@webpieces/rules-config 0.4.550 → 0.4.551

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/rules-config",
-  "version": "0.4.550",
+  "version": "0.4.551",
   "description": "Shared webpieces.config.json loader. Single source of truth for validation rule configuration consumed by @webpieces/ai-hook-rules, @webpieces/code-rules, and @webpieces/nx-webpieces-rules.",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/commands-section-validators.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateCommandsSection = validateCommandsSection;
+const config_error_banner_1 = require("./config-error-banner");
 const config_key_rules_1 = require("./config-key-rules");
 const retired_config_keys_1 = require("./retired-config-keys");
 const validate_config_1 = require("./validate-config");
@@ -26,7 +27,10 @@ const GUARD_HINT_FIELDS = ['prCreationOrPush', 'mergeInProgress'];
 function validateCommandsSection(commands, legacyPrGate, repoRoot) {
     const errors = [];
     if (legacyPrGate !== undefined) {
-        errors.push(`[pr-gate] The top-level "pr-gate" block is RETIRED. Move it under the "commands" ` +
+        errors.push(
+        // RETIRED_TOP_LEVEL_MARKER is imported, not re-typed: it is what the banner classifier keys off
+        // to call this DEFINITIVE (a shape no version of the validator accepts).
+        `[pr-gate] The top-level "pr-gate" ${config_error_banner_1.RETIRED_TOP_LEVEL_MARKER}. Move it under the "commands" ` +
             `section as commands["pr-gate"] (run \`pnpm wp-install-ai-hooks --sync\` to migrate automatically).`);
     }
     if (commands !== undefined && (typeof commands !== 'object' || commands === null || Array.isArray(commands))) {

package/src/commands-section-validators.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands-section-validators.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/commands-section-validators.ts"],"names":[],"mappings":";;AAyBA,0DA0BC;AAnDD,yDAAsD;AACtD,+DAA2D;AAC3D,uDAA0D;AAE1D,yGAAyG;AACzG,0GAA0G;AAC1G,2FAA2F;AAC3F,gEAAgE;AAEhE,uGAAuG;AACvG,kGAAkG;AAClG,MAAM,aAAa,GAAsB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AACnE,MAAM,iBAAiB,GAAsB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;AAErF;;;;;;;;GAQG;AACH,yFAAyF;AACzF,8GAA8G;AAC9G,SAAgB,uBAAuB,CAAC,QAAiB,EAAE,YAAqB,EAAE,QAAiB;IAC/F,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CACP,mFAAmF;YACnF,oGAAoG,CACvG,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3G,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,+FAA+F;IAC/F,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IAEtD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,wCAAkB,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,mCAAgB,EAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;IAEjE,iDAAiD;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,uCAAqB,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAEpD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,0FAA0F;AAC1F,8GAA8G;AAC9G,SAAS,kBAAkB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,oGAAoG,CAAC,CAAC;IAClH,CAAC;IACD,gGAAgG;IAChG,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,MAAM,GAAa,IAAA,mCAAgB,EAAC,CAAC,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACpC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACrF,MAAM,CAAC,IAAI,CAAC,0BAA0B,KAAK,0DAA0D,CAAC,CAAC;QAC3G,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["import { unknownKeyErrors } from './config-key-rules';\nimport { retiredKeyErrorsIn } from './retired-config-keys';\nimport { validatePrGateSection } from './validate-config';\n\n// The `commands` section of webpieces.config.json, plus the key-level rules every section shares: strict\n// unknown-key rejection and the `*Why` comment convention. Split out of validate-config.ts only for size,\n// exactly as pr-gate-section-validators.ts was; loadAndValidate still reaches this through\n// validateCommandsSection, which validate-config.ts re-exports.\n\n// Every key the `commands` section defines. Anything else is rejected — see unknownKeyErrors for why a\n// tolerated unknown key is the mechanism by which a stale config shape survives upgrades forever.\nconst COMMANDS_KEYS: readonly string[] = ['pr-gate', 'guardHints'];\nconst GUARD_HINT_FIELDS: readonly string[] = ['prCreationOrPush', 'mergeInProgress'];\n\n/**\n * Validate the `commands` section: its `pr-gate` block (delegated to validatePrGateSection), the\n * `guardHints` command strings, and strict rejection of everything else. Also surfaces a migration error if\n * a DEPRECATED top-level `pr-gate` block is still present, telling the consumer to move it under `commands`.\n *\n * There is deliberately no fallback from `commands[\"pr-gate\"]` to the top-level block: the top-level block\n * is a hard error above, so a config carrying it never loads, and a fallback for a shape that cannot load is\n * dead code that only makes the real shape ambiguous. See retired-config-keys.ts for the policy.\n */\n// webpieces-disable no-any-unknown -- `commands`/`legacyPrGate` are opaque consumer JSON\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validateCommandsSection(commands: unknown, legacyPrGate: unknown, repoRoot?: string): string[] {\n    const errors: string[] = [];\n\n    if (legacyPrGate !== undefined) {\n        errors.push(\n            `[pr-gate] The top-level \"pr-gate\" block is RETIRED. Move it under the \"commands\" ` +\n            `section as commands[\"pr-gate\"] (run \\`pnpm wp-install-ai-hooks --sync\\` to migrate automatically).`,\n        );\n    }\n\n    if (commands !== undefined && (typeof commands !== 'object' || commands === null || Array.isArray(commands))) {\n        errors.push(`[commands] Must be an object { \"pr-gate\": {...}, \"guardHints\": {...} }.`);\n        return errors;\n    }\n\n    // webpieces-disable no-any-unknown -- narrowing the opaque commands section from consumer JSON\n    const c = (commands ?? {}) as Record<string, unknown>;\n\n    errors.push(...retiredKeyErrorsIn(c, '[commands]'));\n    errors.push(...unknownKeyErrors(c, COMMANDS_KEYS, '[commands]'));\n\n    // pr-gate is required (set mode OFF to opt out).\n    errors.push(...validatePrGateSection(c['pr-gate'], repoRoot));\n    errors.push(...validateGuardHints(c['guardHints']));\n\n    return errors;\n}\n\n/**\n * The `commands.guardHints` sub-object: the command strings the bash guards print in their fix hints. Each\n * name binds to exactly one guard, so an unknown field here is a hint nothing will ever read.\n */\n// webpieces-disable no-any-unknown -- `hints` is opaque consumer JSON until narrowed here\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction validateGuardHints(hints: unknown): string[] {\n    if (hints === undefined) return [];\n    if (typeof hints !== 'object' || hints === null || Array.isArray(hints)) {\n        return [`[commands] \"guardHints\" must be an object { \"prCreationOrPush\": \"...\", \"mergeInProgress\": \"...\" }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque guardHints object from consumer JSON\n    const h = hints as Record<string, unknown>;\n    const errors: string[] = unknownKeyErrors(h, GUARD_HINT_FIELDS, '[commands.guardHints]');\n    for (const field of GUARD_HINT_FIELDS) {\n        if (field in h && (typeof h[field] !== 'string' || (h[field] as string).trim() === '')) {\n            errors.push(`[commands] \"guardHints.${field}\" must be a non-empty string (the gated command to run).`);\n        }\n    }\n    return errors;\n}\n"]}
+{"version":3,"file":"commands-section-validators.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/commands-section-validators.ts"],"names":[],"mappings":";;AA0BA,0DA4BC;AAtDD,+DAAiE;AACjE,yDAAsD;AACtD,+DAA2D;AAC3D,uDAA0D;AAE1D,yGAAyG;AACzG,0GAA0G;AAC1G,2FAA2F;AAC3F,gEAAgE;AAEhE,uGAAuG;AACvG,kGAAkG;AAClG,MAAM,aAAa,GAAsB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AACnE,MAAM,iBAAiB,GAAsB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;AAErF;;;;;;;;GAQG;AACH,yFAAyF;AACzF,8GAA8G;AAC9G,SAAgB,uBAAuB,CAAC,QAAiB,EAAE,YAAqB,EAAE,QAAiB;IAC/F,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI;QACP,gGAAgG;QAChG,yEAAyE;QACzE,qCAAqC,8CAAwB,iCAAiC;YAC9F,oGAAoG,CACvG,CAAC;IACN,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3G,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,+FAA+F;IAC/F,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IAEtD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,wCAAkB,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,mCAAgB,EAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;IAEjE,iDAAiD;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,uCAAqB,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAEpD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,0FAA0F;AAC1F,8GAA8G;AAC9G,SAAS,kBAAkB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,oGAAoG,CAAC,CAAC;IAClH,CAAC;IACD,gGAAgG;IAChG,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,MAAM,GAAa,IAAA,mCAAgB,EAAC,CAAC,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACpC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,KAAK,CAAY,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACrF,MAAM,CAAC,IAAI,CAAC,0BAA0B,KAAK,0DAA0D,CAAC,CAAC;QAC3G,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["import { RETIRED_TOP_LEVEL_MARKER } from './config-error-banner';\nimport { unknownKeyErrors } from './config-key-rules';\nimport { retiredKeyErrorsIn } from './retired-config-keys';\nimport { validatePrGateSection } from './validate-config';\n\n// The `commands` section of webpieces.config.json, plus the key-level rules every section shares: strict\n// unknown-key rejection and the `*Why` comment convention. Split out of validate-config.ts only for size,\n// exactly as pr-gate-section-validators.ts was; loadAndValidate still reaches this through\n// validateCommandsSection, which validate-config.ts re-exports.\n\n// Every key the `commands` section defines. Anything else is rejected — see unknownKeyErrors for why a\n// tolerated unknown key is the mechanism by which a stale config shape survives upgrades forever.\nconst COMMANDS_KEYS: readonly string[] = ['pr-gate', 'guardHints'];\nconst GUARD_HINT_FIELDS: readonly string[] = ['prCreationOrPush', 'mergeInProgress'];\n\n/**\n * Validate the `commands` section: its `pr-gate` block (delegated to validatePrGateSection), the\n * `guardHints` command strings, and strict rejection of everything else. Also surfaces a migration error if\n * a DEPRECATED top-level `pr-gate` block is still present, telling the consumer to move it under `commands`.\n *\n * There is deliberately no fallback from `commands[\"pr-gate\"]` to the top-level block: the top-level block\n * is a hard error above, so a config carrying it never loads, and a fallback for a shape that cannot load is\n * dead code that only makes the real shape ambiguous. See retired-config-keys.ts for the policy.\n */\n// webpieces-disable no-any-unknown -- `commands`/`legacyPrGate` are opaque consumer JSON\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validateCommandsSection(commands: unknown, legacyPrGate: unknown, repoRoot?: string): string[] {\n    const errors: string[] = [];\n\n    if (legacyPrGate !== undefined) {\n        errors.push(\n            // RETIRED_TOP_LEVEL_MARKER is imported, not re-typed: it is what the banner classifier keys off\n            // to call this DEFINITIVE (a shape no version of the validator accepts).\n            `[pr-gate] The top-level \"pr-gate\" ${RETIRED_TOP_LEVEL_MARKER}. Move it under the \"commands\" ` +\n            `section as commands[\"pr-gate\"] (run \\`pnpm wp-install-ai-hooks --sync\\` to migrate automatically).`,\n        );\n    }\n\n    if (commands !== undefined && (typeof commands !== 'object' || commands === null || Array.isArray(commands))) {\n        errors.push(`[commands] Must be an object { \"pr-gate\": {...}, \"guardHints\": {...} }.`);\n        return errors;\n    }\n\n    // webpieces-disable no-any-unknown -- narrowing the opaque commands section from consumer JSON\n    const c = (commands ?? {}) as Record<string, unknown>;\n\n    errors.push(...retiredKeyErrorsIn(c, '[commands]'));\n    errors.push(...unknownKeyErrors(c, COMMANDS_KEYS, '[commands]'));\n\n    // pr-gate is required (set mode OFF to opt out).\n    errors.push(...validatePrGateSection(c['pr-gate'], repoRoot));\n    errors.push(...validateGuardHints(c['guardHints']));\n\n    return errors;\n}\n\n/**\n * The `commands.guardHints` sub-object: the command strings the bash guards print in their fix hints. Each\n * name binds to exactly one guard, so an unknown field here is a hint nothing will ever read.\n */\n// webpieces-disable no-any-unknown -- `hints` is opaque consumer JSON until narrowed here\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction validateGuardHints(hints: unknown): string[] {\n    if (hints === undefined) return [];\n    if (typeof hints !== 'object' || hints === null || Array.isArray(hints)) {\n        return [`[commands] \"guardHints\" must be an object { \"prCreationOrPush\": \"...\", \"mergeInProgress\": \"...\" }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque guardHints object from consumer JSON\n    const h = hints as Record<string, unknown>;\n    const errors: string[] = unknownKeyErrors(h, GUARD_HINT_FIELDS, '[commands.guardHints]');\n    for (const field of GUARD_HINT_FIELDS) {\n        if (field in h && (typeof h[field] !== 'string' || (h[field] as string).trim() === '')) {\n            errors.push(`[commands] \"guardHints.${field}\" must be a non-empty string (the gated command to run).`);\n        }\n    }\n    return errors;\n}\n"]}

package/src/config-error-banner.d.ts

@@ -0,0 +1,68 @@
+/**
+ * THE validation-failure banner for webpieces.config.json.
+ *
+ * ## The invariant: there is exactly ONE cure
+ *
+ * Every error this banner carries came from VALIDATING webpieces.config.json, so the file is the
+ * defect and editing it is the fix. That is the whole instruction. Editing it is unconditionally
+ * allowed (L0 allowlist entry 2) even while it is invalid, so the cure is always reachable.
+ *
+ * The banner this replaces printed a FIXED four-step "FIX ORDER" that led with `pnpm install`, and each
+ * of those steps was wrong in its own way:
+ *
+ *   - `pnpm install` CANNOT help. The committed shim (templates/ai-hook.sh) runs the guard bin only
+ *     under `[ -x "$BIN" ] && [ -z "$DRIFT_PKG" ]`, and DRIFT_PKG is set by comparing every exact-pinned
+ *     `@webpieces/*` spec in the root package.json against the installed version (a `catalog:` spec is
+ *     resolved through pnpm-lock.yaml first). So the validator only ever runs when package.json and
+ *     node_modules ALREADY agree: nothing is out of date to install. It is not a first step, it is a
+ *     detour — and it is the detour that sent an agent down the wrong path in the incident that
+ *     produced this rewrite. The one gap: the drift check skips RANGE specs (`^`, `~`, `workspace:*`),
+ *     so a repo pinning with ranges is outside that guarantee. This repo pins exactly
+ *     (validate-versions-locked).
+ *   - "Retry your command" was not a fix step at all. Retrying is implied by the first line.
+ *   - A fourth step prescribed `pnpm wp-install-ai-hooks --sync` as a competing "edit the config"
+ *     command. It is not a cure; it is an optional BULK EDITOR that makes the same edit for you, and
+ *     migrate() rewrites the WHOLE file (it also appends every missing built-in as OFF and reformats),
+ *     so its diff is far larger than the error being fixed. It never leads.
+ *
+ * ## Why the negative instructions are here
+ *
+ * The failure mode was not a missing instruction, it was a generic ordered list — which is exactly how
+ * an agent picks the wrong step. So the banner states what NOT to do as plainly as what to do: do not
+ * run `pnpm install`, and do not delete an unknown key on sight (check first whether package.json pins
+ * an @webpieces OLDER than the config was written for — that anti-destructive warning is the one part
+ * of the old banner worth keeping, re-aimed from node_modules at the PIN).
+ *
+ * ## The one conditional line
+ *
+ * The bulk-editor mention appears ONLY when at least one error is something migrate() can actually
+ * perform (a retired key, a retired top-level `pr-gate` block, a misplaced rule/guard). Advertising it
+ * for errors it cannot fix is how the old step 4 misled. Those three markers are DEFINED HERE and
+ * IMPORTED by the message builders (retired-config-keys.ts, commands-section-validators.ts,
+ * validate-config.ts) rather than re-typed there, so the condition and the messages are literally the
+ * same string and cannot drift apart.
