@webpieces/pr-gate 0.4.484 → 0.4.485

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/pr-gate",
-  "version": "0.4.484",
+  "version": "0.4.485",
   "description": "Gated PR system: 3-point squash-merge, merge validation gate, and red/yellow/green PR dashboard. Standalone scripts, no Nx dependency required.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -25,7 +25,7 @@
     "directory": "packages/tooling/pr-gate"
   },
   "dependencies": {
-    "@webpieces/rules-config": "0.4.484",
+    "@webpieces/rules-config": "0.4.485",
     "@inversifyjs/binding-decorators": "1.1.5",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"

package/src/scripts/commands/start-upsert-pr-command.d.ts

@@ -1,19 +1,17 @@
 import { RepoRootFinder, ReviewJsonService, DiffScope } from '@webpieces/rules-config';
 import { AiBranchName } from '../workflow/git-readAiBranchName';
 import { BranchNaming } from '../workflow/branch-naming';
-import { BuildAffected } from '../workflow/build-affected';
 import { GitExec } from '../workflow/git-exec';
 import { RunUpdate } from '../workflow/run-update';
 export declare class StartUpsertPrCommand {
     private readonly repoRootFinder;
     private readonly aiBranchName;
     private readonly branchNaming;
-    private readonly buildAffected;
     private readonly gitExec;
     private readonly runUpdate;
     private readonly reviewJsonService;
     private readonly diffScope;
-    constructor(repoRootFinder: RepoRootFinder, aiBranchName: AiBranchName, branchNaming: BranchNaming, buildAffected: BuildAffected, gitExec: GitExec, runUpdate: RunUpdate, reviewJsonService: ReviewJsonService, diffScope: DiffScope);
+    constructor(repoRootFinder: RepoRootFinder, aiBranchName: AiBranchName, branchNaming: BranchNaming, gitExec: GitExec, runUpdate: RunUpdate, reviewJsonService: ReviewJsonService, diffScope: DiffScope);
     run(): Promise<void>;
     /**
      * Hand the AI its next step: run `wp-checklist`, write review.json, then run finish (which posts the PR).

package/src/scripts/commands/start-upsert-pr-command.js

@@ -6,28 +6,27 @@ const rules_config_1 = require("@webpieces/rules-config");
 const inversify_1 = require("inversify");
 const git_readAiBranchName_1 = require("../workflow/git-readAiBranchName");
 const branch_naming_1 = require("../workflow/branch-naming");
-const build_affected_1 = require("../workflow/build-affected");
 const git_exec_1 = require("../workflow/git-exec");
 const run_update_1 = require("../workflow/run-update");
 const SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n';
-// START of the AI-first PR flow: the deterministic setup — update from main, run the advisory build gate
-// — then hand the AI instructions to WRITE review.json and run `wp-finish-upsert-pr` (which reads it and
-// posts the PR). This command NEVER creates/updates a PR and NEVER pushes: all `gh` posting and the ONE
-// push live in finish, behind review.json + the checklists + the authoritative build gate.
+// START of the AI-first PR flow: the deterministic setup — update from main — then hand the AI
+// instructions to run `wp-checklist`, WRITE review.json, and run `wp-finish-upsert-pr` (which reads it
+// and posts the PR). It runs NO build gate: start's job is the update / 3-point merge, and the SINGLE
+// build gate is authoritative and lives in wp-finish-upsert-pr (so `pr-gate.buildCommand` is a
+// finish-only knob). This command NEVER creates/updates a PR and NEVER pushes: all `gh` posting and the
+// ONE push live in finish, behind review.json + the checklists + the authoritative build gate.
 let StartUpsertPrCommand = class StartUpsertPrCommand {
     repoRootFinder;
     aiBranchName;
     branchNaming;
-    buildAffected;
     gitExec;
     runUpdate;
     reviewJsonService;
     diffScope;
-    constructor(repoRootFinder, aiBranchName, branchNaming, buildAffected, gitExec, runUpdate, reviewJsonService, diffScope) {
+    constructor(repoRootFinder, aiBranchName, branchNaming, gitExec, runUpdate, reviewJsonService, diffScope) {
         this.repoRootFinder = repoRootFinder;
         this.aiBranchName = aiBranchName;
         this.branchNaming = branchNaming;
-        this.buildAffected = buildAffected;
         this.gitExec = gitExec;
         this.runUpdate = runUpdate;
         this.reviewJsonService = reviewJsonService;
@@ -50,9 +49,8 @@ let StartUpsertPrCommand = class StartUpsertPrCommand {
         // every BLOCK checklist, and the authoritative build gate — so no unreviewed commit reaches the
         // remote, and there is no early `synchronize` firing against a PR body with a stale gate token.
         await this.updateBranchFromMain(repoRoot);
-        // Advisory build gate — early feedback before the AI writes review.json. wp-finish-upsert-pr
-        // runs the authoritative one. Both go through the same runBuildGate (only the framing differs).
-        this.buildAffected.runBuildGate(repoRoot, new build_affected_1.BuildGateOptions('② Build gate (nx affected)', 'pnpm wp-start-upsert-pr', 'Build failed — fix it before reviewing.'));
+        // No build gate here — start only updates from main / drives the 3-point merge. The one build
+        // gate is authoritative and runs in wp-finish-upsert-pr, after review.json + every checklist.
         this.handOffToReview(repoRoot);
     }
     /**
@@ -71,8 +69,8 @@ let StartUpsertPrCommand = class StartUpsertPrCommand {
         // Persist the PR diff context (base sha + the full changed-file set) — wp-checklist and every reviewer
         // subagent read it, so it must exist before either runs.
         const context = this.writePrContext(repoRoot);
-        process.stdout.write('\n' + SEP + '③ Review the PR, then finish\n' + SEP + '\n');
-        process.stdout.write(`Branch is updated and the build gate passed (nothing pushed yet — finish does the one push).\n` +
+        process.stdout.write('\n' + SEP + '② Review the PR, then finish\n' + SEP + '\n');
+        process.stdout.write(`Branch is updated (nothing pushed yet — finish does the one push, behind the build gate).\n` +
             `${this.contextLines(context)}\n` +
             `${this.checklistPointer(repoRoot)}\n` +
             `Then review your own changes and\n` +
@@ -143,7 +141,6 @@ exports.StartUpsertPrCommand = StartUpsertPrCommand = tslib_1.__decorate([
     tslib_1.__metadata("design:paramtypes", [rules_config_1.RepoRootFinder,
         git_readAiBranchName_1.AiBranchName,
         branch_naming_1.BranchNaming,
-        build_affected_1.BuildAffected,
         git_exec_1.GitExec,
         run_update_1.RunUpdate,
         rules_config_1.ReviewJsonService,

