workos 0.17.1 → 0.19.0

package/dist/lib/telemetry-notice.js.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry-notice.js","sourceRoot":"","sources":["../../src/lib/telemetry-notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvF,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC;QACH,IAAI,gBAAgB;YAAE,OAAO;QAC7B,IAAI,UAAU,EAAE;YAAE,OAAO,CAAC,mEAAmE;QAC7F,IAAI,mBAAmB,EAAE;YAAE,OAAO,CAAC,wCAAwC;QAC3E,IAAI,aAAa,EAAE;YAAE,OAAO,CAAC,2BAA2B;QAExD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,uDAAuD,MAAM,kBAAkB,CAAC;QACjH,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,gBAAgB,GAAG,IAAI,CAAC;QACxB,eAAe,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,yBAAyB;IACvC,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC","sourcesContent":["/**\n * First-run telemetry notice.\n *\n * Prints a one-time, stderr-only box telling the user that anonymous CLI usage\n * telemetry is being collected and how to turn it off. Shown at most once ever\n * (backed by the persisted `noticeShownAt` timestamp in preferences.json), only\n * in interactive human mode, and never on the machine-readable path.\n *\n * Mirrors the structural pattern of unclaimed-warning.ts: a per-session guard,\n * a `!isJsonMode()` gate, the shared renderStderrBox helper, and a never-throws\n * contract so it can never block command execution. The one structural\n * difference is persistence — this notice writes `noticeShownAt` the first time\n * it actually displays so it never re-shows across runs.\n */\n\nimport chalk from 'chalk';\nimport { isJsonMode } from '../utils/output.js';\nimport { renderStderrBox } from '../utils/box.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { isNoticeShown, markNoticeShown, isTelemetryOptedOut } from './preferences.js';\n\nlet shownThisSession = false;\n\n/**\n * Show the first-run telemetry notice if it has never been displayed.\n *\n * Gate order is load-bearing: every suppression check runs BEFORE\n * markNoticeShown(), so a non-human first run (--json / piped / CI) never\n * consumes the one-time display. The flag is set only when the box is actually\n * rendered, so a real human eventually sees it. Never throws.\n */\nexport function maybeShowTelemetryNotice(): void {\n  try {\n    if (shownThisSession) return;\n    if (isJsonMode()) return; // suppress in --json / non-TTY / CI (output auto-switches to json)\n    if (isTelemetryOptedOut()) return; // already opted out — nothing to inform\n    if (isNoticeShown()) return; // already shown once, ever\n\n    const optOut = chalk.cyan(formatWorkOSCommand('telemetry opt-out'));\n    const inner = ` ${chalk.cyan('ℹ')} WorkOS collects anonymous CLI usage telemetry. Run ${optOut} to disable it. `;\n    renderStderrBox(inner, chalk.cyan);\n    // Set the per-session guard and persist ONLY after a successful render, so a\n    // render failure (caught below) lets a later command in this process retry\n    // rather than silently suppressing the notice for the rest of the session.\n    shownThisSession = true;\n    markNoticeShown();\n  } catch {\n    // Never block command execution.\n  }\n}\n\n/** Reset session state (for testing). */\nexport function resetTelemetryNoticeState(): void {\n  shownThisSession = false;\n}\n"]}
+{"version":3,"file":"telemetry-notice.js","sourceRoot":"","sources":["../../src/lib/telemetry-notice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC;QACH,IAAI,gBAAgB;YAAE,OAAO;QAC7B,IAAI,UAAU,EAAE;YAAE,OAAO,CAAC,mEAAmE;QAC7F,IAAI,mBAAmB,EAAE;YAAE,OAAO,CAAC,wCAAwC;QAC3E,IAAI,aAAa,EAAE;YAAE,OAAO,CAAC,2BAA2B;QAExD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACpE,kBAAkB,CAChB,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,sCAAsC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,EAAE,CAC7G,CAAC;QACF,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,gBAAgB,GAAG,IAAI,CAAC;QACxB,eAAe,EAAE,CAAC;QAClB,6EAA6E;QAC7E,sBAAsB,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,yBAAyB;IACvC,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC","sourcesContent":["/**\n * First-run telemetry notice.\n *\n * Prints a one-time, stderr-only notice telling the user that anonymous CLI\n * usage telemetry is being collected and how to turn it off. Shown at most once\n * ever (backed by the persisted `noticeShownAt` timestamp in preferences.json),\n * only in interactive human mode, and never on the machine-readable path.\n *\n * Mirrors the structural pattern of unclaimed-warning.ts: a per-session guard,\n * a `!isJsonMode()` gate, the shared renderStderrNotice helper, and a never-throws\n * contract so it can never block command execution. The one structural\n * difference is persistence — this notice writes `noticeShownAt` the first time\n * it actually displays so it never re-shows across runs.\n */\n\nimport chalk from 'chalk';\nimport { isJsonMode } from '../utils/output.js';\nimport { renderStderrNotice } from '../utils/box.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\nimport { isNoticeShown, markNoticeShown, isTelemetryOptedOut } from './preferences.js';\nimport { markStartupNoticeShown } from './startup-notice-gate.js';\n\nlet shownThisSession = false;\n\n/**\n * Show the first-run telemetry notice if it has never been displayed.\n *\n * Gate order is load-bearing: every suppression check runs BEFORE\n * markNoticeShown(), so a non-human first run (--json / piped / CI) never\n * consumes the one-time display. The flag is set only when the box is actually\n * rendered, so a real human eventually sees it. Never throws.\n */\nexport function maybeShowTelemetryNotice(): void {\n  try {\n    if (shownThisSession) return;\n    if (isJsonMode()) return; // suppress in --json / non-TTY / CI (output auto-switches to json)\n    if (isTelemetryOptedOut()) return; // already opted out — nothing to inform\n    if (isNoticeShown()) return; // already shown once, ever\n\n    const optOut = chalk.cyan(formatWorkOSCommand('telemetry opt-out'));\n    renderStderrNotice(\n      `${chalk.cyan('ℹ')} ${chalk.dim('Anonymous CLI usage telemetry is on.')} ${chalk.dim('Disable:')} ${optOut}`,\n    );\n    // Set the per-session guard and persist ONLY after a successful render, so a\n    // render failure (caught below) lets a later command in this process retry\n    // rather than silently suppressing the notice for the rest of the session.\n    shownThisSession = true;\n    markNoticeShown();\n    // Claim the one-notice-per-run slot so the lower-priority MCP banner defers.\n    markStartupNoticeShown();\n  } catch {\n    // Never block command execution.\n  }\n}\n\n/** Reset session state (for testing). */\nexport function resetTelemetryNoticeState(): void {\n  shownThisSession = false;\n}\n"]}

package/dist/lib/unclaimed-env-provision.js

@@ -7,11 +7,12 @@
  */
 import chalk from 'chalk';
 import { provisionUnclaimedEnvironment, UnclaimedEnvApiError } from './unclaimed-env-api.js';
-import { getConfig, saveConfig, getActiveEnvironment } from './config-store.js';
+import { getConfig, saveConfig, getActiveEnvironment, freshEnvKey } from './config-store.js';
 import { writeCredentialsEnv } from './env-writer.js';
 import { logInfo, logError } from '../utils/debug.js';
-import { renderStderrBox } from '../utils/box.js';
-import clack from '../utils/clack.js';
+import { renderStderrNotice } from '../utils/box.js';
+import ui from '../utils/ui.js';
+import { formatWorkOSCommand } from '../utils/command-invocation.js';
 /**
  * Try to provision an unclaimed environment. Non-fatal — returns true on success,
  * false on any failure.
@@ -36,27 +37,29 @@ export async function tryProvisionUnclaimedEnv(options) {
             envVars[key] = options.redirectUri;
         }
         writeCredentialsEnv(options.installDir, envVars);
-        // Save to config store (after .env.local succeeds)
+        // Save to config store (after .env.local succeeds). A fresh key so a repeated
+        // provision never clobbers an earlier env's claim token (unrecoverable — it
+        // lives only in this config).
         const config = getConfig() ?? { environments: {} };
-        config.environments['unclaimed'] = {
-            name: 'unclaimed',
+        const key = freshEnvKey(config, 'unclaimed');
+        config.environments[key] = {
+            name: key,
             type: 'unclaimed',
             apiKey: result.apiKey,
             clientId: result.clientId,
             claimToken: result.claimToken,
         };
-        config.activeEnvironment = 'unclaimed';
+        config.activeEnvironment = key;
         saveConfig(config);
         // Verify config persisted — critical for `workos env claim` in a later process
         const readBack = getActiveEnvironment();
         if (!readBack || readBack.type !== 'unclaimed') {
             logError('[unclaimed-env-provision] Config read-back failed after save — claim token may not persist');
-            clack.log.warn('Environment provisioned but config storage may be unreliable. Falling back to login...');
+            ui.log.warn('Environment provisioned but config storage may be unreliable. Falling back to login...');
             return false;
         }
         logInfo('[unclaimed-env-provision] Unclaimed environment provisioned and saved');
-        const inner = ` ✓ ${chalk.green('Environment provisioned')} — Run ${chalk.cyan('workos env claim')} to keep it. `;
-        renderStderrBox(inner, chalk.green);
+        renderStderrNotice(`${chalk.green('✓')} ${chalk.bold('Environment provisioned')} ${chalk.dim('— credentials saved to your project')}`, `${chalk.dim('Run')} ${chalk.bold.cyan(formatWorkOSCommand('env claim'))} ${chalk.dim('to link it to your account.')}`);
         return true;
     }
     catch (error) {
@@ -64,12 +67,12 @@ export async function tryProvisionUnclaimedEnv(options) {
         logError('[unclaimed-env-provision] Failed:', message);
         if (error instanceof UnclaimedEnvApiError) {
             if (error.statusCode === 429) {
-                clack.log.warn('WorkOS is busy, falling back to login...');
+                ui.log.warn('WorkOS is busy, falling back to login...');
             }
         }
         else {
             // Non-API errors (filesystem, keyring) are unexpected — surface to user
-            clack.log.warn(`Could not set up environment: ${message}. Falling back to login...`);
+            ui.log.warn(`Could not set up environment: ${message}. Falling back to login...`);
         }
         return false;
     }

package/dist/lib/unclaimed-env-provision.js.map

@@ -1 +1 @@
-{"version":3,"file":"unclaimed-env-provision.js","sourceRoot":"","sources":["../../src/lib/unclaimed-env-provision.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEhF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,MAAM,mBAAmB,CAAC;AAUtC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAqC;IAClF,IAAI,CAAC;QACH,OAAO,CAAC,yEAAyE,CAAC,CAAC;QAEnF,MAAM,MAAM,GAAG,MAAM,6BAA6B,EAAE,CAAC;QAErD,iFAAiF;QACjF,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,gBAAgB,EAAE,MAAM,CAAC,QAAQ;YACjC,kBAAkB,EAAE,MAAM,CAAC,UAAU;SACtC,CAAC;QAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACrC,CAAC;QAED,mBAAmB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEjD,mDAAmD;QACnD,MAAM,MAAM,GAAc,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG;YACjC,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;QACF,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC;QACvC,UAAU,CAAC,MAAM,CAAC,CAAC;QAEnB,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/C,QAAQ,CAAC,4FAA4F,CAAC,CAAC;YACvG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,uEAAuE,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC;QAClH,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAEpC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,QAAQ,CAAC,mCAAmC,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC7B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,4BAA4B,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Unclaimed environment provisioning helper.\n *\n * Calls the unclaimed env API, saves credentials to config store as type 'unclaimed',\n * and returns whether provisioning succeeded. Non-fatal — wraps everything in\n * try/catch so install flow can fall back to login.\n */\n\nimport chalk from 'chalk';\nimport { provisionUnclaimedEnvironment, UnclaimedEnvApiError } from './unclaimed-env-api.js';\nimport { getConfig, saveConfig, getActiveEnvironment } from './config-store.js';\nimport type { CliConfig } from './config-store.js';\nimport { writeCredentialsEnv } from './env-writer.js';\nimport { logInfo, logError } from '../utils/debug.js';\nimport { renderStderrBox } from '../utils/box.js';\nimport clack from '../utils/clack.js';\n\nexport interface UnclaimedEnvProvisionOptions {\n  installDir: string;\n  /** Redirect URI key name varies by framework */\n  redirectUriKey?: string;\n  /** Redirect URI value */\n  redirectUri?: string;\n}\n\n/**\n * Try to provision an unclaimed environment. Non-fatal — returns true on success,\n * false on any failure.\n *\n * On success:\n * - Saves environment to config store as type 'unclaimed'\n * - Sets it as active environment\n * - Writes credentials (including cookie password and claim token) to .env.local\n */\nexport async function tryProvisionUnclaimedEnv(options: UnclaimedEnvProvisionOptions): Promise<boolean> {\n  try {\n    logInfo('[unclaimed-env-provision] Attempting unclaimed environment provisioning');\n\n    const result = await provisionUnclaimedEnvironment();\n\n    // Write .env.local first — if this fails, config stays clean (no orphan entries)\n    const envVars: Record<string, string> = {\n      WORKOS_API_KEY: result.apiKey,\n      WORKOS_CLIENT_ID: result.clientId,\n      WORKOS_CLAIM_TOKEN: result.claimToken,\n    };\n\n    if (options.redirectUri) {\n      const key = options.redirectUriKey ?? 'WORKOS_REDIRECT_URI';\n      envVars[key] = options.redirectUri;\n    }\n\n    writeCredentialsEnv(options.installDir, envVars);\n\n    // Save to config store (after .env.local succeeds)\n    const config: CliConfig = getConfig() ?? { environments: {} };\n    config.environments['unclaimed'] = {\n      name: 'unclaimed',\n      type: 'unclaimed',\n      apiKey: result.apiKey,\n      clientId: result.clientId,\n      claimToken: result.claimToken,\n    };\n    config.activeEnvironment = 'unclaimed';\n    saveConfig(config);\n\n    // Verify config persisted — critical for `workos env claim` in a later process\n    const readBack = getActiveEnvironment();\n    if (!readBack || readBack.type !== 'unclaimed') {\n      logError('[unclaimed-env-provision] Config read-back failed after save — claim token may not persist');\n      clack.log.warn('Environment provisioned but config storage may be unreliable. Falling back to login...');\n      return false;\n    }\n\n    logInfo('[unclaimed-env-provision] Unclaimed environment provisioned and saved');\n    const inner = ` ✓ ${chalk.green('Environment provisioned')} — Run ${chalk.cyan('workos env claim')} to keep it. `;\n    renderStderrBox(inner, chalk.green);\n\n    return true;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    logError('[unclaimed-env-provision] Failed:', message);\n\n    if (error instanceof UnclaimedEnvApiError) {\n      if (error.statusCode === 429) {\n        clack.log.warn('WorkOS is busy, falling back to login...');\n      }\n    } else {\n      // Non-API errors (filesystem, keyring) are unexpected — surface to user\n      clack.log.warn(`Could not set up environment: ${message}. Falling back to login...`);\n    }\n\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"unclaimed-env-provision.js","sourceRoot":"","sources":["../../src/lib/unclaimed-env-provision.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAUrE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAqC;IAClF,IAAI,CAAC;QACH,OAAO,CAAC,yEAAyE,CAAC,CAAC;QAEnF,MAAM,MAAM,GAAG,MAAM,6BAA6B,EAAE,CAAC;QAErD,iFAAiF;QACjF,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,gBAAgB,EAAE,MAAM,CAAC,QAAQ;YACjC,kBAAkB,EAAE,MAAM,CAAC,UAAU;SACtC,CAAC;QAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACrC,CAAC;QAED,mBAAmB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEjD,8EAA8E;QAC9E,4EAA4E;QAC5E,8BAA8B;QAC9B,MAAM,MAAM,GAAc,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG;YACzB,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;QACF,MAAM,CAAC,iBAAiB,GAAG,GAAG,CAAC;QAC/B,UAAU,CAAC,MAAM,CAAC,CAAC;QAEnB,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/C,QAAQ,CAAC,4FAA4F,CAAC,CAAC;YACvG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;YACtG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,uEAAuE,CAAC,CAAC;QACjF,kBAAkB,CAChB,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE,EAClH,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CACvH,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,QAAQ,CAAC,mCAAmC,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC7B,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,4BAA4B,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Unclaimed environment provisioning helper.\n *\n * Calls the unclaimed env API, saves credentials to config store as type 'unclaimed',\n * and returns whether provisioning succeeded. Non-fatal — wraps everything in\n * try/catch so install flow can fall back to login.\n */\n\nimport chalk from 'chalk';\nimport { provisionUnclaimedEnvironment, UnclaimedEnvApiError } from './unclaimed-env-api.js';\nimport { getConfig, saveConfig, getActiveEnvironment, freshEnvKey } from './config-store.js';\nimport type { CliConfig } from './config-store.js';\nimport { writeCredentialsEnv } from './env-writer.js';\nimport { logInfo, logError } from '../utils/debug.js';\nimport { renderStderrNotice } from '../utils/box.js';\nimport ui from '../utils/ui.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\n\nexport interface UnclaimedEnvProvisionOptions {\n  installDir: string;\n  /** Redirect URI key name varies by framework */\n  redirectUriKey?: string;\n  /** Redirect URI value */\n  redirectUri?: string;\n}\n\n/**\n * Try to provision an unclaimed environment. Non-fatal — returns true on success,\n * false on any failure.\n *\n * On success:\n * - Saves environment to config store as type 'unclaimed'\n * - Sets it as active environment\n * - Writes credentials (including cookie password and claim token) to .env.local\n */\nexport async function tryProvisionUnclaimedEnv(options: UnclaimedEnvProvisionOptions): Promise<boolean> {\n  try {\n    logInfo('[unclaimed-env-provision] Attempting unclaimed environment provisioning');\n\n    const result = await provisionUnclaimedEnvironment();\n\n    // Write .env.local first — if this fails, config stays clean (no orphan entries)\n    const envVars: Record<string, string> = {\n      WORKOS_API_KEY: result.apiKey,\n      WORKOS_CLIENT_ID: result.clientId,\n      WORKOS_CLAIM_TOKEN: result.claimToken,\n    };\n\n    if (options.redirectUri) {\n      const key = options.redirectUriKey ?? 'WORKOS_REDIRECT_URI';\n      envVars[key] = options.redirectUri;\n    }\n\n    writeCredentialsEnv(options.installDir, envVars);\n\n    // Save to config store (after .env.local succeeds). A fresh key so a repeated\n    // provision never clobbers an earlier env's claim token (unrecoverable — it\n    // lives only in this config).\n    const config: CliConfig = getConfig() ?? { environments: {} };\n    const key = freshEnvKey(config, 'unclaimed');\n    config.environments[key] = {\n      name: key,\n      type: 'unclaimed',\n      apiKey: result.apiKey,\n      clientId: result.clientId,\n      claimToken: result.claimToken,\n    };\n    config.activeEnvironment = key;\n    saveConfig(config);\n\n    // Verify config persisted — critical for `workos env claim` in a later process\n    const readBack = getActiveEnvironment();\n    if (!readBack || readBack.type !== 'unclaimed') {\n      logError('[unclaimed-env-provision] Config read-back failed after save — claim token may not persist');\n      ui.log.warn('Environment provisioned but config storage may be unreliable. Falling back to login...');\n      return false;\n    }\n\n    logInfo('[unclaimed-env-provision] Unclaimed environment provisioned and saved');\n    renderStderrNotice(\n      `${chalk.green('✓')} ${chalk.bold('Environment provisioned')} ${chalk.dim('— credentials saved to your project')}`,\n      `${chalk.dim('Run')} ${chalk.bold.cyan(formatWorkOSCommand('env claim'))} ${chalk.dim('to link it to your account.')}`,\n    );\n\n    return true;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error';\n    logError('[unclaimed-env-provision] Failed:', message);\n\n    if (error instanceof UnclaimedEnvApiError) {\n      if (error.statusCode === 429) {\n        ui.log.warn('WorkOS is busy, falling back to login...');\n      }\n    } else {\n      // Non-API errors (filesystem, keyring) are unexpected — surface to user\n      ui.log.warn(`Could not set up environment: ${message}. Falling back to login...`);\n    }\n\n    return false;\n  }\n}\n"]}

