@webpieces/rules-config 0.4.469 → 0.4.470

package/src/subagent-provenance.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubagentProvenanceService = exports.ProvenanceResult = exports.PROVENANCE_SKIPPED = exports.PROVENANCE_MISSING = exports.PROVENANCE_OK = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const os = tslib_1.__importStar(require("os"));
+const inversify_1 = require("inversify");
+const to_error_1 = require("./to-error");
+// Outcome of a provenance check.
+exports.PROVENANCE_OK = 'ok'; // a matching reviewer subagent demonstrably ran on this branch
+exports.PROVENANCE_MISSING = 'missing'; // session known, but no matching subagent artifact found → refuse (BLOCK)
+exports.PROVENANCE_SKIPPED = 'skipped'; // no CLAUDE_CODE_SESSION_ID (plain terminal / CI) → warn + pass
+class ProvenanceResult {
+    status; // PROVENANCE_OK | PROVENANCE_MISSING | PROVENANCE_SKIPPED
+    detail; // human-readable explanation for the warning/error/dashboard
+    constructor(status, detail) {
+        this.status = status;
+        this.detail = detail;
+    }
+}
+exports.ProvenanceResult = ProvenanceResult;
+/**
+ * Verifies — from the Claude Code harness's OWN artifacts, never from anything the model asserts — that
+ * a subagent of a given `agentType` actually ran during the current session on the current branch. Used
+ * to enforce a checklist's optional `subagent:` field: that an INDEPENDENT reviewer looked, rather than
+ * the coding agent self-certifying.
+ *
+ * The harness writes, beside each subagent transcript:
+ *   ~/.claude/projects/<cwd-slug>/<sessionId>/subagents/agent-<id>.meta.json  → { agentType, spawnDepth, … }
+ *   ~/.claude/projects/<cwd-slug>/<sessionId>/subagents/agent-<id>.jsonl      → record 0 { isSidechain, gitBranch, … }
+ * `agentType`/`spawnDepth`/`isSidechain` are written by Claude Code, not by the model. We locate the dir
+ * by the unique sessionId (globbing `projects/&#42;/<sessionId>/subagents`), so the cwd-slug never has to be
+ * derived/guessed.
+ *
+ * IMPORTANT — this is NOT tamper-proof. A determined agent can `cat >` a fake agent-*.meta.json. This
+ * raises the bar from "trust the model's word" to "deliberate, auditable forgery outside the repo"; it
+ * is not cryptographic. Say so wherever `subagent:` is documented.
+ *
+ * `@injectable(bindingScopeValues.Singleton)` so it is drawn in the DI design and injected by type.
+ */
+let SubagentProvenanceService = class SubagentProvenanceService {
+    // Verify a subagent of `expectedAgentType` ran on `branch`. Absent CLAUDE_CODE_SESSION_ID (plain
+    // terminal / CI) returns SKIPPED — the feature must not break non-Claude-Code consumers.
+    verify(expectedAgentType, branch) {
+        const sessionId = process.env['CLAUDE_CODE_SESSION_ID'] ?? '';
+        if (sessionId.trim() === '') {
+            return new ProvenanceResult(exports.PROVENANCE_SKIPPED, `CLAUDE_CODE_SESSION_ID not set — cannot verify the "${expectedAgentType}" reviewer subagent (plain terminal / CI). Skipping the provenance check.`);
+        }
+        const dir = this.findSubagentsDir(sessionId);
+        if (dir === '') {
+            return new ProvenanceResult(exports.PROVENANCE_MISSING, `No subagents recorded for this session — the "${expectedAgentType}" reviewer subagent must run on this branch before the PR can open.`);
+        }
+        for (const metaFile of this.metaFiles(dir)) {
+            const meta = this.readJson(path.join(dir, metaFile));
+            if (!meta)
+                continue;
+            if (meta['agentType'] !== expectedAgentType)
+                continue;
+            const spawnDepth = meta['spawnDepth'];
+            if (typeof spawnDepth !== 'number' || spawnDepth < 1)
+                continue;
+            const agentId = this.agentIdOf(metaFile);
+            if (this.sidechainOnBranch(dir, agentId, branch)) {
+                return new ProvenanceResult(exports.PROVENANCE_OK, `verified "${expectedAgentType}" reviewer subagent ran (agent ${agentId}).`);
+            }
+        }
+        return new ProvenanceResult(exports.PROVENANCE_MISSING, `No "${expectedAgentType}" reviewer subagent ran on this branch — a separate reviewer of that type must review this checklist.`);
+    }
+    // Find the subagents dir for `sessionId` by its UNIQUE id, so the cwd-slug never has to be guessed.
+    findSubagentsDir(sessionId) {
+        const projects = path.join(os.homedir(), '.claude', 'projects');
+        if (!fs.existsSync(projects))
+            return '';
+        for (const proj of this.readDir(projects)) {
+            const candidate = path.join(projects, proj, sessionId, 'subagents');
+            if (fs.existsSync(candidate))
+                return candidate;
+        }
+        return '';
+    }
+    metaFiles(dir) {
+        return this.readDir(dir).filter((f) => f.endsWith('.meta.json'));
+    }
+    // agent-<id>.meta.json → <id>
+    agentIdOf(metaFile) {
+        return metaFile.replace(/^agent-/, '').replace(/\.meta\.json$/, '');
+    }
+    // Cross-check the sibling transcript's record 0: isSidechain true (a real subagent, not the main
+    // loop) and, when recorded, the same branch. Lenient on branch drift (a leftover …wpN suffix from a
+    // mid-flight branch rename) and on a missing jsonl (meta already matched — accept, best-effort).
+    sidechainOnBranch(dir, agentId, branch) {
+        const jsonl = path.join(dir, `agent-${agentId}.jsonl`);
+        if (!fs.existsSync(jsonl))
+            return true;
+        const first = this.firstNonEmptyLine(jsonl);
+        if (first === '')
+            return true;
+        const rec = this.parseLine(first);
+        if (!rec)
+            return true;
+        if (rec['isSidechain'] !== true)
+            return false;
+        const gitBranch = rec['gitBranch'];
+        if (typeof gitBranch !== 'string' || gitBranch === '')
+            return true;
+        return this.stripWp(gitBranch) === this.stripWp(branch);
+    }
+    stripWp(branch) {
+        return branch.replace(/-?wp\d+$/i, '');
+    }
+    readDir(dir) {
+        // webpieces-disable no-unmanaged-exceptions -- chokepoint: an unreadable dir yields [] (best-effort provenance)
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            return fs.readdirSync(dir);
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error;
+            return [];
+        }
+    }
+    firstNonEmptyLine(filePath) {
+        // webpieces-disable no-unmanaged-exceptions -- chokepoint: unreadable transcript → '' (best-effort)
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            for (const line of fs.readFileSync(filePath, 'utf8').split('\n')) {
+                if (line.trim() !== '')
+                    return line;
+            }
+            return '';
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error;
+            return '';
+        }
+    }
+    // webpieces-disable no-any-unknown -- opaque parsed JSON object, keys read by the caller
+    readJson(filePath) {
+        // webpieces-disable no-unmanaged-exceptions -- chokepoint: malformed meta.json → null (skipped)
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            // webpieces-disable no-any-unknown -- parsed JSON is opaque until narrowed by the caller
+            return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error;
+            return null;
+        }
+    }
+    // webpieces-disable no-any-unknown -- one opaque JSONL record, keys read by the caller
+    parseLine(line) {
+        // webpieces-disable no-unmanaged-exceptions -- chokepoint: malformed JSONL record → null
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            // webpieces-disable no-any-unknown -- parsed JSON is opaque until narrowed by the caller
+            return JSON.parse(line);
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error;
+            return null;
+        }
+    }
+};
+exports.SubagentProvenanceService = SubagentProvenanceService;
+exports.SubagentProvenanceService = SubagentProvenanceService = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton)
+], SubagentProvenanceService);
+//# sourceMappingURL=subagent-provenance.js.map

package/src/subagent-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subagent-provenance.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/subagent-provenance.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAC7B,+CAAyB;AACzB,yCAA2D;AAC3D,yCAAqC;AAErC,iCAAiC;AACpB,QAAA,aAAa,GAAG,IAAI,CAAC,CAAW,+DAA+D;AAC/F,QAAA,kBAAkB,GAAG,SAAS,CAAC,CAAC,0EAA0E;AAC1G,QAAA,kBAAkB,GAAG,SAAS,CAAC,CAAC,gEAAgE;AAE7G,MAAa,gBAAgB;IACzB,MAAM,CAAS,CAAC,0DAA0D;IAC1E,MAAM,CAAS,CAAC,6DAA6D;IAE7E,YAAY,MAAc,EAAE,MAAc;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;CACJ;AARD,4CAQC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAClC,iGAAiG;IACjG,yFAAyF;IACzF,MAAM,CAAC,iBAAyB,EAAE,MAAc;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1B,OAAO,IAAI,gBAAgB,CAAC,0BAAkB,EAC1C,uDAAuD,iBAAiB,2EAA2E,CAAC,CAAC;QAC7J,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACb,OAAO,IAAI,gBAAgB,CAAC,0BAAkB,EAC1C,iDAAiD,iBAAiB,qEAAqE,CAAC,CAAC;QACjJ,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,iBAAiB;gBAAE,SAAS;YACtD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;YACtC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,CAAC;gBAAE,SAAS;YAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC/C,OAAO,IAAI,gBAAgB,CAAC,qBAAa,EACrC,aAAa,iBAAiB,kCAAkC,OAAO,IAAI,CAAC,CAAC;YACrF,CAAC;QACL,CAAC;QACD,OAAO,IAAI,gBAAgB,CAAC,0BAAkB,EAC1C,OAAO,iBAAiB,uGAAuG,CAAC,CAAC;IACzI,CAAC;IAED,oGAAoG;IAC5F,gBAAgB,CAAC,SAAiB;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YACpE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,GAAW;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,8BAA8B;IACtB,SAAS,CAAC,QAAgB;QAC9B,OAAO,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,iGAAiG;IACjG,oGAAoG;IACpG,iGAAiG;IACzF,iBAAiB,CAAC,GAAW,EAAE,OAAe,EAAE,MAAc;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,OAAO,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IAEO,OAAO,CAAC,MAAc;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAEO,OAAO,CAAC,GAAW;QACvB,gHAAgH;QAChH,8DAA8D;QAC9D,IAAI,CAAC;YACD,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,KAAK,KAAK,CAAC;YACX,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAEO,iBAAiB,CAAC,QAAgB;QACtC,oGAAoG;QACpG,8DAA8D;QAC9D,IAAI,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;oBAAE,OAAO,IAAI,CAAC;YACxC,CAAC;YACD,OAAO,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,KAAK,KAAK,CAAC;YACX,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED,yFAAyF;IACjF,QAAQ,CAAC,QAAgB;QAC7B,gGAAgG;QAChG,8DAA8D;QAC9D,IAAI,CAAC;YACD,yFAAyF;YACzF,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA4B,CAAC;QACpF,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,KAAK,KAAK,CAAC;YACX,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,uFAAuF;IAC/E,SAAS,CAAC,IAAY;QAC1B,yFAAyF;QACzF,8DAA8D;QAC9D,IAAI,CAAC;YACD,yFAAyF;YACzF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACvD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,KAAK,KAAK,CAAC;YACX,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;CACJ,CAAA;AA5HY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,yBAAyB,CA4HrC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { toError } from './to-error';\n\n// Outcome of a provenance check.\nexport const PROVENANCE_OK = 'ok';           // a matching reviewer subagent demonstrably ran on this branch\nexport const PROVENANCE_MISSING = 'missing'; // session known, but no matching subagent artifact found → refuse (BLOCK)\nexport const PROVENANCE_SKIPPED = 'skipped'; // no CLAUDE_CODE_SESSION_ID (plain terminal / CI) → warn + pass\n\nexport class ProvenanceResult {\n    status: string; // PROVENANCE_OK | PROVENANCE_MISSING | PROVENANCE_SKIPPED\n    detail: string; // human-readable explanation for the warning/error/dashboard\n\n    constructor(status: string, detail: string) {\n        this.status = status;\n        this.detail = detail;\n    }\n}\n\n/**\n * Verifies — from the Claude Code harness's OWN artifacts, never from anything the model asserts — that\n * a subagent of a given `agentType` actually ran during the current session on the current branch. Used\n * to enforce a checklist's optional `subagent:` field: that an INDEPENDENT reviewer looked, rather than\n * the coding agent self-certifying.\n *\n * The harness writes, beside each subagent transcript:\n *   ~/.claude/projects/<cwd-slug>/<sessionId>/subagents/agent-<id>.meta.json  → { agentType, spawnDepth, … }\n *   ~/.claude/projects/<cwd-slug>/<sessionId>/subagents/agent-<id>.jsonl      → record 0 { isSidechain, gitBranch, … }\n * `agentType`/`spawnDepth`/`isSidechain` are written by Claude Code, not by the model. We locate the dir\n * by the unique sessionId (globbing `projects/&#42;/<sessionId>/subagents`), so the cwd-slug never has to be\n * derived/guessed.\n *\n * IMPORTANT — this is NOT tamper-proof. A determined agent can `cat >` a fake agent-*.meta.json. This\n * raises the bar from \"trust the model's word\" to \"deliberate, auditable forgery outside the repo\"; it\n * is not cryptographic. Say so wherever `subagent:` is documented.\n *\n * `@injectable(bindingScopeValues.Singleton)` so it is drawn in the DI design and injected by type.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class SubagentProvenanceService {\n    // Verify a subagent of `expectedAgentType` ran on `branch`. Absent CLAUDE_CODE_SESSION_ID (plain\n    // terminal / CI) returns SKIPPED — the feature must not break non-Claude-Code consumers.\n    verify(expectedAgentType: string, branch: string): ProvenanceResult {\n        const sessionId = process.env['CLAUDE_CODE_SESSION_ID'] ?? '';\n        if (sessionId.trim() === '') {\n            return new ProvenanceResult(PROVENANCE_SKIPPED,\n                `CLAUDE_CODE_SESSION_ID not set — cannot verify the \"${expectedAgentType}\" reviewer subagent (plain terminal / CI). Skipping the provenance check.`);\n        }\n        const dir = this.findSubagentsDir(sessionId);\n        if (dir === '') {\n            return new ProvenanceResult(PROVENANCE_MISSING,\n                `No subagents recorded for this session — the \"${expectedAgentType}\" reviewer subagent must run on this branch before the PR can open.`);\n        }\n        for (const metaFile of this.metaFiles(dir)) {\n            const meta = this.readJson(path.join(dir, metaFile));\n            if (!meta) continue;\n            if (meta['agentType'] !== expectedAgentType) continue;\n            const spawnDepth = meta['spawnDepth'];\n            if (typeof spawnDepth !== 'number' || spawnDepth < 1) continue;\n            const agentId = this.agentIdOf(metaFile);\n            if (this.sidechainOnBranch(dir, agentId, branch)) {\n                return new ProvenanceResult(PROVENANCE_OK,\n                    `verified \"${expectedAgentType}\" reviewer subagent ran (agent ${agentId}).`);\n            }\n        }\n        return new ProvenanceResult(PROVENANCE_MISSING,\n            `No \"${expectedAgentType}\" reviewer subagent ran on this branch — a separate reviewer of that type must review this checklist.`);\n    }\n\n    // Find the subagents dir for `sessionId` by its UNIQUE id, so the cwd-slug never has to be guessed.\n    private findSubagentsDir(sessionId: string): string {\n        const projects = path.join(os.homedir(), '.claude', 'projects');\n        if (!fs.existsSync(projects)) return '';\n        for (const proj of this.readDir(projects)) {\n            const candidate = path.join(projects, proj, sessionId, 'subagents');\n            if (fs.existsSync(candidate)) return candidate;\n        }\n        return '';\n    }\n\n    private metaFiles(dir: string): string[] {\n        return this.readDir(dir).filter((f: string): boolean => f.endsWith('.meta.json'));\n    }\n\n    // agent-<id>.meta.json → <id>\n    private agentIdOf(metaFile: string): string {\n        return metaFile.replace(/^agent-/, '').replace(/\\.meta\\.json$/, '');\n    }\n\n    // Cross-check the sibling transcript's record 0: isSidechain true (a real subagent, not the main\n    // loop) and, when recorded, the same branch. Lenient on branch drift (a leftover …wpN suffix from a\n    // mid-flight branch rename) and on a missing jsonl (meta already matched — accept, best-effort).\n    private sidechainOnBranch(dir: string, agentId: string, branch: string): boolean {\n        const jsonl = path.join(dir, `agent-${agentId}.jsonl`);\n        if (!fs.existsSync(jsonl)) return true;\n        const first = this.firstNonEmptyLine(jsonl);\n        if (first === '') return true;\n        const rec = this.parseLine(first);\n        if (!rec) return true;\n        if (rec['isSidechain'] !== true) return false;\n        const gitBranch = rec['gitBranch'];\n        if (typeof gitBranch !== 'string' || gitBranch === '') return true;\n        return this.stripWp(gitBranch) === this.stripWp(branch);\n    }\n\n    private stripWp(branch: string): string {\n        return branch.replace(/-?wp\\d+$/i, '');\n    }\n\n    private readDir(dir: string): string[] {\n        // webpieces-disable no-unmanaged-exceptions -- chokepoint: an unreadable dir yields [] (best-effort provenance)\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            return fs.readdirSync(dir);\n        } catch (err: unknown) {\n            const error = toError(err);\n            void error;\n            return [];\n        }\n    }\n\n    private firstNonEmptyLine(filePath: string): string {\n        // webpieces-disable no-unmanaged-exceptions -- chokepoint: unreadable transcript → '' (best-effort)\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            for (const line of fs.readFileSync(filePath, 'utf8').split('\\n')) {\n                if (line.trim() !== '') return line;\n            }\n            return '';\n        } catch (err: unknown) {\n            const error = toError(err);\n            void error;\n            return '';\n        }\n    }\n\n    // webpieces-disable no-any-unknown -- opaque parsed JSON object, keys read by the caller\n    private readJson(filePath: string): Record<string, unknown> | null {\n        // webpieces-disable no-unmanaged-exceptions -- chokepoint: malformed meta.json → null (skipped)\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            // webpieces-disable no-any-unknown -- parsed JSON is opaque until narrowed by the caller\n            return JSON.parse(fs.readFileSync(filePath, 'utf8')) as Record<string, unknown>;\n        } catch (err: unknown) {\n            const error = toError(err);\n            void error;\n            return null;\n        }\n    }\n\n    // webpieces-disable no-any-unknown -- one opaque JSONL record, keys read by the caller\n    private parseLine(line: string): Record<string, unknown> | null {\n        // webpieces-disable no-unmanaged-exceptions -- chokepoint: malformed JSONL record → null\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            // webpieces-disable no-any-unknown -- parsed JSON is opaque until narrowed by the caller\n            return JSON.parse(line) as Record<string, unknown>;\n        } catch (err: unknown) {\n            const error = toError(err);\n            void error;\n            return null;\n        }\n    }\n}\n"]}

package/src/validate-config.d.ts

@@ -8,6 +8,7 @@ export declare function validateWebpiecesConfig(rawRules: Record<string, Record<
  * `repoRoot` (when known) lets the `checklists[].docs` existence check run.
