pre-release\n * doctor check.\n *\n * NEEDS NO BOOTED APP — it reads two files from the project root.\n *\n * Verdicts:\n * - `\"private\": true`, or no package name → not applicable, no line at all;\n * - no `CHANGELOG.md` → `warn` (recommended for a published package, not\n *   mandatory);\n * - no parseable heading → `warn`;\n * - heading version ≠ package.json version → `fail`;\n * - otherwise → `ok`.\n */\nexport const releaseHygieneCheck: DoctorCheck = {\n  name: \"release-hygiene\",\n  run: () => {\n    const packageJsonPath = rootPath(\"package.json\");\n    const changelogPath = rootPath(\"CHANGELOG.md\");\n\n    const manifest: ProjectManifest = JSON.parse(readFileSync(packageJsonPath, \"utf8\"));\n\n    if (!isPublishable(manifest)) {\n      return undefined;\n    }\n\n    const pkgVersion = manifest.version;\n\n    if (typeof pkgVersion !== \"string\") {\n      return {\n        name: \"release-hygiene\",\n        status: \"fail\",\n        detail: \"package.json is publishable but has no string version field\",\n      };\n    }\n\n    if (!existsSync(changelogPath)) {\n      return {\n        name: \"release-hygiene\",\n        status: \"warn\",\n        detail: `no CHANGELOG.md at project root (package.json is ${pkgVersion})`,\n      };\n    }\n\n    const changelog = readFileSync(changelogPath, \"utf8\");\n    const heading = parseTopHeading(changelog);\n\n    if (!heading) {\n      return {\n        name: \"release-hygiene\",\n        status: \"warn\",\n        detail: \"CHANGELOG.md has no parseable `## x.y.z` heading\",\n      };\n    }\n\n    if (heading.version !== pkgVersion) {\n      return {\n        name: \"release-hygiene\",\n        status: \"fail\",\n        detail: `package.json ${pkgVersion} ≠ top CHANGELOG heading ${heading.version}`,\n      };\n    }\n\n    return {\n      name: \"release-hygiene\",\n      status: \"ok\",\n      detail: `package.json and CHANGELOG agree on ${pkgVersion}`,\n    };\n  },\n};\n"],"mappings":";;;;;;;;AA4BA,SAAS,gBAAgB,WAAiD;CACxE,MAAM,QAAQ,UAAU,MAAM,kEAAkE;CAEhG,IAAI,CAAC,OACH;CAGF,MAAM,GAAG,OAAO,OAAO,OAAO,QAAQ;CAEtC,OAAO;EACL,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG;EAC9B;CACF;AACF;;;;;;;;;;;;AAaA,SAAS,cAAc,UAAoC;CACzD,OAAO,SAAS,YAAY,QAAQ,OAAO,SAAS,SAAS;AAC/D;;;;;;;;;;;;;;;;;AAkBA,MAAa,sBAAmC;CAC9C,MAAM;CACN,WAAW;EACT,MAAM,kBAAkB,SAAS,cAAc;EAC/C,MAAM,gBAAgB,SAAS,cAAc;EAE7C,MAAM,WAA4B,KAAK,MAAM,aAAa,iBAAiB,MAAM,CAAC;EAElF,IAAI,CAAC,cAAc,QAAQ,GACzB;EAGF,MAAM,aAAa,SAAS;EAE5B,IAAI,OAAO,eAAe,UACxB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ;EACV;EAGF,IAAI,CAAC,WAAW,aAAa,GAC3B,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,oDAAoD,WAAW;EACzE;EAIF,MAAM,UAAU,gBADE,aAAa,eAAe,MACN,CAAC;EAEzC,IAAI,CAAC,SACH,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ;EACV;EAGF,IAAI,QAAQ,YAAY,YACtB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,gBAAgB,WAAW,2BAA2B,QAAQ;EACxE;EAGF,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,uCAAuC;EACjD;CACF;AACF"}
+{"version":3,"file":"release-hygiene.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/release-hygiene.check.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { rootPath } from \"../../../../utils/paths\";\nimport type { DoctorCheck } from \"../check.types\";\n\n/**\n * A `## x.y.z` changelog heading with an optional ` - YYYY-MM-DD` suffix.\n * Mirrors the shape parsed by the tier-0 release-hygiene unit guard; inlined\n * here because that guard lives in the test tree and is not importable from\n * `src`.\n */\ntype ChangelogHeading = {\n  version: string;\n  date?: string;\n};\n\n/**\n * The parts of `package.json` this check reads.\n */\ntype ProjectManifest = {\n  version?: unknown;\n  private?: unknown;\n  name?: unknown;\n};\n\n/**\n * Parse the top-most `## x.y.z[ - YYYY-MM-DD]` heading out of a CHANGELOG body.\n * Returns `undefined` when no version heading is present.\n */\nfunction parseTopHeading(changelog: string): ChangelogHeading | undefined {\n  const match = changelog.match(/^##\\s+(\\d+)\\.