@webpieces/pr-gate 0.4.706 → 0.4.707

package/src/scripts/pr-gate-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"pr-gate-app.js","sourceRoot":"","sources":["../../../../../../packages/tooling/pr-gate/src/scripts/pr-gate-app.ts"],"names":[],"mappings":";;;;AAAA,0DAAyD;AACzD,yCAA2D;AAC3D,0EAAqE;AACrE,4EAAuE;AACvE,gFAA0E;AAC1E,kFAA4E;AAC5E,gEAA4D;AAE5D,wFAAkF;AAClF,gEAA2D;AAC3D,kEAA6D;AAC7D,kFAAmG;AACnG,4EAAuE;AACvE,4DAAsE;AACtE,kEAA6E;AAC7E,gFAAgG;AAChG,8DAA8D;AAC9D,0DAAyD;AAEzD;;;;;GAKG;AAGI,IAAM,SAAS,GAAf,MAAM,SAAS;IAEG;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAfrB,YACqB,kBAAsC,EACtC,mBAAwC,EACxC,oBAA0C,EAC1C,qBAA4C,EAC5C,cAA8B,EAC9B,wBAAkD,EAClD,aAA4B,EAC5B,cAA8B,EAC9B,qBAA4C,EAC5C,mBAAwC,EACxC,YAA0B,EAC1B,cAA8B,EAC9B,oBAA0C,EAC1C,iBAAoC,EACpC,cAA8B;QAd9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;QAC9B,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,kBAAa,GAAb,aAAa,CAAe;QAC5B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,mBAAc,GAAd,cAAc,CAAgB;IAChD,CAAC;IAEJ;;;;;;;OAOG;IACK,yBAAyB,CAAC,OAAe;QAC7C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAAE,OAAO;QACpE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACnG,CAAC;IAED,+GAA+G;IAC/G,OAAO,CAAC,OAAuB,IAAI,iCAAc,EAAE;QAC/C,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,mGAAmG;IACnG,aAAa,CAAC,OAA6B,IAAI,8CAAoB,EAAE;QACjE,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,IAAc;QACvB,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAkB;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,kEAAkE;IAClE,WAAW;QACP,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,gFAAgF;IAChF,YAAY;QACR,IAAI,CAAC,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;IAC1C,CAAC;IAED,4GAA4G;IAC5G,aAAa;QACT,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;IAED,oGAAoG;IACpG,cAAc;QACV,IAAI,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,OAAuB;QAC3B,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,iBAAiB;QACb,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED,0FAA0F;IAC1F,MAAM;QACF,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,OAA8B,IAAI,gDAAqB,EAAE;QACpE,IAAI,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,+GAA+G;IAC/G,OAAO;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;CACJ,CAAA;AA5HY,8BAAS;oBAAT,SAAS;IAFrB,IAAA,6BAAc,GAAE;IAChB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGI,yCAAkB;QACjB,2CAAmB;QAClB,8CAAoB;QACnB,gDAAqB;QAC5B,gCAAc;QACJ,sDAAwB;QACnC,+BAAa;QACZ,iCAAc;QACP,gDAAqB;QACvB,2CAAmB;QAC1B,4BAAY;QACV,iCAAc;QACR,8CAAoB;QACvB,kCAAiB;QACpB,6BAAc;GAhB1C,SAAS,CA4HrB","sourcesContent":["import { DocumentDesign } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { StartUpdateCommand } from './commands/start-update-command';\nimport { FinishUpdateCommand } from './commands/finish-update-command';\nimport { StartUpsertPrCommand } from './commands/start-upsert-pr-command';\nimport { FinishUpsertPrCommand } from './commands/finish-upsert-pr-command';\nimport { CleanupCommand } from './commands/cleanup-command';\nimport { CleanupOptions } from './commands/cleanup-options';\nimport { CheckoutCleanMainCommand } from './commands/checkout-clean-main-command';\nimport { LandPrCommand } from './commands/land-pr-command';\nimport { CheckPrCommand } from './commands/check-pr-command';\nimport { ReviewUpsertPrCommand, ReviewUpsertPrOptions } from './commands/review-upsert-pr-command';\nimport { ReapWorktreeCommand } from './commands/reap-worktree-command';\nimport { BuildCommand, BuildOptions } from './commands/build-command';\nimport { PushDevCommand, PushDevOptions } from './commands/push-dev-command';\nimport { FinishPushDevCommand, FinishPushDevOptions } from './commands/finish-push-dev-command';\nimport { PushDevStateStore } from './workflow/push-dev-state';\nimport { RepoRootFinder } from '@webpieces/rules-config';\n\n/**\n * The pr-gate application root. `container.get(PrGateApp)` resolves the entire workflow DAG (the command\n * classes → the injected git/merge/dashboard services). `@DocumentDesign` marks it the\n * top-of-DAG the DI-design analyzer roots on, so `role:app` pr-gate draws its design. Each `bin/*`\n * entry resolves THIS and calls the matching command method.\n */\n@DocumentDesign()\n@injectable(bindingScopeValues.Singleton)\nexport class PrGateApp {\n    constructor(\n        private readonly startUpdateCommand: StartUpdateCommand,\n        private readonly finishUpdateCommand: FinishUpdateCommand,\n        private readonly startUpsertPrCommand: StartUpsertPrCommand,\n        private readonly finishUpsertPrCommand: FinishUpsertPrCommand,\n        private readonly cleanupCommand: CleanupCommand,\n        private readonly checkoutCleanMainCommand: CheckoutCleanMainCommand,\n        private readonly landPrCommand: LandPrCommand,\n        private readonly checkPrCommand: CheckPrCommand,\n        private readonly reviewUpsertPrCommand: ReviewUpsertPrCommand,\n        private readonly reapWorktreeCommand: ReapWorktreeCommand,\n        private readonly buildCommand: BuildCommand,\n        private readonly pushDevCommand: PushDevCommand,\n        private readonly finishPushDevCommand: FinishPushDevCommand,\n        private readonly pushDevStateStore: PushDevStateStore,\n        private readonly repoRootFinder: RepoRootFinder,\n    ) {}\n\n    /**\n     * Refuse `command` while a `wp-push-dev --resolve` is half-finished.\n     *\n     * Enforced HERE, at the one place every bin funnels through, rather than in each command: a resolve\n     * parks the checkout on a throwaway branch, so every command below would act on a branch that is not\n     * the one it thinks it is. Putting the check in nine constructors is nine chances to forget it in the\n     * tenth. PushDevStateStore owns the blocked list AND renders the hint from it, so the two cannot drift.\n     */\n    private assertNoResolveInProgress(command: string): void {\n        if (!this.pushDevStateStore.isBlockedDuringResolve(command)) return;\n        this.pushDevStateStore.assertIdle(this.repoRootFinder.resolveRepoRoot(process.cwd()), command);\n    }\n\n    /** `wp-push-dev`: publish a DISPOSABLE copy of this branch for the shared dev environment. No PR, no build. */\n    pushDev(opts: PushDevOptions = new PushDevOptions()): Promise<void> {\n        return this.pushDevCommand.run(opts);\n    }\n\n    /** `wp-finish-push-dev`: commit a resolved dev composition and publish it (conflict path only). */\n    finishPushDev(opts: FinishPushDevOptions = new FinishPushDevOptions()): Promise<void> {\n        return this.finishPushDevCommand.run(opts);\n    }\n\n    /**\n     * INTERNAL (`wp-reap-worktree.js`, no `bin` entry): remove ONE named worktree and its branch.\n     * `wp-land-pr` spawns it with cwd = the primary clone so the tree it just landed from can be\n     * reaped by a process that is not standing in it.\n     */\n    reapWorktree(args: string[]): Promise<void> {\n        return this.reapWorktreeCommand.run(args);\n    }\n\n    /**\n     * `wp-build`: run this repo's ONE configured build (`commands.pr-gate.buildCommand`) — the same\n     * command, resolved by the same resolver, that the PR gate's build stage runs. Not blocked during a\n     * `wp-push-dev --resolve`: it mutates nothing and reads no branch state.\n     */\n    build(opts: BuildOptions): Promise<void> {\n        return this.buildCommand.run(opts);\n    }\n\n    /** `wp-start-update`: 3-point squash-update from main (no PR). */\n    startUpdate(): Promise<void> {\n        this.assertNoResolveInProgress('wp-start-update');\n        return this.startUpdateCommand.run();\n    }\n\n    /** `wp-finish-update`: validate + finalize a resolved 3-point merge (no PR). */\n    finishUpdate(): Promise<void> {\n        this.assertNoResolveInProgress('wp-finish-update');\n        return this.finishUpdateCommand.run();\n    }\n\n    /** `wp-start-upsert-pr`: update from main (3-point merge), hand off review.json. No build gate, no push. */\n    startUpsertPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-start-upsert-pr');\n        return this.startUpsertPrCommand.run();\n    }\n\n    /** `wp-finish-upsert-pr`: finalize merge, authoritative build gate, dashboard, create/update PR. */\n    finishUpsertPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-finish-upsert-pr');\n        return this.finishUpsertPrCommand.run();\n    }\n\n    /**\n     * `wp-cleanup`: reap what is provably merged AND every zero-commit husk, then report the rest with\n     * the exact flags that take it. `options` carries what argv said — see CleanupOptions.\n     */\n    cleanup(options: CleanupOptions): Promise<void> {\n        this.assertNoResolveInProgress('wp-cleanup');\n        return this.cleanupCommand.run(options);\n    }\n\n    /**\n     * `wp-checkout-clean-main`: go to main, fast-forward it, reap dead worktrees and branches, and sweep\n     * the orphan directories a project move leaves behind. Replaces `git checkout main && git pull\n     * origin main` outright — see CheckoutCleanMainCommand for why the old pair must stop being accepted\n     * rather than surviving beside this.\n     */\n    checkoutCleanMain(): Promise<void> {\n        this.assertNoResolveInProgress('wp-checkout-clean-main');\n        return this.checkoutCleanMainCommand.run();\n    }\n\n    /** `wp-land-pr`: squash-merge this branch's PR into main with the compact commit body. */\n    landPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-land-pr');\n        return this.landPrCommand.run();\n    }\n\n    /**\n     * `wp-review-upsert-pr`: STAGE ② — validate the 3-point merge, run the build gate, extract this\n     * branch's diff, and brief the reviewer subagents. Unlike the report-only command it replaces, this CAN\n     * fail — before any reviewer is spawned, so a broken branch costs no reviewer tokens.\n     */\n    reviewUpsertPr(opts: ReviewUpsertPrOptions = new ReviewUpsertPrOptions()): Promise<void> {\n        this.assertNoResolveInProgress('wp-review-upsert-pr');\n        return this.reviewUpsertPrCommand.run(opts);\n    }\n\n    /** `wp-check-pr`: READ-ONLY CI check — verify the PR body carries a valid HMAC gate token for its head sha. */\n    checkPr(): Promise<void> {\n        return this.checkPrCommand.run();\n    }\n}\n"]}
