@formigio/fazemos-cli 0.10.67 → 0.10.74

package/dist/preflight/row3_workspace.js

@@ -0,0 +1,253 @@
+/**
+ * F53 Rows 3a/3b/3c — Workspace repo file checks.
+ *
+ * Checks performed via `gh api` against origin/main (D3: remote, not local copy).
+ *   3a — persona file exists (path from role.persona in roles.json)
+ *   3b — playbook file exists (derived from role.inbox path convention)
+ *   3c — .fazemos/roles.json has the role entry with a filler (local check)
+ *
+ * Row 3 rows do NOT run if `gh` is unavailable (whole group becomes tooling_error).
+ */
+import { checkGhAvailable, getWorkspaceGitHubRepo, getFileContentOnGitHub, listDirectoryFilenamesOnGitHub, ToolingError, } from './repoRead.js';
+/**
+ * Strip YAML frontmatter from a markdown file's content.
+ * Frontmatter is a `---` block at the start of the file.
+ * Returns only the body — the part after the closing `---` line.
+ *
+ * Mirrors the API-side guard in fazemos-api/src/routes/members.ts (fileDoc.body?.trim())
+ * which emits a structured `role_doc_empty_body` warn on frontmatter-only files.
+ */
+function stripYamlFrontmatter(text) {
+    const match = text.match(/^---\r?\n[\s\S]*?\n---\r?\n?/);
+    return match ? text.slice(match[0].length) : text;
+}
+/**
+ * Derive the role's directory path from its inbox path.
+ * e.g. "projects/fazemos/roles/project-manager/inbox/" → "projects/fazemos/roles/project-manager"
+ * Falls back to "roles/<role_slug>" if inbox is not set.
+ */
+function derivRoleDir(roleEntry, roleSlug) {
+    if (roleEntry?.inbox) {
+        // Strip trailing slash and the 'inbox' segment
+        const trimmed = roleEntry.inbox.replace(/\/+$/, '');
+        const parts = trimmed.split('/');
+        if (parts[parts.length - 1] === 'inbox') {
+            return parts.slice(0, -1).join('/');
+        }
+        return trimmed;
+    }
+    return `roles/${roleSlug}`;
+}
+/**
+ * Run rows 3a, 3b, 3c for a given workspace/role.
+ */
+export async function checkRow3Workspace(opts) {
+    const { workspaceRoot, roleSlug, agentName, roleEntry, registry } = opts;
+    // ── Check gh CLI availability first ──────────────────────────────────────
+    let ghAvailable = true;
+    let ghError = '';
+    try {
+        checkGhAvailable();
+    }
+    catch (err) {
+        ghAvailable = false;
+        ghError = err instanceof ToolingError ? err.message : String(err);
+    }
+    const repoRef = ghAvailable ? getWorkspaceGitHubRepo(workspaceRoot) : null;
+    if (!ghAvailable || !repoRef) {
+        const detail = !ghAvailable
+            ? ghError
+            : 'Cannot determine GitHub repo from workspace git remote.origin.url.';
+        const row3tooling = {
+            id: '3a',
+            name: 'persona file (GitHub)',
+            status: 'tooling_error',
+            detail,
+            fix_command: null,
+            fix_instruction: 'Install and authenticate gh CLI: brew install gh && gh auth login',
+        };
+        return [
+            row3tooling,
+            { ...row3tooling, id: '3b', name: 'playbook file (GitHub)' },
+            {
+                id: '3c',
+                name: 'roles.json entry',
+                status: 'tooling_error',
+                detail,
+                fix_command: null,
+                fix_instruction: 'gh CLI required only for 3a/3b; 3c uses local check but grouped here for clarity.',
+            },
+        ];
+    }
+    const roleDir = derivRoleDir(roleEntry, roleSlug);
+    // ── Row 3a resolution note ───────────────────────────────────────────────
+    // The runtime (F18 file resolution) reads docs/agents/<name>.md from the
+    // workspace repo (org_file layer). The roles.json `persona` field points to
+    // a different path in many workspaces — that field is NOT what the runtime
+    // reads. We check the actual runtime path, not the roles.json value.
+    const runtimePersonaPath = `docs/agents/${agentName}.md`;
+    const rows = [];
+    // ── 3a — persona file (runtime resolution path: docs/agents/<name>.md) ──
+    // Checks the *body* after YAML frontmatter, not just byte size. A BUG160 stub
+    // carries frontmatter (~60–80 bytes) with an empty body — `size > 0` would
+    // PASS it. We mirror the API-side guard (fazemos-api/src/routes/members.ts:150,
+    // `fileDoc.body?.trim()`) and test the actual body content.