(\\d+)\\.(\\d+)(?:\\s*[-–]\\s*(\\d{4}-\\d{2}-\\d{2}))?\\s*$/m);\n\n  if (!match) {\n    return undefined;\n  }\n\n  const [, major, minor, patch, date] = match;\n\n  return {\n    version: `${major}.${minor}.${patch}`,\n    date,\n  };\n}\n\n/**\n * Whether this project is something anyone could `npm publish`.\n *\n * THE GATE, and the reason it exists: a changelog is a promise to the people\n * who install your package. An application has no such people. Running this\n * check on every project projected the framework monorepo's own release\n * practice onto users building an app, who were told — on every single run,\n * forever — that their private application was missing a CHANGELOG.md it had no\n * reason to have. `\"private\": true` is exactly the field npm itself reads to\n * refuse a publish, so it is the honest test of whether the concern applies.\n */\nfunction isPublishable(manifest: ProjectManifest): boolean {\n  return manifest.private !== true && typeof manifest.name === \"string\";\n}\n\n/**\n * Checks that a PUBLISHABLE package's `package.json` version matches the\n * top-most `## x.y.z` heading in `CHANGELOG.md` — the same version↔changelog\n * invariant the release-hygiene unit guard enforces, surfaced as a pre-release\n * doctor check.\n *\n * NEEDS NO BOOTED APP — it reads two files from the project root.\n *\n * Verdicts:\n * - `\"private\": true`, or no package name → not applicable, no line at all;\n * - no `CHANGELOG.md` → `warn` (recommended for a published package, not\n *   mandatory);\n * - no parseable heading → `warn`;\n * - heading version ≠ package.json version → `fail`;\n * - otherwise → `ok`.\n */\nexport const releaseHygieneCheck: DoctorCheck = {\n  name: \"release-hygiene\",\n  run: () => {\n    const packageJsonPath = rootPath(\"package.json\");\n    const changelogPath = rootPath(\"CHANGELOG.md\");\n\n    const manifest: ProjectManifest = JSON.parse(readFileSync(packageJsonPath, \"utf8\"));\n\n    if (!isPublishable(manifest)) {\n      return undefined;\n    }\n\n    const pkgVersion = manifest.version;\n\n    if (typeof pkgVersion !== \"string\") {\n      return {\n        name: \"release-hygiene\",\n        status: \"fail\",\n        code: \"WL9102\",\n        detail: \"package.json is publishable but has no string version field\",\n      };\n    }\n\n    if (!existsSync(changelogPath)) {\n      return {\n        name: \"release-hygiene\",\n        status: \"warn\",\n        code: \"WL9103\",\n        detail: `no CHANGELOG.md at project root (package.json is ${pkgVersion})`,\n      };\n    }\n\n    const changelog = readFileSync(changelogPath, \"utf8\");\n    const heading = parseTopHeading(changelog);\n\n    if (!heading) {\n      return {\n        name: \"release-hygiene\",\n        status: \"warn\",\n        code: \"WL9103\",\n        detail: \"CHANGELOG.md has no parseable `## x.y.z` heading\",\n      };\n    }\n\n    if (heading.version !== pkgVersion) {\n      return {\n        name: \"release-hygiene\",\n        status: \"fail\",\n        code: \"WL9102\",\n        detail: `package.json ${pkgVersion} ≠ top CHANGELOG heading ${heading.version}`,\n      };\n    }\n\n    return {\n      name: \"release-hygiene\",\n      status: \"ok\",\n      detail: `package.json and CHANGELOG agree on ${pkgVersion}`,\n    };\n  },\n};\n"],"mappings":";;;;;;;;AA4BA,SAAS,gBAAgB,WAAiD;CACxE,MAAM,QAAQ,UAAU,MAAM,kEAAkE;CAEhG,IAAI,CAAC,OACH;CAGF,MAAM,GAAG,OAAO,OAAO,OAAO,QAAQ;CAEtC,OAAO;EACL,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG;EAC9B;CACF;AACF;;;;;;;;;;;;AAaA,SAAS,cAAc,UAAoC;CACzD,OAAO,SAAS,YAAY,QAAQ,OAAO,SAAS,SAAS;AAC/D;;;;;;;;;;;;;;;;;AAkBA,MAAa,sBAAmC;CAC9C,MAAM;CACN,WAAW;EACT,MAAM,kBAAkB,SAAS,cAAc;EAC/C,MAAM,gBAAgB,SAAS,cAAc;EAE7C,MAAM,WAA4B,KAAK,MAAM,aAAa,iBAAiB,MAAM,CAAC;EAElF,IAAI,CAAC,cAAc,QAAQ,GACzB;EAGF,MAAM,aAAa,SAAS;EAE5B,IAAI,OAAO,eAAe,UACxB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QAAQ;EACV;EAGF,IAAI,CAAC,WAAW,aAAa,GAC3B,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QAAQ,oDAAoD,WAAW;EACzE;EAIF,MAAM,UAAU,gBADE,aAAa,eAAe,MACN,CAAC;EAEzC,IAAI,CAAC,SACH,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QAAQ;EACV;EAGF,IAAI,QAAQ,YAAY,YACtB,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QAAQ,gBAAgB,WAAW,2BAA2B,QAAQ;EACxE;EAGF,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,uCAAuC;EACjD;CACF;AACF"}