  */
 export declare function validatePrGateSection(section: unknown, repoRoot?: string): string[];
+export declare function validateChecklists(value: unknown, repoRoot?: string): string[];
 /**
  * Validate the REQUIRED top-level `excludePaths` block: two independent glob lists (`rules`,
  * `guards`) that suppress hook enforcement per file path. Required so every client upgrading is

package/src/validate-config.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.allRuleNames = allRuleNames;
 exports.validateWebpiecesConfig = validateWebpiecesConfig;
 exports.validatePrGateSection = validatePrGateSection;
+exports.validateChecklists = validateChecklists;
 exports.validateExcludePaths = validateExcludePaths;
 exports.validateMatchRulesSection = validateMatchRulesSection;
 exports.validateSectionPlacement = validateSectionPlacement;
@@ -292,6 +293,8 @@ function validateChecklist(entry, index, repoRoot) {
         errors.push(`[pr-gate] ${label}.blockMessage must be a string.`);
     if (c['disabled'] !== undefined && typeof c['disabled'] !== 'boolean')
         errors.push(`[pr-gate] ${label}.disabled must be a boolean (example/inactive checklist kept in the file).`);
+    if (c['subagent'] !== undefined && typeof c['subagent'] !== 'string')
+        errors.push(`[pr-gate] ${label}.subagent must be a string (the expected reviewer agentType, e.g. "morpheus-reviewer"; omit for no provenance requirement).`);
     return errors;
 }
 /**
@@ -354,9 +357,18 @@ function validatePrGateSection(section, repoRoot) {
     // behavior change. Present ⇒ every entry validated field-by-field, ids unique across the array.
     if ('checklists' in s)
         errors.push(...validateChecklists(s['checklists'], repoRoot));
+    // Optional server-token salt. Absent ⇒ no token minted, CI enforcement is a no-op. Present ⇒ must be
+    // a non-empty string (an empty salt would mint a token anyone can forge from a known-empty secret).
+    if ('gateSalt' in s) {
+        const salt = s['gateSalt'];
+        if (typeof salt !== 'string' || salt.trim() === '') {
+            errors.push(`[pr-gate] "gateSalt" must be a non-empty string — it is the shared secret the gate token is HMAC'd with. Omit the key entirely to disable server-side token enforcement.`);
+        }
+    }
     return errors;
 }
 // The `checklists` array of a pr-gate section: each entry validated field-by-field, ids unique.
+// Exported so the isolated validate-checklist-docs target (checklist-docs-validator.ts) reuses it.
 // webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed below
 // webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file
 function validateChecklists(value, repoRoot) {

package/src/validate-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/validate-config.ts"],"names":[],"mappings":";;AAoGA,oCAEC;AAiGD,0DAqDC;AAmHD,sDAuDC;AA8CD,oDAgBC;AAkFD,8DAuBC;AAUD,4DAuBC;AASD,0DA6BC;;AAppBD,+CAAyB;AACzB,mDAA6B;AAE7B,yCAAyD;AACzD,iDAAqD;AACrD,yDAA2E;AAC3E,6DAA2D;AAC3D,yCAAqC;AACrC,iDAyCwB;AACxB,2EAA0F;AAE1F,sEAAsE;AACtE,iEAAiE;AACjE,MAAM,YAAY,GAA6C;IAC3D,kBAAkB,EAAE,mCAAoB,CAAC,MAAM;IAC/C,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,qBAAqB,EAAE,sCAAuB,CAAC,MAAM;IACrD,yBAAyB,EAAE,yCAA0B,CAAC,MAAM;IAC5D,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,iBAAiB,EAAE,kCAAmB,CAAC,MAAM;IAC7C,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;IACvD,kBAAkB,EAAE,oCAAqB,CAAC,MAAM;IAChD,gBAAgB,EAAE,kCAAmB,CAAC,MAAM;IAC5C,yBAAyB,EAAE,0CAA2B,CAAC,MAAM;IAC7D,qBAAqB,EAAE,sCAAuB,CAAC,MAAM;IACrD,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;IACvD,mCAAmC,EAAE,iDAAkC,CAAC,MAAM;IAC9E,qBAAqB,EAAE,qCAAsB,CAAC,MAAM;IACpD,6CAA6C,EAAE,uEAA2C,CAAC,MAAM;IACjG,eAAe,EAAE,gCAAiB,CAAC,MAAM;IACzC,8BAA8B,EAAE,6CAA8B,CAAC,MAAM;IACrE,2BAA2B,EAAE,2CAA4B,CAAC,MAAM;IAChE,iDAAiD,EAAE,8DAA+C,CAAC,MAAM;IACzG,eAAe,EAAE,iCAAkB,CAAC,MAAM;IAC1C,UAAU,EAAE,4BAAa,CAAC,MAAM;IAChC,uBAAuB,EAAE,wCAAyB,CAAC,MAAM;IACzD,2BAA2B,EAAE,0CAA2B,CAAC,MAAM;IAC/D,yBAAyB,EAAE,yCAA0B,CAAC,MAAM;IAC5D,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,4BAA4B,EAAE,2CAA4B,CAAC,MAAM;IACjE,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;IACvD,kBAAkB,EAAE,mCAAoB,CAAC,MAAM;IAC/C,0BAA0B,EAAE,0CAA2B,CAAC,MAAM;IAC9D,uBAAuB,EAAE,uCAAwB,CAAC,MAAM;IACxD,sBAAsB,EAAE,wCAAyB,CAAC,MAAM;IACxD,WAAW,EAAE,6BAAc,CAAC,MAAM;IAClC,UAAU,EAAE,4BAAa,CAAC,MAAM;IAChC,2BAA2B,EAAE,4CAA6B,CAAC,MAAM;IACjE,aAAa,EAAE,8BAAe,CAAC,MAAM;IACrC,oBAAoB,EAAE,oCAAqB,CAAC,MAAM;IAClD,iCAAiC,EAAE,kDAAmC,CAAC,MAAM;IAC7E,iCAAiC,EAAE,iDAAkC,CAAC,MAAM;IAC5E,sBAAsB,EAAE,wCAAyB,CAAC,MAAM;IACxD,0BAA0B,EAAE,2CAA4B,CAAC,MAAM;IAC/D,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;CAC1D,CAAC;AAEF,kGAAkG;AAClG,mGAAmG;AACnG,SAAgB,YAAY;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY;IAC1C,4FAA4F;IAC5F,2FAA2F;IAC3F,IAAI,GAAG,KAAK,0BAA0B;QAAE,OAAO,8DAA8D,CAAC;IAC9G,OAAO,GAAG,CAAC,UAAU;QACjB,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;QACnC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB;YAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAG,CAAC,CAAC,UAAU;gBACtC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAE,CAAC,CAAC,WAAW;oBACvC,CAAC,CAAC,YAAY,CAAC;AACvB,CAAC;AAED,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,MAAM,uBAAuB,GAAG;IAC5B,mBAAmB;IACnB,uBAAuB;IACvB,0BAA0B;IAC1B,gBAAgB;IAChB,aAAa;IACb,wBAAwB;CAC3B,CAAC;AAEF,yGAAyG;AACzG,SAAS,UAAU,CAAC,MAAgC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,CACH,2CAA2C,WAAW,mCAAmC;QACzF,4FAA4F;QAC5F,4CAA4C,MAAM,EAAE,CACvD,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,MAAgC;IAC1E,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,GACH,IAAI,QAAQ,qEAAqE,OAAO,aAAa;QACrG,mDAAmD;QACnD,MAAM,QAAQ,SAAS,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAE5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,GAAG;YACC,sEAAsE;gBACtE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACf,CAAC;AAED,uGAAuG;AACvG,oGAAoG;AACpG,uGAAuG;AACvG,wGAAwG;AACxG,oGAAoG;AACpG,sFAAsF;AACtF,uGAAuG;AACvG,uGAAuG;AACvG,iEAAiE;AACjE,SAAS,gBAAgB,CAAC,QAAgB;IACtC,OAAO,CACH,IAAI,QAAQ,iFAAiF;QAC7F,mGAAmG;QACnG,qGAAqG;QACrG,yBAAyB,QAAQ,+DAA+D;QAChG,qDAAqD,QAAQ,mCAAmC,CACnG,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,wGAAwG;AACxG,iGAAiG;AACjG,MAAM,mBAAmB,GAA2B;IAChD,mCAAmC,EAC/B,8FAA8F;QAC9F,2EAA2E;IAC/E,sCAAsC,EAClC,8FAA8F;QAC9F,iGAAiG;QACjG,wDAAwD;CAC/D,CAAC;AAEF,4GAA4G;AAC5G,SAAgB,uBAAuB,CACnC,QAAiD,EACjD,oBAA6B,KAAK;IAElC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,mFAAmF;YACnF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,CAAC,iBAAiB;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChE,SAAS;QACb,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,oBAAoB,GAAG,qBAAqB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;gBACjH,SAAS;YACb,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACjE,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;YACrF,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,aAAa,QAAQ,CAAC,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC,CAAC;YACzF,CAAC;iBAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;gBAC/E,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,QAAQ,KAAK,mCAAmC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxH,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,2EAA2E;QAC3E,6FAA6F;QAC7F,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,6BAA6B,GAAG,UAAU,GAAG,KAAK,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,mEAAmE;IACnE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAC7C,6FAA6F;AAC7F,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAEtD,iGAAiG;AACjG,kGAAkG;AAClG,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAChB,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;IACtD,8FAA8F;IAC9F,+FAA+F;IAC/F,kGAAkG;IAClG,oEAAoE;IACpE,iGAAiG;IACjG,6FAA6F;IAC7F,6EAA6E,CACpF,CAAC;AAEF,gGAAgG;AAChG,6FAA6F;AAC7F,SAAS,aAAa;IAClB,OAAO,CACH,kBAAkB;QAClB,qBAAqB;QACrB,0IAA0I;QAC1I,kBAAkB;QAClB,8GAA8G;QAC9G,SAAS;QACT,KAAK,CACR,CAAC;AACN,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAa,EAAE,KAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,mBAAmB,KAAK,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,0FAA0F;IAC1F,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,0BAA0B,CAAC,CAAC;IACnG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS;QAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oGAAoG,CAAC,CAAC;SACzI,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK;QAClE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oFAAoF,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS;QACjE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,wEAAwE,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,sGAAsG;AACtG,wGAAwG;AACxG,0FAA0F;AAC1F,8GAA8G;AAC9G,uHAAuH;AACvH,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa,EAAE,QAAiB;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,wBAAwB,KAAK,wGAAwG,CAAC,CAAC;IACnJ,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAW,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,GAAG,CAAC;IAChH,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACpD,MAAM,CAAC,IAAI,CAAC,wBAAwB,KAAK,wEAAwE,CAAC,CAAC;IACvH,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAC1D,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,0DAA0D,CAAC,CAAC;IAE9F,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,oFAAoF,CAAC,CAAC;IACxH,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,sFAAsF,CAAC,CAAC;IAC1H,CAAC;SAAM,IAAI,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAU,EAAQ,EAAE;YACzD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,oBAAoB,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,iFAAiF,CAAC,CAAC;IACrH,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,GAAW,EAAQ,EAAE;YACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,qBAAqB,GAAG,uFAAuF,CAAC,CAAC;QACvJ,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,uCAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAW,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,6BAA6B,uCAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,kCAAe,IAAI,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,mCAAmC,kCAAe,8DAA8D,CAAC,CAAC;IACpJ,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ;QACxE,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,iCAAiC,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS;QACjE,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,4EAA4E,CAAC,CAAC;IAEhH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,8GAA8G;AAC9G,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,QAAiB;IACrE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,yFAAyF;gBACzF,8CAA8C,aAAa,EAAE,EAAE;SAClE,CAAC;IACN,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,4CAA4C,aAAa,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,4DAA4D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAiC,CAAC,EAAE,CAAC;QAC7G,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC;IAED,iGAAiG;IACjG,8FAA8F;IAC9F,oDAAoD;IACpD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACP,0FAA0F;gBAC1F,oGAAoG,CACvG,CAAC;QACN,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,iDAAiD,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAwC,CAAC,EAAE,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,EAAE,CAAC,mBAAmB,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;QACtG,CAAC;aAAM,CAAC;YACJ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;QACL,CAAC;IACL,CAAC;IAED,oGAAoG;IACpG,gGAAgG;IAChG,IAAI,YAAY,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAErF,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,gGAAgG;AAChG,2FAA2F;AAC3F,8GAA8G;AAC9G,SAAS,kBAAkB,CAAC,KAAc,EAAE,QAAiB;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,+HAA+H,CAAC,CAAC;IAC7I,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,wFAAwF;QACxF,MAAM,EAAE,GAAI,KAAK,CAAC,CAAC,CAAoC,EAAE,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,0CAA0C,CAAC,CAAC;YACpH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB;IACxB,OAAO,qBAAqB;QACxB,sCAAsC;QACtC,oBAAoB;QACpB,KAAK,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,KAAc,EAAE,GAAW;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,mBAAmB,GAAG,uDAAuD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,6FAA6F;AAC7F,SAAgB,oBAAoB,CAAC,OAAgB;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,kFAAkF;gBAClF,yDAAyD,mBAAmB,EAAE,EAAE;SACnF,CAAC;IACN,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,2FAA2F,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,mGAAmG;IACnG,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO;QACH,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC3C,GAAG,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;KAChD,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,kGAAkG;AAClG,sGAAsG;AACtG,yGAAyG;AACzG,8EAA8E;AAE9E,SAAS,iBAAiB;IACtB,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,wCAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,OAAe;IAC/B,8DAA8D;IAC9D,IAAI,CAAC;QACD,kFAAkF;QAClF,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,SAAS,CAAC;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACzB,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,+GAA+G;AAC/G,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,uBAAuB,KAAK,2FAA2F,CAAC,CAAC;IACrI,CAAC;IACD,+FAA+F;IAC/F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,+EAA+E,CAAC,CAAC;IAE7H,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oDAAoD,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACJ,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,aAAa,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,0CAA0C,CAAC,CAAC;IAElF,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,kCAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAuC,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,yBAAyB,kCAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElG,IAAI,OAAO,CAAC,CAAC,0BAA0B,CAAC,KAAK,QAAQ;QACjD,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,uGAAuG,CAAC,CAAC;IAE/I,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,mDAAmD,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,iEAAiE,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC7E,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oCAAoC,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ;QAC9F,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,4CAA4C,CAAC,CAAC;IAEpF,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,SAAgB,yBAAyB,CAAC,OAAgB;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,6FAA6F;gBAC7F,uGAAuG,iBAAiB,EAAE,EAAE;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,wEAAwE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,0FAA0F;QAC1F,MAAM,IAAI,GAAI,OAAO,CAAC,CAAC,CAAoC,EAAE,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,0CAA0C,CAAC,CAAC;YACvH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,4EAA4E;AAC5E,SAAgB,wBAAwB,CACpC,YAAqD,EACrD,iBAA0D;IAE1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAA,sBAAW,EAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,0EAA0E;gBAClF,2EAA2E,CAC9E,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,2FAA2F;QAC3F,IAAI,CAAC,IAAA,sBAAW,EAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,yEAAyE;gBACjF,2EAA2E,CAC9E,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,yFAAyF;AACzF,8GAA8G;AAC9G,SAAgB,uBAAuB,CAAC,QAAiB,EAAE,YAAqB,EAAE,QAAiB;IAC/F,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CACP,sFAAsF;YACtF,+FAA+F,CAClG,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3G,MAAM,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;QAC7G,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,+FAA+F;IAC/F,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IAEtD,8FAA8F;IAC9F,iFAAiF;IACjF,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE9E,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,gDAAgD,CAAC,CAAC;QACtF,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { FieldDef } from './field-def';\nimport { sectionForRule, isHookGuard } from './sections';\nimport { MODIFIED_CODE_MODES } from './rule-configs';\nimport { CHECKLIST_BLOCK, CHECKLIST_SEVERITIES } from './checklist-config';\nimport { DEFAULT_MATCH_RULES } from './match-rules-config';\nimport { toError } from './to-error';\nimport {\n    MaxMethodLinesConfig,\n    MaxFileLinesConfig,\n    RequireReturnTypeConfig,\n    NoInlineTypeLiteralsConfig,\n    NoAnyUnknownConfig,\n    NoImplicitAnyConfig,\n    PrismaValidateDtosConfig,\n    PrismaConverterConfig,\n    NoDestructureConfig,\n    NoUnmanagedExceptionsConfig,\n    CatchErrorPatternConfig,\n    ThrowCauseRequiredConfig,\n    AngularNoDirectApiInResolverConfig,\n    NoSymbolDiTokensConfig,\n    NoCustomCssConfig,\n    NoProcessExitOutsideMainConfig,\n    NoFunctionOutsideClassConfig,\n    InjectAnnotationNotNeededForConcreteClassConfig,\n    FrameworkTagConfig,\n    RoleTagConfig,\n    BranchCreationGuardConfig,\n    PrCreationOrPushGuardConfig,\n    MergeInProgressGuardConfig,\n    PrMergeGuardConfig,\n    RedirectHowToMergeMainConfig,\n    FeatureBranchGuardConfig,\n    ReadStaleGuardConfig,\n    MergedBranchBashGuardConfig,\n    NoFileImportCyclesConfig,\n    RuntimeArchitectureConfig,\n    NxWiringConfig,\n    DiGraphConfig,\n    MissingDesignAnnotationConfig,\n    NoJsFilesConfig,\n    ValidateTsInSrcConfig,\n    ValidateArchitectureUnchangedConfig,\n    ValidateNoArchitectureCyclesConfig,\n    ValidatePackageJsonConfig,\n    ValidateVersionsLockedConfig,\n    ValidateEslintSyncConfig,\n} from './rule-configs';\nimport { NoClientCreationOutsideServerOrClientConfig } from './no-client-creation-config';\n\n// Thin lookup table — each entry delegates to the class's own SCHEMA.\n// No field lists here; all schemas live with their config class.\nconst RULE_SCHEMAS: Record<string, Record<string, FieldDef>> = {\n    'max-method-lines': MaxMethodLinesConfig.SCHEMA,\n    'max-file-lines': MaxFileLinesConfig.SCHEMA,\n    'require-return-type': RequireReturnTypeConfig.SCHEMA,\n    'no-inline-type-literals': NoInlineTypeLiteralsConfig.SCHEMA,\n    'no-any-unknown': NoAnyUnknownConfig.SCHEMA,\n    'no-implicit-any': NoImplicitAnyConfig.SCHEMA,\n    'prisma-validate-dtos': PrismaValidateDtosConfig.SCHEMA,\n    'prisma-converter': PrismaConverterConfig.SCHEMA,\n    'no-destructure': NoDestructureConfig.SCHEMA,\n    'no-unmanaged-exceptions': NoUnmanagedExceptionsConfig.SCHEMA,\n    'catch-error-pattern': CatchErrorPatternConfig.SCHEMA,\n    'throw-cause-required': ThrowCauseRequiredConfig.SCHEMA,\n    'angular-no-direct-api-in-resolver': AngularNoDirectApiInResolverConfig.SCHEMA,\n    'no-symbol-di-tokens': NoSymbolDiTokensConfig.SCHEMA,\n    'no-client-creation-outside-server-or-client': NoClientCreationOutsideServerOrClientConfig.SCHEMA,\n    'no-custom-css': NoCustomCssConfig.SCHEMA,\n    'no-process-exit-outside-main': NoProcessExitOutsideMainConfig.SCHEMA,\n    'no-function-outside-class': NoFunctionOutsideClassConfig.SCHEMA,\n    'inject-annotation-not-needed-for-concrete-class': InjectAnnotationNotNeededForConcreteClassConfig.SCHEMA,\n    'framework-tag': FrameworkTagConfig.SCHEMA,\n    'role-tag': RoleTagConfig.SCHEMA,\n    'branch-creation-guard': BranchCreationGuardConfig.SCHEMA,\n    'pr-creation-or-push-guard': PrCreationOrPushGuardConfig.SCHEMA,\n    'merge-in-progress-guard': MergeInProgressGuardConfig.SCHEMA,\n    'pr-merge-guard': PrMergeGuardConfig.SCHEMA,\n    'redirect-how-to-merge-main': RedirectHowToMergeMainConfig.SCHEMA,\n    'feature-branch-guard': FeatureBranchGuardConfig.SCHEMA,\n    'read-stale-guard': ReadStaleGuardConfig.SCHEMA,\n    'merged-branch-bash-guard': MergedBranchBashGuardConfig.SCHEMA,\n    'no-file-import-cycles': NoFileImportCyclesConfig.SCHEMA,\n    'runtime-architecture': RuntimeArchitectureConfig.SCHEMA,\n    'nx-wiring': NxWiringConfig.SCHEMA,\n    'di-graph': DiGraphConfig.SCHEMA,\n    'missing-design-annotation': MissingDesignAnnotationConfig.SCHEMA,\n    'no-js-files': NoJsFilesConfig.SCHEMA,\n    'validate-ts-in-src': ValidateTsInSrcConfig.SCHEMA,\n    'validate-architecture-unchanged': ValidateArchitectureUnchangedConfig.SCHEMA,\n    'validate-no-architecture-cycles': ValidateNoArchitectureCyclesConfig.SCHEMA,\n    'validate-packagejson': ValidatePackageJsonConfig.SCHEMA,\n    'validate-versions-locked': ValidateVersionsLockedConfig.SCHEMA,\n    'validate-eslint-sync': ValidateEslintSyncConfig.SCHEMA,\n};\n\n// Every built-in rule name that has a typed schema (code rules + bash guards). The installer uses\n// this (with sectionForRule) to seed a fresh webpieces.config.json with every rule in its section.\nexport function allRuleNames(): readonly string[] {\n    return Object.keys(RULE_SCHEMAS);\n}\n\nfunction valueHint(def: FieldDef, key?: string): string {\n    // ignoreModifiedUntilEpoch is required on every rule; 0 keeps the rule active (epoch in the\n    // past), a future unix epoch (seconds) temporarily disables it. Spell that out for the AI.\n    if (key === 'ignoreModifiedUntilEpoch') return '0  (0 = active; future unix-epoch seconds = temporarily off)';\n    return def.enumValues\n        ? `\"${def.enumValues.join(' | ')}\"`\n        : def.type === 'string[]' ? '[\"<string>\", ...]'\n        : def.type === 'number'   ? '<number>'\n        : def.type === 'boolean'  ? '<boolean>'\n        : '\"<string>\"';\n}\n\n// Scoped modes (narrowest → broadest) that enforce ONLY on what changed, so a rule can be\n// adopted gradually instead of all-at-once. When a rule offers one, recommend the first it\n// supports so a fresh config opts into a low-friction rollout rather than reflexively OFF.\nconst GRADUAL_MODE_PREFERENCE = [\n    'MODIFIED_PROJECTS',\n    'NEW_AND_MODIFIED_CODE',\n    'NEW_AND_MODIFIED_METHODS',\n    'MODIFIED_CLASS',\n    'NEW_METHODS',\n    'NEW_AND_MODIFIED_FILES',\n];\n\n/** A rollout hint for the copy-paste snippet: recommend the narrowest gradual mode the rule supports. */\nfunction rolloutTip(schema: Record<string, FieldDef>): string {\n    const modes = schema['mode']?.enumValues ?? [];\n    const recommended = GRADUAL_MODE_PREFERENCE.find((m: string) => modes.includes(m));\n    if (!recommended) return '';\n    const optOut = modes.includes('OFF') ? ' Set \"mode\": \"OFF\" to opt out entirely.' : '';\n    return (\n        `\\n\\n💡 Recommended: start with \"mode\": \"${recommended}\" — it enforces only on what you ` +\n        `actually change, so the rule rolls out gradually (existing code stays grandfathered until ` +\n        `you next touch that project/file/method).${optOut}`\n    );\n}\n\nfunction missingRuleSnippet(ruleName: string, schema: Record<string, FieldDef>): string {\n    // Only required fields go in the copy-paste entry. Optional fields (e.g. the\n    // universal escape hatches ignoreRuleWhileOnBranch / ignoreModifiedUntilEpoch)\n    // are listed separately so the snippet doesn't over-state what's mandatory.\n    const fields = Object.keys(schema);\n    const required = fields.filter(f => !schema[f].optional);\n    const optional = fields.filter(f => schema[f].optional);\n\n    const requiredLines = required.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n    const section = sectionForRule(ruleName);\n    let out =\n        `[${ruleName}] Not configured in webpieces.config.json. Add this entry to the \"${section}\" section\\n` +\n        `(choose values appropriate for your project):\\n\\n` +\n        `  \"${ruleName}\": {\\n${requiredLines.join(',\\n')}\\n  }`;\n\n    if (optional.length > 0) {\n        const optionalLines = optional.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n        out +=\n            `\\n\\nOptional fields you may add to this rule (omit if not needed):\\n` +\n            `${optionalLines.join(',\\n')}`;\n    }\n    out += rolloutTip(schema);\n    return out;\n}\n\n// A config key under rules/hookGuards that the RUNNING validator has no schema for (and no rulesDir is\n// set to supply custom rules). Two very different causes, so the message leads with the common one:\n//   1. Version skew (most common — happens right after a dep bump): webpieces.config.json references a\n//      rule a NEWER @webpieces release added, but the installed guard is OLDER and doesn't know it yet.\n//      Fix = `pnpm install` (NOT deleting the key — the key is valid, the validator is just stale).\n//   2. A genuinely removed/renamed rule left behind, or a typo. Fix = remove the key.\n// Do NOT tell the AI to delete first — that destroys valid config in case 1 (the trap that made the AI\n// gut a working config instead of running `pnpm install`). The banner in load-config.ts spells out the\n// ordered \"run pnpm install, THEN edit only if it persists\" fix.\nfunction unknownRuleError(ruleName: string): string {\n    return (\n        `[${ruleName}] Unknown rule — the running @webpieces validator has no schema for it, and no ` +\n        `\"rulesDir\" is configured to supply custom rules. Most often this means your installed guard is a ` +\n        `release BEHIND this webpieces.config.json: run \\`pnpm install\\` first (see the fix steps below) so ` +\n        `the validator learns \"${ruleName}\". Only if it is STILL unknown after a fresh install is it a ` +\n        `removed/renamed rule or a typo — then remove the \"${ruleName}\" key from webpieces.config.json.`\n    );\n}\n\n// Fields we DELETED from a rule's schema, keyed by \"<rule>.<field>\". The generic unknown-field error\n// (\"Unknown field ... Valid fields: [...]\") is correct but doesn't say WHY the field vanished, so an AI\n// might re-add it. These hints explain the removal so the only action left is to delete the key.\nconst RETIRED_FIELD_HINTS: Record<string, string> = {\n    'runtime-architecture.servicePaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json (apiRelations + project roles). Delete it.',\n    'runtime-architecture.apiProjectPaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json, so there is NO list of api libs to maintain. Delete it (do not ' +\n        'enumerate api libs and do not replace it with a glob).',\n};\n\n// webpieces-disable no-any-unknown -- rawRules values are opaque JSON; each field is validated individually\nexport function validateWebpiecesConfig(\n    rawRules: Record<string, Record<string, unknown>>,\n    hasCustomRulesDir: boolean = false,\n): string[] {\n    const errors: string[] = [];\n\n    // Check field-level correctness for rules that are present\n    for (const [ruleName, entry] of Object.entries(rawRules)) {\n        const schema = RULE_SCHEMAS[ruleName];\n        if (!schema) {\n            // No built-in schema. With no rulesDir there are no custom rules, so this key is a\n            // dead/typo'd entry — tell the AI to remove it (a removed rule like no-shell-substitution\n            // lingers here otherwise). With a rulesDir it may be a legitimate custom rule → skip.\n            if (!hasCustomRulesDir) errors.push(unknownRuleError(ruleName));\n            continue;\n        }\n        for (const [key, value] of Object.entries(entry)) {\n            const fieldDef = schema[key];\n            if (!fieldDef) {\n                const retiredHint = RETIRED_FIELD_HINTS[`${ruleName}.${key}`];\n                const suffix = retiredHint ? ` ${retiredHint}` : '';\n                errors.push(`[${ruleName}] Unknown field \"${key}\". Valid fields: [${Object.keys(schema).join(', ')}].${suffix}`);\n                continue;\n            }\n            if (fieldDef.type === 'string[]') {\n                if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))\n                    errors.push(`[${ruleName}] \"${key}\" must be string[], got ${typeof value}.`);\n            } else if (typeof value !== fieldDef.type) {\n                errors.push(`[${ruleName}] \"${key}\" must be ${fieldDef.type}, got ${typeof value}.`);\n            } else if (fieldDef.enumValues && !fieldDef.enumValues.includes(value as string)) {\n                errors.push(`[${ruleName}] \"${key}\" = \"${value}\" is not valid. Must be one of: ${fieldDef.enumValues.join(', ')}.`);\n            }\n        }\n        // Required fields must actually be present. Until now the loop above only checked\n        // fields that WERE present, so an entry like `{}` (or one missing `mode` /\n        // `ignoreModifiedUntilEpoch`) slipped through. Every non-optional schema field is mandatory.\n        for (const [key, fieldDef] of Object.entries(schema)) {\n            if (!fieldDef.optional && !(key in entry)) {\n                errors.push(`[${ruleName}] Missing required field \"${key}\". Add ${key}: ${valueHint(fieldDef, key)}.`);\n            }\n        }\n    }\n\n    // Every built-in rule must be explicitly configured — no silent defaults.\n    // When a new rule is added to the framework, this check surfaces it immediately\n    // with a ready-to-copy snippet so AI can configure it in one pass.\n    for (const [ruleName, schema] of Object.entries(RULE_SCHEMAS)) {\n        if (!(ruleName in rawRules)) {\n            errors.push(missingRuleSnippet(ruleName, schema));\n        }\n    }\n\n    return errors;\n}\n\nconst PR_GATE_MODES = ['ON', 'OFF'] as const;\n// Optional — omitted means DETECT. Kept inline (like prGateExample) to avoid a load-config ↔\n// pr-gate-config import cycle; the canonical list + semantics live in pr-gate-config.ts.\nconst PR_GATE_MERGE_MODES = ['AUTO', 'NONE'] as const;\n\n// Spelled out because the choice is a POLICY decision with a consequence the chooser cannot see:\n// only the AUTO path can put the compact risk/flags body in main's history, because a UI merge is\n// limited to the repo's squash_merge_commit_title/message settings and no setting produces it.