+    //
+    // Cost note: this is a content fetch via the GitHub Contents API rather than a
+    // metadata-only call. For typical persona files (small markdown docs) the extra
+    // payload is negligible; the Content API endpoint is the same either way.
+    try {
+        const content = getFileContentOnGitHub(repoRef, runtimePersonaPath);
+        const exists = content !== null;
+        // Strip YAML frontmatter and test trimmed body — frontmatter-only is empty
+        const body = exists ? stripYamlFrontmatter(content) : '';
+        const nonEmpty = exists && body.trim().length > 0;
+        // Note when roles.json persona field diverges from the runtime resolution path
+        const roleJsonPersona = roleEntry?.persona;
+        const driftNote = roleJsonPersona && roleJsonPersona !== runtimePersonaPath
+            ? ` (roles.json persona='${roleJsonPersona}' — that field is not what the runtime reads; ` +
+                `see docs/guides/agent-provisioning-runbook.md §3)`
+            : '';
+        if (!exists) {
+            rows.push({
+                id: '3a',
+                name: 'persona file',
+                status: 'fail',
+                detail: `${runtimePersonaPath} not found on ${repoRef.owner}/${repoRef.repo}@${repoRef.ref}.` +
+                    driftNote,
+                fix_command: null,
+                fix_instruction: `Create the agent persona at ${runtimePersonaPath} in the workspace repo. ` +
+                    `The F18 runtime reads this path — not the 'persona' field in .fazemos/roles.json. ` +
+                    `Reference another docs/agents/*.md file as a pattern.`,
+            });
+        }
+        else if (!nonEmpty) {
+            rows.push({
+                id: '3a',
+                name: 'persona file',
+                status: 'fail',
+                detail: `${runtimePersonaPath} exists but has no body content (frontmatter-only or blank) on ` +
+                    `${repoRef.owner}/${repoRef.repo}@${repoRef.ref}. ` +
+                    `A frontmatter-only file replaces the DB systemPrompt with "" at runtime (BUG160 class).` +
+                    driftNote,
+                fix_command: null,
+                fix_instruction: `Populate ${runtimePersonaPath} with the agent's full persona text below the YAML frontmatter. ` +
+                    `Do NOT leave the body empty — the runtime substitutes the file body for the DB systemPrompt; ` +
+                    `frontmatter-only silences the agent's identity. Reference another docs/agents/*.md as a pattern.`,
+            });
+        }
+        else {
+            rows.push({
+                id: '3a',
+                name: 'persona file',
+                status: 'pass',
+                detail: `${runtimePersonaPath} exists with non-empty body on ` +
+                    `${repoRef.owner}/${repoRef.repo}@${repoRef.ref}.` +
+                    driftNote,
+                fix_command: null,
+            });
+        }
+    }
+    catch (err) {
+        const detail = err instanceof ToolingError ? err.message : String(err);
+        rows.push({
+            id: '3a',
+            name: 'persona file',
+            status: 'tooling_error',
+            detail,
+            fix_command: null,
+            fix_instruction: 'gh CLI authentication or network issue. Run: gh auth login',
+        });
+    }
+    // ── 3b — playbook file (any playbook-*.md in role dir) ──────────────────
+    // PASS if any playbook-*.md exists. Roles carry different cadences
+    // (playbook-daily, playbook-weekly, playbook-task, etc.) — do not hard-code
+    // a single expected filename.
