@event4u/agent-config 16.2.0 → 16.4.0

package/dist/scripts/_lib/lean_projection_mode.js

@@ -1,20 +1,64 @@
 /**
- * `lean_projection.mode` — ONE definition of what the three modes mean.
- *
- * The projector (`condense.ts`) resolves the value with a real YAML parse; the
- * delivery concern (`hooks/rule_inject_hook.ts`) resolves it with an
- * indentation-shaped read, because a hook must never fail a tool call because a
- * parser could not load. Two readers is unavoidable. Two *normalisations* is
- * not, and would be the defect worth preventing: a projector that writes thin
- * files while the concern believes the mode is off delivers pointers and no
- * bodies, which is exactly the 36.2 % arm the delivery mode exists to replace.
- *
- * So each side supplies the raw string from its own reader and this module
- * decides what it means. Anything unrecognised — absent key, typo, `null`,
- * a non-string — is `eager-all`: the parser fallback, which is NOT the value
- * the template ships (see the type below), because a mode nobody can spell
- * must never silently thin the standing corpus.
+ * `lean_projection.mode` — ONE definition of what the three modes mean, and
+ * since step 1.2 of `road-to-a-rule-carrier-that-works-outside-the-repo`, ONE
+ * reader that produces it.
+ *
+ * ── What this module used to be, and why that was not enough ──
+ *
+ * It owned the NORMALISATION and left each caller its own READER: the projector
+ * (`condense.ts`) resolved the value with a real YAML parse over the full
+ * settings cascade; the delivery concern (`hooks/rule_inject_hook.ts`) resolved
+ * it with an indentation-shaped read of `<cwd>/.agent-settings.yml` alone. The
+ * header argued that two readers were unavoidable and that two *normalisations*
+ * were the only thing worth preventing.
+ *
+ * Measured on 2026-10-02, that split was not a stylistic difference — it was a
+ * disagreement about WHICH FILE. The installer writes settings to
+ * `<root>/agents/settings/.agent-settings.yml` (`agent_settings.ts`'s canonical
+ * write target; `install.ts:4108`). The concern read `<root>/.agent-settings.yml`,
+ * the LEGACY location, and nothing else. On a normal install the concern
+ * therefore read a file that does not exist, got `''`, normalised it to
+ * `eager-all`, and closed its own gate — while the projector, reading the
+ * canonical file, had written thin stubs. That is the pointer arm the delivery
+ * mode exists to replace, reached by configuration rather than by choice, and
+ * it is a SECOND independent cause of the silence step 1.1 repaired: a consumer
+ * that fixed the package root alone would still have received nothing.
+ *
+ * The user-global layer was invisible to the concern for the same reason, which
+ * matters more than it sounds: ADR-020 installs are global-only, so for those
+ * consumers the ONLY layer carrying a mode is one the concern never opened.
+ *
+ * ── D3: one resolver, not a parity test between three ──
+ *
+ * The roadmap's D3 records the choice and the reason — a parity test keeps
+ * three readers that can drift again, and this module already existed to be the
+ * one. `resolveLeanProjection` below is that resolver. It reads the layers in
+ * the order `load_agent_settings` defines (template base, user-global,
+ * project), through `project_settings_path`, which prefers the canonical file
+ * and falls back to the legacy one, so a hand-edited root file still works.
+ *
+ * ── Why the template path is passed in rather than resolved ──
+ *
+ * `agent_settings.default_template_path()` derives the package root from
+ * `import.meta.url` three directories up. That is correct for a module at
+ * `<pkg>/src/scripts/_lib/`; inside the composed hook bundle `import.meta.url`
+ * is `<pkg>/dist/hooks/dispatch.js`, so the same arithmetic yields the PARENT
+ * of the package and the template read misses. Verified in the built bundle,
+ * not inferred. With no template the base layer is `{}` and an unconfigured
+ * consumer resolves to `eager-all` — the silence again, one layer lower. So a
+ * caller that knows the real package root (the carrier does: the dispatcher
+ * passes it) hands it over, and the resolver reads the template from there.