+{"version":3,"file":"pr-gate-app.js","sourceRoot":"","sources":["../../../../../../packages/tooling/pr-gate/src/scripts/pr-gate-app.ts"],"names":[],"mappings":";;;;AAAA,0DAAyD;AACzD,yCAA2D;AAC3D,0EAAqE;AACrE,4EAAuE;AACvE,gFAA0E;AAC1E,kFAA4E;AAC5E,gEAA4D;AAE5D,wFAAkF;AAClF,gEAA2D;AAC3D,kEAA6D;AAC7D,oEAAgE;AAChE,sEAAiE;AACjE,kFAAmG;AACnG,4EAAuE;AACvE,4DAAsE;AACtE,kEAA6E;AAC7E,gFAAgG;AAChG,8DAA8D;AAC9D,0DAAoE;AAEpE;;;;;GAKG;AAGI,IAAM,SAAS,GAAf,MAAM,SAAS;IAEG;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAjBrB,YACqB,kBAAsC,EACtC,mBAAwC,EACxC,oBAA0C,EAC1C,qBAA4C,EAC5C,cAA8B,EAC9B,wBAAkD,EAClD,aAA4B,EAC5B,cAA8B,EAC9B,gBAAkC,EAClC,gBAAkC,EAClC,qBAA4C,EAC5C,mBAAwC,EACxC,YAA0B,EAC1B,cAA8B,EAC9B,oBAA0C,EAC1C,iBAAoC,EACpC,cAA8B;QAhB9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;QAC9B,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,kBAAa,GAAb,aAAa,CAAe;QAC5B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,mBAAc,GAAd,cAAc,CAAgB;IAChD,CAAC;IAEJ;;;;;;;OAOG;IACK,yBAAyB,CAAC,OAAe;QAC7C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAAE,OAAO;QACpE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACnG,CAAC;IAED,+GAA+G;IAC/G,OAAO,CAAC,OAAuB,IAAI,iCAAc,EAAE;QAC/C,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,mGAAmG;IACnG,aAAa,CAAC,OAA6B,IAAI,8CAAoB,EAAE;QACjE,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,IAAc;QACvB,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAkB;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,kEAAkE;IAClE,WAAW;QACP,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED,gFAAgF;IAChF,YAAY;QACR,IAAI,CAAC,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;IAC1C,CAAC;IAED,4GAA4G;IAC5G,aAAa;QACT,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;IAED,oGAAoG;IACpG,cAAc;QACV,IAAI,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,OAAuB;QAC3B,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,iBAAiB;QACb,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,CAAC;IAC/C,CAAC;IAED,0FAA0F;IAC1F,MAAM;QACF,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,OAA8B,IAAI,gDAAqB,EAAE;QACpE,IAAI,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,IAAe;QACrB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,6FAA6F;IAC7F,SAAS,CAAC,IAAe;QACrB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,+GAA+G;IAC/G,OAAO;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;CACJ,CAAA;AA3IY,8BAAS;oBAAT,SAAS;IAFrB,IAAA,6BAAc,GAAE;IAChB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGI,yCAAkB;QACjB,2CAAmB;QAClB,8CAAoB;QACnB,gDAAqB;QAC5B,gCAAc;QACJ,sDAAwB;QACnC,+BAAa;QACZ,iCAAc;QACZ,oCAAgB;QAChB,qCAAgB;QACX,gDAAqB;QACvB,2CAAmB;QAC1B,4BAAY;QACV,iCAAc;QACR,8CAAoB;QACvB,kCAAiB;QACpB,6BAAc;GAlB1C,SAAS,CA2IrB","sourcesContent":["import { DocumentDesign } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { StartUpdateCommand } from './commands/start-update-command';\nimport { FinishUpdateCommand } from './commands/finish-update-command';\nimport { StartUpsertPrCommand } from './commands/start-upsert-pr-command';\nimport { FinishUpsertPrCommand } from './commands/finish-upsert-pr-command';\nimport { CleanupCommand } from './commands/cleanup-command';\nimport { CleanupOptions } from './commands/cleanup-options';\nimport { CheckoutCleanMainCommand } from './commands/checkout-clean-main-command';\nimport { LandPrCommand } from './commands/land-pr-command';\nimport { CheckPrCommand } from './commands/check-pr-command';\nimport { AuthorizeCommand } from './commands/authorize-command';\nimport { CheckAuthCommand } from './commands/check-auth-command';\nimport { ReviewUpsertPrCommand, ReviewUpsertPrOptions } from './commands/review-upsert-pr-command';\nimport { ReapWorktreeCommand } from './commands/reap-worktree-command';\nimport { BuildCommand, BuildOptions } from './commands/build-command';\nimport { PushDevCommand, PushDevOptions } from './commands/push-dev-command';\nimport { FinishPushDevCommand, FinishPushDevOptions } from './commands/finish-push-dev-command';\nimport { PushDevStateStore } from './workflow/push-dev-state';\nimport { CliArgSet, RepoRootFinder } from '@webpieces/rules-config';\n\n/**\n * The pr-gate application root. `container.get(PrGateApp)` resolves the entire workflow DAG (the command\n * classes → the injected git/merge/dashboard services). `@DocumentDesign` marks it the\n * top-of-DAG the DI-design analyzer roots on, so `role:app` pr-gate draws its design. Each `bin/*`\n * entry resolves THIS and calls the matching command method.\n */\n@DocumentDesign()\n@injectable(bindingScopeValues.Singleton)\nexport class PrGateApp {\n    constructor(\n        private readonly startUpdateCommand: StartUpdateCommand,\n        private readonly finishUpdateCommand: FinishUpdateCommand,\n        private readonly startUpsertPrCommand: StartUpsertPrCommand,\n        private readonly finishUpsertPrCommand: FinishUpsertPrCommand,\n        private readonly cleanupCommand: CleanupCommand,\n        private readonly checkoutCleanMainCommand: CheckoutCleanMainCommand,\n        private readonly landPrCommand: LandPrCommand,\n        private readonly checkPrCommand: CheckPrCommand,\n        private readonly authorizeCommand: AuthorizeCommand,\n        private readonly checkAuthCommand: CheckAuthCommand,\n        private readonly reviewUpsertPrCommand: ReviewUpsertPrCommand,\n        private readonly reapWorktreeCommand: ReapWorktreeCommand,\n        private readonly buildCommand: BuildCommand,\n        private readonly pushDevCommand: PushDevCommand,\n        private readonly finishPushDevCommand: FinishPushDevCommand,\n        private readonly pushDevStateStore: PushDevStateStore,\n        private readonly repoRootFinder: RepoRootFinder,\n    ) {}\n\n    /**\n     * Refuse `command` while a `wp-push-dev --resolve` is half-finished.\n     *\n     * Enforced HERE, at the one place every bin funnels through, rather than in each command: a resolve\n     * parks the checkout on a throwaway branch, so every command below would act on a branch that is not\n     * the one it thinks it is. Putting the check in nine constructors is nine chances to forget it in the\n     * tenth. PushDevStateStore owns the blocked list AND renders the hint from it, so the two cannot drift.\n     */\n    private assertNoResolveInProgress(command: string): void {\n        if (!this.pushDevStateStore.isBlockedDuringResolve(command)) return;\n        this.pushDevStateStore.assertIdle(this.repoRootFinder.resolveRepoRoot(process.cwd()), command);\n    }\n\n    /** `wp-push-dev`: publish a DISPOSABLE copy of this branch for the shared dev environment. No PR, no build. */\n    pushDev(opts: PushDevOptions = new PushDevOptions()): Promise<void> {\n        return this.pushDevCommand.run(opts);\n    }\n\n    /** `wp-finish-push-dev`: commit a resolved dev composition and publish it (conflict path only). */\n    finishPushDev(opts: FinishPushDevOptions = new FinishPushDevOptions()): Promise<void> {\n        return this.finishPushDevCommand.run(opts);\n    }\n\n    /**\n     * INTERNAL (`wp-reap-worktree.js`, no `bin` entry): remove ONE named worktree and its branch.\n     * `wp-land-pr` spawns it with cwd = the primary clone so the tree it just landed from can be\n     * reaped by a process that is not standing in it.\n     */\n    reapWorktree(args: string[]): Promise<void> {\n        return this.reapWorktreeCommand.run(args);\n    }\n\n    /**\n     * `wp-build`: run this repo's ONE configured build (`commands.pr-gate.buildCommand`) — the same\n     * command, resolved by the same resolver, that the PR gate's build stage runs. Not blocked during a\n     * `wp-push-dev --resolve`: it mutates nothing and reads no branch state.\n     */\n    build(opts: BuildOptions): Promise<void> {\n        return this.buildCommand.run(opts);\n    }\n\n    /** `wp-start-update`: 3-point squash-update from main (no PR). */\n    startUpdate(): Promise<void> {\n        this.assertNoResolveInProgress('wp-start-update');\n        return this.startUpdateCommand.run();\n    }\n\n    /** `wp-finish-update`: validate + finalize a resolved 3-point merge (no PR). */\n    finishUpdate(): Promise<void> {\n        this.assertNoResolveInProgress('wp-finish-update');\n        return this.finishUpdateCommand.run();\n    }\n\n    /** `wp-start-upsert-pr`: update from main (3-point merge), hand off review.json. No build gate, no push. */\n    startUpsertPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-start-upsert-pr');\n        return this.startUpsertPrCommand.run();\n    }\n\n    /** `wp-finish-upsert-pr`: finalize merge, authoritative build gate, dashboard, create/update PR. */\n    finishUpsertPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-finish-upsert-pr');\n        return this.finishUpsertPrCommand.run();\n    }\n\n    /**\n     * `wp-cleanup`: reap what is provably merged AND every zero-commit husk, then report the rest with\n     * the exact flags that take it. `options` carries what argv said — see CleanupOptions.\n     */\n    cleanup(options: CleanupOptions): Promise<void> {\n        this.assertNoResolveInProgress('wp-cleanup');\n        return this.cleanupCommand.run(options);\n    }\n\n    /**\n     * `wp-checkout-clean-main`: go to main, fast-forward it, reap dead worktrees and branches, and sweep\n     * the orphan directories a project move leaves behind. Replaces `git checkout main && git pull\n     * origin main` outright — see CheckoutCleanMainCommand for why the old pair must stop being accepted\n     * rather than surviving beside this.\n     */\n    checkoutCleanMain(): Promise<void> {\n        this.assertNoResolveInProgress('wp-checkout-clean-main');\n        return this.checkoutCleanMainCommand.run();\n    }\n\n    /** `wp-land-pr`: squash-merge this branch's PR into main with the compact commit body. */\n    landPr(): Promise<void> {\n        this.assertNoResolveInProgress('wp-land-pr');\n        return this.landPrCommand.run();\n    }\n\n    /**\n     * `wp-review-upsert-pr`: STAGE ② — validate the 3-point merge, run the build gate, extract this\n     * branch's diff, and brief the reviewer subagents. Unlike the report-only command it replaces, this CAN\n     * fail — before any reviewer is spawned, so a broken branch costs no reviewer tokens.\n     */\n    reviewUpsertPr(opts: ReviewUpsertPrOptions = new ReviewUpsertPrOptions()): Promise<void> {\n        this.assertNoResolveInProgress('wp-review-upsert-pr');\n        return this.reviewUpsertPrCommand.run(opts);\n    }\n\n    /**\n     * `wp-authorize`: HUMAN ONLY — sign an authorization allowing one review checklist to be overridden.\n     * Reads from /dev/tty, so an agent cannot drive it. See AuthorizeCommand for why that is the mechanism.\n     */\n    authorize(args: CliArgSet): void {\n        this.authorizeCommand.run(args);\n    }\n\n    /** `wp-check-auth`: read-only verification of those authorizations — the half agents run. */\n    checkAuth(args: CliArgSet): void {\n        this.checkAuthCommand.run(args);\n    }\n\n    /** `wp-check-pr`: READ-ONLY CI check — verify the PR body carries a valid HMAC gate token for its head sha. */\n    checkPr(): Promise<void> {\n        return this.checkPrCommand.run();\n    }\n}\n"]}

package/src/scripts/workflow/authorization-context-resolver.d.ts

@@ -0,0 +1,63 @@
+import { AuthorizationContext, DiffScope } from '@webpieces/rules-config';
+import { AiBranchName } from './git-readAiBranchName';
+import { DiffBasisResolver } from './diff-basis';
+/**
+ * THE changed-file set the review system judges a branch by — extracted so the checklist scanner and the
+ * authorization commands cannot answer it two different ways.