package/esm/cli/commands/doctor/checks/routes.check.mjs

@@ -35,11 +35,13 @@ const routesCheck = {
 		if (context.moduleFailures.length > 0) return {
 			name: "routes",
 			status: "fail",
+			code: "WL2001",
 			detail: `${context.moduleFailures.length} app module(s) failed to load — the routes they declare will 404:\n` + describeFailures(context)
 		};
 		if (!context.booted) return {
 			name: "routes",
 			status: "fail",
+			code: "WL2002",
 			detail: "app modules could not be discovered — nothing to report on"
 		};
 		if (context.totalRoutes === 0) {
@@ -51,6 +53,7 @@ const routesCheck = {
 			return {
 				name: "routes",
 				status: "fail",
+				code: "WL3005",
 				detail: `${context.routeModules} route module(s) loaded without error but registered 0 routes — every request will 404`
 			};
 		}

package/esm/cli/commands/doctor/checks/routes.check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"routes.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/routes.check.ts"],"sourcesContent":["import type { DoctorBootContext, DoctorCheck } from \"../check.types\";\n\n/**\n * Describe the failed modules as an indented block, one per line, cause first.\n * The file that failed is the only thing that makes this actionable, so it is\n * never summarised away.\n */\nfunction describeFailures(context: DoctorBootContext): string {\n  return context.moduleFailures\n    .map((failure) => `  - ${failure.file}: ${failure.message}`)\n    .join(\"\\n\");\n}\n\n/**\n * Reports the route surface the app will actually serve.\n *\n * NEEDS A BOOTED APP — and now gets one. Routes exist only as the side effect of\n * importing the module that declares them, so a doctor that did not import app\n * code reported `0 routes` for an app the dev server served fourteen routes\n * for. The boot pass imports the same modules, in the same order, and boots\n * (never starts) the same connectors, so the number printed here is the number\n * `warlock dev` prints for the same project — the two are read off the same\n * router after the same registrations.\n *\n * Verdicts:\n * - a module failed to import → `fail`, naming every file and its cause. This\n *   is the finding doctor exists for: a route file that throws on import is\n *   invisible at runtime, it just 404s;\n * - route modules on disk but nothing registered → `fail` (they loaded and\n *   registered nothing, which is not a state a working app is in);\n * - no route modules at all → `ok`, stated plainly. A worker or CLI-only app is\n *   a legitimate shape and must not be nagged;\n * - otherwise → `ok` with the count, split into what app code registered and\n *   what connectors added.\n */\nexport const routesCheck: DoctorCheck = {\n  name: \"routes\",\n  run: (context) => {\n    if (context.moduleFailures.length > 0) {\n      const count = context.moduleFailures.length;\n\n      return {\n        name: \"routes\",\n        status: \"fail\",\n        detail:\n          `${count} app module(s) failed to load — the routes they declare will 404:\\n` +\n          describeFailures(context),\n      };\n    }\n\n    if (!context.booted) {\n      return {\n        name: \"routes\",\n        status: \"fail\",\n        detail: \"app modules could not be discovered — nothing to report on\",\n      };\n    }\n\n    if (context.totalRoutes === 0) {\n      if (context.routeModules === 0) {\n        return {\n          name: \"routes\",\n          status: \"ok\",\n          detail: \"no route modules found (src/app/*/routes.ts) — this app serves no HTTP routes\",\n        };\n      }\n\n      return {\n        name: \"routes\",\n        