workos 0.18.0 → 0.20.1

package/dist/lib/validation/quick-checks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"quick-checks.js","sourceRoot":"","sources":["../../../src/lib/validation/quick-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAC5C,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,OAAqD;IAErD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,IAAI,4BAA4B,CAAC,CAAC;IACrH,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE9B,IAAI,eAAe,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,IAAI,wBAAwB,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE9C,OAAO;QACL,MAAM;QACN,OAAO;QACP,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC;QACzD,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAgC,EAAE,SAAiB;IACrE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;AACpG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,YAAoB,4BAA4B;IAEhD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAE9D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CACrD,YAAY,CAAC,OAAO,EACpB,YAAY,CAAC,IAAI,EACjB,UAAU,EACV,SAAS,CACV,CAAC;IAEF,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAsB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,eAAe,KAAK,EAAE;QAC/B,IAAI,EAAE,4CAA4C;KACnD,CAAC,CAAC,CAAC;IAEJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,kBAAkB;YAC3B,IAAI,EAAE,SAAS,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB;SAC1F,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,WAAW;QAClB,MAAM;QACN,WAAW,EAAE,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC;QAClD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,UAAkB,EAAE,SAAiB;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAEtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAEhH,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,gBAAgB,CAAC,EAAE;YAC5B,IAAI,EAAE,mCAAmC;SAC1C,CAAC,CAAC;QACL,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,SAAS,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB;aAClF;SACF,CAAC;IAER,OAAO;QACL,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,OAAO;QACd,MAAM;QACN,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACtC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC;AAOD,KAAK,UAAU,sBAAsB,CAAC,UAAkB;IACtD,MAAM,EAAE,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAyC,CAAC;QAExE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5G,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,+BAA+B;IAC/B,6CAA6C;IAC7C,6DAA6D;IAC7D,MAAM,OAAO,GAAG,kEAAkE,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAgB,EAAE,SAAiB;IAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,mDAAmD;QACnD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,gDAAgD,SAAS,sCAAsC,CAAC;IACzG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,+CAA+C;QAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAEvD,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;YACzB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,OAAO,6BAA6B,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD,CAAC;AACtK,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyB;IAClD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,OAAO,wBAAwB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC;AACvF,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAY,CAAC;SAC1B,IAAI,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,gBAAwB;IACxE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CACnB,OAAe,EACf,IAAc,EACd,GAAW,EACX,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YAChC,GAAG;YACH,OAAO,EAAE,SAAS;YAClB,GAAG,UAAU;SACd,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACvC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACvC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { spawn } from 'child_process';\nimport { readFile } from 'fs/promises';\nimport { join } from 'path';\nimport type { QuickCheckResult, QuickChecksOutput, ValidationIssue } from './types.js';\nimport { detectBuildCommand, detectPackageManager, parseBuildErrors } from './build-validator.js';\nimport { SPAWN_OPTS } from '../../utils/platform.js';\n\nconst DEFAULT_TYPECHECK_TIMEOUT_MS = 30_000;\nconst DEFAULT_BUILD_TIMEOUT_MS = 60_000;\n\n/**\n * Run fast deterministic checks: typecheck first, then build.