@webpieces/nx-webpieces-rules 0.4.465 → 0.4.467

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/nx-webpieces-rules",
-  "version": "0.4.465",
+  "version": "0.4.467",
   "description": "Nx-specific webpieces validation rules and graph tooling. Bundles all @webpieces rule packages with Nx graph validators and an inference plugin.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -21,11 +21,11 @@
     "README.md"
   ],
   "dependencies": {
-    "@webpieces/ai-hook-rules": "0.4.465",
-    "@webpieces/code-rules": "0.4.465",
-    "@webpieces/eslint-rules": "0.4.465",
-    "@webpieces/pr-gate": "0.4.465",
-    "@webpieces/rules-config": "0.4.465",
+    "@webpieces/ai-hook-rules": "0.4.467",
+    "@webpieces/code-rules": "0.4.467",
+    "@webpieces/eslint-rules": "0.4.467",
+    "@webpieces/pr-gate": "0.4.467",
+    "@webpieces/rules-config": "0.4.467",
     "madge": "8.0.0"
   },
   "peerDependencies": {

package/src/executors/validate-architecture-unchanged/executor.js

@@ -17,6 +17,7 @@ const graph_comparator_1 = require("../../lib/graph-comparator");
 const graph_loader_1 = require("../../lib/graph-loader");
 const graph_metadata_1 = require("../../lib/graph-metadata");
 const api_scanner_1 = require("../../lib/api-usage/api-scanner");
+const rule_gate_1 = require("../../lib/rule-gate");
 const toError_1 = require("../../toError");
 const TMP_MD_FILE = 'webpieces.dependencies.md';
 /**
@@ -64,6 +65,11 @@ async function buildCurrentGraph(workspaceRoot) {
 async function runExecutor(options, context) {
     const graphPath = options.graphPath;
     const workspaceRoot = context.root;
+    // Epoch-gateable: this rule diffs against the blessed architecture/dependencies.json, so
+    // "grandfather the current drift until <epoch>" is meaningful — hence honorEpoch = true.
+    if (new rule_gate_1.RuleGate().isDisabled(workspaceRoot, 'validate-architecture-unchanged', true)) {
+        return { success: true };
+    }
     console.log('\n🔍 Validating Architecture Unchanged\n');
     // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
     try {

package/src/executors/validate-architecture-unchanged/executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/nx-webpieces-rules/src/executors/validate-architecture-unchanged/executor.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAsEH,8BAwDC;AA3HD,0DAAwD;AACxD,+DAAiE;AACjE,yDAAgE;AAChE,iEAA2D;AAC3D,yDAA2E;AAC3E,6DAAoG;AACpG,iEAA4E;AAE5E,2CAAwC;AAUxC,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD;;;GAGG;AACH,SAAS,wBAAwB,CAAC,aAAqB;IACnD,MAAM,MAAM,GAAG,IAAA,4BAAa,EAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAEzD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,aAAqB;IAC1D,MAAM,MAAM,GAAG,wBAAwB,CAAC,aAAa,CAAC,CAAC;IAEvD,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,MAAM,GAAG,wCAAwC,CAAC,CAAC;IACvF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACpH,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,oIAAoI;AACpI,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAClD,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,MAAM,IAAA,sCAAoB,GAAE,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAA,qCAAsB,EAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,MAAM,IAAA,mCAAkB,GAAE,CAAC;IAChD,IAAA,4BAAW,EAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,IAAA,uCAAyB,EAAC,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IACrE,OAAO,YAAY,CAAC;AACxB,CAAC;AAEc,KAAK,UAAU,WAAW,CACrC,OAA6C,EAC7C,OAAwB;IAExB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAEnC,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAExD,8DAA8D;IAC9D,IAAI,CAAC;QACD,8BAA8B;QAC9B,IAAI,CAAC,IAAA,8BAAe,EAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC1E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC;YACrG,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QAED,wEAAwE;QACxE,2CAA2C;QAC3C,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAE5D,2BAA2B;QAC3B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAA,+BAAgB,EAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QAED,yBAAyB;QACzB,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAA,gCAAa,EAAC,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEpE,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QACD,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,iBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,KAAK,YAAY,wCAAuB,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAA,4BAAa,EAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;YAC7E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,MAAM,GAAG,qDAAqD,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACL,CAAC","sourcesContent":["/**\n * Validate Architecture Unchanged Executor\n *\n * Validates that the current architecture graph matches the saved blessed graph.\n * This ensures no unapproved architecture changes have been made.\n *\n * Usage:\n * nx run architecture:validate-architecture-unchanged\n */\n\nimport type { ExecutorContext } from '@nx/devkit';\nimport { writeTemplate } from '@webpieces/rules-config';\nimport { generateReducedGraph } from '../../lib/graph-generator';\nimport { sortGraphTopologically } from '../../lib/graph-sorter';\nimport { compareGraphs } from '../../lib/graph-comparator';\nimport { loadBlessedGraph, graphFileExists } from '../../lib/graph-loader';\nimport { collectProjectInfo, enrichGraph, MetadataValidationError } from '../../lib/graph-metadata';\nimport { scanAndAttachApiRelations } from '../../lib/api-usage/api-scanner';\nimport type { EnhancedGraph } from '../../lib/graph-sorter';\nimport { toError } from '../../toError';\n\nexport interface ValidateArchitectureUnchangedOptions {\n    graphPath?: string;\n}\n\nexport interface ExecutorResult {\n    success: boolean;\n}\n\nconst TMP_MD_FILE = 'webpieces.dependencies.md';\n\n/**\n * Write the instructions documentation to .webpieces/instruct-ai/.\n * Sourced from @webpieces/rules-config.\n */\nfunction writeTmpInstructionsFile(workspaceRoot: string): string {\n    const mdPath = writeTemplate(workspaceRoot, TMP_MD_FILE);\n\n    return mdPath;\n}\n\n/**\n * Report a current-vs-saved graph mismatch and write the AI instructions file.\n */\nfunction reportMismatch(summary: string, workspaceRoot: string): void {\n    const mdPath = writeTmpInstructionsFile(workspaceRoot);\n\n    console.error('❌ Architecture has changed since last update!');\n    console.error('\\nDifferences:');\n    console.error(summary);\n    console.error('');\n    console.error('⚠️  *** Refer to ' + mdPath + ' for instructions on how to fix *** ⚠️');\n    console.error('');\n    console.error('To fix:');\n    console.error('  1. Review the changes above');\n    console.error('  2. If intentional, ASK USER to run: nx run architecture:generate since this is a critical change');\n    console.error('  3. Commit the updated architecture/dependencies.json');\n}\n\n/**\n * Build the current dependency graph exactly as the generator does: reduce the nx\n * graph, sort into levels, enrich with metadata, and attach the derived\n * apiRelations — so this validator compares like-for-like against the committed file.\n */\n// webpieces-disable no-function-outside-class -- executor step helper, matches reportMismatch/writeTmpInstructionsFile in this file\nasync function buildCurrentGraph(workspaceRoot: string): Promise<EnhancedGraph> {\n    console.log('📊 Generating current dependency graph...');\n    const reducedGraph = await generateReducedGraph();\n    console.log('🔄 Computing topological layers...');\n    const currentGraph = sortGraphTopologically(reducedGraph);\n    console.log('🏷️  Enriching graph with framework + responsibilities metadata...');\n    const projectInfos = await collectProjectInfo();\n    enrichGraph(currentGraph, projectInfos, workspaceRoot);\n    console.log('🔎 Scanning source for implements/uses API relations...');\n    scanAndAttachApiRelations(workspaceRoot, currentGraph, projectInfos);\n    return currentGraph;\n}\n\nexport default async function runExecutor(\n    options: ValidateArchitectureUnchangedOptions,\n    context: ExecutorContext\n): Promise<ExecutorResult> {\n    const graphPath = options.graphPath;\n    const workspaceRoot = context.root;\n\n    console.log('\\n🔍 Validating Architecture Unchanged\\n');\n\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Check if saved graph exists\n        if (!graphFileExists(workspaceRoot, graphPath)) {\n            console.error('❌ No saved graph found at architecture/dependencies.json');\n            console.error('');\n            console.error('To initialize:');\n            console.error('  1. Run: nx run architecture:generate');\n            console.error('  2. Run: nx run architecture:visualize');\n            console.error('  3. Manually inspect the generated graph to confirm it is the desired architecture');\n            console.error('  4. Commit architecture/dependencies.json');\n            return { success: false };\n        }\n\n        // Steps 1-3: build + enrich + scan the current graph (same pipeline the\n        // generator runs, so any drift is caught).\n        const currentGraph = await buildCurrentGraph(workspaceRoot);\n\n        // Step 4: Load saved graph\n        console.log('📂 Loading saved graph...');\n        const savedGraph = loadBlessedGraph(workspaceRoot, graphPath);\n\n        if (!savedGraph) {\n            console.error('❌ Could not load saved graph');\n            return { success: false };\n        }\n\n        // Step 5: Compare graphs\n        console.log('🔍 Comparing current graph to saved graph...');\n        const comparison = compareGraphs(currentGraph, savedGraph.projects);\n\n        if (comparison.identical) {\n            console.log('✅ Architecture unchanged - current graph matches saved graph');\n            return { success: true };\n        }\n        reportMismatch(comparison.summary, workspaceRoot);\n        return { success: false };\n    } catch (err: unknown) {\n        const error = toError(err);\n        console.error('❌ Architecture validation failed:', error.message);\n        if (error instanceof MetadataValidationError) {\n            const mdPath = writeTemplate(workspaceRoot, 'webpieces.responsibilities.md');\n            console.error('');\n            console.error('⚠️  *** Refer to ' + mdPath + ' for how to author responsibilities.md files *** ⚠️');\n        }\n        return { success: false };\n    }\n}\n"]}
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/nx-webpieces-rules/src/executors/validate-architecture-unchanged/executor.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAuEH,8BA8DC;AAlID,0DAAwD;AACxD,+DAAiE;AACjE,yDAAgE;AAChE,iEAA2D;AAC3D,yDAA2E;AAC3E,6DAAoG;AACpG,iEAA4E;AAC5E,mDAA+C;AAE/C,2CAAwC;AAUxC,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAEhD;;;GAGG;AACH,SAAS,wBAAwB,CAAC,aAAqB;IACnD,MAAM,MAAM,GAAG,IAAA,4BAAa,EAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAEzD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,aAAqB;IAC1D,MAAM,MAAM,GAAG,wBAAwB,CAAC,aAAa,CAAC,CAAC;IAEvD,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,MAAM,GAAG,wCAAwC,CAAC,CAAC;IACvF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/C,OAAO,CAAC,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACpH,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,oIAAoI;AACpI,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAClD,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,MAAM,IAAA,sCAAoB,GAAE,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAA,qCAAsB,EAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,MAAM,IAAA,mCAAkB,GAAE,CAAC;IAChD,IAAA,4BAAW,EAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,IAAA,uCAAyB,EAAC,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IACrE,OAAO,YAAY,CAAC;AACxB,CAAC;AAEc,KAAK,UAAU,WAAW,CACrC,OAA6C,EAC7C,OAAwB;IAExB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAEnC,yFAAyF;IACzF,yFAAyF;IACzF,IAAI,IAAI,oBAAQ,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,iCAAiC,EAAE,IAAI,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAExD,8DAA8D;IAC9D,IAAI,CAAC;QACD,8BAA8B;QAC9B,IAAI,CAAC,IAAA,8BAAe,EAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC1E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC;YACrG,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QAED,wEAAwE;QACxE,2CAA2C;QAC3C,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAE5D,2BAA2B;QAC3B,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAA,+BAAgB,EAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QAED,yBAAyB;QACzB,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAA,gCAAa,EAAC,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEpE,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QACD,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,iBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,KAAK,YAAY,wCAAuB,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAA,4BAAa,EAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;YAC7E,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,MAAM,GAAG,qDAAqD,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACL,CAAC","sourcesContent":["/**\n * Validate Architecture Unchanged Executor\n *\n * Validates that the current architecture graph matches the saved blessed graph.\n * This ensures no unapproved architecture changes have been made.\n *\n * Usage:\n * nx run architecture:validate-architecture-unchanged\n */\n\nimport type { ExecutorContext } from '@nx/devkit';\nimport { writeTemplate } from '@webpieces/rules-config';\nimport { generateReducedGraph } from '../../lib/graph-generator';\nimport { sortGraphTopologically } from '../../lib/graph-sorter';\nimport { compareGraphs } from '../../lib/graph-comparator';\nimport { loadBlessedGraph, graphFileExists } from '../../lib/graph-loader';\nimport { collectProjectInfo, enrichGraph, MetadataValidationError } from '../../lib/graph-metadata';\nimport { scanAndAttachApiRelations } from '../../lib/api-usage/api-scanner';\nimport { RuleGate } from '../../lib/rule-gate';\nimport type { EnhancedGraph } from '../../lib/graph-sorter';\nimport { toError } from '../../toError';\n\nexport interface ValidateArchitectureUnchangedOptions {\n    graphPath?: string;\n}\n\nexport interface ExecutorResult {\n    success: boolean;\n}\n\nconst TMP_MD_FILE = 'webpieces.dependencies.md';\n\n/**\n * Write the instructions documentation to .webpieces/instruct-ai/.\n * Sourced from @webpieces/rules-config.\n */\nfunction writeTmpInstructionsFile(workspaceRoot: string): string {\n    const mdPath = writeTemplate(workspaceRoot, TMP_MD_FILE);\n\n    return mdPath;\n}\n\n/**\n * Report a current-vs-saved graph mismatch and write the AI instructions file.\n */\nfunction reportMismatch(summary: string, workspaceRoot: string): void {\n    const mdPath = writeTmpInstructionsFile(workspaceRoot);\n\n    console.error('❌ Architecture has changed since last update!');\n    console.error('\\nDifferences:');\n    console.error(summary);\n    console.error('');\n    console.error('⚠️  *** Refer to ' + mdPath + ' for instructions on how to fix *** ⚠️');\n    console.error('');\n    console.error('To fix:');\n    console.error('  1. Review the changes above');\n    console.error('  2. If intentional, ASK USER to run: nx run architecture:generate since this is a critical change');\n    console.error('  3. Commit the updated architecture/dependencies.json');\n}\n\n/**\n * Build the current dependency graph exactly as the generator does: reduce the nx\n * graph, sort into levels, enrich with metadata, and attach the derived\n * apiRelations — so this validator compares like-for-like against the committed file.\n */\n// webpieces-disable no-function-outside-class -- executor step helper, matches reportMismatch/writeTmpInstructionsFile in this file\nasync function buildCurrentGraph(workspaceRoot: string): Promise<EnhancedGraph> {\n    console.log('📊 Generating current dependency graph...');\n    const reducedGraph = await generateReducedGraph();\n    console.log('🔄 Computing topological layers...');\n    const currentGraph = sortGraphTopologically(reducedGraph);\n    console.log('🏷️  Enriching graph with framework + responsibilities metadata...');\n    const projectInfos = await collectProjectInfo();\n    enrichGraph(currentGraph, projectInfos, workspaceRoot);\n    console.log('🔎 Scanning source for implements/uses API relations...');\n    scanAndAttachApiRelations(workspaceRoot, currentGraph, projectInfos);\n    return currentGraph;\n}\n\nexport default async function runExecutor(\n    options: ValidateArchitectureUnchangedOptions,\n    context: ExecutorContext\n): Promise<ExecutorResult> {\n    const graphPath = options.graphPath;\n    const workspaceRoot = context.root;\n\n    // Epoch-gateable: this rule diffs against the blessed architecture/dependencies.json, so\n    // \"grandfather the current drift until <epoch>\" is meaningful — hence honorEpoch = true.\n    if (new RuleGate().isDisabled(workspaceRoot, 'validate-architecture-unchanged', true)) {\n        return { success: true };\n    }\n\n    console.log('\\n🔍 Validating Architecture Unchanged\\n');\n\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Check if saved graph exists\n        if (!graphFileExists(workspaceRoot, graphPath)) {\n            console.error('❌ No saved graph found at architecture/dependencies.json');\n            console.error('');\n            console.error('To initialize:');\n            console.error('  1. Run: nx run architecture:generate');\n            console.error('  2. Run: nx run architecture:visualize');\n            console.error('  3. Manually inspect the generated graph to confirm it is the desired architecture');\n            console.error('  4. Commit architecture/dependencies.json');\n            return { success: false };\n        }\n\n        // Steps 1-3: build + enrich + scan the current graph (same pipeline the\n        // generator runs, so any drift is caught).\n        const currentGraph = await buildCurrentGraph(workspaceRoot);\n\n        // Step 4: Load saved graph\n        console.log('📂 Loading saved graph...');\n        const savedGraph = loadBlessedGraph(workspaceRoot, graphPath);\n\n        if (!savedGraph) {\n            console.error('❌ Could not load saved graph');\n            return { success: false };\n        }\n\n        // Step 5: Compare graphs\n        console.log('🔍 Comparing current graph to saved graph...');\n        const comparison = compareGraphs(currentGraph, savedGraph.projects);\n\n        if (comparison.identical) {\n            console.log('✅ Architecture unchanged - current graph matches saved graph');\n            return { success: true };\n        }\n        reportMismatch(comparison.summary, workspaceRoot);\n        return { success: false };\n    } catch (err: unknown) {\n        const error = toError(err);\n        console.error('❌ Architecture validation failed:', error.message);\n        if (error instanceof MetadataValidationError) {\n            const mdPath = writeTemplate(workspaceRoot, 'webpieces.responsibilities.md');\n            console.error('');\n            console.error('⚠️  *** Refer to ' + mdPath + ' for how to author responsibilities.md files *** ⚠️');\n        }\n        return { success: false };\n    }\n}\n"]}