+    try {
+        const dirFiles = listDirectoryFilenamesOnGitHub(repoRef, roleDir);
+        const playbookFiles = (dirFiles ?? []).filter((f) => /^playbook-.+\.md$/.test(f));
+        if (!dirFiles) {
+            rows.push({
+                id: '3b',
+                name: 'playbook file',
+                status: 'fail',
+                detail: `Role directory '${roleDir}/' not found on ${repoRef.owner}/${repoRef.repo}@${repoRef.ref}. ` +
+                    `No playbook files can exist.`,
+                fix_command: null,
+                fix_instruction: `Create the role directory and at least one playbook file ` +
+                    `(e.g. ${roleDir}/playbook-daily.md or ${roleDir}/playbook-task.md) in the workspace repo. ` +
+                    `See docs/guides/agent-provisioning-runbook.md §3.`,
+            });
+        }
+        else if (playbookFiles.length === 0) {
+            const mdFiles = dirFiles.filter((f) => f.endsWith('.md'));
+            rows.push({
+                id: '3b',
+                name: 'playbook file',
+                status: 'fail',
+                detail: `No playbook-*.md files found in ${roleDir}/ on ${repoRef.owner}/${repoRef.repo}@${repoRef.ref}. ` +
+                    `Found .md files: ${mdFiles.length > 0 ? mdFiles.join(', ') : 'none'}.`,
+                fix_command: null,
+                fix_instruction: `Create at least one playbook file in ${roleDir}/ (e.g. playbook-daily.md or playbook-task.md). ` +
+                    `Reference another role's playbooks as a pattern ` +
+                    `(e.g. look at other roles in projects/fazemos/roles/ for examples). ` +
+                    `See docs/guides/agent-provisioning-runbook.md §3.`,
+            });
+        }
+        else {
+            rows.push({
+                id: '3b',
+                name: 'playbook file',
+                status: 'pass',
+                detail: `Found ${playbookFiles.length} playbook file(s) in ${roleDir}/: ${playbookFiles.join(', ')}`,
+                fix_command: null,
+            });
+        }
+    }
+    catch (err) {
+        const detail = err instanceof ToolingError ? err.message : String(err);
+        rows.push({
+            id: '3b',
+            name: 'playbook file',
+            status: 'tooling_error',
+            detail,
+            fix_command: null,
+            fix_instruction: 'gh CLI authentication or network issue. Run: gh auth login',
+        });
+    }
+    // ── 3c — roles.json entry (local check) ──────────────────────────────────
+    if (!registry || !registry.roles[roleSlug]) {
+        rows.push({
+            id: '3c',
+            name: 'roles.json entry',
+            status: 'fail',
+            detail: `Role '${roleSlug}' not found in .fazemos/roles.json (or no registry found).`,
+            fix_command: null,
+            fix_instruction: `Add a filler entry for '${roleSlug}' in the workspace .fazemos/roles.json, ` +
+                `then run: fazemos roles sync`,
+        });
+    }
+    else if (!registry.roles[roleSlug].filler?.identity) {
+        rows.push({
+            id: '3c',
+            name: 'roles.json entry',
+            status: 'fail',
+            detail: `Role '${roleSlug}' in .fazemos/roles.json has no filler.identity.`,
+            fix_command: null,
+            fix_instruction: `Set filler.identity for '${roleSlug}' in .fazemos/roles.json (the agent's display name), ` +
+                `then run: fazemos roles sync`,
+        });
+    }
+    else {
+        const entry = registry.roles[roleSlug];
+        rows.push({
+            id: '3c',
+            name: 'roles.json entry',
+            status: 'pass',
+            detail: `${roleSlug}: filler.type=${entry.filler.type}, filler.identity=${entry.filler.identity}, scope=${entry.scope}`,
+            fix_command: null,
+        });
+    }
+    return rows;
+}
+//# sourceMappingURL=row3_workspace.js.map