+ */
+/** `retiredKeyError` — every RETIRED_CONFIG_KEYS entry is one `migrate()` knows how to move/rename. */
+export declare const RETIRED_KEY_MARKER = "is a RETIRED webpieces.config.json key";
+/** `validateCommandsSection` — the retired TOP-LEVEL pr-gate block (a shape, so it has its own text). */
+export declare const RETIRED_TOP_LEVEL_MARKER = "block is RETIRED";
+/** `validateSectionPlacement` — a built-in configured under the wrong section. */
+export declare const SECTION_PLACEMENT_MARKER = "belongs in the";
+/**
+ * The errors `pnpm wp-install-ai-hooks --sync` can apply for you. NOT a classification of "how bad" an
+ * error is — every error here has the same cure — only of which ones the bulk editor covers.
+ */
+export declare const MIGRATOR_COVERED_MARKERS: readonly string[];
+/** How many of these errors the bulk editor could apply. 0 → the optional line is omitted entirely. */
+export declare function migratorCoveredCount(errors: readonly string[]): number;
+/**
+ * How many migrator-covered errors it takes before the bulk editor is even mentioned. TWO, because for
+ * ONE key the bullet already names a one-line edit and `--sync` would rewrite the whole file to make
+ * it — a strictly worse trade. The mention earns its place only on a sweep.
+ */
+export declare const BULK_EDITOR_MIN_ERRORS = 2;
+/**
+ * Assemble the banner: the errors, then the ONE cure, then the two warnings, then (only when it
+ * applies) the bulk-editor option. See the module comment for why nothing else belongs here.
+ */
+export declare function formatConfigErrorsBanner(errors: readonly string[]): string;

package/src/config-error-banner.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * THE validation-failure banner for webpieces.config.json.
+ *
+ * ## The invariant: there is exactly ONE cure
+ *
+ * Every error this banner carries came from VALIDATING webpieces.config.json, so the file is the
+ * defect and editing it is the fix. That is the whole instruction. Editing it is unconditionally
+ * allowed (L0 allowlist entry 2) even while it is invalid, so the cure is always reachable.
+ *
+ * The banner this replaces printed a FIXED four-step "FIX ORDER" that led with `pnpm install`, and each
+ * of those steps was wrong in its own way:
+ *
+ *   - `pnpm install` CANNOT help. The committed shim (templates/ai-hook.sh) runs the guard bin only
+ *     under `[ -x "$BIN" ] && [ -z "$DRIFT_PKG" ]`, and DRIFT_PKG is set by comparing every exact-pinned
+ *     `@webpieces/*` spec in the root package.json against the installed version (a `catalog:` spec is
+ *     resolved through pnpm-lock.yaml first). So the validator only ever runs when package.json and
+ *     node_modules ALREADY agree: nothing is out of date to install. It is not a first step, it is a
+ *     detour — and it is the detour that sent an agent down the wrong path in the incident that
+ *     produced this rewrite. The one gap: the drift check skips RANGE specs (`^`, `~`, `workspace:*`),
+ *     so a repo pinning with ranges is outside that guarantee. This repo pins exactly
+ *     (validate-versions-locked).
+ *   - "Retry your command" was not a fix step at all. Retrying is implied by the first line.
+ *   - A fourth step prescribed `pnpm wp-install-ai-hooks --sync` as a competing "edit the config"
+ *     command. It is not a cure; it is an optional BULK EDITOR that makes the same edit for you, and
+ *     migrate() rewrites the WHOLE file (it also appends every missing built-in as OFF and reformats),
+ *     so its diff is far larger than the error being fixed. It never leads.
+ *
+ * ## Why the negative instructions are here
+ *
+ * The failure mode was not a missing instruction, it was a generic ordered list — which is exactly how
+ * an agent picks the wrong step. So the banner states what NOT to do as plainly as what to do: do not
+ * run `pnpm install`, and do not delete an unknown key on sight (check first whether package.json pins
+ * an @webpieces OLDER than the config was written for — that anti-destructive warning is the one part
+ * of the old banner worth keeping, re-aimed from node_modules at the PIN).
+ *
+ * ## The one conditional line
+ *
+ * The bulk-editor mention appears ONLY when at least one error is something migrate() can actually
+ * perform (a retired key, a retired top-level `pr-gate` block, a misplaced rule/guard). Advertising it
+ * for errors it cannot fix is how the old step 4 misled. Those three markers are DEFINED HERE and
+ * IMPORTED by the message builders (retired-config-keys.ts, commands-section-validators.ts,
+ * validate-config.ts) rather than re-typed there, so the condition and the messages are literally the
+ * same string and cannot drift apart.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BULK_EDITOR_MIN_ERRORS = exports.MIGRATOR_COVERED_MARKERS = exports.SECTION_PLACEMENT_MARKER = exports.RETIRED_TOP_LEVEL_MARKER = exports.RETIRED_KEY_MARKER = void 0;
+exports.migratorCoveredCount = migratorCoveredCount;
+exports.formatConfigErrorsBanner = formatConfigErrorsBanner;
+/** `retiredKeyError` — every RETIRED_CONFIG_KEYS entry is one `migrate()` knows how to move/rename. */
+exports.RETIRED_KEY_MARKER = 'is a RETIRED webpieces.config.json key';
+/** `validateCommandsSection` — the retired TOP-LEVEL pr-gate block (a shape, so it has its own text). */
+exports.RETIRED_TOP_LEVEL_MARKER = 'block is RETIRED';
+/** `validateSectionPlacement` — a built-in configured under the wrong section. */
+exports.SECTION_PLACEMENT_MARKER = 'belongs in the';
+/**
+ * The errors `pnpm wp-install-ai-hooks --sync` can apply for you. NOT a classification of "how bad" an
+ * error is — every error here has the same cure — only of which ones the bulk editor covers.
+ */
+exports.MIGRATOR_COVERED_MARKERS = [
+    exports.RETIRED_KEY_MARKER,
+    exports.RETIRED_TOP_LEVEL_MARKER,
+    exports.SECTION_PLACEMENT_MARKER,
+];
+/** How many of these errors the bulk editor could apply. 0 → the optional line is omitted entirely. */
+// webpieces-disable no-function-outside-class -- pure predicate beside the marker data it reads, matching this package's validator style
+function migratorCoveredCount(errors) {
+    return errors.filter((e) => exports.MIGRATOR_COVERED_MARKERS.some((m) => e.includes(m))).length;
+}
+/**
+ * How many migrator-covered errors it takes before the bulk editor is even mentioned. TWO, because for
+ * ONE key the bullet already names a one-line edit and `--sync` would rewrite the whole file to make
+ * it — a strictly worse trade. The mention earns its place only on a sweep.
+ */
+exports.BULK_EDITOR_MIN_ERRORS = 2;
+// The optional bulk-editor line. Offered only on a sweep of errors the migrator actually performs, and
+// always with its cost stated, so nobody reaches for it to fix a single misplaced key.
+// webpieces-disable no-function-outside-class -- sibling string builder in this module
+function bulkEditorLine(errors) {
+    const covered = migratorCoveredCount(errors);
+    if (covered < exports.BULK_EDITOR_MIN_ERRORS)
+        return '';
+    return (`\n\nOPTIONAL (${covered} of the errors above are retired/misplaced keys): ` +
+        `\`pnpm wp-install-ai-hooks --sync\` applies all of them in one pass, and it is allowed through ` +
+        `the guard right now. It is a bulk EDITOR, not a different cure — and it rewrites the WHOLE ` +
+        `file (it also appends every missing built-in as "mode": "OFF" and reformats), so its diff is ` +
+        `much larger than the fix — which is why it is offered only for a sweep like this one, never ` +
+        `for a single key. Never run the BARE ` +
+        `\`wp-install-ai-hooks\` here — it goes on to wire the Claude Code hooks and PROMPTS for a ` +
+        `target, which hangs a non-interactive session.`);
+}
+/**
+ * Assemble the banner: the errors, then the ONE cure, then the two warnings, then (only when it
+ * applies) the bulk-editor option. See the module comment for why nothing else belongs here.
+ */
+// webpieces-disable no-function-outside-class -- sibling string builder in this module
+function formatConfigErrorsBanner(errors) {
+    return (
+    // No "then retry". Retrying is not a fix STEP — the old banner spent one of its four numbered
+    // steps on it, which is how "run the command again" came to look like a candidate cure.
+    `webpieces.config.json has ${errors.length} validation error(s) — fix ALL of them:\n\n` +
+        errors.map((e) => `  • ${e}`).join('\n') +
+        `\n\n👉 THE FIX: edit webpieces.config.json and apply every • above. Each bullet names the exact ` +
+        `change to make, and editing this file is ALWAYS allowed through the guard — including right ` +
+        `now, while it is invalid. There is no other step.\n` +
+        `  • Do NOT run \`pnpm install\` — it cannot help. The guards only run when package.json and ` +
+        `node_modules already agree, so there is nothing out of date to install. (Only exception: ` +
+        `@webpieces deps pinned with a RANGE — ^ / ~ / workspace:* — which drift detection skips. This ` +
+        `repo pins exact versions.)\n` +
+        `  • Do NOT delete a key just because it is reported unknown — that is how valid config gets ` +
+        `gutted. First check whether package.json pins an @webpieces OLDER than this config was written ` +
+        `for (a key copied from newer docs/branch); then the fix is to bump that pin, not to delete the ` +
+        `key.` +
+        bulkEditorLine(errors) +
+        `\n\nBackground: .webpieces/instruct-ai/webpieces.config-policy.md`);
+}
+//# sourceMappingURL=config-error-banner.js.map

package/src/config-error-banner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-error-banner.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/config-error-banner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;;;AAuBH,oDAIC;AAgCD,4DAoBC;AA7ED,uGAAuG;AAC1F,QAAA,kBAAkB,GAAG,wCAAwC,CAAC;AAE3E,yGAAyG;AAC5F,QAAA,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D,kFAAkF;AACrE,QAAA,wBAAwB,GAAG,gBAAgB,CAAC;AAEzD;;;GAGG;AACU,QAAA,wBAAwB,GAAsB;IACvD,0BAAkB;IAClB,gCAAwB;IACxB,gCAAwB;CAC3B,CAAC;AAEF,uGAAuG;AACvG,yIAAyI;AACzI,SAAgB,oBAAoB,CAAC,MAAyB;IAC1D,OAAO,MAAM,CAAC,MAAM,CAChB,CAAC,CAAS,EAAW,EAAE,CAAC,gCAAwB,CAAC,IAAI,CAAC,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC/F,CAAC,MAAM,CAAC;AACb,CAAC;AAED;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,CAAC,CAAC;AAExC,uGAAuG;AACvG,uFAAuF;AACvF,uFAAuF;AACvF,SAAS,cAAc,CAAC,MAAyB;IAC7C,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAG,8BAAsB;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO,CACH,iBAAiB,OAAO,oDAAoD;QAC5E,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,8FAA8F;QAC9F,uCAAuC;QACvC,4FAA4F;QAC5F,gDAAgD,CACnD,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,uFAAuF;AACvF,SAAgB,wBAAwB,CAAC,MAAyB;IAC9D,OAAO;IACH,8FAA8F;IAC9F,wFAAwF;IACxF,6BAA6B,MAAM,CAAC,MAAM,6CAA6C;QACvF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAS,EAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACxD,kGAAkG;QAClG,8FAA8F;QAC9F,qDAAqD;QACrD,8FAA8F;QAC9F,2FAA2F;QAC3F,gGAAgG;QAChG,8BAA8B;QAC9B,8FAA8F;QAC9F,iGAAiG;QACjG,iGAAiG;QACjG,MAAM;QACN,cAAc,CAAC,MAAM,CAAC;QACtB,mEAAmE,CACtE,CAAC;AACN,CAAC","sourcesContent":["/**\n * THE validation-failure banner for webpieces.config.json.\n *\n * ## The invariant: there is exactly ONE cure\n *\n * Every error this banner carries came from VALIDATING webpieces.config.json, so the file is the\n * defect and editing it is the fix. That is the whole instruction. Editing it is unconditionally\n * allowed (L0 allowlist entry 2) even while it is invalid, so the cure is always reachable.