package/dist/lib/unclaimed-warning.js

@@ -11,7 +11,10 @@ import { getActiveEnvironment, isUnclaimedEnvironment, markEnvironmentClaimed }
 import { createClaimNonce, UnclaimedEnvApiError } from './unclaimed-env-api.js';
 import { logError, logInfo } from '../utils/debug.js';
 import { isJsonMode } from '../utils/output.js';
-import { renderStderrBox } from '../utils/box.js';
+import { renderStderrNotice } from '../utils/box.js';
+import { pill } from '../utils/ui.js';
+import { markStartupNoticeShown } from './startup-notice-gate.js';
+import { formatWorkOSCommand } from '../utils/command-invocation.js';
 let warningShownThisSession = false;
 let claimCheckDoneThisSession = false;
 /**
@@ -57,8 +60,9 @@ export async function warnIfUnclaimed() {
             return;
         warningShownThisSession = true;
         if (!isJsonMode()) {
-            const inner = ` ${chalk.yellow('⚠ Unclaimed environment')} — Run ${chalk.cyan('workos env claim')} to keep your data. `;
-            renderStderrBox(inner, chalk.yellow);
+            renderStderrNotice(`${pill('WARN', 'warn')}  ${chalk.bold('Unclaimed environment')} ${chalk.dim('— not linked to your account')}`, `${chalk.dim('Run')} ${chalk.bold.cyan(formatWorkOSCommand('env claim'))} ${chalk.dim('to save it — its credentials live only on this machine.')}`);
+            // Claim the one-notice-per-run slot so the lower-priority MCP banner defers.
+            markStartupNoticeShown();
         }
     }
     catch (error) {

package/dist/lib/unclaimed-warning.js.map

@@ -1 +1 @@
-{"version":3,"file":"unclaimed-warning.js","sourceRoot":"","sources":["../../src/lib/unclaimed-warning.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,IAAI,uBAAuB,GAAG,KAAK,CAAC;AACpC,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO;QAEjD,2DAA2D;QAC3D,2EAA2E;QAC3E,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,yBAAyB,GAAG,IAAI,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpE,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC1B,sBAAsB,EAAE,CAAC;oBACzB,OAAO,CAAC,wEAAwE,CAAC,CAAC;oBAClF,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBACtE,yEAAyE;oBACzE,yDAAyD;oBACzD,sBAAsB,EAAE,CAAC;oBACzB,OAAO,CAAC,0DAA0D,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,wEAAwE;gBACxE,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,QAAQ,CAAC,yCAAyC,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvF,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,yCAAyC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9G,CAAC;YACH,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IAAI,uBAAuB;YAAE,OAAO;QACpC,uBAAuB,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC;YACxH,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yDAAyD;QACzD,QAAQ,CAAC,uCAAuC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,0BAA0B;IACxC,uBAAuB,GAAG,KAAK,CAAC;IAChC,yBAAyB,GAAG,KAAK,CAAC;AACpC,CAAC","sourcesContent":["/**\n * Unclaimed environment warning module.\n *\n * Shows a one-line stderr warning when the active environment is unclaimed.\n * On first run, checks if the environment was claimed externally (e.g. via\n * browser) and updates the local config if so.\n * Never throws — all errors are caught to avoid blocking management commands.\n */\n\nimport chalk from 'chalk';\nimport { getActiveEnvironment, isUnclaimedEnvironment, markEnvironmentClaimed } from './config-store.js';\nimport { createClaimNonce, UnclaimedEnvApiError } from './unclaimed-env-api.js';\nimport { logError, logInfo } from '../utils/debug.js';\nimport { isJsonMode } from '../utils/output.js';\nimport { renderStderrBox } from '../utils/box.js';\n\nlet warningShownThisSession = false;\nlet claimCheckDoneThisSession = false;\n\n/**\n * Show a warning if the active environment is unclaimed.\n * Non-blocking — never throws.\n */\nexport async function warnIfUnclaimed(): Promise<void> {\n  try {\n    const env = getActiveEnvironment();\n    if (!env || !isUnclaimedEnvironment(env)) return;\n\n    // Check once per session if the env was claimed externally\n    // claimToken and clientId guaranteed present by UnclaimedEnvironmentConfig\n    if (!claimCheckDoneThisSession) {\n      claimCheckDoneThisSession = true;\n      try {\n        const result = await createClaimNonce(env.clientId, env.claimToken);\n        if (result.alreadyClaimed) {\n          markEnvironmentClaimed();\n          logInfo('[unclaimed-warning] Environment was claimed externally, config updated');\n          return;\n        }\n      } catch (error) {\n        if (error instanceof UnclaimedEnvApiError && error.statusCode === 401) {\n          // 401 likely means the claim token was invalidated after the environment\n          // was claimed. We assume claimed and promote to sandbox.\n          markEnvironmentClaimed();\n          logInfo('[unclaimed-warning] Claim token invalid/expired, removed');\n          return;\n        }\n        // Log non-401 errors for diagnostics, then fall through to show warning\n        if (error instanceof UnclaimedEnvApiError) {\n          logError('[unclaimed-warning] Claim check failed:', error.statusCode, error.message);\n        } else {\n          logError('[unclaimed-warning] Claim check failed:', error instanceof Error ? error.message : String(error));\n        }\n      }\n    }\n\n    // Show warning once per session\n    if (warningShownThisSession) return;\n    warningShownThisSession = true;\n\n    if (!isJsonMode()) {\n      const inner = ` ${chalk.yellow('⚠ Unclaimed environment')} — Run ${chalk.cyan('workos env claim')} to keep your data. `;\n      renderStderrBox(inner, chalk.yellow);\n    }\n  } catch (error) {\n    // Never block command execution, but log for diagnostics\n    logError('[unclaimed-warning] Unexpected error:', error instanceof Error ? error.message : String(error));\n  }\n}\n\n/** Reset session state (for testing) */\nexport function resetUnclaimedWarningState(): void {\n  warningShownThisSession = false;\n  claimCheckDoneThisSession = false;\n}\n"]}
+{"version":3,"file":"unclaimed-warning.js","sourceRoot":"","sources":["../../src/lib/unclaimed-warning.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,IAAI,uBAAuB,GAAG,KAAK,CAAC;AACpC,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO;QAEjD,2DAA2D;QAC3D,2EAA2E;QAC3E,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,yBAAyB,GAAG,IAAI,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpE,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC1B,sBAAsB,EAAE,CAAC;oBACzB,OAAO,CAAC,wEAAwE,CAAC,CAAC;oBAClF,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBACtE,yEAAyE;oBACzE,yDAAyD;oBACzD,sBAAsB,EAAE,CAAC;oBACzB,OAAO,CAAC,0DAA0D,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,wEAAwE;gBACxE,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,QAAQ,CAAC,yCAAyC,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvF,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,yCAAyC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9G,CAAC;YACH,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IAAI,uBAAuB;YAAE,OAAO;QACpC,uBAAuB,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAClB,kBAAkB,CAChB,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,EAC9G,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,yDAAyD,CAAC,EAAE,CACnJ,CAAC;YACF,6EAA6E;YAC7E,sBAAsB,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yDAAyD;QACzD,QAAQ,CAAC,uCAAuC,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,0BAA0B;IACxC,uBAAuB,GAAG,KAAK,CAAC;IAChC,yBAAyB,GAAG,KAAK,CAAC;AACpC,CAAC","sourcesContent":["/**\n * Unclaimed environment warning module.\n *\n * Shows a one-line stderr warning when the active environment is unclaimed.\n * On first run, checks if the environment was claimed externally (e.g. via\n * browser) and updates the local config if so.\n * Never throws — all errors are caught to avoid blocking management commands.\n */\n\nimport chalk from 'chalk';\nimport { getActiveEnvironment, isUnclaimedEnvironment, markEnvironmentClaimed } from './config-store.js';\nimport { createClaimNonce, UnclaimedEnvApiError } from './unclaimed-env-api.js';\nimport { logError, logInfo } from '../utils/debug.js';\nimport { isJsonMode } from '../utils/output.js';\nimport { renderStderrNotice } from '../utils/box.js';\nimport { pill } from '../utils/ui.js';\nimport { markStartupNoticeShown } from './startup-notice-gate.js';\nimport { formatWorkOSCommand } from '../utils/command-invocation.js';\n\nlet warningShownThisSession = false;\nlet claimCheckDoneThisSession = false;\n\n/**\n * Show a warning if the active environment is unclaimed.\n * Non-blocking — never throws.\n */\nexport async function warnIfUnclaimed(): Promise<void> {\n  try {\n    const env = getActiveEnvironment();\n    if (!env || !isUnclaimedEnvironment(env)) return;\n\n    // Check once per session if the env was claimed externally\n    // claimToken and clientId guaranteed present by UnclaimedEnvironmentConfig\n    if (!claimCheckDoneThisSession) {\n      claimCheckDoneThisSession = true;\n      try {\n        const result = await createClaimNonce(env.clientId, env.claimToken);\n        if (result.alreadyClaimed) {\n          markEnvironmentClaimed();\n          logInfo('[unclaimed-warning] Environment was claimed externally, config updated');\n          return;\n        }\n      } catch (error) {\n        if (error instanceof UnclaimedEnvApiError && error.statusCode === 401) {\n          // 401 likely means the claim token was invalidated after the environment\n          // was claimed. We assume claimed and promote to sandbox.\n          markEnvironmentClaimed();\n          logInfo('[unclaimed-warning] Claim token invalid/expired, removed');\n          return;\n        }\n        // Log non-401 errors for diagnostics, then fall through to show warning\n        if (error instanceof UnclaimedEnvApiError) {\n          logError('[unclaimed-warning] Claim check failed:', error.statusCode, error.message);\n        } else {\n          logError('[unclaimed-warning] Claim check failed:', error instanceof Error ? error.message : String(error));\n        }\n      }\n    }\n\n    // Show warning once per session\n    if (warningShownThisSession) return;\n    warningShownThisSession = true;\n\n    if (!isJsonMode()) {\n      renderStderrNotice(\n        `${pill('WARN', 'warn')}  ${chalk.bold('Unclaimed environment')} ${chalk.dim('— not linked to your account')}`,\n        `${chalk.dim('Run')} ${chalk.bold.cyan(formatWorkOSCommand('env claim'))} ${chalk.dim('to save it — its credentials live only on this machine.')}`,\n      );\n      // Claim the one-notice-per-run slot so the lower-priority MCP banner defers.\n      markStartupNoticeShown();\n    }\n  } catch (error) {\n    // Never block command execution, but log for diagnostics\n    logError('[unclaimed-warning] Unexpected error:', error instanceof Error ? error.message : String(error));\n  }\n}\n\n/** Reset session state (for testing) */\nexport function resetUnclaimedWarningState(): void {\n  warningShownThisSession = false;\n  claimCheckDoneThisSession = false;\n}\n"]}