package/src/executors/validate-eslint-sync/executor.js

@@ -4,6 +4,7 @@ exports.default = validateEslintSyncExecutor;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
+const rule_gate_1 = require("../../lib/rule-gate");
 function calculateHash(content) {
     return (0, crypto_1.createHash)('sha256').update(content).digest('hex');
 }
@@ -13,6 +14,10 @@ function normalizeContent(content) {
 }
 async function validateEslintSyncExecutor(options, context) {
     const workspaceRoot = context.root;
+    // All-or-nothing (honorEpoch = false): the two files either match or they do not.
+    if (new rule_gate_1.RuleGate().isDisabled(workspaceRoot, 'validate-eslint-sync', false)) {
+        return { success: true };
+    }
     const templatePath = (0, path_1.join)(workspaceRoot, 'packages/tooling/nx-webpieces-rules/templates/eslint.webpieces.config.mjs');
     const workspacePath = (0, path_1.join)(workspaceRoot, 'eslint.webpieces.config.mjs');
     // eslint-disable-next-line @webpieces/no-unmanaged-exceptions

package/src/executors/validate-eslint-sync/executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/nx-webpieces-rules/src/executors/validate-eslint-sync/executor.ts"],"names":[],"mappings":";;AAoBA,6CAkCC;AArDD,2BAAkC;AAClC,+BAA4B;AAC5B,mCAAoC;AAQpC,SAAS,aAAa,CAAC,OAAe;IAClC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACrC,6CAA6C;IAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAEc,KAAK,UAAU,0BAA0B,CACpD,OAAkC,EAClC,OAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAEnC,MAAM,YAAY,GAAG,IAAA,WAAI,EAAC,aAAa,EAAE,2EAA2E,CAAC,CAAC;IACtH,MAAM,aAAa,GAAG,IAAA,WAAI,EAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;IAEzE,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,eAAe,GAAG,IAAA,iBAAY,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,IAAA,iBAAY,EAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9D,MAAM,aAAa,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAE7D,MAAM,YAAY,GAAG,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;QAEtE,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;YACjC,oBAAoB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE7B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,kDAAkD;QAClD,0DAA0D;QAC1D,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,aAAqB;IACrE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9E,OAAO,CAAC,KAAK,CAAC,QAAQ,YAAY,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,QAAQ,aAAa,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACzE,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC3E,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACzE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;IACtG,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAC9G,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAClF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IACxC,mEAAmE;IACnE,wCAAwC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import type { ExecutorContext } from '@nx/devkit';\nimport { readFileSync } from 'fs';\nimport { join } from 'path';\nimport { createHash } from 'crypto';\n\nexport interface ValidateEslintSyncOptions {}\n\nexport interface ExecutorResult {\n    success: boolean;\n}\n\nfunction calculateHash(content: string): string {\n    return createHash('sha256').update(content).digest('hex');\n}\n\nfunction normalizeContent(content: string): string {\n    // Normalize line endings and trim whitespace\n    return content.replace(/\\r\\n/g, '\\n').trim();\n}\n\nexport default async function validateEslintSyncExecutor(\n    options: ValidateEslintSyncOptions,\n    context: ExecutorContext\n): Promise<ExecutorResult> {\n    const workspaceRoot = context.root;\n\n    const templatePath = join(workspaceRoot, 'packages/tooling/nx-webpieces-rules/templates/eslint.webpieces.config.mjs');\n    const workspacePath = join(workspaceRoot, 'eslint.webpieces.config.mjs');\n\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const templateContent = readFileSync(templatePath, 'utf-8');\n        const workspaceContent = readFileSync(workspacePath, 'utf-8');\n\n        const templateRules = extractRulesSection(templateContent);\n        const workspaceRules = extractRulesSection(workspaceContent);\n\n        const templateHash = calculateHash(normalizeContent(templateRules));\n        const workspaceHash = calculateHash(normalizeContent(workspaceRules));\n\n        if (templateHash !== workspaceHash) {\n            printValidationError(templatePath, workspacePath);\n            return { success: false };\n        }\n\n        console.log('✅ ESLint configuration sync validated - rules match!');\n        return { success: true };\n\n    } catch (err: unknown) {\n        // Error occurred during validation - log and fail\n        // eslint-disable-next-line @webpieces/catch-error-pattern\n        console.error('❌ Error validating ESLint sync:', err);\n        return { success: false };\n    }\n}\n\nfunction printValidationError(templatePath: string, workspacePath: string): void {\n    console.error('');\n    console.error('❌ ESLint configuration sync validation FAILED');\n    console.error('');\n    console.error('The @webpieces ESLint rules must be identical in both files:');\n    console.error(`  1. ${templatePath}`);\n    console.error(`  2. ${workspacePath}`);\n    console.error('');\n    console.error('These files must have identical rules sections so that:');\n    console.error('  - External clients get the same rules we use internally');\n    console.error('  - We \"eat our own dog food\" - same rules for everyone');\n    console.error('');\n    console.error('To fix:');\n    console.error('  1. Modify the rules in ONE file (recommend: templates/eslint.webpieces.config.mjs)');\n    console.error('  2. Copy the rules section to the other file');\n    console.error('  3. Keep import statements different (template uses npm, workspace uses loadWorkspaceRules)');\n    console.error('');\n    console.error('Customization for webpieces workspace goes in: eslint.config.mjs');\n    console.error('');\n}\n\nfunction extractRulesSection(content: string): string {\n    // Extract everything between \"export default [\" and the final \"];\"\n    // This includes the rules configuration\n    const match = content.match(/export default \\[([\\s\\S]*)\\];/);\n    if (!match) {\n        throw new Error('Could not extract rules section - export default not found');\n    }\n\n    return match[1].trim();\n}\n"]}
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/nx-webpieces-rules/src/executors/validate-eslint-sync/executor.ts"],"names":[],"mappings":";;AAqBA,6CAuCC;AA3DD,2BAAkC;AAClC,+BAA4B;AAC5B,mCAAoC;AACpC,mDAA+C;AAQ/C,SAAS,aAAa,CAAC,OAAe;IAClC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACrC,6CAA6C;IAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAEc,KAAK,UAAU,0BAA0B,CACpD,OAAkC,EAClC,OAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAEnC,kFAAkF;IAClF,IAAI,IAAI,oBAAQ,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,YAAY,GAAG,IAAA,WAAI,EAAC,aAAa,EAAE,2EAA2E,CAAC,CAAC;IACtH,MAAM,aAAa,GAAG,IAAA,WAAI,EAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;IAEzE,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,eAAe,GAAG,IAAA,iBAAY,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,IAAA,iBAAY,EAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9D,MAAM,aAAa,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAE7D,MAAM,YAAY,GAAG,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;QACpE,MAAM,aAAa,GAAG,aAAa,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;QAEtE,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;YACjC,oBAAoB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE7B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,kDAAkD;QAClD,0DAA0D;QAC1D,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB,EAAE,aAAqB;IACrE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9E,OAAO,CAAC,KAAK,CAAC,QAAQ,YAAY,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,QAAQ,aAAa,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACzE,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC3E,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACzE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;IACtG,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAC9G,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAClF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IACxC,mEAAmE;IACnE,wCAAwC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import type { ExecutorContext } from '@nx/devkit';\nimport { readFileSync } from 'fs';\nimport { join } from 'path';\nimport { createHash } from 'crypto';\nimport { RuleGate } from '../../lib/rule-gate';\n\nexport interface ValidateEslintSyncOptions {}\n\nexport interface ExecutorResult {\n    success: boolean;\n}\n\nfunction calculateHash(content: string): string {\n    return createHash('sha256').update(content).digest('hex');\n}\n\nfunction normalizeContent(content: string): string {\n    // Normalize line endings and trim whitespace\n    return content.replace(/\\r\\n/g, '\\n').trim();\n}\n\nexport default async function validateEslintSyncExecutor(\n    options: ValidateEslintSyncOptions,\n    context: ExecutorContext\n): Promise<ExecutorResult> {\n    const workspaceRoot = context.root;\n\n    // All-or-nothing (honorEpoch = false): the two files either match or they do not.\n    if (new RuleGate().isDisabled(workspaceRoot, 'validate-eslint-sync', false)) {\n        return { success: true };\n    }\n\n    const templatePath = join(workspaceRoot, 'packages/tooling/nx-webpieces-rules/templates/eslint.webpieces.config.mjs');\n    const workspacePath = join(workspaceRoot, 'eslint.webpieces.config.mjs');\n\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const templateContent = readFileSync(templatePath, 'utf-8');\n        const workspaceContent = readFileSync(workspacePath, 'utf-8');\n\n        const templateRules = extractRulesSection(templateContent);\n        const workspaceRules = extractRulesSection(workspaceContent);\n\n        const templateHash = calculateHash(normalizeContent(templateRules));\n        const workspaceHash = calculateHash(normalizeContent(workspaceRules));\n\n        if (templateHash !== workspaceHash) {\n            printValidationError(templatePath, workspacePath);\n            return { success: false };\n        }\n\n        console.log('✅ ESLint configuration sync validated - rules match!');\n        return { success: true };\n\n    } catch (err: unknown) {\n        // Error occurred during validation - log and fail\n        // eslint-disable-next-line @webpieces/catch-error-pattern\n        console.error('❌ Error validating ESLint sync:', err);\n        return { success: false };\n    }\n}\n\nfunction printValidationError(templatePath: string, workspacePath: string): void {\n    console.error('');\n    console.error('❌ ESLint configuration sync validation FAILED');\n    console.error('');\n    console.error('The @webpieces ESLint rules must be identical in both files:');\n    console.error(`  1. ${templatePath}`);\n    console.error(`  2. ${workspacePath}`);\n    console.error('');\n    console.error('These files must have identical rules sections so that:');\n    console.error('  - External clients get the same rules we use internally');\n    console.error('  - We \"eat our own dog food\" - same rules for everyone');\n    console.error('');\n    console.error('To fix:');\n    console.error('  1. Modify the rules in ONE file (recommend: templates/eslint.webpieces.config.mjs)');\n    console.error('  2. Copy the rules section to the other file');\n    console.error('  3. Keep import statements different (template uses npm, workspace uses loadWorkspaceRules)');\n    console.error('');\n    console.error('Customization for webpieces workspace goes in: eslint.config.mjs');\n    console.error('');\n}\n\nfunction extractRulesSection(content: string): string {\n    // Extract everything between \"export default [\" and the final \"];\"\n    // This includes the rules configuration\n    const match = content.match(/export default \\[([\\s\\S]*)\\];/);\n    if (!match) {\n        throw new Error('Could not extract rules section - export default not found');\n    }\n\n    return match[1].trim();\n}\n"]}

package/src/executors/validate-no-architecture-cycles/executor.d.ts

@@ -13,4 +13,4 @@ export interface ValidateNoCyclesOptions {
 export interface ExecutorResult {
     success: boolean;
 }
-export default function runExecutor(_options: ValidateNoCyclesOptions, _context: ExecutorContext): Promise<ExecutorResult>;
+export default function runExecutor(_options: ValidateNoCyclesOptions, context: ExecutorContext): Promise<ExecutorResult>;

package/src/executors/validate-no-architecture-cycles/executor.js

@@ -12,8 +12,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = runExecutor;
 const graph_generator_1 = require("../../lib/graph-generator");
 const graph_sorter_1 = require("../../lib/graph-sorter");
+const rule_gate_1 = require("../../lib/rule-gate");
 const toError_1 = require("../../toError");
-async function runExecutor(_options, _context) {
+async function runExecutor(_options, context) {
+    // Epoch-gateable: the existing cycle set can be grandfathered while a refactor lands, so this
+    // rule honors ignoreModifiedUntilEpoch / ignoreRuleWhileOnBranch in addition to mode: OFF.
+    if (new rule_gate_1.RuleGate().isDisabled(context.root, 'validate-no-architecture-cycles', true)) {
+        return { success: true };
+    }
     console.log('\n🔄 Validating No Circular Dependencies\n');
     // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
     try {

package/src/executors/validate-no-architecture-cycles/executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/nx-webpieces-rules/src/executors/validate-no-architecture-cycles/executor.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAeH,8BAuCC;AAnDD,+DAA0D;AAC1D,yDAAgE;AAChE,2CAAwC;AAUzB,KAAK,UAAU,WAAW,CACrC,QAAiC,EACjC,QAAyB;IAEzB,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAE1D,8DAA8D;IAC9D,IAAI,CAAC;QACD,yDAAyD;QACzD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,IAAA,+BAAa,GAAE,CAAC;QAEvC,+CAA+C;QAC/C,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,8DAA8D;QAC9D,IAAI,CAAC;YACD,IAAA,qCAAsB,EAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YAEpD,gBAAgB;YAChB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,iBAAiB,YAAY,wBAAwB,CAAC,CAAC;YAEnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,iBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,iBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACL,CAAC","sourcesContent":["/**\n * Validate No Architecture Cycles Executor\n *\n * Validates that the architecture dependency graph has no circular dependencies.\n * This is a fast check that only validates acyclicity at the project level.\n *\n * Usage:\n * nx run architecture:validate-no-architecture-cycles\n */\n\nimport type { ExecutorContext } from '@nx/devkit';\nimport { generateGraph } from '../../lib/graph-generator';\nimport { sortGraphTopologically } from '../../lib/graph-sorter';\nimport { toError } from '../../toError';\n\nexport interface ValidateNoCyclesOptions {\n    // No options needed\n}\n\nexport interface ExecutorResult {\n    success: boolean;\n}\n\nexport default async function runExecutor(\n    _options: ValidateNoCyclesOptions,\n    _context: ExecutorContext\n): Promise<ExecutorResult> {\n    console.log('\\n🔄 Validating No Circular Dependencies\\n');\n\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Step 1: Generate current graph from project.json files\n        console.log('📊 Generating dependency graph from project.json files...');\n        const rawGraph = await generateGraph();\n\n        // Step 2: Topological sort (validates acyclic)\n        console.log('🔄 Checking for cycles (topological sort)...');\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            sortGraphTopologically(rawGraph);\n            console.log('✅ No circular dependencies detected!');\n\n            // Print summary\n            const projectCount = Object.keys(rawGraph).length;\n            console.log(`\\n📈 Summary: ${projectCount} projects, all acyclic`);\n\n            return { success: true };\n        } catch (err: unknown) {\n            const error = toError(err);\n            console.error('❌ Circular dependency detected!');\n            console.error(error.message);\n            console.error('\\nTo fix:');\n            console.error('  1. Review the cycle above');\n            console.error('  2. Break the cycle by refactoring dependencies');\n            console.error('  3. Run this check again');\n            return { success: false };\n        }\n    } catch (err: unknown) {\n        const error = toError(err);\n        console.error('❌ Cycle validation failed:', error.message);\n        return { success: false };\n    }\n}\n"]}
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/nx-webpieces-rules/src/executors/validate-no-architecture-cycles/executor.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAgBH,8BA6CC;AA1DD,+DAA0D;AAC1D,yDAAgE;AAChE,mDAA+C;AAC/C,2CAAwC;AAUzB,KAAK,UAAU,WAAW,CACrC,QAAiC,EACjC,OAAwB;IAExB,8FAA8F;IAC9F,2FAA2F;IAC3F,IAAI,IAAI,oBAAQ,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,iCAAiC,EAAE,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAE1D,8DAA8D;IAC9D,IAAI,CAAC;QACD,yDAAyD;QACzD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,IAAA,+BAAa,GAAE,CAAC;QAEvC,+CAA+C;QAC/C,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC5D,8DAA8D;QAC9D,IAAI,CAAC;YACD,IAAA,qCAAsB,EAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YAEpD,gBAAgB;YAChB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,iBAAiB,YAAY,wBAAwB,CAAC,CAAC;YAEnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,iBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,iBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACL,CAAC","sourcesContent":["/**\n * Validate No Architecture Cycles Executor\n *\n * Validates that the architecture dependency graph has no circular dependencies.\n * This is a fast check that only validates acyclicity at the project level.\n *\n * Usage:\n * nx run architecture:validate-no-architecture-cycles\n */\n\nimport type { ExecutorContext } from '@nx/devkit';\nimport { generateGraph } from '../../lib/graph-generator';\nimport { sortGraphTopologically } from '../../lib/graph-sorter';\nimport { RuleGate } from '../../lib/rule-gate';\nimport { toError } from '../../toError';\n\nexport interface ValidateNoCyclesOptions {\n    // No options needed\n}\n\nexport interface ExecutorResult {\n    success: boolean;\n}\n\nexport default async function runExecutor(\n    _options: ValidateNoCyclesOptions,\n    context: ExecutorContext\n): Promise<ExecutorResult> {\n    // Epoch-gateable: the existing cycle set can be grandfathered while a refactor lands, so this\n    // rule honors ignoreModifiedUntilEpoch / ignoreRuleWhileOnBranch in addition to mode: OFF.\n    if (new RuleGate().isDisabled(context.root, 'validate-no-architecture-cycles', true)) {\n        return { success: true };\n    }\n\n    console.log('\\n🔄 Validating No Circular Dependencies\\n');\n\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Step 1: Generate current graph from project.json files\n        console.log('📊 Generating dependency graph from project.json files...');\n        const rawGraph = await generateGraph();\n\n        // Step 2: Topological sort (validates acyclic)\n        console.log('🔄 Checking for cycles (topological sort)...');\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            sortGraphTopologically(rawGraph);\n            console.log('✅ No circular dependencies detected!');\n\n            // Print summary\n            const projectCount = Object.keys(rawGraph).length;\n            console.log(`\\n📈 Summary: ${projectCount} projects, all acyclic`);\n\n            return { success: true };\n        } catch (err: unknown) {\n            const error = toError(err);\n            console.error('❌ Circular dependency detected!');\n            console.error(error.message);\n            console.error('\\nTo fix:');\n            console.error('  1. Review the cycle above');\n            console.error('  2. Break the cycle by refactoring dependencies');\n            console.error('  3. Run this check again');\n            return { success: false };\n        }\n    } catch (err: unknown) {\n        const error = toError(err);\n        console.error('❌ Cycle validation failed:', error.message);\n        return { success: false };\n    }\n}\n"]}