package/dist/preflight/row3_workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row3_workspace.js","sourceRoot":"","sources":["../../src/preflight/row3_workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,SAAgC,EAAE,QAAgB;IACtE,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;QACrB,+CAA+C;QAC/C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,SAAS,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAQxC;IACC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEzE,4EAA4E;IAC5E,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,gBAAgB,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,GAAG,KAAK,CAAC;QACpB,OAAO,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,WAAW;YACzB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,oEAAoE,CAAC;QACzE,MAAM,WAAW,GAAiB;YAChC,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,eAAe;YACvB,MAAM;YACN,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,mEAAmE;SACrF,CAAC;QACF,OAAO;YACL,WAAW;YACX,EAAE,GAAG,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,EAAE;YAC5D;gBACE,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,eAAe;gBACvB,MAAM;gBACN,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,mFAAmF;aACrG;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAElD,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,kBAAkB,GAAG,eAAe,SAAS,KAAK,CAAC;IAEzD,MAAM,IAAI,GAAmB,EAAE,CAAC;IAEhC,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,gFAAgF;IAChF,4DAA4D;IAC5D,EAAE;IACF,+EAA+E;IAC/E,gFAAgF;IAChF,0EAA0E;IAC1E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,KAAK,IAAI,CAAC;QAChC,2EAA2E;QAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAElD,+EAA+E;QAC/E,MAAM,eAAe,GAAG,SAAS,EAAE,OAAO,CAAC;QAC3C,MAAM,SAAS,GACb,eAAe,IAAI,eAAe,KAAK,kBAAkB;YACvD,CAAC,CAAC,yBAAyB,eAAe,gDAAgD;gBACxF,mDAAmD;YACrD,CAAC,CAAC,EAAE,CAAC;QAET,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,GAAG,kBAAkB,iBAAiB,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,GAAG;oBACrF,SAAS;gBACX,WAAW,EAAE,IAAI;gBACjB,eAAe,EACb,+BAA+B,kBAAkB,0BAA0B;oBAC3E,oFAAoF;oBACpF,uDAAuD;aAC1D,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,GAAG,kBAAkB,iEAAiE;oBACtF,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI;oBACnD,yFAAyF;oBACzF,SAAS;gBACX,WAAW,EAAE,IAAI;gBACjB,eAAe,EACb,YAAY,kBAAkB,kEAAkE;oBAChG,+FAA+F;oBAC/F,kGAAkG;aACrG,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,GAAG,kBAAkB,iCAAiC;oBACtD,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,GAAG;oBAClD,SAAS;gBACX,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,eAAe;YACvB,MAAM;YACN,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,4DAA4D;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,mEAAmE;IACnE,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAElF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,mBAAmB,OAAO,mBAAmB,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI;oBAC7F,8BAA8B;gBAChC,WAAW,EAAE,IAAI;gBACjB,eAAe,EACb,2DAA2D;oBAC3D,SAAS,OAAO,yBAAyB,OAAO,4CAA4C;oBAC5F,mDAAmD;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,mCAAmC,OAAO,QAAQ,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI;oBAClG,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG;gBACzE,WAAW,EAAE,IAAI;gBACjB,eAAe,EACb,wCAAwC,OAAO,kDAAkD;oBACjG,kDAAkD;oBAClD,sEAAsE;oBACtE,mDAAmD;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC;gBACR,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,SAAS,aAAa,CAAC,MAAM,wBAAwB,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACpG,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,eAAe;YACvB,MAAM;YACN,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,4DAA4D;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,SAAS,QAAQ,4DAA4D;YACrF,WAAW,EAAE,IAAI;YACjB,eAAe,EACb,2BAA2B,QAAQ,0CAA0C;gBAC7E,8BAA8B;SACjC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,SAAS,QAAQ,kDAAkD;YAC3E,WAAW,EAAE,IAAI;YACjB,eAAe,EACb,4BAA4B,QAAQ,uDAAuD;gBAC3F,8BAA8B;SACjC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,QAAQ,iBAAiB,KAAK,CAAC,MAAM,CAAC,IAAI,qBAAqB,KAAK,CAAC,MAAM,CAAC,QAAQ,WAAW,KAAK,CAAC,KAAK,EAAE;YACvH,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/preflight/row4_ssm.d.ts

@@ -0,0 +1,57 @@
+/**
+ * F53 Rows 4a/4b/4c — SSM allowlist checks.
+ *
+ * Checks that the role appears in the three Fazemos SSM parameters:
+ *   4a — /fazemos/<env>/wake/allowlist          (comma-separated role slugs)
+ *   4b — /fazemos/<env>/wake/auto-wakeable-roles (comma-separated role slugs)
+ *   4c — /fazemos/<env>/triggers/allowlist       (role:cadence pairs, e.g. "project-manager:daily")
+ *
+ * All three rows look up the **role slug** — NOT the agent/filler name.
+ * Row 4c entries use a `role:cadence` format; only the role portion is compared,
+ * and the cadence is surfaced in the PASS detail for operator visibility.
+ *
+ * Uses the `aws ssm get-parameter` CLI (consistent with existing shell-out pattern
+ * in index.ts for wait-for-pipeline). Operator credentials required.
+ *
+ * On AWS credential failure → tooling_error with fix instruction (aws sso login).
+ * On access denied → tooling_error.
+ * On parameter not found → fail with fix command (aws ssm put-parameter ...).
+ *
+ * `triggersAllowlist` returns bare role slugs (`:cadence` suffix stripped) so that
+ * row3_playbook.ts's `triggersAllowlist.includes(roleSlug)` check works correctly.