package/dist/lib/validation/security-checks.js

@@ -1,4 +1,5 @@
 import { checkAuthPatterns } from '../../doctor/checks/auth-patterns.js';
+import { formatWorkOSCommand } from '../../utils/command-invocation.js';
 /**
  * The "security subset" of `workos doctor`'s auth-pattern checks that the
  * installer enforces. These are the patterns that are *unsafe* or *leak secrets*
@@ -99,7 +100,7 @@ export function formatBlockingSecurityError(blocking) {
         '',
         ...lines,
         '',
-        'Fix the issues above (or run `workos doctor` for details and remediation) and re-run the installer.',
+        `Fix the issues above (or run \`${formatWorkOSCommand('doctor')}\` for details and remediation) and re-run the installer.`,
     ].join('\n');
 }
 //# sourceMappingURL=security-checks.js.map

package/dist/lib/validation/security-checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-checks.js","sourceRoot":"","sources":["../../../src/lib/validation/security-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAIzE;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAC7C,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;CACpB,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,0BAA0B,GAA2B;IACzD,MAAM,EAAE,SAAS;IACjB,cAAc,EAAE,cAAc;IAC9B,gBAAgB,EAAE,gBAAgB;CACnC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAAmB,EAAE,UAAkB;IACpF,MAAM,SAAS,GAAkB;QAC/B,IAAI,EAAE,0BAA0B,CAAC,WAAW,CAAC,IAAI,IAAI;QACrD,OAAO,EAAE,IAAI;KACd,CAAC;IACF,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,WAAW,GAAoB;QACnC,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,IAAI;QAClB,OAAO,EAAE,IAAI;KACd,CAAC;IACF,MAAM,GAAG,GAAY;QACnB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,YAAY;KACvB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,QAA8B;IACrE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QAChE,IAAI,EAAE,CAAC,CAAC,WAAW;KACpB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAA8B;IAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,OAAO,uDAAuD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAAC;AACtJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAA8B;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,OAAO;QACL,uEAAuE;QACvE,EAAE;QACF,GAAG,KAAK;QACR,EAAE;QACF,qGAAqG;KACtG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC","sourcesContent":["import { checkAuthPatterns } from '../../doctor/checks/auth-patterns.js';\nimport type { AuthPatternFinding, FrameworkInfo, EnvironmentInfo, SdkInfo } from '../../doctor/types.js';\nimport type { ValidationIssue } from './types.js';\n\n/**\n * The \"security subset\" of `workos doctor`'s auth-pattern checks that the\n * installer enforces. These are the patterns that are *unsafe* or *leak secrets*\n * (an unsafe GET sign-out, an API key in client env/source, an ungitignored\n * .env). Completeness checks (missing middleware/callback/provider) are\n * intentionally excluded here — `validateInstallation` already covers those, and\n * they carry higher false-positive risk than we want gating install success.\n *\n * Keep in sync with the codes emitted by `src/doctor/checks/auth-patterns.ts`.\n */\nconst SECURITY_FINDING_CODES = new Set<string>([\n  'SIGNOUT_GET_HANDLER',\n  'SIGNOUT_LINK_PREFETCH',\n  'API_KEY_LEAKED_TO_CLIENT',\n  'API_KEY_IN_SOURCE',\n  'ENV_FILE_NOT_GITIGNORED',\n  'MIXED_ENVIRONMENT',\n]);\n\n/** Map an installer integration id to the framework name doctor's checks expect. */\nconst INTEGRATION_FRAMEWORK_NAME: Record<string, string> = {\n  nextjs: 'Next.js',\n  'react-router': 'React Router',\n  'tanstack-start': 'TanStack Start',\n};\n\nexport interface SecurityCheckResult {\n  /** All security-class findings for this install (errors + warnings). */\n  findings: AuthPatternFinding[];\n  /**\n   * Error-severity findings that must block a successful install. Empty when the\n   * install is secure; a non-empty list means install should not report success.\n   */\n  blocking: AuthPatternFinding[];\n}\n\n/**\n * Run the security subset of doctor's auth-pattern checks against an install\n * directory. Pure file inspection — no network — so it is safe to call both\n * inside the installer's self-correction loop and as the final pre-success gate.\n *\n * This closes the install-validate ↔ doctor gap: previously install could report\n * `success: true` while `workos doctor` immediately found a security hole,\n * because neither the retry loop nor `validateInstallation` ran these checks.\n */\nexport async function runInstallSecurityChecks(integration: string, installDir: string): Promise<SecurityCheckResult> {\n  const framework: FrameworkInfo = {\n    name: INTEGRATION_FRAMEWORK_NAME[integration] ?? null,\n    version: null,\n  };\n  // checkAuthPatterns loads .env files itself; these structs only satisfy the\n  // shape its non-Next.js checks read from.\n  const environment: EnvironmentInfo = {\n    apiKeyConfigured: false,\n    apiKeyType: null,\n    clientId: null,\n    redirectUri: null,\n    cookieDomain: null,\n    baseUrl: null,\n  };\n  const sdk: SdkInfo = {\n    name: null,\n    version: null,\n    latest: null,\n    outdated: false,\n    isAuthKit: false,\n    language: 'javascript',\n  };\n\n  const result = await checkAuthPatterns({ installDir }, framework, environment, sdk);\n  const findings = result.findings.filter((f) => SECURITY_FINDING_CODES.has(f.code));\n  const blocking = findings.filter((f) => f.severity === 'error');\n  return { findings, blocking };\n}\n\n/** Convert security findings into ValidationIssues for the emitter/report surfaces. */\nexport function securityFindingsToIssues(findings: AuthPatternFinding[]): ValidationIssue[] {\n  return findings.map((f) => ({\n    type: 'pattern',\n    severity: f.severity,\n    message: f.filePath ? `${f.message} (${f.filePath})` : f.message,\n    hint: f.remediation,\n  }));\n}\n\n/**\n * Build an agent correction prompt from security findings so the installer's\n * self-correction loop fixes them before declaring success. Returns an empty\n * string when there is nothing to correct.\n */\nexport function formatSecurityFindingsForAgent(findings: AuthPatternFinding[]): string {\n  if (findings.length === 0) return '';\n  const lines = findings.map((f) => {\n    const loc = f.filePath ? ` in ${f.filePath}` : '';\n    const fix = f.remediation ? ` Fix: ${f.remediation}` : '';\n    return `- [${f.severity}] ${f.message}${loc}.${fix}`;\n  });\n  return `Security checks found issues that must be fixed:\\n\\n${lines.join('\\n')}\\n\\nApply the fixes above, then make sure the project still builds.`;\n}\n\n/**\n * Build the error message thrown when error-severity security findings survive\n * the installer's retries — the message that turns a silent insecure \"success\"\n * into a visible failure.\n */\nexport function formatBlockingSecurityError(blocking: AuthPatternFinding[]): string {\n  const lines = blocking.map((f) => {\n    const loc = f.filePath ? ` (${f.filePath})` : '';\n    return `  • ${f.code}: ${f.message}${loc}`;\n  });\n  return [\n    'Installation produced insecure code that could not be auto-corrected:',\n    '',\n    ...lines,\n    '',\n    'Fix the issues above (or run `workos doctor` for details and remediation) and re-run the installer.',\n  ].join('\\n');\n}\n"]}
+{"version":3,"file":"security-checks.js","sourceRoot":"","sources":["../../../src/lib/validation/security-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAGzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAC7C,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;CACpB,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,0BAA0B,GAA2B;IACzD,MAAM,EAAE,SAAS;IACjB,cAAc,EAAE,cAAc;IAC9B,gBAAgB,EAAE,gBAAgB;CACnC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAAmB,EAAE,UAAkB;IACpF,MAAM,SAAS,GAAkB;QAC/B,IAAI,EAAE,0BAA0B,CAAC,WAAW,CAAC,IAAI,IAAI;QACrD,OAAO,EAAE,IAAI;KACd,CAAC;IACF,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,WAAW,GAAoB;QACnC,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,IAAI;QAClB,OAAO,EAAE,IAAI;KACd,CAAC;IACF,MAAM,GAAG,GAAY;QACnB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,YAAY;KACvB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,QAA8B;IACrE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QAChE,IAAI,EAAE,CAAC,CAAC,WAAW;KACpB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAA8B;IAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,OAAO,uDAAuD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAAC;AACtJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAA8B;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,OAAO;QACL,uEAAuE;QACvE,EAAE;QACF,GAAG,KAAK;QACR,EAAE;QACF,kCAAkC,mBAAmB,CAAC,QAAQ,CAAC,2DAA2D;KAC3H,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC","sourcesContent":["import { checkAuthPatterns } from '../../doctor/checks/auth-patterns.js';\nimport type { AuthPatternFinding, FrameworkInfo, EnvironmentInfo, SdkInfo } from '../../doctor/types.js';\nimport type { ValidationIssue } from './types.js';\nimport { formatWorkOSCommand } from '../../utils/command-invocation.js';\n\n/**\n * The \"security subset\" of `workos doctor`'s auth-pattern checks that the\n * installer enforces. These are the patterns that are *unsafe* or *leak secrets*\n * (an unsafe GET sign-out, an API key in client env/source, an ungitignored\n * .env). Completeness checks (missing middleware/callback/provider) are\n * intentionally excluded here — `validateInstallation` already covers those, and\n * they carry higher false-positive risk than we want gating install success.\n *\n * Keep in sync with the codes emitted by `src/doctor/checks/auth-patterns.ts`.\n */\nconst SECURITY_FINDING_CODES = new Set<string>([\n  'SIGNOUT_GET_HANDLER',\n  'SIGNOUT_LINK_PREFETCH',\n  'API_KEY_LEAKED_TO_CLIENT',\n  'API_KEY_IN_SOURCE',\n  'ENV_FILE_NOT_GITIGNORED',\n  'MIXED_ENVIRONMENT',\n]);\n\n/** Map an installer integration id to the framework name doctor's checks expect. */\nconst INTEGRATION_FRAMEWORK_NAME: Record<string, string> = {\n  nextjs: 'Next.js',\n  'react-router': 'React Router',\n  'tanstack-start': 'TanStack Start',\n};\n\nexport interface SecurityCheckResult {\n  /** All security-class findings for this install (errors + warnings). */\n  findings: AuthPatternFinding[];\n  /**\n   * Error-severity findings that must block a successful install. Empty when the\n   * install is secure; a non-empty list means install should not report success.\n   */\n  blocking: AuthPatternFinding[];\n}\n\n/**\n * Run the security subset of doctor's auth-pattern checks against an install\n * directory. Pure file inspection — no network — so it is safe to call both\n * inside the installer's self-correction loop and as the final pre-success gate.\n *\n * This closes the install-validate ↔ doctor gap: previously install could report\n * `success: true` while `workos doctor` immediately found a security hole,\n * because neither the retry loop nor `validateInstallation` ran these checks.\n */\nexport async function runInstallSecurityChecks(integration: string, installDir: string): Promise<SecurityCheckResult> {\n  const framework: FrameworkInfo = {\n    name: INTEGRATION_FRAMEWORK_NAME[integration] ?? null,\n    version: null,\n  };\n  // checkAuthPatterns loads .env files itself; these structs only satisfy the\n  // shape its non-Next.js checks read from.\n  const environment: EnvironmentInfo = {\n    apiKeyConfigured: false,\n    apiKeyType: null,\n    clientId: null,\n    redirectUri: null,\n    cookieDomain: null,\n    baseUrl: null,\n  };\n  const sdk: SdkInfo = {\n    name: null,\n    version: null,\n    latest: null,\n    outdated: false,\n    isAuthKit: false,\n    language: 'javascript',\n  };\n\n  const result = await checkAuthPatterns({ installDir }, framework, environment, sdk);\n  const findings = result.findings.filter((f) => SECURITY_FINDING_CODES.has(f.code));\n  const blocking = findings.filter((f) => f.severity === 'error');\n  return { findings, blocking };\n}\n\n/** Convert security findings into ValidationIssues for the emitter/report surfaces. */\nexport function securityFindingsToIssues(findings: AuthPatternFinding[]): ValidationIssue[] {\n  return findings.map((f) => ({\n    type: 'pattern',\n    severity: f.severity,\n    message: f.filePath ? `${f.message} (${f.filePath})` : f.message,\n    hint: f.remediation,\n  }));\n}\n\n/**\n * Build an agent correction prompt from security findings so the installer's\n * self-correction loop fixes them before declaring success. Returns an empty\n * string when there is nothing to correct.\n */\nexport function formatSecurityFindingsForAgent(findings: AuthPatternFinding[]): string {\n  if (findings.length === 0) return '';\n  const lines = findings.map((f) => {\n    const loc = f.filePath ? ` in ${f.filePath}` : '';\n    const fix = f.remediation ? ` Fix: ${f.remediation}` : '';\n    return `- [${f.severity}] ${f.message}${loc}.${fix}`;\n  });\n  return `Security checks found issues that must be fixed:\\n\\n${lines.join('\\n')}\\n\\nApply the fixes above, then make sure the project still builds.`;\n}\n\n/**\n * Build the error message thrown when error-severity security findings survive\n * the installer's retries — the message that turns a silent insecure \"success\"\n * into a visible failure.\n */\nexport function formatBlockingSecurityError(blocking: AuthPatternFinding[]): string {\n  const lines = blocking.map((f) => {\n    const loc = f.filePath ? ` (${f.filePath})` : '';\n    return `  • ${f.code}: ${f.message}${loc}`;\n  });\n  return [\n    'Installation produced insecure code that could not be auto-corrected:',\n    '',\n    ...lines,\n    '',\n    `Fix the issues above (or run \\`${formatWorkOSCommand('doctor')}\\` for details and remediation) and re-run the installer.`,\n  ].join('\\n');\n}\n"]}