+ *
+ * Two non-default options, both load-bearing, and both the reason this is worth a class rather than a
+ * repeated three-liner:
+ *
+ * `tsOnly:false`          — the default drops every *.sql / Dockerfile / .env* file, silently shrinking the
+ *                           set a reviewer is pointed at — and, here, the set an approval's scope is
+ *                           checked against, which would let terraform-adjacent files slip inside a
+ *                           "terraform only" grant.
+ * `includeDeletions:true` — the default is `--diff-filter=d`, so a DELETED file is invisible. A PR that
+ *                           deletes a migration or an auth check changed exactly what a checklist exists
+ *                           to catch.
+ *
+ * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.
+ */
+export declare class ReviewChangedFiles {
+    private readonly diffScope;
+    constructor(diffScope: DiffScope);
+    /**
+     * Every file changed since `base`, INCLUDING uncommitted and untracked ones. [] when there is no base.
+     *
+     * No head argument — that is the branch of `getChangedFiles` which diffs base → WORKING TREE and unions
+     * in untracked files. Passing a head would diff commit-to-commit and miss staged, unstaged and
+     * untracked work, so an approval could be verified against a scope the working tree has already grown
+     * out of.
+     */
+    since(repoRoot: string, base: string): string[];
+}
+/**
+ * Gathers the ONE branch state a human authorization is minted against and verified against: the stable
+ * feature name, the fork point, and the changed-file set.
+ *
+ * Why the FEATURE name and not `git branch --show-current`: the 3-point merge parks the checkout on a
+ * transient `<feature>Squash` branch, and an approval keyed to the raw branch name would stop verifying
+ * for exactly as long as the flow that needs it is running. `AiBranchName.getFeatureName()` is already the
+ * stable identity every other per-branch artifact is keyed by, so an approval lives and dies with the same
+ * unit of work as the review it authorizes.
+ *
+ * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.
+ */
+export declare class AuthorizationContextResolver {
+    private readonly aiBranchName;
+    private readonly diffBasisResolver;
+    private readonly changedFiles;
+    constructor(aiBranchName: AiBranchName, diffBasisResolver: DiffBasisResolver, changedFiles: ReviewChangedFiles);
+    resolve(repoRoot: string): AuthorizationContext;
+    /**
+     * The scope globs PROPOSED for a fresh approval, derived from what the diff touches today: one
+     * `<dir>/**` per distinct directory, collapsed to the first two path segments so a deep tree yields a
+     * readable handful rather than one glob per folder.
+     *
+     * Proposed, never imposed — `wp-authorize` prints these and lets the human replace them. The derived
+     * default matters anyway, because the alternative to a good default is a human who types `**` to get
+     * past the prompt, and `**` is the widening-by-absence this whole mechanism exists to make impossible
+     * to reach by accident.
+     */
+    proposeScopePaths(changedFiles: readonly string[]): string[];
+}

package/src/scripts/workflow/authorization-context-resolver.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationContextResolver = exports.ReviewChangedFiles = void 0;
+const tslib_1 = require("tslib");
+const rules_config_1 = require("@webpieces/rules-config");
+const inversify_1 = require("inversify");
+const git_readAiBranchName_1 = require("./git-readAiBranchName");
+const diff_basis_1 = require("./diff-basis");
+/**
+ * THE changed-file set the review system judges a branch by — extracted so the checklist scanner and the
+ * authorization commands cannot answer it two different ways.
+ *
+ * Two non-default options, both load-bearing, and both the reason this is worth a class rather than a
+ * repeated three-liner:
+ *
+ * `tsOnly:false`          — the default drops every *.sql / Dockerfile / .env* file, silently shrinking the
+ *                           set a reviewer is pointed at — and, here, the set an approval's scope is
+ *                           checked against, which would let terraform-adjacent files slip inside a
+ *                           "terraform only" grant.
+ * `includeDeletions:true` — the default is `--diff-filter=d`, so a DELETED file is invisible. A PR that
+ *                           deletes a migration or an auth check changed exactly what a checklist exists
+ *                           to catch.
+ *
+ * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.
+ */
+let ReviewChangedFiles = class ReviewChangedFiles {
+    diffScope;
+    constructor(diffScope) {
+        this.diffScope = diffScope;
+    }
+    /**
+     * Every file changed since `base`, INCLUDING uncommitted and untracked ones. [] when there is no base.
+     *
+     * No head argument — that is the branch of `getChangedFiles` which diffs base → WORKING TREE and unions
+     * in untracked files. Passing a head would diff commit-to-commit and miss staged, unstaged and
+     * untracked work, so an approval could be verified against a scope the working tree has already grown
+     * out of.
+     */
+    since(repoRoot, base) {
+        if (base === '')
+            return [];
+        const opts = new rules_config_1.ChangedFilesOptions();
+        opts.tsOnly = false;
+        opts.includeDeletions = true;
+        return this.diffScope.getChangedFiles(repoRoot, base, undefined, opts);
+    }
+};
+exports.ReviewChangedFiles = ReviewChangedFiles;
+exports.ReviewChangedFiles = ReviewChangedFiles = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
+    tslib_1.__metadata("design:paramtypes", [rules_config_1.DiffScope])
+], ReviewChangedFiles);
+/**
+ * Gathers the ONE branch state a human authorization is minted against and verified against: the stable
+ * feature name, the fork point, and the changed-file set.
+ *
+ * Why the FEATURE name and not `git branch --show-current`: the 3-point merge parks the checkout on a
+ * transient `<feature>Squash` branch, and an approval keyed to the raw branch name would stop verifying
+ * for exactly as long as the flow that needs it is running. `AiBranchName.getFeatureName()` is already the
+ * stable identity every other per-branch artifact is keyed by, so an approval lives and dies with the same
+ * unit of work as the review it authorizes.
+ *
+ * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.
+ */
+let AuthorizationContextResolver = class AuthorizationContextResolver {
+    aiBranchName;
+    diffBasisResolver;
+    changedFiles;
+    constructor(aiBranchName, diffBasisResolver, changedFiles) {
+        this.aiBranchName = aiBranchName;
+        this.diffBasisResolver = diffBasisResolver;
+        this.changedFiles = changedFiles;
+    }
+    resolve(repoRoot) {
+        const base = this.diffBasisResolver.resolve(repoRoot).base;
+        return new rules_config_1.AuthorizationContext(this.aiBranchName.getFeatureName(), base, this.changedFiles.since(repoRoot, base));
+    }
+    /**
+     * The scope globs PROPOSED for a fresh approval, derived from what the diff touches today: one
+     * `<dir>/**` per distinct directory, collapsed to the first two path segments so a deep tree yields a
+     * readable handful rather than one glob per folder.
+     *
+     * Proposed, never imposed — `wp-authorize` prints these and lets the human replace them. The derived
+     * default matters anyway, because the alternative to a good default is a human who types `**` to get
+     * past the prompt, and `**` is the widening-by-absence this whole mechanism exists to make impossible
+     * to reach by accident.
+     */
+    proposeScopePaths(changedFiles) {
+        const globs = new Set();
+        for (const file of changedFiles) {
+            const parts = file.split('/');
+            if (parts.length === 1)
+                globs.add(file);
+            else
+                globs.add(`${parts.slice(0, Math.min(2, parts.length - 1)).join('/')}/**`);
+        }
+        return [...globs].sort();
+    }
+};
+exports.AuthorizationContextResolver = AuthorizationContextResolver;
+exports.AuthorizationContextResolver = AuthorizationContextResolver = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
+    tslib_1.__metadata("design:paramtypes", [git_readAiBranchName_1.AiBranchName,
+        diff_basis_1.DiffBasisResolver,
+        ReviewChangedFiles])
+], AuthorizationContextResolver);
+//# sourceMappingURL=authorization-context-resolver.js.map

package/src/scripts/workflow/authorization-context-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-context-resolver.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/authorization-context-resolver.ts"],"names":[],"mappings":";;;;AAAA,0DAA+F;AAC/F,yCAA2D;AAC3D,iEAAsD;AACtD,6CAAiD;AAEjD;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACE;IAA7B,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD;;;;;;;OAOG;IACH,KAAK,CAAC,QAAgB,EAAE,IAAY;QAChC,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,kCAAmB,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;CACJ,CAAA;AAlBY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEG,wBAAS;GADxC,kBAAkB,CAkB9B;AAED;;;;;;;;;;;GAWG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAEhB;IACA;IACA;IAHrB,YACqB,YAA0B,EAC1B,iBAAoC,EACpC,YAAgC;QAFhC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,iBAAY,GAAZ,YAAY,CAAoB;IAClD,CAAC;IAEJ,OAAO,CAAC,QAAgB;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;QAC3D,OAAO,IAAI,mCAAoB,CAC3B,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;;;OASG;IACH,iBAAiB,CAAC,YAA+B;QAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;gBACnC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;CACJ,CAAA;AAhCY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGF,mCAAY;QACP,8BAAiB;QACtB,kBAAkB;GAJ5C,4BAA4B,CAgCxC","sourcesContent":["import { AuthorizationContext, ChangedFilesOptions, DiffScope } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { AiBranchName } from './git-readAiBranchName';\nimport { DiffBasisResolver } from './diff-basis';\n\n/**\n * THE changed-file set the review system judges a branch by — extracted so the checklist scanner and the\n * authorization commands cannot answer it two different ways.\n *\n * Two non-default options, both load-bearing, and both the reason this is worth a class rather than a\n * repeated three-liner:\n *\n * `tsOnly:false`          — the default drops every *.sql / Dockerfile / .env* file, silently shrinking the\n *                           set a reviewer is pointed at — and, here, the set an approval's scope is\n *                           checked against, which would let terraform-adjacent files slip inside a\n *                           \"terraform only\" grant.\n * `includeDeletions:true` — the default is `--diff-filter=d`, so a DELETED file is invisible. A PR that\n *                           deletes a migration or an auth check changed exactly what a checklist exists\n *                           to catch.\n *\n * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ReviewChangedFiles {\n    constructor(private readonly diffScope: DiffScope) {}\n\n    /**\n     * Every file changed since `base`, INCLUDING uncommitted and untracked ones. [] when there is no base.\n     *\n     * No head argument — that is the branch of `getChangedFiles` which diffs base → WORKING TREE and unions\n     * in untracked files. Passing a head would diff commit-to-commit and miss staged, unstaged and\n     * untracked work, so an approval could be verified against a scope the working tree has already grown\n     * out of.