package/src/executors/validate-packagejson/executor.d.ts

@@ -8,7 +8,14 @@
  * nx run architecture:validate-packagejson
  */
 import type { ExecutorContext } from '@nx/devkit';
+import { TestOnlyDepMode } from '../../lib/package-validator';
 export interface ValidatePackageJsonOptions {
+    /**
+     * Strictness for "a test-only package is listed in dependencies" (i.e. it lands in
+     * the `pnpm deploy --prod` closure and ships to production).
+     * 'error' (default) | 'warn' (migration) | 'off'.
+     */
+    testOnlyDepMode?: TestOnlyDepMode;
 }
 export interface ExecutorResult {
     success: boolean;

package/src/executors/validate-packagejson/executor.js

@@ -13,9 +13,54 @@ exports.default = runExecutor;
 const graph_generator_1 = require("../../lib/graph-generator");
 const graph_sorter_1 = require("../../lib/graph-sorter");
 const package_validator_1 = require("../../lib/package-validator");
+const rule_gate_1 = require("../../lib/rule-gate");
 const toError_1 = require("../../toError");
+/**
+ * Console reporting for the validation result.
+ *
+ * Extracted from `runExecutor` purely to keep that method under the max-method-lines
+ * limit: it crossed 70 lines when the config gate (this branch) and the test-vs-prod
+ * dependency classification (main, #481) both landed in it.
+ */
+class ValidationReporter {
+    reportWarnings(warnings) {
+        // Warnings never fail the build (e.g. runtime-only / peer deps).
+        if (warnings.length === 0) {
+            return;
+        }
+        console.warn('\n⚠️  Package.json notices (non-fatal):');
+        for (const warning of warnings) {
+            console.warn(`  ${warning}`);
+        }
+    }
+    reportErrors(errors) {
+        console.error('\n❌ Package.json validation failed!');
+        console.error('\nErrors:');
+        for (const error of errors) {
+            console.error(`  ${error}`);
+        }
+        console.error('\nTo fix:');
+        console.error('  1. Review each error above — it names the SECTION the dependency belongs in');
+        console.error('  2. Imported by production source → package.json "dependencies"');
+        console.error('  3. Imported only by *.spec.ts / __tests__ / test configs → "devDependencies"');
+        console.error('     (devDependencies are excluded from `pnpm deploy --prod`, so test-only');
+        console.error('      packages never reach the production image)');
+    }
+    reportSummary(projectResults) {
+        const validProjects = projectResults.filter(r => r.valid).length;
+        const totalProjects = projectResults.length;
+        console.log(`\n📈 Validation Summary:`);
+        console.log(`   Projects validated: ${totalProjects}`);
+        console.log(`   Valid: ${validProjects}`);
+        console.log(`   Invalid: ${totalProjects - validProjects}`);
+    }
+}
 async function runExecutor(options, context) {
     const workspaceRoot = context.root;
+    // All-or-nothing (honorEpoch = false): there is no blessed baseline to grandfather against.
+    if (new rule_gate_1.RuleGate().isDisabled(workspaceRoot, 'validate-packagejson', false)) {
+        return { success: true };
+    }
     console.log('\n📦 Validating Package.json Dependencies\n');
     // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
     try {
@@ -27,33 +72,16 @@ async function runExecutor(options, context) {
         const enhancedGraph = (0, graph_sorter_1.sortGraphTopologically)(reducedGraph);
         // Step 3: Validate package.json dependencies match
         console.log('📦 Validating package.json dependencies match the architecture graph...');
-        const packageValidation = await (0, package_validator_1.validatePackageJsonDependencies)(enhancedGraph, workspaceRoot);
-        // Warnings never fail the build (e.g. runtime-only / peer deps).
-        if (packageValidation.warnings.length > 0) {
-            console.warn('\n⚠️  Package.json notices (non-fatal):');
-            for (const warning of packageValidation.warnings) {
-                console.warn(`  ${warning}`);
-            }
-        }
+        const validatorOptions = new package_validator_1.PackageValidatorOptions(options.testOnlyDepMode ?? 'error');
+        const packageValidation = await (0, package_validator_1.validatePackageJsonDependencies)(enhancedGraph, workspaceRoot, validatorOptions);
+        const reporter = new ValidationReporter();
+        reporter.reportWarnings(packageValidation.warnings);
         if (!packageValidation.valid) {
-            console.error('\n❌ Package.json validation failed!');
-            console.error('\nErrors:');
-            for (const error of packageValidation.errors) {
-                console.error(`  ${error}`);
-            }
-            console.error('\nTo fix:');
-            console.error('  1. Review the missing dependencies above');
-            console.error('  2. Add the missing dependencies to the respective package.json files');
+            reporter.reportErrors(packageValidation.errors);
             return { success: false };
         }
         console.log('✅ Package.json dependencies cover the architecture graph');
-        // Print summary
-        const validProjects = packageValidation.projectResults.filter(r => r.valid).length;
-        const totalProjects = packageValidation.projectResults.length;
-        console.log(`\n📈 Validation Summary:`);
-        console.log(`   Projects validated: ${totalProjects}`);
-        console.log(`   Valid: ${validProjects}`);
-        console.log(`   Invalid: ${totalProjects - validProjects}`);
+        reporter.reportSummary(packageValidation.projectResults);
         return { success: true };
     }
     catch (err) {

package/src/executors/validate-packagejson/executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/nx-webpieces-rules/src/executors/validate-packagejson/executor.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAgBH,8BA0DC;AAvED,+DAAiE;AACjE,yDAAgE;AAChE,mEAA8E;AAC9E,2CAAwC;AAUzB,KAAK,UAAU,WAAW,CACrC,OAAmC,EACnC,OAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAEnC,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAE3D,8DAA8D;IAC9D,IAAI,CAAC;QACD,+EAA+E;QAC/E,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,MAAM,IAAA,sCAAoB,GAAE,CAAC;QAElD,+DAA+D;QAC/D,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,IAAA,qCAAsB,EAAC,YAAY,CAAC,CAAC;QAE3D,mDAAmD;QACnD,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,MAAM,iBAAiB,GAAG,MAAM,IAAA,mDAA+B,EAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAE9F,iEAAiE;QACjE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACxD,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,QAAQ,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YACjC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC3B,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBAC3C,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAC5D,OAAO,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACxF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QAExE,gBAAgB;QAChB,MAAM,aAAa,GAAG,iBAAiB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QACnF,MAAM,aAAa,GAAG,iBAAiB,CAAC,cAAc,CAAC,MAAM,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,aAAa,aAAa,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,aAAa,GAAG,aAAa,EAAE,CAAC,CAAC;QAE5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,iBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACL,CAAC","sourcesContent":["/**\n * Validate Package.json Executor\n *\n * Validates that package.json dependencies match project.json build dependencies.\n * This ensures the two sources of truth don't drift apart.\n *\n * Usage:\n * nx run architecture:validate-packagejson\n */\n\nimport type { ExecutorContext } from '@nx/devkit';\nimport { generateReducedGraph } from '../../lib/graph-generator';\nimport { sortGraphTopologically } from '../../lib/graph-sorter';\nimport { validatePackageJsonDependencies } from '../../lib/package-validator';\nimport { toError } from '../../toError';\n\nexport interface ValidatePackageJsonOptions {\n    // No options needed for now\n}\n\nexport interface ExecutorResult {\n    success: boolean;\n}\n\nexport default async function runExecutor(\n    options: ValidatePackageJsonOptions,\n    context: ExecutorContext\n): Promise<ExecutorResult> {\n    const workspaceRoot = context.root;\n\n    console.log('\\n📦 Validating Package.json Dependencies\\n');\n\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Step 1: Build the full graph from nx, then transitively reduce it (the view)\n        console.log(\"📊 Generating dependency graph from nx's project graph...\");\n        const reducedGraph = await generateReducedGraph();\n\n        // Step 2: Topological sort (to get enhanced graph with levels)\n        console.log('🔄 Computing topological layers...');\n        const enhancedGraph = sortGraphTopologically(reducedGraph);\n\n        // Step 3: Validate package.json dependencies match\n        console.log('📦 Validating package.json dependencies match the architecture graph...');\n        const packageValidation = await validatePackageJsonDependencies(enhancedGraph, workspaceRoot);\n\n        // Warnings never fail the build (e.g. runtime-only / peer deps).\n        if (packageValidation.warnings.length > 0) {\n            console.warn('\\n⚠️  Package.json notices (non-fatal):');\n            for (const warning of packageValidation.warnings) {\n                console.warn(`  ${warning}`);\n            }\n        }\n\n        if (!packageValidation.valid) {\n            console.error('\\n❌ Package.json validation failed!');\n            console.error('\\nErrors:');\n            for (const error of packageValidation.errors) {\n                console.error(`  ${error}`);\n            }\n            console.error('\\nTo fix:');\n            console.error('  1. Review the missing dependencies above');\n            console.error('  2. Add the missing dependencies to the respective package.json files');\n            return { success: false };\n        }\n\n        console.log('✅ Package.json dependencies cover the architecture graph');\n\n        // Print summary\n        const validProjects = packageValidation.projectResults.filter(r => r.valid).length;\n        const totalProjects = packageValidation.projectResults.length;\n        console.log(`\\n📈 Validation Summary:`);\n        console.log(`   Projects validated: ${totalProjects}`);\n        console.log(`   Valid: ${validProjects}`);\n        console.log(`   Invalid: ${totalProjects - validProjects}`);\n\n        return { success: true };\n    } catch (err: unknown) {\n        const error = toError(err);\n        console.error('❌ Package.json validation failed:', error.message);\n        return { success: false };\n    }\n}\n"]}
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/nx-webpieces-rules/src/executors/validate-packagejson/executor.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAsEH,8BAiDC;AApHD,+DAAiE;AACjE,yDAAgE;AAChE,mEAKqC;AACrC,mDAA+C;AAC/C,2CAAwC;AAexC;;;;;;GAMG;AACH,MAAM,kBAAkB;IACpB,cAAc,CAAC,QAAkB;QAC7B,iEAAiE;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,MAAgB;QACzB,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;QAC/F,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAClF,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QAChG,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,aAAa,CAAC,cAAyC;QACnD,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QACjE,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,aAAa,aAAa,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,aAAa,GAAG,aAAa,EAAE,CAAC,CAAC;IAChE,CAAC;CACJ;AAEc,KAAK,UAAU,WAAW,CACrC,OAAmC,EACnC,OAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAEnC,4FAA4F;IAC5F,IAAI,IAAI,oBAAQ,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,sBAAsB,EAAE,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAE3D,8DAA8D;IAC9D,IAAI,CAAC;QACD,+EAA+E;QAC/E,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,MAAM,IAAA,sCAAoB,GAAE,CAAC;QAElD,+DAA+D;QAC/D,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,IAAA,qCAAsB,EAAC,YAAY,CAAC,CAAC;QAE3D,mDAAmD;QACnD,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,MAAM,gBAAgB,GAAG,IAAI,2CAAuB,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,CAAC;QACzF,MAAM,iBAAiB,GAAG,MAAM,IAAA,mDAA+B,EAC3D,aAAa,EACb,aAAa,EACb,gBAAgB,CACnB,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAC1C,QAAQ,CAAC,cAAc,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC3B,QAAQ,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,QAAQ,CAAC,aAAa,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAEzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,iBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACL,CAAC","sourcesContent":["/**\n * Validate Package.json Executor\n *\n * Validates that package.json dependencies match project.json build dependencies.\n * This ensures the two sources of truth don't drift apart.\n *\n * Usage:\n * nx run architecture:validate-packagejson\n */\n\nimport type { ExecutorContext } from '@nx/devkit';\nimport { generateReducedGraph } from '../../lib/graph-generator';\nimport { sortGraphTopologically } from '../../lib/graph-sorter';\nimport {\n    PackageValidatorOptions,\n    ProjectValidationResult,\n    TestOnlyDepMode,\n    validatePackageJsonDependencies,\n} from '../../lib/package-validator';\nimport { RuleGate } from '../../lib/rule-gate';\nimport { toError } from '../../toError';\n\nexport interface ValidatePackageJsonOptions {\n    /**\n     * Strictness for \"a test-only package is listed in dependencies\" (i.e. it lands in\n     * the `pnpm deploy --prod` closure and ships to production).\n     * 'error' (default) | 'warn' (migration) | 'off'.\n     */\n    testOnlyDepMode?: TestOnlyDepMode;\n}\n\nexport interface ExecutorResult {\n    success: boolean;\n}\n\n/**\n * Console reporting for the validation result.\n *\n * Extracted from `runExecutor` purely to keep that method under the max-method-lines\n * limit: it crossed 70 lines when the config gate (this branch) and the test-vs-prod\n * dependency classification (main, #481) both landed in it.\n */\nclass ValidationReporter {\n    reportWarnings(warnings: string[]): void {\n        // Warnings never fail the build (e.g. runtime-only / peer deps).\n        if (warnings.length === 0) {\n            return;\n        }\n        console.warn('\\n⚠️  Package.json notices (non-fatal):');\n        for (const warning of warnings) {\n            console.warn(`  ${warning}`);\n        }\n    }\n\n    reportErrors(errors: string[]): void {\n        console.error('\\n❌ Package.json validation failed!');\n        console.error('\\nErrors:');\n        for (const error of errors) {\n            console.error(`  ${error}`);\n        }\n        console.error('\\nTo fix:');\n        console.error('  1. Review each error above — it names the SECTION the dependency belongs in');\n        console.error('  2. Imported by production source → package.json \"dependencies\"');\n        console.error('  3. Imported only by *.spec.ts / __tests__ / test configs → \"devDependencies\"');\n        console.error('     (devDependencies are excluded from `pnpm deploy --prod`, so test-only');\n        console.error('      packages never reach the production image)');\n    }\n\n    reportSummary(projectResults: ProjectValidationResult[]): void {\n        const validProjects = projectResults.filter(r => r.valid).length;\n        const totalProjects = projectResults.length;\n        console.log(`\\n📈 Validation Summary:`);\n        console.log(`   Projects validated: ${totalProjects}`);\n        console.log(`   Valid: ${validProjects}`);\n        console.log(`   Invalid: ${totalProjects - validProjects}`);\n    }\n}\n\nexport default async function runExecutor(\n    options: ValidatePackageJsonOptions,\n    context: ExecutorContext\n): Promise<ExecutorResult> {\n    const workspaceRoot = context.root;\n\n    // All-or-nothing (honorEpoch = false): there is no blessed baseline to grandfather against.\n    if (new RuleGate().isDisabled(workspaceRoot, 'validate-packagejson', false)) {\n        return { success: true };\n    }\n\n    console.log('\\n📦 Validating Package.json Dependencies\\n');\n\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Step 1: Build the full graph from nx, then transitively reduce it (the view)\n        console.log(\"📊 Generating dependency graph from nx's project graph...\");\n        const reducedGraph = await generateReducedGraph();\n\n        // Step 2: Topological sort (to get enhanced graph with levels)\n        console.log('🔄 Computing topological layers...');\n        const enhancedGraph = sortGraphTopologically(reducedGraph);\n\n        // Step 3: Validate package.json dependencies match\n        console.log('📦 Validating package.json dependencies match the architecture graph...');\n        const validatorOptions = new PackageValidatorOptions(options.testOnlyDepMode ?? 'error');\n        const packageValidation = await validatePackageJsonDependencies(\n            enhancedGraph,\n            workspaceRoot,\n            validatorOptions\n        );\n\n        const reporter = new ValidationReporter();\n        reporter.reportWarnings(packageValidation.warnings);\n\n        if (!packageValidation.valid) {\n            reporter.reportErrors(packageValidation.errors);\n            return { success: false };\n        }\n\n        console.log('✅ Package.json dependencies cover the architecture graph');\n        reporter.reportSummary(packageValidation.projectResults);\n\n        return { success: true };\n    } catch (err: unknown) {\n        const error = toError(err);\n        console.error('❌ Package.json validation failed:', error.message);\n        return { success: false };\n    }\n}\n"]}