package/dist/lib/validation/validator.js

@@ -3,6 +3,7 @@ import { existsSync } from 'fs';
 import { join } from 'path';
 import fg from 'fast-glob';
 import { runBuildValidation } from './build-validator.js';
+import { detectPort } from '../port-detection.js';
 export async function validateInstallation(framework, projectDir, options = {}) {
     const startTime = Date.now();
     const issues = [];
@@ -213,6 +214,29 @@ export async function validateFrameworkSpecific(framework, projectDir) {
     }
     return issues;
 }
+/**
+ * Compares the redirect URI's effective port to the detected dev server port,
+ * for local dev hosts only, and records an error-severity issue on mismatch.
+ * Skips production URIs and placeholder hosts like http://test.
+ */
+function validateRedirectUriPort(url, framework, projectDir, issues) {
+    // Only enforce for local dev hosts; skip production URIs and placeholder
+    // hosts like http://test. Node parses IPv6 hostnames with brackets: [::1].
+    const localHosts = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+    if (!localHosts.has(url.hostname))
+        return;
+    const effectivePort = url.port || (url.protocol === 'https:' ? '443' : '80');
+    const detected = detectPort(framework, projectDir);
+    if (Number(effectivePort) !== detected) {
+        issues.push({
+            type: 'env',
+            severity: 'error',
+            message: `Redirect URI port :${effectivePort} does not match the detected dev server port :${detected}`,
+            hint: `Update the redirect URI to use port :${detected} in .env.local and the WorkOS dashboard ` +
+                `(redirect URI, CORS origin, homepage URL), or change your dev server to run on port ${effectivePort}.`,
+        });
+    }
+}
 /**
  * Validates that the Next.js redirect URI matches an existing callback route.
  *
@@ -237,6 +261,7 @@ async function validateNextjsRedirectUri(projectDir, issues) {
     try {
         const url = new URL(redirectUri);
         callbackPath = url.pathname;
+        validateRedirectUriPort(url, 'nextjs', projectDir, issues);
     }
     catch {
         issues.push({
@@ -272,7 +297,7 @@ async function validateNextjsRedirectUri(projectDir, issues) {
             const actualPath = '/' + existingRoutes[0].replace(/^(src\/)?app\//, '').replace(/\/route\.(ts|tsx|js|jsx)$/, '');
             hint =
                 `Found callback route at ${existingRoutes[0]} but redirect URI points to ${callbackPath}. Either:\n` +
-                    `  1. Change NEXT_PUBLIC_WORKOS_REDIRECT_URI to http://localhost:3000${actualPath}\n` +
+                    `  1. Change NEXT_PUBLIC_WORKOS_REDIRECT_URI to ${new URL(redirectUri).origin}${actualPath}\n` +
                     `  2. Move the route to app/${routePath}/route.ts`;
         }
         issues.push({
@@ -308,6 +333,7 @@ async function validateReactRouterRedirectUri(projectDir, issues) {
     try {
         const url = new URL(redirectUri);
         callbackPath = url.pathname;
+        validateRedirectUriPort(url, 'react-router', projectDir, issues);
     }
     catch {
         issues.push({
@@ -361,7 +387,7 @@ async function validateReactRouterRedirectUri(projectDir, issues) {
                     .replace(/\./g, '/');
             hint =
                 `Found callback route at ${actualFile} but redirect URI points to ${callbackPath}. Either:\n` +
-                    `  1. Change WORKOS_REDIRECT_URI to http://localhost:3000${actualPath}\n` +
+                    `  1. Change WORKOS_REDIRECT_URI to ${new URL(redirectUri).origin}${actualPath}\n` +
                     `  2. Move the route to app/routes/${dotPath}.tsx`;
         }
         issues.push({
@@ -396,6 +422,7 @@ async function validateTanstackStartRedirectUri(projectDir, issues) {
     try {
         const url = new URL(redirectUri);
         callbackPath = url.pathname;
+        validateRedirectUriPort(url, 'tanstack-start', projectDir, issues);
     }
     catch {
         issues.push({
@@ -433,7 +460,7 @@ async function validateTanstackStartRedirectUri(projectDir, issues) {
                     .replace(/\/index$/, '');
             hint =
                 `Found callback route at ${actualFile} but redirect URI points to ${callbackPath}. Either:\n` +
-                    `  1. Change WORKOS_REDIRECT_URI to http://localhost:3000${actualPath}\n` +
+                    `  1. Change WORKOS_REDIRECT_URI to ${new URL(redirectUri).origin}${actualPath}\n` +
                     `  2. Move the route to app/routes/${routePath}.tsx`;
         }
         issues.push({