status: \"fail\",\n        detail:\n          `${context.routeModules} route module(s) loaded without error but registered 0 routes — ` +\n          \"every request will 404\",\n      };\n    }\n\n    const fromConnectors = context.totalRoutes - context.appRoutes;\n    const breakdown =\n      fromConnectors > 0\n        ? `${context.appRoutes} from ${context.routeModules} route module(s), ` +\n          `${fromConnectors} from connectors`\n        : `from ${context.routeModules} route module(s)`;\n\n    return {\n      name: \"routes\",\n      status: \"ok\",\n      detail: `${context.totalRoutes} registered (${breakdown})`,\n    };\n  },\n};\n"],"mappings":";;;;;;AAOA,SAAS,iBAAiB,SAAoC;CAC5D,OAAO,QAAQ,eACZ,KAAK,YAAY,OAAO,QAAQ,KAAK,IAAI,QAAQ,SAAS,CAAC,CAC3D,KAAK,IAAI;AACd;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,cAA2B;CACtC,MAAM;CACN,MAAM,YAAY;EAChB,IAAI,QAAQ,eAAe,SAAS,GAGlC,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QACE,GANU,QAAQ,eAAe,OAMxB,uEACT,iBAAiB,OAAO;EAC5B;EAGF,IAAI,CAAC,QAAQ,QACX,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ;EACV;EAGF,IAAI,QAAQ,gBAAgB,GAAG;GAC7B,IAAI,QAAQ,iBAAiB,GAC3B,OAAO;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;GACV;GAGF,OAAO;IACL,MAAM;IACN,QAAQ;IACR,QACE,GAAG,QAAQ,aAAa;GAE5B;EACF;EAEA,MAAM,iBAAiB,QAAQ,cAAc,QAAQ;EACrD,MAAM,YACJ,iBAAiB,IACb,GAAG,QAAQ,UAAU,QAAQ,QAAQ,aAAa,oBAC/C,eAAe,oBAClB,QAAQ,QAAQ,aAAa;EAEnC,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,QAAQ,YAAY,eAAe,UAAU;EAC1D;CACF;AACF"}
+{"version":3,"file":"routes.check.mjs","names":[],"sources":["../../../../../../../../../../../packages/core/src/cli/commands/doctor/checks/routes.check.ts"],"sourcesContent":["import type { DoctorBootContext, DoctorCheck } from \"../check.types\";\n\n/**\n * Describe the failed modules as an indented block, one per line, cause first.\n * The file that failed is the only thing that makes this actionable, so it is\n * never summarised away.\n */\nfunction describeFailures(context: DoctorBootContext): string {\n  return context.moduleFailures\n    .map((failure) => `  - ${failure.file}: ${failure.message}`)\n    .join(\"\\n\");\n}\n\n/**\n * Reports the route surface the app will actually serve.\n *\n * NEEDS A BOOTED APP — and now gets one. Routes exist only as the side effect of\n * importing the module that declares them, so a doctor that did not import app\n * code reported `0 routes` for an app the dev server served fourteen routes\n * for. The boot pass imports the same modules, in the same order, and boots\n * (never starts) the same connectors, so the number printed here is the number\n * `warlock dev` prints for the same project — the two are read off the same\n * router after the same registrations.\n *\n * Verdicts:\n * - a module failed to import → `fail`, naming every file and its cause. This\n *   is the finding doctor exists for: a route file that throws on import is\n *   invisible at runtime, it just 404s;\n * - route modules on disk but nothing registered → `fail` (they loaded and\n *   registered nothing, which is not a state a working app is in);\n * - no route modules at all → `ok`, stated plainly. A worker or CLI-only app is\n *   a legitimate shape and must not be nagged;\n * - otherwise → `ok` with the count, split into what app code registered and\n *   what connectors added.\n */\nexport const routesCheck: DoctorCheck = {\n  name: \"routes\",\n  run: (context) => {\n    if (context.moduleFailures.length > 0) {\n      const count = context.moduleFailures.length;\n\n      return {\n        name: \"routes\",\n        status: \"fail\",\n        code: \"WL2001\",\n        detail:\n          `${count} app module(s) failed to load — the routes they declare will 404:\\n` +\n          describeFailures(context),\n      };\n    }\n\n    if (!context.booted) {\n      return {\n        name: \"routes\",\n        status: \"fail\",\n        code: \"WL2002\",\n        detail: \"app modules could not be discovered — nothing to report on\",\n      };\n    }\n\n    if (context.totalRoutes === 0) {\n      if (context.routeModules === 0) {\n        return {\n          name: \"routes\",\n          status: \"ok\",\n          detail: \"no route modules found (src/app/*/routes.ts) — this app serves no HTTP routes\",\n        };\n      }\n\n      return {\n        name: \"routes\",\n        status: \"fail\",\n        code: \"WL3005\",\n        detail:\n          `${context.routeModules} route module(s) loaded without error but registered 0 routes — ` +\n          \"every request will 404\",\n      };\n    }\n\n    const fromConnectors = context.totalRoutes - context.appRoutes;\n    const breakdown =\n      fromConnectors > 0\n        ? `${context.appRoutes} from ${context.routeModules} route module(s), ` +\n          `${fromConnectors} from connectors`\n        : `from ${context.routeModules} route module(s)`;\n\n    return {\n      name: \"routes\",\n      status: \"ok\",\n      detail: `${context.totalRoutes} registered (${breakdown})`,\n    };\n  },\n};\n"],"mappings":";;;;;;AAOA,SAAS,iBAAiB,SAAoC;CAC5D,OAAO,QAAQ,eACZ,KAAK,YAAY,OAAO,QAAQ,KAAK,IAAI,QAAQ,SAAS,CAAC,CAC3D,KAAK,IAAI;AACd;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,cAA2B;CACtC,MAAM;CACN,MAAM,YAAY;EAChB,IAAI,QAAQ,eAAe,SAAS,GAGlC,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QACE,GAPU,QAAQ,eAAe,OAOxB,uEACT,iBAAiB,OAAO;EAC5B;EAGF,IAAI,CAAC,QAAQ,QACX,OAAO;GACL,MAAM;GACN,QAAQ;GACR,MAAM;GACN,QAAQ;EACV;EAGF,IAAI,QAAQ,gBAAgB,GAAG;GAC7B,IAAI,QAAQ,iBAAiB,GAC3B,OAAO;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;GACV;GAGF,OAAO;IACL,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QACE,GAAG,QAAQ,aAAa;GAE5B;EACF;EAEA,MAAM,iBAAiB,QAAQ,cAAc,QAAQ;EACrD,MAAM,YACJ,iBAAiB,IACb,GAAG,QAAQ,UAAU,QAAQ,QAAQ,aAAa,oBAC/C,eAAe,oBAClB,QAAQ,QAAQ,aAAa;EAEnC,OAAO;GACL,MAAM;GACN,QAAQ;GACR,QAAQ,GAAG,QAAQ,YAAY,eAAe,UAAU;EAC1D;CACF;AACF"}

package/esm/cli/commands/doctor/doctor-command.action.mjs

@@ -1,7 +1,9 @@
 import { bootForDiagnostics } from "./boot-for-diagnostics.mjs";
+import { withConsoleOnStderr } from "../routes/with-console-on-stderr.mjs";
+import { flushAndExit } from "../../flush-and-exit.mjs";
 import { fixLocaleSources } from "./checks/locales-ts-deprecated.check.mjs";
 import { defaultDoctorChecks } from "./checks/index.mjs";
-import { printReport } from "./format-report.mjs";
+import { printReport, toDoctorJson } from "./format-report.mjs";
 import { runChecks } from "./run-checks.mjs";
 
 //#region ../../packages/core/src/cli/commands/doctor/doctor-command.action.ts
@@ -26,16 +28,22 @@ import { runChecks } from "./run-checks.mjs";
 * banner and exits zero — which also disposes of the handles the boot pass
 * left open (a Fastify instance, a Vite dev server for `web` apps).
 *
-* @param data Parsed CLI args, including the optional safe migration flag.
+* With `--json` the report is printed as JSON (see `toDoctorJson`): every
+* finding carries its stable `WL` code, `hint`, `skill` and `docs`.
+*
+* @param data Parsed CLI args: the optional safe migration flag and `--json`.
 */
 async function doctorCommandAction(data) {
+	const json = data.options.json === true;
+	const log = json ? console.error : console.log;
 	if (data.options.fix === true) for (const result of fixLocaleSources()) {
 		const file = result.file.replace(process.cwd(), ".").replaceAll("\\", "/");
-		console.log(`${result.convertible ? "converted" : "manual"} ${file}: ${result.reason}`);
+		log(`${result.convertible ? "converted" : "manual"} ${file}: ${result.reason}`);
 	}
-	const report = await runChecks(defaultDoctorChecks, await bootForDiagnostics());
-	printReport(report);
-	if (report.hasFailures) process.exit(report.exitCode);
+	const report = await runChecks(defaultDoctorChecks, json ? await withConsoleOnStderr(bootForDiagnostics) : await bootForDiagnostics());
+	if (json) console.log(JSON.stringify(toDoctorJson(report), null, 2));
+	else printReport(report);
+	if (report.hasFailures) await flushAndExit(report.exitCode);
 }
 
 //#endregion