+ *
+ * ── What has NOT changed ──
+ *
+ * Anything unrecognised — absent key, typo, `null`, a non-string — is still
+ * `eager-all`: the parser fallback, which is NOT the value the template ships
+ * (see the type below), because a mode nobody can spell must never silently
+ * thin the standing corpus. That fallback now fires only when no layer carried
+ * a value at all, rather than whenever the concern looked in the wrong place.
  */
+import * as path from 'node:path';
+import { load_agent_settings } from './agent_settings.js';
 export const DEFAULT_LEAN_PROJECTION_MODE = 'eager-all';
 /** Map a raw settings value onto a mode. Unrecognised → `eager-all`. */
 export function normalizeLeanProjectionMode(raw) {
@@ -146,4 +190,163 @@ export function describeDroppedHosts(res) {
 export function thinsHost(mode, hosts, hostId) {
     return writesThinFiles(mode) && hosts.includes(hostId);
 }
+/**
+ * THE resolver. Every surface that asks "which delivery mode" calls this.
+ *
+ * Tolerant like everything else on a hook path: `load_agent_settings` answers
+ * with defaults on an unreadable or malformed file and never throws, and the
+ * normalisers above turn anything unrecognised into the safe value. A caller
+ * on a hot path pays ONE cascade read per prompt; `modeExplicit` is a lazy
+ * getter, so the second, template-isolated read happens only for a caller that
+ * actually reads provenance — which today is the installer and nothing else.
+ */
+export function resolveLeanProjection(opts = {}) {
+    // The LEGACY root path, deliberately, and not `project_settings_path`'s
+    // either-or pick. `load_agent_settings` expands whatever it is given into
+    // `[the file, <its dir>/agents/settings/.agent-settings.yml, <its dir>/
+    // agents/settings/.agent-settings.local.yml]` and merges them deepest-wins,
+    // so handing it the root path reads BOTH the legacy and the canonical file
+    // — which is strictly more than picking one, and is what a tree carrying
+    // both should resolve to. It also keeps one export out of this module's
+    // import list, which is runtime bytes in the composed hook bundle.
+    const file = opts.settingsPath ?? path.join(opts.projectRoot ?? process.cwd(), '.agent-settings.yml');
+    const tpl = opts.packageRoot == null
+        ? null
+        : path.join(opts.packageRoot, 'src', 'config', 'agent-settings.template.yml');
+    let lean;
+    try {
+        lean = load_agent_settings(tpl === null ? { project_path: file } : { project_path: file, template_path: tpl })['lean_projection'];
+    }
+    catch {
+        /* a settings layer nothing can read must never fail a turn */
+    }
+    const obj = typeof lean === 'object' && lean !== null && !Array.isArray(lean) ? lean : {};
+    const o = obj;
+    return {
+        mode: normalizeLeanProjectionMode(o['mode'] ?? ''),
+        hosts: resolveLeanProjectionHosts(o['hosts']),
+        // LAZY, and the hot path is the reason. Provenance needs a SECOND,
+        // template-isolated cascade, and only the installer reads it — the
+        // delivery concern on `user_prompt_submit` destructures `{ mode, hosts }`
+        // and discards this field, so computing it eagerly doubled the per-prompt
+        // settings read for an answer nobody asked for. A getter keeps the
+        // field's shape (`readonly modeExplicit: boolean`) and charges only the
+        // caller that touches it.
+        get modeExplicit() {
+            return rawExplicitLeanProjectionMode(opts) !== '';
+        },
+    };
+}
+/**
+ * A path no tree contains, so `template_defaults` contributes nothing.
+ *
+ * This is the mechanism `load_agent_settings` documents for the purpose —
+ * "a test or tool that pins every other input can pin the defaults base too,
+ * and point it at a nonexistent file to isolate the cascade" — used here for a
+ * tool rather than a test. It is a reserved device filename on every platform
+ * this package runs on and is never created, so the read fails and the loader's
+ * own tolerance turns it into `{}`.