\nconst MERGE_MODE_HELP = (\n        `Must be one of: ${PR_GATE_MERGE_MODES.join(', ')}.\\n` +\n        `  \"AUTO\" — wp-finish-upsert-pr lands the PR: it squash-merges when mergeable, else enables\\n` +\n        `           GitHub auto-merge, both with an explicit --subject/--body-file so main's history\\n` +\n        `           gets the PR title + the compact risk/flags body. Needs allow_auto_merge on the repo\\n` +\n        `           (gh api repos/{owner}/{repo} --jq .allow_auto_merge).\\n` +\n        `  \"NONE\" — wp-finish-upsert-pr only opens/updates the PR; a human merges it. The compact body\\n` +\n        `           is then impossible, so set the repo's squash_merge_commit_title to PR_TITLE or\\n` +\n        `           commits land as the internal \"Squash merge of <branch>\" subject.`\n);\n\n// Copy-paste example for the top-level `pr-gate` block (sibling of `rules`). Kept inline rather\n// than imported from pr-gate-config.ts to avoid a load-config ↔ pr-gate-config import cycle.\nfunction prGateExample(): string {\n    return (\n        `  \"pr-gate\": {\\n` +\n        `    \"mode\": \"ON\",\\n` +\n        `    \"buildCommand\": \"<command CI runs to validate a PR, e.g. pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)>\",\\n` +\n        `    \"gates\": [\\n` +\n        `      { \"name\": \"API Changed\", \"patterns\": [\"libraries/apis/**\", \"**/*Api.ts\"], \"warningColor\": \"yellow\" }\\n` +\n        `    ]\\n` +\n        `  }`\n    );\n}\n\n// webpieces-disable no-any-unknown -- one gate entry from opaque consumer JSON, validated field-by-field\nfunction validateGate(gate: unknown, index: number): string[] {\n    if (typeof gate !== 'object' || gate === null) {\n        return [`[pr-gate] gates[${index}] must be an object { name, patterns, warningColor, disabled? }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque gate object from consumer JSON\n    const g = gate as Record<string, unknown>;\n    const errors: string[] = [];\n    if (typeof g['name'] !== 'string') errors.push(`[pr-gate] gates[${index}].name must be a string.`);\n    if (!Array.isArray(g['patterns']) || !g['patterns'].every(p => typeof p === 'string'))\n        errors.push(`[pr-gate] gates[${index}].patterns must be string[].`);\n    if (g['warningColor'] === undefined)\n        errors.push(`[pr-gate] gates[${index}].warningColor is required — set it to \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    else if (g['warningColor'] !== 'yellow' && g['warningColor'] !== 'red')\n        errors.push(`[pr-gate] gates[${index}].warningColor must be \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    if (g['disabled'] !== undefined && typeof g['disabled'] !== 'boolean')\n        errors.push(`[pr-gate] gates[${index}].disabled must be a boolean (example/inactive gate kept in the file).`);\n    return errors;\n}\n\n// One `checklists[]` entry, validated field-by-field (mirrors validateGate + validateMatchRule). When\n// `repoRoot` is supplied, each doc path must EXIST — a checklist pointing at a deleted doc is otherwise\n// a silent no-op, which is exactly the failure mode this whole feature exists to prevent.\n// webpieces-disable no-any-unknown -- one checklist entry from opaque consumer JSON, validated field-by-field\n// webpieces-disable no-function-outside-class -- module-level config validator, matches validateGate/validateMatchRule\nfunction validateChecklist(entry: unknown, index: number, repoRoot?: string): string[] {\n    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {\n        return [`[pr-gate] checklists[${index}] must be an object { id, title, patterns, contentPatterns, docs, severity, blockMessage, disabled? }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque checklist entry from consumer JSON\n    const c = entry as Record<string, unknown>;\n    const label = typeof c['id'] === 'string' && c['id'] !== '' ? `\"${c['id'] as string}\"` : `checklists[${index}]`;\n    const errors: string[] = [];\n\n    if (typeof c['id'] !== 'string' || c['id'].trim() === '')\n        errors.push(`[pr-gate] checklists[${index}].id must be a non-empty string (it is the key echoed in review.json).`);\n    if (typeof c['title'] !== 'string' || c['title'].trim() === '')\n        errors.push(`[pr-gate] ${label}.title must be a non-empty string (the dashboard label).`);\n\n    if (c['patterns'] !== undefined && !isStringArray(c['patterns']))\n        errors.push(`[pr-gate] ${label}.patterns must be a string[] of path globs (omit or [] to match any changed file).`);\n    if (c['contentPatterns'] !== undefined && !isStringArray(c['contentPatterns'])) {\n        errors.push(`[pr-gate] ${label}.contentPatterns must be a string[] of regexes (omit or [] for a path-only trigger).`);\n    } else if (isStringArray(c['contentPatterns'])) {\n        c['contentPatterns'].forEach((p: string, pi: number): void => {\n            const rxErr = regexError(p);\n            if (rxErr) errors.push(`[pr-gate] ${label}.contentPatterns[${pi}] is not a valid regex: ${rxErr}`);\n        });\n    }\n\n    if (!isStringArray(c['docs']) || c['docs'].length === 0) {\n        errors.push(`[pr-gate] ${label}.docs must be a non-empty string[] of repo-relative doc paths the AI must read.`);\n    } else if (repoRoot !== undefined) {\n        c['docs'].forEach((doc: string): void => {\n            if (!fs.existsSync(path.join(repoRoot, doc)))\n                errors.push(`[pr-gate] ${label}.docs references \"${doc}\", which does not exist — a checklist pointing at a missing doc silently never fires.`);\n        });\n    }\n\n    if (typeof c['severity'] !== 'string' || !CHECKLIST_SEVERITIES.includes(c['severity'] as string))\n        errors.push(`[pr-gate] ${label}.severity must be one of: ${CHECKLIST_SEVERITIES.join(', ')}.`);\n    if (c['severity'] === CHECKLIST_BLOCK && (typeof c['blockMessage'] !== 'string' || c['blockMessage'].trim() === ''))\n        errors.push(`[pr-gate] ${label}.blockMessage is required for a ${CHECKLIST_BLOCK} checklist — it is the wording shown when the PR is refused.`);\n    if (c['blockMessage'] !== undefined && typeof c['blockMessage'] !== 'string')\n        errors.push(`[pr-gate] ${label}.blockMessage must be a string.`);\n    if (c['disabled'] !== undefined && typeof c['disabled'] !== 'boolean')\n        errors.push(`[pr-gate] ${label}.disabled must be a boolean (example/inactive checklist kept in the file).`);\n\n    return errors;\n}\n\n/**\n * Validate the top-level `pr-gate` section. It is REQUIRED (a client that opts out sets mode \"OFF\").\n * `buildCommand` is required unless mode is \"OFF\". Returns human-readable, copy-paste-friendly errors\n * — never throws. The pr-gate block lives outside the FieldDef-driven `rules` schema because its\n * nested `gates`/`checklists` arrays can't be expressed there, so they get structural validation here.\n * `repoRoot` (when known) lets the `checklists[].docs` existence check run.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validatePrGateSection(section: unknown, repoRoot?: string): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[pr-gate] Not configured in webpieces.config.json. Add this block under the \"commands\" ` +\n            `section (set \"mode\": \"OFF\" to opt out):\\n\\n${prGateExample()}`,\n        ];\n    }\n    if (typeof section !== 'object' || Array.isArray(section)) {\n        return [`[pr-gate] Must be an object. Example:\\n\\n${prGateExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque pr-gate section from consumer JSON\n    const s = section as Record<string, unknown>;\n    const errors: string[] = [];\n\n    if (!('mode' in s)) {\n        errors.push(`[pr-gate] Missing required field \"mode\". Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    } else if (typeof s['mode'] !== 'string' || !PR_GATE_MODES.includes(s['mode'] as typeof PR_GATE_MODES[number])) {\n        errors.push(`[pr-gate] \"mode\" = \"${String(s['mode'])}\" is not valid. Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    }\n\n    // buildCommand and mergeMode are both required whenever the gate is active (mode !== OFF). There\n    // is deliberately NO default for mergeMode: whether the tooling may land your PRs is a policy\n    // decision, and either guess is wrong for somebody.\n    if (s['mode'] !== 'OFF') {\n        const cmd = s['buildCommand'];\n        if (typeof cmd !== 'string' || cmd.trim() === '') {\n            errors.push(\n                `[pr-gate] Missing required field \"buildCommand\" — the command CI runs to validate a PR. ` +\n                `Add e.g. \"buildCommand\": \"pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)\".`,\n            );\n        }\n        const mm = s['mergeMode'];\n        if (!('mergeMode' in s)) {\n            errors.push(`[pr-gate] Missing required field \"mergeMode\". ${MERGE_MODE_HELP}`);\n        } else if (typeof mm !== 'string' || !PR_GATE_MERGE_MODES.includes(mm as typeof PR_GATE_MERGE_MODES[number])) {\n            errors.push(`[pr-gate] \"mergeMode\" = \"${String(mm)}\" is not valid. ${MERGE_MODE_HELP}`);\n        }\n    }\n\n    if ('gates' in s) {\n        const gates = s['gates'];\n        if (!Array.isArray(gates)) {\n            errors.push(`[pr-gate] \"gates\" must be an array of { name, patterns, warningColor, disabled? }.`);\n        } else {\n            for (let i = 0; i < gates.length; i += 1) {\n                errors.push(...validateGate(gates[i], i));\n            }\n        }\n    }\n\n    // Optional extension point: diff-triggered company review checklists. Absent ⇒ no validation and no\n    // behavior change. Present ⇒ every entry validated field-by-field, ids unique across the array.\n    if ('checklists' in s) errors.push(...validateChecklists(s['checklists'], repoRoot));\n\n    return errors;\n}\n\n// The `checklists` array of a pr-gate section: each entry validated field-by-field, ids unique.\n// webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed below\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction validateChecklists(value: unknown, repoRoot?: string): string[] {\n    if (!Array.isArray(value)) {\n        return [`[pr-gate] \"checklists\" must be an array of { id, title, patterns, contentPatterns, docs, severity, blockMessage, disabled? }.`];\n    }\n    const errors: string[] = [];\n    const seenIds = new Set<string>();\n    for (let i = 0; i < value.length; i += 1) {\n        errors.push(...validateChecklist(value[i], i, repoRoot));\n        // webpieces-disable no-any-unknown -- reading the id off an opaque entry only to dedupe\n        const id = (value[i] as Record<string, unknown> | null)?.['id'];\n        if (typeof id === 'string' && id !== '') {\n            if (seenIds.has(id)) errors.push(`[pr-gate] duplicate checklist id \"${id}\" — each checklists[].id must be unique.`);\n            seenIds.add(id);\n        }\n    }\n    return errors;\n}\n\nfunction excludePathsExample(): string {\n    return '\"excludePaths\": {\\n' +\n        '    \"rules\":  [\"repositories/**\"],\\n' +\n        '    \"guards\": []\\n' +\n        '  }';\n}\n\n// One of the two excludePaths lists: required, must be a string[] (may be empty).\n// webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed here\nfunction validateExcludeList(value: unknown, key: string): string[] {\n    if (!(Array.isArray(value) && value.every(p => typeof p === 'string'))) {\n        return [`[excludePaths] \"${key}\" must be a string[] of glob paths (use [] for none).`];\n    }\n    return [];\n}\n\n/**\n * Validate the REQUIRED top-level `excludePaths` block: two independent glob lists (`rules`,\n * `guards`) that suppress hook enforcement per file path. Required so every client upgrading is\n * forced to declare it (as [] to keep today's behavior, or with real paths). Returns copy-paste\n * friendly errors and never throws — same contract as validatePrGateSection.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateExcludePaths(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[excludePaths] Not configured in webpieces.config.json. Add this REQUIRED block ` +\n            `(use empty arrays to keep enforcing everywhere):\\n\\n  ${excludePathsExample()}`,\n        ];\n    }\n    if (typeof section !== 'object' || Array.isArray(section)) {\n        return [`[excludePaths] Must be an object with \"rules\" and \"guards\" string arrays. Example:\\n\\n  ${excludePathsExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque excludePaths section from consumer JSON\n    const s = section as Record<string, unknown>;\n    return [\n        ...validateExcludeList(s['rules'], 'rules'),\n        ...validateExcludeList(s['guards'], 'guards'),\n    ];\n}\n\n// ---------------------------------------------------------------------------\n// match-rules — a new top-level ARRAY section (parallel to pr-gate/excludePaths). Each entry is a\n// client-authored content guard (raw-regex patterns + message + scoping). Validated structurally here\n// the same way pr-gate's `gates` are, because an array of objects can't be expressed in FieldDef schema.\n// ---------------------------------------------------------------------------\n\nfunction matchRulesExample(): string {\n    return `\"match-rules\": ${JSON.stringify(DEFAULT_MATCH_RULES, null, 4)}`;\n}\n\n// webpieces-disable no-any-unknown -- generic type guard over an opaque JSON value\nfunction isStringArray(value: unknown): value is string[] {\n    return Array.isArray(value) && value.every(v => typeof v === 'string');\n}\n\n// Compile a pattern to validate it; returns the error message, or undefined when it compiles.\nfunction regexError(pattern: string): string | undefined {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Constructed only to validate the syntax; the object is intentionally discarded.\n        void new RegExp(pattern);\n        return undefined;\n    } catch (err: unknown) {\n        const error = toError(err);\n        return error.message;\n    }\n}\n\n// One entry of the match-rules array, validated field-by-field (see validateGate for the pattern).\n// webpieces-disable no-any-unknown -- one match-rule entry from opaque consumer JSON, validated field-by-field\nfunction validateMatchRule(entry: unknown, index: number): string[] {\n    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {\n        return [`[match-rules] entry[${index}] must be an object { name, patterns, mainMessage, mode, ignoreModifiedUntilEpoch, ... }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque match-rule entry from consumer JSON\n    const e = entry as Record<string, unknown>;\n    const label = typeof e['name'] === 'string' ? `\"${e['name']}\"` : `entry[${index}]`;\n    const errors: string[] = [];\n\n    if (typeof e['name'] !