\n *\n * The banner this replaces printed a FIXED four-step \"FIX ORDER\" that led with `pnpm install`, and each\n * of those steps was wrong in its own way:\n *\n *   - `pnpm install` CANNOT help. The committed shim (templates/ai-hook.sh) runs the guard bin only\n *     under `[ -x \"$BIN\" ] && [ -z \"$DRIFT_PKG\" ]`, and DRIFT_PKG is set by comparing every exact-pinned\n *     `@webpieces/*` spec in the root package.json against the installed version (a `catalog:` spec is\n *     resolved through pnpm-lock.yaml first). So the validator only ever runs when package.json and\n *     node_modules ALREADY agree: nothing is out of date to install. It is not a first step, it is a\n *     detour — and it is the detour that sent an agent down the wrong path in the incident that\n *     produced this rewrite. The one gap: the drift check skips RANGE specs (`^`, `~`, `workspace:*`),\n *     so a repo pinning with ranges is outside that guarantee. This repo pins exactly\n *     (validate-versions-locked).\n *   - \"Retry your command\" was not a fix step at all. Retrying is implied by the first line.\n *   - A fourth step prescribed `pnpm wp-install-ai-hooks --sync` as a competing \"edit the config\"\n *     command. It is not a cure; it is an optional BULK EDITOR that makes the same edit for you, and\n *     migrate() rewrites the WHOLE file (it also appends every missing built-in as OFF and reformats),\n *     so its diff is far larger than the error being fixed. It never leads.\n *\n * ## Why the negative instructions are here\n *\n * The failure mode was not a missing instruction, it was a generic ordered list — which is exactly how\n * an agent picks the wrong step. So the banner states what NOT to do as plainly as what to do: do not\n * run `pnpm install`, and do not delete an unknown key on sight (check first whether package.json pins\n * an @webpieces OLDER than the config was written for — that anti-destructive warning is the one part\n * of the old banner worth keeping, re-aimed from node_modules at the PIN).\n *\n * ## The one conditional line\n *\n * The bulk-editor mention appears ONLY when at least one error is something migrate() can actually\n * perform (a retired key, a retired top-level `pr-gate` block, a misplaced rule/guard). Advertising it\n * for errors it cannot fix is how the old step 4 misled. Those three markers are DEFINED HERE and\n * IMPORTED by the message builders (retired-config-keys.ts, commands-section-validators.ts,\n * validate-config.ts) rather than re-typed there, so the condition and the messages are literally the\n * same string and cannot drift apart.\n */\n\n/** `retiredKeyError` — every RETIRED_CONFIG_KEYS entry is one `migrate()` knows how to move/rename. */\nexport const RETIRED_KEY_MARKER = 'is a RETIRED webpieces.config.json key';\n\n/** `validateCommandsSection` — the retired TOP-LEVEL pr-gate block (a shape, so it has its own text). */\nexport const RETIRED_TOP_LEVEL_MARKER = 'block is RETIRED';\n\n/** `validateSectionPlacement` — a built-in configured under the wrong section. */\nexport const SECTION_PLACEMENT_MARKER = 'belongs in the';\n\n/**\n * The errors `pnpm wp-install-ai-hooks --sync` can apply for you. NOT a classification of \"how bad\" an\n * error is — every error here has the same cure — only of which ones the bulk editor covers.\n */\nexport const MIGRATOR_COVERED_MARKERS: readonly string[] = [\n    RETIRED_KEY_MARKER,\n    RETIRED_TOP_LEVEL_MARKER,\n    SECTION_PLACEMENT_MARKER,\n];\n\n/** How many of these errors the bulk editor could apply. 0 → the optional line is omitted entirely. */\n// webpieces-disable no-function-outside-class -- pure predicate beside the marker data it reads, matching this package's validator style\nexport function migratorCoveredCount(errors: readonly string[]): number {\n    return errors.filter(\n        (e: string): boolean => MIGRATOR_COVERED_MARKERS.some((m: string): boolean => e.includes(m)),\n    ).length;\n}\n\n/**\n * How many migrator-covered errors it takes before the bulk editor is even mentioned. TWO, because for\n * ONE key the bullet already names a one-line edit and `--sync` would rewrite the whole file to make\n * it — a strictly worse trade. The mention earns its place only on a sweep.\n */\nexport const BULK_EDITOR_MIN_ERRORS = 2;\n\n// The optional bulk-editor line. Offered only on a sweep of errors the migrator actually performs, and\n// always with its cost stated, so nobody reaches for it to fix a single misplaced key.\n// webpieces-disable no-function-outside-class -- sibling string builder in this module\nfunction bulkEditorLine(errors: readonly string[]): string {\n    const covered = migratorCoveredCount(errors);\n    if (covered < BULK_EDITOR_MIN_ERRORS) return '';\n    return (\n        `\\n\\nOPTIONAL (${covered} of the errors above are retired/misplaced keys): ` +\n        `\\`pnpm wp-install-ai-hooks --sync\\` applies all of them in one pass, and it is allowed through ` +\n        `the guard right now. It is a bulk EDITOR, not a different cure — and it rewrites the WHOLE ` +\n        `file (it also appends every missing built-in as \"mode\": \"OFF\" and reformats), so its diff is ` +\n        `much larger than the fix — which is why it is offered only for a sweep like this one, never ` +\n        `for a single key. Never run the BARE ` +\n        `\\`wp-install-ai-hooks\\` here — it goes on to wire the Claude Code hooks and PROMPTS for a ` +\n        `target, which hangs a non-interactive session.`\n    );\n}\n\n/**\n * Assemble the banner: the errors, then the ONE cure, then the two warnings, then (only when it\n * applies) the bulk-editor option. See the module comment for why nothing else belongs here.\n */\n// webpieces-disable no-function-outside-class -- sibling string builder in this module\nexport function formatConfigErrorsBanner(errors: readonly string[]): string {\n    return (\n        // No \"then retry\". Retrying is not a fix STEP — the old banner spent one of its four numbered\n        // steps on it, which is how \"run the command again\" came to look like a candidate cure.\n        `webpieces.config.json has ${errors.length} validation error(s) — fix ALL of them:\\n\\n` +\n        errors.map((e: string): string => `  • ${e}`).join('\\n') +\n        `\\n\\n👉 THE FIX: edit webpieces.config.json and apply every • above. Each bullet names the exact ` +\n        `change to make, and editing this file is ALWAYS allowed through the guard — including right ` +\n        `now, while it is invalid. There is no other step.\\n` +\n        `  • Do NOT run \\`pnpm install\\` — it cannot help. The guards only run when package.json and ` +\n        `node_modules already agree, so there is nothing out of date to install. (Only exception: ` +\n        `@webpieces deps pinned with a RANGE — ^ / ~ / workspace:* — which drift detection skips. This ` +\n        `repo pins exact versions.)\\n` +\n        `  • Do NOT delete a key just because it is reported unknown — that is how valid config gets ` +\n        `gutted. First check whether package.json pins an @webpieces OLDER than this config was written ` +\n        `for (a key copied from newer docs/branch); then the fix is to bump that pin, not to delete the ` +\n        `key.` +\n        bulkEditorLine(errors) +\n        `\\n\\nBackground: .webpieces/instruct-ai/webpieces.config-policy.md`\n    );\n}\n"]}

package/src/index.d.ts

@@ -6,6 +6,7 @@ export { CliUsage, CliArgsCheck, CliArgs } from './cli-args';
 export { runMain } from './run-main';
 export { toError } from './to-error';
 export { loadAndValidate, LoadedConfig, ConfigLoader } from './load-config';
+export { formatConfigErrorsBanner, migratorCoveredCount, MIGRATOR_COVERED_MARKERS, RETIRED_KEY_MARKER, RETIRED_TOP_LEVEL_MARKER, SECTION_PLACEMENT_MARKER, } from './config-error-banner';
 export { findConfigFile, CONFIG_FILENAME, ConfigFile, ConfigParseAttempt, CONFIG_PARSE_ATTEMPTS, CONFIG_PARSE_RETRY_MILLIS } from './config-file';
 export { RepoRootFinder, INSTRUCT_AI_DIR, INSTRUCT_AI_LEAF } from './repo-root';
 export { DotWebpieces, dotWebpieces, GitDirs, WORKTREE_STATE_DIR } from './state-dir';

package/src/index.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateCommandsSection = exports.allRuleNames = exports.validateMatchRulesSection = exports.validateExcludePaths = exports.validateSectionPlacement = exports.validateChecklistsSection = exports.validatePrGateSection = exports.validateWebpiecesConfig = exports.TemplateWriter = exports.writeTemplate = exports.writeTemplateIfMissing = exports.loadTemplate = exports.defaultRulesDir = exports.defaultRules = exports.matchesAnyGlob = exports.isPathExcluded = exports.ExcludePaths = exports.DESIGN_METADATA_KEYS = exports.isDocumentDesign = exports.DocumentDesign = exports.RulesConfigDesign = exports.AtomicFile = exports.StateMigrationReport = exports.StateDirMigrator = exports.WORKTREE_STATE_DIR = exports.GitDirs = exports.dotWebpieces = exports.DotWebpieces = exports.INSTRUCT_AI_LEAF = exports.INSTRUCT_AI_DIR = exports.RepoRootFinder = exports.CONFIG_PARSE_RETRY_MILLIS = exports.CONFIG_PARSE_ATTEMPTS = exports.ConfigParseAttempt = exports.ConfigFile = exports.CONFIG_FILENAME = exports.findConfigFile = exports.ConfigLoader = exports.LoadedConfig = exports.loadAndValidate = exports.toError = exports.runMain = exports.CliArgs = exports.CliArgsCheck = exports.CliUsage = exports.CliExitError = exports.RuleFailError = exports.InformAiError = exports.ResolvedRuleConfig = exports.ResolvedConfig = void 0;
-exports.WP_START_UPDATE = exports.SyncFlowGuidance = exports.WebpiecesRulesConfig = exports.MERGE_EXPLANATION_FILE = exports.MERGE_IN_PROGRESS_FILE = exports.PR_REVIEW_DIR = exports.MERGE_INFO_DIR = exports.WEBPIECES_TMP_DIR = exports.hasDisable = exports.RULE_NAMES = exports.WEBPIECES_DISABLE = exports.AbstractRule = exports.ChangedFilesOptions = exports.DiffRange = exports.DiffScope = exports.isNewOrModified = exports.hasChangesInRange = exports.findNewMethodSignaturesInDiff = exports.getChangedLineNumbers = exports.getFileDiff = exports.getChangedFiles = exports.resolveBase = exports.detectBase = exports.getCurrentBranch = exports.shouldSkipRule = exports.FieldDef = exports.sectionForRule = exports.isHookGuard = exports.HOOK_GUARD_NAMES = exports.DEFAULT_MATCH_RULES = exports.renderMatchRuleMessage = exports.compileMatchRulePatterns = exports.isMatchRuleAllowedPath = exports.findMatchRuleViolations = exports.MatchRuleViolation = exports.MatchRuleConfig = exports.validateChecklistDocs = exports.retiredRuleFor = exports.retiredKeyErrorsIn = exports.retiredKeyError = exports.retiredEntry = exports.isRetiredKey = exports.RetiredConfigKey = exports.RETIRED_SCOPE_RULE = exports.RETIRED_SCOPE_KEY = exports.RETIRED_CONFIG_KEYS = exports.COMMENT_KEY_SUFFIX = exports.validateTopLevelKeys = exports.isCommentKey = exports.unknownKeyErrors = void 0;
-exports.THROW_CAUSE_MODES = exports.DIRECT_API_RESOLVER_MODES = exports.PRISMA_CONVERTER_MODES = exports.PRISMA_DTOS_MODES = exports.PROJECT_MODES = exports.MODIFIED_CODE_MODES = exports.INLINE_TYPE_MODES = exports.RETURN_TYPE_MODES = exports.FILE_LIMIT_MODES = exports.METHOD_LIMIT_MODES = exports.BaseRuleConfig = exports.ValidateEslintSyncConfig = exports.ValidateVersionsLockedConfig = exports.ValidatePackageJsonConfig = exports.ValidateNoArchitectureCyclesConfig = exports.ValidateArchitectureUnchangedConfig = exports.ValidateTsInSrcConfig = exports.NoJsFilesConfig = exports.DiGraphConfig = exports.NxWiringConfig = exports.RuntimeArchitectureConfig = exports.NoFileImportCyclesConfig = exports.RedirectHowToMergeMainConfig = exports.PrMergeGuardConfig = exports.MergeInProgressGuardConfig = exports.PrCreationOrPushGuardConfig = exports.BranchCreationGuardConfig = exports.RoleTagConfig = exports.FrameworkTagConfig = exports.InjectAnnotationNotNeededForConcreteClassConfig = exports.NoFunctionOutsideClassConfig = exports.NoProcessExitOutsideMainConfig = exports.NoCustomCssConfig = exports.NoSymbolDiTokensConfig = exports.AngularNoDirectApiInResolverConfig = exports.ThrowCauseRequiredConfig = exports.CatchErrorPatternConfig = exports.NoUnmanagedExceptionsConfig = exports.NoDestructureConfig = exports.PrismaConverterConfig = exports.PrismaValidateDtosConfig = exports.NoImplicitAnyConfig = exports.NoAnyUnknownConfig = exports.NoInlineTypeLiteralsConfig = exports.RequireReturnTypeConfig = exports.MaxFileLinesConfig = exports.MaxMethodLinesConfig = exports.WP_FINISH_UPSERT_PR = exports.WP_START_UPSERT_PR = exports.WP_FINISH_UPDATE = void 0;