+ *
+ * The alternative — re-reading the YAML layers by hand — was rejected because
+ * it would be a SECOND reader of the same key, which is the precise defect step
+ * 1.2 of the carrier roadmap existed to remove. Isolating the base keeps one
+ * reader and changes only which layers it is given.
+ */
+const NO_TEMPLATE_LAYER = path.join(path.sep, 'dev', 'null', 'agent-config-absent-template.yml');
+/**
+ * The RAW `lean_projection.mode` string from the user-controlled layers only,
+ * or `''` when no such layer carries it.
+ *
+ * Raw and un-normalised on purpose: {@link normalizeLeanProjectionMode} maps
+ * everything unrecognised — `''` included — onto `eager-all`, so a normalised
+ * answer cannot tell "the user chose eager-all" from "the user chose nothing".
+ * Provenance needs exactly that distinction, so it has to be read before the
+ * normaliser runs.
+ */
+export function rawExplicitLeanProjectionMode(opts = {}) {
+    const file = opts.settingsPath ?? path.join(opts.projectRoot ?? process.cwd(), '.agent-settings.yml');
+    let lean;
+    try {
+        lean = load_agent_settings({ project_path: file, template_path: NO_TEMPLATE_LAYER })['lean_projection'];
+    }
+    catch {
+        return ''; // a layer nothing can read states no preference
+    }
+    if (typeof lean !== 'object' || lean === null || Array.isArray(lean))
+        return '';
+    const m = lean['mode'];
+    return typeof m === 'string' ? m.trim() : '';
+}
+/**
+ * Did a human ask for this mode, and is it the one the caller is gated on?
+ *
+ * The question an installer actually has. `modeExplicit` alone is not enough —
+ * a consumer who explicitly set `eager-all` has set the key explicitly and must
+ * NOT be thinned — so the two conditions are folded here rather than left to
+ * every caller to remember to combine.
+ */
+export function leanProjectionModeChosen(mode, opts = {}) {
+    const raw = rawExplicitLeanProjectionMode(opts);
+    return raw !== '' && normalizeLeanProjectionMode(raw) === mode;
+}
+/**
+ * May the INSTALLER thin this host's rule tree?
+ *
+ * The host-aware sibling of {@link leanProjectionModeChosen}, and the predicate
+ * `road-to-an-installed-layer-that-is-thinned` step 1.1 keys on. It folds the
+ * three conditions that must hold together, once, so no caller has to remember
+ * to combine them:
+ *
+ * 1. **A human asked.** `modeExplicit` — false whenever the only layer carrying
+ *    the key is the shipped template, which already says `delivery`. Reading the
+ *    template as consent would thin every consumer's `~/.claude/rules` as a side
+ *    effect of wiring a reader, which is the owner-reserved default flip (that
+ *    roadmap's blocker, decision D4).
+ * 2. **The chosen mode actually writes stubs.** A consumer who explicitly chose
+ *    `eager-all` has set the key and must NOT be thinned on the strength of
+ *    having an opinion.
+ * 3. **This host is in scope.** The same `hosts:` list the projector honours, so
+ *    installer and projector cannot disagree about which trees are thinned.
+ *
+ * ONE `resolveLeanProjection` call, which is why this is not two
+ * {@link leanProjectionModeChosen} calls: that one answers "is the chosen mode
+ * exactly X" and knows nothing about `hosts`, so a caller combining it with a
+ * host check by hand would re-create the fold this function exists to own.
+ *
+ * That is one CALL and two cascade READS here, because reading `modeExplicit`
+ * triggers its lazy getter and a second, template-isolated load. The installer
+ * runs once per deploy and does not care; the cost is named rather than rounded
+ * down because the same resolver serves the per-prompt delivery concern, which
+ * does NOT read provenance and therefore does not pay it.
+ */
+export function installerThinsHost(hostId, opts = {}) {
+    const { mode, hosts, modeExplicit } = resolveLeanProjection({
+        ...opts,
+        settingsPath: opts.settingsPath ?? NO_PROJECT_LAYER,
+    });
+    return modeExplicit && thinsHost(mode, hosts.hosts, hostId);
+}
+/**
+ * A path no tree contains, so the PROJECT cascade contributes nothing.