+ *
+ * r3.3 — Row 4c polarity fix (2026-08-20):
+ * Row 4c is now symmetric with row 3b. Previously it FAILed any role absent from the
+ * triggers allowlist. Now it classifies by cadence-playbook presence (mirroring how
+ * row 3b classifies by allowlist presence):
+ *
+ *   Role present in triggers allowlist            → PASS (cadence named in detail)
+ *   Absent from allowlist + cadence playbook      → FAIL (real gap)
+ *   Absent from allowlist + no cadence playbook   → SKIP (dispatch-driven by design)
+ *   Triggers allowlist unreadable                 → TOOLING-ERROR
+ *
+ * `playbookFiles` is pre-fetched by the caller (commands/preflight.ts) and passed in,
+ * the same way row 3b receives the triggers allowlist from row 4c's fetch.
+ */
+import type { PreflightRow } from './schema.js';
+export declare function checkRow4Ssm(opts: {
+    env: string;
+    /** Agent display name — retained for API compat; allowlist checks use roleSlug. */
+    agentName: string;
+    /** Role slug checked in all three SSM parameters. */
+    roleSlug: string;
+    region?: string;
+    /**
+     * Playbook filenames in the role's workspace directory, pre-fetched by the caller.
+     * Used by row 4c to classify SKIP vs FAIL when the role is absent from the triggers
+     * allowlist — symmetric with row 3b receiving the triggers allowlist from row 4c.
+     *
+     * `string[]`     — list of playbook-*.md files; empty means no playbooks at all.
+     * `'unavailable'` — gh CLI not available / read failed; row 4c conservatively FAILs.
+     * `undefined`    — not provided; row 4c conservatively FAILs (same as unavailable).
+     */
+    playbookFiles?: string[] | 'unavailable';
+}): Promise<{
+    rows: PreflightRow[];
+    triggersAllowlist: string[] | 'unavailable';
+}>;

package/dist/preflight/row4_ssm.js

@@ -0,0 +1,235 @@
+/**
+ * F53 Rows 4a/4b/4c — SSM allowlist checks.
+ *
+ * Checks that the role appears in the three Fazemos SSM parameters:
+ *   4a — /fazemos/<env>/wake/allowlist          (comma-separated role slugs)
+ *   4b — /fazemos/<env>/wake/auto-wakeable-roles (comma-separated role slugs)
+ *   4c — /fazemos/<env>/triggers/allowlist       (role:cadence pairs, e.g. "project-manager:daily")
+ *
+ * All three rows look up the **role slug** — NOT the agent/filler name.
+ * Row 4c entries use a `role:cadence` format; only the role portion is compared,
+ * and the cadence is surfaced in the PASS detail for operator visibility.
+ *
+ * Uses the `aws ssm get-parameter` CLI (consistent with existing shell-out pattern
+ * in index.ts for wait-for-pipeline). Operator credentials required.
+ *
+ * On AWS credential failure → tooling_error with fix instruction (aws sso login).
+ * On access denied → tooling_error.
+ * On parameter not found → fail with fix command (aws ssm put-parameter ...).
+ *
+ * `triggersAllowlist` returns bare role slugs (`:cadence` suffix stripped) so that
+ * row3_playbook.ts's `triggersAllowlist.includes(roleSlug)` check works correctly.
+ *
+ * r3.3 — Row 4c polarity fix (2026-08-20):
+ * Row 4c is now symmetric with row 3b. Previously it FAILed any role absent from the
+ * triggers allowlist. Now it classifies by cadence-playbook presence (mirroring how
+ * row 3b classifies by allowlist presence):
+ *
+ *   Role present in triggers allowlist            → PASS (cadence named in detail)
+ *   Absent from allowlist + cadence playbook      → FAIL (real gap)
+ *   Absent from allowlist + no cadence playbook   → SKIP (dispatch-driven by design)
+ *   Triggers allowlist unreadable                 → TOOLING-ERROR
+ *
+ * `playbookFiles` is pre-fetched by the caller (commands/preflight.ts) and passed in,
+ * the same way row 3b receives the triggers allowlist from row 4c's fetch.
+ */
+import { execSync } from 'child_process';
+/**
+ * Determine whether the role has a cadence (daily/weekly) playbook.
+ *
+ * Returns `true` if the list contains a playbook-daily.md or playbook-weekly.md,
+ * or if the list is `'unavailable'` / `undefined` (conservative — treat unknown
+ * as potentially cadence-bearing so we FAIL rather than silently SKIP).