-exports.ReviewerPaths = exports.ReviewerTranscript = exports.ReviewProvenance = exports.ReviewProvenanceService = exports.PROVENANCE_SKIPPED = exports.PROVENANCE_MISSING = exports.PROVENANCE_OK = exports.ProvenanceResult = exports.TranscriptScan = exports.EvidenceRequest = exports.ReviewerEvidence = exports.SubagentProvenanceService = exports.verifyGateToken = exports.extractGateToken = exports.gateTokenMarker = exports.computeGateToken = exports.GateTokenService = exports.ALL_DIFF_ONE_READ_LINES = exports.READ_TRUNCATION_LINES = exports.ContextEntry = exports.BriefedFile = exports.ReviewerBriefing = exports.ReviewerInstructionsService = exports.ChecklistInstructionsService = exports.ChecklistValidator = exports.formatFileList = exports.normalizeChecklistDoc = exports.toChecklist = exports.ChecklistDefinition = exports.MERGE_MODES = exports.MERGE_MODE_NONE = exports.MERGE_MODE_AUTO = exports.buildLandPrConfig = exports.buildPrGateConfig = exports.defaultLandPrConfig = exports.defaultPrGateConfig = exports.defaultGates = exports.ReviewContextEntry = exports.LandPrConfig = exports.PrGateConfig = exports.GateDefinition = exports.StaleMainBashGuardConfig = exports.MergedBranchBashGuardConfig = exports.ReadStaleGuardConfig = exports.FeatureBranchGuardConfig = exports.CLIENT_CREATION_SEVERITIES = exports.NoClientCreationOutsideServerOrClientConfig = exports.VALIDATE_TS_MODES = exports.STRUCTURAL_MODES = exports.ON_OFF_MODES = void 0;
-exports.MergedBranch = exports.squashRecoverySteps = exports.stampCleanMainSyncStatus = exports.computeMainSyncStatus = exports.finishedLock = exports.inProcessLock = exports.tryAcquireMainSyncLock = exports.isRefreshInProgress = exports.isLockStale = exports.writeMainSyncLock = exports.readMainSyncLock = exports.computeAllMainSyncStatuses = exports.writeMainSyncStatusFile = exports.writeMainSyncStatus = exports.readMainSyncStatusFile = exports.readMainSyncStatus = exports.mainSyncLockPath = exports.mainSyncStatusPath = exports.DEFAULT_HANG_TIMEOUT_MINUTES = exports.MainSyncStatusService = exports.MainSyncLock = exports.MAIN_SYNC_STATUS_VERSION = exports.PullRequestIndex = exports.MainSyncFileStore = exports.MainSyncStatusFile = exports.MainSyncStatus = exports.reviewJsonSchemaHint = exports.reviewJsonPath = exports.prDirFor = exports.loadReviewJson = exports.ReviewJsonService = exports.ChecklistReviewContext = exports.RequiredChecklist = exports.VERDICT_STATUSES = exports.VERDICT_RED = exports.VERDICT_YELLOW = exports.VERDICT_GREEN = exports.CK_BAD_FORMAT = exports.CK_MISSING = exports.CK_FAIL = exports.CK_OVERRIDDEN = exports.CK_WARN = exports.CK_PASS = exports.ChecklistVerdict = exports.ChecklistResult = exports.PrContext = exports.ReviewJson = exports.DEFAULT_RETENTION_DAYS = exports.ProvenanceWriteRequest = exports.OfferedContext = void 0;
-exports.DEFAULT_MERGE_COMPLETE_COMMAND = exports.DEFAULT_UPSERT_PR_COMMAND = exports.buildCommandsConfig = exports.CommandsConfig = exports.logBranchMutation = exports.branchMutationLogPath = exports.BranchMutationLog = exports.BranchMutationEvent = exports.WorktreeReaper = exports.WorktreeReapResult = exports.ReapedWorktree = exports.BranchReaper = exports.ReapResult = exports.ReapedBranch = exports.WorktreeService = exports.Worktree = exports.BRANCH_RETENTION_KEEP = exports.BRANCH_RETENTION_ARCHIVE_TAG = exports.BRANCH_RETENTION_DELETE = exports.BRANCH_RETENTIONS = exports.ARCHIVE_TAG_PREFIX = exports.ArchiveResult = exports.BranchArchiver = exports.PROMPTABLE_CLASSIFICATIONS = exports.CLASSIFICATION_DETACHED = exports.CLASSIFICATION_CURRENT = exports.CLASSIFICATION_LOCKED = exports.CLASSIFICATION_PRUNABLE = exports.CLASSIFICATION_IN_USE = exports.CLASSIFICATION_NEVER_PROPOSED = exports.CLASSIFICATION_CONTENT_IN_MAIN = exports.CLASSIFICATION_SUPERSEDED = exports.CLASSIFICATION_NO_COMMITS = exports.CLASSIFICATION_BACKUP_OF_LIVE = exports.CLASSIFICATION_BACKUP_OF_MERGED = exports.CLASSIFICATION_MERGED_PR = exports.CACHE_STALE_AFTER_MS = exports.CacheFreshness = exports.MergedBranchesService = exports.MergedBranchesCache = exports.DeletableWorktree = exports.DeletableBranch = void 0;
+exports.validatePrGateSection = exports.validateWebpiecesConfig = exports.TemplateWriter = exports.writeTemplate = exports.writeTemplateIfMissing = exports.loadTemplate = exports.defaultRulesDir = exports.defaultRules = exports.matchesAnyGlob = exports.isPathExcluded = exports.ExcludePaths = exports.DESIGN_METADATA_KEYS = exports.isDocumentDesign = exports.DocumentDesign = exports.RulesConfigDesign = exports.AtomicFile = exports.StateMigrationReport = exports.StateDirMigrator = exports.WORKTREE_STATE_DIR = exports.GitDirs = exports.dotWebpieces = exports.DotWebpieces = exports.INSTRUCT_AI_LEAF = exports.INSTRUCT_AI_DIR = exports.RepoRootFinder = exports.CONFIG_PARSE_RETRY_MILLIS = exports.CONFIG_PARSE_ATTEMPTS = exports.ConfigParseAttempt = exports.ConfigFile = exports.CONFIG_FILENAME = exports.findConfigFile = exports.SECTION_PLACEMENT_MARKER = exports.RETIRED_TOP_LEVEL_MARKER = exports.RETIRED_KEY_MARKER = exports.MIGRATOR_COVERED_MARKERS = exports.migratorCoveredCount = exports.formatConfigErrorsBanner = exports.ConfigLoader = exports.LoadedConfig = exports.loadAndValidate = exports.toError = exports.runMain = exports.CliArgs = exports.CliArgsCheck = exports.CliUsage = exports.CliExitError = exports.RuleFailError = exports.InformAiError = exports.ResolvedRuleConfig = exports.ResolvedConfig = void 0;
+exports.MERGE_INFO_DIR = exports.WEBPIECES_TMP_DIR = exports.hasDisable = exports.RULE_NAMES = exports.WEBPIECES_DISABLE = exports.AbstractRule = exports.ChangedFilesOptions = exports.DiffRange = exports.DiffScope = exports.isNewOrModified = exports.hasChangesInRange = exports.findNewMethodSignaturesInDiff = exports.getChangedLineNumbers = exports.getFileDiff = exports.getChangedFiles = exports.resolveBase = exports.detectBase = exports.getCurrentBranch = exports.shouldSkipRule = exports.FieldDef = exports.sectionForRule = exports.isHookGuard = exports.HOOK_GUARD_NAMES = exports.DEFAULT_MATCH_RULES = exports.renderMatchRuleMessage = exports.compileMatchRulePatterns = exports.isMatchRuleAllowedPath = exports.findMatchRuleViolations = exports.MatchRuleViolation = exports.MatchRuleConfig = exports.validateChecklistDocs = exports.retiredRuleFor = exports.retiredKeyErrorsIn = exports.retiredKeyError = exports.retiredEntry = exports.isRetiredKey = exports.RetiredConfigKey = exports.RETIRED_SCOPE_RULE = exports.RETIRED_SCOPE_KEY = exports.RETIRED_CONFIG_KEYS = exports.COMMENT_KEY_SUFFIX = exports.validateTopLevelKeys = exports.isCommentKey = exports.unknownKeyErrors = exports.validateCommandsSection = exports.allRuleNames = exports.validateMatchRulesSection = exports.validateExcludePaths = exports.validateSectionPlacement = exports.validateChecklistsSection = void 0;
+exports.INLINE_TYPE_MODES = exports.RETURN_TYPE_MODES = exports.FILE_LIMIT_MODES = exports.METHOD_LIMIT_MODES = exports.BaseRuleConfig = exports.ValidateEslintSyncConfig = exports.ValidateVersionsLockedConfig = exports.ValidatePackageJsonConfig = exports.ValidateNoArchitectureCyclesConfig = exports.ValidateArchitectureUnchangedConfig = exports.ValidateTsInSrcConfig = exports.NoJsFilesConfig = exports.DiGraphConfig = exports.NxWiringConfig = exports.RuntimeArchitectureConfig = exports.NoFileImportCyclesConfig = exports.RedirectHowToMergeMainConfig = exports.PrMergeGuardConfig = exports.MergeInProgressGuardConfig = exports.PrCreationOrPushGuardConfig = exports.BranchCreationGuardConfig = exports.RoleTagConfig = exports.FrameworkTagConfig = exports.InjectAnnotationNotNeededForConcreteClassConfig = exports.NoFunctionOutsideClassConfig = exports.NoProcessExitOutsideMainConfig = exports.NoCustomCssConfig = exports.NoSymbolDiTokensConfig = exports.AngularNoDirectApiInResolverConfig = exports.ThrowCauseRequiredConfig = exports.CatchErrorPatternConfig = exports.NoUnmanagedExceptionsConfig = exports.NoDestructureConfig = exports.PrismaConverterConfig = exports.PrismaValidateDtosConfig = exports.NoImplicitAnyConfig = exports.NoAnyUnknownConfig = exports.NoInlineTypeLiteralsConfig = exports.RequireReturnTypeConfig = exports.MaxFileLinesConfig = exports.MaxMethodLinesConfig = exports.WP_FINISH_UPSERT_PR = exports.WP_START_UPSERT_PR = exports.WP_FINISH_UPDATE = exports.WP_START_UPDATE = exports.SyncFlowGuidance = exports.WebpiecesRulesConfig = exports.MERGE_EXPLANATION_FILE = exports.MERGE_IN_PROGRESS_FILE = exports.PR_REVIEW_DIR = void 0;
+exports.PROVENANCE_OK = exports.ProvenanceResult = exports.TranscriptScan = exports.EvidenceRequest = exports.ReviewerEvidence = exports.SubagentProvenanceService = exports.verifyGateToken = exports.extractGateToken = exports.gateTokenMarker = exports.computeGateToken = exports.GateTokenService = exports.ALL_DIFF_ONE_READ_LINES = exports.READ_TRUNCATION_LINES = exports.ContextEntry = exports.BriefedFile = exports.ReviewerBriefing = exports.ReviewerInstructionsService = exports.ChecklistInstructionsService = exports.ChecklistValidator = exports.formatFileList = exports.normalizeChecklistDoc = exports.toChecklist = exports.ChecklistDefinition = exports.MERGE_MODES = exports.MERGE_MODE_NONE = exports.MERGE_MODE_AUTO = exports.buildLandPrConfig = exports.buildPrGateConfig = exports.defaultLandPrConfig = exports.defaultPrGateConfig = exports.defaultGates = exports.ReviewContextEntry = exports.LandPrConfig = exports.PrGateConfig = exports.GateDefinition = exports.StaleMainBashGuardConfig = exports.MergedBranchBashGuardConfig = exports.ReadStaleGuardConfig = exports.FeatureBranchGuardConfig = exports.CLIENT_CREATION_SEVERITIES = exports.NoClientCreationOutsideServerOrClientConfig = exports.VALIDATE_TS_MODES = exports.STRUCTURAL_MODES = exports.ON_OFF_MODES = exports.THROW_CAUSE_MODES = exports.DIRECT_API_RESOLVER_MODES = exports.PRISMA_CONVERTER_MODES = exports.PRISMA_DTOS_MODES = exports.PROJECT_MODES = exports.MODIFIED_CODE_MODES = void 0;
+exports.tryAcquireMainSyncLock = exports.isRefreshInProgress = exports.isLockStale = exports.writeMainSyncLock = exports.readMainSyncLock = exports.computeAllMainSyncStatuses = exports.writeMainSyncStatusFile = exports.writeMainSyncStatus = exports.readMainSyncStatusFile = exports.readMainSyncStatus = exports.mainSyncLockPath = exports.mainSyncStatusPath = exports.DEFAULT_HANG_TIMEOUT_MINUTES = exports.MainSyncStatusService = exports.MainSyncLock = exports.MAIN_SYNC_STATUS_VERSION = exports.PullRequestIndex = exports.MainSyncFileStore = exports.MainSyncStatusFile = exports.MainSyncStatus = exports.reviewJsonSchemaHint = exports.reviewJsonPath = exports.prDirFor = exports.loadReviewJson = exports.ReviewJsonService = exports.ChecklistReviewContext = exports.RequiredChecklist = exports.VERDICT_STATUSES = exports.VERDICT_RED = exports.VERDICT_YELLOW = exports.VERDICT_GREEN = exports.CK_BAD_FORMAT = exports.CK_MISSING = exports.CK_FAIL = exports.CK_OVERRIDDEN = exports.CK_WARN = exports.CK_PASS = exports.ChecklistVerdict = exports.ChecklistResult = exports.PrContext = exports.ReviewJson = exports.DEFAULT_RETENTION_DAYS = exports.ProvenanceWriteRequest = exports.OfferedContext = exports.ReviewerPaths = exports.ReviewerTranscript = exports.ReviewProvenance = exports.ReviewProvenanceService = exports.PROVENANCE_SKIPPED = exports.PROVENANCE_MISSING = void 0;
+exports.DEFAULT_MERGE_COMPLETE_COMMAND = exports.DEFAULT_UPSERT_PR_COMMAND = exports.buildCommandsConfig = exports.CommandsConfig = exports.logBranchMutation = exports.branchMutationLogPath = exports.BranchMutationLog = exports.BranchMutationEvent = exports.WorktreeReaper = exports.WorktreeReapResult = exports.ReapedWorktree = exports.BranchReaper = exports.ReapResult = exports.ReapedBranch = exports.WorktreeService = exports.Worktree = exports.BRANCH_RETENTION_KEEP = exports.BRANCH_RETENTION_ARCHIVE_TAG = exports.BRANCH_RETENTION_DELETE = exports.BRANCH_RETENTIONS = exports.ARCHIVE_TAG_PREFIX = exports.ArchiveResult = exports.BranchArchiver = exports.PROMPTABLE_CLASSIFICATIONS = exports.CLASSIFICATION_DETACHED = exports.CLASSIFICATION_CURRENT = exports.CLASSIFICATION_LOCKED = exports.CLASSIFICATION_PRUNABLE = exports.CLASSIFICATION_IN_USE = exports.CLASSIFICATION_NEVER_PROPOSED = exports.CLASSIFICATION_CONTENT_IN_MAIN = exports.CLASSIFICATION_SUPERSEDED = exports.CLASSIFICATION_NO_COMMITS = exports.CLASSIFICATION_BACKUP_OF_LIVE = exports.CLASSIFICATION_BACKUP_OF_MERGED = exports.CLASSIFICATION_MERGED_PR = exports.CACHE_STALE_AFTER_MS = exports.CacheFreshness = exports.MergedBranchesService = exports.MergedBranchesCache = exports.DeletableWorktree = exports.DeletableBranch = exports.MergedBranch = exports.squashRecoverySteps = exports.stampCleanMainSyncStatus = exports.computeMainSyncStatus = exports.finishedLock = exports.inProcessLock = void 0;