+ *
+ * The same device {@link NO_TEMPLATE_LAYER} uses, pointed at the other end of
+ * the cascade, and the reason is scope rather than isolation: the thing
+ * {@link installerThinsHost} gates is a mutation of `~/.claude/rules`, which
+ * belongs to the MACHINE. A per-checkout value must not decide it, in either
+ * direction — a project saying `delivery` would thin the layer every other
+ * project on that machine reads, and a project saying `eager-all` would
+ * suppress an opt-in the user wrote user-globally, because the project cascade
+ * merges last and wins.
+ *
+ * `load_agent_settings` reads `user_global_settings_paths()` regardless of what
+ * `project_path` it is given, so pointing the project layer at nothing leaves
+ * exactly the machine-global layers — which is the scope the installer's
+ * sibling `_resolve_global_rule_scope` already resolves for the same deploy.
+ * A caller may still pass an explicit `settingsPath` (tests pin one). A
+ * `projectRoot` handed to {@link installerThinsHost} is DISCARDED — the `??`
+ * chain terminates at `settingsPath` before `projectRoot` is consulted — which
+ * is the intended behaviour and is stated here because a caller passing it and
+ * expecting it honoured would otherwise get no signal.
+ */
+const NO_PROJECT_LAYER = path.join(path.sep, 'dev', 'null', 'agent-config-absent-project-settings.yml');
 //# sourceMappingURL=lean_projection_mode.js.map

package/dist/scripts/_lib/package_root.js

@@ -0,0 +1,68 @@
+/**
+ * Layout-independent package-root resolution for the `_cli` delegate commands.
+ *
+ * `src/scripts/_cli/*.ts` sits three levels below the package root, so every
+ * delegate command derived the root with three hard-coded parent hops. Then the
+ * delegate precompile (`fa51c5a54`) started bundling those same modules into
+ * `dist/cli-delegate/*.js` — **two** levels below the root. Fixed hop counts are
+ * correct in exactly one of the two layouts, and nothing failed loudly: three
+ * hops from the bundle lands on `<pkg>/..`, which for a scoped install is
+ * `node_modules/@event4u`. `conformance` then reported `dist/router.json` and
+ * `src/scripts/hook_manifest.yaml` as missing — files that ship fine — and the
+ * 9.11.0 release PR's `tarball E2E` went red on both Node majors.
+ *
+ * The fix is to stop counting hops. Anchor on the marker that actually defines
+ * the root: the `package.json` whose `name` is this package. That answer holds
+ * for the source tree, for any bundle depth, for npm-global, npx, and
+ * vendor/bin symlink invocations — and it keeps holding if either directory
+ * ever moves.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+/** `name` in this package's own package.json — the root marker. */
+export const PACKAGE_NAME = '@event4u/agent-config';
+/**
+ * Bound on the upward walk. Deep enough for any real install path, finite so a
+ * malformed start value can never spin.
+ */
+const MAX_ASCENT = 16;
+/**
+ * Absolute package root for the module at `fromUrlOrPath` (pass
+ * `import.meta.url`).
+ *
+ * Walks up looking for the package.json whose `name` is {@link PACKAGE_NAME}.
+ * A consumer's own package.json encountered on the way is skipped by that name
+ * check, so an install nested under another project resolves correctly.
+ *
+ * `legacyHops` is the pre-existing hop count for the *source* layout and is
+ * used only if no marker is found. Falling back beats throwing during CLI
+ * startup: a wrong path yields one actionable "missing file" message, while an
+ * exception takes down every command in the delegate.
+ */
+export function resolvePackageRoot(fromUrlOrPath, legacyHops = 3) {
+    const start = fromUrlOrPath.startsWith('file:') ? fileURLToPath(fromUrlOrPath) : fromUrlOrPath;
+    const startDir = path.dirname(start);
+    let dir = startDir;
+    for (let i = 0; i < MAX_ASCENT; i++) {
+        const manifest = path.join(dir, 'package.json');
+        if (fs.existsSync(manifest)) {
+            try {
+                const parsed = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+                if (parsed.name === PACKAGE_NAME) {
+                    return dir;
+                }
+            }
+            catch {
+                // Unreadable / unparseable manifest — not our marker; keep ascending.