\n     */\n    since(repoRoot: string, base: string): string[] {\n        if (base === '') return [];\n        const opts = new ChangedFilesOptions();\n        opts.tsOnly = false;\n        opts.includeDeletions = true;\n        return this.diffScope.getChangedFiles(repoRoot, base, undefined, opts);\n    }\n}\n\n/**\n * Gathers the ONE branch state a human authorization is minted against and verified against: the stable\n * feature name, the fork point, and the changed-file set.\n *\n * Why the FEATURE name and not `git branch --show-current`: the 3-point merge parks the checkout on a\n * transient `<feature>Squash` branch, and an approval keyed to the raw branch name would stop verifying\n * for exactly as long as the flow that needs it is running. `AiBranchName.getFeatureName()` is already the\n * stable identity every other per-branch artifact is keyed by, so an approval lives and dies with the same\n * unit of work as the review it authorizes.\n *\n * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class AuthorizationContextResolver {\n    constructor(\n        private readonly aiBranchName: AiBranchName,\n        private readonly diffBasisResolver: DiffBasisResolver,\n        private readonly changedFiles: ReviewChangedFiles,\n    ) {}\n\n    resolve(repoRoot: string): AuthorizationContext {\n        const base = this.diffBasisResolver.resolve(repoRoot).base;\n        return new AuthorizationContext(\n            this.aiBranchName.getFeatureName(), base, this.changedFiles.since(repoRoot, base));\n    }\n\n    /**\n     * The scope globs PROPOSED for a fresh approval, derived from what the diff touches today: one\n     * `<dir>/**` per distinct directory, collapsed to the first two path segments so a deep tree yields a\n     * readable handful rather than one glob per folder.\n     *\n     * Proposed, never imposed — `wp-authorize` prints these and lets the human replace them. The derived\n     * default matters anyway, because the alternative to a good default is a human who types `**` to get\n     * past the prompt, and `**` is the widening-by-absence this whole mechanism exists to make impossible\n     * to reach by accident.\n     */\n    proposeScopePaths(changedFiles: readonly string[]): string[] {\n        const globs = new Set<string>();\n        for (const file of changedFiles) {\n            const parts = file.split('/');\n            if (parts.length === 1) globs.add(file);\n            else globs.add(`${parts.slice(0, Math.min(2, parts.length - 1)).join('/')}/**`);\n        }\n        return [...globs].sort();\n    }\n}\n"]}

package/src/scripts/workflow/checklist-scanner.d.ts

@@ -1,8 +1,9 @@
-import { ChecklistDefinition, ChecklistResult, ChecklistReviewContext, DiffScope, RequiredChecklist, ReviewJsonService } from '@webpieces/rules-config';
+import { AuthorizedOverrides, ChecklistDefinition, ChecklistResult, ChecklistReviewContext, HumanAuthorizationService, RequiredChecklist, ReviewJsonService } from '@webpieces/rules-config';
 import { AiBranchName } from './git-readAiBranchName';
 import { ChecklistDetector, ChecklistRoster } from './checklist-detector';
 import { DiffBasis, DiffBasisResolver } from './diff-basis';
 import { PrContextWriter } from './pr-context-writer';
+import { ReviewChangedFiles } from './authorization-context-resolver';
 /** How a caller wants the scan filtered. Data-only (per CLAUDE.md). */
 export declare class ChecklistScanOptions {
     /**
@@ -72,7 +73,17 @@ export declare class ChecklistScan {
      * passed. An optional checklist that ran and went RED is absent from here and stays in `outstanding`.
      */
     optionalNotRun: RequiredChecklist[];
-    constructor(defined: ChecklistDefinition[], applicable: RequiredChecklist[], reviewed: RequiredChecklist[], outstanding: RequiredChecklist[], context: ChecklistReviewContext, reviewPath: string, forkPoint: string, roster: ChecklistRoster, formatErrors: string[], basis?: DiffBasis, changedFiles?: string[], results?: ChecklistResult[], optionalNotRun?: RequiredChecklist[]);
+    /**
+     * The human authorizations that VERIFY for this branch right now — the only thing that turns a
+     * reviewer's `override` into a shipping verdict.
+     *
+     * Carried on the scan for the same reason `results` is: it is an input to every verdict, and a caller
+     * that re-resolved it would be verifying against a second reading of the fork point and changed-file
+     * set. One resolution, one answer, or the command that gates and the command that reports disagree
+     * about whether the human said yes.
+     */
+    authorized: AuthorizedOverrides;
+    constructor(defined: ChecklistDefinition[], applicable: RequiredChecklist[], reviewed: RequiredChecklist[], outstanding: RequiredChecklist[], context: ChecklistReviewContext, reviewPath: string, forkPoint: string, roster: ChecklistRoster, formatErrors: string[], basis: DiffBasis | undefined, changedFiles: string[] | undefined, results: ChecklistResult[] | undefined, optionalNotRun: RequiredChecklist[] | undefined, authorized: AuthorizedOverrides);
 }
 /**
  * The ONE computation of which reviewer subagents a branch owes, shared by `wp-review-upsert-pr` (which lists) and
@@ -84,10 +95,9 @@ export declare class ChecklistScan {
  * 1. **The base is the FORK POINT of main, computed directly** — never `DiffScope.resolveBase`, which
  *    overlays `NX_BASE`/`NX_HEAD` from the environment. That made review coverage depend on an env var.
  *    It now arrives via {@link DiffBasisResolver}, which injects ForkPoint; same sha, one resolution.
- * 2. **UNCOMMITTED work counts.** `getChangedFiles` is called with NO head, which is the branch of it that
- *    diffs base → WORKING TREE and unions in untracked files. Passing a head would diff commit-to-commit and
- *    silently miss staged, unstaged and untracked changes — so a checklist matching only uncommitted files
- *    would never fire and its reviewer would never be listed.
+ * 2. **UNCOMMITTED work counts**, and the set comes from {@link ReviewChangedFiles} — the one place that
+ *    computation lives, shared with the authorization commands so a checklist's scope and an approval's
+ *    scope are literally the same file set rather than two implementations of it.
  * 3. **The range and the command it prints are the SAME basis.** Property 2 used to be true of the file set
  *    only: reviewers were handed `git diff <base> HEAD`, which on a dirty tree covers a different range and
  *    prints nothing. Both now derive from one {@link DiffBasis}, carried on the scan so a materializing
@@ -98,19 +108,23 @@ export declare class ChecklistScan {
 export declare class ChecklistScanner {
     private readonly aiBranchName;
     private readonly checklistDetector;
-    private readonly diffScope;
+    private readonly reviewChangedFiles;
     private readonly diffBasisResolver;
     private readonly prContextWriter;
     private readonly reviewJsonService;
-    constructor(aiBranchName: AiBranchName, checklistDetector: ChecklistDetector, diffScope: DiffScope, diffBasisResolver: DiffBasisResolver, prContextWriter: PrContextWriter, reviewJsonService: ReviewJsonService);
+    private readonly humanAuthorization;
+    constructor(aiBranchName: AiBranchName, checklistDetector: ChecklistDetector, reviewChangedFiles: ReviewChangedFiles, diffBasisResolver: DiffBasisResolver, prContextWriter: PrContextWriter, reviewJsonService: ReviewJsonService, humanAuthorization: HumanAuthorizationService);
     /**
      * `defined` is the caller's ALREADY-VALIDATED `prGate.checklists`. The scanner deliberately does not load
      * config itself: `loadAndValidate` is the one gate on the checklist set (it rejects a non-array
      * `checklists`, including the removed `{ doc }` manifest shape, and verifies every guidance doc and
      * reviewer-agent file exists), both callers already run it for other fields, and keeping the read out of
-     * here leaves this a function of its inputs rather than of the filesystem.
+     * here leaves this a function of its inputs rather than of the filesystem. `gateSalt` travels the same
+     * way and for the same reason — and as a POSITIONAL parameter rather than a field on
+     * {@link ChecklistScanOptions}, so it cannot be omitted. Omitted, every human authorization on the
+     * branch would be silently ignored, which looks exactly like a human who never approved anything.
      */
-    scan(repoRoot: string, defined: ChecklistDefinition[], opts: ChecklistScanOptions): ChecklistScan;
+    scan(repoRoot: string, defined: ChecklistDefinition[], gateSalt: string, opts: ChecklistScanOptions): ChecklistScan;
     /**
      * What `wp-finish-upsert-pr` actually REFUSES on: everything still owing a verdict, minus the optional
      * checklists nobody ran.
@@ -121,15 +135,4 @@ export declare class ChecklistScanner {
      * exactly the divergence this class's docstring exists to prevent.
      */
     private blocking;
-    /**
-     * Every file changed since the fork point, INCLUDING uncommitted and untracked ones. Two non-default
-     * options, both load-bearing:
-     *
-     * `tsOnly:false`        — the default drops every *.sql / Dockerfile / .env* file a checklist most wants
-     *                         to key on, which would silently shrink the set a reviewer is pointed at.
-     * `includeDeletions:true` — the default is `--diff-filter=d`, so a DELETED file is invisible. A PR that
-     *                         deletes a migration, an auth check or a terraform rule changed exactly what a
-     *                         checklist exists to catch, and under the default no checklist fires at all.
-     */
-    private changedFiles;
 }

package/src/scripts/workflow/checklist-scanner.js

@@ -8,6 +8,7 @@ const git_readAiBranchName_1 = require("./git-readAiBranchName");
 const checklist_detector_1 = require("./checklist-detector");
 const diff_basis_1 = require("./diff-basis");
 const pr_context_writer_1 = require("./pr-context-writer");
+const authorization_context_resolver_1 = require("./authorization-context-resolver");
 /** How a caller wants the scan filtered. Data-only (per CLAUDE.md). */
 class ChecklistScanOptions {
     /**
@@ -87,11 +88,25 @@ class ChecklistScan {
      * passed. An optional checklist that ran and went RED is absent from here and stays in `outstanding`.
      */
     optionalNotRun;
+    /**
+     * The human authorizations that VERIFY for this branch right now — the only thing that turns a
+     * reviewer's `override` into a shipping verdict.
+     *
+     * Carried on the scan for the same reason `results` is: it is an input to every verdict, and a caller
+     * that re-resolved it would be verifying against a second reading of the fork point and changed-file
+     * set. One resolution, one answer, or the command that gates and the command that reports disagree
+     * about whether the human said yes.
+     */
+    authorized;
     // eslint-disable-next-line @typescript-eslint/max-params
     constructor(defined, applicable, reviewed, outstanding, context, reviewPath, forkPoint, roster, formatErrors, basis = new diff_basis_1.DiffBasis(), changedFiles = [], 
     // Defaulted so a caller that only cares about the X/N/Z counts (and every existing test construction)
     // stays a one-liner; the scanner itself always passes the real set.
-    results = [], optionalNotRun = []) {
+    results = [], optionalNotRun = [], 
+    // REQUIRED, with no default. An empty grant fails closed, but a construction that silently got one
+    // by omission would report "no human authorized this" for a branch where somebody did — the exact
+    // stall this whole feature exists to end, arrived at by forgetting an argument.