\n * Short-circuits: if typecheck fails, skip build (build will fail too).\n */\nexport async function runQuickChecks(\n  projectDir: string,\n  options?: { skipBuild?: boolean; timeoutMs?: number },\n): Promise<QuickChecksOutput> {\n  const startTime = Date.now();\n  const results: QuickCheckResult[] = [];\n\n  const typecheckResult = await runTypecheckValidation(projectDir, options?.timeoutMs ?? DEFAULT_TYPECHECK_TIMEOUT_MS);\n  results.push(typecheckResult);\n\n  if (typecheckResult.passed && !options?.skipBuild) {\n    results.push(await runBuildQuickCheck(projectDir, options?.timeoutMs ?? DEFAULT_BUILD_TIMEOUT_MS));\n  }\n\n  const passed = results.every((r) => r.passed);\n\n  return {\n    passed,\n    results,\n    agentRetryPrompt: passed ? null : formatForAgent(results),\n    totalDurationMs: Date.now() - startTime,\n  };\n}\n\nfunction passResult(phase: QuickCheckResult['phase'], startTime: number): QuickCheckResult {\n  return { passed: true, phase, issues: [], agentPrompt: null, durationMs: Date.now() - startTime };\n}\n\n/**\n * Run typecheck only (tsc --noEmit or framework equivalent).\n * Faster than full build — catches type errors in ~5s.\n */\nexport async function runTypecheckValidation(\n  projectDir: string,\n  timeoutMs: number = DEFAULT_TYPECHECK_TIMEOUT_MS,\n): Promise<QuickCheckResult> {\n  const startTime = Date.now();\n  const typecheckCmd = await detectTypecheckCommand(projectDir);\n\n  if (!typecheckCmd) {\n    return passResult('typecheck', startTime);\n  }\n\n  const { exitCode, stdout, stderr } = await spawnCommand(\n    typecheckCmd.command,\n    typecheckCmd.args,\n    projectDir,\n    timeoutMs,\n  );\n\n  if (exitCode === 0) {\n    return passResult('typecheck', startTime);\n  }\n\n  const output = stdout + stderr;\n  const errors = parseTypecheckErrors(output);\n  const issues: ValidationIssue[] = errors.map((error) => ({\n    type: 'file',\n    severity: 'error',\n    message: `Type error: ${error}`,\n    hint: 'Fix the type error and run typecheck again',\n  }));\n\n  if (issues.length === 0) {\n    issues.push({\n      type: 'file',\n      severity: 'error',\n      message: 'Typecheck failed',\n      hint: `Run \\`${typecheckCmd.command} ${typecheckCmd.args.join(' ')}\\` to see full output`,\n    });\n  }\n\n  return {\n    passed: false,\n    phase: 'typecheck',\n    issues,\n    agentPrompt: formatTypecheckErrors(errors, output),\n    durationMs: Date.now() - startTime,\n  };\n}\n\nasync function runBuildQuickCheck(projectDir: string, timeoutMs: number): Promise<QuickCheckResult> {\n  const startTime = Date.now();\n  const buildCmd = await detectBuildCommand(projectDir);\n\n  if (!buildCmd) {\n    return passResult('build', startTime);\n  }\n\n  const { exitCode, stdout, stderr } = await spawnCommand(buildCmd.command, buildCmd.args, projectDir, timeoutMs);\n\n  if (exitCode === 0) {\n    return passResult('build', startTime);\n  }\n\n  const output = stdout + stderr;\n  const errors = parseBuildErrors(output);\n  const issues: ValidationIssue[] =\n    errors.length > 0\n      ? errors.map((e) => ({\n          type: 'file',\n          severity: 'error',\n          message: `Build error: ${e}`,\n          hint: 'Fix the error and run build again',\n        }))\n      : [\n          {\n            type: 'file',\n            severity: 'error',\n            message: 'Build failed',\n            hint: `Run \\`${buildCmd.command} ${buildCmd.args.join(' ')}\\` to see full output`,\n          },\n        ];\n\n  return {\n    passed: false,\n    phase: 'build',\n    issues,\n    agentPrompt: formatBuildErrors(issues),\n    durationMs: Date.now() - startTime,\n  };\n}\n\ninterface TypecheckCommand {\n  command: string;\n  args: string[];\n}\n\nasync function detectTypecheckCommand(projectDir: string): Promise<TypecheckCommand | null> {\n  const pm = detectPackageManager(projectDir);\n\n  try {\n    const content = await readFile(join(projectDir, 'package.json'), 'utf-8');\n    const pkg = JSON.parse(content) as { scripts?: Record<string, string> };\n\n    const scriptName = pkg.scripts?.typecheck ? 'typecheck' : pkg.scripts?.['type-check'] ? 