+ *
+ * Returns `false` when the caller confirms no cadence playbook exists (empty array
+ * or array containing only task/other playbooks), enabling row 4c to SKIP.
+ */
+function hasCadencePlaybookFile(playbookFiles) {
+    if (playbookFiles === 'unavailable' || playbookFiles === undefined) {
+        // Conservative: cannot determine playbook state → treat as requiring a trigger.
+        return true;
+    }
+    const cadencePattern = /^playbook-(daily|weekly)\.md$/;
+    return playbookFiles.some((f) => cadencePattern.test(f));
+}
+function runSsmGetParameter(paramName, region) {
+    const regionFlag = region ? `--region ${region}` : '';
+    try {
+        const output = execSync(`aws ssm get-parameter --name "${paramName}" --query Parameter.Value --output text ${regionFlag}`.trim(), { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+        return output;
+    }
+    catch (err) {
+        const stderr = String(err.stderr ?? '');
+        if (stderr.includes('ParameterNotFound') || stderr.includes('parameter not found')) {
+            return null; // Parameter doesn't exist
+        }
+        throw err; // Re-throw for credential / access errors
+    }
+}
+function parseAllowList(value) {
+    return value
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+/**
+ * Check whether `needle` is present in `list`.
+ *
+ * For row 4c (role:cadence format), pass `entryKeyExtractor: (e) => e.split(':')[0]`
+ * so that "project-manager:daily" matches needle "project-manager".
+ *
+ * Returns `{ found, matchedEntry }` so callers can surface the full entry
+ * (e.g. "project-manager:daily") in PASS detail output.
+ */
+function checkMembership(list, needle, entryKeyExtractor) {
+    const normNeedle = needle.toLowerCase().replace(/[-_\s]+/g, '-');
+    for (const item of list) {
+        const key = entryKeyExtractor ? entryKeyExtractor(item) : item;
+        const normKey = key.toLowerCase().replace(/[-_\s]+/g, '-');
+        if (normKey === normNeedle) {
+            return { found: true, matchedEntry: item };
+        }
+    }
+    return { found: false };
+}
+export async function checkRow4Ssm(opts) {
+    const { env, roleSlug, region } = opts;
+    let triggersAllowlistValue = 'unavailable';
+    const checks = [
+        {
+            id: '4a',
+            name: 'SSM wake allowlist',
+            paramPath: `/fazemos/${env}/wake/allowlist`,
+            // FIX: parameter holds role slugs, not agent names (matches row 4b pattern).
+            needle: roleSlug,
+            needleLabel: `role '${roleSlug}'`,
+        },
+        {
+            id: '4b',
+            name: 'SSM auto-wakeable-roles allowlist',
+            paramPath: `/fazemos/${env}/wake/auto-wakeable-roles`,
+            needle: roleSlug,
+            needleLabel: `role '${roleSlug}'`,
+        },
+        {
+            id: '4c',
+            name: 'SSM triggers allowlist',
+            paramPath: `/fazemos/${env}/triggers/allowlist`,
+            needle: roleSlug,
+            needleLabel: `role '${roleSlug}'`,
+            // FIX: entries are "role:cadence" — compare only the role portion before the colon.
+            entryKeyExtractor: (entry) => entry.split(':')[0],
+            // When appending a new entry, include the default cadence suffix.
+            newEntryValue: `${roleSlug}:daily`,
+        },
+    ];
+    const results = [];
+    for (const check of checks) {
+        let paramValue;
+        try {
+            paramValue = runSsmGetParameter(check.paramPath, region);
+        }
+        catch (err) {
+            const stderr = String(err.stderr ?? err.message ?? '');
+            const isCredentialError = stderr.includes('Unable to locate credentials') ||
+                stderr.includes('ExpiredToken') ||
+                stderr.includes('NoCredentialProviders') ||
+                stderr.includes('AccessDenied') ||
+                stderr.includes('not authorized');
+            results.push({
+                id: check.id,
+                name: check.name,
+                status: 'tooling_error',
+                detail: isCredentialError
+                    ? `AWS credentials unavailable or expired: ${stderr.split('\n')[0].trim()}`
+                    : `aws ssm get-parameter failed: ${stderr.split('\n')[0].trim()}`,
+                fix_command: null,
+                fix_instruction: 'Run: aws sso login --profile AdministratorAccess-047982206554',
+            });
+            continue;
+        }
+        if (paramValue === null) {
+            // Parameter does not exist at all.