+    authorized) {
         this.defined = defined;
         this.applicable = applicable;
         this.reviewed = reviewed;
@@ -105,6 +120,7 @@ class ChecklistScan {
         this.changedFiles = changedFiles;
         this.results = results;
         this.optionalNotRun = optionalNotRun;
+        this.authorized = authorized;
     }
 }
 exports.ChecklistScan = ChecklistScan;
@@ -118,10 +134,9 @@ exports.ChecklistScan = ChecklistScan;
  * 1. **The base is the FORK POINT of main, computed directly** — never `DiffScope.resolveBase`, which
  *    overlays `NX_BASE`/`NX_HEAD` from the environment. That made review coverage depend on an env var.
  *    It now arrives via {@link DiffBasisResolver}, which injects ForkPoint; same sha, one resolution.
- * 2. **UNCOMMITTED work counts.** `getChangedFiles` is called with NO head, which is the branch of it that
- *    diffs base → WORKING TREE and unions in untracked files. Passing a head would diff commit-to-commit and
- *    silently miss staged, unstaged and untracked changes — so a checklist matching only uncommitted files
- *    would never fire and its reviewer would never be listed.
+ * 2. **UNCOMMITTED work counts**, and the set comes from {@link ReviewChangedFiles} — the one place that
+ *    computation lives, shared with the authorization commands so a checklist's scope and an approval's
+ *    scope are literally the same file set rather than two implementations of it.
  * 3. **The range and the command it prints are the SAME basis.** Property 2 used to be true of the file set
  *    only: reviewers were handed `git diff <base> HEAD`, which on a dirty tree covers a different range and
  *    prints nothing. Both now derive from one {@link DiffBasis}, carried on the scan so a materializing
@@ -132,26 +147,31 @@ exports.ChecklistScan = ChecklistScan;
 let ChecklistScanner = class ChecklistScanner {
     aiBranchName;
     checklistDetector;
-    diffScope;
+    reviewChangedFiles;
     diffBasisResolver;
     prContextWriter;
     reviewJsonService;
-    constructor(aiBranchName, checklistDetector, diffScope, diffBasisResolver, prContextWriter, reviewJsonService) {
+    humanAuthorization;
+    constructor(aiBranchName, checklistDetector, reviewChangedFiles, diffBasisResolver, prContextWriter, reviewJsonService, humanAuthorization) {
         this.aiBranchName = aiBranchName;
         this.checklistDetector = checklistDetector;
-        this.diffScope = diffScope;
+        this.reviewChangedFiles = reviewChangedFiles;
         this.diffBasisResolver = diffBasisResolver;
         this.prContextWriter = prContextWriter;
         this.reviewJsonService = reviewJsonService;
+        this.humanAuthorization = humanAuthorization;
     }
     /**
      * `defined` is the caller's ALREADY-VALIDATED `prGate.checklists`. The scanner deliberately does not load
      * config itself: `loadAndValidate` is the one gate on the checklist set (it rejects a non-array
      * `checklists`, including the removed `{ doc }` manifest shape, and verifies every guidance doc and
      * reviewer-agent file exists), both callers already run it for other fields, and keeping the read out of
-     * here leaves this a function of its inputs rather than of the filesystem.
+     * here leaves this a function of its inputs rather than of the filesystem. `gateSalt` travels the same
+     * way and for the same reason — and as a POSITIONAL parameter rather than a field on
+     * {@link ChecklistScanOptions}, so it cannot be omitted. Omitted, every human authorization on the
+     * branch would be silently ignored, which looks exactly like a human who never approved anything.
      */
-    scan(repoRoot, defined, opts) {
+    scan(repoRoot, defined, gateSalt, opts) {
         const featureName = this.aiBranchName.getFeatureName();
         const reviewPath = (0, rules_config_1.reviewJsonPath)(repoRoot, featureName);
         // ONE basis for the file set, the reproduce command and any downstream materialization. The fork
@@ -160,20 +180,23 @@ let ChecklistScanner = class ChecklistScanner {
         const base = basis.base;
         // ONE changed-file computation feeds both the roster (all X) and the applicable set (N). `detect` is
         // pure and defined as the roster minus its empty entries, so the two cannot disagree about a match.
-        const changedFiles = this.changedFiles(repoRoot, base);
+        const changedFiles = this.reviewChangedFiles.since(repoRoot, base);
         const roster = new checklist_detector_1.ChecklistRoster(this.checklistDetector.roster(defined, changedFiles), changedFiles.length, base !== '');
         const applicable = this.checklistDetector.toRequired(this.checklistDetector.detect(defined, changedFiles));
         const results = this.reviewJsonService.loadChecklistResults(reviewPath, applicable);
-        const stillOwed = this.reviewJsonService.pendingChecklists(applicable, results);
+        // Resolved ONCE, from the same fork point and changed-file set the matching ran against — the
+        // approval's scope is checked against THIS diff, not against a second reading of it.
+        const authorized = this.humanAuthorization.verifiedFor(repoRoot, new rules_config_1.AuthorizationContext(featureName, base, changedFiles), gateSalt);
+        const stillOwed = this.reviewJsonService.pendingChecklists(applicable, results, authorized);
         const owedIds = new Set(stillOwed.map((r) => r.id));
         // NOT `!owedIds.has(...)`-with-the-optional-exemption-folded-in: an optional checklist nobody ran is
         // neither reviewed nor blocking, and calling it "reviewed" would put a ✓ on the dashboard for a review
         // that never happened.
         const reviewed = applicable.filter((r) => !owedIds.has(r.id));
-        const optionalNotRun = this.reviewJsonService.optionalWithoutVerdict(applicable, results);
+        const optionalNotRun = this.reviewJsonService.optionalWithoutVerdict(applicable, results, authorized);
         return new ChecklistScan(defined, applicable, reviewed, opts.filterAlreadyReviewed ? this.blocking(stillOwed, optionalNotRun) : applicable, opts.contextStage === ''
             ? this.prContextWriter.contextFor(repoRoot, featureName, basis)
-            : this.prContextWriter.ensure(repoRoot, featureName, basis, opts.contextStage, changedFiles), reviewPath, base, roster, this.reviewJsonService.checklistFormatErrors(applicable, results), basis, changedFiles, results, optionalNotRun);
+            : this.prContextWriter.ensure(repoRoot, featureName, basis, opts.contextStage, changedFiles), reviewPath, base, roster, this.reviewJsonService.checklistFormatErrors(applicable, results, authorized), basis, changedFiles, results, optionalNotRun, authorized);
     }
     /**
      * What `wp-finish-upsert-pr` actually REFUSES on: everything still owing a verdict, minus the optional
@@ -188,34 +211,16 @@ let ChecklistScanner = class ChecklistScanner {
         const skipped = new Set(optionalNotRun.map((r) => r.id));
         return stillOwed.filter((r) => !skipped.has(r.id));
     }
-    /**
-     * Every file changed since the fork point, INCLUDING uncommitted and untracked ones. Two non-default
-     * options, both load-bearing:
-     *
-     * `tsOnly:false`        — the default drops every *.sql / Dockerfile / .env* file a checklist most wants
-     *                         to key on, which would silently shrink the set a reviewer is pointed at.
-     * `includeDeletions:true` — the default is `--diff-filter=d`, so a DELETED file is invisible. A PR that
-     *                         deletes a migration, an auth check or a terraform rule changed exactly what a
-     *                         checklist exists to catch, and under the default no checklist fires at all.
-     */
-    changedFiles(repoRoot, base) {
-        if (base === '')
-            return [];
-        const opts = new rules_config_1.ChangedFilesOptions();
-        opts.tsOnly = false;
-        opts.includeDeletions = true;
-        // No head argument — see the class comment. This is what includes the working tree.
-        return this.diffScope.getChangedFiles(repoRoot, base, undefined, opts);
-    }
 };
 exports.ChecklistScanner = ChecklistScanner;
 exports.ChecklistScanner = ChecklistScanner = tslib_1.__decorate([
     (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
     tslib_1.__metadata("design:paramtypes", [git_readAiBranchName_1.AiBranchName,
         checklist_detector_1.ChecklistDetector,
-        rules_config_1.DiffScope,
+        authorization_context_resolver_1.ReviewChangedFiles,
         diff_basis_1.DiffBasisResolver,
         pr_context_writer_1.PrContextWriter,
-        rules_config_1.ReviewJsonService])
+        rules_config_1.ReviewJsonService,
+        rules_config_1.HumanAuthorizationService])
 ], ChecklistScanner);
 //# sourceMappingURL=checklist-scanner.js.map

package/src/scripts/workflow/checklist-scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"checklist-scanner.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/checklist-scanner.ts"],"names":[],"mappings":";;;;AAAA,0DAGiC;AACjC,yCAA2D;AAC3D,iEAAsD;AACtD,6DAA0E;AAC1E,6CAA4D;AAC5D,2DAAsD;AAEtD,uEAAuE;AACvE,MAAa,oBAAoB;IAC7B;;;;OAIG;IACH,qBAAqB,CAAU;IAC/B;;;;;;;;;;;;OAYG;IACH,YAAY,CAAS;IAErB,YAAY,qBAAqB,GAAG,KAAK,EAAE,YAAY,GAAG,YAAY;QAClE,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACnD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACrC,CAAC;CACJ;AA1BD,oDA0BC;AAED;;;;;;GAMG;AACH,MAAa,aAAa;IACtB,OAAO,CAAwB,CAAM,IAAI;IACzC,UAAU,CAAsB,CAAK,IAAI;IACzC,QAAQ,CAAsB,CAAO,mEAAmE;IACxG,WAAW,CAAsB,CAAI,uCAAuC;IAC5E,OAAO,CAAyB,CAAK,wCAAwC;IAC7E,UAAU,CAAS,CAAkB,wDAAwD;IAC7F,SAAS,CAAS,CAAmB,iCAAiC;IACtE,wGAAwG;IACxG,+FAA+F;IAC/F,6EAA6E;IAC7E,MAAM,CAAkB;IACxB,qGAAqG;IACrG,qGAAqG;IACrG,2EAA2E;IAC3E,YAAY,CAAW;IACvB;;;;OAIG;IACH,KAAK,CAAY;IACjB,YAAY,CAAW,CAAc,qDAAqD;IAC1F;;;;;;;;;OASG;IACH,OAAO,CAAoB;IAC3B;;;;;;;;OAQG;IACH,cAAc,CAAsB;IAEpC,yDAAyD;IACzD,YACI,OAA8B,EAC9B,UAA+B,EAC/B,QAA6B,EAC7B,WAAgC,EAChC,OAA+B,EAC/B,UAAkB,EAClB,SAAiB,EACjB,MAAuB,EACvB,YAAsB,EACtB,QAAmB,IAAI,sBAAS,EAAE,EAClC,eAAyB,EAAE;IAC3B,sGAAsG;IACtG,oEAAoE;IACpE,UAA6B,EAAE,EAC/B,iBAAsC,EAAE;QAExC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACzC,CAAC;CACJ;AA7ED,sCA6EC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAEJ;IACA;IACA;IACA;IACA;IACA;IANrB,YACqB,YAA0B,EAC1B,iBAAoC,EACpC,SAAoB,EACpB,iBAAoC,EACpC,eAAgC,EAChC,iBAAoC;QALpC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,cAAS,GAAT,SAAS,CAAW;QACpB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,oBAAe,GAAf,eAAe,CAAiB;QAChC,sBAAiB,GAAjB,iBAAiB,CAAmB;IACtD,CAAC;IAEJ;;;;;;OAMG;IACH,IAAI,CAAC,QAAgB,EAAE,OAA8B,EAAE,IAA0B;QAC7E,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,IAAA,6BAAc,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACzD,iGAAiG;QACjG,iGAAiG;QACjG,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,qGAAqG;QACrG,oGAAoG;QACpG,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,oCAAe,CAC9B,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3G,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACpF,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAoB,EAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,qGAAqG;QACrG,uGAAuG;QACvG,uBAAuB;QACvB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAoB,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC1F,OAAO,IAAI,aAAa,CACpB,OAAO,EACP,UAAU,EACV,QAAQ,EACR,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,EAClF,IAAI,CAAC,YAAY,KAAK,EAAE;YACpB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EAChG,UAAU,EACV,IAAI,EACJ,MAAM,EACN,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,EACjE,KAAK,EACL,YAAY,EACZ,OAAO,EACP,cAAc,CACjB,CAAC;IACN,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CAAC,SAAuC,EAAE,cAA4C;QAClG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAoB,EAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAoB,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;;OASG;IACK,YAAY,CAAC,QAAgB,EAAE,IAAY;QAC/C,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,kCAAmB,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,oFAAoF;QACpF,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;CACJ,CAAA;AAzFY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGF,mCAAY;QACP,sCAAiB;QACzB,wBAAS;QACD,8BAAiB;QACnB,mCAAe;QACb,gCAAiB;GAPhD,gBAAgB,CAyF5B","sourcesContent":["import {\n    ChangedFilesOptions, ChecklistDefinition, ChecklistResult, ChecklistReviewContext, DiffScope,\n    RequiredChecklist, ReviewJsonService, reviewJsonPath,\n} from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { AiBranchName } from './git-readAiBranchName';\nimport { ChecklistDetector, ChecklistRoster } from './checklist-detector';\nimport { DiffBasis, DiffBasisResolver } from './diff-basis';\nimport { PrContextWriter } from './pr-context-writer';\n\n/** How a caller wants the scan filtered. Data-only (per CLAUDE.md). */\nexport class ChecklistScanOptions {\n    /**\n     * false — `outstanding` is every applicable checklist (what `wp-review-upsert-pr` LISTS).