'type-check' : null;\n    if (scriptName) {\n      const args = pm === 'npm' ? ['run', scriptName] : [scriptName];\n      return { command: pm, args };\n    }\n  } catch {\n    // No package.json or malformed\n  }\n\n  try {\n    await readFile(join(projectDir, 'tsconfig.json'), 'utf-8');\n    return { command: 'npx', args: ['tsc', '--noEmit'] };\n  } catch {\n    return null;\n  }\n}\n\nfunction parseTypecheckErrors(output: string): string[] {\n  // Match both TS error formats:\n  //   src/file.ts(line,col): error TS2345: ...\n  //   src/file.ts:line:col - error TS2345: ...  (tsc --pretty)\n  const pattern = /[\\w./]+\\.\\w+(?:\\(\\d+,\\d+\\):\\s*|:\\d+:\\d+\\s*-\\s*)error\\s+TS\\d+:.+/g;\n  const matches = output.match(pattern);\n  return matches ? [...new Set(matches)].slice(0, 10) : [];\n}\n\nfunction formatTypecheckErrors(errors: string[], rawOutput: string): string {\n  if (errors.length === 0) {\n    // Couldn't parse specific errors — give raw output\n    const truncated = rawOutput.slice(0, 2000);\n    return `The typecheck failed. Here is the output:\\n\\n${truncated}\\n\\nFix the type errors shown above.`;\n  }\n\n  const lines = errors.map((error) => {\n    // Extract file:line info and error description\n    const fileMatch = error.match(/([\\w./]+\\.\\w+)[:(]\\d+/);\n    const tsMatch = error.match(/error\\s+(TS\\d+):\\s*(.+)/);\n\n    if (fileMatch && tsMatch) {\n      return `- ${fileMatch[1]}: ${tsMatch[2]} (${tsMatch[1]})`;\n    }\n    return `- ${error}`;\n  });\n\n  return `The typecheck failed with ${errors.length} error${errors.length === 1 ? '' : 's'}:\\n\\n${lines.join('\\n')}\\n\\nFix these type errors in the indicated files.`;\n}\n\nfunction formatBuildErrors(issues: ValidationIssue[]): string {\n  const errorMessages = issues.map((i) => `- ${i.message}`);\n  return `The build failed:\\n\\n${errorMessages.join('\\n')}\\n\\nFix these build errors.`;\n}\n\nfunction formatForAgent(results: QuickCheckResult[]): string {\n  return results\n    .filter((r) => !r.passed && r.agentPrompt)\n    .map((r) => r.agentPrompt!)\n    .join('\\n\\n');\n}\n\n/**\n * Validation callback suitable for RetryConfig.validateAndFormat.\n * Returns null if checks pass, or an agent-ready error prompt if they fail.\n */\nexport async function quickCheckValidateAndFormat(workingDirectory: string): Promise<string | null> {\n  const result = await runQuickChecks(workingDirectory);\n  return result.passed ? null : result.agentRetryPrompt;\n}\n\nfunction spawnCommand(\n  command: string,\n  args: string[],\n  cwd: string,\n  timeoutMs: number,\n): Promise<{ exitCode: number; stdout: string; stderr: string }> {\n  return new Promise((resolve) => {\n    const proc = spawn(command, args, {\n      cwd,\n      timeout: timeoutMs,\n      ...SPAWN_OPTS,\n    });\n\n    let stdout = '';\n    let stderr = '';\n\n    proc.stdout?.on('data', (data: Buffer) => {\n      stdout += data.toString();\n    });\n    proc.stderr?.on('data', (data: Buffer) => {\n      stderr += data.toString();\n    });\n\n    proc.on('close', (code) => {\n      resolve({ exitCode: code ?? 1, stdout, stderr });\n    });\n\n    proc.on('error', () => {\n      resolve({ exitCode: 1, stdout, stderr });\n    });\n  });\n}\n"]}

package/dist/lib/validation/security-checks.d.ts

@@ -1,35 +0,0 @@
-import type { AuthPatternFinding } from '../../doctor/types.js';
-import type { ValidationIssue } from './types.js';
-export interface SecurityCheckResult {
-    /** All security-class findings for this install (errors + warnings). */
-    findings: AuthPatternFinding[];
-    /**
-     * Error-severity findings that must block a successful install. Empty when the
-     * install is secure; a non-empty list means install should not report success.
-     */
-    blocking: AuthPatternFinding[];
-}
-/**
- * Run the security subset of doctor's auth-pattern checks against an install
- * directory. Pure file inspection — no network — so it is safe to call both
- * inside the installer's self-correction loop and as the final pre-success gate.
- *
- * This closes the install-validate ↔ doctor gap: previously install could report
- * `success: true` while `workos doctor` immediately found a security hole,
- * because neither the retry loop nor `validateInstallation` ran these checks.