 var types_1 = require("./types");
 Object.defineProperty(exports, "ResolvedConfig", { enumerable: true, get: function () { return types_1.ResolvedConfig; } });
 Object.defineProperty(exports, "ResolvedRuleConfig", { enumerable: true, get: function () { return types_1.ResolvedRuleConfig; } });
@@ -27,6 +27,15 @@ var load_config_1 = require("./load-config");
 Object.defineProperty(exports, "loadAndValidate", { enumerable: true, get: function () { return load_config_1.loadAndValidate; } });
 Object.defineProperty(exports, "LoadedConfig", { enumerable: true, get: function () { return load_config_1.LoadedConfig; } });
 Object.defineProperty(exports, "ConfigLoader", { enumerable: true, get: function () { return load_config_1.ConfigLoader; } });
+// The validation-failure banner: ONE cure (edit the file), plus the markers that decide whether the
+// optional bulk migrator is even mentioned.
+var config_error_banner_1 = require("./config-error-banner");
+Object.defineProperty(exports, "formatConfigErrorsBanner", { enumerable: true, get: function () { return config_error_banner_1.formatConfigErrorsBanner; } });
+Object.defineProperty(exports, "migratorCoveredCount", { enumerable: true, get: function () { return config_error_banner_1.migratorCoveredCount; } });
+Object.defineProperty(exports, "MIGRATOR_COVERED_MARKERS", { enumerable: true, get: function () { return config_error_banner_1.MIGRATOR_COVERED_MARKERS; } });
+Object.defineProperty(exports, "RETIRED_KEY_MARKER", { enumerable: true, get: function () { return config_error_banner_1.RETIRED_KEY_MARKER; } });
+Object.defineProperty(exports, "RETIRED_TOP_LEVEL_MARKER", { enumerable: true, get: function () { return config_error_banner_1.RETIRED_TOP_LEVEL_MARKER; } });
+Object.defineProperty(exports, "SECTION_PLACEMENT_MARKER", { enumerable: true, get: function () { return config_error_banner_1.SECTION_PLACEMENT_MARKER; } });
 var config_file_1 = require("./config-file");
 Object.defineProperty(exports, "findConfigFile", { enumerable: true, get: function () { return config_file_1.findConfigFile; } });
 Object.defineProperty(exports, "CONFIG_FILENAME", { enumerable: true, get: function () { return config_file_1.CONFIG_FILENAME; } });

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/index.ts"],"names":[],"mappings":";;;;;;;;AAAA,iCAA0E;AAAjE,uGAAA,cAAc,OAAA;AAAE,2GAAA,kBAAkB,OAAA;AAC3C,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,mDAAgD;AAAvC,8GAAA,YAAY,OAAA;AACrB,uCAA6D;AAApD,oGAAA,QAAQ,OAAA;AAAE,wGAAA,YAAY,OAAA;AAAE,mGAAA,OAAO,OAAA;AACxC,uCAAqC;AAA5B,mGAAA,OAAO,OAAA;AAChB,uCAAqC;AAA5B,mGAAA,OAAO,OAAA;AAChB,6CAA4E;AAAnE,8GAAA,eAAe,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,2GAAA,YAAY,OAAA;AACpD,6CAAkJ;AAAzI,6GAAA,cAAc,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,yGAAA,UAAU,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,wHAAA,yBAAyB,OAAA;AAC1H,yCAAgF;AAAvE,2GAAA,cAAc,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAC1D,wGAAwG;AACxG,8FAA8F;AAC9F,yCAAsF;AAA7E,yGAAA,YAAY,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,oGAAA,OAAO,OAAA;AAAE,+GAAA,kBAAkB,OAAA;AAChE,6DAA+E;AAAtE,uHAAA,gBAAgB,OAAA;AAAE,2HAAA,oBAAoB,OAAA;AAC/C,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,2BAA8E;AAArE,oGAAA,cAAc,OAAA;AAAE,sGAAA,gBAAgB,OAAA;AAAE,0GAAA,oBAAoB,OAAA;AAC/D,2DAAoD;AAA3C,kHAAA,YAAY,OAAA;AACrB,iDAAiE;AAAxD,+GAAA,cAAc,OAAA;AAAE,+GAAA,cAAc,OAAA;AACvC,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,iDAAsG;AAA7F,6GAAA,YAAY,OAAA;AAAE,uHAAA,sBAAsB,OAAA;AAAE,8GAAA,aAAa,OAAA;AAAE,+GAAA,cAAc,OAAA;AAC5E,qDAAuM;AAA9L,0HAAA,uBAAuB,OAAA;AAAE,wHAAA,qBAAqB,OAAA;AAAE,4HAAA,yBAAyB,OAAA;AAAE,2HAAA,wBAAwB,OAAA;AAAE,uHAAA,oBAAoB,OAAA;AAAE,4HAAA,yBAAyB,OAAA;AAAE,+GAAA,YAAY,OAAA;AAC3K,6EAAwE;AAA/D,sIAAA,uBAAuB,OAAA;AAChC,uDAA8G;AAArG,oHAAA,gBAAgB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,wHAAA,oBAAoB,OAAA;AAAE,sHAAA,kBAAkB,OAAA;AACjF,uGAAuG;AACvG,wEAAwE;AACxE,6DAAsM;AAA7L,0HAAA,mBAAmB,OAAA;AAAE,wHAAA,iBAAiB,OAAA;AAAE,yHAAA,kBAAkB,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAAE,mHAAA,YAAY,OAAA;AAAE,mHAAA,YAAY,OAAA;AAAE,sHAAA,eAAe,OAAA;AAAE,yHAAA,kBAAkB,OAAA;AAAE,qHAAA,cAAc,OAAA;AACtK,uEAAmE;AAA1D,iIAAA,qBAAqB,OAAA;AAC9B,2DAQ8B;AAP1B,qHAAA,eAAe,OAAA;AACf,wHAAA,kBAAkB,OAAA;AAClB,6HAAA,uBAAuB,OAAA;AACvB,4HAAA,sBAAsB,OAAA;AACtB,8HAAA,wBAAwB,OAAA;AACxB,4HAAA,sBAAsB,OAAA;AACtB,yHAAA,mBAAmB,OAAA;AAGvB,uCAA2E;AAAlE,4GAAA,gBAAgB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAAE,0GAAA,cAAc,OAAA;AACtD,yCAAuC;AAA9B,qGAAA,QAAQ,OAAA;AAEjB,yCAA+D;AAAtD,2GAAA,cAAc,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAEzC,2CAYsB;AAXlB,wGAAA,UAAU,OAAA;AACV,yGAAA,WAAW,OAAA;AACX,6GAAA,eAAe,OAAA;AACf,yGAAA,WAAW,OAAA;AACX,mHAAA,qBAAqB,OAAA;AACrB,2HAAA,6BAA6B,OAAA;AAC7B,+GAAA,iBAAiB,OAAA;AACjB,6GAAA,eAAe,OAAA;AACf,uGAAA,SAAS,OAAA;AACT,uGAAA,SAAS,OAAA;AACT,iHAAA,mBAAmB,OAAA;AAEvB,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AACrB,yCASqB;AARjB,8GAAA,iBAAiB,OAAA;AACjB,uGAAA,UAAU,OAAA;AACV,uGAAA,UAAU,OAAA;AACV,8GAAA,iBAAiB,OAAA;AACjB,2GAAA,cAAc,OAAA;AACd,0GAAA,aAAa,OAAA;AACb,mHAAA,sBAAsB,OAAA;AACtB,mHAAA,sBAAsB,OAAA;AAE1B,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,2DAM8B;AAL1B,sHAAA,gBAAgB,OAAA;AAChB,qHAAA,eAAe,OAAA;AACf,sHAAA,gBAAgB,OAAA;AAChB,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AAEvB,+CAsCwB;AArCpB,oHAAA,oBAAoB,OAAA;AACpB,kHAAA,kBAAkB,OAAA;AAClB,uHAAA,uBAAuB,OAAA;AACvB,0HAAA,0BAA0B,OAAA;AAC1B,kHAAA,kBAAkB,OAAA;AAClB,mHAAA,mBAAmB,OAAA;AACnB,wHAAA,wBAAwB,OAAA;AACxB,qHAAA,qBAAqB,OAAA;AACrB,mHAAA,mBAAmB,OAAA;AACnB,2HAAA,2BAA2B,OAAA;AAC3B,uHAAA,uBAAuB,OAAA;AACvB,wHAAA,wBAAwB,OAAA;AACxB,kIAAA,kCAAkC,OAAA;AAClC,sHAAA,sBAAsB,OAAA;AACtB,iHAAA,iBAAiB,OAAA;AACjB,8HAAA,8BAA8B,OAAA;AAC9B,4HAAA,4BAA4B,OAAA;AAC5B,+IAAA,+CAA+C,OAAA;AAC/C,kHAAA,kBAAkB,OAAA;AAClB,6GAAA,aAAa,OAAA;AACb,yHAAA,yBAAyB,OAAA;AACzB,2HAAA,2BAA2B,OAAA;AAC3B,0HAAA,0BAA0B,OAAA;AAC1B,kHAAA,kBAAkB,OAAA;AAClB,4HAAA,4BAA4B,OAAA;AAC5B,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,8GAAA,cAAc,OAAA;AACd,6GAAA,aAAa,OAAA;AACb,+GAAA,eAAe,OAAA;AACf,qHAAA,qBAAqB,OAAA;AACrB,mIAAA,mCAAmC,OAAA;AACnC,kIAAA,kCAAkC,OAAA;AAClC,yHAAA,yBAAyB,OAAA;AACzB,4HAAA,4BAA4B,OAAA;AAC5B,wHAAA,wBAAwB,OAAA;AACxB,8GAAA,cAAc,OAAA;AAElB,wFAAwF;AACxF,+CAcwB;AAbpB,kHAAA,kBAAkB,OAAA;AAClB,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AACjB,iHAAA,iBAAiB,OAAA;AACjB,mHAAA,mBAAmB,OAAA;AACnB,6GAAA,aAAa,OAAA;AACb,iHAAA,iBAAiB,OAAA;AACjB,sHAAA,sBAAsB,OAAA;AACtB,yHAAA,yBAAyB,OAAA;AACzB,iHAAA,iBAAiB,OAAA;AACjB,4GAAA,YAAY,OAAA;AACZ,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AAErB,yEAGqC;AAFjC,wJAAA,2CAA2C,OAAA;AAC3C,uIAAA,0BAA0B,OAAA;AAkB9B,qEAKmC;AAJ/B,mIAAA,wBAAwB,OAAA;AACxB,+HAAA,oBAAoB,OAAA;AACpB,sIAAA,2BAA2B,OAAA;AAC3B,mIAAA,wBAAwB,OAAA;AAE5B,mDAa0B;AAZtB,gHAAA,cAAc,OAAA;AACd,8GAAA,YAAY,OAAA;AACZ,8GAAA,YAAY,OAAA;AACZ,oHAAA,kBAAkB,OAAA;AAClB,8GAAA,YAAY,OAAA;AACZ,qHAAA,mBAAmB,OAAA;AACnB,qHAAA,mBAAmB,OAAA;AACnB,mHAAA,iBAAiB,OAAA;AACjB,mHAAA,iBAAiB,OAAA;AACjB,iHAAA,eAAe,OAAA;AACf,iHAAA,eAAe,OAAA;AACf,6GAAA,WAAW,OAAA;AAEf,uDAK4B;AAJxB,uHAAA,mBAAmB,OAAA;AACnB,+GAAA,WAAW,OAAA;AACX,yHAAA,qBAAqB,OAAA;AACrB,kHAAA,cAAc,OAAA;AAGlB,6DAA2D;AAAlD,yHAAA,kBAAkB,OAAA;AAC3B,mEAAwE;AAA/D,sIAAA,4BAA4B,OAAA;AACrC,iEAOiC;AAN7B,oIAAA,2BAA2B,OAAA;AAC3B,yHAAA,gBAAgB,OAAA;AAChB,oHAAA,WAAW,OAAA;AACX,qHAAA,YAAY,OAAA;AACZ,8HAAA,qBAAqB,OAAA;AACrB,gIAAA,uBAAuB,OAAA;AAE3B,2CAMsB;AALlB,8GAAA,gBAAgB,OAAA;AAChB,8GAAA,gBAAgB,OAAA;AAChB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAChB,6GAAA,eAAe,OAAA;AAEnB,6DAS+B;AAR3B,gIAAA,yBAAyB,OAAA;AACzB,uHAAA,gBAAgB,OAAA;AAChB,sHAAA,eAAe,OAAA;AACf,qHAAA,cAAc,OAAA;AACd,uHAAA,gBAAgB,OAAA;AAChB,oHAAA,aAAa,OAAA;AACb,yHAAA,kBAAkB,OAAA;AAClB,yHAAA,kBAAkB,OAAA;AAEtB,yDAQ6B;AAPzB,4HAAA,uBAAuB,OAAA;AACvB,qHAAA,gBAAgB,OAAA;AAChB,uHAAA,kBAAkB,OAAA;AAClB,kHAAA,aAAa,OAAA;AACb,mHAAA,cAAc,OAAA;AACd,2HAAA,sBAAsB,OAAA;AACtB,2HAAA,sBAAsB,OAAA;AAE1B,6CAsBuB;AArBnB,yGAAA,UAAU,OAAA;AACV,wGAAA,SAAS,OAAA;AACT,8GAAA,eAAe,OAAA;AACf,+GAAA,gBAAgB,OAAA;AAChB,sGAAA,OAAO,OAAA;AACP,sGAAA,OAAO,OAAA;AACP,4GAAA,aAAa,OAAA;AACb,sGAAA,OAAO,OAAA;AACP,yGAAA,UAAU,OAAA;AACV,4GAAA,aAAa,OAAA;AACb,4GAAA,aAAa,OAAA;AACb,6GAAA,cAAc,OAAA;AACd,0GAAA,WAAW,OAAA;AACX,+GAAA,gBAAgB,OAAA;AAChB,gHAAA,iBAAiB,OAAA;AACjB,qHAAA,sBAAsB,OAAA;AACtB,gHAAA,iBAAiB,OAAA;AACjB,6GAAA,cAAc,OAAA;AACd,uGAAA,QAAQ,OAAA;AACR,6GAAA,cAAc,OAAA;AACd,mHAAA,oBAAoB,OAAA;AAExB,mDAM0B;AALtB,gHAAA,cAAc,OAAA;AACd,oHAAA,kBAAkB,OAAA;AAClB,mHAAA,iBAAiB,OAAA;AACjB,kHAAA,gBAAgB,OAAA;AAChB,0HAAA,wBAAwB,OAAA;AAE5B,uDAqB4B;AApBxB,gHAAA,YAAY,OAAA;AACZ,yHAAA,qBAAqB,OAAA;AACrB,gIAAA,4BAA4B,OAAA;AAC5B,sHAAA,kBAAkB,OAAA;AAClB,oHAAA,gBAAgB,OAAA;AAChB,sHAAA,kBAAkB,OAAA;AAClB,0HAAA,sBAAsB,OAAA;AACtB,uHAAA,mBAAmB,OAAA;AACnB,2HAAA,uBAAuB,OAAA;AACvB,8HAAA,0BAA0B,OAAA;AAC1B,oHAAA,gBAAgB,OAAA;AAChB,qHAAA,iBAAiB,OAAA;AACjB,+GAAA,WAAW,OAAA;AACX,uHAAA,mBAAmB,OAAA;AACnB,0HAAA,sBAAsB,OAAA;AACtB,iHAAA,aAAa,OAAA;AACb,gHAAA,YAAY,OAAA;AACZ,yHAAA,qBAAqB,OAAA;AACrB,4HAAA,wBAAwB,OAAA;AACxB,uHAAA,mBAAmB,OAAA;AAEvB,qDAqB2B;AApBvB,+GAAA,YAAY,OAAA;AACZ,kHAAA,eAAe,OAAA;AACf,oHAAA,iBAAiB,OAAA;AACjB,sHAAA,mBAAmB,OAAA;AACnB,wHAAA,qBAAqB,OAAA;AACrB,iHAAA,cAAc,OAAA;AACd,uHAAA,oBAAoB,OAAA;AACpB,2HAAA,wBAAwB,OAAA;AACxB,kIAAA,+BAA+B,OAAA;AAC/B,gIAAA,6BAA6B,OAAA;AAC7B,4HAAA,yBAAyB,OAAA;AACzB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA;AAC9B,gIAAA,6BAA6B,OAAA;AAC7B,wHAAA,qBAAqB,OAAA;AACrB,0HAAA,uBAAuB,OAAA;AACvB,wHAAA,qBAAqB,OAAA;AACrB,yHAAA,sBAAsB,OAAA;AACtB,0HAAA,uBAAuB,OAAA;AACvB,6HAAA,0BAA0B,OAAA;AAE9B,qDAQ2B;AAPvB,iHAAA,cAAc,OAAA;AACd,gHAAA,aAAa,OAAA;AACb,qHAAA,kBAAkB,OAAA;AAClB,oHAAA,iBAAiB,OAAA;AACjB,0HAAA,uBAAuB,OAAA;AACvB,+HAAA,4BAA4B,OAAA;AAC5B,wHAAA,qBAAqB,OAAA;AAEzB,yCAGqB;AAFjB,qGAAA,QAAQ,OAAA;AACR,4GAAA,eAAe,OAAA;AAEnB,iDAIyB;AAHrB,6GAAA,YAAY,OAAA;AACZ,2GAAA,UAAU,OAAA;AACV,6GAAA,YAAY,OAAA;AAEhB,qDAI2B;AAHvB,iHAAA,cAAc,OAAA;AACd,qHAAA,kBAAkB,OAAA;AAClB,iHAAA,cAAc,OAAA;AAGlB,6DAK+B;AAJ3B,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AAErB,qDAK2B;AAJvB,iHAAA,cAAc,OAAA;AACd,sHAAA,mBAAmB,OAAA;AACnB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA","sourcesContent":["export { ResolvedConfig, ResolvedRuleConfig, RuleOptions } from './types';\nexport { InformAiError } from './inform-ai-error';\nexport { RuleFailError } from './rule-fail-error';\nexport { CliExitError } from './cli-exit-error';\nexport { CliUsage, CliArgsCheck, CliArgs } from './cli-args';\nexport { runMain } from './run-main';\nexport { toError } from './to-error';\nexport { loadAndValidate, LoadedConfig, ConfigLoader } from './load-config';\nexport { findConfigFile, CONFIG_FILENAME, ConfigFile, ConfigParseAttempt, CONFIG_PARSE_ATTEMPTS, CONFIG_PARSE_RETRY_MILLIS } from './config-file';\nexport { RepoRootFinder, INSTRUCT_AI_DIR, INSTRUCT_AI_LEAF } from './repo-root';\n// The scoped `.webpieces` resolver. EVERY reader/writer of `.webpieces/...` goes through one of its two\n// named methods so the call site declares whether the state is repo-wide or worktree-private.\nexport { DotWebpieces, dotWebpieces, GitDirs, WORKTREE_STATE_DIR } from './state-dir';\nexport { StateDirMigrator, StateMigrationReport } from './state-dir-migration';\nexport { AtomicFile } from './atomic-file';\nexport { RulesConfigDesign } from './rules-config-design';\nexport { DocumentDesign, isDocumentDesign, DESIGN_METADATA_KEYS } from './di';\nexport { ExcludePaths } from './exclude-hook-paths';\nexport { isPathExcluded, matchesAnyGlob } from './exclude-paths';\nexport { defaultRules, defaultRulesDir } from './default-rules';\nexport { loadTemplate, writeTemplateIfMissing, writeTemplate, TemplateWriter } from './load-template';\nexport { validateWebpiecesConfig, validatePrGateSection, validateChecklistsSection, validateSectionPlacement, validateExcludePaths, validateMatchRulesSection, allRuleNames } from './validate-config';\nexport { validateCommandsSection } from './commands-section-validators';\nexport { unknownKeyErrors, isCommentKey, validateTopLevelKeys, COMMENT_KEY_SUFFIX } from './config-key-rules';\n// The retired-key table + the no-back-compat policy it enforces. Exported so the installer can migrate\n// what the errors instruct, and so consumers can enumerate retirements.