\n     * true  — `outstanding` drops the ones already carrying a passing/overridden verdict, leaving only what\n     *         still owes review (what `wp-finish-upsert-pr` BLOCKS on).\n     */\n    filterAlreadyReviewed: boolean;\n    /**\n     * Which per-stage snapshot this scan should persist ('stage3-finish', …), or '' for \"do not write\n     * pr-context.json here\".\n     *\n     * '' exists for stage ②, which cannot write yet: the context records `diffDir`, and the diff has not\n     * been materialized at scan time. Letting the scan write anyway meant stage ② wrote the file twice,\n     * ~60 lines apart, the first time with an empty diffDir. Now it writes once, after materializing.\n     *\n     * The DEFAULT is deliberately non-empty, so writing is what you get by NOT thinking about it. A\n     * reviewer block that lost its diff command because nobody had written pr-context.json is a bug this\n     * codebase has already shipped once (see PrContextWriter's docstring); opting out must be an explicit,\n     * visible act by a caller that takes responsibility for writing it later — not an omission.\n     */\n    contextStage: string;\n\n    constructor(filterAlreadyReviewed = false, contextStage = 'stage-scan') {\n        this.filterAlreadyReviewed = filterAlreadyReviewed;\n        this.contextStage = contextStage;\n    }\n}\n\n/**\n * The answer to \"what review does this branch owe?\", in the X → N → Z terms the commands report:\n *   X = `defined`     — every checklist in pr-gate.checklists\n *   N = `applicable`  — those whose patterns matched (or that have no patterns, so always run)\n *   Z = `outstanding` — of N, those still owing a verdict (only when filterAlreadyReviewed)\n * Data-only.\n */\nexport class ChecklistScan {\n    defined: ChecklistDefinition[];      // X\n    applicable: RequiredChecklist[];     // N\n    reviewed: RequiredChecklist[];       // N − Z: already have a passing/warned/overridden review-<id>.json\n    outstanding: RequiredChecklist[];    // Z (== applicable when not filtering)\n    context: ChecklistReviewContext;     // fork-point sha + pr-context.json path\n    reviewPath: string;                  // the branch's review.json; verdict files sit beside it\n    forkPoint: string;                   // '' when no fork point resolved\n    // ALL X, matched or not, with why — what the PR comment publishes as its roster. Skipped checklists are\n    // absent from `applicable` by construction, and recovering them downstream would mean a second\n    // changed-file computation with different semantics (see the class comment).\n    roster: ChecklistRoster;\n    // Verdict files that exist but cannot be read as a verdict (e.g. still using the removed `success`).\n    // Carried on the SCAN because wp-finish-upsert-pr refuses on missing reviewers before it ever parses\n    // review.json — a complaint raised only in there would never reach the AI.\n    formatErrors: string[];\n    /**\n     * The basis the matching ACTUALLY ran against. Carried out so a caller that materializes the diff\n     * (stage ②) reuses the identical range instead of resolving its own — two independent resolutions is\n     * exactly how the changed-file set and the printed `git diff` command came to disagree.\n     */\n    basis: DiffBasis;\n    changedFiles: string[];              // the full changed-file set the matching ran against\n    /**\n     * The verdict files the scan ALREADY read, carried out rather than dropped.\n     *\n     * `outstanding` answers \"who still owes a verdict?\" but not \"why\" — and the two reasons demand opposite\n     * actions from the reader: a reviewer that never ran must be SPAWNED, a reviewer that ran and REFUSED\n     * must not be (it will refuse again; the finding has to be fixed first). Telling them apart means\n     * resolving each checklist's verdict, and without the results here every caller either re-reads the same\n     * files off disk — a second read that can disagree with this one — or merges the two cases into one\n     * message, which is exactly the loop this field exists to break.\n     */\n    results: ChecklistResult[];\n    /**\n     * The OPTIONAL (`required: false`) applicable checklists carrying no verdict file — i.e. nobody ran them.\n     *\n     * Deliberately NOT in `outstanding` when filtering: that is the exemption that makes `required: false`\n     * mean something. Carried out as its own set rather than merely subtracted, because both readers need it\n     * BY NAME and neither can recover it from what is left: stage ② offers exactly these to the human, and\n     * the PR dashboard must publish them as \"not run\" rather than let a shorter roster imply everything\n     * passed. An optional checklist that ran and went RED is absent from here and stays in `outstanding`.\n     */\n    optionalNotRun: RequiredChecklist[];\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(\n        defined: ChecklistDefinition[],\n        applicable: RequiredChecklist[],\n        reviewed: RequiredChecklist[],\n        outstanding: RequiredChecklist[],\n        context: ChecklistReviewContext,\n        reviewPath: string,\n        forkPoint: string,\n        roster: ChecklistRoster,\n        formatErrors: string[],\n        basis: DiffBasis = new DiffBasis(),\n        changedFiles: string[] = [],\n        // Defaulted so a caller that only cares about the X/N/Z counts (and every existing test construction)\n        // stays a one-liner; the scanner itself always passes the real set.\n        results: ChecklistResult[] = [],\n        optionalNotRun: RequiredChecklist[] = [],\n    ) {\n        this.defined = defined;\n        this.applicable = applicable;\n        this.reviewed = reviewed;\n        this.outstanding = outstanding;\n        this.context = context;\n        this.reviewPath = reviewPath;\n        this.forkPoint = forkPoint;\n        this.roster = roster;\n        this.formatErrors = formatErrors;\n        this.basis = basis;\n        this.changedFiles = changedFiles;\n        this.results = results;\n        this.optionalNotRun = optionalNotRun;\n    }\n}\n\n/**\n * The ONE computation of which reviewer subagents a branch owes, shared by `wp-review-upsert-pr` (which lists) and\n * `wp-finish-upsert-pr` (which blocks). They previously each assembled this from the same parts in slightly\n * different ways, and any divergence means the command that reports and the command that gates disagree.\n *\n * Two properties are deliberate and load-bearing:\n *\n * 1. **The base is the FORK POINT of main, computed directly** — never `DiffScope.resolveBase`, which\n *    overlays `NX_BASE`/`NX_HEAD` from the environment. That made review coverage depend on an env var.\n *    It now arrives via {@link DiffBasisResolver}, which injects ForkPoint; same sha, one resolution.\n * 2. **UNCOMMITTED work counts.** `getChangedFiles` is called with NO head, which is the branch of it that\n *    diffs base → WORKING TREE and unions in untracked files. Passing a head would diff commit-to-commit and\n *    silently miss staged, unstaged and untracked changes — so a checklist matching only uncommitted files\n *    would never fire and its reviewer would never be listed.\n * 3. **The range and the command it prints are the SAME basis.** Property 2 used to be true of the file set\n *    only: reviewers were handed `git diff <base> HEAD`, which on a dirty tree covers a different range and\n *    prints nothing. Both now derive from one {@link DiffBasis}, carried on the scan so a materializing\n *    caller cannot re-resolve and drift.\n *\n * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ChecklistScanner {\n    constructor(\n        private readonly aiBranchName: AiBranchName,\n        private readonly checklistDetector: ChecklistDetector,\n        private readonly diffScope: DiffScope,\n        private readonly diffBasisResolver: DiffBasisResolver,\n        private readonly prContextWriter: PrContextWriter,\n        private readonly reviewJsonService: ReviewJsonService,\n    ) {}\n\n    /**\n     * `defined` is the caller's ALREADY-VALIDATED `prGate.checklists`. The scanner deliberately does not load\n     * config itself: `loadAndValidate` is the one gate on the checklist set (it rejects a non-array\n     * `checklists`, including the removed `{ doc }` manifest shape, and verifies every guidance doc and\n     * reviewer-agent file exists), both callers already run it for other fields, and keeping the read out of\n     * here leaves this a function of its inputs rather than of the filesystem.\n     */\n    scan(repoRoot: string, defined: ChecklistDefinition[], opts: ChecklistScanOptions): ChecklistScan {\n        const featureName = this.aiBranchName.getFeatureName();\n        const reviewPath = reviewJsonPath(repoRoot, featureName);\n        // ONE basis for the file set, the reproduce command and any downstream materialization. The fork\n        // point still comes from ForkPoint (never DiffScope.resolveBase) — DiffBasisResolver injects it.\n        const basis = this.diffBasisResolver.resolve(repoRoot);\n        const base = basis.base;\n        // ONE changed-file computation feeds both the roster (all X) and the applicable set (N). `detect` is\n        // pure and defined as the roster minus its empty entries, so the two cannot disagree about a match.\n        const changedFiles = this.changedFiles(repoRoot, base);\n        const roster = new ChecklistRoster(\n            this.checklistDetector.roster(defined, changedFiles), changedFiles.length, base !== '');\n        const applicable = this.checklistDetector.toRequired(this.checklistDetector.detect(defined, changedFiles));\n        const results = this.reviewJsonService.loadChecklistResults(reviewPath, applicable);\n        const stillOwed = this.reviewJsonService.pendingChecklists(applicable, results);\n        const owedIds = new Set(stillOwed.map((r: RequiredChecklist): string => r.id));\n        // NOT `!owedIds.has(...)