package/dist/lib/validation/validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../src/lib/validation/validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,WAAW,CAAC;AAE3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAO1D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,UAAkB,EAClB,UAA2B,EAAE;IAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,mDAAmD;IACnD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,SAAS;YACT,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAEzD,2CAA2C;IAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,yBAAyB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAEzE,kCAAkC;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QACjE,SAAS;QACT,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,SAAiB,EAAE,OAAgB;IAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,SAAS,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;QAErD,mCAAmC;QACnC,IAAI,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO;gBACL,GAAG,KAAK;gBACR,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBACtD,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;gBAC/D,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;aAC7D,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,kCAAkC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAsB,EAAE,UAAkB;IAC/E,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA2B,CAAC;IAChE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAA2B,CAAC;IACtE,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAE7F,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE;gBACxC,IAAI,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAsB,EAAE,UAAkB;IAC9E,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAU,GAAG,EAAE,CAAC;IAEpB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE,uDAAuD;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACjC,wCAAwC;QACxC,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,KAAK,EAAE,GAAG,CAAC,CAAC;YAClD,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU;gBAC1B,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;gBAC7E,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,2BAA2B,CAAC;YAEhD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;gBACvD,OAAO,EAAE,iCAAiC,IAAI,CAAC,IAAI,EAAE;gBACrD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAsB,EAAE,UAAkB;IAC5E,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,iBAAiB,IAAI,CAAC,IAAI,EAAE;gBACrC,IAAI,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;gBACxC,SAAS;YACX,CAAC;YAED,sBAAsB;YACtB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACvC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC/B,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,SAAS;4BACf,QAAQ,EAAE,SAAS;4BACnB,OAAO,EAAE,QAAQ,OAAO,CAAC,CAAC,CAAC,+BAA+B,OAAO,GAAG;4BACpE,IAAI,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE;yBAClD,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+BAA+B;YAC/B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,SAAS;wBACf,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,QAAQ,OAAO,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBAC/E,IAAI,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,iCAAiC;qBAC5D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,SAAiB,EAAE,UAAkB;IACnF,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,8BAA8B;IAC9B,MAAM,yBAAyB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,wBAAwB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEnD,iCAAiC;IACjC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,MAAM,yBAAyB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,iCAAiC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;YACjF,MAAM;QACR,KAAK,OAAO;YACV,MAAM,6BAA6B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,cAAc;YACjB,MAAM,8BAA8B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;YACjF,MAAM;QACR,KAAK,gBAAgB;YACnB,MAAM,gCAAgC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;YACjF,MAAM;IACV,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,MAAyB;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,+CAA+C;IACzD,CAAC;IAED,6BAA6B;IAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,iDAAiD;IAC3D,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,YAAoB,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,yBAAyB,WAAW,EAAE;YAC/C,IAAI,EAAE,qDAAqD;SAC5D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,yCAAyC;IACzC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAElD,uEAAuE;IACvE,MAAM,aAAa,GAAG;QACpB,OAAO,SAAS,WAAW;QAC3B,OAAO,SAAS,YAAY;QAC5B,OAAO,SAAS,WAAW;QAC3B,OAAO,SAAS,YAAY;QAC5B,WAAW,SAAS,WAAW;QAC/B,WAAW,SAAS,YAAY;QAChC,WAAW,SAAS,WAAW;QAC/B,WAAW,SAAS,YAAY;KACjC,CAAC;IAEF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,mDAAmD;QACnD,MAAM,cAAc,GAAG,MAAM,EAAE,CAC7B,CAAC,0CAA0C,EAAE,8CAA8C,CAAC,EAC5F;YACE,GAAG,EAAE,UAAU;SAChB,CACF,CAAC;QAEF,IAAI,IAAI,GAAG,iCAAiC,SAAS,WAAW,CAAC;QACjE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,0DAA0D;YAC1D,MAAM,UAAU,GAAG,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;YAClH,IAAI;gBACF,2BAA2B,cAAc,CAAC,CAAC,CAAC,+BAA+B,YAAY,aAAa;oBACpG,uEAAuE,UAAU,IAAI;oBACrF,8BAA8B,SAAS,WAAW,CAAC;QACvD,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,sBAAsB,YAAY,8BAA8B;YACzE,IAAI;SACL,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,8BAA8B,CAAC,UAAkB,EAAE,MAAyB;IACzF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,YAAoB,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,yBAAyB,WAAW,EAAE;YAC/C,IAAI,EAAE,yCAAyC;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,iEAAiE;IACjE,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE9C,sCAAsC;IACtC,MAAM,aAAa,GAAG;QACpB,oDAAoD;QACpD,cAAc,OAAO,MAAM;QAC3B,cAAc,OAAO,KAAK;QAC1B,cAAc,OAAO,MAAM;QAC3B,cAAc,OAAO,KAAK;QAC1B,sDAAsD;QACtD,cAAc,SAAS,MAAM;QAC7B,cAAc,SAAS,KAAK;QAC5B,cAAc,SAAS,MAAM;QAC7B,cAAc,SAAS,KAAK;QAC5B,kEAAkE;QAClE,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;QAClC,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;QAClC,kEAAkE;QAClE,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;QAClC,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;KACnC,CAAC;IAEF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,CAAC,0CAA0C,CAAC,EAAE;YAC5E,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QAEH,IAAI,IAAI,GAAG,gCAAgC,OAAO,MAAM,CAAC;QACzD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YACrC,qCAAqC;YACrC,MAAM,UAAU,GACd,GAAG;gBACH,UAAU;qBACP,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;qBAC7B,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;qBAC7B,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;qBAC/B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzB,IAAI;gBACF,2BAA2B,UAAU,+BAA+B,YAAY,aAAa;oBAC7F,2DAA2D,UAAU,IAAI;oBACzE,qCAAqC,OAAO,MAAM,CAAC;QACvD,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,sBAAsB,YAAY,8BAA8B;YACzE,IAAI;SACL,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gCAAgC,CAAC,UAAkB,EAAE,MAAyB;IAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,YAAoB,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,yBAAyB,WAAW,EAAE;YAC/C,IAAI,EAAE,yCAAyC;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAElD,gCAAgC;IAChC,MAAM,aAAa,GAAG;QACpB,cAAc,SAAS,MAAM;QAC7B,cAAc,SAAS,KAAK;QAC5B,cAAc,SAAS,MAAM;QAC7B,cAAc,SAAS,KAAK;QAC5B,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;QAClC,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;KACnC,CAAC;IAEF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,CAAC,0CAA0C,CAAC,EAAE;YAC5E,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QAEH,IAAI,IAAI,GAAG,gCAAgC,SAAS,MAAM,CAAC;QAC3D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,UAAU,GACd,GAAG;gBACH,UAAU;qBACP,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;qBAC7B,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;qBAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI;gBACF,2BAA2B,UAAU,+BAA+B,YAAY,aAAa;oBAC7F,2DAA2D,UAAU,IAAI;oBACzE,qCAAqC,SAAS,MAAM,CAAC;QACzD,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,sBAAsB,YAAY,8BAA8B;YACzE,IAAI;SACL,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B,CACzC,UAAkB,EAClB,MAAyB,EACzB,UAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,+CAA+C;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,UAAU,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,iDAAiD;IAC3D,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,GAAG,UAAU,8CAA8C,QAAQ,CAAC,MAAM,GAAG;YACtF,IAAI,EAAE,qDAAqD;SAC5D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,MAAyB;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,8CAA8C;IAC9C,MAAM,cAAc,GAAG,CAAC,wBAAwB,EAAE,oCAAoC,CAAC,CAAC;IAExF,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,4BAA4B,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM;oBACjE,IAAI,EAAE,oFAAoF;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,MAAM,gBAAgB,GAAG,CAAC,0BAA0B,EAAE,sCAAsC,CAAC,CAAC;IAE9F,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,8BAA8B,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM;oBACnE,IAAI,EAAE,yFAAyF;iBAChG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iCAAiC,CAAC,UAAkB,EAAE,MAAyB;IAC5F,sEAAsE;IACtE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3C,MAAM,YAAY,GAAG;QACnB,GAAG,WAAW,eAAe;QAC7B,GAAG,WAAW,eAAe;QAC7B,GAAG,WAAW,UAAU;QACxB,GAAG,WAAW,UAAU;KACzB,CAAC;IAEF,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IAED,gDAAgD;IAChD,MAAM,WAAW,GAAG;QAClB,eAAe;QACf,eAAe;QACf,mBAAmB;QACnB,mBAAmB;QACnB,UAAU;QACV,UAAU;QACV,cAAc;QACd,cAAc;KACf,CAAC;IACF,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzG,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,GAAG,UAAU,uCAAuC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;YACzF,IAAI,EAAE,cAAc,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,0GAA0G;SAC7K,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,wCAAwC;IACxC,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,CAAC,+BAA+B,CAAC,EAAE;QAC5D,GAAG,EAAE,UAAU;QACf,MAAM,EAAE,CAAC,iBAAiB,CAAC;KAC5B,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,6CAA6C,SAAS,CAAC,CAAC,CAAC,EAAE;YACpE,IAAI,EAAE,cAAc,WAAW,oBAAoB,WAAW,sCAAsC;SACrG,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,6BAA6B,CAAC,UAAkB,EAAE,MAAyB;IACxF,qCAAqC;IACrC,MAAM,aAAa,GAAG;QACpB,cAAc;QACd,cAAc;QACd,eAAe;QACf,eAAe;QACf,aAAa;QACb,aAAa;QACb,gBAAgB;QAChB,gBAAgB;KACjB,CAAC;IAEF,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACxC,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,qEAAqE;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACzD,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;gBAC7D,IAAI,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,SAAS;wBACf,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,kDAAkD;wBAC3D,IAAI,EAAE,yHAAyH;qBAChI,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,wBAAwB,CAAC,UAAkB,EAAE,MAAyB;IACnF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAEpD,IAAI,UAAkB,CAAC;IACvB,IAAI,eAAuB,CAAC;IAE5B,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,sCAAsC;IAChD,CAAC;IAED,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,uCAAuC;IACjD,CAAC;IAED,sCAAsC;IACtC,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAuB,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACtD,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAE/C,4CAA4C;IAC5C,MAAM,UAAU,GAAG;QACjB,gBAAgB;QAChB,kBAAkB;QAClB,qBAAqB;QACrB,wBAAwB;QACxB,8BAA8B;QAC9B,iCAAiC;KAClC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,QAAQ,IAAI,UAAU,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,OAAO,8CAA8C;gBACjE,IAAI,EAAE,yFAAyF;aAChG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { readFile } from 'fs/promises';\nimport { existsSync } from 'fs';\nimport { join } from 'path';\nimport fg from 'fast-glob';\nimport type { ValidationResult, ValidationRules, ValidationIssue } from './types.js';\nimport { runBuildValidation } from './build-validator.js';\n\nexport interface ValidateOptions {\n  variant?: string;\n  runBuild?: boolean;\n}\n\nexport async function validateInstallation(\n  framework: string,\n  projectDir: string,\n  options: ValidateOptions = {},\n): Promise<ValidationResult> {\n  const startTime = Date.now();\n  const issues: ValidationIssue[] = [];\n\n  // Load rules for framework (with optional variant)\n  const rules = await loadRules(framework, options.variant);\n  if (!rules) {\n    return {\n      passed: true,\n      framework,\n      issues: [],\n      durationMs: Date.now() - startTime,\n    };\n  }\n\n  // Run validations\n  issues.push(...(await validatePackages(rules, projectDir)));\n  issues.push(...(await validateEnvVars(rules, projectDir)));\n  issues.push(...(await validateFiles(rules, projectDir)));\n\n  // Run framework-specific cross-validations\n  issues.push(...(await validateFrameworkSpecific(framework, projectDir)));\n\n  // Run build validation if enabled\n  if (options.runBuild !== false) {\n    const buildResult = await runBuildValidation(projectDir);\n    issues.push(...buildResult.issues);\n  }\n\n  return {\n    passed: issues.filter((i) => i.severity === 'error').length === 0,\n    framework,\n    issues,\n    durationMs: Date.now() - startTime,\n  };\n}\n\nasync function loadRules(framework: string, variant?: string): Promise<ValidationRules | null> {\n  const rulesPath = new URL(`./rules/${framework}.json`, import.meta.url);\n  try {\n    const content = await readFile(rulesPath, 'utf-8');\n    const rules = JSON.parse(content) as ValidationRules;\n\n    // Merge variant rules if specified\n    if (variant && rules.variants?.[variant]) {\n      const variantRules = rules.variants[variant];\n      return {\n        ...rules,\n        files: [...rules.files, ...(variantRules.files || [])],\n        packages: [...rules.packages, ...(variantRules.packages || [])],\n        envVars: [...rules.envVars, ...(variantRules.envVars || [])],\n      };\n    }\n\n    return rules;\n  } catch {\n    return null; // No rules for this framework yet\n  }\n}\n\nexport async function validatePackages(rules: ValidationRules, projectDir: string): Promise<ValidationIssue[]> {\n  const issues: ValidationIssue[] = [];\n  const pkgPath = join(projectDir, 'package.json');\n  if (!existsSync(pkgPath)) return issues;\n\n  let pkg: Record<string, unknown>;\n  try {\n    pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));\n  } catch {\n    // Malformed package.json - skip package validation\n    return issues;\n  }\n\n  const deps = (pkg.dependencies || {}) as Record<string, string>;\n  const devDeps = (pkg.devDependencies || {}) as Record<string, string>;\n  const allDeps = { ...devDeps, ...deps };\n\n  for (const rule of rules.packages) {\n    const location = rule.location || 'any';\n    const searchIn = location === 'any' ? allDeps : location === 'dependencies' ? deps : devDeps;\n\n    if (!searchIn[rule.name]) {\n      issues.push({\n        type: 'package',\n        severity: 'error',\n        message: `Missing package: ${rule.name}`,\n        hint: `Run: npm install ${rule.name}`,\n      });\n    }\n  }\n\n  return issues;\n}\n\nexport async function validateEnvVars(rules: ValidationRules, projectDir: string): Promise<ValidationIssue[]> {\n  const issues: ValidationIssue[] = [];\n  const envPath = join(projectDir, '.env.local');\n  let envContent = '';\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    if (rules.envVars.length > 0) {\n      issues.push({\n        type: 'env',\n        severity: 'error',\n        message: 'Missing .env.local file',\n        hint: 'Create .env.local with required environment variables',\n      });\n    }\n    return issues;\n  }\n\n  for (const rule of rules.envVars) {\n    // Check primary name and any alternates\n    const varsToCheck = [rule.name, ...(rule.alternates || [])];\n    const found = varsToCheck.some((varName) => {\n      const pattern = new RegExp(`^${varName}=.+`, 'm');\n      return pattern.test(envContent);\n    });\n\n    if (!found) {\n      const hint = rule.alternates\n        ? `Add ${rule.name} (or one of: ${rule.alternates.join(', ')}) to .env.local`\n        : `Add ${rule.name}=your_value to .env.local`;\n\n      issues.push({\n        type: 'env',\n        severity: rule.required === false ? 'warning' : 'error',\n        message: `Missing environment variable: ${rule.name}`,\n        hint,\n      });\n    }\n  }\n\n  return issues;\n}\n\nexport async function validateFiles(rules: ValidationRules, projectDir: string): Promise<ValidationIssue[]> {\n  const issues: ValidationIssue[] = [];\n\n  for (const rule of rules.files) {\n    let matches: string[];\n    try {\n      matches = await fg(rule.path, { cwd: projectDir });\n    } catch {\n      // Invalid glob pattern - skip\n      continue;\n    }\n\n    if (matches.length === 0) {\n      issues.push({\n        type: 'file',\n        severity: 'error',\n        message: `Missing file: ${rule.path}`,\n        hint: `Create ${rule.path}`,\n      });\n      continue;\n    }\n\n    // Check content patterns\n    if (rule.mustContain || rule.mustContainAny) {\n      const filePath = join(projectDir, matches[0]);\n      let content: string;\n      try {\n        content = await readFile(filePath, 'utf-8');\n      } catch {\n        // File read error - skip content checks\n        continue;\n      }\n\n      // All must be present\n      if (rule.mustContain) {\n        for (const pattern of rule.mustContain) {\n          if (!content.includes(pattern)) {\n            issues.push({\n              type: 'pattern',\n              severity: 'warning',\n              message: `File ${matches[0]} missing expected pattern: \"${pattern}\"`,\n              hint: `Ensure ${matches[0]} contains: ${pattern}`,\n            });\n          }\n        }\n      }\n\n      // At least one must be present\n      if (rule.mustContainAny) {\n        const hasAny = rule.mustContainAny.some((p) => content.includes(p));\n        if (!hasAny) {\n          issues.push({\n            type: 'pattern',\n            severity: 'warning',\n            message: `File ${matches[0]} missing one of: ${rule.mustContainAny.join(', ')}`,\n            hint: `Ensure ${matches[0]} contains one of these patterns`,\n          });\n        }\n      }\n    }\n  }\n\n  return issues;\n}\n\n/**\n * Framework-specific cross-validations that require reading multiple sources.