== 'string' || e['name'].trim() === '')\n        errors.push(`[match-rules] entry[${index}].name must be a non-empty string (it is the disable token and report label).`);\n\n    if (!isStringArray(e['patterns']) || e['patterns'].length === 0) {\n        errors.push(`[match-rules] ${label}.patterns must be a non-empty string[] of regexes.`);\n    } else {\n        e['patterns'].forEach((p: string, pi: number) => {\n            const rxErr = regexError(p);\n            if (rxErr) errors.push(`[match-rules] ${label}.patterns[${pi}] is not a valid regex: ${rxErr}`);\n        });\n    }\n\n    if (typeof e['mainMessage'] !== 'string' || e['mainMessage'].trim() === '')\n        errors.push(`[match-rules] ${label}.mainMessage must be a non-empty string.`);\n\n    if (typeof e['mode'] !== 'string' || !MODIFIED_CODE_MODES.includes(e['mode'] as typeof MODIFIED_CODE_MODES[number]))\n        errors.push(`[match-rules] ${label}.mode must be one of: ${MODIFIED_CODE_MODES.join(', ')}.`);\n\n    if (typeof e['ignoreModifiedUntilEpoch'] !== 'number')\n        errors.push(`[match-rules] ${label}.ignoreModifiedUntilEpoch must be a number (0 = active; future unix-epoch seconds = temporarily off).`);\n\n    if (e['options'] !== undefined && !isStringArray(e['options']))\n        errors.push(`[match-rules] ${label}.options must be a string[] (omit if not needed).`);\n    if (e['allowedPaths'] !== undefined && !isStringArray(e['allowedPaths']))\n        errors.push(`[match-rules] ${label}.allowedPaths must be a string[] of globs (omit if not needed).`);\n    if (e['disableAllowed'] !== undefined && typeof e['disableAllowed'] !== 'boolean')\n        errors.push(`[match-rules] ${label}.disableAllowed must be a boolean.`);\n    if (e['ignoreRuleWhileOnBranch'] !== undefined && typeof e['ignoreRuleWhileOnBranch'] !== 'string')\n        errors.push(`[match-rules] ${label}.ignoreRuleWhileOnBranch must be a string.`);\n\n    return errors;\n}\n\n/**\n * Validate the REQUIRED top-level `match-rules` array (client-authored content guards). MISSING →\n * one error printing the ready-to-paste `no-fetch` example (add at least this; more can follow).\n * Present-but-`[]` → allowed (a conscious opt-out, matching pr-gate mode:OFF / excludePaths []).\n * Otherwise every entry is validated field-by-field (each regex compile-checked) plus name\n * uniqueness. Copy-paste-friendly errors; never throws — same contract as validatePrGateSection.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateMatchRulesSection(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[match-rules] Not configured in webpieces.config.json. Add this REQUIRED top-level array — ` +\n            `seed it with the no-fetch guard below (you can add more entries: no-moment, no-lodash-chain, …):\\n\\n${matchRulesExample()}`,\n        ];\n    }\n    if (!Array.isArray(section)) {\n        return [`[match-rules] Must be an array of content-guard objects. Example:\\n\\n${matchRulesExample()}`];\n    }\n\n    const errors: string[] = [];\n    const seen = new Set<string>();\n    for (let i = 0; i < section.length; i += 1) {\n        errors.push(...validateMatchRule(section[i], i));\n        // webpieces-disable no-any-unknown -- reading the name off an opaque entry only to dedupe\n        const name = (section[i] as Record<string, unknown> | null)?.['name'];\n        if (typeof name === 'string') {\n            if (seen.has(name)) errors.push(`[match-rules] duplicate entry name \"${name}\" — each match-rule name must be unique.`);\n            seen.add(name);\n        }\n    }\n    return errors;\n}\n\n/**\n * Enforce that each built-in lives in its correct section: code rules under `rules`, bash guards\n * under `hookGuards`. A guard left in `rules` (or a rule placed in `hookGuards`) is reported with a\n * \"move it\" message so the split stays clean. Unknown/custom names are ignored (they may be custom\n * rules from rulesDir). Presence (\"every built-in must be configured\") is checked separately by\n * validateWebpiecesConfig against the merged map.\n */\n// webpieces-disable no-any-unknown -- section maps are opaque consumer JSON\nexport function validateSectionPlacement(\n    rulesSection: Record<string, Record<string, unknown>>,\n    hookGuardsSection: Record<string, Record<string, unknown>>,\n): string[] {\n    const errors: string[] = [];\n    for (const name of Object.keys(rulesSection)) {\n        if (isHookGuard(name)) {\n            errors.push(\n                `[${name}] is a hook guard and belongs in the \"hookGuards\" section, not \"rules\". ` +\n                `Move it (or run \\`wp-install-ai-hooks --sync\\` to migrate automatically).`,\n            );\n        }\n    }\n    for (const name of Object.keys(hookGuardsSection)) {\n        // Only flag KNOWN code rules misplaced into hookGuards; unknown names may be custom rules.\n        if (!isHookGuard(name) && RULE_SCHEMAS[name]) {\n            errors.push(\n                `[${name}] is a code rule and belongs in the \"rules\" section, not \"hookGuards\". ` +\n                `Move it (or run \\`wp-install-ai-hooks --sync\\` to migrate automatically).`,\n            );\n        }\n    }\n    return errors;\n}\n\n/**\n * Validate the `commands` section: its `pr-gate` block (delegated to validatePrGateSection) plus the\n * optional command-string fields. Also surfaces a migration error if a DEPRECATED top-level `pr-gate`\n * block is still present, telling the consumer to move it under `commands`.\n */\n// webpieces-disable no-any-unknown -- `commands`/`legacyPrGate` are opaque consumer JSON\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validateCommandsSection(commands: unknown, legacyPrGate: unknown, repoRoot?: string): string[] {\n    const errors: string[] = [];\n\n    if (legacyPrGate !== undefined) {\n        errors.push(\n            `[pr-gate] The top-level \"pr-gate\" block is deprecated. Move it under the \"commands\" ` +\n            `section as commands[\"pr-gate\"] (run \\`wp-install-ai-hooks --sync\\` to migrate automatically).`,\n        );\n    }\n\n    if (commands !== undefined && (typeof commands !== 'object' || commands === null || Array.isArray(commands))) {\n        errors.push(`[commands] Must be an object { \"pr-gate\": {...}, \"upsertPr\": \"...\", \"mergeComplete\": \"...\" }.`);\n        return errors;\n    }\n\n    // webpieces-disable no-any-unknown -- narrowing the opaque commands section from consumer JSON\n    const c = (commands ?? {}) as Record<string, unknown>;\n\n    // pr-gate is required (set mode OFF to opt out). Prefer commands[\"pr-gate\"]; fall back to the\n    // legacy top-level block so an un-migrated file still validates its gate config.\n    errors.push(...validatePrGateSection(c['pr-gate'] ?? legacyPrGate, repoRoot));\n\n    for (const field of ['upsertPr', 'mergeComplete']) {\n        if (field in c && typeof c[field] !== 'string') {\n            errors.push(`[commands] \"${field}\" must be a string (the gated command to run).`);\n        }\n    }\n\n    return errors;\n}\n"]}
+{"version":3,"file":"validate-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/validate-config.ts"],"names":[],"mappings":";;AAoGA,oCAEC;AAiGD,0DAqDC;AAqHD,sDAgEC;AAMD,gDAgBC;AAyBD,oDAgBC;AAkFD,8DAuBC;AAUD,4DAuBC;AASD,0DA6BC;;AAhqBD,+CAAyB;AACzB,mDAA6B;AAE7B,yCAAyD;AACzD,iDAAqD;AACrD,yDAA2E;AAC3E,6DAA2D;AAC3D,yCAAqC;AACrC,iDAyCwB;AACxB,2EAA0F;AAE1F,sEAAsE;AACtE,iEAAiE;AACjE,MAAM,YAAY,GAA6C;IAC3D,kBAAkB,EAAE,mCAAoB,CAAC,MAAM;IAC/C,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,qBAAqB,EAAE,sCAAuB,CAAC,MAAM;IACrD,yBAAyB,EAAE,yCAA0B,CAAC,MAAM;IAC5D,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,iBAAiB,EAAE,kCAAmB,CAAC,MAAM;IAC7C,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;IACvD,kBAAkB,EAAE,oCAAqB,CAAC,MAAM;IAChD,gBAAgB,EAAE,kCAAmB,CAAC,MAAM;IAC5C,yBAAyB,EAAE,0CAA2B,CAAC,MAAM;IAC7D,qBAAqB,EAAE,sCAAuB,CAAC,MAAM;IACrD,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;IACvD,mCAAmC,EAAE,iDAAkC,CAAC,MAAM;IAC9E,qBAAqB,EAAE,qCAAsB,CAAC,MAAM;IACpD,6CAA6C,EAAE,uEAA2C,CAAC,MAAM;IACjG,eAAe,EAAE,gCAAiB,CAAC,MAAM;IACzC,8BAA8B,EAAE,6CAA8B,CAAC,MAAM;IACrE,2BAA2B,EAAE,2CAA4B,CAAC,MAAM;IAChE,iDAAiD,EAAE,8DAA+C,CAAC,MAAM;IACzG,eAAe,EAAE,iCAAkB,CAAC,MAAM;IAC1C,UAAU,EAAE,4BAAa,CAAC,MAAM;IAChC,uBAAuB,EAAE,wCAAyB,CAAC,MAAM;IACzD,2BAA2B,EAAE,0CAA2B,CAAC,MAAM;IAC/D,yBAAyB,EAAE,yCAA0B,CAAC,MAAM;IAC5D,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,4BAA4B,EAAE,2CAA4B,CAAC,MAAM;IACjE,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;IACvD,kBAAkB,EAAE,mCAAoB,CAAC,MAAM;IAC/C,0BAA0B,EAAE,0CAA2B,CAAC,MAAM;IAC9D,uBAAuB,EAAE,uCAAwB,CAAC,MAAM;IACxD,sBAAsB,EAAE,wCAAyB,CAAC,MAAM;IACxD,WAAW,EAAE,6BAAc,CAAC,MAAM;IAClC,UAAU,EAAE,4BAAa,CAAC,MAAM;IAChC,2BAA2B,EAAE,4CAA6B,CAAC,MAAM;IACjE,aAAa,EAAE,8BAAe,CAAC,MAAM;IACrC,oBAAoB,EAAE,oCAAqB,CAAC,MAAM;IAClD,iCAAiC,EAAE,kDAAmC,CAAC,MAAM;IAC7E,iCAAiC,EAAE,iDAAkC,CAAC,MAAM;IAC5E,sBAAsB,EAAE,wCAAyB,CAAC,MAAM;IACxD,0BAA0B,EAAE,2CAA4B,CAAC,MAAM;IAC/D,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;CAC1D,CAAC;AAEF,kGAAkG;AAClG,mGAAmG;AACnG,SAAgB,YAAY;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY;IAC1C,4FAA4F;IAC5F,2FAA2F;IAC3F,IAAI,GAAG,KAAK,0BAA0B;QAAE,OAAO,8DAA8D,CAAC;IAC9G,OAAO,GAAG,CAAC,UAAU;QACjB,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;QACnC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB;YAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAG,CAAC,CAAC,UAAU;gBACtC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAE,CAAC,CAAC,WAAW;oBACvC,CAAC,CAAC,YAAY,CAAC;AACvB,CAAC;AAED,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,MAAM,uBAAuB,GAAG;IAC5B,mBAAmB;IACnB,uBAAuB;IACvB,0BAA0B;IAC1B,gBAAgB;IAChB,aAAa;IACb,wBAAwB;CAC3B,CAAC;AAEF,yGAAyG;AACzG,SAAS,UAAU,CAAC,MAAgC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,CACH,2CAA2C,WAAW,mCAAmC;QACzF,4FAA4F;QAC5F,4CAA4C,MAAM,EAAE,CACvD,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,MAAgC;IAC1E,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,GACH,IAAI,QAAQ,qEAAqE,OAAO,aAAa;QACrG,mDAAmD;QACnD,MAAM,QAAQ,SAAS,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAE5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,GAAG;YACC,sEAAsE;gBACtE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACf,CAAC;AAED,uGAAuG;AACvG,oGAAoG;AACpG,uGAAuG;AACvG,wGAAwG;AACxG,oGAAoG;AACpG,sFAAsF;AACtF,uGAAuG;AACvG,uGAAuG;AACvG,iEAAiE;AACjE,SAAS,gBAAgB,CAAC,QAAgB;IACtC,OAAO,CACH,IAAI,QAAQ,iFAAiF;QAC7F,mGAAmG;QACnG,qGAAqG;QACrG,yBAAyB,QAAQ,+DAA+D;QAChG,qDAAqD,QAAQ,mCAAmC,CACnG,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,wGAAwG;AACxG,iGAAiG;AACjG,MAAM,mBAAmB,GAA2B;IAChD,mCAAmC,EAC/B,8FAA8F;QAC9F,2EAA2E;IAC/E,sCAAsC,EAClC,8FAA8F;QAC9F,iGAAiG;QACjG,wDAAwD;CAC/D,CAAC;AAEF,4GAA4G;AAC5G,SAAgB,uBAAuB,CACnC,QAAiD,EACjD,oBAA6B,KAAK;IAElC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,mFAAmF;YACnF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,CAAC,iBAAiB;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChE,SAAS;QACb,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,oBAAoB,GAAG,qBAAqB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;gBACjH,SAAS;YACb,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACjE,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;YACrF,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,aAAa,QAAQ,CAAC,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC,CAAC;YACzF,CAAC;iBAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;gBAC/E,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,QAAQ,KAAK,mCAAmC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxH,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,2EAA2E;QAC3E,6FAA6F;QAC7F,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,6BAA6B,GAAG,UAAU,GAAG,KAAK,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,mEAAmE;IACnE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAC7C,6FAA6F;AAC7F,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAEtD,iGAAiG;AACjG,kGAAkG;AAClG,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAChB,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;IACtD,8FAA8F;IAC9F,+FAA+F;IAC/F,kGAAkG;IAClG,oEAAoE;IACpE,iGAAiG;IACjG,6FAA6F;IAC7F,6EAA6E,CACpF,CAAC;AAEF,gGAAgG;AAChG,6FAA6F;AAC7F,SAAS,aAAa;IAClB,OAAO,CACH,kBAAkB;QAClB,qBAAqB;QACrB,0IAA0I;QAC1I,kBAAkB;QAClB,8GAA8G;QAC9G,SAAS;QACT,KAAK,CACR,CAAC;AACN,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAa,EAAE,KAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,mBAAmB,KAAK,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,0FAA0F;IAC1F,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,0BAA0B,CAAC,CAAC;IACnG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS;QAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oGAAoG,CAAC,CAAC;SACzI,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK;QAClE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oFAAoF,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS;QACjE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,wEAAwE,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,sGAAsG;AACtG,wGAAwG;AACxG,0FAA0F;AAC1F,8GAA8G;AAC9G,uHAAuH;AACvH,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa,EAAE,QAAiB;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,wBAAwB,KAAK,wGAAwG,CAAC,CAAC;IACnJ,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAW,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,GAAG,CAAC;IAChH,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACpD,MAAM,CAAC,IAAI,CAAC,wBAAwB,KAAK,wEAAwE,CAAC,CAAC;IACvH,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAC1D,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,0DAA0D,CAAC,CAAC;IAE9F,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,oFAAoF,CAAC,CAAC;IACxH,IAAI,CAAC,CAAC,iBAAiB,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,sFAAsF,CAAC,CAAC;IAC1H,CAAC;SAAM,IAAI,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAU,EAAQ,EAAE;YACzD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,oBAAoB,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,iFAAiF,CAAC,CAAC;IACrH,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,GAAW,EAAQ,EAAE;YACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,qBAAqB,GAAG,uFAAuF,CAAC,CAAC;QACvJ,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,uCAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAW,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,6BAA6B,uCAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,kCAAe,IAAI,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,mCAAmC,kCAAe,8DAA8D,CAAC,CAAC;IACpJ,