- */
-export declare function runInstallSecurityChecks(integration: string, installDir: string): Promise<SecurityCheckResult>;
-/** Convert security findings into ValidationIssues for the emitter/report surfaces. */
-export declare function securityFindingsToIssues(findings: AuthPatternFinding[]): ValidationIssue[];
-/**
- * Build an agent correction prompt from security findings so the installer's
- * self-correction loop fixes them before declaring success. Returns an empty
- * string when there is nothing to correct.
- */
-export declare function formatSecurityFindingsForAgent(findings: AuthPatternFinding[]): string;
-/**
- * Build the error message thrown when error-severity security findings survive
- * the installer's retries — the message that turns a silent insecure "success"
- * into a visible failure.
- */
-export declare function formatBlockingSecurityError(blocking: AuthPatternFinding[]): string;

package/dist/lib/validation/security-checks.js

@@ -1,105 +0,0 @@
-import { checkAuthPatterns } from '../../doctor/checks/auth-patterns.js';
-/**
- * The "security subset" of `workos doctor`'s auth-pattern checks that the
- * installer enforces. These are the patterns that are *unsafe* or *leak secrets*
- * (an unsafe GET sign-out, an API key in client env/source, an ungitignored
- * .env). Completeness checks (missing middleware/callback/provider) are
- * intentionally excluded here — `validateInstallation` already covers those, and
- * they carry higher false-positive risk than we want gating install success.
- *
- * Keep in sync with the codes emitted by `src/doctor/checks/auth-patterns.ts`.
- */
-const SECURITY_FINDING_CODES = new Set([
-    'SIGNOUT_GET_HANDLER',
-    'SIGNOUT_LINK_PREFETCH',
-    'API_KEY_LEAKED_TO_CLIENT',
-    'API_KEY_IN_SOURCE',
-    'ENV_FILE_NOT_GITIGNORED',
-    'MIXED_ENVIRONMENT',
-]);
-/** Map an installer integration id to the framework name doctor's checks expect. */
-const INTEGRATION_FRAMEWORK_NAME = {
-    nextjs: 'Next.js',
-    'react-router': 'React Router',
-    'tanstack-start': 'TanStack Start',
-};
-/**
- * Run the security subset of doctor's auth-pattern checks against an install
- * directory. Pure file inspection — no network — so it is safe to call both
- * inside the installer's self-correction loop and as the final pre-success gate.
- *
- * This closes the install-validate ↔ doctor gap: previously install could report
- * `success: true` while `workos doctor` immediately found a security hole,
- * because neither the retry loop nor `validateInstallation` ran these checks.
- */
-export async function runInstallSecurityChecks(integration, installDir) {
-    const framework = {
-        name: INTEGRATION_FRAMEWORK_NAME[integration] ?? null,
-        version: null,
-    };
-    // checkAuthPatterns loads .env files itself; these structs only satisfy the
-    // shape its non-Next.js checks read from.
-    const environment = {
-        apiKeyConfigured: false,
-        apiKeyType: null,
-        clientId: null,
-        redirectUri: null,
-        cookieDomain: null,
-        baseUrl: null,
-    };
-    const sdk = {
-        name: null,
-        version: null,
-        latest: null,
-        outdated: false,
-        isAuthKit: false,
-        language: 'javascript',
-    };
-    const result = await checkAuthPatterns({ installDir }, framework, environment, sdk);
-    const findings = result.findings.filter((f) => SECURITY_FINDING_CODES.has(f.code));
-    const blocking = findings.filter((f) => f.severity === 'error');
-    return { findings, blocking };
-}
-/** Convert security findings into ValidationIssues for the emitter/report surfaces. */
-export function securityFindingsToIssues(findings) {
-    return findings.map((f) => ({
-        type: 'pattern',
-        severity: f.severity,
-        message: f.filePath ? `${f.message} (${f.filePath})` : f.message,
-        hint: f.remediation,
-    }));
-}
-/**
- * Build an agent correction prompt from security findings so the installer's
- * self-correction loop fixes them before declaring success. Returns an empty
- * string when there is nothing to correct.