package/src/executors/validate-packagejson/schema.json

@@ -1,8 +1,15 @@
 {
     "$schema": "http://json-schema.org/schema",
     "title": "Validate Package.json Executor",
-    "description": "Validates that package.json dependencies match project.json build dependencies",
+    "description": "Validates that package.json dependencies match project.json build dependencies, and that each dependency sits in the correct section (dependencies vs devDependencies)",
     "type": "object",
-    "properties": {},
+    "properties": {
+        "testOnlyDepMode": {
+            "type": "string",
+            "enum": ["error", "warn", "off"],
+            "default": "error",
+            "description": "What to do when a package imported ONLY by test/dev files is listed in \"dependencies\" (so `pnpm deploy --prod` ships it to production). 'error' fails the build (default), 'warn' reports without failing (migration path for existing repos), 'off' skips the check."
+        }
+    },
     "required": []
 }

package/src/executors/validate-versions-locked/executor.js

@@ -20,6 +20,7 @@ exports.default = runExecutor;
 const tslib_1 = require("tslib");
 const fs = tslib_1.__importStar(require("fs"));
 const path = tslib_1.__importStar(require("path"));
+const rule_gate_1 = require("../../lib/rule-gate");
 const toError_1 = require("../../toError");
 // webpieces-disable max-lines-new-methods -- Existing method from renamed validate-versions file
 // Find all package.json files except node_modules, dist, .nx, .angular
@@ -286,8 +287,12 @@ function checkSemverRanges(workspaceRoot) {
     return { errors: semverErrors };
 }
 async function runExecutor(_options, context) {
-    console.log('\n🔒 Validating Package Versions are LOCKED and CONSISTENT\n');
     const workspaceRoot = context.root;
+    // All-or-nothing (honorEpoch = false): there is no blessed baseline to grandfather against.
+    if (new rule_gate_1.RuleGate().isDisabled(workspaceRoot, 'validate-versions-locked', false)) {
+        return { success: true };
+    }
+    console.log('\n🔒 Validating Package Versions are LOCKED and CONSISTENT\n');
     // Step 1: Check for semver ranges (FAILS if any found)
     const semverResult = checkSemverRanges(workspaceRoot);
     const semverErrors = semverResult.errors;