\n */\nexport async function validateFrameworkSpecific(framework: string, projectDir: string): Promise<ValidationIssue[]> {\n  const issues: ValidationIssue[] = [];\n\n  // Universal cross-validations\n  await validateCredentialFormats(projectDir, issues);\n  await validateDuplicateEnvVars(projectDir, issues);\n\n  // Framework-specific validations\n  switch (framework) {\n    case 'nextjs':\n      await validateNextjsRedirectUri(projectDir, issues);\n      await validateNextjsMiddlewarePlacement(projectDir, issues);\n      await validateCookiePasswordLength(projectDir, issues, 'WORKOS_COOKIE_PASSWORD');\n      break;\n    case 'react':\n      await validateReactProviderWrapping(projectDir, issues);\n      break;\n    case 'react-router':\n      await validateReactRouterRedirectUri(projectDir, issues);\n      await validateCookiePasswordLength(projectDir, issues, 'WORKOS_COOKIE_PASSWORD');\n      break;\n    case 'tanstack-start':\n      await validateTanstackStartRedirectUri(projectDir, issues);\n      await validateCookiePasswordLength(projectDir, issues, 'WORKOS_COOKIE_PASSWORD');\n      break;\n  }\n\n  return issues;\n}\n\n/**\n * Validates that the Next.js redirect URI matches an existing callback route.\n *\n * Common failure: .env.local has /auth/callback but route is at /api/auth/callback\n */\nasync function validateNextjsRedirectUri(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  const envPath = join(projectDir, '.env.local');\n  let envContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return; // No .env.local - other validators handle this\n  }\n\n  // Extract redirect URI value\n  const match = envContent.match(/^NEXT_PUBLIC_WORKOS_REDIRECT_URI=(.+)$/m);\n  if (!match) {\n    return; // Missing env var - other validators handle this\n  }\n\n  const redirectUri = match[1].trim();\n  let callbackPath: string;\n\n  try {\n    const url = new URL(redirectUri);\n    callbackPath = url.pathname;\n  } catch {\n    issues.push({\n      type: 'env',\n      severity: 'error',\n      message: `Invalid redirect URI: ${redirectUri}`,\n      hint: 'NEXT_PUBLIC_WORKOS_REDIRECT_URI must be a valid URL',\n    });\n    return;\n  }\n\n  // Remove leading slash for path matching\n  const routePath = callbackPath.replace(/^\\//, '');\n\n  // Check if route file exists at expected location (Next.js App Router)\n  const routePatterns = [\n    `app/${routePath}/route.ts`,\n    `app/${routePath}/route.tsx`,\n    `app/${routePath}/route.js`,\n    `app/${routePath}/route.jsx`,\n    `src/app/${routePath}/route.ts`,\n    `src/app/${routePath}/route.tsx`,\n    `src/app/${routePath}/route.js`,\n    `src/app/${routePath}/route.jsx`,\n  ];\n\n  const routeExists = routePatterns.some((pattern) => existsSync(join(projectDir, pattern)));\n\n  if (!routeExists) {\n    // Check what routes DO exist to give a better hint\n    const existingRoutes = await fg(\n      ['app/**/callback/**/route.{ts,tsx,js,jsx}', 'src/app/**/callback/**/route.{ts,tsx,js,jsx}'],\n      {\n        cwd: projectDir,\n      },\n    );\n\n    let hint = `Create a route handler at app/${routePath}/route.ts`;\n    if (existingRoutes.length > 0) {\n      // Found a route at a different path - likely the mismatch\n      const actualPath = '/' + existingRoutes[0].replace(/^(src\\/)?app\\//, '').replace(/\\/route\\.(ts|tsx|js|jsx)$/, '');\n      hint =\n        `Found callback route at ${existingRoutes[0]} but redirect URI points to ${callbackPath}. Either:\\n` +\n        `  1. Change NEXT_PUBLIC_WORKOS_REDIRECT_URI to http://localhost:3000${actualPath}\\n` +\n        `  2. Move the route to app/${routePath}/route.ts`;\n    }\n\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: `Redirect URI path \"${callbackPath}\" has no matching route file`,\n      hint,\n    });\n  }\n}\n\n/**\n * Validates that the React Router redirect URI matches an existing callback route.\n *\n * React Router v7 framework mode uses file-based routing:\n * - /auth/callback → app/routes/auth.callback.tsx (dot notation)\n * - /auth/callback → app/routes/auth/callback.tsx (nested folders)\n */\nasync function validateReactRouterRedirectUri(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  const envPath = join(projectDir, '.env.local');\n  let envContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return;\n  }\n\n  const match = envContent.match(/^WORKOS_REDIRECT_URI=(.+)$/m);\n  if (!match) {\n    return;\n  }\n\n  const redirectUri = match[1].trim();\n  let callbackPath: string;\n\n  try {\n    const url = new URL(redirectUri);\n    callbackPath = url.pathname;\n  } catch {\n    issues.push({\n      type: 'env',\n      severity: 'error',\n      message: `Invalid redirect URI: ${redirectUri}`,\n      hint: 'WORKOS_REDIRECT_URI must be a valid URL',\n    });\n    return;\n  }\n\n  const routePath = callbackPath.replace(/^\\//, '');\n  // React Router uses dot notation: /auth/callback → auth.callback\n  const dotPath = routePath.replace(/\\//g, '.');\n\n  // Check possible route file locations\n  const routePatterns = [\n    // Dot notation (e.g., app/routes/auth.callback.tsx)\n    `app/routes/${dotPath}.tsx`,\n    `app/routes/${dotPath}.ts`,\n    `app/routes/${dotPath}.jsx`,\n    `app/routes/${dotPath}.js`,\n    // Nested folders (e.g., app/routes/auth/callback.tsx)\n    `app/routes/${routePath}.tsx`,\n    `app/routes/${routePath}.ts`,\n    `app/routes/${routePath}.jsx`,\n    `app/routes/${routePath}.js`,\n    // Index file in folder (e.g., app/routes/auth/callback/index.tsx)\n    `app/routes/${routePath}/index.tsx`,\n    `app/routes/${routePath}/index.ts`,\n    `app/routes/${routePath}/index.jsx`,\n    `app/routes/${routePath}/index.js`,\n    // Route file in folder (e.g., app/routes/auth/callback/route.tsx)\n    `app/routes/${routePath}/route.tsx`,\n    `app/routes/${routePath}/route.ts`,\n    `app/routes/${routePath}/route.jsx`,\n    `app/routes/${routePath}/route.js`,\n  ];\n\n  const routeExists = routePatterns.some((pattern) => existsSync(join(projectDir, pattern)));\n\n  if (!routeExists) {\n    const existingRoutes = await fg(['app/routes/**/*callback*.{ts,tsx,js,jsx}'], {\n      cwd: projectDir,\n    });\n\n    let hint = `Create a route at app/routes/${dotPath}.tsx`;\n    if (existingRoutes.length > 0) {\n      const actualFile = existingRoutes[0];\n      // Convert file path back to URL path\n      const actualPath =\n        '/' +\n        actualFile\n          .replace(/^app\\/routes\\//, '')\n          .replace(/\\.(tsx?|jsx?)$/, '')\n          .replace(/\\/(index|route)$/, '')\n          .replace(/\\./g, '/');\n      hint =\n        `Found callback route at ${actualFile} but redirect URI points to ${callbackPath}. Either:\\n` +\n        `  1. Change WORKOS_REDIRECT_URI to http://localhost:3000${actualPath}\\n` +\n        `  2. Move the route to app/routes/${dotPath}.tsx`;\n    }\n\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: `Redirect URI path \"${callbackPath}\" has no matching route file`,\n      hint,\n    });\n  }\n}\n\n/**\n * Validates that the TanStack Start redirect URI matches an existing callback route.\n *\n * TanStack Start uses file-based routing:\n * - /auth/callback → app/routes/auth/callback.tsx\n */\nasync function validateTanstackStartRedirectUri(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  const envPath = join(projectDir, '.env.local');\n  let envContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return;\n  }\n\n  const match = envContent.match(/^WORKOS_REDIRECT_URI=(.+)$/m);\n  if (!match) {\n    return;\n  }\n\n  const redirectUri = match[1].trim();\n  let callbackPath: string;\n\n  try {\n    const url = new URL(redirectUri);\n    callbackPath = url.pathname;\n  } catch {\n    issues.push({\n      type: 'env',\n      severity: 'error',\n      message: `Invalid redirect URI: ${redirectUri}`,\n      hint: 'WORKOS_REDIRECT_URI must be a valid URL',\n    });\n    return;\n  }\n\n  const routePath = callbackPath.replace(/^\\//, '');\n\n  // TanStack Start route patterns\n  const routePatterns = [\n    `app/routes/${routePath}.tsx`,\n    `app/routes/${routePath}.ts`,\n    `app/routes/${routePath}.jsx`,\n    `app/routes/${routePath}.js`,\n    `app/routes/${routePath}/index.tsx`,\n    `app/routes/${routePath}/index.ts`,\n    `app/routes/${routePath}/index.jsx`,\n    `app/routes/${routePath}/index.js`,\n  ];\n\n  const routeExists = routePatterns.some((pattern) => existsSync(join(projectDir, pattern)));\n\n  if (!routeExists) {\n    const existingRoutes = await fg(['app/routes/**/*callback*.{ts,tsx,js,jsx}'], {\n      cwd: projectDir,\n    });\n\n    let hint = `Create a route at app/routes/${routePath}.tsx`;\n    if (existingRoutes.length > 0) {\n      const actualFile = existingRoutes[0];\n      const actualPath =\n        '/' +\n        actualFile\n          .replace(/^app\\/routes\\//, '')\n          .replace(/\\.(tsx?|jsx?)$/, '')\n          .replace(/\\/index$/, '');\n      hint =\n        `Found callback route at ${actualFile} but redirect URI points to ${callbackPath}. Either:\\n` +\n        `  1. Change WORKOS_REDIRECT_URI to http://localhost:3000${actualPath}\\n` +\n        `  2. Move the route to app/routes/${routePath}.tsx`;\n    }\n\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: `Redirect URI path \"${callbackPath}\" has no matching route file`,\n      hint,\n    });\n  }\n}\n\n/**\n * Validates cookie password is at least 32 characters.\n * WorkOS requires this for secure session encryption.\n */\nasync function validateCookiePasswordLength(\n  projectDir: string,\n  issues: ValidationIssue[],\n  envVarName: string,\n): Promise<void> {\n  const envPath = join(projectDir, '.env.local');\n  let envContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return; // No .env.local - other validators handle this\n  }\n\n  const match = envContent.match(new RegExp(`^${envVarName}=(.*)$`, 'm'));\n  if (!match) {\n    return; // Missing env var - other validators handle this\n  }\n\n  const password = match[1].trim();\n  if (password.length < 32) {\n    issues.push({\n      type: 'env',\n      severity: 'error',\n      message: `${envVarName} must be at least 32 characters (currently ${password.length})`,\n      hint: `Generate a secure password: openssl rand -base64 32`,\n    });\n  }\n}\n\n/**\n * Validates credential formats:\n * - API key should start with sk_\n * - Client ID should start with client_\n */\nasync function validateCredentialFormats(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  const envPath = join(projectDir, '.env.local');\n  let envContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return;\n  }\n\n  // Check API key format (any common variation)\n  const apiKeyPatterns = [/^WORKOS_API_KEY=(.*)$/m, /^NEXT_PUBLIC_WORKOS_API_KEY=(.*)$/m];\n\n  for (const pattern of apiKeyPatterns) {\n    const match = envContent.match(pattern);\n    if (match) {\n      const value = match[1].trim();\n      if (value && !value.startsWith('sk_')) {\n        issues.push({\n          type: 'env',\n          severity: 'error',\n          message: `Invalid API key format: \"${value.substring(0, 10)}...\"`,\n          hint: 'WorkOS API keys start with \"sk_\". Check your WorkOS Dashboard for the correct key.',\n        });\n      }\n    }\n  }\n\n  // Check Client ID format\n  const clientIdPatterns = [/^WORKOS_CLIENT_ID=(.*)$/m, /^NEXT_PUBLIC_WORKOS_CLIENT_ID=(.*)$/m];\n\n  for (const pattern of clientIdPatterns) {\n    const match = envContent.match(pattern);\n    if (match) {\n      const value = match[1].trim();\n      if (value && !value.startsWith('client_')) {\n        issues.push({\n          type: 'env',\n          severity: 'error',\n          message: `Invalid Client ID format: \"${value.substring(0, 15)}...\"`,\n          hint: 'WorkOS Client IDs start with \"client_\". Check your WorkOS Dashboard for the correct ID.',\n        });\n      }\n    }\n  }\n}\n\n/**\n * Validates Next.js middleware/proxy is at the correct location.\n * Must be alongside the app/ directory — Next.js only watches for these files\n * in the parent directory of app/.\n */\nasync function validateNextjsMiddlewarePlacement(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  // Determine where app/ lives to know where middleware/proxy should be\n  const appInSrc = existsSync(join(projectDir, 'src', 'app'));\n  const expectedDir = appInSrc ? 'src/' : '';\n\n  const correctPaths = [\n    `${expectedDir}middleware.ts`,\n    `${expectedDir}middleware.js`,\n    `${expectedDir}proxy.ts`,\n    `${expectedDir}proxy.js`,\n  ];\n\n  const hasCorrectPlacement = correctPaths.some((p) => existsSync(join(projectDir, p)));\n  if (hasCorrectPlacement) {\n    return;\n  }\n\n  // Check for middleware/proxy at the wrong level\n  const allPossible = [\n    'middleware.ts',\n    'middleware.js',\n    'src/middleware.ts',\n    'src/middleware.js',\n    'proxy.ts',\n    'proxy.js',\n    'src/proxy.ts',\n    'src/proxy.js',\n  ];\n  const wrongLevel = allPossible.find((p) => existsSync(join(projectDir, p)) && !correctPaths.includes(p));\n\n  if (wrongLevel) {\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: `${wrongLevel} is at the wrong level — app/ is in ${appInSrc ? 'src/' : 'root'}`,\n      hint: `Move it to ${expectedDir}${wrongLevel.replace(/^src\\//, '')} (must be alongside app/ directory). Next.js silently ignores middleware/proxy files at the wrong level.`,\n    });\n    return;\n  }\n\n  // Check for deeply misplaced middleware\n  const misplaced = await fg(['**/{middleware,proxy}.{ts,js}'], {\n    cwd: projectDir,\n    ignore: ['node_modules/**'],\n  });\n\n  if (misplaced.length > 0) {\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: `middleware/proxy found at wrong location: ${misplaced[0]}`,\n      hint: `Must be at ${expectedDir}middleware.ts or ${expectedDir}proxy.ts (alongside app/ directory).`,\n    });\n  }\n}\n\n/**\n * Validates React SPA has AuthKitProvider wrapping the app.\n */\nasync function validateReactProviderWrapping(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  // Common entry points for React apps\n  const entryPatterns = [\n    'src/main.tsx',\n    'src/main.jsx',\n    'src/index.tsx',\n    'src/index.jsx',\n    'src/App.tsx',\n    'src/App.jsx',\n    'app/layout.tsx',\n    'app/layout.jsx',\n  ];\n\n  let foundProvider = false;\n\n  for (const pattern of entryPatterns) {\n    const filePath = join(projectDir, pattern);\n    if (!existsSync(filePath)) continue;\n\n    try {\n      const content = await readFile(filePath, 'utf-8');\n      if (content.includes('AuthKitProvider')) {\n        foundProvider = true;\n        break;\n      }\n    } catch {\n      continue;\n    }\n  }\n\n  if (!foundProvider) {\n    // Check if package is installed (if not, other validators handle it)\n    const pkgPath = join(projectDir, 'package.json');\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));\n        const deps = { ...pkg.dependencies, ...pkg.devDependencies };\n        if (deps['@workos-inc/authkit-react']) {\n          issues.push({\n            type: 'pattern',\n            severity: 'warning',\n            message: 'AuthKitProvider not found in common entry points',\n            hint: 'Wrap your app with <AuthKitProvider> in main.tsx or App.tsx. See: https://workos.com/docs/user-management/react/authkit',\n          });\n        }\n      } catch {\n        // Malformed package.json - skip\n      }\n    }\n  }\n}\n\n/**\n * Detects duplicate env vars between .env and .env.local with different values.\n * This can cause confusing behavior where wrong values are used.\n */\nasync function validateDuplicateEnvVars(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  const envPath = join(projectDir, '.env');\n  const envLocalPath = join(projectDir, '.env.local');\n\n  let envContent: string;\n  let envLocalContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return; // No .env file - no conflict possible\n  }\n\n  try {\n    envLocalContent = await readFile(envLocalPath, 'utf-8');\n  } catch {\n    return; // No .env.local - no conflict possible\n  }\n\n  // Parse env files into key-value maps\n  const parseEnv = (content: string): Map<string, string> => {\n    const map = new Map<string, string>();\n    for (const line of content.split(/\\r?\\n/)) {\n      const match = line.match(/^([A-Z_][A-Z0-9_]*)=(.*)$/);\n      if (match) {\n        map.set(match[1], match[2].trim());\n      }\n    }\n    return map;\n  };\n\n  const envVars = parseEnv(envContent);\n  const envLocalVars = parseEnv(envLocalContent);\n\n  // Check for WorkOS-related vars that differ\n  const workosVars = [\n    'WORKOS_API_KEY',\n    'WORKOS_CLIENT_ID',\n    'WORKOS_REDIRECT_URI',\n    'WORKOS_COOKIE_PASSWORD',\n    'NEXT_PUBLIC_WORKOS_CLIENT_ID',\n    'NEXT_PUBLIC_WORKOS_REDIRECT_URI',\n  ];\n\n  for (const varName of workosVars) {\n    const envValue = envVars.get(varName);\n    const localValue = envLocalVars.get(varName);\n\n    if (envValue && localValue && envValue !== localValue) {\n      issues.push({\n        type: 'env',\n        severity: 'warning',\n        message: `${varName} has different values in .env and .env.local`,\n        hint: `.env.local takes precedence. Remove from .env to avoid confusion, or ensure they match.`,\n      });\n    }\n  }\n}\n"]}