package/src/scripts/commands/start-upsert-pr-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"start-upsert-pr-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/start-upsert-pr-command.ts"],"names":[],"mappings":";;;;AACA,0DAA2P;AAC3P,yCAA2D;AAC3D,2EAAgE;AAChE,6DAAyD;AACzD,+DAA6E;AAC7E,mDAA+C;AAC/C,uDAAmD;AAEnD,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,yGAAyG;AACzG,yGAAyG;AACzG,wGAAwG;AACxG,2FAA2F;AAEpF,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAER;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IARrB,YACqB,cAA8B,EAC9B,YAA0B,EAC1B,YAA0B,EAC1B,aAA4B,EAC5B,OAAgB,EAChB,SAAoB,EACpB,iBAAoC,EACpC,SAAoB;QAPpB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,kBAAa,GAAb,aAAa,CAAe;QAC5B,YAAO,GAAP,OAAO,CAAS;QAChB,cAAS,GAAT,SAAS,CAAW;QACpB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,cAAS,GAAT,SAAS,CAAW;IACtC,CAAC;IAEJ,KAAK,CAAC,GAAG;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,gGAAgG;QAChG,IAAA,4BAAa,EAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QACrD,gGAAgG;QAChG,mGAAmG;QACnG,mGAAmG;QACnG,6CAA6C;QAC7C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAElC,gGAAgG;QAChG,4FAA4F;QAC5F,iGAAiG;QACjG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEvC,iGAAiG;QACjG,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAE1C,6FAA6F;QAC7F,gGAAgG;QAChG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,iCAAgB,CAC1D,4BAA4B,EAAE,yBAAyB,EAAE,yCAAyC,CACrG,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACK,eAAe,CAAC,QAAgB;QACpC,MAAM,UAAU,GAAG,IAAA,6BAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC;QAChF,4FAA4F;QAC5F,IAAA,4BAAa,EAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;QAC1D,uGAAuG;QACvG,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,gCAAgC,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QACjF,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,gGAAgG;YAChG,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI;YACjC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI;YACtC,oCAAoC;YACpC,GAAG,IAAA,mCAAoB,EAAC,UAAU,CAAC,MAAM;YACzC,0CAA0C;YAC1C,gHAAgH,CACnH,CAAC;IACN,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,QAAgB;QACrC,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,2FAA2F,CAAC;QACvG,CAAC;QACD,OAAO,CACH,oCAAoC;YACpC,+FAA+F;YAC/F,gGAAgG;YAChG,8FAA8F,CACjG,CAAC;IACN,CAAC;IAED,gGAAgG;IAChG,oGAAoG;IACpG,kGAAkG;IAC1F,cAAc,CAAC,QAAgB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,IAAI,qCAAsB,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,kCAAmB,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,MAAM,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAC3C,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,IAAI,wBAAS,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CACzF,CAAC;QACF,OAAO,IAAI,qCAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,kGAAkG;IAC1F,YAAY,CAAC,OAA+B;QAChD,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC7C,OAAO,CACH,wBAAwB,OAAO,CAAC,OAAO,SAAS;YAChD,2CAA2C,OAAO,CAAC,aAAa,IAAI,CACvE,CAAC;IACN,CAAC;IAED,kGAAkG;IAClG,oGAAoG;IACpG,mGAAmG;IAC3F,kBAAkB,CAAC,QAAgB;QACvC,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO;QACpE,IAAA,qCAAsB,EAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,qFAAqF;YACrF,gGAAgG;YAChG,2FAA2F,CAC9F,CAAC;IACN,CAAC;IAED,oGAAoG;IACpG,iFAAiF;IACzE,KAAK,CAAC,oBAAoB,CAAC,QAAgB;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,+BAA+B,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QAChF,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,KAAK,CAAC,CAAC;QACrH,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;YAC5D,MAAM,IAAI,2BAAY,CAAC,CAAC,EACpB,iHAAiH,CACpH,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AAxIY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QAChB,mCAAY;QACZ,4BAAY;QACX,8BAAa;QACnB,kBAAO;QACL,sBAAS;QACD,gCAAiB;QACzB,wBAAS;GAThC,oBAAoB,CAwIhC","sourcesContent":["import { execSync } from 'child_process';\nimport { loadAndValidate, reviewJsonPath, reviewJsonSchemaHint, writeTemplate, writeTemplateIfMissing, CliExitError, RepoRootFinder, ReviewJsonService, DiffScope, ChangedFilesOptions, PrContext, ChecklistReviewContext } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { AiBranchName } from '../workflow/git-readAiBranchName';\nimport { BranchNaming } from '../workflow/branch-naming';\nimport { BuildAffected, BuildGateOptions } from '../workflow/build-affected';\nimport { GitExec } from '../workflow/git-exec';\nimport { RunUpdate } from '../workflow/run-update';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n// START of the AI-first PR flow: the deterministic setup — update from main, run the advisory build gate\n// — then hand the AI instructions to WRITE review.json and run `wp-finish-upsert-pr` (which reads it and\n// posts the PR). This command NEVER creates/updates a PR and NEVER pushes: all `gh` posting and the ONE\n// push live in finish, behind review.json + the checklists + the authoritative build gate.\n@injectable(bindingScopeValues.Singleton)\nexport class StartUpsertPrCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly aiBranchName: AiBranchName,\n        private readonly branchNaming: BranchNaming,\n        private readonly buildAffected: BuildAffected,\n        private readonly gitExec: GitExec,\n        private readonly runUpdate: RunUpdate,\n        private readonly reviewJsonService: ReviewJsonService,\n        private readonly diffScope: DiffScope,\n    ) {}\n\n    async run(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        // Refresh the AI-facing workflow doc so it's present + current for any failure message to cite.\n        writeTemplate(repoRoot, 'webpieces.git-workflow.md');\n        // When this repo has opted into server-side enforcement (a committed gateSalt), scaffold the CI\n        // workflow into the gitignored instruct-ai dir (never .github directly — that would dirty the tree\n        // before the clean-tree check) and tell the human to copy + require it. IfMissing so it is written\n        // once and never clobbers a customized copy.\n        this.scaffoldCiWorkflow(repoRoot);\n\n        // Precondition: a fully-committed tree. This flow squash-updates the branch and builds it — the\n        // tooling must not commit your work for you, and building a dirty working tree would let an\n        // uncommitted change build green over a different commit than the one that ships. Fail if dirty.\n        this.gitExec.assertCleanTree(repoRoot);\n\n        // Nothing here pushes. This command reviews; wp-finish-upsert-pr pushes ONCE, after review.json,\n        // every BLOCK checklist, and the authoritative build gate — so no unreviewed commit reaches the\n        // remote, and there is no early `synchronize` firing against a PR body with a stale gate token.\n        await this.updateBranchFromMain(repoRoot);\n\n        // Advisory build gate — early feedback before the AI writes review.json. wp-finish-upsert-pr\n        // runs the authoritative one. Both go through the same runBuildGate (only the framing differs).\n        this.buildAffected.runBuildGate(repoRoot, new BuildGateOptions(\n            '② Build gate (nx affected)', 'pnpm wp-start-upsert-pr', 'Build failed — fix it before reviewing.',\n        ));\n\n        this.handOffToReview(repoRoot);\n    }\n\n    /**\n     * Hand the AI its next step: run `wp-checklist`, write review.json, then run finish (which posts the PR).\n     *\n     * This USED to compute the matched checklists and print every reviewer's full instructions inline — twice,\n     * in two blocks that could drift. That detail now lives in ONE command, `wp-checklist`, which wp-finish\n     * validates against; here we only point at it. Keeping this section short is the point: it is the block\n     * the AI must actually act on, and burying the three steps in forty lines of reviewer detail is how a\n     * step gets skipped.\n     */\n    private handOffToReview(repoRoot: string): void {\n        const reviewPath = reviewJsonPath(repoRoot, this.aiBranchName.getFeatureName());\n        // Persist the review-format + process instructions where any failure message can cite them.\n        writeTemplate(repoRoot, 'webpieces.review-checklists.md');\n        // Persist the PR diff context (base sha + the full changed-file set) — wp-checklist and every reviewer\n        // subagent read it, so it must exist before either runs.\n        const context = this.writePrContext(repoRoot);\n        process.stdout.write('\\n' + SEP + '③ Review the PR, then finish\\n' + SEP + '\\n');\n        process.stdout.write(\n            `Branch is updated and the build gate passed (nothing pushed yet — finish does the one push).