package/src/executors/validate-versions-locked/executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/nx-webpieces-rules/src/executors/validate-versions-locked/executor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAiBH,oDA2CC;AA8QD,8BAsCC;;AA7WD,+CAAyB;AACzB,mDAA6B;AAC7B,2CAAwC;AAUxC,iGAAiG;AACjG,uEAAuE;AACvE,SAAgB,oBAAoB,CAAC,GAAW,EAAE,QAAQ,GAAG,EAAE;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE/C,yBAAyB;QACzB,IACI,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAC/D,IAAI,CACP,EACH,CAAC;YACC,SAAS;QACb,CAAC;QAED,2FAA2F;QAC3F,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,SAAS;QACb,CAAC;QAED,gDAAgD;QAChD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS;QACb,CAAC;QAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,yFAAyF;YACzF,0FAA0F;YAC1F,uFAAuF;YACvF,0FAA0F;YAC1F,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACb,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,+CAA+C;AAC/C,SAAS,cAAc,CAAC,OAAe;IACnC,2BAA2B;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,yCAAyC;IACzC,MAAM,cAAc,GAAG;QACnB,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,eAAe;QACvB,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,aAAa;QACxB,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,OAAO;KACpB,CAAC;IAEF,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,iGAAiG;AACjG,wDAAwD;AACxD,SAAS,mBAAmB,CAAC,QAAgB;IACzC,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,qBAAqB;QACrB,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7D,mCAAmC;gBACnC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBACjC,SAAS;gBACb,CAAC;gBAED,IAAI,cAAc,CAAC,OAAiB,CAAC,EAAE,CAAC;oBACpC,MAAM,CAAC,IAAI,CACP,gBAAgB,IAAI,MAAM,OAAO,uDAAuD,CAC3F,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QAED,wBAAwB;QACxB,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChE,mCAAmC;gBACnC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBACjC,SAAS;gBACb,CAAC;gBAED,IAAI,cAAc,CAAC,OAAiB,CAAC,EAAE,CAAC;oBACpC,MAAM,CAAC,IAAI,CACP,mBAAmB,IAAI,MAAM,OAAO,uDAAuD,CAC9F,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QAED,mEAAmE;QACnE,0FAA0F;QAE1F,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,iBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,mBAAmB,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;AACL,CAAC;AASD,iGAAiG;AACjG,8DAA8D;AAC9D,SAAS,sBAAsB,CAAC,aAAqB;IACjD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC3D,MAAM,YAAY,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAEzD,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QAClC,8DAA8D;QAC9D,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAE5D,uBAAuB;YACvB,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACnB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC7D,mCAAmC;oBACnC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;wBAAE,SAAS;oBAE7C,MAAM,KAAK,GAAoB;wBAC3B,OAAO,EAAE,OAAiB;wBAC1B,IAAI,EAAE,YAAY;wBAClB,IAAI,EAAE,cAAc;qBACvB,CAAC;oBAEF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC3B,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAChC,CAAC;oBACD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzC,CAAC;YACL,CAAC;YAED,0BAA0B;YAC1B,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;oBAChE,mCAAmC;oBACnC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;wBAAE,SAAS;oBAE7C,MAAM,KAAK,GAAoB;wBAC3B,OAAO,EAAE,OAAiB;wBAC1B,IAAI,EAAE,YAAY;wBAClB,IAAI,EAAE,iBAAiB;qBAC1B,CAAC;oBAEF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC3B,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAChC,CAAC;oBACD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzC,CAAC;YACL,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,8BAA8B;YAC9B,+FAA+F;QACnG,CAAC;IACL,CAAC;IAED,OAAO,aAAa,CAAC;AACzB,CAAC;AAED,oGAAoG;AACpG,wDAAwD;AACxD,SAAS,qBAAqB,CAAC,aAAqB;IAChD,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAE9E,MAAM,aAAa,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACpB,MAAM;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAC1E,CAAC;QAEF,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,eAAe,GAAG,MAAM;iBACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;iBAClF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;iBACrD,IAAI,CAAC,IAAI,CAAC,CAAC;YAEhB,SAAS,CAAC,IAAI,CAAC,QAAQ,WAAW,QAAQ,QAAQ,CAAC,IAAI,yBAAyB,eAAe,EAAE,CAAC,CAAC;QACvG,CAAC;IACL,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,qGAAqG;AACrG,SAAS,kCAAkC,CAAC,YAAoB;IAC5D,OAAO,CAAC,GAAG,CAAC;;;QAGR,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CnB,CAAC,CAAC;AACH,CAAC;AAID,qEAAqE;AACrE,SAAS,iBAAiB,CAAC,aAAqB;IAC5C,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,QAAQ,YAAY,GAAG,CAAC,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;YACD,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,QAAQ,YAAY,EAAE,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAEc,KAAK,UAAU,WAAW,CACrC,QAAuC,EACvC,OAAwB;IAExB,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAE5E,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAEnC,uDAAuD;IACvD,MAAM,YAAY,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC;IACzC,MAAM,YAAY,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAEzD,gEAAgE;IAChE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAE9D,UAAU;IACV,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,yCAAyC,YAAY,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,yBAAyB,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAEhE,iDAAiD;IACjD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACnB,kCAAkC,CAAC,YAAY,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,4BAA4B;IAC5B,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,kGAAkG,CAAC,CAAC;QAChH,OAAO,CAAC,GAAG,CAAC,wGAAwG,CAAC,CAAC;QACtH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["/**\n * Validate Versions Locked Executor\n *\n * Validates that package.json versions are:\n * 1. LOCKED (exact versions, no semver ranges like ^, ~, *)\n * 2. CONSISTENT across all package.json files (no version conflicts)\n *\n * Why locked versions matter:\n * - Micro bugs ARE introduced via patch versions (1.4.5 → 1.4.6)\n * - git bisect fails when software changes OUTSIDE of git\n * - Library upgrades must be explicit via PR/commit, not implicit drift\n *\n * Usage:\n * nx run architecture:validate-versions-locked\n */\n\nimport type { ExecutorContext } from '@nx/devkit';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { toError } from '../../toError';\n\nexport interface ValidateVersionsLockedOptions {\n    // No options needed\n}\n\nexport interface ExecutorResult {\n    success: boolean;\n}\n\n// webpieces-disable max-lines-new-methods -- Existing method from renamed validate-versions file\n// Find all package.json files except node_modules, dist, .nx, .angular\nexport function findPackageJsonFiles(dir: string, basePath = ''): string[] {\n    const files: string[] = [];\n    const items = fs.readdirSync(dir);\n\n    for (const item of items) {\n        const fullPath = path.join(dir, item);\n        const relativePath = path.join(basePath, item);\n\n        // Skip these directories\n        if (\n            ['node_modules', 'dist', '.nx', '.angular', 'tmp', '.git'].includes(\n                item,\n            )\n        ) {\n            continue;\n        }\n\n        // Skip platform-specific node_modules backups (node_modules_mac, node_modules_linux, etc.)\n        if (item.startsWith('node_modules_')) {\n            continue;\n        }\n\n        // Skip all hidden directories (starting with .)\n        if (item.startsWith('.')) {\n            continue;\n        }\n\n        const stat = fs.statSync(fullPath);\n        if (stat.isDirectory()) {\n            // Don't descend into a nested git repository (e.g. a clone under repositories/): it is a\n            // separate project with its own version policy, NOT part of this monorepo's version lock.\n            // The presence of a `.git` entry (dir for a real clone, file for a worktree/submodule)\n            // marks a repo boundary — the same signal the AI guards use to scope to the current repo.\n            if (fs.existsSync(path.join(fullPath, '.git'))) {\n                continue;\n            }\n            files.push(...findPackageJsonFiles(fullPath, relativePath));\n        } else if (item === 'package.json') {\n            files.push(fullPath);\n        }\n    }\n\n    return files;\n}\n\n// Check if a version string uses semver ranges\nfunction hasSemverRange(version: string): boolean {\n    // Allow workspace protocol\n    if (version.startsWith('workspace:')) {\n        return false;\n    }\n\n    // Allow file: protocol (for local packages)\n    if (version.startsWith('file:')) {\n        return false;\n    }\n\n    // Check for common semver range patterns\n    const semverPatterns = [\n        /^\\^/, // ^1.2.3\n        /^~/, // ~1.2.3\n        /^\\+/, // +1.2.3\n        /^\\*/, // *\n        /^>/, // >1.2.3\n        /^</, // <1.2.3\n        /^>=/, // >=1.2.3\n        /^<=/, // <=1.2.3\n        /\\|\\|/, // 1.2.3 || 2.x\n        / - /, // 1.2.3 - 2.3.4\n        /^\\d+\\.x/, // 1.x, 1.2.x\n        /^latest$/, // latest\n        /^next$/, // next\n    ];\n\n    return semverPatterns.some((pattern) => pattern.test(version));\n}\n\n// webpieces-disable max-lines-new-methods -- Existing method from renamed validate-versions file\n// Validate a single package.json file for semver ranges\nfunction validatePackageJson(filePath: string): string[] {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const content = fs.readFileSync(filePath, 'utf-8');\n        const pkg = JSON.parse(content);\n        const errors: string[] = [];\n\n        // Check dependencies\n        if (pkg.dependencies) {\n            for (const [name, version] of Object.entries(pkg.dependencies)) {\n                // Skip internal workspace packages\n                if (name.startsWith('@webpieces/')) {\n                    continue;\n                }\n\n                if (hasSemverRange(version as string)) {\n                    errors.push(\n                        `dependencies.${name}: \"${version}\" uses semver range (must be locked to exact version)`,\n                    );\n                }\n            }\n        }\n\n        // Check devDependencies\n        if (pkg.devDependencies) {\n            for (const [name, version] of Object.entries(pkg.devDependencies)) {\n                // Skip internal workspace packages\n                if (name.startsWith('@webpieces/')) {\n                    continue;\n                }\n\n                if (hasSemverRange(version as string)) {\n                    errors.push(\n                        `devDependencies.${name}: \"${version}\" uses semver range (must be locked to exact version)`,\n                    );\n                }\n            }\n        }\n\n        // Check peerDependencies (these can have ranges for compatibility)\n        // We don't validate peerDependencies for semver ranges since they're meant to be flexible\n\n        return errors;\n    } catch (err: unknown) {\n        const error = toError(err);\n        return [`Failed to parse ${filePath}: ${error.message}`];\n    }\n}\n\n// Track all dependency versions across the monorepo\ninterface DependencyUsage {\n    version: string;\n    file: string;\n    type: 'dependencies' | 'devDependencies';\n}\n\n// webpieces-disable max-lines-new-methods -- Collecting dependencies from all package.json files\n// Collect all dependency versions from all package.json files\nfunction collectAllDependencies(workspaceRoot: string): Map<string, DependencyUsage[]> {\n    const dependencyMap = new Map<string, DependencyUsage[]>();\n    const packageFiles = findPackageJsonFiles(workspaceRoot);\n\n    for (const filePath of packageFiles) {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            const content = fs.readFileSync(filePath, 'utf-8');\n            const pkg = JSON.parse(content);\n            const relativePath = path.relative(workspaceRoot, filePath);\n\n            // Collect dependencies\n            if (pkg.dependencies) {\n                for (const [name, version] of Object.entries(pkg.dependencies)) {\n                    // Skip internal workspace packages\n                    if (name.startsWith('@webpieces/')) continue;\n\n                    const usage: DependencyUsage = {\n                        version: version as string,\n                        file: relativePath,\n                        type: 'dependencies'\n                    };\n\n                    if (!dependencyMap.has(name)) {\n                        dependencyMap.set(name, []);\n                    }\n                    dependencyMap.get(name)!.push(usage);\n                }\n            }\n\n            // Collect devDependencies\n            if (pkg.devDependencies) {\n                for (const [name, version] of Object.entries(pkg.devDependencies)) {\n                    // Skip internal workspace packages\n                    if (name.startsWith('@webpieces/')) continue;\n\n                    const usage: DependencyUsage = {\n                        version: version as string,\n                        file: relativePath,\n                        type: 'devDependencies'\n                    };\n\n                    if (!dependencyMap.has(name)) {\n                        dependencyMap.set(name, []);\n                    }\n                    dependencyMap.get(name)!.push(usage);\n                }\n            }\n        } catch (err: unknown) {\n            // const error = toError(err);\n            // Intentionally skip files that can't be parsed - this is expected for some package.json files\n        }\n    }\n\n    return dependencyMap;\n}\n\n// webpieces-disable max-lines-new-methods -- Simple iteration logic, splitting would reduce clarity\n// Check for version conflicts across package.json files\nfunction checkVersionConflicts(workspaceRoot: string): string[] {\n    console.log('\\n🔍 Checking for version conflicts across package.json files:');\n\n    const dependencyMap = collectAllDependencies(workspaceRoot);\n    const conflicts: string[] = [];\n\n    for (const [packageName, usages] of dependencyMap.entries()) {\n        // Get unique versions (ignoring workspace: and file: protocols)\n        const versions = new Set(\n            usages\n                .map(u => u.version)\n                .filter(v => !v.startsWith('workspace:') && !v.startsWith('file:'))\n        );\n\n        if (versions.size > 1) {\n            const conflictDetails = usages\n                .filter(u => !u.version.startsWith('workspace:') && !u.version.startsWith('file:'))\n                .map(u => `      ${u.file} (${u.type}): ${u.version}`)\n                .join('\\n');\n\n            conflicts.push(`   ❌ ${packageName} has ${versions.size} different versions:\\n${conflictDetails}`);\n        }\n    }\n\n    if (conflicts.length === 0) {\n        console.log('   ✅ No version conflicts found');\n    } else {\n        for (const conflict of conflicts) {\n            console.log(conflict);\n        }\n    }\n\n    return conflicts;\n}\n\n/**\n * Prints the educational message explaining why semver ranges are forbidden.