`-with-the-optional-exemption-folded-in: an optional checklist nobody ran is\n        // neither reviewed nor blocking, and calling it \"reviewed\" would put a ✓ on the dashboard for a review\n        // that never happened.\n        const reviewed = applicable.filter((r: RequiredChecklist): boolean => !owedIds.has(r.id));\n        const optionalNotRun = this.reviewJsonService.optionalWithoutVerdict(applicable, results);\n        return new ChecklistScan(\n            defined,\n            applicable,\n            reviewed,\n            opts.filterAlreadyReviewed ? this.blocking(stillOwed, optionalNotRun) : applicable,\n            opts.contextStage === ''\n                ? this.prContextWriter.contextFor(repoRoot, featureName, basis)\n                : this.prContextWriter.ensure(repoRoot, featureName, basis, opts.contextStage, changedFiles),\n            reviewPath,\n            base,\n            roster,\n            this.reviewJsonService.checklistFormatErrors(applicable, results),\n            basis,\n            changedFiles,\n            results,\n            optionalNotRun,\n        );\n    }\n\n    /**\n     * What `wp-finish-upsert-pr` actually REFUSES on: everything still owing a verdict, minus the optional\n     * checklists nobody ran.\n     *\n     * The subtraction happens HERE — in the one place `outstanding` is computed — and not in the gate, so\n     * there is a single answer to \"does this branch owe review?\". When the gate did its own filtering, the\n     * command that lists and the command that blocks were two implementations of the same question, which is\n     * exactly the divergence this class's docstring exists to prevent.\n     */\n    private blocking(stillOwed: readonly RequiredChecklist[], optionalNotRun: readonly RequiredChecklist[]): RequiredChecklist[] {\n        const skipped = new Set(optionalNotRun.map((r: RequiredChecklist): string => r.id));\n        return stillOwed.filter((r: RequiredChecklist): boolean => !skipped.has(r.id));\n    }\n\n    /**\n     * Every file changed since the fork point, INCLUDING uncommitted and untracked ones. Two non-default\n     * options, both load-bearing:\n     *\n     * `tsOnly:false`        — the default drops every *.sql / Dockerfile / .env* file a checklist most wants\n     *                         to key on, which would silently shrink the set a reviewer is pointed at.\n     * `includeDeletions:true` — the default is `--diff-filter=d`, so a DELETED file is invisible. A PR that\n     *                         deletes a migration, an auth check or a terraform rule changed exactly what a\n     *                         checklist exists to catch, and under the default no checklist fires at all.\n     */\n    private changedFiles(repoRoot: string, base: string): string[] {\n        if (base === '') return [];\n        const opts = new ChangedFilesOptions();\n        opts.tsOnly = false;\n        opts.includeDeletions = true;\n        // No head argument — see the class comment. This is what includes the working tree.\n        return this.diffScope.getChangedFiles(repoRoot, base, undefined, opts);\n    }\n}\n"]}
+{"version":3,"file":"checklist-scanner.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/checklist-scanner.ts"],"names":[],"mappings":";;;;AAAA,0DAIiC;AACjC,yCAA2D;AAC3D,iEAAsD;AACtD,6DAA0E;AAC1E,6CAA4D;AAC5D,2DAAsD;AACtD,qFAAsE;AAEtE,uEAAuE;AACvE,MAAa,oBAAoB;IAC7B;;;;OAIG;IACH,qBAAqB,CAAU;IAC/B;;;;;;;;;;;;OAYG;IACH,YAAY,CAAS;IAErB,YAAY,qBAAqB,GAAG,KAAK,EAAE,YAAY,GAAG,YAAY;QAClE,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACnD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACrC,CAAC;CACJ;AA1BD,oDA0BC;AAED;;;;;;GAMG;AACH,MAAa,aAAa;IACtB,OAAO,CAAwB,CAAM,IAAI;IACzC,UAAU,CAAsB,CAAK,IAAI;IACzC,QAAQ,CAAsB,CAAO,mEAAmE;IACxG,WAAW,CAAsB,CAAI,uCAAuC;IAC5E,OAAO,CAAyB,CAAK,wCAAwC;IAC7E,UAAU,CAAS,CAAkB,wDAAwD;IAC7F,SAAS,CAAS,CAAmB,iCAAiC;IACtE,wGAAwG;IACxG,+FAA+F;IAC/F,6EAA6E;IAC7E,MAAM,CAAkB;IACxB,qGAAqG;IACrG,qGAAqG;IACrG,2EAA2E;IAC3E,YAAY,CAAW;IACvB;;;;OAIG;IACH,KAAK,CAAY;IACjB,YAAY,CAAW,CAAc,qDAAqD;IAC1F;;;;;;;;;OASG;IACH,OAAO,CAAoB;IAC3B;;;;;;;;OAQG;IACH,cAAc,CAAsB;IACpC;;;;;;;;OAQG;IACH,UAAU,CAAsB;IAEhC,yDAAyD;IACzD,YACI,OAA8B,EAC9B,UAA+B,EAC/B,QAA6B,EAC7B,WAAgC,EAChC,OAA+B,EAC/B,UAAkB,EAClB,SAAiB,EACjB,MAAuB,EACvB,YAAsB,EACtB,QAAmB,IAAI,sBAAS,EAAE,EAClC,eAAyB,EAAE;IAC3B,sGAAsG;IACtG,oEAAoE;IACpE,UAA6B,EAAE,EAC/B,iBAAsC,EAAE;IACxC,mGAAmG;IACnG,kGAAkG;IAClG,gFAAgF;IAChF,UAA+B;QAE/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;CACJ;AA5FD,sCA4FC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAEJ;IACA;IACA;IACA;IACA;IACA;IACA;IAPrB,YACqB,YAA0B,EAC1B,iBAAoC,EACpC,kBAAsC,EACtC,iBAAoC,EACpC,eAAgC,EAChC,iBAAoC,EACpC,kBAA6C;QAN7C,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,oBAAe,GAAf,eAAe,CAAiB;QAChC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,uBAAkB,GAAlB,kBAAkB,CAA2B;IAC/D,CAAC;IAEJ;;;;;;;;;OASG;IACH,IAAI,CACA,QAAgB,EAAE,OAA8B,EAAE,QAAgB,EAAE,IAA0B;QAE9F,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,IAAA,6BAAc,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACzD,iGAAiG;QACjG,iGAAiG;QACjG,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,qGAAqG;QACrG,oGAAoG;QACpG,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,oCAAe,CAC9B,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3G,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACpF,8FAA8F;QAC9F,qFAAqF;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAClD,QAAQ,EAAE,IAAI,mCAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAoB,EAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,qGAAqG;QACrG,uGAAuG;QACvG,uBAAuB;QACvB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAoB,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACtG,OAAO,IAAI,aAAa,CACpB,OAAO,EACP,UAAU,EACV,QAAQ,EACR,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,EAClF,IAAI,CAAC,YAAY,KAAK,EAAE;YACpB,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EAChG,UAAU,EACV,IAAI,EACJ,MAAM,EACN,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,EAC7E,KAAK,EACL,YAAY,EACZ,OAAO,EACP,cAAc,EACd,UAAU,CACb,CAAC;IACN,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CAAC,SAAuC,EAAE,cAA4C;QAClG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAoB,EAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAoB,EAAW,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,CAAC;CACJ,CAAA;AAjFY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGF,mCAAY;QACP,sCAAiB;QAChB,mDAAkB;QACnB,8BAAiB;QACnB,mCAAe;QACb,gCAAiB;QAChB,wCAAyB;GARzD,gBAAgB,CAiF5B","sourcesContent":["import {\n    AuthorizationContext, AuthorizedOverrides, ChecklistDefinition, ChecklistResult,\n    ChecklistReviewContext, HumanAuthorizationService, RequiredChecklist, ReviewJsonService,\n    reviewJsonPath,\n} from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { AiBranchName } from './git-readAiBranchName';\nimport { ChecklistDetector, ChecklistRoster } from './checklist-detector';\nimport { DiffBasis, DiffBasisResolver } from './diff-basis';\nimport { PrContextWriter } from './pr-context-writer';\nimport { ReviewChangedFiles } from './authorization-context-resolver';\n\n/** How a caller wants the scan filtered. Data-only (per CLAUDE.md). */\nexport class ChecklistScanOptions {\n    /**\n     * false — `outstanding` is every applicable checklist (what `wp-review-upsert-pr` LISTS).\n     * true  — `outstanding` drops the ones already carrying a passing/overridden verdict, leaving only what\n     *         still owes review (what `wp-finish-upsert-pr` BLOCKS on).\n     */\n    filterAlreadyReviewed: boolean;\n    /**\n     * Which per-stage snapshot this scan should persist ('stage3-finish', …), or '' for \"do not write\n     * pr-context.json here\".\n     *\n     * '' exists for stage ②, which cannot write yet: the context records `diffDir`, and the diff has not\n     * been materialized at scan time. Letting the scan write anyway meant stage ② wrote the file twice,\n     * ~60 lines apart, the first time with an empty diffDir. Now it writes once, after materializing.\n     *\n     * The DEFAULT is deliberately non-empty, so writing is what you get by NOT thinking about it. A\n     * reviewer block that lost its diff command because nobody had written pr-context.json is a bug this\n     * codebase has already shipped once (see PrContextWriter's docstring); opting out must be an explicit,\n     * visible act by a caller that takes responsibility for writing it later — not an omission.\n     */\n    contextStage: string;\n\n    constructor(filterAlreadyReviewed = false, contextStage = 'stage-scan') {\n        this.filterAlreadyReviewed = filterAlreadyReviewed;\n        this.contextStage = contextStage;\n    }\n}\n\n/**\n * The answer to \"what review does this branch owe?\", in the X → N → Z terms the commands report:\n *   X = `defined`     — every checklist in pr-gate.checklists\n *   N = `applicable`  — those whose patterns matched (or that have no patterns, so always run)\n *   Z = `outstanding` — of N, those still owing a verdict (only when filterAlreadyReviewed)\n * Data-only.\n */\nexport class ChecklistScan {\n    defined: ChecklistDefinition[];      // X\n    applicable: RequiredChecklist[];     // N\n    reviewed: RequiredChecklist[];       // N − Z: already have a passing/warned/overridden review-<id>.json\n    outstanding: RequiredChecklist[];    // Z (== applicable when not filtering)\n    context: ChecklistReviewContext;     // fork-point sha + pr-context.json path\n    reviewPath: string;                  // the branch's review.json; verdict files sit beside it\n    forkPoint: string;                   // '' when no fork point resolved\n    // ALL X, matched or not, with why — what the PR comment publishes as its roster. Skipped checklists are\n    // absent from `applicable` by construction, and recovering them downstream would mean a second\n    // changed-file computation with different semantics (see the class comment).\n    roster: ChecklistRoster;\n    // Verdict files that exist but cannot be read as a verdict (e.g. still using the removed `success`).\n    // Carried on the SCAN because wp-finish-upsert-pr refuses on missing reviewers before it ever parses\n    // review.json — a complaint raised only in there would never reach the AI.\n    formatErrors: string[];\n    /**\n     * The basis the matching ACTUALLY ran against. Carried out so a caller that materializes the diff\n     * (stage ②) reuses the identical range instead of resolving its own — two independent resolutions is\n     * exactly how the changed-file set and the printed `git diff` command came to disagree.\n     */\n    basis: DiffBasis;\n    changedFiles: string[];              // the full changed-file set the matching ran against\n    /**\n     * The verdict files the scan ALREADY read, carried out rather than dropped.\n     *\n     * `outstanding` answers \"who still owes a verdict?\" but not \"why\" — and the two reasons demand opposite\n     * actions from the reader: a reviewer that never ran must be SPAWNED, a reviewer that ran and REFUSED\n     * must not be (it will refuse again; the finding has to be fixed first). Telling them apart means\n     * resolving each checklist's verdict, and without the results here every caller either re-reads the same\n     * files off disk — a second read that can disagree with this one — or merges the two cases into one\n     * message, which is exactly the loop this field exists to break.