\\n` +\n            `${this.contextLines(context)}\\n` +\n            `${this.checklistPointer(repoRoot)}\\n` +\n            `Then review your own changes and\\n` +\n            `${reviewJsonSchemaHint(reviewPath)}\\n\\n` +\n            `Finally run:  pnpm wp-finish-upsert-pr\\n` +\n            `(It re-validates the build, re-checks every checklist, renders the dashboard, and creates/updates the PR.)\\n\\n`,\n        );\n    }\n\n    /**\n     * Step 1 of the review: find out what review this diff owes. A repo with checklists gets pointed at\n     * `wp-checklist`; a repo with none is told plainly that it has none, because printing \"run wp-checklist\"\n     * forever at a repo that will never have one is noise, and silence reads as \"a checklist passed\".\n     */\n    private checklistPointer(repoRoot: string): string {\n        if (loadAndValidate(repoRoot).prGate.checklists.length === 0) {\n            return '📋 Review checklists: NONE CONFIGURED for this repo — nothing to run, and that is fine.\\n';\n        }\n        return (\n            '📋 FIRST run:  pnpm wp-checklist\\n' +\n            '   It validates this repo\\'s checklist patterns against your diff and prints WHICH reviewer\\n' +\n            '   subagents you must spawn, plus the exact review-<id>.json each must write. Do that BEFORE\\n' +\n            '   finishing — wp-finish-upsert-pr refuses to open the PR until every one of them has run.\\n'\n        );\n    }\n\n    // Write pr-context.json (base/head sha + the full changed-file set, tsOnly:false) so a reviewer\n    // subagent knows the exact base the gate uses and can `git diff <base> HEAD -- <file>` for content.\n    // Returns what every printed instruction needs to inline; an empty context when no base resolves.\n    private writePrContext(repoRoot: string): ChecklistReviewContext {\n        const range = this.diffScope.resolveBase(repoRoot);\n        if (!range.base) return new ChecklistReviewContext();\n        const opts = new ChangedFilesOptions();\n        opts.tsOnly = false;\n        const changed = this.diffScope.getChangedFiles(repoRoot, range.base, range.head, opts);\n        const head = range.head && range.head.trim() !== '' ? range.head : 'HEAD';\n        const p = this.reviewJsonService.writePrContext(\n            repoRoot, this.aiBranchName.getFeatureName(), new PrContext(range.base, head, changed),\n        );\n        return new ChecklistReviewContext(range.base, p);\n    }\n\n    // The diff facts, stated where the instruction to use them is — not in a separate block above it.\n    private contextLines(context: ChecklistReviewContext): string {\n        if (context.baseSha.trim() === '') return '';\n        return (\n            `Your diff:  git diff ${context.baseSha} HEAD\\n` +\n            `Full changed-file set + base/head sha:  ${context.prContextPath}\\n`\n        );\n    }\n\n    // Scaffold the server-side CI check when (and only when) this repo set a gateSalt. Written to the\n    // gitignored instruct-ai dir so it never dirties the tree; the human copies it to .github/workflows\n    // and marks it required (webpieces can't set branch protection). No-op for repos with no gateSalt.\n    private scaffoldCiWorkflow(repoRoot: string): void {\n        if (loadAndValidate(repoRoot).prGate.gateSalt.trim() === '') return;\n        writeTemplateIfMissing(repoRoot, 'webpieces-pr-gate.yml');\n        process.stdout.write(\n            `\\nℹ️  Server-side gate enforcement is ON (gateSalt set). If you have not already:\\n` +\n            `   • copy  .webpieces/instruct-ai/webpieces-pr-gate.yml  → .github/workflows/  and commit it\\n` +\n            `   • mark the \"webpieces-pr-gate\" check REQUIRED in branch protection (repo admin only)\\n`,\n        );\n    }\n\n    // Bring the branch up to date with main via the shared 3-point engine (in-process). On conflict the\n    // merge process doc it writes names `wp-finish-upsert-pr` as the finish command.\n    private async updateBranchFromMain(repoRoot: string): Promise<void> {\n        process.stdout.write('\\n' + SEP + '① Updating branch from main\\n' + SEP + '\\n');\n        // pushRemote=false — finish owns the single push (see MergeEndOptions).\n        const outcome = await this.runUpdate.runUpdateFromMain(repoRoot, 'wp-start-upsert-pr', 'wp-finish-upsert-pr', false);\n        if (outcome === 'conflict' || outcome === 'unvalidatedResume') {\n            throw new CliExitError(2,\n                '\\n⏸️  Conflicts — resolve them, then run pnpm wp-finish-upsert-pr (it validates the merge AND finishes the PR).',\n            );\n        }\n    }\n}\n"]}
+{"version":3,"file":"start-upsert-pr-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/start-upsert-pr-command.ts"],"names":[],"mappings":";;;;AACA,0DAA2P;AAC3P,yCAA2D;AAC3D,2EAAgE;AAChE,6DAAyD;AACzD,mDAA+C;AAC/C,uDAAmD;AAEnD,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,+FAA+F;AAC/F,uGAAuG;AACvG,sGAAsG;AACtG,+FAA+F;AAC/F,wGAAwG;AACxG,+FAA+F;AAExF,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAER;IACA;IACA;IACA;IACA;IACA;IACA;IAPrB,YACqB,cAA8B,EAC9B,YAA0B,EAC1B,YAA0B,EAC1B,OAAgB,EAChB,SAAoB,EACpB,iBAAoC,EACpC,SAAoB;QANpB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,YAAO,GAAP,OAAO,CAAS;QAChB,cAAS,GAAT,SAAS,CAAW;QACpB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,cAAS,GAAT,SAAS,CAAW;IACtC,CAAC;IAEJ,KAAK,CAAC,GAAG;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,gGAAgG;QAChG,IAAA,4BAAa,EAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QACrD,gGAAgG;QAChG,mGAAmG;QACnG,mGAAmG;QACnG,6CAA6C;QAC7C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAElC,gGAAgG;QAChG,4FAA4F;QAC5F,iGAAiG;QACjG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEvC,iGAAiG;QACjG,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAE1C,8FAA8F;QAC9F,8FAA8F;QAC9F,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACK,eAAe,CAAC,QAAgB;QACpC,MAAM,UAAU,GAAG,IAAA,6BAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC;QAChF,4FAA4F;QAC5F,IAAA,4BAAa,EAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;QAC1D,uGAAuG;QACvG,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,gCAAgC,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QACjF,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,6FAA6F;YAC7F,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI;YACjC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI;YACtC,oCAAoC;YACpC,GAAG,IAAA,mCAAoB,EAAC,UAAU,CAAC,MAAM;YACzC,0CAA0C;YAC1C,gHAAgH,CACnH,CAAC;IACN,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,QAAgB;QACrC,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,2FAA2F,CAAC;QACvG,CAAC;QACD,OAAO,CACH,oCAAoC;YACpC,+FAA+F;YAC/F,gGAAgG;YAChG,8FAA8F,CACjG,CAAC;IACN,CAAC;IAED,gGAAgG;IAChG,oGAAoG;IACpG,kGAAkG;IAC1F,cAAc,CAAC,QAAgB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,IAAI,qCAAsB,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,kCAAmB,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1E,MAAM,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAC3C,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,IAAI,wBAAS,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CACzF,CAAC;QACF,OAAO,IAAI,qCAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,kGAAkG;IAC1F,YAAY,CAAC,OAA+B;QAChD,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC7C,OAAO,CACH,wBAAwB,OAAO,CAAC,OAAO,SAAS;YAChD,2CAA2C,OAAO,CAAC,aAAa,IAAI,CACvE,CAAC;IACN,CAAC;IAED,kGAAkG;IAClG,oGAAoG;IACpG,mGAAmG;IAC3F,kBAAkB,CAAC,QAAgB;QACvC,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO;QACpE,IAAA,qCAAsB,EAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,qFAAqF;YACrF,gGAAgG;YAChG,2FAA2F,CAC9F,CAAC;IACN,CAAC;IAED,oGAAoG;IACpG,iFAAiF;IACzE,KAAK,CAAC,oBAAoB,CAAC,QAAgB;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,+BAA+B,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QAChF,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,KAAK,CAAC,CAAC;QACrH,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,mBAAmB,EAAE,CAAC;YAC5D,MAAM,IAAI,2BAAY,CAAC,CAAC,EACpB,iHAAiH,CACpH,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AAnIY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QAChB,mCAAY;QACZ,4BAAY;QACjB,kBAAO;QACL,sBAAS;QACD,gCAAiB;QACzB,wBAAS;GARhC,oBAAoB,CAmIhC","sourcesContent":["import { execSync } from 'child_process';\nimport { loadAndValidate, reviewJsonPath, reviewJsonSchemaHint, writeTemplate, writeTemplateIfMissing, CliExitError, RepoRootFinder, ReviewJsonService, DiffScope, ChangedFilesOptions, PrContext, ChecklistReviewContext } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { AiBranchName } from '../workflow/git-readAiBranchName';\nimport { BranchNaming } from '../workflow/branch-naming';\nimport { GitExec } from '../workflow/git-exec';\nimport { RunUpdate } from '../workflow/run-update';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n// START of the AI-first PR flow: the deterministic setup — update from main — then hand the AI\n// instructions to run `wp-checklist`, WRITE review.json, and run `wp-finish-upsert-pr` (which reads it\n// and posts the PR). It runs NO build gate: start's job is the update / 3-point merge, and the SINGLE\n// build gate is authoritative and lives in wp-finish-upsert-pr (so `pr-gate.buildCommand` is a\n// finish-only knob). This command NEVER creates/updates a PR and NEVER pushes: all `gh` posting and the\n// ONE push live in finish, behind review.json + the checklists + the authoritative build gate.