- */
-export function formatSecurityFindingsForAgent(findings) {
-    if (findings.length === 0)
-        return '';
-    const lines = findings.map((f) => {
-        const loc = f.filePath ? ` in ${f.filePath}` : '';
-        const fix = f.remediation ? ` Fix: ${f.remediation}` : '';
-        return `- [${f.severity}] ${f.message}${loc}.${fix}`;
-    });
-    return `Security checks found issues that must be fixed:\n\n${lines.join('\n')}\n\nApply the fixes above, then make sure the project still builds.`;
-}
-/**
- * Build the error message thrown when error-severity security findings survive
- * the installer's retries — the message that turns a silent insecure "success"
- * into a visible failure.
- */
-export function formatBlockingSecurityError(blocking) {
-    const lines = blocking.map((f) => {
-        const loc = f.filePath ? ` (${f.filePath})` : '';
-        return `  • ${f.code}: ${f.message}${loc}`;
-    });
-    return [
-        'Installation produced insecure code that could not be auto-corrected:',
-        '',
-        ...lines,
-        '',
-        'Fix the issues above (or run `workos doctor` for details and remediation) and re-run the installer.',
-    ].join('\n');
-}
-//# sourceMappingURL=security-checks.js.map

package/dist/lib/validation/security-checks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-checks.js","sourceRoot":"","sources":["../../../src/lib/validation/security-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAIzE;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAC7C,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,yBAAyB;IACzB,mBAAmB;CACpB,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,0BAA0B,GAA2B;IACzD,MAAM,EAAE,SAAS;IACjB,cAAc,EAAE,cAAc;IAC9B,gBAAgB,EAAE,gBAAgB;CACnC,CAAC;AAYF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAAmB,EAAE,UAAkB;IACpF,MAAM,SAAS,GAAkB;QAC/B,IAAI,EAAE,0BAA0B,CAAC,WAAW,CAAC,IAAI,IAAI;QACrD,OAAO,EAAE,IAAI;KACd,CAAC;IACF,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,WAAW,GAAoB;QACnC,gBAAgB,EAAE,KAAK;QACvB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,IAAI;QAClB,OAAO,EAAE,IAAI;KACd,CAAC;IACF,MAAM,GAAG,GAAY;QACnB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,YAAY;KACvB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,QAA8B;IACrE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QAChE,IAAI,EAAE,CAAC,CAAC,WAAW;KACpB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAA8B;IAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,OAAO,uDAAuD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAAC;AACtJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAA8B;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,OAAO;QACL,uEAAuE;QACvE,EAAE;QACF,GAAG,KAAK;QACR,EAAE;QACF,qGAAqG;KACtG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC","sourcesContent":["import { checkAuthPatterns } from '../../doctor/checks/auth-patterns.js';\nimport type { AuthPatternFinding, FrameworkInfo, EnvironmentInfo, SdkInfo } from '../../doctor/types.js';\nimport type { ValidationIssue } from './types.js';\n\n/**\n * The \"security subset\" of `workos doctor`'s auth-pattern checks that the\n * installer enforces. These are the patterns that are *unsafe* or *leak secrets*\n * (an unsafe GET sign-out, an API key in client env/source, an ungitignored\n * .env). Completeness checks (missing middleware/callback/provider) are\n * intentionally excluded here — `validateInstallation` already covers those, and\n * they carry higher false-positive risk than we want gating install success.\n *\n * Keep in sync with the codes emitted by `src/doctor/checks/auth-patterns.ts`.\n */\nconst SECURITY_FINDING_CODES = new Set<string>([\n  'SIGNOUT_GET_HANDLER',\n  'SIGNOUT_LINK_PREFETCH',\n  'API_KEY_LEAKED_TO_CLIENT',\n  'API_KEY_IN_SOURCE',\n  'ENV_FILE_NOT_GITIGNORED',\n  'MIXED_ENVIRONMENT',\n]);\n\n/** Map an installer integration id to the framework name doctor's checks expect. */\nconst INTEGRATION_FRAMEWORK_NAME: Record<string, string> = {\n  nextjs: 'Next.js',\n  'react-router': 'React Router',\n  'tanstack-start': 'TanStack Start',\n};\n\nexport interface SecurityCheckResult {\n  /** All security-class findings for this install (errors + warnings). */\n  findings: AuthPatternFinding[];\n  /**\n   * Error-severity findings that must block a successful install. Empty when the\n   * install is secure; a non-empty list means install should not report success.