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ;QACxE,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,iCAAiC,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS;QACjE,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,4EAA4E,CAAC,CAAC;IAChH,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAChE,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,6HAA6H,CAAC,CAAC;IAEjK,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,8GAA8G;AAC9G,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,QAAiB;IACrE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,yFAAyF;gBACzF,8CAA8C,aAAa,EAAE,EAAE;SAClE,CAAC;IACN,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,4CAA4C,aAAa,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,4DAA4D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAiC,CAAC,EAAE,CAAC;QAC7G,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC;IAED,iGAAiG;IACjG,8FAA8F;IAC9F,oDAAoD;IACpD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACP,0FAA0F;gBAC1F,oGAAoG,CACvG,CAAC;QACN,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,iDAAiD,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAwC,CAAC,EAAE,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,EAAE,CAAC,mBAAmB,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;QACtG,CAAC;aAAM,CAAC;YACJ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;QACL,CAAC;IACL,CAAC;IAED,oGAAoG;IACpG,gGAAgG;IAChG,IAAI,YAAY,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAErF,qGAAqG;IACrG,oGAAoG;IACpG,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,0KAA0K,CAAC,CAAC;QAC5L,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,gGAAgG;AAChG,mGAAmG;AACnG,2FAA2F;AAC3F,8GAA8G;AAC9G,SAAgB,kBAAkB,CAAC,KAAc,EAAE,QAAiB;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,+HAA+H,CAAC,CAAC;IAC7I,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzD,wFAAwF;QACxF,MAAM,EAAE,GAAI,KAAK,CAAC,CAAC,CAAoC,EAAE,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,0CAA0C,CAAC,CAAC;YACpH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB;IACxB,OAAO,qBAAqB;QACxB,sCAAsC;QACtC,oBAAoB;QACpB,KAAK,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,KAAc,EAAE,GAAW;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,mBAAmB,GAAG,uDAAuD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,6FAA6F;AAC7F,SAAgB,oBAAoB,CAAC,OAAgB;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,kFAAkF;gBAClF,yDAAyD,mBAAmB,EAAE,EAAE;SACnF,CAAC;IACN,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,2FAA2F,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,mGAAmG;IACnG,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,OAAO;QACH,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAC3C,GAAG,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;KAChD,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,kGAAkG;AAClG,sGAAsG;AACtG,yGAAyG;AACzG,8EAA8E;AAE9E,SAAS,iBAAiB;IACtB,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,wCAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,OAAe;IAC/B,8DAA8D;IAC9D,IAAI,CAAC;QACD,kFAAkF;QAClF,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,SAAS,CAAC;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACzB,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,+GAA+G;AAC/G,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,uBAAuB,KAAK,2FAA2F,CAAC,CAAC;IACrI,CAAC;IACD,+FAA+F;IAC/F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,+EAA+E,CAAC,CAAC;IAE7H,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oDAAoD,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACJ,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,aAAa,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,0CAA0C,CAAC,CAAC;IAElF,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,kCAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAuC,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,yBAAyB,kCAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElG,IAAI,OAAO,CAAC,CAAC,0BAA0B,CAAC,KAAK,QAAQ;QACjD,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,uGAAuG,CAAC,CAAC;IAE/I,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,mDAAmD,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,iEAAiE,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC7E,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oCAAoC,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,yBAAyB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,yBAAyB,CAAC,KAAK,QAAQ;QAC9F,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,4CAA4C,CAAC,CAAC;IAEpF,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,SAAgB,yBAAyB,CAAC,OAAgB;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,6FAA6F;gBAC7F,uGAAuG,iBAAiB,EAAE,EAAE;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,wEAAwE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,0FAA0F;QAC1F,MAAM,IAAI,GAAI,OAAO,CAAC,CAAC,CAAoC,EAAE,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,0CAA0C,CAAC,CAAC;YACvH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,4EAA4E;AAC5E,SAAgB,wBAAwB,CACpC,YAAqD,EACrD,iBAA0D;IAE1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAA,sBAAW,EAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,0EAA0E;gBAClF,2EAA2E,CAC9E,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,2FAA2F;QAC3F,IAAI,CAAC,IAAA,sBAAW,EAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,yEAAyE;gBACjF,2EAA2E,CAC9E,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,yFAAyF;AACzF,8GAA8G;AAC9G,SAAgB,uBAAuB,CAAC,QAAiB,EAAE,YAAqB,EAAE,QAAiB;IAC/F,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CACP,sFAAsF;YACtF,+FAA+F,CAClG,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3G,MAAM,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;QAC7G,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,+FAA+F;IAC/F,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IAEtD,8FAA8F;IAC9F,iFAAiF;IACjF,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE9E,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,gDAAgD,CAAC,CAAC;QACtF,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { FieldDef } from './field-def';\nimport { sectionForRule, isHookGuard } from './sections';\nimport { MODIFIED_CODE_MODES } from './rule-configs';\nimport { CHECKLIST_BLOCK, CHECKLIST_SEVERITIES } from './checklist-config';\nimport { DEFAULT_MATCH_RULES } from './match-rules-config';\nimport { toError } from './to-error';\nimport {\n    MaxMethodLinesConfig,\n    MaxFileLinesConfig,\n    RequireReturnTypeConfig,\n    NoInlineTypeLiteralsConfig,\n    NoAnyUnknownConfig,\n    NoImplicitAnyConfig,\n    PrismaValidateDtosConfig,\n    PrismaConverterConfig,\n    NoDestructureConfig,\n    NoUnmanagedExceptionsConfig,\n    CatchErrorPatternConfig,\n    ThrowCauseRequiredConfig,\n    AngularNoDirectApiInResolverConfig,\n    NoSymbolDiTokensConfig,\n    NoCustomCssConfig,\n    NoProcessExitOutsideMainConfig,\n    NoFunctionOutsideClassConfig,\n    InjectAnnotationNotNeededForConcreteClassConfig,\n    FrameworkTagConfig,\n    RoleTagConfig,\n    BranchCreationGuardConfig,\n    PrCreationOrPushGuardConfig,\n    MergeInProgressGuardConfig,\n    PrMergeGuardConfig,\n    RedirectHowToMergeMainConfig,\n    FeatureBranchGuardConfig,\n    ReadStaleGuardConfig,\n    MergedBranchBashGuardConfig,\n    NoFileImportCyclesConfig,\n    RuntimeArchitectureConfig,\n    NxWiringConfig,\n    DiGraphConfig,\n    MissingDesignAnnotationConfig,\n    NoJsFilesConfig,\n    ValidateTsInSrcConfig,\n    ValidateArchitectureUnchangedConfig,\n    ValidateNoArchitectureCyclesConfig,\n    ValidatePackageJsonConfig,\n    ValidateVersionsLockedConfig,\n    ValidateEslintSyncConfig,\n} from './rule-configs';\nimport { NoClientCreationOutsideServerOrClientConfig } from './no-client-creation-config';\n\n// Thin lookup table — each entry delegates to the class's own SCHEMA.\n// No field lists here; all schemas live with their config class.\nconst RULE_SCHEMAS: Record<string, Record<string, FieldDef>> = {\n    'max-method-lines': MaxMethodLinesConfig.SCHEMA,\n    'max-file-lines': MaxFileLinesConfig.SCHEMA,\n    'require-return-type': RequireReturnTypeConfig.SCHEMA,\n    'no-inline-type-literals': NoInlineTypeLiteralsConfig.SCHEMA,\n    'no-any-unknown': NoAnyUnknownConfig.SCHEMA,\n    'no-implicit-any': NoImplicitAnyConfig.SCHEMA,\n    'prisma-validate-dtos': PrismaValidateDtosConfig.SCHEMA,\n    'prisma-converter': PrismaConverterConfig.SCHEMA,\n    'no-destructure': NoDestructureConfig.SCHEMA,\n    'no-unmanaged-exceptions': NoUnmanagedExceptionsConfig.SCHEMA,\n    'catch-error-pattern': CatchErrorPatternConfig.SCHEMA,\n    'throw-cause-required': ThrowCauseRequiredConfig.SCHEMA,\n    'angular-no-direct-api-in-resolver': AngularNoDirectApiInResolverConfig.SCHEMA,\n    'no-symbol-di-tokens': NoSymbolDiTokensConfig.SCHEMA,\n    'no-client-creation-outside-server-or-client': NoClientCreationOutsideServerOrClientConfig.SCHEMA,\n    'no-custom-css': NoCustomCssConfig.SCHEMA,\n    'no-process-exit-outside-main': NoProcessExitOutsideMainConfig.SCHEMA,\n    'no-function-outside-class': NoFunctionOutsideClassConfig.SCHEMA,\n    'inject-annotation-not-needed-for-concrete-class': InjectAnnotationNotNeededForConcreteClassConfig.SCHEMA,\n    'framework-tag': FrameworkTagConfig.SCHEMA,\n    'role-tag': RoleTagConfig.SCHEMA,\n    'branch-creation-guard': BranchCreationGuardConfig.SCHEMA,\n    'pr-creation-or-push-guard': PrCreationOrPushGuardConfig.SCHEMA,\n    'merge-in-progress-guard': MergeInProgressGuardConfig.SCHEMA,\n    'pr-merge-guard': PrMergeGuardConfig.SCHEMA,\n    'redirect-how-to-merge-main': RedirectHowToMergeMainConfig.SCHEMA,\n    'feature-branch-guard': FeatureBranchGuardConfig.SCHEMA,\n    'read-stale-guard': ReadStaleGuardConfig.SCHEMA,\n    'merged-branch-bash-guard': MergedBranchBashGuardConfig.SCHEMA,\n    'no-file-import-cycles': NoFileImportCyclesConfig.SCHEMA,\n    'runtime-architecture': RuntimeArchitectureConfig.SCHEMA,\n    'nx-wiring': NxWiringConfig.SCHEMA,\n    'di-graph': DiGraphConfig.SCHEMA,\n    'missing-design-annotation': MissingDesignAnnotationConfig.SCHEMA,\n    'no-js-files': NoJsFilesConfig.SCHEMA,\n    'validate-ts-in-src': ValidateTsInSrcConfig.SCHEMA,\n    'validate-architecture-unchanged': ValidateArchitectureUnchangedConfig.SCHEMA,\n    'validate-no-architecture-cycles': ValidateNoArchitectureCyclesConfig.SCHEMA,\n    'validate-packagejson': ValidatePackageJsonConfig.SCHEMA,\n    'validate-versions-locked': ValidateVersionsLockedConfig.SCHEMA,\n    'validate-eslint-sync': ValidateEslintSyncConfig.SCHEMA,\n};\n\n// Every built-in rule name that has a typed schema (code rules + bash guards). The installer uses\n// this (with sectionForRule) to seed a fresh webpieces.config.json with every rule in its section.\nexport function allRuleNames(): readonly string[] {\n    return Object.keys(RULE_SCHEMAS);\n}\n\nfunction valueHint(def: FieldDef, key?: string): string {\n    // ignoreModifiedUntilEpoch is required on every rule; 0 keeps the rule active (epoch in the\n    // past), a future unix epoch (seconds) temporarily disables it. Spell that out for the AI.\n    if (key === 'ignoreModifiedUntilEpoch') return '0  (0 = active; future unix-epoch seconds = temporarily off)';\n    return def.enumValues\n        ? `\"${def.enumValues.join(' | ')}\"`\n        : def.type === 'string[]' ? '[\"<string>\", ...]'\n        : def.type === 'number'   ? '<number>'\n        : def.type === 'boolean'  ? '<boolean>'\n        : '\"<string>\"';\n}\n\n// Scoped modes (narrowest → broadest) that enforce ONLY on what changed, so a rule can be\n// adopted gradually instead of all-at-once. When a rule offers one, recommend the first it\n// supports so a fresh config opts into a low-friction rollout rather than reflexively OFF.\nconst GRADUAL_MODE_PREFERENCE = [\n    'MODIFIED_PROJECTS',\n    'NEW_AND_MODIFIED_CODE',\n    'NEW_AND_MODIFIED_METHODS',\n    'MODIFIED_CLASS',\n    'NEW_METHODS',\n    'NEW_AND_MODIFIED_FILES',\n];\n\n/** A rollout hint for the copy-paste snippet: recommend the narrowest gradual mode the rule supports. */\nfunction rolloutTip(schema: Record<string, FieldDef>): string {\n    const modes = schema['mode']?.enumValues ?? [];\n    const recommended = GRADUAL_MODE_PREFERENCE.find((m: string) => modes.includes(m));\n    if (!recommended) return '';\n    const optOut = modes.includes('OFF') ? ' Set \"mode\": \"OFF\" to opt out entirely.' : '';\n    return (\n        `\\n\\n💡 Recommended: start with \"mode\": \"${recommended}\" — it enforces only on what you ` +\n        `actually change, so the rule rolls out gradually (existing code stays grandfathered until ` +\n        `you next touch that project/file/method).${optOut}`\n    );\n}\n\nfunction missingRuleSnippet(ruleName: string, schema: Record<string, FieldDef>): string {\n    // Only required fields go in the copy-paste entry. Optional fields (e.g. the\n    // universal escape hatches ignoreRuleWhileOnBranch / ignoreModifiedUntilEpoch)\n    // are listed separately so the snippet doesn't over-state what's mandatory.\n    const fields = Object.keys(schema);\n    const required = fields.filter(f => !schema[f].optional);\n    const optional = fields.filter(f => schema[f].optional);\n\n    const requiredLines = required.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n    const section = sectionForRule(ruleName);\n    let out =\n        `[${ruleName}] Not configured in webpieces.config.json. Add this entry to the \"${section}\" section\\n` +\n        `(choose values appropriate for your project):\\n\\n` +\n        `  \"${ruleName}\": {\\n${requiredLines.join(',\\n')}\\n  }`;\n\n    if (optional.length > 0) {\n        const optionalLines = optional.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n        out +=\n            `\\n\\nOptional fields you may add to this rule (omit if not needed):\\n` +\n            `${optionalLines.join(',\\n')}`;\n    }\n    out += rolloutTip(schema);\n    return out;\n}\n\n// A config key under rules/hookGuards that the RUNNING validator has no schema for (and no rulesDir is\n// set to supply custom rules). Two very different causes, so the message leads with the common one:\n//   1. Version skew (most common — happens right after a dep bump): webpieces.config.json references a\n//      rule a NEWER @webpieces release added, but the installed guard is OLDER and doesn't know it yet.\n//      Fix = `pnpm install` (NOT deleting the key — the key is valid, the validator is just stale).\n//   2. A genuinely removed/renamed rule left behind, or a typo. Fix = remove the key.\n// Do NOT tell the AI to delete first — that destroys valid config in case 1 (the trap that made the AI\n// gut a working config instead of running `pnpm install`). The banner in load-config.ts spells out the\n// ordered \"run pnpm install, THEN edit only if it persists\" fix.