\n@injectable(bindingScopeValues.Singleton)\nexport class StartUpsertPrCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly aiBranchName: AiBranchName,\n        private readonly branchNaming: BranchNaming,\n        private readonly gitExec: GitExec,\n        private readonly runUpdate: RunUpdate,\n        private readonly reviewJsonService: ReviewJsonService,\n        private readonly diffScope: DiffScope,\n    ) {}\n\n    async run(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        // Refresh the AI-facing workflow doc so it's present + current for any failure message to cite.\n        writeTemplate(repoRoot, 'webpieces.git-workflow.md');\n        // When this repo has opted into server-side enforcement (a committed gateSalt), scaffold the CI\n        // workflow into the gitignored instruct-ai dir (never .github directly — that would dirty the tree\n        // before the clean-tree check) and tell the human to copy + require it. IfMissing so it is written\n        // once and never clobbers a customized copy.\n        this.scaffoldCiWorkflow(repoRoot);\n\n        // Precondition: a fully-committed tree. This flow squash-updates the branch and builds it — the\n        // tooling must not commit your work for you, and building a dirty working tree would let an\n        // uncommitted change build green over a different commit than the one that ships. Fail if dirty.\n        this.gitExec.assertCleanTree(repoRoot);\n\n        // Nothing here pushes. This command reviews; wp-finish-upsert-pr pushes ONCE, after review.json,\n        // every BLOCK checklist, and the authoritative build gate — so no unreviewed commit reaches the\n        // remote, and there is no early `synchronize` firing against a PR body with a stale gate token.\n        await this.updateBranchFromMain(repoRoot);\n\n        // No build gate here — start only updates from main / drives the 3-point merge. The one build\n        // gate is authoritative and runs in wp-finish-upsert-pr, after review.json + every checklist.\n        this.handOffToReview(repoRoot);\n    }\n\n    /**\n     * Hand the AI its next step: run `wp-checklist`, write review.json, then run finish (which posts the PR).\n     *\n     * This USED to compute the matched checklists and print every reviewer's full instructions inline — twice,\n     * in two blocks that could drift. That detail now lives in ONE command, `wp-checklist`, which wp-finish\n     * validates against; here we only point at it. Keeping this section short is the point: it is the block\n     * the AI must actually act on, and burying the three steps in forty lines of reviewer detail is how a\n     * step gets skipped.\n     */\n    private handOffToReview(repoRoot: string): void {\n        const reviewPath = reviewJsonPath(repoRoot, this.aiBranchName.getFeatureName());\n        // Persist the review-format + process instructions where any failure message can cite them.\n        writeTemplate(repoRoot, 'webpieces.review-checklists.md');\n        // Persist the PR diff context (base sha + the full changed-file set) — wp-checklist and every reviewer\n        // subagent read it, so it must exist before either runs.\n        const context = this.writePrContext(repoRoot);\n        process.stdout.write('\\n' + SEP + '② Review the PR, then finish\\n' + SEP + '\\n');\n        process.stdout.write(\n            `Branch is updated (nothing pushed yet — finish does the one push, behind the build gate).\\n` +\n            `${this.contextLines(context)}\\n` +\n            `${this.checklistPointer(repoRoot)}\\n` +\n            `Then review your own changes and\\n` +\n            `${reviewJsonSchemaHint(reviewPath)}\\n\\n` +\n            `Finally run:  pnpm wp-finish-upsert-pr\\n` +\n            `(It re-validates the build, re-checks every checklist, renders the dashboard, and creates/updates the PR.)\\n\\n`,\n        );\n    }\n\n    /**\n     * Step 1 of the review: find out what review this diff owes. A repo with checklists gets pointed at\n     * `wp-checklist`; a repo with none is told plainly that it has none, because printing \"run wp-checklist\"\n     * forever at a repo that will never have one is noise, and silence reads as \"a checklist passed\".\n     */\n    private checklistPointer(repoRoot: string): string {\n        if (loadAndValidate(repoRoot).prGate.checklists.length === 0) {\n            return '📋 Review checklists: NONE CONFIGURED for this repo — nothing to run, and that is fine.\\n';\n        }\n        return (\n            '📋 FIRST run:  pnpm wp-checklist\\n' +\n            '   It validates this repo\\'s checklist patterns against your diff and prints WHICH reviewer\\n' +\n            '   subagents you must spawn, plus the exact review-<id>.json each must write. Do that BEFORE\\n' +\n            '   finishing — wp-finish-upsert-pr refuses to open the PR until every one of them has run.\\n'\n        );\n    }\n\n    // Write pr-context.json (base/head sha + the full changed-file set, tsOnly:false) so a reviewer\n    // subagent knows the exact base the gate uses and can `git diff <base> HEAD -- <file>` for content.\n    // Returns what every printed instruction needs to inline; an empty context when no base resolves.\n    private writePrContext(repoRoot: string): ChecklistReviewContext {\n        const range = this.diffScope.resolveBase(repoRoot);\n        if (!range.base) return new ChecklistReviewContext();\n        const opts = new ChangedFilesOptions();\n        opts.tsOnly = false;\n        const changed = this.diffScope.getChangedFiles(repoRoot, range.base, range.head, opts);\n        const head = range.head && range.head.trim() !== '' ? range.head : 'HEAD';\n        const p = this.reviewJsonService.writePrContext(\n            repoRoot, this.aiBranchName.getFeatureName(), new PrContext(range.base, head, changed),\n        );\n        return new ChecklistReviewContext(range.base, p);\n    }\n\n    // The diff facts, stated where the instruction to use them is — not in a separate block above it.\n    private contextLines(context: ChecklistReviewContext): string {\n        if (context.baseSha.trim() === '') return '';\n        return (\n            `Your diff:  git diff ${context.baseSha} HEAD\\n` +\n            `Full changed-file set + base/head sha:  ${context.prContextPath}\\n`\n        );\n    }\n\n    // Scaffold the server-side CI check when (and only when) this repo set a gateSalt. Written to the\n    // gitignored instruct-ai dir so it never dirties the tree; the human copies it to .github/workflows\n    // and marks it required (webpieces can't set branch protection). No-op for repos with no gateSalt.\n    private scaffoldCiWorkflow(repoRoot: string): void {\n        if (loadAndValidate(repoRoot).prGate.gateSalt.trim() === '') return;\n        writeTemplateIfMissing(repoRoot, 'webpieces-pr-gate.yml');\n        process.stdout.write(\n            `\\nℹ️  Server-side gate enforcement is ON (gateSalt set). If you have not already:\\n` +\n            `   • copy  .webpieces/instruct-ai/webpieces-pr-gate.yml  → .github/workflows/  and commit it\\n` +\n            `   • mark the \"webpieces-pr-gate\" check REQUIRED in branch protection (repo admin only)\\n`,\n        );\n    }\n\n    // Bring the branch up to date with main via the shared 3-point engine (in-process). On conflict the\n    // merge process doc it writes names `wp-finish-upsert-pr` as the finish command.\n    private async updateBranchFromMain(repoRoot: string): Promise<void> {\n        process.stdout.write('\\n' + SEP + '① Updating branch from main\\n' + SEP + '\\n');\n        // pushRemote=false — finish owns the single push (see MergeEndOptions).\n        const outcome = await this.runUpdate.runUpdateFromMain(repoRoot, 'wp-start-upsert-pr', 'wp-finish-upsert-pr', false);\n        if (outcome === 'conflict' || outcome === 'unvalidatedResume') {\n            throw new CliExitError(2,\n                '\\n⏸️  Conflicts — resolve them, then run pnpm wp-finish-upsert-pr (it validates the merge AND finishes the PR).',\n            );\n        }\n    }\n}\n"]}