\n   */\n  blocking: AuthPatternFinding[];\n}\n\n/**\n * Run the security subset of doctor's auth-pattern checks against an install\n * directory. Pure file inspection — no network — so it is safe to call both\n * inside the installer's self-correction loop and as the final pre-success gate.\n *\n * This closes the install-validate ↔ doctor gap: previously install could report\n * `success: true` while `workos doctor` immediately found a security hole,\n * because neither the retry loop nor `validateInstallation` ran these checks.\n */\nexport async function runInstallSecurityChecks(integration: string, installDir: string): Promise<SecurityCheckResult> {\n  const framework: FrameworkInfo = {\n    name: INTEGRATION_FRAMEWORK_NAME[integration] ?? null,\n    version: null,\n  };\n  // checkAuthPatterns loads .env files itself; these structs only satisfy the\n  // shape its non-Next.js checks read from.\n  const environment: EnvironmentInfo = {\n    apiKeyConfigured: false,\n    apiKeyType: null,\n    clientId: null,\n    redirectUri: null,\n    cookieDomain: null,\n    baseUrl: null,\n  };\n  const sdk: SdkInfo = {\n    name: null,\n    version: null,\n    latest: null,\n    outdated: false,\n    isAuthKit: false,\n    language: 'javascript',\n  };\n\n  const result = await checkAuthPatterns({ installDir }, framework, environment, sdk);\n  const findings = result.findings.filter((f) => SECURITY_FINDING_CODES.has(f.code));\n  const blocking = findings.filter((f) => f.severity === 'error');\n  return { findings, blocking };\n}\n\n/** Convert security findings into ValidationIssues for the emitter/report surfaces. */\nexport function securityFindingsToIssues(findings: AuthPatternFinding[]): ValidationIssue[] {\n  return findings.map((f) => ({\n    type: 'pattern',\n    severity: f.severity,\n    message: f.filePath ? `${f.message} (${f.filePath})` : f.message,\n    hint: f.remediation,\n  }));\n}\n\n/**\n * Build an agent correction prompt from security findings so the installer's\n * self-correction loop fixes them before declaring success. Returns an empty\n * string when there is nothing to correct.\n */\nexport function formatSecurityFindingsForAgent(findings: AuthPatternFinding[]): string {\n  if (findings.length === 0) return '';\n  const lines = findings.map((f) => {\n    const loc = f.filePath ? ` in ${f.filePath}` : '';\n    const fix = f.remediation ? ` Fix: ${f.remediation}` : '';\n    return `- [${f.severity}] ${f.message}${loc}.${fix}`;\n  });\n  return `Security checks found issues that must be fixed:\\n\\n${lines.join('\\n')}\\n\\nApply the fixes above, then make sure the project still builds.`;\n}\n\n/**\n * Build the error message thrown when error-severity security findings survive\n * the installer's retries — the message that turns a silent insecure \"success\"\n * into a visible failure.\n */\nexport function formatBlockingSecurityError(blocking: AuthPatternFinding[]): string {\n  const lines = blocking.map((f) => {\n    const loc = f.filePath ? ` (${f.filePath})` : '';\n    return `  • ${f.code}: ${f.message}${loc}`;\n  });\n  return [\n    'Installation produced insecure code that could not be auto-corrected:',\n    '',\n    ...lines,\n    '',\n    'Fix the issues above (or run `workos doctor` for details and remediation) and re-run the installer.',\n  ].join('\\n');\n}\n"]}

package/dist/lib/validation/types.d.ts

@@ -1,56 +0,0 @@
-export type ValidationSeverity = 'error' | 'warning';
-export type ValidationIssueType = 'package' | 'env' | 'file' | 'pattern';
-export interface ValidationIssue {
-    type: ValidationIssueType;
-    severity: ValidationSeverity;
-    message: string;
-    hint?: string;
-}
-export interface ValidationResult {
-    passed: boolean;
-    framework: string;
-    issues: ValidationIssue[];
-    durationMs: number;
-}
-export interface PackageRule {
-    name: string;
-    location?: 'dependencies' | 'devDependencies' | 'any';