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) {
+            break; // filesystem root
+        }
+        dir = parent;
+    }
+    return path.resolve(startDir, ...Array.from({ length: legacyHops }, () => '..'));
+}
+//# sourceMappingURL=package_root.js.map

package/dist/scripts/_lib/rule_consequence_class.js

@@ -0,0 +1,45 @@
+/**
+ * The high-consequence rule class — one reader for the config, the projector
+ * and the test.
+ *
+ * The criterion itself is prose and lives where an author meets it: the
+ * `consequence_class` property of `src/scripts/schemas/rule.schema.json`. This
+ * module does not restate it. It reads the list the criterion produced
+ * (`src/config/rule-consequence-class.json`), joins it to what each rule file
+ * actually declares, and answers the one question `project_thin_rules` asks:
+ * may this rule's stub carry its own law, and if not, has that been declared?
+ *
+ * WHY A DECLARED `no_stub` SUBSET RATHER THAN A SHORTER CLASS. A member whose
+ * law section is missing or over the ceiling cannot ship as stub-plus-law —
+ * there is nothing short enough to copy. Two ways to handle that: drop it from
+ * the class, or keep it in the class and record why it cannot stand. Dropping
+ * it makes the class shrinkable by NOT writing a law, which is the incentive a
+ * criterion must not create. Keeping it leaves the obligation visible and costs
+ * only a full-bodied projection, which is what those rules get today anyway.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+export const CLASS_CONFIG_REL = 'src/config/rule-consequence-class.json';
+export const CLAUSES = ['irreversible-external', 'security-boundary', 'authority-bypass'];
+export function readConsequenceClass(repoRoot) {
+    const raw = JSON.parse(fs.readFileSync(path.join(repoRoot, CLASS_CONFIG_REL), 'utf-8'));
+    return {
+        criterion_ref: raw.criterion_ref ?? '',
+        members: raw.members ?? {},
+        no_stub: raw.no_stub ?? {},
+        excluded: raw.excluded ?? {},
+    };
+}
+/** Ids whose stub carries their law — members minus the declared `no_stub` set. */
+export function stubLawIds(cfg) {
+    return new Set(Object.keys(cfg.members).filter((id) => cfg.no_stub[id] === undefined));
+}
+/** The `consequence_class:` value a rule file declares, or `null`. */
+export function declaredClause(ruleText) {
+    const m = /^consequence_class:\s*"?([a-z-]+)"?\s*$/m.exec(ruleText);
+    if (m === null)
+        return null;
+    const v = m[1];
+    return CLAUSES.includes(v) ? v : null;
+}
+//# sourceMappingURL=rule_consequence_class.js.map

package/dist/scripts/_lib/rule_injection.js

@@ -55,8 +55,51 @@ import * as path from 'node:path';
 import { match_prompt } from './router_match.js';
 /** Kinds of trigger a prompt alone can never fire. */
 export const PATH_TRIGGER_KINDS = ['path_prefix', 'file_pattern'];
+/**
+ * Set by `dispatch_hook` to its own resolved package root. Read here rather
+ * than threaded through every caller — see `ruleSourceDirs`.