package/src/scripts/pr-gate-app.d.ts

@@ -26,7 +26,7 @@ export declare class PrGateApp {
     startUpdate(): Promise<void>;
     /** `wp-finish-update`: validate + finalize a resolved 3-point merge (no PR). */
     finishUpdate(): Promise<void>;
-    /** `wp-start-upsert-pr`: update from main, push, advisory build gate, hand off review.json. */
+    /** `wp-start-upsert-pr`: update from main (3-point merge), hand off review.json. No build gate, no push. */
     startUpsertPr(): Promise<void>;
     /** `wp-finish-upsert-pr`: finalize merge, authoritative build gate, dashboard, create/update PR. */
     finishUpsertPr(): Promise<void>;

package/src/scripts/pr-gate-app.js

@@ -45,7 +45,7 @@ let PrGateApp = class PrGateApp {
     finishUpdate() {
         return this.finishUpdateCommand.run();
     }
-    /** `wp-start-upsert-pr`: update from main, push, advisory build gate, hand off review.json. */
+    /** `wp-start-upsert-pr`: update from main (3-point merge), hand off review.json. No build gate, no push. */
     startUpsertPr() {
         return this.startUpsertPrCommand.run();
     }

package/src/scripts/pr-gate-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"pr-gate-app.js","sourceRoot":"","sources":["../../../../../../packages/tooling/pr-gate/src/scripts/pr-gate-app.ts"],"names":[],"mappings":";;;;AAAA,0DAAyD;AACzD,yCAA2D;AAC3D,0EAAqE;AACrE,4EAAuE;AACvE,gFAA0E;AAC1E,kFAA4E;AAC5E,gEAA4D;AAC5D,gEAA2D;AAC3D,kEAA6D;AAC7D,oEAAgE;AAEhE;;;;;GAKG;AAGI,IAAM,SAAS,GAAf,MAAM,SAAS;IAEG;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IARrB,YACqB,kBAAsC,EACtC,mBAAwC,EACxC,oBAA0C,EAC1C,qBAA4C,EAC5C,cAA8B,EAC9B,aAA4B,EAC5B,cAA8B,EAC9B,gBAAkC;QAPlC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;QAC9B,kBAAa,GAAb,aAAa,CAAe;QAC5B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;IACpD,CAAC;IAEJ,kEAAkE;IAClE,WAAW;QACP,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,gFAAgF;IAChF,YAAY;QACR,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;IAC1C,CAAC;IAED,+FAA+F;IAC/F,aAAa;QACT,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;IAED,oGAAoG;IACpG,cAAc;QACV,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,CAAC;IAC5C,CAAC;IAED,gGAAgG;IAChG,OAAO;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;IAED,0FAA0F;IAC1F,MAAM;QACF,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAED,wGAAwG;IACxG,SAAS;QACL,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,+GAA+G;IAC/G,OAAO;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;CACJ,CAAA;AAnDY,8BAAS;oBAAT,SAAS;IAFrB,IAAA,6BAAc,GAAE;IAChB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGI,yCAAkB;QACjB,2CAAmB;QAClB,8CAAoB;QACnB,gDAAqB;QAC5B,gCAAc;QACf,+BAAa;QACZ,iCAAc;QACZ,oCAAgB;GAT9C,SAAS,CAmDrB","sourcesContent":["import { DocumentDesign } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { StartUpdateCommand } from './commands/start-update-command';\nimport { FinishUpdateCommand } from './commands/finish-update-command';\nimport { StartUpsertPrCommand } from './commands/start-upsert-pr-command';\nimport { FinishUpsertPrCommand } from './commands/finish-upsert-pr-command';\nimport { CleanupCommand } from './commands/cleanup-command';\nimport { LandPrCommand } from './commands/land-pr-command';\nimport { CheckPrCommand } from './commands/check-pr-command';\nimport { ChecklistCommand } from './commands/checklist-command';\n\n/**\n * The pr-gate application root. `container.get(PrGateApp)` resolves the entire workflow DAG (the command\n * classes → the injected git/merge/dashboard services). `@DocumentDesign` marks it the\n * top-of-DAG the DI-design analyzer roots on, so `role:app` pr-gate draws its design. Each `bin/*`\n * entry resolves THIS and calls the matching command method.\n */\n@DocumentDesign()\n@injectable(bindingScopeValues.Singleton)\nexport class PrGateApp {\n    constructor(\n        private readonly startUpdateCommand: StartUpdateCommand,\n        private readonly finishUpdateCommand: FinishUpdateCommand,\n        private readonly startUpsertPrCommand: StartUpsertPrCommand,\n        private readonly finishUpsertPrCommand: FinishUpsertPrCommand,\n        private readonly cleanupCommand: CleanupCommand,\n        private readonly landPrCommand: LandPrCommand,\n        private readonly checkPrCommand: CheckPrCommand,\n        private readonly checklistCommand: ChecklistCommand,\n    ) {}\n\n    /** `wp-start-update`: 3-point squash-update from main (no PR). */\n    startUpdate(): Promise<void> {\n        return this.startUpdateCommand.run();\n    }\n\n    /** `wp-finish-update`: validate + finalize a resolved 3-point merge (no PR). */\n    finishUpdate(): Promise<void> {\n        return this.finishUpdateCommand.run();\n    }\n\n    /** `wp-start-upsert-pr`: update from main, push, advisory build gate, hand off review.json. */\n    startUpsertPr(): Promise<void> {\n        return this.startUpsertPrCommand.run();\n    }\n\n    /** `wp-finish-upsert-pr`: finalize merge, authoritative build gate, dashboard, create/update PR. */\n    finishUpsertPr(): Promise<void> {\n        return this.finishUpsertPrCommand.run();\n    }\n\n    /** `wp-cleanup`: delete local branches whose PR is already merged (or that hold no commits). */\n    cleanup(): Promise<void> {\n        return this.cleanupCommand.run();\n    }\n\n    /** `wp-land-pr`: squash-merge this branch's PR into main with the compact commit body. */\n    landPr(): Promise<void> {\n        return this.landPrCommand.run();\n    }\n\n    /** `wp-checklist`: READ-ONLY — which reviewer subagents this diff still owes, and what to tell them. */\n    checklist(): Promise<void> {\n        return this.checklistCommand.run();\n    }\n\n    /** `wp-check-pr`: READ-ONLY CI check — verify the PR body carries a valid HMAC gate token for its head sha. */\n    checkPr(): Promise<void> {\n        return this.checkPrCommand.run();\n    }\n}\n"]}