-}
-export interface EnvVarRule {
-    name: string;
-    required?: boolean;
-    alternates?: string[];
-}
-export interface FileRule {
-    path: string;
-    mustContain?: string[];
-    mustContainAny?: string[];
-}
-export interface VariantRules {
-    files?: FileRule[];
-    packages?: PackageRule[];
-    envVars?: EnvVarRule[];
-}
-export interface ValidationRules {
-    framework: string;
-    packages: PackageRule[];
-    envVars: EnvVarRule[];
-    files: FileRule[];
-    variants?: Record<string, VariantRules>;
-}
-export interface QuickCheckResult {
-    passed: boolean;
-    phase: 'typecheck' | 'build';
-    issues: ValidationIssue[];
-    /** Formatted for agent consumption — actionable, not just error messages */
-    agentPrompt: string | null;
-    durationMs: number;
-}
-export interface QuickChecksOutput {
-    passed: boolean;
-    results: QuickCheckResult[];
-    /** Combined agent-ready prompt summarizing all failures */
-    agentRetryPrompt: string | null;
-    totalDurationMs: number;
-}
-export type { BuildResult } from './build-validator.js';

package/dist/lib/validation/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map

package/dist/lib/validation/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/validation/types.ts"],"names":[],"mappings":"","sourcesContent":["export type ValidationSeverity = 'error' | 'warning';\nexport type ValidationIssueType = 'package' | 'env' | 'file' | 'pattern';\n\nexport interface ValidationIssue {\n  type: ValidationIssueType;\n  severity: ValidationSeverity;\n  message: string;\n  hint?: string; // How to fix\n}\n\nexport interface ValidationResult {\n  passed: boolean;\n  framework: string;\n  issues: ValidationIssue[];\n  durationMs: number;\n}\n\n// Rule definitions (matches JSON schema)\nexport interface PackageRule {\n  name: string;\n  location?: 'dependencies' | 'devDependencies' | 'any'; // default: 'any'\n}\n\nexport interface EnvVarRule {\n  name: string;\n  required?: boolean; // default: true\n  alternates?: string[]; // alternate env var names (e.g., VITE_WORKOS_CLIENT_ID)\n}\n\nexport interface FileRule {\n  path: string; // glob pattern, e.g., \"middleware.ts\" or \"app/**/callback/**/route.ts\"\n  mustContain?: string[]; // strings that must appear in file\n  mustContainAny?: string[]; // at least one must appear\n}\n\nexport interface VariantRules {\n  files?: FileRule[];\n  packages?: PackageRule[];\n  envVars?: EnvVarRule[];\n}\n\nexport interface ValidationRules {\n  framework: string;\n  packages: PackageRule[];\n  envVars: EnvVarRule[];\n  files: FileRule[];\n  variants?: Record<string, VariantRules>;\n}\n\nexport interface QuickCheckResult {\n  passed: boolean;\n  phase: 'typecheck' | 'build';\n  issues: ValidationIssue[];\n  /** Formatted for agent consumption — actionable, not just error messages */\n  agentPrompt: string | null;\n  durationMs: number;\n}\n\nexport interface QuickChecksOutput {\n  passed: boolean;\n  results: QuickCheckResult[];\n  /** Combined agent-ready prompt summarizing all failures */\n  agentRetryPrompt: string | null;\n  totalDurationMs: number;\n}\n\n// Re-export BuildResult from build-validator\nexport type { BuildResult } from './build-validator.js';\n"]}

package/dist/lib/validation/validator.d.ts

@@ -1,13 +0,0 @@
-import type { ValidationResult, ValidationRules, ValidationIssue } from './types.js';
-export interface ValidateOptions {
-    variant?: string;
-    runBuild?: boolean;
-}
-export declare function validateInstallation(framework: string, projectDir: string, options?: ValidateOptions): Promise<ValidationResult>;
-export declare function validatePackages(rules: ValidationRules, projectDir: string): Promise<ValidationIssue[]>;
-export declare function validateEnvVars(rules: ValidationRules, projectDir: string): Promise<ValidationIssue[]>;
-export declare function validateFiles(rules: ValidationRules, projectDir: string): Promise<ValidationIssue[]>;
-/**
- * Framework-specific cross-validations that require reading multiple sources.
- */
-export declare function validateFrameworkSpecific(framework: string, projectDir: string): Promise<ValidationIssue[]>;