+ */
+export const PACKAGE_ROOT_ENV = 'AGENT_CONFIG_PACKAGE_ROOT';
+function statKind(p) {
+    try {
+        const s = fs.statSync(p);
+        return s.isDirectory() ? 'dir' : s.isFile() ? 'file' : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Resolve the body dirs, the router and the gap wording in ONE filesystem pass. */
+export function ruleSources(repoRoot) {
+    const env = (process.env[PACKAGE_ROOT_ENV] ?? '').trim();
+    const pkg = env ? path.resolve(env) : null;
+    const dirs = [];
+    const add = (d) => {
+        if (statKind(d) === 'dir' && !dirs.includes(d))
+            dirs.push(d);
+    };
+    add(path.join(repoRoot, 'agents', 'overrides'));
+    add(path.join(repoRoot, 'dist', 'agent-src', 'rules'));
+    if (pkg !== null)
+        add(path.join(pkg, 'dist', 'agent-src', 'rules'));
+    const local = path.join(repoRoot, 'dist', 'router.json');
+    let router = statKind(local) === 'file' ? local : null;
+    if (router === null && pkg !== null) {
+        const shipped = path.join(pkg, 'dist', 'router.json');
+        if (statKind(shipped) === 'file')
+            router = shipped;
+    }
+    let gap = null;
+    if (router === null || dirs.length === 0) {
+        const miss = pkg === null
+            ? `${PACKAGE_ROOT_ENV} unset`
+            : `no ${router === null ? 'dist/router.json' : 'dist/agent-src/rules'} under ${repoRoot} or ${pkg}`;
+        gap = `rule-inject: no rule source — ${miss}`;
+    }
+    return { dirs, pkg, router, gap };
+}
 export function loadRouter(repoRoot) {
-    const p = path.join(repoRoot, 'dist', 'router.json');
+    const p = ruleSources(repoRoot).router ?? path.join(repoRoot, 'dist', 'router.json');
     return JSON.parse(fs.readFileSync(p, 'utf8'));
 }
 /** Kernel rule ids, as declared by the router. */
@@ -137,16 +180,30 @@ export function matchTierRules(router, prompt, openFiles, command) {
     }
     return out;
 }
-/** Where the projected body of a rule lives. */
-export function ruleBodyPath(repoRoot, id) {
-    return path.join(repoRoot, 'dist', 'agent-src', 'rules', `${id}.md`);
-}
-/** The projected body, or `null` when the rule has no projected file. */
+/**
+ * The projected body from the highest-precedence tree carrying it, or `null`.
+ *
+ * `ruleBodyPath` used to sit in front of this and is gone: it returned the
+ * single-root path unconditionally, this diff changed its contract to "the
+ * first tree that has the file", and nothing outside this module ever called
+ * it. An exported helper whose last caller disappeared in the same diff is an
+ * own-orphan, and the composed hook bundle charges for it on every dispatch
+ * (`src/config/hook-bundle-budget.json`), so it is removed rather than left as
+ * a wrapper nobody uses.
+ */
 export function loadRuleBody(repoRoot, id) {
-    const p = ruleBodyPath(repoRoot, id);
-    if (!fs.existsSync(p))
-        return null;
-    return fs.readFileSync(p, 'utf8');
+    for (const dir of ruleSources(repoRoot).dirs) {
+        const p = path.join(dir, `${id}.md`);
+        if (statKind(p) === 'file') {
+            try {
+                return fs.readFileSync(p, 'utf8');
+            }
+            catch {
+                return null;
+            }
+        }
+    }
+    return null;
 }
 /**
  * UTF-8 byte length — the runtime measure, dependency-free by design.

package/dist/scripts/_lib/rule_law_section.js

@@ -0,0 +1,122 @@
+/**
+ * One spelling of "a rule's law section" — the unit three gates and one
+ * projector all price.
+ *
+ * A **law section** is a heading whose title matches `\biron\s+laws?\b` plus
+ * everything under it up to the next heading of the same or a shallower depth.
+ * A rule may carry several (`direct-answers` has three, `no-cheap-questions`
+ * six); the rule's law is all of them, joined by a blank line, because each one
+ * states an obligation and a stub carrying only the first would ship a rule
+ * whose other laws silently vanished.
+ *
+ * WHY A SHARED MODULE RATHER THAN A REGEX PER CALLER. The projector
+ * (`project_thin_rules.ts`) byte-copies this text into a stub and digests it;
+ * the lint (`lint_rule_law_section.ts`) holds it under a ceiling. If those two
+ * disagreed about where a section ends, the lint would certify a length the
+ * projection does not carry — the exact drift `THIN_ENTRY_MARKER`'s own comment
+ * argues against one file over.