+{"version":3,"file":"pr-gate-app.js","sourceRoot":"","sources":["../../../../../../packages/tooling/pr-gate/src/scripts/pr-gate-app.ts"],"names":[],"mappings":";;;;AAAA,0DAAyD;AACzD,yCAA2D;AAC3D,0EAAqE;AACrE,4EAAuE;AACvE,gFAA0E;AAC1E,kFAA4E;AAC5E,gEAA4D;AAC5D,gEAA2D;AAC3D,kEAA6D;AAC7D,oEAAgE;AAEhE;;;;;GAKG;AAGI,IAAM,SAAS,GAAf,MAAM,SAAS;IAEG;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IARrB,YACqB,kBAAsC,EACtC,mBAAwC,EACxC,oBAA0C,EAC1C,qBAA4C,EAC5C,cAA8B,EAC9B,aAA4B,EAC5B,cAA8B,EAC9B,gBAAkC;QAPlC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;QAC9B,kBAAa,GAAb,aAAa,CAAe;QAC5B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;IACpD,CAAC;IAEJ,kEAAkE;IAClE,WAAW;QACP,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,gFAAgF;IAChF,YAAY;QACR,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;IAC1C,CAAC;IAED,4GAA4G;IAC5G,aAAa;QACT,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;IAED,oGAAoG;IACpG,cAAc;QACV,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,CAAC;IAC5C,CAAC;IAED,gGAAgG;IAChG,OAAO;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;IAED,0FAA0F;IAC1F,MAAM;QACF,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAED,wGAAwG;IACxG,SAAS;QACL,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,+GAA+G;IAC/G,OAAO;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;CACJ,CAAA;AAnDY,8BAAS;oBAAT,SAAS;IAFrB,IAAA,6BAAc,GAAE;IAChB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGI,yCAAkB;QACjB,2CAAmB;QAClB,8CAAoB;QACnB,gDAAqB;QAC5B,gCAAc;QACf,+BAAa;QACZ,iCAAc;QACZ,oCAAgB;GAT9C,SAAS,CAmDrB","sourcesContent":["import { DocumentDesign } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { StartUpdateCommand } from './commands/start-update-command';\nimport { FinishUpdateCommand } from './commands/finish-update-command';\nimport { StartUpsertPrCommand } from './commands/start-upsert-pr-command';\nimport { FinishUpsertPrCommand } from './commands/finish-upsert-pr-command';\nimport { CleanupCommand } from './commands/cleanup-command';\nimport { LandPrCommand } from './commands/land-pr-command';\nimport { CheckPrCommand } from './commands/check-pr-command';\nimport { ChecklistCommand } from './commands/checklist-command';\n\n/**\n * The pr-gate application root. `container.get(PrGateApp)` resolves the entire workflow DAG (the command\n * classes → the injected git/merge/dashboard services). `@DocumentDesign` marks it the\n * top-of-DAG the DI-design analyzer roots on, so `role:app` pr-gate draws its design. Each `bin/*`\n * entry resolves THIS and calls the matching command method.\n */\n@DocumentDesign()\n@injectable(bindingScopeValues.Singleton)\nexport class PrGateApp {\n    constructor(\n        private readonly startUpdateCommand: StartUpdateCommand,\n        private readonly finishUpdateCommand: FinishUpdateCommand,\n        private readonly startUpsertPrCommand: StartUpsertPrCommand,\n        private readonly finishUpsertPrCommand: FinishUpsertPrCommand,\n        private readonly cleanupCommand: CleanupCommand,\n        private readonly landPrCommand: LandPrCommand,\n        private readonly checkPrCommand: CheckPrCommand,\n        private readonly checklistCommand: ChecklistCommand,\n    ) {}\n\n    /** `wp-start-update`: 3-point squash-update from main (no PR). */\n    startUpdate(): Promise<void> {\n        return this.startUpdateCommand.run();\n    }\n\n    /** `wp-finish-update`: validate + finalize a resolved 3-point merge (no PR). */\n    finishUpdate(): Promise<void> {\n        return this.finishUpdateCommand.run();\n    }\n\n    /** `wp-start-upsert-pr`: update from main (3-point merge), hand off review.json. No build gate, no push. */\n    startUpsertPr(): Promise<void> {\n        return this.startUpsertPrCommand.run();\n    }\n\n    /** `wp-finish-upsert-pr`: finalize merge, authoritative build gate, dashboard, create/update PR. */\n    finishUpsertPr(): Promise<void> {\n        return this.finishUpsertPrCommand.run();\n    }\n\n    /** `wp-cleanup`: delete local branches whose PR is already merged (or that hold no commits). */\n    cleanup(): Promise<void> {\n        return this.cleanupCommand.run();\n    }\n\n    /** `wp-land-pr`: squash-merge this branch's PR into main with the compact commit body. */\n    landPr(): Promise<void> {\n        return this.landPrCommand.run();\n    }\n\n    /** `wp-checklist`: READ-ONLY — which reviewer subagents this diff still owes, and what to tell them. */\n    checklist(): Promise<void> {\n        return this.checklistCommand.run();\n    }\n\n    /** `wp-check-pr`: READ-ONLY CI check — verify the PR body carries a valid HMAC gate token for its head sha. */\n    checkPr(): Promise<void> {\n        return this.checkPrCommand.run();\n    }\n}\n"]}

package/src/scripts/workflow/build-affected.d.ts

@@ -1,8 +1,8 @@
 export declare const DEFAULT_BUILD_COMMAND = "pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)";
 /**
- * The two facts that differ between the wp-start (advisory) and wp-finish (authoritative) build gates.
- * Everything else is identical, so it lives once in runBuildGate and the difference is passed in here.
- * A class (not an object literal) per the codebase's data-structure convention.
+ * The caller-supplied framing for the build gate (label, re-run command, failure headline). Kept as a
+ * parameter object so runBuildGate stays agnostic of who invokes it; today the sole caller is
+ * wp-finish-upsert-pr. A class (not an object literal) per the codebase's data-structure convention.
  */
 export declare class BuildGateOptions {
     label: string;
@@ -10,7 +10,7 @@ export declare class BuildGateOptions {
     failureHeadline: string;
     constructor(label: string, rerunCommand: string, failureHeadline: string);
 }
-/** Runs the nx-affected build gate the same way for the advisory and authoritative PR gates. */
+/** Runs the authoritative nx-affected build gate for wp-finish-upsert-pr (the only PR-flow build gate). */
 export declare class BuildAffected {
     /**
      * Resolve the exact build command this gate will run: the project's configured