+            // Capture empty list for row3b (no entries = no cadence-bearing roles configured).
+            if (check.id === '4c') {
+                triggersAllowlistValue = [];
+                // r3.3: SKIP if dispatch-driven (no cadence playbook); FAIL only if a cadence
+                // playbook exists that would fire with no trigger entry.
+                if (!hasCadencePlaybookFile(opts.playbookFiles)) {
+                    results.push({
+                        id: check.id,
+                        name: check.name,
+                        status: 'skip',
+                        detail: `Parameter ${check.paramPath} does not exist — ` +
+                            `role '${check.needle}' is dispatch-driven; cadence trigger not required by design.`,
+                        fix_command: null,
+                    });
+                    continue;
+                }
+            }
+            const valueToAdd = check.newEntryValue ?? check.needle;
+            results.push({
+                id: check.id,
+                name: check.name,
+                status: 'fail',
+                detail: `Parameter ${check.paramPath} does not exist.`,
+                fix_command: `aws ssm put-parameter --name "${check.paramPath}" --value "${valueToAdd}" ` +
+                    `--type String --overwrite` +
+                    (region ? ` --region ${region}` : ''),
+            });
+            continue;
+        }
+        const list = parseAllowList(paramValue);
+        const { found, matchedEntry } = checkMembership(list, check.needle, check.entryKeyExtractor);
+        if (!found) {
+            // Parameter exists but role not present.
+            if (check.id === '4c') {
+                // Return bare role slugs (strip :cadence) for row3b's includes() check.
+                triggersAllowlistValue = list.map((e) => check.entryKeyExtractor(e));
+                // r3.3: SKIP if dispatch-driven (no cadence playbook); FAIL only when the role
+                // has a cadence playbook that will fire with no entry in the triggers allowlist.
+                if (!hasCadencePlaybookFile(opts.playbookFiles)) {
+                    results.push({
+                        id: check.id,
+                        name: check.name,
+                        status: 'skip',
+                        detail: `${check.needleLabel} not in ${check.paramPath} — ` +
+                            `role is dispatch-driven; cadence trigger not required by design.`,
+                        fix_command: null,
+                    });
+                    continue;
+                }
+            }
+            const valueToAdd = check.newEntryValue ?? check.needle;
+            const newValue = [...list, valueToAdd].join(',');
+            results.push({
+                id: check.id,
+                name: check.name,
+                status: 'fail',
+                detail: `${check.needleLabel} not in ${check.paramPath} (current: [${list.join(', ')}]).`,
+                fix_command: `aws ssm put-parameter --name "${check.paramPath}" --value "${newValue}" ` +
+                    `--type String --overwrite` +
+                    (region ? ` --region ${region}` : ''),
+            });
+        }
+        else {
+            if (check.id === '4c') {
+                // Return bare role slugs (strip :cadence) for row3b's includes() check.
+                triggersAllowlistValue = list.map((e) => check.entryKeyExtractor(e));
+            }
+            results.push({
+                id: check.id,
+                name: check.name,
+                status: 'pass',
+                // For 4c: surface the full "role:cadence" matched entry — cadence is useful
+                // operator information (shows which schedule governs this role's auto-wake).