\nexport { RETIRED_CONFIG_KEYS, RETIRED_SCOPE_KEY, RETIRED_SCOPE_RULE, RetiredConfigKey, isRetiredKey, retiredEntry, retiredKeyError, retiredKeyErrorsIn, retiredRuleFor } from './retired-config-keys';\nexport { validateChecklistDocs } from './checklist-docs-validator';\nexport {\n    MatchRuleConfig,\n    MatchRuleViolation,\n    findMatchRuleViolations,\n    isMatchRuleAllowedPath,\n    compileMatchRulePatterns,\n    renderMatchRuleMessage,\n    DEFAULT_MATCH_RULES,\n} from './match-rules-config';\nexport type { ConfigSection } from './sections';\nexport { HOOK_GUARD_NAMES, isHookGuard, sectionForRule } from './sections';\nexport { FieldDef } from './field-def';\nexport type { SchemaShape } from './field-def';\nexport { shouldSkipRule, getCurrentBranch } from './skip-rule';\nexport type { SkipRuleResult } from './skip-rule';\nexport {\n    detectBase,\n    resolveBase,\n    getChangedFiles,\n    getFileDiff,\n    getChangedLineNumbers,\n    findNewMethodSignaturesInDiff,\n    hasChangesInRange,\n    isNewOrModified,\n    DiffScope,\n    DiffRange,\n    ChangedFilesOptions,\n} from './diff-scope';\nexport { AbstractRule } from './abstract-rule';\nexport {\n    WEBPIECES_DISABLE,\n    RULE_NAMES,\n    hasDisable,\n    WEBPIECES_TMP_DIR,\n    MERGE_INFO_DIR,\n    PR_REVIEW_DIR,\n    MERGE_IN_PROGRESS_FILE,\n    MERGE_EXPLANATION_FILE,\n} from './constants';\nexport { WebpiecesRulesConfig } from './WebpiecesRulesConfig';\nexport {\n    SyncFlowGuidance,\n    WP_START_UPDATE,\n    WP_FINISH_UPDATE,\n    WP_START_UPSERT_PR,\n    WP_FINISH_UPSERT_PR,\n} from './sync-flow-guidance';\nexport {\n    MaxMethodLinesConfig,\n    MaxFileLinesConfig,\n    RequireReturnTypeConfig,\n    NoInlineTypeLiteralsConfig,\n    NoAnyUnknownConfig,\n    NoImplicitAnyConfig,\n    PrismaValidateDtosConfig,\n    PrismaConverterConfig,\n    NoDestructureConfig,\n    NoUnmanagedExceptionsConfig,\n    CatchErrorPatternConfig,\n    ThrowCauseRequiredConfig,\n    AngularNoDirectApiInResolverConfig,\n    NoSymbolDiTokensConfig,\n    NoCustomCssConfig,\n    NoProcessExitOutsideMainConfig,\n    NoFunctionOutsideClassConfig,\n    InjectAnnotationNotNeededForConcreteClassConfig,\n    FrameworkTagConfig,\n    RoleTagConfig,\n    BranchCreationGuardConfig,\n    PrCreationOrPushGuardConfig,\n    MergeInProgressGuardConfig,\n    PrMergeGuardConfig,\n    RedirectHowToMergeMainConfig,\n    NoFileImportCyclesConfig,\n    RuntimeArchitectureConfig,\n    NxWiringConfig,\n    DiGraphConfig,\n    NoJsFilesConfig,\n    ValidateTsInSrcConfig,\n    ValidateArchitectureUnchangedConfig,\n    ValidateNoArchitectureCyclesConfig,\n    ValidatePackageJsonConfig,\n    ValidateVersionsLockedConfig,\n    ValidateEslintSyncConfig,\n    BaseRuleConfig,\n} from './rule-configs';\n// Mode unions + their value arrays — the single source of truth shared with code-rules.\nexport {\n    METHOD_LIMIT_MODES,\n    FILE_LIMIT_MODES,\n    RETURN_TYPE_MODES,\n    INLINE_TYPE_MODES,\n    MODIFIED_CODE_MODES,\n    PROJECT_MODES,\n    PRISMA_DTOS_MODES,\n    PRISMA_CONVERTER_MODES,\n    DIRECT_API_RESOLVER_MODES,\n    THROW_CAUSE_MODES,\n    ON_OFF_MODES,\n    STRUCTURAL_MODES,\n    VALIDATE_TS_MODES,\n} from './rule-configs';\nexport {\n    NoClientCreationOutsideServerOrClientConfig,\n    CLIENT_CREATION_SEVERITIES,\n} from './no-client-creation-config';\nexport type { ClientCreationSeverity } from './no-client-creation-config';\nexport type {\n    MethodLimitMode,\n    FileLimitMode,\n    ReturnTypeMode,\n    InlineTypeMode,\n    ModifiedCodeMode,\n    ProjectMode,\n    PrismaValidateDtosMode,\n    PrismaConverterMode,\n    DirectApiResolverMode,\n    ThrowCauseMode,\n    OnOffMode,\n    StructuralMode,\n    ValidateTsMode,\n} from './rule-configs';\nexport {\n    FeatureBranchGuardConfig,\n    ReadStaleGuardConfig,\n    MergedBranchBashGuardConfig,\n    StaleMainBashGuardConfig,\n} from './main-sync-guard-configs';\nexport {\n    GateDefinition,\n    PrGateConfig,\n    LandPrConfig,\n    ReviewContextEntry,\n    defaultGates,\n    defaultPrGateConfig,\n    defaultLandPrConfig,\n    buildPrGateConfig,\n    buildLandPrConfig,\n    MERGE_MODE_AUTO,\n    MERGE_MODE_NONE,\n    MERGE_MODES,\n} from './pr-gate-config';\nexport {\n    ChecklistDefinition,\n    toChecklist,\n    normalizeChecklistDoc,\n    formatFileList,\n} from './checklist-config';\nexport type { RawChecklistItem } from './checklist-config';\nexport { ChecklistValidator } from './checklist-validator';\nexport { ChecklistInstructionsService } from './checklist-instructions';\nexport {\n    ReviewerInstructionsService,\n    ReviewerBriefing,\n    BriefedFile,\n    ContextEntry,\n    READ_TRUNCATION_LINES,\n    ALL_DIFF_ONE_READ_LINES,\n} from './reviewer-instructions';\nexport {\n    GateTokenService,\n    computeGateToken,\n    gateTokenMarker,\n    extractGateToken,\n    verifyGateToken,\n} from './gate-token';\nexport {\n    SubagentProvenanceService,\n    ReviewerEvidence,\n    EvidenceRequest,\n    TranscriptScan,\n    ProvenanceResult,\n    PROVENANCE_OK,\n    PROVENANCE_MISSING,\n    PROVENANCE_SKIPPED,\n} from './subagent-provenance';\nexport {\n    ReviewProvenanceService,\n    ReviewProvenance,\n    ReviewerTranscript,\n    ReviewerPaths,\n    OfferedContext,\n    ProvenanceWriteRequest,\n    DEFAULT_RETENTION_DAYS,\n} from './review-provenance';\nexport {\n    ReviewJson,\n    PrContext,\n    ChecklistResult,\n    ChecklistVerdict,\n    CK_PASS,\n    CK_WARN,\n    CK_OVERRIDDEN,\n    CK_FAIL,\n    CK_MISSING,\n    CK_BAD_FORMAT,\n    VERDICT_GREEN,\n    VERDICT_YELLOW,\n    VERDICT_RED,\n    VERDICT_STATUSES,\n    RequiredChecklist,\n    ChecklistReviewContext,\n    ReviewJsonService,\n    loadReviewJson,\n    prDirFor,\n    reviewJsonPath,\n    reviewJsonSchemaHint,\n} from './review-json';\nexport {\n    MainSyncStatus,\n    MainSyncStatusFile,\n    MainSyncFileStore,\n    PullRequestIndex,\n    MAIN_SYNC_STATUS_VERSION,\n} from './main-sync-file';\nexport {\n    MainSyncLock,\n    MainSyncStatusService,\n    DEFAULT_HANG_TIMEOUT_MINUTES,\n    mainSyncStatusPath,\n    mainSyncLockPath,\n    readMainSyncStatus,\n    readMainSyncStatusFile,\n    writeMainSyncStatus,\n    writeMainSyncStatusFile,\n    computeAllMainSyncStatuses,\n    readMainSyncLock,\n    writeMainSyncLock,\n    isLockStale,\n    isRefreshInProgress,\n    tryAcquireMainSyncLock,\n    inProcessLock,\n    finishedLock,\n    computeMainSyncStatus,\n    stampCleanMainSyncStatus,\n    squashRecoverySteps,\n} from './main-sync-status';\nexport {\n    MergedBranch,\n    DeletableBranch,\n    DeletableWorktree,\n    MergedBranchesCache,\n    MergedBranchesService,\n    CacheFreshness,\n    CACHE_STALE_AFTER_MS,\n    CLASSIFICATION_MERGED_PR,\n    CLASSIFICATION_BACKUP_OF_MERGED,\n    CLASSIFICATION_BACKUP_OF_LIVE,\n    CLASSIFICATION_NO_COMMITS,\n    CLASSIFICATION_SUPERSEDED,\n    CLASSIFICATION_CONTENT_IN_MAIN,\n    CLASSIFICATION_NEVER_PROPOSED,\n    CLASSIFICATION_IN_USE,\n    CLASSIFICATION_PRUNABLE,\n    CLASSIFICATION_LOCKED,\n    CLASSIFICATION_CURRENT,\n    CLASSIFICATION_DETACHED,\n    PROMPTABLE_CLASSIFICATIONS,\n} from './merged-branches';\nexport {\n    BranchArchiver,\n    ArchiveResult,\n    ARCHIVE_TAG_PREFIX,\n    BRANCH_RETENTIONS,\n    BRANCH_RETENTION_DELETE,\n    BRANCH_RETENTION_ARCHIVE_TAG,\n    BRANCH_RETENTION_KEEP,\n} from './branch-archiver';\nexport {\n    Worktree,\n    WorktreeService,\n} from './worktrees';\nexport {\n    ReapedBranch,\n    ReapResult,\n    BranchReaper,\n} from './branch-reaper';\nexport {\n    ReapedWorktree,\n    WorktreeReapResult,\n    WorktreeReaper,\n} from './worktree-reaper';\nexport type { MutationVerb, MutationPhase } from './branch-mutation-log';\nexport {\n    BranchMutationEvent,\n    BranchMutationLog,\n    branchMutationLogPath,\n    logBranchMutation,\n} from './branch-mutation-log';\nexport {\n    CommandsConfig,\n    buildCommandsConfig,\n    DEFAULT_UPSERT_PR_COMMAND,\n    DEFAULT_MERGE_COMPLETE_COMMAND,\n} from './commands-config';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/index.ts"],"names":[],"mappings":";;;;;;;;AAAA,iCAA0E;AAAjE,uGAAA,cAAc,OAAA;AAAE,2GAAA,kBAAkB,OAAA;AAC3C,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,mDAAgD;AAAvC,8GAAA,YAAY,OAAA;AACrB,uCAA6D;AAApD,oGAAA,QAAQ,OAAA;AAAE,wGAAA,YAAY,OAAA;AAAE,mGAAA,OAAO,OAAA;AACxC,uCAAqC;AAA5B,mGAAA,OAAO,OAAA;AAChB,uCAAqC;AAA5B,mGAAA,OAAO,OAAA;AAChB,6CAA4E;AAAnE,8GAAA,eAAe,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,2GAAA,YAAY,OAAA;AACpD,oGAAoG;AACpG,4CAA4C;AAC5C,6DAO+B;AAN3B,+HAAA,wBAAwB,OAAA;AACxB,2HAAA,oBAAoB,OAAA;AACpB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,+HAAA,wBAAwB,OAAA;AACxB,+HAAA,wBAAwB,OAAA;AAE5B,6CAAkJ;AAAzI,6GAAA,cAAc,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,yGAAA,UAAU,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,wHAAA,yBAAyB,OAAA;AAC1H,yCAAgF;AAAvE,2GAAA,cAAc,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAC1D,wGAAwG;AACxG,8FAA8F;AAC9F,yCAAsF;AAA7E,yGAAA,YAAY,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,oGAAA,OAAO,OAAA;AAAE,+GAAA,kBAAkB,OAAA;AAChE,6DAA+E;AAAtE,uHAAA,gBAAgB,OAAA;AAAE,2HAAA,oBAAoB,OAAA;AAC/C,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,2BAA8E;AAArE,oGAAA,cAAc,OAAA;AAAE,sGAAA,gBAAgB,OAAA;AAAE,0GAAA,oBAAoB,OAAA;AAC/D,2DAAoD;AAA3C,kHAAA,YAAY,OAAA;AACrB,iDAAiE;AAAxD,+GAAA,cAAc,OAAA;AAAE,+GAAA,cAAc,OAAA;AACvC,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,iDAAsG;AAA7F,6GAAA,YAAY,OAAA;AAAE,uHAAA,sBAAsB,OAAA;AAAE,8GAAA,aAAa,OAAA;AAAE,+GAAA,cAAc,OAAA;AAC5E,qDAAuM;AAA9L,0HAAA,uBAAuB,OAAA;AAAE,wHAAA,qBAAqB,OAAA;AAAE,4HAAA,yBAAyB,OAAA;AAAE,2HAAA,wBAAwB,OAAA;AAAE,uHAAA,oBAAoB,OAAA;AAAE,4HAAA,yBAAyB,OAAA;AAAE,+GAAA,YAAY,OAAA;AAC3K,6EAAwE;AAA/D,sIAAA,uBAAuB,OAAA;AAChC,uDAA8G;AAArG,oHAAA,gBAAgB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,wHAAA,oBAAoB,OAAA;AAAE,sHAAA,kBAAkB,OAAA;AACjF,uGAAuG;AACvG,wEAAwE;AACxE,6DAAsM;AAA7L,0HAAA,mBAAmB,OAAA;AAAE,wHAAA,iBAAiB,OAAA;AAAE,yHAAA,kBAAkB,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAAE,mHAAA,YAAY,OAAA;AAAE,mHAAA,YAAY,OAAA;AAAE,sHAAA,eAAe,OAAA;AAAE,yHAAA,kBAAkB,OAAA;AAAE,qHAAA,cAAc,OAAA;AACtK,uEAAmE;AAA1D,iIAAA,qBAAqB,OAAA;AAC9B,2DAQ8B;AAP1B,qHAAA,eAAe,OAAA;AACf,wHAAA,kBAAkB,OAAA;AAClB,6HAAA,uBAAuB,OAAA;AACvB,4HAAA,sBAAsB,OAAA;AACtB,8HAAA,wBAAwB,OAAA;AACxB,4HAAA,sBAAsB,OAAA;AACtB,yHAAA,mBAAmB,OAAA;AAGvB,uCAA2E;AAAlE,4GAAA,gBAAgB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAAE,0GAAA,cAAc,OAAA;AACtD,yCAAuC;AAA9B,qGAAA,QAAQ,OAAA;AAEjB,yCAA+D;AAAtD,2GAAA,cAAc,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAEzC,2CAYsB;AAXlB,wGAAA,UAAU,OAAA;AACV,yGAAA,WAAW,OAAA;AACX,6GAAA,eAAe,OAAA;AACf,yGAAA,WAAW,OAAA;AACX,mHAAA,qBAAqB,OAAA;AACrB,2HAAA,6BAA6B,OAAA;AAC7B,+GAAA,iBAAiB,OAAA;AACjB,6GAAA,eAAe,OAAA;AACf,uGAAA,SAAS,OAAA;AACT,uGAAA,SAAS,OAAA;AACT,iHAAA,mBAAmB,OAAA;AAEvB,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AACrB,yCASqB;AARjB,8GAAA,iBAAiB,OAAA;AACjB,uGAAA,UAAU,OAAA;AACV,uGAAA,UAAU,OAAA;AACV,8GAAA,iBAAiB,OAAA;AACjB,2GAAA,cAAc,OAAA;AACd,0GAAA,aAAa,OAAA;AACb,mHAAA,sBAAsB,OAAA;AACtB,mHAAA,sBAAsB,OAAA;AAE1B,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,2DAM8B;AAL1B,sHAAA,gBAAgB,OAAA;AAChB,qHAAA,eAAe,OAAA;AACf,sHAAA,gBAAgB,OAAA;AAChB,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AAEvB,+CAsCwB;AArCpB,oHAAA,oBAAoB,OAAA;AACpB,kHAAA,kBAAkB,OAAA;AAClB,uHAAA,uBAAuB,OAAA;AACvB,0HAAA,0BAA0B,OAAA;AAC1B,kHAAA,kBAAkB,OAAA;AAClB,mHAAA,mBAAmB,OAAA;AACnB,wHAAA,wBAAwB,OAAA;AACxB,qHAAA,qBAAqB,OAAA;AACrB,mHAAA,mBAAmB,OAAA;AACnB,2HAAA,2BAA2B,OAAA;AAC3B,uHAAA,uBAAuB,OAAA;AACvB,wHAAA,wBAAwB,OAAA;AACxB,kIAAA,kCAAkC,OAAA;AAClC,sHAAA,sBAAsB,OAAA;AACtB,iHAAA,iBAAiB,OAAA;AACjB,8HAAA,8BAA8B,OAAA;AAC9B,4HAAA,4BAA4B,OAAA;AAC5B,+IAAA,+CAA+C,OAAA;AAC/C,kHAAA,kBAAkB,OAAA;AAClB,6