package/src/scripts/workflow/build-affected.js

@@ -5,18 +5,18 @@ const tslib_1 = require("tslib");
 const child_process_1 = require("child_process");
 const rules_config_1 = require("@webpieces/rules-config");
 const inversify_1 = require("inversify");
-// Single source of truth for the build gate. The PR flow's advisory gate (`wp-start-upsert-pr`) and
-// authoritative merge gate (`wp-finish-upsert-pr`) both run THIS, so the two can never drift. nx
-// `affected` only rebuilds changed projects. `--base=$(git merge-base origin/main HEAD)` (the fork
-// point) instead of `--base=origin/main`: origin/main rebuilds projects touched by OTHER people's
-// merged PRs. The fork point scopes affected to only YOUR branch's changes. The `$(...)` resolves
-// because runBuildAffected runs with shell: true.
+// Single source of truth for the build gate. Only `wp-finish-upsert-pr` runs it (authoritatively,
+// before the one push) — `wp-start-upsert-pr` deliberately runs NO build gate, so `pr-gate.buildCommand`
+// is a finish-only knob. nx `affected` only rebuilds changed projects.
+// `--base=$(git merge-base origin/main HEAD)` (the fork point) instead of `--base=origin/main`:
+// origin/main rebuilds projects touched by OTHER people's merged PRs. The fork point scopes affected to
+// only YOUR branch's changes. The `$(...)` resolves because runBuildAffected runs with shell: true.
 exports.DEFAULT_BUILD_COMMAND = 'pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)';
 const SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n';
 /**
- * The two facts that differ between the wp-start (advisory) and wp-finish (authoritative) build gates.
- * Everything else is identical, so it lives once in runBuildGate and the difference is passed in here.
- * A class (not an object literal) per the codebase's data-structure convention.
+ * The caller-supplied framing for the build gate (label, re-run command, failure headline). Kept as a
+ * parameter object so runBuildGate stays agnostic of who invokes it; today the sole caller is
+ * wp-finish-upsert-pr. A class (not an object literal) per the codebase's data-structure convention.
  */
 class BuildGateOptions {
     label; // section header shown above the gate
@@ -29,7 +29,7 @@ class BuildGateOptions {
     }
 }
 exports.BuildGateOptions = BuildGateOptions;
-/** Runs the nx-affected build gate the same way for the advisory and authoritative PR gates. */
+/** Runs the authoritative nx-affected build gate for wp-finish-upsert-pr (the only PR-flow build gate). */
 let BuildAffected = class BuildAffected {
     /**
      * Resolve the exact build command this gate will run: the project's configured