\n * This helps developers understand the rationale behind locked versions.\n */\n// webpieces-disable max-lines-new-methods -- Educational message template, splitting reduces clarity\nfunction printSemverRangeEducationalMessage(semverErrors: number): void {\n    console.log(`\n❌ SEMVER RANGES DETECTED - BUILD FAILED\n\nFound ${semverErrors} package(s) using semver ranges (^, ~, *, etc.) instead of locked versions.\n\nWHY THIS IS A HARD FAILURE:\n═══════════════════════════════════════════════════════════════════════════════\n\n1. MICRO BUGS ARE REAL\n   Thinking that patch versions (1.4.5 → 1.4.6) don't introduce bugs is wrong.\n   They do. Sometimes what looks like an \"easy fix\" breaks things in subtle ways.\n\n2. GIT BISECT BECOMES USELESS\n   When you run \"git bisect\" to find when a bug was introduced, it fails if\n   software changed OUTSIDE of git. You checkout an old commit, but node_modules\n   has different versions than when that commit was made. The bug persists even\n   in \"known good\" commits because the library versions drifted.\n\n3. THE \"MAGIC BUG\" PROBLEM\n   You checkout code from 6 months ago to debug an issue. The bug is still there!\n   But it wasn't there 6 months ago... The culprit: a minor version upgrade that\n   happened silently without any PR or git commit. Impossible to track down.\n\n4. CHANGES OUTSIDE GIT = BAD\n   Every change to your software should be tracked in version control.\n   Implicit library upgrades via semver ranges violate this principle.\n\nTHE SOLUTION:\n═══════════════════════════════════════════════════════════════════════════════\n\nUse LOCKED (exact) versions for all dependencies:\n  ❌ \"lodash\": \"^4.17.21\"    <- BAD: allows 4.17.22, 4.18.0, etc.\n  ❌ \"lodash\": \"~4.17.21\"    <- BAD: allows 4.17.22, 4.17.23, etc.\n  ✅ \"lodash\": \"4.17.21\"     <- GOOD: locked to this exact version\n\nTo upgrade libraries, use an explicit process:\n  1. Run: npm update <package-name>\n  2. Test thoroughly\n  3. Commit the package.json AND package-lock.json changes\n  4. Create a PR so the upgrade is reviewed and tracked in git history\n\nThis way, every library change is:\n  • Intentional (not accidental)\n  • Reviewed (via PR)\n  • Tracked (in git history)\n  • Bisectable (git bisect works correctly)\n\n`);\n}\n\ntype SemverRangeResult = { errors: number };\n\n// Check semver ranges in all package.json files - FAILS if any found\nfunction checkSemverRanges(workspaceRoot: string): SemverRangeResult {\n    console.log('\\n📋 Checking for unlocked versions (semver ranges):');\n    const packageFiles = findPackageJsonFiles(workspaceRoot);\n    let semverErrors = 0;\n\n    for (const filePath of packageFiles) {\n        const relativePath = path.relative(workspaceRoot, filePath);\n        const errors = validatePackageJson(filePath);\n\n        if (errors.length > 0) {\n            console.log(`   ❌ ${relativePath}:`);\n            for (const error of errors) {\n                console.log(`      ${error}`);\n            }\n            semverErrors += errors.length;\n        } else {\n            console.log(`   ✅ ${relativePath}`);\n        }\n    }\n\n    return { errors: semverErrors };\n}\n\nexport default async function runExecutor(\n    _options: ValidateVersionsLockedOptions,\n    context: ExecutorContext\n): Promise<ExecutorResult> {\n    console.log('\\n🔒 Validating Package Versions are LOCKED and CONSISTENT\\n');\n\n    const workspaceRoot = context.root;\n\n    // Step 1: Check for semver ranges (FAILS if any found)\n    const semverResult = checkSemverRanges(workspaceRoot);\n    const semverErrors = semverResult.errors;\n    const packageFiles = findPackageJsonFiles(workspaceRoot);\n\n    // Step 2: Check for version conflicts across package.json files\n    const versionConflicts = checkVersionConflicts(workspaceRoot);\n\n    // Summary\n    console.log(`\\n📊 Summary:`);\n    console.log(`   Files checked: ${packageFiles.length}`);\n    console.log(`   Unlocked versions (semver ranges): ${semverErrors}`);\n    console.log(`   Version conflicts: ${versionConflicts.length}`);\n\n    // Fail on semver ranges with educational message\n    if (semverErrors > 0) {\n        printSemverRangeEducationalMessage(semverErrors);\n        return { success: false };\n    }\n\n    // Fail on version conflicts\n    if (versionConflicts.length > 0) {\n        console.log('\\n❌ VALIDATION FAILED!');\n        console.log('   Fix version conflicts - all package.json files must use the same version for each dependency.');\n        console.log('   This prevents \"works on my machine\" bugs where different projects use different library versions.\\n');\n        return { success: false };\n    }\n\n    console.log('\\n✅ VALIDATION PASSED! All versions are locked and consistent.');\n    return { success: true };\n}\n"]}
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/nx-webpieces-rules/src/executors/validate-versions-locked/executor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAkBH,oDA2CC;AA8QD,8BA2CC;;AAnXD,+CAAyB;AACzB,mDAA6B;AAC7B,mDAA+C;AAC/C,2CAAwC;AAUxC,iGAAiG;AACjG,uEAAuE;AACvE,SAAgB,oBAAoB,CAAC,GAAW,EAAE,QAAQ,GAAG,EAAE;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE/C,yBAAyB;QACzB,IACI,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAC/D,IAAI,CACP,EACH,CAAC;YACC,SAAS;QACb,CAAC;QAED,2FAA2F;QAC3F,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,SAAS;QACb,CAAC;QAED,gDAAgD;QAChD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS;QACb,CAAC;QAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,yFAAyF;YACzF,0FAA0F;YAC1F,uFAAuF;YACvF,0FAA0F;YAC1F,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACb,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,+CAA+C;AAC/C,SAAS,cAAc,CAAC,OAAe;IACnC,2BAA2B;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,yCAAyC;IACzC,MAAM,cAAc,GAAG;QACnB,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,eAAe;QACvB,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,aAAa;QACxB,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,OAAO;KACpB,CAAC;IAEF,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,iGAAiG;AACjG,wDAAwD;AACxD,SAAS,mBAAmB,CAAC,QAAgB;IACzC,8DAA8D;IAC9D,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,qBAAqB;QACrB,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7D,mCAAmC;gBACnC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBACjC,SAAS;gBACb,CAAC;gBAED,IAAI,cAAc,CAAC,OAAiB,CAAC,EAAE,CAAC;oBACpC,MAAM,CAAC,IAAI,CACP,gBAAgB,IAAI,MAAM,OAAO,uDAAuD,CAC3F,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QAED,wBAAwB;QACxB,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;gBAChE,mCAAmC;gBACnC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBACjC,SAAS;gBACb,CAAC;gBAED,IAAI,cAAc,CAAC,OAAiB,CAAC,EAAE,CAAC;oBACpC,MAAM,CAAC,IAAI,CACP,mBAAmB,IAAI,MAAM,OAAO,uDAAuD,CAC9F,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QAED,mEAAmE;QACnE,0FAA0F;QAE1F,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,iBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,mBAAmB,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;AACL,CAAC;AASD,iGAAiG;AACjG,8DAA8D;AAC9D,SAAS,sBAAsB,CAAC,aAAqB;IACjD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC3D,MAAM,YAAY,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAEzD,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QAClC,8DAA8D;QAC9D,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAE5D,uBAAuB;YACvB,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACnB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC7D,mCAAmC;oBACnC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;wBAAE,SAAS;oBAE7C,MAAM,KAAK,GAAoB;wBAC3B,OAAO,EAAE,OAAiB;wBAC1B,IAAI,EAAE,YAAY;wBAClB,IAAI,EAAE,cAAc;qBACvB,CAAC;oBAEF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC3B,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAChC,CAAC;oBACD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzC,CAAC;YACL,CAAC;YAED,0BAA0B;YAC1B,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;gBACtB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;oBAChE,mCAAmC;oBACnC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;wBAAE,SAAS;oBAE7C,MAAM,KAAK,GAAoB;wBAC3B,OAAO,EAAE,OAAiB;wBAC1B,IAAI,EAAE,YAAY;wBAClB,IAAI,EAAE,iBAAiB;qBAC1B,CAAC;oBAEF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC3B,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAChC,CAAC;oBACD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzC,CAAC;YACL,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,8BAA8B;YAC9B,+FAA+F;QACnG,CAAC;IACL,CAAC;IAED,OAAO,aAAa,CAAC;AACzB,CAAC;AAED,oGAAoG;AACpG,wDAAwD;AACxD,SAAS,qBAAqB,CAAC,aAAqB;IAChD,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAE9E,MAAM,aAAa,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACpB,MAAM;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAC1E,CAAC;QAEF,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,eAAe,GAAG,MAAM;iBACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;iBAClF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;iBACrD,IAAI,CAAC,IAAI,CAAC,CAAC;YAEhB,SAAS,CAAC,IAAI,CAAC,QAAQ,WAAW,QAAQ,QAAQ,CAAC,IAAI,yBAAyB,eAAe,EAAE,CAAC,CAAC;QACvG,CAAC;IACL,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,qGAAqG;AACrG,SAAS,kCAAkC,CAAC,YAAoB;IAC5D,OAAO,CAAC,GAAG,CAAC;;;QAGR,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4CnB,CAAC,CAAC;AACH,CAAC;AAID,qEAAqE;AACrE,SAAS,iBAAiB,CAAC,aAAqB;IAC5C,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,QAAQ,YAAY,GAAG,CAAC,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;YAClC,CAAC;YACD,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,QAAQ,YAAY,EAAE,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAEc,KAAK,UAAU,WAAW,CACrC,QAAuC,EACvC,OAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAEnC,4FAA4F;IAC5F,IAAI,IAAI,oBAAQ,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,0BAA0B,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAE5E,uDAAuD;IACvD,MAAM,YAAY,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC;IACzC,MAAM,YAAY,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAEzD,gEAAgE;IAChE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAE9D,UAAU;IACV,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,qBAAqB,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,yCAAyC,YAAY,EAAE,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,yBAAyB,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAEhE,iDAAiD;IACjD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACnB,kCAAkC,CAAC,YAAY,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,4BAA4B;IAC5B,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,kGAAkG,CAAC,CAAC;QAChH,OAAO,CAAC,GAAG,CAAC,wGAAwG,CAAC,CAAC;QACtH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["/**\n * Validate Versions Locked Executor\n *\n * Validates that package.json versions are:\n * 1. LOCKED (exact versions, no semver ranges like ^, ~, *)\n * 2. CONSISTENT across all package.json files (no version conflicts)\n *\n * Why locked versions matter:\n * - Micro bugs ARE introduced via patch versions (1.4.5 → 1.4.6)\n * - git bisect fails when software changes OUTSIDE of git\n * - Library upgrades must be explicit via PR/commit, not implicit drift\n *\n * Usage:\n * nx run architecture:validate-versions-locked\n */\n\nimport type { ExecutorContext } from '@nx/devkit';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { RuleGate } from '../../lib/rule-gate';\nimport { toError } from '../../toError';\n\nexport interface ValidateVersionsLockedOptions {\n    // No options needed\n}\n\nexport interface ExecutorResult {\n    success: boolean;\n}\n\n// webpieces-disable max-lines-new-methods -- Existing method from renamed validate-versions file\n// Find all package.json files except node_modules, dist, .nx, .angular\nexport function findPackageJsonFiles(dir: string, basePath = ''): string[] {\n    const files: string[] = [];\n    const items = fs.readdirSync(dir);\n\n    for (const item of items) {\n        const fullPath = path.join(dir, item);\n        const relativePath = path.join(basePath, item);\n\n        // Skip these directories\n        if (\n            ['node_modules', 'dist', '.nx', '.angular', 'tmp', '.git'].includes(\n                item,\n            )\n        ) {\n            continue;\n        }\n\n        // Skip platform-specific node_modules backups (node_modules_mac, node_modules_linux, etc.)