GAAA,aAAa,OAAA;AACb,yHAAA,yBAAyB,OAAA;AACzB,2HAAA,2BAA2B,OAAA;AAC3B,0HAAA,0BAA0B,OAAA;AAC1B,kHAAA,kBAAkB,OAAA;AAClB,4HAAA,4BAA4B,OAAA;AAC5B,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,8GAAA,cAAc,OAAA;AACd,6GAAA,aAAa,OAAA;AACb,+GAAA,eAAe,OAAA;AACf,qHAAA,qBAAqB,OAAA;AACrB,mIAAA,mCAAmC,OAAA;AACnC,kIAAA,kCAAkC,OAAA;AAClC,yHAAA,yBAAyB,OAAA;AACzB,4HAAA,4BAA4B,OAAA;AAC5B,wHAAA,wBAAwB,OAAA;AACxB,8GAAA,cAAc,OAAA;AAElB,wFAAwF;AACxF,+CAcwB;AAbpB,kHAAA,kBAAkB,OAAA;AAClB,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AACjB,iHAAA,iBAAiB,OAAA;AACjB,mHAAA,mBAAmB,OAAA;AACnB,6GAAA,aAAa,OAAA;AACb,iHAAA,iBAAiB,OAAA;AACjB,sHAAA,sBAAsB,OAAA;AACtB,yHAAA,yBAAyB,OAAA;AACzB,iHAAA,iBAAiB,OAAA;AACjB,4GAAA,YAAY,OAAA;AACZ,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AAErB,yEAGqC;AAFjC,wJAAA,2CAA2C,OAAA;AAC3C,uIAAA,0BAA0B,OAAA;AAkB9B,qEAKmC;AAJ/B,mIAAA,wBAAwB,OAAA;AACxB,+HAAA,oBAAoB,OAAA;AACpB,sIAAA,2BAA2B,OAAA;AAC3B,mIAAA,wBAAwB,OAAA;AAE5B,mDAa0B;AAZtB,gHAAA,cAAc,OAAA;AACd,8GAAA,YAAY,OAAA;AACZ,8GAAA,YAAY,OAAA;AACZ,oHAAA,kBAAkB,OAAA;AAClB,8GAAA,YAAY,OAAA;AACZ,qHAAA,mBAAmB,OAAA;AACnB,qHAAA,mBAAmB,OAAA;AACnB,mHAAA,iBAAiB,OAAA;AACjB,mHAAA,iBAAiB,OAAA;AACjB,iHAAA,eAAe,OAAA;AACf,iHAAA,eAAe,OAAA;AACf,6GAAA,WAAW,OAAA;AAEf,uDAK4B;AAJxB,uHAAA,mBAAmB,OAAA;AACnB,+GAAA,WAAW,OAAA;AACX,yHAAA,qBAAqB,OAAA;AACrB,kHAAA,cAAc,OAAA;AAGlB,6DAA2D;AAAlD,yHAAA,kBAAkB,OAAA;AAC3B,mEAAwE;AAA/D,sIAAA,4BAA4B,OAAA;AACrC,iEAOiC;AAN7B,oIAAA,2BAA2B,OAAA;AAC3B,yHAAA,gBAAgB,OAAA;AAChB,oHAAA,WAAW,OAAA;AACX,qHAAA,YAAY,OAAA;AACZ,8HAAA,qBAAqB,OAAA;AACrB,gIAAA,uBAAuB,OAAA;AAE3B,2CAMsB;AALlB,8GAAA,gBAAgB,OAAA;AAChB,8GAAA,gBAAgB,OAAA;AAChB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAChB,6GAAA,eAAe,OAAA;AAEnB,6DAS+B;AAR3B,gIAAA,yBAAyB,OAAA;AACzB,uHAAA,gBAAgB,OAAA;AAChB,sHAAA,eAAe,OAAA;AACf,qHAAA,cAAc,OAAA;AACd,uHAAA,gBAAgB,OAAA;AAChB,oHAAA,aAAa,OAAA;AACb,yHAAA,kBAAkB,OAAA;AAClB,yHAAA,kBAAkB,OAAA;AAEtB,yDAQ6B;AAPzB,4HAAA,uBAAuB,OAAA;AACvB,qHAAA,gBAAgB,OAAA;AAChB,uHAAA,kBAAkB,OAAA;AAClB,kHAAA,aAAa,OAAA;AACb,mHAAA,cAAc,OAAA;AACd,2HAAA,sBAAsB,OAAA;AACtB,2HAAA,sBAAsB,OAAA;AAE1B,6CAsBuB;AArBnB,yGAAA,UAAU,OAAA;AACV,wGAAA,SAAS,OAAA;AACT,8GAAA,eAAe,OAAA;AACf,+GAAA,gBAAgB,OAAA;AAChB,sGAAA,OAAO,OAAA;AACP,sGAAA,OAAO,OAAA;AACP,4GAAA,aAAa,OAAA;AACb,sGAAA,OAAO,OAAA;AACP,yGAAA,UAAU,OAAA;AACV,4GAAA,aAAa,OAAA;AACb,4GAAA,aAAa,OAAA;AACb,6GAAA,cAAc,OAAA;AACd,0GAAA,WAAW,OAAA;AACX,+GAAA,gBAAgB,OAAA;AAChB,gHAAA,iBAAiB,OAAA;AACjB,qHAAA,sBAAsB,OAAA;AACtB,gHAAA,iBAAiB,OAAA;AACjB,6GAAA,cAAc,OAAA;AACd,uGAAA,QAAQ,OAAA;AACR,6GAAA,cAAc,OAAA;AACd,mHAAA,oBAAoB,OAAA;AAExB,mDAM0B;AALtB,gHAAA,cAAc,OAAA;AACd,oHAAA,kBAAkB,OAAA;AAClB,mHAAA,iBAAiB,OAAA;AACjB,kHAAA,gBAAgB,OAAA;AAChB,0HAAA,wBAAwB,OAAA;AAE5B,uDAqB4B;AApBxB,gHAAA,YAAY,OAAA;AACZ,yHAAA,qBAAqB,OAAA;AACrB,gIAAA,4BAA4B,OAAA;AAC5B,sHAAA,kBAAkB,OAAA;AAClB,oHAAA,gBAAgB,OAAA;AAChB,sHAAA,kBAAkB,OAAA;AAClB,0HAAA,sBAAsB,OAAA;AACtB,uHAAA,mBAAmB,OAAA;AACnB,2HAAA,uBAAuB,OAAA;AACvB,8HAAA,0BAA0B,OAAA;AAC1B,oHAAA,gBAAgB,OAAA;AAChB,qHAAA,iBAAiB,OAAA;AACjB,+GAAA,WAAW,OAAA;AACX,uHAAA,mBAAmB,OAAA;AACnB,0HAAA,sBAAsB,OAAA;AACtB,iHAAA,aAAa,OAAA;AACb,gHAAA,YAAY,OAAA;AACZ,yHAAA,qBAAqB,OAAA;AACrB,4HAAA,wBAAwB,OAAA;AACxB,uHAAA,mBAAmB,OAAA;AAEvB,qDAqB2B;AApBvB,+GAAA,YAAY,OAAA;AACZ,kHAAA,eAAe,OAAA;AACf,oHAAA,iBAAiB,OAAA;AACjB,sHAAA,mBAAmB,OAAA;AACnB,wHAAA,qBAAqB,OAAA;AACrB,iHAAA,cAAc,OAAA;AACd,uHAAA,oBAAoB,OAAA;AACpB,2HAAA,wBAAwB,OAAA;AACxB,kIAAA,+BAA+B,OAAA;AAC/B,gIAAA,6BAA6B,OAAA;AAC7B,4HAAA,yBAAyB,OAAA;AACzB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA;AAC9B,gIAAA,6BAA6B,OAAA;AAC7B,wHAAA,qBAAqB,OAAA;AACrB,0HAAA,uBAAuB,OAAA;AACvB,wHAAA,qBAAqB,OAAA;AACrB,yHAAA,sBAAsB,OAAA;AACtB,0HAAA,uBAAuB,OAAA;AACvB,6HAAA,0BAA0B,OAAA;AAE9B,qDAQ2B;AAPvB,iHAAA,cAAc,OAAA;AACd,gHAAA,aAAa,OAAA;AACb,qHAAA,kBAAkB,OAAA;AAClB,oHAAA,iBAAiB,OAAA;AACjB,0HAAA,uBAAuB,OAAA;AACvB,+HAAA,4BAA4B,OAAA;AAC5B,wHAAA,qBAAqB,OAAA;AAEzB,yCAGqB;AAFjB,qGAAA,QAAQ,OAAA;AACR,4GAAA,eAAe,OAAA;AAEnB,iDAIyB;AAHrB,6GAAA,YAAY,OAAA;AACZ,2GAAA,UAAU,OAAA;AACV,6GAAA,YAAY,OAAA;AAEhB,qDAI2B;AAHvB,iHAAA,cAAc,OAAA;AACd,qHAAA,kBAAkB,OAAA;AAClB,iHAAA,cAAc,OAAA;AAGlB,6DAK+B;AAJ3B,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AAErB,qDAK2B;AAJvB,iHAAA,cAAc,OAAA;AACd,sHAAA,mBAAmB,OAAA;AACnB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA","sourcesContent":["export { ResolvedConfig, ResolvedRuleConfig, RuleOptions } from './types';\nexport { InformAiError } from './inform-ai-error';\nexport { RuleFailError } from './rule-fail-error';\nexport { CliExitError } from './cli-exit-error';\nexport { CliUsage, CliArgsCheck, CliArgs } from './cli-args';\nexport { runMain } from './run-main';\nexport { toError } from './to-error';\nexport { loadAndValidate, LoadedConfig, ConfigLoader } from './load-config';\n// The validation-failure banner: ONE cure (edit the file), plus the markers that decide whether the\n// optional bulk migrator is even mentioned.\nexport {\n    formatConfigErrorsBanner,\n    migratorCoveredCount,\n    MIGRATOR_COVERED_MARKERS,\n    RETIRED_KEY_MARKER,\n    RETIRED_TOP_LEVEL_MARKER,\n    SECTION_PLACEMENT_MARKER,\n} from './config-error-banner';\nexport { findConfigFile, CONFIG_FILENAME, ConfigFile, ConfigParseAttempt, CONFIG_PARSE_ATTEMPTS, CONFIG_PARSE_RETRY_MILLIS } from './config-file';\nexport { RepoRootFinder, INSTRUCT_AI_DIR, INSTRUCT_AI_LEAF } from './repo-root';\n// The scoped `.webpieces` resolver. EVERY reader/writer of `.webpieces/...` goes through one of its two\n// named methods so the call site declares whether the state is repo-wide or worktree-private.\nexport { DotWebpieces, dotWebpieces, GitDirs, WORKTREE_STATE_DIR } from './state-dir';\nexport { StateDirMigrator, StateMigrationReport } from './state-dir-migration';\nexport { AtomicFile } from './atomic-file';\nexport { RulesConfigDesign } from './rules-config-design';\nexport { DocumentDesign, isDocumentDesign, DESIGN_METADATA_KEYS } from './di';\nexport { ExcludePaths } from './exclude-hook-paths';\nexport { isPathExcluded, matchesAnyGlob } from './exclude-paths';\nexport { defaultRules, defaultRulesDir } from './default-rules';\nexport { loadTemplate, writeTemplateIfMissing, writeTemplate, TemplateWriter } from './load-template';\nexport { validateWebpiecesConfig, validatePrGateSection, validateChecklistsSection, validateSectionPlacement, validateExcludePaths, validateMatchRulesSection, allRuleNames } from './validate-config';\nexport { validateCommandsSection } from './commands-section-validators';\nexport { unknownKeyErrors, isCommentKey, validateTopLevelKeys, COMMENT_KEY_SUFFIX } from './config-key-rules';\n// The retired-key table + the no-back-compat policy it enforces. Exported so the installer can migrate\n// what the errors instruct, and so consumers can enumerate retirements.\nexport { RETIRED_CONFIG_KEYS, RETIRED_SCOPE_KEY, RETIRED_SCOPE_RULE, RetiredConfigKey, isRetiredKey, retiredEntry, retiredKeyError, retiredKeyErrorsIn, retiredRuleFor } from './retired-config-keys';\nexport { validateChecklistDocs } from './checklist-docs-validator';\nexport {\n    MatchRuleConfig,\n    MatchRuleViolation,\n    findMatchRuleViolations,\n    isMatchRuleAllowedPath,\n    compileMatchRulePatterns,\n    renderMatchRuleMessage,\n    DEFAULT_MATCH_RULES,\n} from './match-rules-config';\nexport type { ConfigSection } from './sections';\nexport { HOOK_GUARD_NAMES, isHookGuard, sectionForRule } from './sections';\nexport { FieldDef } from './field-def';\nexport type { SchemaShape } from './field-def';\nexport { shouldSkipRule, getCurrentBranch } from './skip-rule';\nexport type { SkipRuleResult } from './skip-rule';\nexport {\n    detectBase,\n    resolveBase,\n    getChangedFiles,\n    getFileDiff,\n    getChangedLineNumbers,\n    findNewMethodSignaturesInDiff,\n    hasChangesInRange,\n    isNewOrModified,\n    DiffScope,\n    DiffRange,\n    ChangedFilesOptions,\n} from './diff-scope';\nexport { AbstractRule } from './abstract-rule';\nexport {\n    WEBPIECES_DISABLE,\n    RULE_NAMES,\n    hasDisable,\n    WEBPIECES_TMP_DIR,\n    MERGE_INFO_DIR,\n    PR_REVIEW_DIR,\n    MERGE_IN_PROGRESS_FILE,\n    MERGE_EXPLANATION_FILE,\n} from './constants';\nexport { WebpiecesRulesConfig } from './WebpiecesRulesConfig';\nexport {\n    SyncFlowGuidance,\n    WP_START_UPDATE,\n    WP_FINISH_UPDATE,\n    WP_START_UPSERT_PR,\n    WP_FINISH_UPSERT_PR,\n} from './sync-flow-guidance';\nexport {\n    MaxMethodLinesConfig,\n    MaxFileLinesConfig,\n    RequireReturnTypeConfig,\n    NoInlineTypeLiteralsConfig,\n    NoAnyUnknownConfig,\n    NoImplicitAnyConfig,\n    PrismaValidateDtosConfig,\n    PrismaConverterConfig,\n    NoDestructureConfig,\n    NoUnmanagedExceptionsConfig,\n    CatchErrorPatternConfig,\n    ThrowCauseRequiredConfig,\n    AngularNoDirectApiInResolverConfig,\n    NoSymbolDiTokensConfig,\n    NoCustomCssConfig,\n    NoProcessExitOutsideMainConfig,\n    NoFunctionOutsideClassConfig,\n    InjectAnnotationNotNeededForConcreteClassConfig,\n    FrameworkTagConfig,\n    RoleTagConfig,\n    BranchCreationGuardConfig,\n    PrCreationOrPushGuardConfig,\n    MergeInProgressGuardConfig,\n    PrMergeGuardConfig,\n    RedirectHowToMergeMainConfig,\n    NoFileImportCyclesConfig,\n    RuntimeArchitectureConfig,\n    NxWiringConfig,\n    DiGraphConfig,\n    NoJsFilesConfig,\n    ValidateTsInSrcConfig,\n    ValidateArchitectureUnchangedConfig,\n    ValidateNoArchitectureCyclesConfig,\n    ValidatePackageJsonConfig,\n    ValidateVersionsLockedConfig,\n    ValidateEslintSyncConfig,\n    BaseRuleConfig,\n} from './rule-configs';\n// Mode unions + their value arrays — the single source of truth shared with code-rules.\nexport {\n    METHOD_LIMIT_MODES,\n    FILE_LIMIT_MODES,\n    RETURN_TYPE_MODES,\n    INLINE_TYPE_MODES,\n    MODIFIED_CODE_MODES,\n    PROJECT_MODES,\n    PRISMA_DTOS_MODES,\n    PRISMA_CONVERTER_MODES,\n    DIRECT_API_RESOLVER_MODES,\n    THROW_CAUSE_MODES,\n    ON_OFF_MODES,\n    STRUCTURAL_MODES,\n    VALIDATE_TS_MODES,\n} from './rule-configs';\nexport {\n    NoClientCreationOutsideServerOrClientConfig,\n    CLIENT_CREATION_SEVERITIES,\n} from './no-client-creation-config';\nexport type { ClientCreationSeverity } from './no-client-creation-config';\nexport type {\n    MethodLimitMode,\n    FileLimitMode,\n    ReturnTypeMode,\n    InlineTypeMode,\n    ModifiedCodeMode,\n    ProjectMode,\n    PrismaValidateDtosMode,\n    PrismaConverterMode,\n    DirectApiResolverMode,\n    ThrowCauseMode,\n    OnOffMode,\n    StructuralMode,\n    ValidateTsMode,\n} from './rule-configs';\nexport {\n    FeatureBranchGuardConfig,\n    ReadStaleGuardConfig,\n    MergedBranchBashGuardConfig,\n    StaleMainBashGuardConfig,\n} from './main-sync-guard-configs';\nexport {\n    GateDefinition,\n    PrGateConfig,\n    LandPrConfig,\n    ReviewContextEntry,\n    defaultGates,\n    defaultPrGateConfig,\n    defaultLandPrConfig,\n    buildPrGateConfig,\n    buildLandPrConfig,\n    MERGE_MODE_AUTO,\n    MERGE_MODE_NONE,\n    MERGE_MODES,\n} from './pr-gate-config';\nexport {\n    ChecklistDefinition,\n    toChecklist,\n    normalizeChecklistDoc,\n    formatFileList,\n} from './checklist-config';\nexport type { RawChecklistItem } from './checklist-config';\nexport { ChecklistValidator } from './checklist-validator';\nexport { ChecklistInstructionsService } from './checklist-instructions';\nexport {\n    ReviewerInstructionsService,\n    ReviewerBriefing,\n    BriefedFile,\n    ContextEntry,\n    READ_TRUNCATION_LINES,\n    ALL_DIFF_ONE_READ_LINES,\n} from './reviewer-instructions';\nexport {\n    GateTokenService,\n    computeGateToken,\n    gateTokenMarker,\n    extractGateToken,\n    verifyGateToken,\n} from './gate-token';\nexport {\n    SubagentProvenanceService,\n    ReviewerEvidence,\n    EvidenceRequest,\n    TranscriptScan,\n    ProvenanceResult,\n    PROVENANCE_OK,\n    PROVENANCE_MISSING,\n    PROVENANCE_SKIPPED,\n} from './subagent-provenance';\nexport {\n    ReviewProvenanceService,\n    ReviewProvenance,\n    ReviewerTranscript,\n    ReviewerPaths,\n    OfferedContext,\n    ProvenanceWriteRequest,\n    DEFAULT_RETENTION_DAYS,\n} from './review-provenance';\nexport {\n    ReviewJson,\n    PrContext,\n    ChecklistResult,\n    ChecklistVerdict,\n    CK_PASS,\n    CK_WARN,\n    