+{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../../src/lib/validation/validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,WAAW,CAAC;AAE3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAOlD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,UAAkB,EAClB,UAA2B,EAAE;IAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,mDAAmD;IACnD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,SAAS;YACT,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACnC,CAAC;IACJ,CAAC;IAED,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAEzD,2CAA2C;IAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,yBAAyB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAEzE,kCAAkC;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QACjE,SAAS;QACT,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,SAAiB,EAAE,OAAgB;IAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,SAAS,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;QAErD,mCAAmC;QACnC,IAAI,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO;gBACL,GAAG,KAAK;gBACR,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBACtD,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;gBAC/D,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;aAC7D,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,kCAAkC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAsB,EAAE,UAAkB;IAC/E,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA2B,CAAC;IAChE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAA2B,CAAC;IACtE,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAE7F,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE;gBACxC,IAAI,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAsB,EAAE,UAAkB;IAC9E,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAU,GAAG,EAAE,CAAC;IAEpB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE,uDAAuD;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACjC,wCAAwC;QACxC,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,KAAK,EAAE,GAAG,CAAC,CAAC;YAClD,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU;gBAC1B,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;gBAC7E,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,2BAA2B,CAAC;YAEhD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;gBACvD,OAAO,EAAE,iCAAiC,IAAI,CAAC,IAAI,EAAE;gBACrD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAsB,EAAE,UAAkB;IAC5E,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,iBAAiB,IAAI,CAAC,IAAI,EAAE;gBACrC,IAAI,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;gBACxC,SAAS;YACX,CAAC;YAED,sBAAsB;YACtB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACvC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC/B,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,SAAS;4BACf,QAAQ,EAAE,SAAS;4BACnB,OAAO,EAAE,QAAQ,OAAO,CAAC,CAAC,CAAC,+BAA+B,OAAO,GAAG;4BACpE,IAAI,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE;yBAClD,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+BAA+B;YAC/B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,SAAS;wBACf,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,QAAQ,OAAO,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBAC/E,IAAI,EAAE,UAAU,OAAO,CAAC,CAAC,CAAC,iCAAiC;qBAC5D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,SAAiB,EAAE,UAAkB;IACnF,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,8BAA8B;IAC9B,MAAM,yBAAyB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,wBAAwB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEnD,iCAAiC;IACjC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,MAAM,yBAAyB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,iCAAiC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;YACjF,MAAM;QACR,KAAK,OAAO;YACV,MAAM,6BAA6B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,cAAc;YACjB,MAAM,8BAA8B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;YACjF,MAAM;QACR,KAAK,gBAAgB;YACnB,MAAM,gCAAgC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;YACjF,MAAM;IACV,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,GAAQ,EAAE,SAAiB,EAAE,UAAkB,EAAE,MAAyB;IACzG,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IAE1C,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAEnD,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,sBAAsB,aAAa,iDAAiD,QAAQ,EAAE;YACvG,IAAI,EACF,wCAAwC,QAAQ,0CAA0C;gBAC1F,uFAAuF,aAAa,GAAG;SAC1G,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,MAAyB;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,+CAA+C;IACzD,CAAC;IAED,6BAA6B;IAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,iDAAiD;IAC3D,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,YAAoB,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC5B,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,yBAAyB,WAAW,EAAE;YAC/C,IAAI,EAAE,qDAAqD;SAC5D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,yCAAyC;IACzC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAElD,uEAAuE;IACvE,MAAM,aAAa,GAAG;QACpB,OAAO,SAAS,WAAW;QAC3B,OAAO,SAAS,YAAY;QAC5B,OAAO,SAAS,WAAW;QAC3B,OAAO,SAAS,YAAY;QAC5B,WAAW,SAAS,WAAW;QAC/B,WAAW,SAAS,YAAY;QAChC,WAAW,SAAS,WAAW;QAC/B,WAAW,SAAS,YAAY;KACjC,CAAC;IAEF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,mDAAmD;QACnD,MAAM,cAAc,GAAG,MAAM,EAAE,CAC7B,CAAC,0CAA0C,EAAE,8CAA8C,CAAC,EAC5F;YACE,GAAG,EAAE,UAAU;SAChB,CACF,CAAC;QAEF,IAAI,IAAI,GAAG,iCAAiC,SAAS,WAAW,CAAC;QACjE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,0DAA0D;YAC1D,MAAM,UAAU,GAAG,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;YAClH,IAAI;gBACF,2BAA2B,cAAc,CAAC,CAAC,CAAC,+BAA+B,YAAY,aAAa;oBACpG,kDAAkD,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,UAAU,IAAI;oBAC9F,8BAA8B,SAAS,WAAW,CAAC;QACvD,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,sBAAsB,YAAY,8BAA8B;YACzE,IAAI;SACL,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,8BAA8B,CAAC,UAAkB,EAAE,MAAyB;IACzF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,YAAoB,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC5B,uBAAuB,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,yBAAyB,WAAW,EAAE;YAC/C,IAAI,EAAE,yCAAyC;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,iEAAiE;IACjE,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE9C,sCAAsC;IACtC,MAAM,aAAa,GAAG;QACpB,oDAAoD;QACpD,cAAc,OAAO,MAAM;QAC3B,cAAc,OAAO,KAAK;QAC1B,cAAc,OAAO,MAAM;QAC3B,cAAc,OAAO,KAAK;QAC1B,sDAAsD;QACtD,cAAc,SAAS,MAAM;QAC7B,cAAc,SAAS,KAAK;QAC5B,cAAc,SAAS,MAAM;QAC7B,cAAc,SAAS,KAAK;QAC5B,kEAAkE;QAClE,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;QAClC,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;QAClC,kEAAkE;QAClE,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;QAClC,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;KACnC,CAAC;IAEF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,CAAC,0CAA0C,CAAC,EAAE;YAC5E,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QAEH,IAAI,IAAI,GAAG,gCAAgC,OAAO,MAAM,CAAC;QACzD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YACrC,qCAAqC;YACrC,MAAM,UAAU,GACd,GAAG;gBACH,UAAU;qBACP,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;qBAC7B,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;qBAC7B,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;qBAC/B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzB,IAAI;gBACF,2BAA2B,UAAU,+BAA+B,YAAY,aAAa;oBAC7F,sCAAsC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,UAAU,IAAI;oBAClF,qCAAqC,OAAO,MAAM,CAAC;QACvD,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,sBAAsB,YAAY,8BAA8B;YACzE,IAAI;SACL,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gCAAgC,CAAC,UAAkB,EAAE,MAAyB;IAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,YAAoB,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC5B,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,yBAAyB,WAAW,EAAE;YAC/C,IAAI,EAAE,yCAAyC;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAElD,gCAAgC;IAChC,MAAM,aAAa,GAAG;QACpB,cAAc,SAAS,MAAM;QAC7B,cAAc,SAAS,KAAK;QAC5B,cAAc,SAAS,MAAM;QAC7B,cAAc,SAAS,KAAK;QAC5B,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;QAClC,cAAc,SAAS,YAAY;QACnC,cAAc,SAAS,WAAW;KACnC,CAAC;IAEF,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAE3F,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,CAAC,0CAA0C,CAAC,EAAE;YAC5E,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;QAEH,IAAI,IAAI,GAAG,gCAAgC,SAAS,MAAM,CAAC;QAC3D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,UAAU,GACd,GAAG;gBACH,UAAU;qBACP,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;qBAC7B,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;qBAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI;gBACF,2BAA2B,UAAU,+BAA+B,YAAY,aAAa;oBAC7F,sCAAsC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,UAAU,IAAI;oBAClF,qCAAqC,SAAS,MAAM,CAAC;QACzD,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,sBAAsB,YAAY,8BAA8B;YACzE,IAAI;SACL,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,4BAA4B,CACzC,UAAkB,EAClB,MAAyB,EACzB,UAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,+CAA+C;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,UAAU,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,iDAAiD;IAC3D,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,GAAG,UAAU,8CAA8C,QAAQ,CAAC,MAAM,GAAG;YACtF,IAAI,EAAE,qDAAqD;SAC5D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,MAAyB;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,8CAA8C;IAC9C,MAAM,cAAc,GAAG,CAAC,wBAAwB,EAAE,oCAAoC,CAAC,CAAC;IAExF,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,4BAA4B,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM;oBACjE,IAAI,EAAE,oFAAoF;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,MAAM,gBAAgB,GAAG,CAAC,0BAA0B,EAAE,sCAAsC,CAAC,CAAC;IAE9F,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,8BAA8B,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM;oBACnE,IAAI,EAAE,yFAAyF;iBAChG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iCAAiC,CAAC,UAAkB,EAAE,MAAyB;IAC5F,sEAAsE;IACtE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3C,MAAM,YAAY,GAAG;QACnB,GAAG,WAAW,eAAe;QAC7B,GAAG,WAAW,eAAe;QAC7B,GAAG,WAAW,UAAU;QACxB,GAAG,WAAW,UAAU;KACzB,CAAC;IAEF,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IAED,gDAAgD;IAChD,MAAM,WAAW,GAAG;QAClB,eAAe;QACf,eAAe;QACf,mBAAmB;QACnB,mBAAmB;QACnB,UAAU;QACV,UAAU;QACV,cAAc;QACd,cAAc;KACf,CAAC;IACF,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzG,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,GAAG,UAAU,uCAAuC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;YACzF,IAAI,EAAE,cAAc,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,0GAA0G;SAC7K,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,wCAAwC;IACxC,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,CAAC,+BAA+B,CAAC,EAAE;QAC5D,GAAG,EAAE,UAAU;QACf,MAAM,EAAE,CAAC,iBAAiB,CAAC;KAC5B,CAAC,CAAC;IAEH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,6CAA6C,SAAS,CAAC,CAAC,CAAC,EAAE;YACpE,IAAI,EAAE,cAAc,WAAW,oBAAoB,WAAW,sCAAsC;SACrG,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,6BAA6B,CAAC,UAAkB,EAAE,MAAyB;IACxF,qCAAqC;IACrC,MAAM,aAAa,GAAG;QACpB,cAAc;QACd,cAAc;QACd,eAAe;QACf,eAAe;QACf,aAAa;QACb,aAAa;QACb,gBAAgB;QAChB,gBAAgB;KACjB,CAAC;IAEF,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACxC,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,qEAAqE;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACzD,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;gBAC7D,IAAI,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,SAAS;wBACf,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,kDAAkD;wBAC3D,IAAI,EAAE,yHAAyH;qBAChI,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,wBAAwB,CAAC,UAAkB,EAAE,MAAyB;IACnF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAEpD,IAAI,UAAkB,CAAC;IACvB,IAAI,eAAuB,CAAC;IAE5B,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,sCAAsC;IAChD,CAAC;IAED,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,uCAAuC;IACjD,CAAC;IAED,sCAAsC;IACtC,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAuB,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACtD,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAE/C,4CAA4C;IAC5C,MAAM,UAAU,GAAG;QACjB,gBAAgB;QAChB,kBAAkB;QAClB,qBAAqB;QACrB,wBAAwB;QACxB,8BAA8B;QAC9B,iCAAiC;KAClC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,QAAQ,IAAI,UAAU,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,OAAO,8CAA8C;gBACjE,IAAI,EAAE,yFAAyF;aAChG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["import { readFile } from 'fs/promises';\nimport { existsSync } from 'fs';\nimport { join } from 'path';\nimport fg from 'fast-glob';\nimport type { ValidationResult, ValidationRules, ValidationIssue } from './types.js';\nimport { runBuildValidation } from './build-validator.js';\nimport { detectPort } from '../port-detection.js';\n\nexport interface ValidateOptions {\n  variant?: string;\n  runBuild?: boolean;\n}\n\nexport async function validateInstallation(\n  framework: string,\n  projectDir: string,\n  options: ValidateOptions = {},\n): Promise<ValidationResult> {\n  const startTime = Date.now();\n  const issues: ValidationIssue[] = [];\n\n  // Load rules for framework (with optional variant)\n  const rules = await loadRules(framework, options.variant);\n  if (!rules) {\n    return {\n      passed: true,\n      framework,\n      issues: [],\n      durationMs: Date.now() - startTime,\n    };\n  }\n\n  // Run validations\n  issues.push(...(await validatePackages(rules, projectDir)));\n  issues.push(...(await validateEnvVars(rules, projectDir)));\n  issues.push(...(await validateFiles(rules, projectDir)));\n\n  // Run framework-specific cross-validations\n  issues.push(...(await validateFrameworkSpecific(framework, projectDir)));\n\n  // Run build validation if enabled\n  if (options.runBuild !== false) {\n    const buildResult = await runBuildValidation(projectDir);\n    issues.push(...buildResult.issues);\n  }\n\n  return {\n    passed: issues.filter((i) => i.severity === 'error').length === 0,\n    framework,\n    issues,\n    durationMs: Date.now() - startTime,\n  };\n}\n\nasync function loadRules(framework: string, variant?: string): Promise<ValidationRules | null> {\n  const rulesPath = new URL(`./rules/${framework}.json`, import.meta.url);\n  try {\n    const content = await readFile(rulesPath, 'utf-8');\n    const rules = JSON.parse(content) as ValidationRules;\n\n    // Merge variant rules if specified\n    if (variant && rules.variants?.[variant]) {\n      const variantRules = rules.variants[variant];\n      return {\n        ...rules,\n        files: [...rules.files, ...(variantRules.files || [])],\n        packages: [...rules.packages, ...(variantRules.packages || [])],\n        envVars: [...rules.envVars, ...(variantRules.envVars || [])],\n      };\n    }\n\n    return rules;\n  } catch {\n    return null; // No rules for this framework yet\n  }\n}\n\nexport async function validatePackages(rules: ValidationRules, projectDir: string): Promise<ValidationIssue[]> {\n  const issues: ValidationIssue[] = [];\n  const pkgPath = join(projectDir, 'package.json');\n  if (!existsSync(pkgPath)) return issues;\n\n  let pkg: Record<string, unknown>;\n  try {\n    pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));\n  } catch {\n    // Malformed package.json - skip package validation\n    return issues;\n  }\n\n  const deps = (pkg.dependencies || {}) as Record<string, string>;\n  const devDeps = (pkg.devDependencies || {}) as Record<string, string>;\n  const allDeps = { ...devDeps, ...deps };\n\n  for (const rule of rules.packages) {\n    const location = rule.location || 'any';\n    const searchIn = location === 'any' ? allDeps : location === 'dependencies' ? deps : devDeps;\n\n    if (!searchIn[rule.name]) {\n      issues.push({\n        type: 'package',\n        severity: 'error',\n        message: `Missing package: ${rule.name}`,\n        hint: `Run: npm install ${rule.name}`,\n      });\n    }\n  }\n\n  return issues;\n}\n\nexport async function validateEnvVars(rules: ValidationRules, projectDir: string): Promise<ValidationIssue[]> {\n  const issues: ValidationIssue[] = [];\n  const envPath = join(projectDir, '.env.local');\n  let envContent = '';\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    if (rules.envVars.length > 0) {\n      issues.push({\n        type: 'env',\n        severity: 'error',\n        message: 'Missing .env.local file',\n        hint: 'Create .env.local with required environment variables',\n      });\n    }\n    return issues;\n  }\n\n  for (const rule of rules.envVars) {\n    // Check primary name and any alternates\n    const varsToCheck = [rule.name, ...(rule.alternates || [])];\n    const found = varsToCheck.some((varName) => {\n      const pattern = new RegExp(`^${varName}=.+`, 'm');\n      return pattern.test(envContent);\n    });\n\n    if (!found) {\n      const hint = rule.alternates\n        ? `Add ${rule.name} (or one of: ${rule.alternates.join(', ')}) to .env.local`\n        : `Add ${rule.name}=your_value to .env.local`;\n\n      issues.push({\n        type: 'env',\n        severity: rule.required === false ? 'warning' : 'error',\n        message: `Missing environment variable: ${rule.name}`,\n        hint,\n      });\n    }\n  }\n\n  return issues;\n}\n\nexport async function validateFiles(rules: ValidationRules, projectDir: string): Promise<ValidationIssue[]> {\n  const issues: ValidationIssue[] = [];\n\n  for (const rule of rules.files) {\n    let matches: string[];\n    try {\n      matches = await fg(rule.path, { cwd: projectDir });\n    } catch {\n      // Invalid glob pattern - skip\n      continue;\n    }\n\n    if (matches.length === 0) {\n      issues.push({\n        type: 'file',\n        severity: 'error',\n        message: `Missing file: ${rule.path}`,\n        hint: `Create ${rule.path}`,\n      });\n      continue;\n    }\n\n    // Check content patterns\n    if (rule.mustContain || rule.mustContainAny) {\n      const filePath = join(projectDir, matches[0]);\n      let content: string;\n      try {\n        content = await readFile(filePath, 'utf-8');\n      } catch {\n        // File read error - skip content checks\n        continue;\n      }\n\n      // All must be present\n      if (rule.mustContain) {\n        for (const pattern of rule.mustContain) {\n          if (!content.includes(pattern)) {\n            issues.push({\n              type: 'pattern',\n              severity: 'warning',\n              message: `File ${matches[0]} missing expected pattern: \"${pattern}\"`,\n              hint: `Ensure ${matches[0]} contains: ${pattern}`,\n            });\n          }\n        }\n      }\n\n      // At least one must be present\n      if (rule.mustContainAny) {\n        const hasAny = rule.mustContainAny.some((p) => content.includes(p));\n        if (!hasAny) {\n          issues.push({\n            type: 'pattern',\n            severity: 'warning',\n            message: `File ${matches[0]} missing one of: ${rule.mustContainAny.join(', ')}`,\n            hint: `Ensure ${matches[0]} contains one of these patterns`,\n          });\n        }\n      }\n    }\n  }\n\n  return issues;\n}\n\n/**\n * Framework-specific cross-validations that require reading multiple sources.