\nfunction unknownRuleError(ruleName: string): string {\n    return (\n        `[${ruleName}] Unknown rule — the running @webpieces validator has no schema for it, and no ` +\n        `\"rulesDir\" is configured to supply custom rules. Most often this means your installed guard is a ` +\n        `release BEHIND this webpieces.config.json: run \\`pnpm install\\` first (see the fix steps below) so ` +\n        `the validator learns \"${ruleName}\". Only if it is STILL unknown after a fresh install is it a ` +\n        `removed/renamed rule or a typo — then remove the \"${ruleName}\" key from webpieces.config.json.`\n    );\n}\n\n// Fields we DELETED from a rule's schema, keyed by \"<rule>.<field>\". The generic unknown-field error\n// (\"Unknown field ... Valid fields: [...]\") is correct but doesn't say WHY the field vanished, so an AI\n// might re-add it. These hints explain the removal so the only action left is to delete the key.\nconst RETIRED_FIELD_HINTS: Record<string, string> = {\n    'runtime-architecture.servicePaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json (apiRelations + project roles). Delete it.',\n    'runtime-architecture.apiProjectPaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json, so there is NO list of api libs to maintain. Delete it (do not ' +\n        'enumerate api libs and do not replace it with a glob).',\n};\n\n// webpieces-disable no-any-unknown -- rawRules values are opaque JSON; each field is validated individually\nexport function validateWebpiecesConfig(\n    rawRules: Record<string, Record<string, unknown>>,\n    hasCustomRulesDir: boolean = false,\n): string[] {\n    const errors: string[] = [];\n\n    // Check field-level correctness for rules that are present\n    for (const [ruleName, entry] of Object.entries(rawRules)) {\n        const schema = RULE_SCHEMAS[ruleName];\n        if (!schema) {\n            // No built-in schema. With no rulesDir there are no custom rules, so this key is a\n            // dead/typo'd entry — tell the AI to remove it (a removed rule like no-shell-substitution\n            // lingers here otherwise). With a rulesDir it may be a legitimate custom rule → skip.\n            if (!hasCustomRulesDir) errors.push(unknownRuleError(ruleName));\n            continue;\n        }\n        for (const [key, value] of Object.entries(entry)) {\n            const fieldDef = schema[key];\n            if (!fieldDef) {\n                const retiredHint = RETIRED_FIELD_HINTS[`${ruleName}.${key}`];\n                const suffix = retiredHint ? ` ${retiredHint}` : '';\n                errors.push(`[${ruleName}] Unknown field \"${key}\". Valid fields: [${Object.keys(schema).join(', ')}].${suffix}`);\n                continue;\n            }\n            if (fieldDef.type === 'string[]') {\n                if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))\n                    errors.push(`[${ruleName}] \"${key}\" must be string[], got ${typeof value}.`);\n            } else if (typeof value !== fieldDef.type) {\n                errors.push(`[${ruleName}] \"${key}\" must be ${fieldDef.type}, got ${typeof value}.`);\n            } else if (fieldDef.enumValues && !fieldDef.enumValues.includes(value as string)) {\n                errors.push(`[${ruleName}] \"${key}\" = \"${value}\" is not valid. Must be one of: ${fieldDef.enumValues.join(', ')}.`);\n            }\n        }\n        // Required fields must actually be present. Until now the loop above only checked\n        // fields that WERE present, so an entry like `{}` (or one missing `mode` /\n        // `ignoreModifiedUntilEpoch`) slipped through. Every non-optional schema field is mandatory.\n        for (const [key, fieldDef] of Object.entries(schema)) {\n            if (!fieldDef.optional && !(key in entry)) {\n                errors.push(`[${ruleName}] Missing required field \"${key}\". Add ${key}: ${valueHint(fieldDef, key)}.`);\n            }\n        }\n    }\n\n    // Every built-in rule must be explicitly configured — no silent defaults.\n    // When a new rule is added to the framework, this check surfaces it immediately\n    // with a ready-to-copy snippet so AI can configure it in one pass.\n    for (const [ruleName, schema] of Object.entries(RULE_SCHEMAS)) {\n        if (!(ruleName in rawRules)) {\n            errors.push(missingRuleSnippet(ruleName, schema));\n        }\n    }\n\n    return errors;\n}\n\nconst PR_GATE_MODES = ['ON', 'OFF'] as const;\n// Optional — omitted means DETECT. Kept inline (like prGateExample) to avoid a load-config ↔\n// pr-gate-config import cycle; the canonical list + semantics live in pr-gate-config.ts.\nconst PR_GATE_MERGE_MODES = ['AUTO', 'NONE'] as const;\n\n// Spelled out because the choice is a POLICY decision with a consequence the chooser cannot see:\n// only the AUTO path can put the compact risk/flags body in main's history, because a UI merge is\n// limited to the repo's squash_merge_commit_title/message settings and no setting produces it.\nconst MERGE_MODE_HELP = (\n        `Must be one of: ${PR_GATE_MERGE_MODES.join(', ')}.\\n` +\n        `  \"AUTO\" — wp-finish-upsert-pr lands the PR: it squash-merges when mergeable, else enables\\n` +\n        `           GitHub auto-merge, both with an explicit --subject/--body-file so main's history\\n` +\n        `           gets the PR title + the compact risk/flags body. Needs allow_auto_merge on the repo\\n` +\n        `           (gh api repos/{owner}/{repo} --jq .allow_auto_merge).\\n` +\n        `  \"NONE\" — wp-finish-upsert-pr only opens/updates the PR; a human merges it. The compact body\\n` +\n        `           is then impossible, so set the repo's squash_merge_commit_title to PR_TITLE or\\n` +\n        `           commits land as the internal \"Squash merge of <branch>\" subject.`\n);\n\n// Copy-paste example for the top-level `pr-gate` block (sibling of `rules`). Kept inline rather\n// than imported from pr-gate-config.ts to avoid a load-config ↔ pr-gate-config import cycle.\nfunction prGateExample(): string {\n    return (\n        `  \"pr-gate\": {\\n` +\n        `    \"mode\": \"ON\",\\n` +\n        `    \"buildCommand\": \"<command CI runs to validate a PR, e.g. pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)>\",\\n` +\n        `    \"gates\": [\\n` +\n        `      { \"name\": \"API Changed\", \"patterns\": [\"libraries/apis/**\", \"**/*Api.ts\"], \"warningColor\": \"yellow\" }\\n` +\n        `    ]\\n` +\n        `  }`\n    );\n}\n\n// webpieces-disable no-any-unknown -- one gate entry from opaque consumer JSON, validated field-by-field\nfunction validateGate(gate: unknown, index: number): string[] {\n    if (typeof gate !== 'object' || gate === null) {\n        return [`[pr-gate] gates[${index}] must be an object { name, patterns, warningColor, disabled? }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque gate object from consumer JSON\n    const g = gate as Record<string, unknown>;\n    const errors: string[] = [];\n    if (typeof g['name'] !== 'string') errors.push(`[pr-gate] gates[${index}].name must be a string.`);\n    if (!Array.isArray(g['patterns']) || !g['patterns'].every(p => typeof p === 'string'))\n        errors.push(`[pr-gate] gates[${index}].patterns must be string[].`);\n    if (g['warningColor'] === undefined)\n        errors.push(`[pr-gate] gates[${index}].warningColor is required — set it to \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    else if (g['warningColor'] !== 'yellow' && g['warningColor'] !== 'red')\n        errors.push(`[pr-gate] gates[${index}].warningColor must be \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    if (g['disabled'] !== undefined && typeof g['disabled'] !== 'boolean')\n        errors.push(`[pr-gate] gates[${index}].disabled must be a boolean (example/inactive gate kept in the file).`);\n    return errors;\n}\n\n// One `checklists[]` entry, validated field-by-field (mirrors validateGate + validateMatchRule). When\n// `repoRoot` is supplied, each doc path must EXIST — a checklist pointing at a deleted doc is otherwise\n// a silent no-op, which is exactly the failure mode this whole feature exists to prevent.\n// webpieces-disable no-any-unknown -- one checklist entry from opaque consumer JSON, validated field-by-field\n// webpieces-disable no-function-outside-class -- module-level config validator, matches validateGate/validateMatchRule\nfunction validateChecklist(entry: unknown, index: number, repoRoot?: string): string[] {\n    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {\n        return [`[pr-gate] checklists[${index}] must be an object { id, title, patterns, contentPatterns, docs, severity, blockMessage, disabled? }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque checklist entry from consumer JSON\n    const c = entry as Record<string, unknown>;\n    const label = typeof c['id'] === 'string' && c['id'] !== '' ? `\"${c['id'] as string}\"` : `checklists[${index}]`;\n    const errors: string[] = [];\n\n    if (typeof c['id'] !== 'string' || c['id'].trim() === '')\n        errors.push(`[pr-gate] checklists[${index}].id must be a non-empty string (it is the key echoed in review.json).`);\n    if (typeof c['title'] !== 'string' || c['title'].trim() === '')\n        errors.push(`[pr-gate] ${label}.title must be a non-empty string (the dashboard label).`);\n\n    if (c['patterns'] !== undefined && !isStringArray(c['patterns']))\n        errors.push(`[pr-gate] ${label}.patterns must be a string[] of path globs (omit or [] to match any changed file).`);\n    if (c['contentPatterns'] !== undefined && !isStringArray(c['contentPatterns'])) {\n        errors.push(`[pr-gate] ${label}.contentPatterns must be a string[] of regexes (omit or [] for a path-only trigger).`);\n    } else if (isStringArray(c['contentPatterns'])) {\n        c['contentPatterns'].forEach((p: string, pi: number): void => {\n            const rxErr = regexError(p);\n            if (rxErr) errors.push(`[pr-gate] ${label}.contentPatterns[${pi}] is not a valid regex: ${rxErr}`);\n        });\n    }\n\n    if (!isStringArray(c['docs']) || c['docs'].length === 0) {\n        errors.push(`[pr-gate] ${label}.docs must be a non-empty string[] of repo-relative doc paths the AI must read.`);\n    } else if (repoRoot !== undefined) {\n        c['docs'].forEach((doc: string): void => {\n            if (!fs.existsSync(path.join(repoRoot, doc)))\n                errors.push(`[pr-gate] ${label}.docs references \"${doc}\", which does not exist — a checklist pointing at a missing doc silently never fires.`);\n        });\n    }\n\n    if (typeof c['severity'] !== 'string' || !CHECKLIST_SEVERITIES.includes(c['severity'] as string))\n        errors.push(`[pr-gate] ${label}.severity must be one of: ${CHECKLIST_SEVERITIES.join(', ')}.`);\n    if (c['severity'] === CHECKLIST_BLOCK && (typeof c['blockMessage'] !== 'string' || c['blockMessage'].trim() === ''))\n        errors.push(`[pr-gate] ${label}.blockMessage is required for a ${CHECKLIST_BLOCK} checklist — it is the wording shown when the PR is refused.`);\n    if (c['blockMessage'] !== undefined && typeof c['blockMessage'] !== 'string')\n        errors.push(`[pr-gate] ${label}.blockMessage must be a string.`);\n    if (c['disabled'] !== undefined && typeof c['disabled'] !== 'boolean')\n        errors.push(`[pr-gate] ${label}.disabled must be a boolean (example/inactive checklist kept in the file).`);\n    if (c['subagent'] !== undefined && typeof c['subagent'] !== 'string')\n        errors.push(`[pr-gate] ${label}.subagent must be a string (the expected reviewer agentType, e.g. \"morpheus-reviewer\"; omit for no provenance requirement).`);\n\n    return errors;\n}\n\n/**\n * Validate the top-level `pr-gate` section. It is REQUIRED (a client that opts out sets mode \"OFF\").\n * `buildCommand` is required unless mode is \"OFF\". Returns human-readable, copy-paste-friendly errors\n * — never throws. The pr-gate block lives outside the FieldDef-driven `rules` schema because its\n * nested `gates`/`checklists` arrays can't be expressed there, so they get structural validation here.\n * `repoRoot` (when known) lets the `checklists[].docs` existence check run.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validatePrGateSection(section: unknown, repoRoot?: string): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[pr-gate] Not configured in webpieces.config.json. Add this block under the \"commands\" ` +\n            `section (set \"mode\": \"OFF\" to opt out):\\n\\n${prGateExample()}`,\n        ];\n    }\n    if (typeof section !== 'object' || Array.isArray(section)) {\n        return [`[pr-gate] Must be an object. Example:\\n\\n${prGateExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque pr-gate section from consumer JSON\n    const s = section as Record<string, unknown>;\n    const errors: string[] = [];\n\n    if (!('mode' in s)) {\n        errors.push(`[pr-gate] Missing required field \"mode\". Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    } else if (typeof s['mode'] !== 'string' || !PR_GATE_MODES.includes(s['mode'] as typeof PR_GATE_MODES[number])) {\n        errors.push(`[pr-gate] \"mode\" = \"${String(s['mode'])}\" is not valid. Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    }\n\n    // buildCommand and mergeMode are both required whenever the gate is active (mode !== OFF). There\n    // is deliberately NO default for mergeMode: whether the tooling may land your PRs is a policy\n    // decision, and either guess is wrong for somebody.\n    if (s['mode'] !== 'OFF') {\n        const cmd = s['buildCommand'];\n        if (typeof cmd !== 'string' || cmd.trim() === '') {\n            errors.push(\n                `[pr-gate] Missing required field \"buildCommand\" — the command CI runs to validate a PR. ` +\n                `Add e.g. \"buildCommand\": \"pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)\".`,\n            );\n        }\n        const mm = s['mergeMode'];\n        if (!('mergeMode' in s)) {\n            errors.push(`[pr-gate] Missing required field \"mergeMode\". ${MERGE_MODE_HELP}`);\n        } else if (typeof mm !== 'string' || !PR_GATE_MERGE_MODES.includes(mm as typeof PR_GATE_MERGE_MODES[number])) {\n            errors.push(`[pr-gate] \"mergeMode\" = \"${String(mm)}\" is not valid. ${MERGE_MODE_HELP}`);\n        }\n    }\n\n    if ('gates' in s) {\n        const gates = s['gates'];\n        if (!Array.isArray(gates)) {\n            errors.push(`[pr-gate] \"gates\" must be an array of { name, patterns, warningColor, disabled? }.