+ *
+ * The heading regex is deliberately the SAME one `check_iron_law_prominence.ts`
+ * uses, so "has a law section" here and "is an Iron Law heading" there cannot
+ * diverge. That gate owns prominence (H2, near the top); this module owns
+ * extent and size.
+ *
+ * WHAT THIS DOES NOT CLAIM. Not that the extracted text IS the rule's obligation. A rule can state its
+ * law in bold prose or a bare fence under no heading at all — several of the 35
+ * routed rules without a heading match do exactly that. A heading match is a
+ * STRUCTURAL property, checkable; "this sentence is the obligation" is not, and
+ * `report_obligation_carriers` plus the ids in `src/config/rule-obligations.json` is where
+ * that question already lives.
+ */
+import * as fs from 'node:fs';
+/** Same literal as `check_iron_law_prominence.ts` — one definition, two readers. */
+export const IRON_LAW_RE = /\biron\s+laws?\b/i;
+const HEADING_RE = /^(#{1,6})\s+(.+?)\s*$/;
+const FENCE_RE = /^\s*```/;
+/** Return `[frontmatter_including_fences, body]`. Empty frontmatter if none. */
+export function splitFrontmatter(text) {
+    if (text.startsWith('---\n')) {
+        const end = text.indexOf('\n---\n', 4);
+        if (end !== -1) {
+            return [text.slice(0, end + 5), text.slice(end + 5)];
+        }
+    }
+    return ['', text];
+}
+/**
+ * The body a runtime delivery carries: frontmatter removed, HTML comments
+ * removed, trimmed.
+ *
+ * Comments are stripped because they are authoring scaffolding
+ * (`<!-- risk-review: … -->`, `<!-- harvest:… -->`, `ref-ignore` markers) that
+ * no host renders to a model, so charging a rule for them would price the wrong
+ * thing. Frontmatter is excluded for the reason `check_rule_stub_ceiling` gives
+ * for the same exclusion: it is the routing surface, and a rule that gains a
+ * trigger must not trip a ceiling whose message tells the author to move prose.
+ */
+export function ruleBody(text) {
+    const [, body] = splitFrontmatter(text);
+    return body.replace(/<!--[\s\S]*?-->/g, '').trim();
+}
+/** Every law section in a rule body, in document order. */
+export function lawSections(body) {
+    const lines = body.split('\n');
+    let inFence = false;
+    const headings = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        const raw = lines[i];
+        if (FENCE_RE.test(raw)) {
+            inFence = !inFence;
+            continue;
+        }
+        if (inFence)
+            continue;
+        const m = HEADING_RE.exec(raw);
+        if (m)
+            headings.push({ i, depth: m[1].length, title: m[2].trim() });
+    }
+    const out = [];
+    for (let k = 0; k < headings.length; k += 1) {
+        const h = headings[k];
+        if (!IRON_LAW_RE.test(h.title))
+            continue;
+        let end = lines.length;
+        for (let j = k + 1; j < headings.length; j += 1) {
+            const n = headings[j];
+            if (n.depth <= h.depth) {
+                end = n.i;
+                break;
+            }
+        }
+        out.push({
+            title: h.title,
+            depth: h.depth,
+            line: h.i + 1,
+            text: lines.slice(h.i, end).join('\n').trim(),
+        });
+    }
+    return out;
+}
+/**
+ * The rule's law, as one byte string — all sections joined by a blank line.
+ * `null` when the rule has none, which is a different answer from `''`.
+ */
+export function lawText(body) {
+    const sections = lawSections(body);
+    if (sections.length === 0)
+        return null;
+    return sections.map((s) => s.text).join('\n\n');
+}
+/** Measure one rule file. */
+export function measureRuleFile(id, filePath) {
+    const body = ruleBody(fs.readFileSync(filePath, 'utf-8'));
+    const law = lawText(body);
+    return {
+        id,
+        lawChars: law === null ? 0 : law.length,
+        sections: lawSections(body).length,
+        bodyChars: body.length,
+        law,
+    };
+}
+//# sourceMappingURL=rule_law_section.js.map