\n */\nexport async function validateFrameworkSpecific(framework: string, projectDir: string): Promise<ValidationIssue[]> {\n  const issues: ValidationIssue[] = [];\n\n  // Universal cross-validations\n  await validateCredentialFormats(projectDir, issues);\n  await validateDuplicateEnvVars(projectDir, issues);\n\n  // Framework-specific validations\n  switch (framework) {\n    case 'nextjs':\n      await validateNextjsRedirectUri(projectDir, issues);\n      await validateNextjsMiddlewarePlacement(projectDir, issues);\n      await validateCookiePasswordLength(projectDir, issues, 'WORKOS_COOKIE_PASSWORD');\n      break;\n    case 'react':\n      await validateReactProviderWrapping(projectDir, issues);\n      break;\n    case 'react-router':\n      await validateReactRouterRedirectUri(projectDir, issues);\n      await validateCookiePasswordLength(projectDir, issues, 'WORKOS_COOKIE_PASSWORD');\n      break;\n    case 'tanstack-start':\n      await validateTanstackStartRedirectUri(projectDir, issues);\n      await validateCookiePasswordLength(projectDir, issues, 'WORKOS_COOKIE_PASSWORD');\n      break;\n  }\n\n  return issues;\n}\n\n/**\n * Compares the redirect URI's effective port to the detected dev server port,\n * for local dev hosts only, and records an error-severity issue on mismatch.\n * Skips production URIs and placeholder hosts like http://test.\n */\nfunction validateRedirectUriPort(url: URL, framework: string, projectDir: string, issues: ValidationIssue[]): void {\n  // Only enforce for local dev hosts; skip production URIs and placeholder\n  // hosts like http://test. Node parses IPv6 hostnames with brackets: [::1].\n  const localHosts = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);\n  if (!localHosts.has(url.hostname)) return;\n\n  const effectivePort = url.port || (url.protocol === 'https:' ? '443' : '80');\n  const detected = detectPort(framework, projectDir);\n\n  if (Number(effectivePort) !== detected) {\n    issues.push({\n      type: 'env',\n      severity: 'error',\n      message: `Redirect URI port :${effectivePort} does not match the detected dev server port :${detected}`,\n      hint:\n        `Update the redirect URI to use port :${detected} in .env.local and the WorkOS dashboard ` +\n        `(redirect URI, CORS origin, homepage URL), or change your dev server to run on port ${effectivePort}.`,\n    });\n  }\n}\n\n/**\n * Validates that the Next.js redirect URI matches an existing callback route.\n *\n * Common failure: .env.local has /auth/callback but route is at /api/auth/callback\n */\nasync function validateNextjsRedirectUri(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  const envPath = join(projectDir, '.env.local');\n  let envContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return; // No .env.local - other validators handle this\n  }\n\n  // Extract redirect URI value\n  const match = envContent.match(/^NEXT_PUBLIC_WORKOS_REDIRECT_URI=(.+)$/m);\n  if (!match) {\n    return; // Missing env var - other validators handle this\n  }\n\n  const redirectUri = match[1].trim();\n  let callbackPath: string;\n\n  try {\n    const url = new URL(redirectUri);\n    callbackPath = url.pathname;\n    validateRedirectUriPort(url, 'nextjs', projectDir, issues);\n  } catch {\n    issues.push({\n      type: 'env',\n      severity: 'error',\n      message: `Invalid redirect URI: ${redirectUri}`,\n      hint: 'NEXT_PUBLIC_WORKOS_REDIRECT_URI must be a valid URL',\n    });\n    return;\n  }\n\n  // Remove leading slash for path matching\n  const routePath = callbackPath.replace(/^\\//, '');\n\n  // Check if route file exists at expected location (Next.js App Router)\n  const routePatterns = [\n    `app/${routePath}/route.ts`,\n    `app/${routePath}/route.tsx`,\n    `app/${routePath}/route.js`,\n    `app/${routePath}/route.jsx`,\n    `src/app/${routePath}/route.ts`,\n    `src/app/${routePath}/route.tsx`,\n    `src/app/${routePath}/route.js`,\n    `src/app/${routePath}/route.jsx`,\n  ];\n\n  const routeExists = routePatterns.some((pattern) => existsSync(join(projectDir, pattern)));\n\n  if (!routeExists) {\n    // Check what routes DO exist to give a better hint\n    const existingRoutes = await fg(\n      ['app/**/callback/**/route.{ts,tsx,js,jsx}', 'src/app/**/callback/**/route.{ts,tsx,js,jsx}'],\n      {\n        cwd: projectDir,\n      },\n    );\n\n    let hint = `Create a route handler at app/${routePath}/route.ts`;\n    if (existingRoutes.length > 0) {\n      // Found a route at a different path - likely the mismatch\n      const actualPath = '/' + existingRoutes[0].replace(/^(src\\/)?app\\//, '').replace(/\\/route\\.(ts|tsx|js|jsx)$/, '');\n      hint =\n        `Found callback route at ${existingRoutes[0]} but redirect URI points to ${callbackPath}. Either:\\n` +\n        `  1. Change NEXT_PUBLIC_WORKOS_REDIRECT_URI to ${new URL(redirectUri).origin}${actualPath}\\n` +\n        `  2. Move the route to app/${routePath}/route.ts`;\n    }\n\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: `Redirect URI path \"${callbackPath}\" has no matching route file`,\n      hint,\n    });\n  }\n}\n\n/**\n * Validates that the React Router redirect URI matches an existing callback route.\n *\n * React Router v7 framework mode uses file-based routing:\n * - /auth/callback → app/routes/auth.callback.tsx (dot notation)\n * - /auth/callback → app/routes/auth/callback.tsx (nested folders)\n */\nasync function validateReactRouterRedirectUri(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  const envPath = join(projectDir, '.env.local');\n  let envContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return;\n  }\n\n  const match = envContent.match(/^WORKOS_REDIRECT_URI=(.+)$/m);\n  if (!match) {\n    return;\n  }\n\n  const redirectUri = match[1].trim();\n  let callbackPath: string;\n\n  try {\n    const url = new URL(redirectUri);\n    callbackPath = url.pathname;\n    validateRedirectUriPort(url, 'react-router', projectDir, issues);\n  } catch {\n    issues.push({\n      type: 'env',\n      severity: 'error',\n      message: `Invalid redirect URI: ${redirectUri}`,\n      hint: 'WORKOS_REDIRECT_URI must be a valid URL',\n    });\n    return;\n  }\n\n  const routePath = callbackPath.replace(/^\\//, '');\n  // React Router uses dot notation: /auth/callback → auth.callback\n  const dotPath = routePath.replace(/\\//g, '.');\n\n  // Check possible route file locations\n  const routePatterns = [\n    // Dot notation (e.g., app/routes/auth.callback.tsx)\n    `app/routes/${dotPath}.tsx`,\n    `app/routes/${dotPath}.ts`,\n    `app/routes/${dotPath}.jsx`,\n    `app/routes/${dotPath}.js`,\n    // Nested folders (e.g., app/routes/auth/callback.tsx)\n    `app/routes/${routePath}.tsx`,\n    `app/routes/${routePath}.ts`,\n    `app/routes/${routePath}.jsx`,\n    `app/routes/${routePath}.js`,\n    // Index file in folder (e.g., app/routes/auth/callback/index.tsx)\n    `app/routes/${routePath}/index.tsx`,\n    `app/routes/${routePath}/index.ts`,\n    `app/routes/${routePath}/index.jsx`,\n    `app/routes/${routePath}/index.js`,\n    // Route file in folder (e.g., app/routes/auth/callback/route.tsx)\n    `app/routes/${routePath}/route.tsx`,\n    `app/routes/${routePath}/route.ts`,\n    `app/routes/${routePath}/route.jsx`,\n    `app/routes/${routePath}/route.js`,\n  ];\n\n  const routeExists = routePatterns.some((pattern) => existsSync(join(projectDir, pattern)));\n\n  if (!routeExists) {\n    const existingRoutes = await fg(['app/routes/**/*callback*.{ts,tsx,js,jsx}'], {\n      cwd: projectDir,\n    });\n\n    let hint = `Create a route at app/routes/${dotPath}.tsx`;\n    if (existingRoutes.length > 0) {\n      const actualFile = existingRoutes[0];\n      // Convert file path back to URL path\n      const actualPath =\n        '/' +\n        actualFile\n          .replace(/^app\\/routes\\//, '')\n          .replace(/\\.(tsx?|jsx?)$/, '')\n          .replace(/\\/(index|route)$/, '')\n          .replace(/\\./g, '/');\n      hint =\n        `Found callback route at ${actualFile} but redirect URI points to ${callbackPath}. Either:\\n` +\n        `  1. Change WORKOS_REDIRECT_URI to ${new URL(redirectUri).origin}${actualPath}\\n` +\n        `  2. Move the route to app/routes/${dotPath}.tsx`;\n    }\n\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: `Redirect URI path \"${callbackPath}\" has no matching route file`,\n      hint,\n    });\n  }\n}\n\n/**\n * Validates that the TanStack Start redirect URI matches an existing callback route.\n *\n * TanStack Start uses file-based routing:\n * - /auth/callback → app/routes/auth/callback.tsx\n */\nasync function validateTanstackStartRedirectUri(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  const envPath = join(projectDir, '.env.local');\n  let envContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return;\n  }\n\n  const match = envContent.match(/^WORKOS_REDIRECT_URI=(.+)$/m);\n  if (!match) {\n    return;\n  }\n\n  const redirectUri = match[1].trim();\n  let callbackPath: string;\n\n  try {\n    const url = new URL(redirectUri);\n    callbackPath = url.pathname;\n    validateRedirectUriPort(url, 'tanstack-start', projectDir, issues);\n  } catch {\n    issues.push({\n      type: 'env',\n      severity: 'error',\n      message: `Invalid redirect URI: ${redirectUri}`,\n      hint: 'WORKOS_REDIRECT_URI must be a valid URL',\n    });\n    return;\n  }\n\n  const routePath = callbackPath.replace(/^\\//, '');\n\n  // TanStack Start route patterns\n  const routePatterns = [\n    `app/routes/${routePath}.tsx`,\n    `app/routes/${routePath}.ts`,\n    `app/routes/${routePath}.jsx`,\n    `app/routes/${routePath}.js`,\n    `app/routes/${routePath}/index.tsx`,\n    `app/routes/${routePath}/index.ts`,\n    `app/routes/${routePath}/index.jsx`,\n    `app/routes/${routePath}/index.js`,\n  ];\n\n  const routeExists = routePatterns.some((pattern) => existsSync(join(projectDir, pattern)));\n\n  if (!routeExists) {\n    const existingRoutes = await fg(['app/routes/**/*callback*.{ts,tsx,js,jsx}'], {\n      cwd: projectDir,\n    });\n\n    let hint = `Create a route at app/routes/${routePath}.tsx`;\n    if (existingRoutes.length > 0) {\n      const actualFile = existingRoutes[0];\n      const actualPath =\n        '/' +\n        actualFile\n          .replace(/^app\\/routes\\//, '')\n          .replace(/\\.(tsx?|jsx?)$/, '')\n          .replace(/\\/index$/, '');\n      hint =\n        `Found callback route at ${actualFile} but redirect URI points to ${callbackPath}. Either:\\n` +\n        `  1. Change WORKOS_REDIRECT_URI to ${new URL(redirectUri).origin}${actualPath}\\n` +\n        `  2. Move the route to app/routes/${routePath}.tsx`;\n    }\n\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: `Redirect URI path \"${callbackPath}\" has no matching route file`,\n      hint,\n    });\n  }\n}\n\n/**\n * Validates cookie password is at least 32 characters.\n * WorkOS requires this for secure session encryption.\n */\nasync function validateCookiePasswordLength(\n  projectDir: string,\n  issues: ValidationIssue[],\n  envVarName: string,\n): Promise<void> {\n  const envPath = join(projectDir, '.env.local');\n  let envContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return; // No .env.local - other validators handle this\n  }\n\n  const match = envContent.match(new RegExp(`^${envVarName}=(.*)$`, 'm'));\n  if (!match) {\n    return; // Missing env var - other validators handle this\n  }\n\n  const password = match[1].trim();\n  if (password.length < 32) {\n    issues.push({\n      type: 'env',\n      severity: 'error',\n      message: `${envVarName} must be at least 32 characters (currently ${password.length})`,\n      hint: `Generate a secure password: openssl rand -base64 32`,\n    });\n  }\n}\n\n/**\n * Validates credential formats:\n * - API key should start with sk_\n * - Client ID should start with client_\n */\nasync function validateCredentialFormats(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  const envPath = join(projectDir, '.env.local');\n  let envContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return;\n  }\n\n  // Check API key format (any common variation)\n  const apiKeyPatterns = [/^WORKOS_API_KEY=(.*)$/m, /^NEXT_PUBLIC_WORKOS_API_KEY=(.*)$/m];\n\n  for (const pattern of apiKeyPatterns) {\n    const match = envContent.match(pattern);\n    if (match) {\n      const value = match[1].trim();\n      if (value && !value.startsWith('sk_')) {\n        issues.push({\n          type: 'env',\n          severity: 'error',\n          message: `Invalid API key format: \"${value.substring(0, 10)}...\"`,\n          hint: 'WorkOS API keys start with \"sk_\". Check your WorkOS Dashboard for the correct key.',\n        });\n      }\n    }\n  }\n\n  // Check Client ID format\n  const clientIdPatterns = [/^WORKOS_CLIENT_ID=(.*)$/m, /^NEXT_PUBLIC_WORKOS_CLIENT_ID=(.*)$/m];\n\n  for (const pattern of clientIdPatterns) {\n    const match = envContent.match(pattern);\n    if (match) {\n      const value = match[1].trim();\n      if (value && !value.startsWith('client_')) {\n        issues.push({\n          type: 'env',\n          severity: 'error',\n          message: `Invalid Client ID format: \"${value.substring(0, 15)}...\"`,\n          hint: 'WorkOS Client IDs start with \"client_\". Check your WorkOS Dashboard for the correct ID.',\n        });\n      }\n    }\n  }\n}\n\n/**\n * Validates Next.js middleware/proxy is at the correct location.\n * Must be alongside the app/ directory — Next.js only watches for these files\n * in the parent directory of app/.\n */\nasync function validateNextjsMiddlewarePlacement(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  // Determine where app/ lives to know where middleware/proxy should be\n  const appInSrc = existsSync(join(projectDir, 'src', 'app'));\n  const expectedDir = appInSrc ? 'src/' : '';\n\n  const correctPaths = [\n    `${expectedDir}middleware.ts`,\n    `${expectedDir}middleware.js`,\n    `${expectedDir}proxy.ts`,\n    `${expectedDir}proxy.js`,\n  ];\n\n  const hasCorrectPlacement = correctPaths.some((p) => existsSync(join(projectDir, p)));\n  if (hasCorrectPlacement) {\n    return;\n  }\n\n  // Check for middleware/proxy at the wrong level\n  const allPossible = [\n    'middleware.ts',\n    'middleware.js',\n    'src/middleware.ts',\n    'src/middleware.js',\n    'proxy.ts',\n    'proxy.js',\n    'src/proxy.ts',\n    'src/proxy.js',\n  ];\n  const wrongLevel = allPossible.find((p) => existsSync(join(projectDir, p)) && !correctPaths.includes(p));\n\n  if (wrongLevel) {\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: `${wrongLevel} is at the wrong level — app/ is in ${appInSrc ? 'src/' : 'root'}`,\n      hint: `Move it to ${expectedDir}${wrongLevel.replace(/^src\\//, '')} (must be alongside app/ directory). Next.js silently ignores middleware/proxy files at the wrong level.`,\n    });\n    return;\n  }\n\n  // Check for deeply misplaced middleware\n  const misplaced = await fg(['**/{middleware,proxy}.{ts,js}'], {\n    cwd: projectDir,\n    ignore: ['node_modules/**'],\n  });\n\n  if (misplaced.length > 0) {\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: `middleware/proxy found at wrong location: ${misplaced[0]}`,\n      hint: `Must be at ${expectedDir}middleware.ts or ${expectedDir}proxy.ts (alongside app/ directory).`,\n    });\n  }\n}\n\n/**\n * Validates React SPA has AuthKitProvider wrapping the app.\n */\nasync function validateReactProviderWrapping(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  // Common entry points for React apps\n  const entryPatterns = [\n    'src/main.tsx',\n    'src/main.jsx',\n    'src/index.tsx',\n    'src/index.jsx',\n    'src/App.tsx',\n    'src/App.jsx',\n    'app/layout.tsx',\n    'app/layout.jsx',\n  ];\n\n  let foundProvider = false;\n\n  for (const pattern of entryPatterns) {\n    const filePath = join(projectDir, pattern);\n    if (!existsSync(filePath)) continue;\n\n    try {\n      const content = await readFile(filePath, 'utf-8');\n      if (content.includes('AuthKitProvider')) {\n        foundProvider = true;\n        break;\n      }\n    } catch {\n      continue;\n    }\n  }\n\n  if (!foundProvider) {\n    // Check if package is installed (if not, other validators handle it)\n    const pkgPath = join(projectDir, 'package.json');\n    if (existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));\n        const deps = { ...pkg.dependencies, ...pkg.devDependencies };\n        if (deps['@workos-inc/authkit-react']) {\n          issues.push({\n            type: 'pattern',\n            severity: 'warning',\n            message: 'AuthKitProvider not found in common entry points',\n            hint: 'Wrap your app with <AuthKitProvider> in main.tsx or App.tsx. See: https://workos.com/docs/user-management/react/authkit',\n          });\n        }\n      } catch {\n        // Malformed package.json - skip\n      }\n    }\n  }\n}\n\n/**\n * Detects duplicate env vars between .env and .env.local with different values.\n * This can cause confusing behavior where wrong values are used.\n */\nasync function validateDuplicateEnvVars(projectDir: string, issues: ValidationIssue[]): Promise<void> {\n  const envPath = join(projectDir, '.env');\n  const envLocalPath = join(projectDir, '.env.local');\n\n  let envContent: string;\n  let envLocalContent: string;\n\n  try {\n    envContent = await readFile(envPath, 'utf-8');\n  } catch {\n    return; // No .env file - no conflict possible\n  }\n\n  try {\n    envLocalContent = await readFile(envLocalPath, 'utf-8');\n  } catch {\n    return; // No .env.local - no conflict possible\n  }\n\n  // Parse env files into key-value maps\n  const parseEnv = (content: string): Map<string, string> => {\n    const map = new Map<string, string>();\n    for (const line of content.split(/\\r?\\n/)) {\n      const match = line.match(/^([A-Z_][A-Z0-9_]*)=(.*)$/);\n      if (match) {\n        map.set(match[1], match[2].trim());\n      }\n    }\n    return map;\n  };\n\n  const envVars = parseEnv(envContent);\n  const envLocalVars = parseEnv(envLocalContent);\n\n  // Check for WorkOS-related vars that differ\n  const workosVars = [\n    'WORKOS_API_KEY',\n    'WORKOS_CLIENT_ID',\n    'WORKOS_REDIRECT_URI',\n    'WORKOS_COOKIE_PASSWORD',\n    'NEXT_PUBLIC_WORKOS_CLIENT_ID',\n    'NEXT_PUBLIC_WORKOS_REDIRECT_URI',\n  ];\n\n  for (const varName of workosVars) {\n    const envValue = envVars.get(varName);\n    const localValue = envLocalVars.get(varName);\n\n    if (envValue && localValue && envValue !== localValue) {\n      issues.push({\n        type: 'env',\n        severity: 'warning',\n        message: `${varName} has different values in .env and .env.local`,\n        hint: `.env.local takes precedence. Remove from .env to avoid confusion, or ensure they match.`,\n      });\n    }\n  }\n}\n"]}