+                detail: matchedEntry !== undefined && matchedEntry !== check.needle
+                    ? `${check.needleLabel} found in ${check.paramPath} as '${matchedEntry}'`
+                    : `${check.needleLabel} found in ${check.paramPath}`,
+                fix_command: null,
+            });
+        }
+    }
+    return { rows: results, triggersAllowlist: triggersAllowlistValue };
+}
+//# sourceMappingURL=row4_ssm.js.map

package/dist/preflight/row4_ssm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row4_ssm.js","sourceRoot":"","sources":["../../src/preflight/row4_ssm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAAC,aAAmD;IACjF,IAAI,aAAa,KAAK,aAAa,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACnE,gFAAgF;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,cAAc,GAAG,+BAA+B,CAAC;IACvD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB,EAAE,MAAe;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CACrB,iCAAiC,SAAS,2CAA2C,UAAU,EAAE,CAAC,IAAI,EAAE,EACxG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACnF,OAAO,IAAI,CAAC,CAAC,0BAA0B;QACzC,CAAC;QACD,MAAM,GAAG,CAAC,CAAC,0CAA0C;IACvD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,IAAc,EACd,MAAc,EACd,iBAA6C;IAE7C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAiBlC;IACC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEvC,IAAI,sBAAsB,GAA6B,aAAa,CAAC;IAErE,MAAM,MAAM,GAAqB;QAC/B;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,oBAAoB;YAC1B,SAAS,EAAE,YAAY,GAAG,iBAAiB;YAC3C,6EAA6E;YAC7E,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,SAAS,QAAQ,GAAG;SAClC;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,mCAAmC;YACzC,SAAS,EAAE,YAAY,GAAG,2BAA2B;YACrD,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,SAAS,QAAQ,GAAG;SAClC;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,wBAAwB;YAC9B,SAAS,EAAE,YAAY,GAAG,qBAAqB;YAC/C,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,SAAS,QAAQ,GAAG;YACjC,oFAAoF;YACpF,iBAAiB,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzD,kEAAkE;YAClE,aAAa,EAAE,GAAG,QAAQ,QAAQ;SACnC;KACF,CAAC;IAEF,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,UAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,iBAAiB,GACrB,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC;gBAC/C,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAC/B,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gBACxC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAC/B,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,iBAAiB;oBACvB,CAAC,CAAC,2CAA2C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;oBAC3E,CAAC,CAAC,iCAAiC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;gBACnE,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,+DAA+D;aACjF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,mCAAmC;YACnC,mFAAmF;YACnF,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBACtB,sBAAsB,GAAG,EAAE,CAAC;gBAC5B,8EAA8E;gBAC9E,yDAAyD;gBACzD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;oBAChD,OAAO,CAAC,IAAI,CAAC;wBACX,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,MAAM,EAAE,MAAM;wBACd,MAAM,EACJ,aAAa,KAAK,CAAC,SAAS,oBAAoB;4BAChD,SAAS,KAAK,CAAC,MAAM,+DAA+D;wBACtF,WAAW,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,aAAa,KAAK,CAAC,SAAS,kBAAkB;gBACtD,WAAW,EACT,iCAAiC,KAAK,CAAC,SAAS,cAAc,UAAU,IAAI;oBAC5E,2BAA2B;oBAC3B,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAE7F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,yCAAyC;YACzC,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBACtB,wEAAwE;gBACxE,sBAAsB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtE,+EAA+E;gBAC/E,iFAAiF;gBACjF,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;oBAChD,OAAO,CAAC,IAAI,CAAC;wBACX,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,MAAM,EAAE,MAAM;wBACd,MAAM,EACJ,GAAG,KAAK,CAAC,WAAW,WAAW,KAAK,CAAC,SAAS,KAAK;4BACnD,kEAAkE;wBACpE,WAAW,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;YACvD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,WAAW,KAAK,CAAC,SAAS,eAAe,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBACzF,WAAW,EACT,iCAAiC,KAAK,CAAC,SAAS,cAAc,QAAQ,IAAI;oBAC1E,2BAA2B;oBAC3B,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBACtB,wEAAwE;gBACxE,sBAAsB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM;gBACd,4EAA4E;gBAC5E,6EAA6E;gBAC7E,MAAM,EACJ,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,KAAK,CAAC,MAAM;oBACzD,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,aAAa,KAAK,CAAC,SAAS,QAAQ,YAAY,GAAG;oBACzE,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,aAAa,KAAK,CAAC,SAAS,EAAE;gBACxD,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;AACtE,CAAC"}

package/dist/preflight/row5_workerLambdaWakeConfig.d.ts

@@ -0,0 +1,20 @@
+/**
+ * F53 Row 5 — Worker Lambda wake config check.
+ *
+ * For each Lambda in PREFLIGHT_WORKER_LAMBDAS, verifies that the function's
+ * environment variables include the required wake/SSM config keys
+ * (WAKE_ALLOWLIST_PARAM, etc.) — the BUG153 gap.
+ *
+ * Uses `aws lambda get-function-configuration --function-name <name>`
+ * (shells out via execSync, consistent with existing CLI pattern).
+ *
+ * D2: enumeration is hard-coded with visible staleness (printed on every run).
+ *
+ * Fix line for row 5 FAILs: honest docs-link (no fake executable command —
+ * Ollie A3, rul_f53_fix_command_honesty).
+ */
+import type { PreflightRow } from './schema.js';
+export declare function checkRow5WorkerLambdaWakeConfig(opts: {
+    env: string;
+    region?: string;
+}): Promise<PreflightRow>;