\n        if (item.startsWith('node_modules_')) {\n            continue;\n        }\n\n        // Skip all hidden directories (starting with .)\n        if (item.startsWith('.')) {\n            continue;\n        }\n\n        const stat = fs.statSync(fullPath);\n        if (stat.isDirectory()) {\n            // Don't descend into a nested git repository (e.g. a clone under repositories/): it is a\n            // separate project with its own version policy, NOT part of this monorepo's version lock.\n            // The presence of a `.git` entry (dir for a real clone, file for a worktree/submodule)\n            // marks a repo boundary — the same signal the AI guards use to scope to the current repo.\n            if (fs.existsSync(path.join(fullPath, '.git'))) {\n                continue;\n            }\n            files.push(...findPackageJsonFiles(fullPath, relativePath));\n        } else if (item === 'package.json') {\n            files.push(fullPath);\n        }\n    }\n\n    return files;\n}\n\n// Check if a version string uses semver ranges\nfunction hasSemverRange(version: string): boolean {\n    // Allow workspace protocol\n    if (version.startsWith('workspace:')) {\n        return false;\n    }\n\n    // Allow file: protocol (for local packages)\n    if (version.startsWith('file:')) {\n        return false;\n    }\n\n    // Check for common semver range patterns\n    const semverPatterns = [\n        /^\\^/, // ^1.2.3\n        /^~/, // ~1.2.3\n        /^\\+/, // +1.2.3\n        /^\\*/, // *\n        /^>/, // >1.2.3\n        /^</, // <1.2.3\n        /^>=/, // >=1.2.3\n        /^<=/, // <=1.2.3\n        /\\|\\|/, // 1.2.3 || 2.x\n        / - /, // 1.2.3 - 2.3.4\n        /^\\d+\\.x/, // 1.x, 1.2.x\n        /^latest$/, // latest\n        /^next$/, // next\n    ];\n\n    return semverPatterns.some((pattern) => pattern.test(version));\n}\n\n// webpieces-disable max-lines-new-methods -- Existing method from renamed validate-versions file\n// Validate a single package.json file for semver ranges\nfunction validatePackageJson(filePath: string): string[] {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        const content = fs.readFileSync(filePath, 'utf-8');\n        const pkg = JSON.parse(content);\n        const errors: string[] = [];\n\n        // Check dependencies\n        if (pkg.dependencies) {\n            for (const [name, version] of Object.entries(pkg.dependencies)) {\n                // Skip internal workspace packages\n                if (name.startsWith('@webpieces/')) {\n                    continue;\n                }\n\n                if (hasSemverRange(version as string)) {\n                    errors.push(\n                        `dependencies.${name}: \"${version}\" uses semver range (must be locked to exact version)`,\n                    );\n                }\n            }\n        }\n\n        // Check devDependencies\n        if (pkg.devDependencies) {\n            for (const [name, version] of Object.entries(pkg.devDependencies)) {\n                // Skip internal workspace packages\n                if (name.startsWith('@webpieces/')) {\n                    continue;\n                }\n\n                if (hasSemverRange(version as string)) {\n                    errors.push(\n                        `devDependencies.${name}: \"${version}\" uses semver range (must be locked to exact version)`,\n                    );\n                }\n            }\n        }\n\n        // Check peerDependencies (these can have ranges for compatibility)\n        // We don't validate peerDependencies for semver ranges since they're meant to be flexible\n\n        return errors;\n    } catch (err: unknown) {\n        const error = toError(err);\n        return [`Failed to parse ${filePath}: ${error.message}`];\n    }\n}\n\n// Track all dependency versions across the monorepo\ninterface DependencyUsage {\n    version: string;\n    file: string;\n    type: 'dependencies' | 'devDependencies';\n}\n\n// webpieces-disable max-lines-new-methods -- Collecting dependencies from all package.json files\n// Collect all dependency versions from all package.json files\nfunction collectAllDependencies(workspaceRoot: string): Map<string, DependencyUsage[]> {\n    const dependencyMap = new Map<string, DependencyUsage[]>();\n    const packageFiles = findPackageJsonFiles(workspaceRoot);\n\n    for (const filePath of packageFiles) {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            const content = fs.readFileSync(filePath, 'utf-8');\n            const pkg = JSON.parse(content);\n            const relativePath = path.relative(workspaceRoot, filePath);\n\n            // Collect dependencies\n            if (pkg.dependencies) {\n                for (const [name, version] of Object.entries(pkg.dependencies)) {\n                    // Skip internal workspace packages\n                    if (name.startsWith('@webpieces/')) continue;\n\n                    const usage: DependencyUsage = {\n                        version: version as string,\n                        file: relativePath,\n                        type: 'dependencies'\n                    };\n\n                    if (!dependencyMap.has(name)) {\n                        dependencyMap.set(name, []);\n                    }\n                    dependencyMap.get(name)!.push(usage);\n                }\n            }\n\n            // Collect devDependencies\n            if (pkg.devDependencies) {\n                for (const [name, version] of Object.entries(pkg.devDependencies)) {\n                    // Skip internal workspace packages\n                    if (name.startsWith('@webpieces/')) continue;\n\n                    const usage: DependencyUsage = {\n                        version: version as string,\n                        file: relativePath,\n                        type: 'devDependencies'\n                    };\n\n                    if (!dependencyMap.has(name)) {\n                        dependencyMap.set(name, []);\n                    }\n                    dependencyMap.get(name)!.push(usage);\n                }\n            }\n        } catch (err: unknown) {\n            // const error = toError(err);\n            // Intentionally skip files that can't be parsed - this is expected for some package.json files\n        }\n    }\n\n    return dependencyMap;\n}\n\n// webpieces-disable max-lines-new-methods -- Simple iteration logic, splitting would reduce clarity\n// Check for version conflicts across package.json files\nfunction checkVersionConflicts(workspaceRoot: string): string[] {\n    console.log('\\n🔍 Checking for version conflicts across package.json files:');\n\n    const dependencyMap = collectAllDependencies(workspaceRoot);\n    const conflicts: string[] = [];\n\n    for (const [packageName, usages] of dependencyMap.entries()) {\n        // Get unique versions (ignoring workspace: and file: protocols)\n        const versions = new Set(\n            usages\n                .map(u => u.version)\n                .filter(v => !v.startsWith('workspace:') && !v.startsWith('file:'))\n        );\n\n        if (versions.size > 1) {\n            const conflictDetails = usages\n                .filter(u => !u.version.startsWith('workspace:') && !u.version.startsWith('file:'))\n                .map(u => `      ${u.file} (${u.type}): ${u.version}`)\n                .join('\\n');\n\n            conflicts.push(`   ❌ ${packageName} has ${versions.size} different versions:\\n${conflictDetails}`);\n        }\n    }\n\n    if (conflicts.length === 0) {\n        console.log('   ✅ No version conflicts found');\n    } else {\n        for (const conflict of conflicts) {\n            console.log(conflict);\n        }\n    }\n\n    return conflicts;\n}\n\n/**\n * Prints the educational message explaining why semver ranges are forbidden.\n * This helps developers understand the rationale behind locked versions.\n */\n// webpieces-disable max-lines-new-methods -- Educational message template, splitting reduces clarity\nfunction printSemverRangeEducationalMessage(semverErrors: number): void {\n    console.log(`\n❌ SEMVER RANGES DETECTED - BUILD FAILED\n\nFound ${semverErrors} package(s) using semver ranges (^, ~, *, etc.) instead of locked versions.\n\nWHY THIS IS A HARD FAILURE:\n═══════════════════════════════════════════════════════════════════════════════\n\n1. MICRO BUGS ARE REAL\n   Thinking that patch versions (1.4.5 → 1.4.6) don't introduce bugs is wrong.\n   They do. Sometimes what looks like an \"easy fix\" breaks things in subtle ways.\n\n2. GIT BISECT BECOMES USELESS\n   When you run \"git bisect\" to find when a bug was introduced, it fails if\n   software changed OUTSIDE of git. You checkout an old commit, but node_modules\n   has different versions than when that commit was made. The bug persists even\n   in \"known good\" commits because the library versions drifted.\n\n3. THE \"MAGIC BUG\" PROBLEM\n   You checkout code from 6 months ago to debug an issue. The bug is still there!\n   But it wasn't there 6 months ago... The culprit: a minor version upgrade that\n   happened silently without any PR or git commit. Impossible to track down.\n\n4. CHANGES OUTSIDE GIT = BAD\n   Every change to your software should be tracked in version control.\n   Implicit library upgrades via semver ranges violate this principle.\n\nTHE SOLUTION:\n═══════════════════════════════════════════════════════════════════════════════\n\nUse LOCKED (exact) versions for all dependencies:\n  ❌ \"lodash\": \"^4.17.21\"    <- BAD: allows 4.17.22, 4.18.0, etc.\n  ❌ \"lodash\": \"~4.17.21\"    <- BAD: allows 4.17.22, 4.17.23, etc.\n  ✅ \"lodash\": \"4.17.21\"     <- GOOD: locked to this exact version\n\nTo upgrade libraries, use an explicit process:\n  1. Run: npm update <package-name>\n  2. Test thoroughly\n  3. Commit the package.json AND package-lock.json changes\n  4. Create a PR so the upgrade is reviewed and tracked in git history\n\nThis way, every library change is:\n  • Intentional (not accidental)\n  • Reviewed (via PR)\n  • Tracked (in git history)\n  • Bisectable (git bisect works correctly)\n\n`);\n}\n\ntype SemverRangeResult = { errors: number };\n\n// Check semver ranges in all package.json files - FAILS if any found\nfunction checkSemverRanges(workspaceRoot: string): SemverRangeResult {\n    console.log('\\n📋 Checking for unlocked versions (semver ranges):');\n    const packageFiles = findPackageJsonFiles(workspaceRoot);\n    let semverErrors = 0;\n\n    for (const filePath of packageFiles) {\n        const relativePath = path.relative(workspaceRoot, filePath);\n        const errors = validatePackageJson(filePath);\n\n        if (errors.length > 0) {\n            console.log(`   ❌ ${relativePath}:`);\n            for (const error of errors) {\n                console.log(`      ${error}`);\n            }\n            semverErrors += errors.length;\n        } else {\n            console.log(`   ✅ ${relativePath}`);\n        }\n    }\n\n    return { errors: semverErrors };\n}\n\nexport default async function runExecutor(\n    _options: ValidateVersionsLockedOptions,\n    context: ExecutorContext\n): Promise<ExecutorResult> {\n    const workspaceRoot = context.root;\n\n    // All-or-nothing (honorEpoch = false): there is no blessed baseline to grandfather against.\n    if (new RuleGate().isDisabled(workspaceRoot, 'validate-versions-locked', false)) {\n        return { success: true };\n    }\n\n    console.log('\\n🔒 Validating Package Versions are LOCKED and CONSISTENT\\n');\n\n    // Step 1: Check for semver ranges (FAILS if any found)\n    const semverResult = checkSemverRanges(workspaceRoot);\n    const semverErrors = semverResult.errors;\n    const packageFiles = findPackageJsonFiles(workspaceRoot);\n\n    // Step 2: Check for version conflicts across package.json files\n    const versionConflicts = checkVersionConflicts(workspaceRoot);\n\n    // Summary\n    console.log(`\\n📊 Summary:`);\n    console.log(`   Files checked: ${packageFiles.length}`);\n    console.log(`   Unlocked versions (semver ranges): ${semverErrors}`);\n    console.log(`   Version conflicts: ${versionConflicts.length}`);\n\n    // Fail on semver ranges with educational message\n    if (semverErrors > 0) {\n        printSemverRangeEducationalMessage(semverErrors);\n        return { success: false };\n    }\n\n    // Fail on version conflicts\n    if (versionConflicts.length > 0) {\n        console.log('\\n❌ VALIDATION FAILED!');\n        console.log('   Fix version conflicts - all package.json files must use the same version for each dependency.');\n        console.log('   This prevents \"works on my machine\" bugs where different projects use different library versions.\\n');\n        return { success: false };\n    }\n\n    console.log('\\n✅ VALIDATION PASSED! All versions are locked and consistent.');\n    return { success: true };\n}\n"]}