`);\n        } else {\n            for (let i = 0; i < gates.length; i += 1) {\n                errors.push(...validateGate(gates[i], i));\n            }\n        }\n    }\n\n    // Optional extension point: diff-triggered company review checklists. Absent ⇒ no validation and no\n    // behavior change. Present ⇒ every entry validated field-by-field, ids unique across the array.\n    if ('checklists' in s) errors.push(...validateChecklists(s['checklists'], repoRoot));\n\n    // Optional server-token salt. Absent ⇒ no token minted, CI enforcement is a no-op. Present ⇒ must be\n    // a non-empty string (an empty salt would mint a token anyone can forge from a known-empty secret).\n    if ('gateSalt' in s) {\n        const salt = s['gateSalt'];\n        if (typeof salt !== 'string' || salt.trim() === '') {\n            errors.push(`[pr-gate] \"gateSalt\" must be a non-empty string — it is the shared secret the gate token is HMAC'd with. Omit the key entirely to disable server-side token enforcement.`);\n        }\n    }\n\n    return errors;\n}\n\n// The `checklists` array of a pr-gate section: each entry validated field-by-field, ids unique.\n// Exported so the isolated validate-checklist-docs target (checklist-docs-validator.ts) reuses it.\n// webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed below\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validateChecklists(value: unknown, repoRoot?: string): string[] {\n    if (!Array.isArray(value)) {\n        return [`[pr-gate] \"checklists\" must be an array of { id, title, patterns, contentPatterns, docs, severity, blockMessage, disabled? }.`];\n    }\n    const errors: string[] = [];\n    const seenIds = new Set<string>();\n    for (let i = 0; i < value.length; i += 1) {\n        errors.push(...validateChecklist(value[i], i, repoRoot));\n        // webpieces-disable no-any-unknown -- reading the id off an opaque entry only to dedupe\n        const id = (value[i] as Record<string, unknown> | null)?.['id'];\n        if (typeof id === 'string' && id !== '') {\n            if (seenIds.has(id)) errors.push(`[pr-gate] duplicate checklist id \"${id}\" — each checklists[].id must be unique.`);\n            seenIds.add(id);\n        }\n    }\n    return errors;\n}\n\nfunction excludePathsExample(): string {\n    return '\"excludePaths\": {\\n' +\n        '    \"rules\":  [\"repositories/**\"],\\n' +\n        '    \"guards\": []\\n' +\n        '  }';\n}\n\n// One of the two excludePaths lists: required, must be a string[] (may be empty).\n// webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed here\nfunction validateExcludeList(value: unknown, key: string): string[] {\n    if (!(Array.isArray(value) && value.every(p => typeof p === 'string'))) {\n        return [`[excludePaths] \"${key}\" must be a string[] of glob paths (use [] for none).`];\n    }\n    return [];\n}\n\n/**\n * Validate the REQUIRED top-level `excludePaths` block: two independent glob lists (`rules`,\n * `guards`) that suppress hook enforcement per file path. Required so every client upgrading is\n * forced to declare it (as [] to keep today's behavior, or with real paths). Returns copy-paste\n * friendly errors and never throws — same contract as validatePrGateSection.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateExcludePaths(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[excludePaths] Not configured in webpieces.config.json. Add this REQUIRED block ` +\n            `(use empty arrays to keep enforcing everywhere):\\n\\n  ${excludePathsExample()}`,\n        ];\n    }\n    if (typeof section !== 'object' || Array.isArray(section)) {\n        return [`[excludePaths] Must be an object with \"rules\" and \"guards\" string arrays. Example:\\n\\n  ${excludePathsExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque excludePaths section from consumer JSON\n    const s = section as Record<string, unknown>;\n    return [\n        ...validateExcludeList(s['rules'], 'rules'),\n        ...validateExcludeList(s['guards'], 'guards'),\n    ];\n}\n\n// ---------------------------------------------------------------------------\n// match-rules — a new top-level ARRAY section (parallel to pr-gate/excludePaths). Each entry is a\n// client-authored content guard (raw-regex patterns + message + scoping). Validated structurally here\n// the same way pr-gate's `gates` are, because an array of objects can't be expressed in FieldDef schema.\n// ---------------------------------------------------------------------------\n\nfunction matchRulesExample(): string {\n    return `\"match-rules\": ${JSON.stringify(DEFAULT_MATCH_RULES, null, 4)}`;\n}\n\n// webpieces-disable no-any-unknown -- generic type guard over an opaque JSON value\nfunction isStringArray(value: unknown): value is string[] {\n    return Array.isArray(value) && value.every(v => typeof v === 'string');\n}\n\n// Compile a pattern to validate it; returns the error message, or undefined when it compiles.\nfunction regexError(pattern: string): string | undefined {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Constructed only to validate the syntax; the object is intentionally discarded.\n        void new RegExp(pattern);\n        return undefined;\n    } catch (err: unknown) {\n        const error = toError(err);\n        return error.message;\n    }\n}\n\n// One entry of the match-rules array, validated field-by-field (see validateGate for the pattern).\n// webpieces-disable no-any-unknown -- one match-rule entry from opaque consumer JSON, validated field-by-field\nfunction validateMatchRule(entry: unknown, index: number): string[] {\n    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {\n        return [`[match-rules] entry[${index}] must be an object { name, patterns, mainMessage, mode, ignoreModifiedUntilEpoch, ... }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque match-rule entry from consumer JSON\n    const e = entry as Record<string, unknown>;\n    const label = typeof e['name'] === 'string' ? `\"${e['name']}\"` : `entry[${index}]`;\n    const errors: string[] = [];\n\n    if (typeof e['name'] !== 'string' || e['name'].trim() === '')\n        errors.push(`[match-rules] entry[${index}].name must be a non-empty string (it is the disable token and report label).`);\n\n    if (!isStringArray(e['patterns']) || e['patterns'].length === 0) {\n        errors.push(`[match-rules] ${label}.patterns must be a non-empty string[] of regexes.`);\n    } else {\n        e['patterns'].forEach((p: string, pi: number) => {\n            const rxErr = regexError(p);\n            if (rxErr) errors.push(`[match-rules] ${label}.patterns[${pi}] is not a valid regex: ${rxErr}`);\n        });\n    }\n\n    if (typeof e['mainMessage'] !== 'string' || e['mainMessage'].trim() === '')\n        errors.push(`[match-rules] ${label}.mainMessage must be a non-empty string.`);\n\n    if (typeof e['mode'] !== 'string' || !MODIFIED_CODE_MODES.includes(e['mode'] as typeof MODIFIED_CODE_MODES[number]))\n        errors.push(`[match-rules] ${label}.mode must be one of: ${MODIFIED_CODE_MODES.join(', ')}.`);\n\n    if (typeof e['ignoreModifiedUntilEpoch'] !== 'number')\n        errors.push(`[match-rules] ${label}.ignoreModifiedUntilEpoch must be a number (0 = active; future unix-epoch seconds = temporarily off).`);\n\n    if (e['options'] !== undefined && !isStringArray(e['options']))\n        errors.push(`[match-rules] ${label}.options must be a string[] (omit if not needed).`);\n    if (e['allowedPaths'] !== undefined && !isStringArray(e['allowedPaths']))\n        errors.push(`[match-rules] ${label}.allowedPaths must be a string[] of globs (omit if not needed).`);\n    if (e['disableAllowed'] !== undefined && typeof e['disableAllowed'] !== 'boolean')\n        errors.push(`[match-rules] ${label}.disableAllowed must be a boolean.`);\n    if (e['ignoreRuleWhileOnBranch'] !== undefined && typeof e['ignoreRuleWhileOnBranch'] !== 'string')\n        errors.push(`[match-rules] ${label}.ignoreRuleWhileOnBranch must be a string.`);\n\n    return errors;\n}\n\n/**\n * Validate the REQUIRED top-level `match-rules` array (client-authored content guards). MISSING →\n * one error printing the ready-to-paste `no-fetch` example (add at least this; more can follow).\n * Present-but-`[]` → allowed (a conscious opt-out, matching pr-gate mode:OFF / excludePaths []).\n * Otherwise every entry is validated field-by-field (each regex compile-checked) plus name\n * uniqueness. Copy-paste-friendly errors; never throws — same contract as validatePrGateSection.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateMatchRulesSection(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[match-rules] Not configured in webpieces.config.json. Add this REQUIRED top-level array — ` +\n            `seed it with the no-fetch guard below (you can add more entries: no-moment, no-lodash-chain, …):\\n\\n${matchRulesExample()}`,\n        ];\n    }\n    if (!Array.isArray(section)) {\n        return [`[match-rules] Must be an array of content-guard objects. Example:\\n\\n${matchRulesExample()}`];\n    }\n\n    const errors: string[] = [];\n    const seen = new Set<string>();\n    for (let i = 0; i < section.length; i += 1) {\n        errors.push(...validateMatchRule(section[i], i));\n        // webpieces-disable no-any-unknown -- reading the name off an opaque entry only to dedupe\n        const name = (section[i] as Record<string, unknown> | null)?.['name'];\n        if (typeof name === 'string') {\n            if (seen.has(name)) errors.push(`[match-rules] duplicate entry name \"${name}\" — each match-rule name must be unique.`);\n            seen.add(name);\n        }\n    }\n    return errors;\n}\n\n/**\n * Enforce that each built-in lives in its correct section: code rules under `rules`, bash guards\n * under `hookGuards`. A guard left in `rules` (or a rule placed in `hookGuards`) is reported with a\n * \"move it\" message so the split stays clean. Unknown/custom names are ignored (they may be custom\n * rules from rulesDir). Presence (\"every built-in must be configured\") is checked separately by\n * validateWebpiecesConfig against the merged map.\n */\n// webpieces-disable no-any-unknown -- section maps are opaque consumer JSON\nexport function validateSectionPlacement(\n    rulesSection: Record<string, Record<string, unknown>>,\n    hookGuardsSection: Record<string, Record<string, unknown>>,\n): string[] {\n    const errors: string[] = [];\n    for (const name of Object.keys(rulesSection)) {\n        if (isHookGuard(name)) {\n            errors.push(\n                `[${name}] is a hook guard and belongs in the \"hookGuards\" section, not \"rules\". ` +\n                `Move it (or run \\`wp-install-ai-hooks --sync\\` to migrate automatically).`,\n            );\n        }\n    }\n    for (const name of Object.keys(hookGuardsSection)) {\n        // Only flag KNOWN code rules misplaced into hookGuards; unknown names may be custom rules.\n        if (!isHookGuard(name) && RULE_SCHEMAS[name]) {\n            errors.push(\n                `[${name}] is a code rule and belongs in the \"rules\" section, not \"hookGuards\". ` +\n                `Move it (or run \\`wp-install-ai-hooks --sync\\` to migrate automatically).`,\n            );\n        }\n    }\n    return errors;\n}\n\n/**\n * Validate the `commands` section: its `pr-gate` block (delegated to validatePrGateSection) plus the\n * optional command-string fields. Also surfaces a migration error if a DEPRECATED top-level `pr-gate`\n * block is still present, telling the consumer to move it under `commands`.\n */\n// webpieces-disable no-any-unknown -- `commands`/`legacyPrGate` are opaque consumer JSON\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validateCommandsSection(commands: unknown, legacyPrGate: unknown, repoRoot?: string): string[] {\n    const errors: string[] = [];\n\n    if (legacyPrGate !== undefined) {\n        errors.push(\n            `[pr-gate] The top-level \"pr-gate\" block is deprecated. Move it under the \"commands\" ` +\n            `section as commands[\"pr-gate\"] (run \\`wp-install-ai-hooks --sync\\` to migrate automatically).`,\n        );\n    }\n\n    if (commands !== undefined && (typeof commands !== 'object' || commands === null || Array.isArray(commands))) {\n        errors.push(`[commands] Must be an object { \"pr-gate\": {...}, \"upsertPr\": \"...\", \"mergeComplete\": \"...\" }.`);\n        return errors;\n    }\n\n    // webpieces-disable no-any-unknown -- narrowing the opaque commands section from consumer JSON\n    const c = (commands ?? {}) as Record<string, unknown>;\n\n    // pr-gate is required (set mode OFF to opt out). Prefer commands[\"pr-gate\"]; fall back to the\n    // legacy top-level block so an un-migrated file still validates its gate config.\n    errors.push(...validatePrGateSection(c['pr-gate'] ?? legacyPrGate, repoRoot));\n\n    for (const field of ['upsertPr', 'mergeComplete']) {\n        if (field in c && typeof c[field] !== 'string') {\n            errors.push(`[commands] \"${field}\" must be a string (the gated command to run).`);\n        }\n    }\n\n    return errors;\n}\n"]}

package/templates/webpieces-pr-gate.yml

@@ -0,0 +1,40 @@
+# Webpieces PR gate — the SERVER-SIDE half of the gate.
+#
+# WHY: locally, pr-creation-or-push-guard blocks `gh pr create` / manual `git push`, so wp-finish-upsert-pr
+# is the sole PR opener FOR HOOKED developers. The gap is UNHOOKED teammates who push + open a PR in the
+# GitHub web UI — nothing local stops them. This required check closes that gap: wp-finish-upsert-pr writes
+# HMAC(prGate.gateSalt, HEAD_sha) into the PR body, and this job recomputes it from the committed salt and
+# the PR head sha. A PR opened outside the gated flow carries no valid token and fails here.
+#
+# TO ENABLE (client repo):
+#   1. Copy this file to .github/workflows/webpieces-pr-gate.yml and commit it.
+#   2. Set a committed "gateSalt" under the pr-gate section of webpieces.config.json (any non-empty string).
+#   3. In branch-protection for `main`, mark the "webpieces-pr-gate" check REQUIRED. (Only a repo admin can
+#      do this — webpieces cannot set branch protection for you.)
+#
+# NOTE: the salt is committed/obscurity-grade — it stops unhooked teammates, but a determined reader can
+# read it and forge. It is deliberately not cryptographically sound; see RESPONSE-pr-gate-ci-enforcement.
+
+name: Webpieces PR Gate
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+permissions:
+  contents: read
+  pull-requests: read
+jobs:
+  webpieces-pr-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Verify webpieces gate token
+        env:
+          GH_TOKEN: ${{ github.token }}
+          WP_PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: pnpm wp-check-pr