package/src/scripts/workflow/build-affected.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-affected.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/build-affected.ts"],"names":[],"mappings":";;;;AAAA,iDAA0C;AAC1C,0DAAwE;AACxE,yCAA2D;AAE3D,oGAAoG;AACpG,iGAAiG;AACjG,mGAAmG;AACnG,kGAAkG;AAClG,kGAAkG;AAClG,kDAAkD;AACrC,QAAA,qBAAqB,GAAG,wEAAwE,CAAC;AAE9G,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE;;;;GAIG;AACH,MAAa,gBAAgB;IACzB,KAAK,CAAS,CAAY,sCAAsC;IAChE,YAAY,CAAS,CAAK,gDAAgD;IAC1E,eAAe,CAAS,CAAE,gCAAgC;IAE1D,YAAY,KAAa,EAAE,YAAoB,EAAE,eAAuB;QACpE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IAC3C,CAAC;CACJ;AAVD,4CAUC;AAED,gGAAgG;AAEzF,IAAM,aAAa,GAAnB,MAAM,aAAa;IACtB;;;OAGG;IACH,mBAAmB,CAAC,QAAgB;QAChC,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACjE,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,6BAAqB,CAAC;IACrG,CAAC;IAED,oEAAoE;IACpE,gBAAgB,CAAC,QAAgB,EAAE,YAAqB;QACpD,MAAM,GAAG,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,6BAAqB,CAAC;QAC5G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,6FAA6F;IAC7F,sBAAsB,CAAC,QAAgB;QACnC,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,QAAgB,EAAE,IAAsB;QACjD,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,6GAA6G;YAC7G,OAAO,YAAY,MAAM,CAC5B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,2BAAY,CAAC,SAAS,EAC5B,OAAO,IAAI,CAAC,eAAe,MAAM;gBACjC,uEAAuE,IAAI,CAAC,YAAY,OAAO;gBAC/F,OAAO,YAAY,IAAI,CAC1B,CAAC;QACN,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChD,CAAC;CACJ,CAAA;AA7CY,sCAAa;wBAAb,aAAa;IADzB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,aAAa,CA6CzB","sourcesContent":["import { spawnSync } from 'child_process';\nimport { loadAndValidate, CliExitError } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\n// Single source of truth for the build gate. The PR flow's advisory gate (`wp-start-upsert-pr`) and\n// authoritative merge gate (`wp-finish-upsert-pr`) both run THIS, so the two can never drift. nx\n// `affected` only rebuilds changed projects. `--base=$(git merge-base origin/main HEAD)` (the fork\n// point) instead of `--base=origin/main`: origin/main rebuilds projects touched by OTHER people's\n// merged PRs. The fork point scopes affected to only YOUR branch's changes. The `$(...)` resolves\n// because runBuildAffected runs with shell: true.\nexport const DEFAULT_BUILD_COMMAND = 'pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/**\n * The two facts that differ between the wp-start (advisory) and wp-finish (authoritative) build gates.\n * Everything else is identical, so it lives once in runBuildGate and the difference is passed in here.\n * A class (not an object literal) per the codebase's data-structure convention.\n */\nexport class BuildGateOptions {\n    label: string;            // section header shown above the gate\n    rerunCommand: string;     // command the AI re-runs after fixing the build\n    failureHeadline: string;  // first line printed on failure\n\n    constructor(label: string, rerunCommand: string, failureHeadline: string) {\n        this.label = label;\n        this.rerunCommand = rerunCommand;\n        this.failureHeadline = failureHeadline;\n    }\n}\n\n/** Runs the nx-affected build gate the same way for the advisory and authoritative PR gates. */\n@injectable(bindingScopeValues.Singleton)\nexport class BuildAffected {\n    /**\n     * Resolve the exact build command this gate will run: the project's configured\n     * PrGateConfig.buildCommand, or the default affected-ci command when none is set.\n     */\n    resolveBuildCommand(repoRoot: string): string {\n        const configured = loadAndValidate(repoRoot).prGate.buildCommand;\n        return configured !== undefined && configured.trim() !== '' ? configured : DEFAULT_BUILD_COMMAND;\n    }\n\n    /** Run the build gate. Returns the process exit code (0 = pass). */\n    runBuildAffected(repoRoot: string, buildCommand?: string): number {\n        const cmd = buildCommand !== undefined && buildCommand.trim() !== '' ? buildCommand : DEFAULT_BUILD_COMMAND;\n        process.stdout.write(`\\n▶ Build gate: ${cmd}\\n\\n`);\n        const result = spawnSync(cmd, { stdio: 'inherit', cwd: repoRoot, shell: true });\n        return result.status ?? 1;\n    }\n\n    /** Run the build gate using the project's configured command (PrGateConfig.buildCommand). */\n    runConfiguredBuildGate(repoRoot: string): number {\n        return this.runBuildAffected(repoRoot, loadAndValidate(repoRoot).prGate.buildCommand);\n    }\n\n    /**\n     * Run the configured build gate with consistent framing, throwing CliExitError(buildCode) on\n     * failure so the bin's main()/runMain owns the exit. Single source of truth: wp-start-upsert-pr and\n     * wp-finish-upsert-pr both call THIS (only the BuildGateOptions differ).\n     */\n    runBuildGate(repoRoot: string, opts: BuildGateOptions): void {\n        const buildCommand = this.resolveBuildCommand(repoRoot);\n        process.stdout.write('\\n' + SEP + opts.label + '\\n' + SEP + '\\n');\n        process.stdout.write(\n            `Running the build gate. To get it passing, run the SAME command yourself and fix everything it reports:\\n\\n` +\n            `    ${buildCommand}\\n\\n`,\n        );\n        const buildCode = this.runConfiguredBuildGate(repoRoot);\n        if (buildCode !== 0) {\n            throw new CliExitError(buildCode,\n                `\\n❌ ${opts.failureHeadline}\\n\\n` +\n                `Run THIS exact command to reproduce and fix all errors, then re-run ${opts.rerunCommand}:\\n\\n` +\n                `    ${buildCommand}\\n`,\n            );\n        }\n        process.stdout.write('\\n✅ Build passed.\\n');\n    }\n}\n"]}
+{"version":3,"file":"build-affected.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/build-affected.ts"],"names":[],"mappings":";;;;AAAA,iDAA0C;AAC1C,0DAAwE;AACxE,yCAA2D;AAE3D,kGAAkG;AAClG,yGAAyG;AACzG,uEAAuE;AACvE,gGAAgG;AAChG,wGAAwG;AACxG,oGAAoG;AACvF,QAAA,qBAAqB,GAAG,wEAAwE,CAAC;AAE9G,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE;;;;GAIG;AACH,MAAa,gBAAgB;IACzB,KAAK,CAAS,CAAY,sCAAsC;IAChE,YAAY,CAAS,CAAK,gDAAgD;IAC1E,eAAe,CAAS,CAAE,gCAAgC;IAE1D,YAAY,KAAa,EAAE,YAAoB,EAAE,eAAuB;QACpE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IAC3C,CAAC;CACJ;AAVD,4CAUC;AAED,2GAA2G;AAEpG,IAAM,aAAa,GAAnB,MAAM,aAAa;IACtB;;;OAGG;IACH,mBAAmB,CAAC,QAAgB;QAChC,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACjE,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,6BAAqB,CAAC;IACrG,CAAC;IAED,oEAAoE;IACpE,gBAAgB,CAAC,QAAgB,EAAE,YAAqB;QACpD,MAAM,GAAG,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,6BAAqB,CAAC;QAC5G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,6FAA6F;IAC7F,sBAAsB,CAAC,QAAgB;QACnC,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,QAAgB,EAAE,IAAsB;QACjD,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,6GAA6G;YAC7G,OAAO,YAAY,MAAM,CAC5B,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,2BAAY,CAAC,SAAS,EAC5B,OAAO,IAAI,CAAC,eAAe,MAAM;gBACjC,uEAAuE,IAAI,CAAC,YAAY,OAAO;gBAC/F,OAAO,YAAY,IAAI,CAC1B,CAAC;QACN,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChD,CAAC;CACJ,CAAA;AA7CY,sCAAa;wBAAb,aAAa;IADzB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,aAAa,CA6CzB","sourcesContent":["import { spawnSync } from 'child_process';\nimport { loadAndValidate, CliExitError } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\n// Single source of truth for the build gate. Only `wp-finish-upsert-pr` runs it (authoritatively,\n// before the one push) — `wp-start-upsert-pr` deliberately runs NO build gate, so `pr-gate.buildCommand`\n// is a finish-only knob. nx `affected` only rebuilds changed projects.\n// `--base=$(git merge-base origin/main HEAD)` (the fork point) instead of `--base=origin/main`:\n// origin/main rebuilds projects touched by OTHER people's merged PRs. The fork point scopes affected to\n// only YOUR branch's changes. The `$(...)` resolves because runBuildAffected runs with shell: true.\nexport const DEFAULT_BUILD_COMMAND = 'pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/**\n * The caller-supplied framing for the build gate (label, re-run command, failure headline). Kept as a\n * parameter object so runBuildGate stays agnostic of who invokes it; today the sole caller is\n * wp-finish-upsert-pr. A class (not an object literal) per the codebase's data-structure convention.\n */\nexport class BuildGateOptions {\n    label: string;            // section header shown above the gate\n    rerunCommand: string;     // command the AI re-runs after fixing the build\n    failureHeadline: string;  // first line printed on failure\n\n    constructor(label: string, rerunCommand: string, failureHeadline: string) {\n        this.label = label;\n        this.rerunCommand = rerunCommand;\n        this.failureHeadline = failureHeadline;\n    }\n}\n\n/** Runs the authoritative nx-affected build gate for wp-finish-upsert-pr (the only PR-flow build gate). */\n@injectable(bindingScopeValues.Singleton)\nexport class BuildAffected {\n    /**\n     * Resolve the exact build command this gate will run: the project's configured\n     * PrGateConfig.buildCommand, or the default affected-ci command when none is set.\n     */\n    resolveBuildCommand(repoRoot: string): string {\n        const configured = loadAndValidate(repoRoot).prGate.buildCommand;\n        return configured !== undefined && configured.trim() !== '' ? configured : DEFAULT_BUILD_COMMAND;\n    }\n\n    /** Run the build gate. Returns the process exit code (0 = pass). */\n    runBuildAffected(repoRoot: string, buildCommand?: string): number {\n        const cmd = buildCommand !== undefined && buildCommand.trim() !== '' ? buildCommand : DEFAULT_BUILD_COMMAND;\n        process.stdout.write(`\\n▶ Build gate: ${cmd}\\n\\n`);\n        const result = spawnSync(cmd, { stdio: 'inherit', cwd: repoRoot, shell: true });\n        return result.status ?? 1;\n    }\n\n    /** Run the build gate using the project's configured command (PrGateConfig.buildCommand). */\n    runConfiguredBuildGate(repoRoot: string): number {\n        return this.runBuildAffected(repoRoot, loadAndValidate(repoRoot).prGate.buildCommand);\n    }\n\n    /**\n     * Run the configured build gate with consistent framing, throwing CliExitError(buildCode) on\n     * failure so the bin's main()/runMain owns the exit. Single source of truth: wp-start-upsert-pr and\n     * wp-finish-upsert-pr both call THIS (only the BuildGateOptions differ).\n     */\n    runBuildGate(repoRoot: string, opts: BuildGateOptions): void {\n        const buildCommand = this.resolveBuildCommand(repoRoot);\n        process.stdout.write('\\n' + SEP + opts.label + '\\n' + SEP + '\\n');\n        process.stdout.write(\n            `Running the build gate. To get it passing, run the SAME command yourself and fix everything it reports:\\n\\n` +\n            `    ${buildCommand}\\n\\n`,\n        );\n        const buildCode = this.runConfiguredBuildGate(repoRoot);\n        if (buildCode !== 0) {\n            throw new CliExitError(buildCode,\n                `\\n❌ ${opts.failureHeadline}\\n\\n` +\n                `Run THIS exact command to reproduce and fix all errors, then re-run ${opts.rerunCommand}:\\n\\n` +\n                `    ${buildCommand}\\n`,\n            );\n        }\n        process.stdout.write('\\n✅ Build passed.\\n');\n    }\n}\n"]}