package/src/lib/dep-usage-scanner.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Dep Usage Scanner
+ *
+ * Answers ONE question for a project: "is package X reached from production
+ * source, or ONLY from test/dev files?"
+ *
+ * WHY this exists: nx derives graph edges from ALL TypeScript sources, specs
+ * included. Without this scan, a package imported only by `*.spec.ts` looks
+ * identical to a package imported by a controller, so the validator forces it
+ * into `dependencies` — and `pnpm deploy --prod` then ships test machinery
+ * (auth-bypass hooks, canned credentials, fakes) into the production image.
+ * Splitting the scan by file kind lets `devDependencies` be the REQUIRED home
+ * for test-only packages.
+ *
+ * The scan is deliberately conservative: a package is "test-only" ONLY when it
+ * is imported by at least one test/dev file and by ZERO production files. Any
+ * doubt (no import found at all, e.g. a runtime-only/reflection dependency)
+ * resolves to "production", so this can never push a runtime-required package
+ * out of `dependencies`.
+ */
+/**
+ * Which packages a project reaches from production code vs. only from test/dev code.
+ * Data-only: no logic lives here (see CLAUDE.md — data structures are classes).
+ */
+export declare class DepUsage {
+    prodPackages: Set<string>;
+    testPackages: Set<string>;
+    constructor(prodPackages: Set<string>, testPackages: Set<string>);
+    /** True when the package is imported by tests and by no production file. */
+    isTestOnly(packageName: string): boolean;
+    /** True when we saw the package in NO file at all (kind is unknown → treat as prod). */
+    isUnseen(packageName: string): boolean;
+}
+export declare class DepUsageScanner {
+    /**
+     * Walk a project directory and record every bare import specifier, bucketed
+     * by whether the importing file is production or test/dev.
+     */
+    scan(absProjectDir: string): DepUsage;
+    /**
+     * Is this path a test/dev file? Path is relative to the project root and
+     * uses either separator.
+     */
+    isDevFile(relPath: string): boolean;
+    /**
+     * The package a bare specifier belongs to, or null for relative/absolute
+     * paths and node: builtins. `@scope/pkg/sub` → `@scope/pkg`; `pkg/sub` → `pkg`.
+     */
+    toPackageName(specifier: string): string | null;
+    private walk;
+    private scanFile;
+    private extractPackageNames;
+    private readFile;
+}