\n     */\n    results: ChecklistResult[];\n    /**\n     * The OPTIONAL (`required: false`) applicable checklists carrying no verdict file — i.e. nobody ran them.\n     *\n     * Deliberately NOT in `outstanding` when filtering: that is the exemption that makes `required: false`\n     * mean something. Carried out as its own set rather than merely subtracted, because both readers need it\n     * BY NAME and neither can recover it from what is left: stage ② offers exactly these to the human, and\n     * the PR dashboard must publish them as \"not run\" rather than let a shorter roster imply everything\n     * passed. An optional checklist that ran and went RED is absent from here and stays in `outstanding`.\n     */\n    optionalNotRun: RequiredChecklist[];\n    /**\n     * The human authorizations that VERIFY for this branch right now — the only thing that turns a\n     * reviewer's `override` into a shipping verdict.\n     *\n     * Carried on the scan for the same reason `results` is: it is an input to every verdict, and a caller\n     * that re-resolved it would be verifying against a second reading of the fork point and changed-file\n     * set. One resolution, one answer, or the command that gates and the command that reports disagree\n     * about whether the human said yes.\n     */\n    authorized: AuthorizedOverrides;\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(\n        defined: ChecklistDefinition[],\n        applicable: RequiredChecklist[],\n        reviewed: RequiredChecklist[],\n        outstanding: RequiredChecklist[],\n        context: ChecklistReviewContext,\n        reviewPath: string,\n        forkPoint: string,\n        roster: ChecklistRoster,\n        formatErrors: string[],\n        basis: DiffBasis = new DiffBasis(),\n        changedFiles: string[] = [],\n        // Defaulted so a caller that only cares about the X/N/Z counts (and every existing test construction)\n        // stays a one-liner; the scanner itself always passes the real set.\n        results: ChecklistResult[] = [],\n        optionalNotRun: RequiredChecklist[] = [],\n        // REQUIRED, with no default. An empty grant fails closed, but a construction that silently got one\n        // by omission would report \"no human authorized this\" for a branch where somebody did — the exact\n        // stall this whole feature exists to end, arrived at by forgetting an argument.\n        authorized: AuthorizedOverrides,\n    ) {\n        this.defined = defined;\n        this.applicable = applicable;\n        this.reviewed = reviewed;\n        this.outstanding = outstanding;\n        this.context = context;\n        this.reviewPath = reviewPath;\n        this.forkPoint = forkPoint;\n        this.roster = roster;\n        this.formatErrors = formatErrors;\n        this.basis = basis;\n        this.changedFiles = changedFiles;\n        this.results = results;\n        this.optionalNotRun = optionalNotRun;\n        this.authorized = authorized;\n    }\n}\n\n/**\n * The ONE computation of which reviewer subagents a branch owes, shared by `wp-review-upsert-pr` (which lists) and\n * `wp-finish-upsert-pr` (which blocks). They previously each assembled this from the same parts in slightly\n * different ways, and any divergence means the command that reports and the command that gates disagree.\n *\n * Two properties are deliberate and load-bearing:\n *\n * 1. **The base is the FORK POINT of main, computed directly** — never `DiffScope.resolveBase`, which\n *    overlays `NX_BASE`/`NX_HEAD` from the environment. That made review coverage depend on an env var.\n *    It now arrives via {@link DiffBasisResolver}, which injects ForkPoint; same sha, one resolution.\n * 2. **UNCOMMITTED work counts**, and the set comes from {@link ReviewChangedFiles} — the one place that\n *    computation lives, shared with the authorization commands so a checklist's scope and an approval's\n *    scope are literally the same file set rather than two implementations of it.\n * 3. **The range and the command it prints are the SAME basis.** Property 2 used to be true of the file set\n *    only: reviewers were handed `git diff <base> HEAD`, which on a dirty tree covers a different range and\n *    prints nothing. Both now derive from one {@link DiffBasis}, carried on the scan so a materializing\n *    caller cannot re-resolve and drift.\n *\n * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ChecklistScanner {\n    constructor(\n        private readonly aiBranchName: AiBranchName,\n        private readonly checklistDetector: ChecklistDetector,\n        private readonly reviewChangedFiles: ReviewChangedFiles,\n        private readonly diffBasisResolver: DiffBasisResolver,\n        private readonly prContextWriter: PrContextWriter,\n        private readonly reviewJsonService: ReviewJsonService,\n        private readonly humanAuthorization: HumanAuthorizationService,\n    ) {}\n\n    /**\n     * `defined` is the caller's ALREADY-VALIDATED `prGate.checklists`. The scanner deliberately does not load\n     * config itself: `loadAndValidate` is the one gate on the checklist set (it rejects a non-array\n     * `checklists`, including the removed `{ doc }` manifest shape, and verifies every guidance doc and\n     * reviewer-agent file exists), both callers already run it for other fields, and keeping the read out of\n     * here leaves this a function of its inputs rather than of the filesystem. `gateSalt` travels the same\n     * way and for the same reason — and as a POSITIONAL parameter rather than a field on\n     * {@link ChecklistScanOptions}, so it cannot be omitted. Omitted, every human authorization on the\n     * branch would be silently ignored, which looks exactly like a human who never approved anything.\n     */\n    scan(\n        repoRoot: string, defined: ChecklistDefinition[], gateSalt: string, opts: ChecklistScanOptions,\n    ): ChecklistScan {\n        const featureName = this.aiBranchName.getFeatureName();\n        const reviewPath = reviewJsonPath(repoRoot, featureName);\n        // ONE basis for the file set, the reproduce command and any downstream materialization. The fork\n        // point still comes from ForkPoint (never DiffScope.resolveBase) — DiffBasisResolver injects it.\n        const basis = this.diffBasisResolver.resolve(repoRoot);\n        const base = basis.base;\n        // ONE changed-file computation feeds both the roster (all X) and the applicable set (N). `detect` is\n        // pure and defined as the roster minus its empty entries, so the two cannot disagree about a match.\n        const changedFiles = this.reviewChangedFiles.since(repoRoot, base);\n        const roster = new ChecklistRoster(\n            this.checklistDetector.roster(defined, changedFiles), changedFiles.length, base !== '');\n        const applicable = this.checklistDetector.toRequired(this.checklistDetector.detect(defined, changedFiles));\n        const results = this.reviewJsonService.loadChecklistResults(reviewPath, applicable);\n        // Resolved ONCE, from the same fork point and changed-file set the matching ran against — the\n        // approval's scope is checked against THIS diff, not against a second reading of it.\n        const authorized = this.humanAuthorization.verifiedFor(\n            repoRoot, new AuthorizationContext(featureName, base, changedFiles), gateSalt);\n        const stillOwed = this.reviewJsonService.pendingChecklists(applicable, results, authorized);\n        const owedIds = new Set(stillOwed.map((r: RequiredChecklist): string => r.id));\n        // NOT `!owedIds.has(...)`-with-the-optional-exemption-folded-in: an optional checklist nobody ran is\n        // neither reviewed nor blocking, and calling it \"reviewed\" would put a ✓ on the dashboard for a review\n        // that never happened.\n        const reviewed = applicable.filter((r: RequiredChecklist): boolean => !owedIds.has(r.id));\n        const optionalNotRun = this.reviewJsonService.optionalWithoutVerdict(applicable, results, authorized);\n        return new ChecklistScan(\n            defined,\n            applicable,\n            reviewed,\n            opts.filterAlreadyReviewed ? this.blocking(stillOwed, optionalNotRun) : applicable,\n            opts.contextStage === ''\n                ? this.prContextWriter.contextFor(repoRoot, featureName, basis)\n                : this.prContextWriter.ensure(repoRoot, featureName, basis, opts.contextStage, changedFiles),\n            reviewPath,\n            base,\n            roster,\n            this.reviewJsonService.checklistFormatErrors(applicable, results, authorized),\n            basis,\n            changedFiles,\n            results,\n            optionalNotRun,\n            authorized,\n        );\n    }\n\n    /**\n     * What `wp-finish-upsert-pr` actually REFUSES on: everything still owing a verdict, minus the optional\n     * checklists nobody ran.\n     *\n     * The subtraction happens HERE — in the one place `outstanding` is computed — and not in the gate, so\n     * there is a single answer to \"does this branch owe review?\". When the gate did its own filtering, the\n     * command that lists and the command that blocks were two implementations of the same question, which is\n     * exactly the divergence this class's docstring exists to prevent.\n     */\n    private blocking(stillOwed: readonly RequiredChecklist[], optionalNotRun: readonly RequiredChecklist[]): RequiredChecklist[] {\n        const skipped = new Set(optionalNotRun.map((r: RequiredChecklist): string => r.id));\n        return stillOwed.filter((r: RequiredChecklist): boolean => !skipped.has(r.id));\n    }\n}\n"]}

package/src/scripts/workflow/review-report.d.ts

@@ -9,9 +9,9 @@ import { ChecklistNotice } from './checklist-notice';
  * agent obeys that block, the reviewer re-reads unchanged code, refuses again — the loop, one stage earlier.
  *
  * The message is rendered by the COMMAND rather than in here for one reason: stage ② must not archive
- * anything. `refusalError` called with no archive path says "fix it, then re-run; or set an override in
- * review-<id>.json", which is only true while that file is still live — and at stage ② it is. Retiring a
- * verdict is finish's act, on the refusal it is actually acting on.
+ * anything. `refusalError` called with no archive path points the reader at the LIVE review-<id>.json,
+ * which is only correct while that file is still there — and at stage ② it is. Retiring a verdict is
+ * finish's act, on the refusal it is actually acting on.
  */
 export declare class RefusedReviewer {
     checklistId: string;

package/src/scripts/workflow/review-report.js

@@ -15,9 +15,9 @@ const SEP = '━━━━━━━━━━━━━━━━━━━━━━
  * agent obeys that block, the reviewer re-reads unchanged code, refuses again — the loop, one stage earlier.
  *
  * The message is rendered by the COMMAND rather than in here for one reason: stage ② must not archive
- * anything. `refusalError` called with no archive path says "fix it, then re-run; or set an override in
- * review-<id>.json", which is only true while that file is still live — and at stage ② it is. Retiring a
- * verdict is finish's act, on the refusal it is actually acting on.
+ * anything. `refusalError` called with no archive path points the reader at the LIVE review-<id>.json,
+ * which is only correct while that file is still there — and at stage ② it is. Retiring a verdict is
+ * finish's act, on the refusal it is actually acting on.
  */
 class RefusedReviewer {
     checklistId;