CK_OVERRIDDEN,\n    CK_FAIL,\n    CK_MISSING,\n    CK_BAD_FORMAT,\n    VERDICT_GREEN,\n    VERDICT_YELLOW,\n    VERDICT_RED,\n    VERDICT_STATUSES,\n    RequiredChecklist,\n    ChecklistReviewContext,\n    ReviewJsonService,\n    loadReviewJson,\n    prDirFor,\n    reviewJsonPath,\n    reviewJsonSchemaHint,\n} from './review-json';\nexport {\n    MainSyncStatus,\n    MainSyncStatusFile,\n    MainSyncFileStore,\n    PullRequestIndex,\n    MAIN_SYNC_STATUS_VERSION,\n} from './main-sync-file';\nexport {\n    MainSyncLock,\n    MainSyncStatusService,\n    DEFAULT_HANG_TIMEOUT_MINUTES,\n    mainSyncStatusPath,\n    mainSyncLockPath,\n    readMainSyncStatus,\n    readMainSyncStatusFile,\n    writeMainSyncStatus,\n    writeMainSyncStatusFile,\n    computeAllMainSyncStatuses,\n    readMainSyncLock,\n    writeMainSyncLock,\n    isLockStale,\n    isRefreshInProgress,\n    tryAcquireMainSyncLock,\n    inProcessLock,\n    finishedLock,\n    computeMainSyncStatus,\n    stampCleanMainSyncStatus,\n    squashRecoverySteps,\n} from './main-sync-status';\nexport {\n    MergedBranch,\n    DeletableBranch,\n    DeletableWorktree,\n    MergedBranchesCache,\n    MergedBranchesService,\n    CacheFreshness,\n    CACHE_STALE_AFTER_MS,\n    CLASSIFICATION_MERGED_PR,\n    CLASSIFICATION_BACKUP_OF_MERGED,\n    CLASSIFICATION_BACKUP_OF_LIVE,\n    CLASSIFICATION_NO_COMMITS,\n    CLASSIFICATION_SUPERSEDED,\n    CLASSIFICATION_CONTENT_IN_MAIN,\n    CLASSIFICATION_NEVER_PROPOSED,\n    CLASSIFICATION_IN_USE,\n    CLASSIFICATION_PRUNABLE,\n    CLASSIFICATION_LOCKED,\n    CLASSIFICATION_CURRENT,\n    CLASSIFICATION_DETACHED,\n    PROMPTABLE_CLASSIFICATIONS,\n} from './merged-branches';\nexport {\n    BranchArchiver,\n    ArchiveResult,\n    ARCHIVE_TAG_PREFIX,\n    BRANCH_RETENTIONS,\n    BRANCH_RETENTION_DELETE,\n    BRANCH_RETENTION_ARCHIVE_TAG,\n    BRANCH_RETENTION_KEEP,\n} from './branch-archiver';\nexport {\n    Worktree,\n    WorktreeService,\n} from './worktrees';\nexport {\n    ReapedBranch,\n    ReapResult,\n    BranchReaper,\n} from './branch-reaper';\nexport {\n    ReapedWorktree,\n    WorktreeReapResult,\n    WorktreeReaper,\n} from './worktree-reaper';\nexport type { MutationVerb, MutationPhase } from './branch-mutation-log';\nexport {\n    BranchMutationEvent,\n    BranchMutationLog,\n    branchMutationLogPath,\n    logBranchMutation,\n} from './branch-mutation-log';\nexport {\n    CommandsConfig,\n    buildCommandsConfig,\n    DEFAULT_UPSERT_PR_COMMAND,\n    DEFAULT_MERGE_COMPLETE_COMMAND,\n} from './commands-config';\n"]}

package/src/load-config.js

@@ -6,6 +6,7 @@ const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const inversify_1 = require("inversify");
 const commands_config_1 = require("./commands-config");
+const config_error_banner_1 = require("./config-error-banner");
 const config_file_1 = require("./config-file");
 const default_rules_1 = require("./default-rules");
 const exclude_hook_paths_1 = require("./exclude-hook-paths");
@@ -169,23 +170,10 @@ let ConfigLoader = class ConfigLoader {
         typed.rulesDir = rulesDir;
         return typed;
     }
-    // Assemble the validation-failure banner. Most of these errors are version skew, not bad config.
+    // Assemble the validation-failure banner. Every error here came from validating this ONE file, so
+    // the cure is always "edit it" — see config-error-banner.ts for why nothing else belongs in it.
     formatConfigErrorsBanner(errors) {
-        return (`webpieces.config.json has ${errors.length} validation error(s) — fix ALL, then retry:\n\n` +
-            errors.map(e => `  • ${e}`).join('\n') +
-            `\n\n👉 FIX ORDER (do NOT start by deleting keys — that usually deletes VALID config):\n` +
-            `  1. Run \`pnpm install\`. It is ALWAYS allowed through the guard (installer bypass), even ` +
-            `while this config is invalid. This is the #1 cause: your installed @webpieces guard is a ` +
-            `release BEHIND webpieces.config.json (a dep bump updated the config + lockfile, but ` +
-            `node_modules here was never re-installed), so the running validator doesn't know the newer ` +
-            `rule names/values yet. \`pnpm install\` syncs node_modules to the pinned version.\n` +
-            `  2. Retry your command. If the errors are gone, you're DONE — do not touch webpieces.config.json.\n` +
-            `  3. ONLY if an error survives a fresh install is it a genuine typo / removed / renamed rule. ` +
-            `Then edit webpieces.config.json (edits to it are ALWAYS allowed) to fix each • above.\n` +
-            `  4. A "RETIRED key" error above already names where the value moved — apply that instruction ` +
-            `literally; there is no fallback that will accept the old shape. ` +
-            `\`pnpm wp-install-ai-hooks --sync\` performs the mechanical migrations. Background: ` +
-            `.webpieces/instruct-ai/webpieces.config-policy.md`);
+        return (0, config_error_banner_1.formatConfigErrorsBanner)(errors);
     }
 };
 exports.ConfigLoader = ConfigLoader;

package/src/load-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/load-config.ts"],"names":[],"mappings":";;;AAmNA,0CAEC;;AArND,mDAA6B;AAC7B,yCAA2D;AAE3D,uDAAwE;AACxE,+CAA2C;AAC3C,mDAA+C;AAC/C,6DAAoD;AACpD,uDAAkD;AAElD,mCAA0E;AAC1E,+EAAwE;AACxE,yDAA0D;AAC1D,uDAAuI;AAEvI,iEAA8D;AAE9D;;;GAGG;AACH,MAAa,YAAY;IAGR;IACA;IACA;IACA;IACA;IACA;IACA;IARb,yDAAyD;IACzD,YACa,QAAwB,EACxB,WAAiC,EACjC,QAAwB,EACxB,MAAoB,EACpB,YAA0B,EAC1B,UAAsC,EACtC,UAAyB;QANzB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,gBAAW,GAAX,WAAW,CAAsB;QACjC,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAc;QACpB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAA4B;QACtC,eAAU,GAAV,UAAU,CAAe;IACnC,CAAC;CACP;AAXD,oCAWC;AAED,wGAAwG;AACxG,2GAA2G;AAC3G,kGAAkG;AAClG,oGAAoG;AAEpG;;;;GAIG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACQ;IAA7B,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD;;;;OAIG;IACH,kGAAkG;IAClG,eAAe,CAAC,GAAW;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,aAAa,GAAG,IAAA,qCAAmB,EAAC,SAAS,CAAC,CAAC;YACrD,OAAO,IAAI,YAAY,CACnB,IAAI,sBAAc,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAClD,IAAI,2CAAoB,EAAE,EAC1B,aAAa,EACb,aAAa,CAAC,MAAM,EACpB,IAAI,iCAAY,CAAC,EAAE,CAAC,EACpB,EAAE,EACF,IAAI,CACP,CAAC;QACN,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,iBAAiB,GAAG,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC;QAC1D,4FAA4F;QAC5F,iGAAiG;QACjG,MAAM,YAAY,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAE/C,8FAA8F;QAC9F,iEAAiE;QACjE,MAAM,aAAa,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAEhE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,IAAI,EAAE,CAAC;QAE/C,iGAAiG;QACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG;YACX,+FAA+F;YAC/F,GAAG,IAAA,uCAAoB,EAAC,cAAoD,CAAC;YAC7E,GAAG,IAAA,yCAAuB,EAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC9D,GAAG,IAAA,0CAAwB,EAAC,YAAY,EAAE,iBAAiB,CAAC;YAC5D,GAAG,IAAA,qDAAuB,EAAC,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;YAC3E,GAAG,IAAA,sCAAoB,EAAC,cAAc,CAAC,YAAY,CAAC;YACpD,GAAG,IAAA,2CAAyB,EAAC,cAAc,CAAC,aAAa,CAAC,CAAC;SAC9D,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,+BAAa,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,qCAAmB,EAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEnD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;QAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;YACzB,GAAG,MAAM,CAAC,IAAI,CAAC,4BAAY,CAAC;YAC5B,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;SAChC,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAC9B,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,4BAAY,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,sBAAc,CAAC,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEhG,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;QAEvE,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACpH,CAAC;IAED,mGAAmG;IACnG,gGAAgG;IACxF,oBAAoB;IACxB,mEAAmE;IACnE,KAA8C,EAC9C,QAAwB;QAExB,MAAM,UAAU,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtD,IAAI,UAAU,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,UAAU,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACtD,CAAC;QACD,MAAM,eAAe,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzD,IAAI,eAAe,IAAI,eAAe,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3E,eAAe,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC;QACrE,CAAC;IACL,CAAC;IAED,kFAAkF;IAC1E,SAAS;IACb,wDAAwD;IACxD,QAA6C;IAC7C,wDAAwD;IACxD,YAAiD;QAEjD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,0BAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,0BAAkB,CAAC,YAA4B,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,0BAAkB,CAAC,QAAuB,CAAC,CAAC;QAE1E,iEAAiE;QACjE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7E,OAAO,IAAI,0BAAkB,CAAC,MAAqB,CAAC,CAAC;IACzD,CAAC;IAED,sGAAsG;IACtG,wGAAwG;IACxG,8DAA8D;IAC9D,wFAAwF;IAChF,iBAAiB,CAAC,GAAY;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,iCAAY,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,iCAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,oGAAoG;IACpG,oGAAoG;IACpG,wDAAwD;IACxD,oGAAoG;IAC5F,eAAe,CAAC,GAAY;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,GAAwB,CAAC;IACpC,CAAC;IAEO,yBAAyB;IAC7B,4FAA4F;IAC5F,QAAiD,EACjD,QAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,2CAAoB,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,4EAA4E;YAC3E,KAAiC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,iGAAiG;IACzF,wBAAwB,CAAC,MAAgB;QAC7C,OAAO,CACH,6BAA6B,MAAM,CAAC,MAAM,iDAAiD;YAC3F,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACtC,yFAAyF;YACzF,6FAA6F;YAC7F,2FAA2F;YAC3F,sFAAsF;YACtF,6FAA6F;YAC7F,qFAAqF;YACrF,sGAAsG;YACtG,gGAAgG;YAChG,yFAAyF;YACzF,gGAAgG;YAChG,kEAAkE;YAClE,sFAAsF;YACtF,mDAAmD,CACtD,CAAC;IACN,CAAC;CACJ,CAAA;AAhKY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEI,wBAAU;GAD1C,YAAY,CAgKxB;AAED,kGAAkG;AAClG,8FAA8F;AAC9F,MAAM,eAAe,GAAG,IAAI,YAAY,CAAC,IAAI,wBAAU,EAAE,CAAC,CAAC;AAE3D,2IAA2I;AAC3I,SAAgB,eAAe,CAAC,GAAW;IACvC,OAAO,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC","sourcesContent":["import * as path from 'path';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nimport { buildCommandsConfig, CommandsConfig } from './commands-config';\nimport { ConfigFile } from './config-file';\nimport { defaultRules } from './default-rules';\nimport { ExcludePaths } from './exclude-hook-paths';\nimport { InformAiError } from './inform-ai-error';\nimport { PrGateConfig } from './pr-gate-config';\nimport { ResolvedConfig, ResolvedRuleConfig, RuleOptions } from './types';\nimport { validateCommandsSection } from './commands-section-validators';\nimport { validateTopLevelKeys } from './config-key-rules';\nimport { validateExcludePaths, validateMatchRulesSection, validateSectionPlacement, validateWebpiecesConfig } from './validate-config';\nimport { MatchRuleConfig } from './match-rules-config';\nimport { WebpiecesRulesConfig } from './WebpiecesRulesConfig';\n\n/**\n * Everything a consumer might need from webpieces.config.json, produced from ONE parse + ONE\n * validation pass. Data-only (per CLAUDE.md, classes for data).\n */\nexport class LoadedConfig {\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(\n        readonly resolved: ResolvedConfig,\n        readonly rulesConfig: WebpiecesRulesConfig,\n        readonly commands: CommandsConfig,\n        readonly prGate: PrGateConfig,\n        readonly excludePaths: ExcludePaths,\n        readonly matchRules: readonly MatchRuleConfig[],\n        readonly configPath: string | null,\n    ) {}\n}\n\n// Renamed rules used to be normalized here — a DEPRECATED_RULE_ALIASES table rewrote the old key to its\n// canonical name BEFORE validation, so no validator ever saw it and no consumer was ever told. That is why\n// the aliases could never be removed: the old names kept working forever. The renames now live in\n// RETIRED_CONFIG_KEYS as hard errors naming the new key. See retired-config-keys.ts for the policy.\n\n/**\n * The single load+validate entry point for ALL consumers (ai-hook-rules, code-rules,\n * nx-webpieces-rules, pr-gate scripts). `@injectable(bindingScopeValues.Singleton)` + injects {@link ConfigFile} so it appears\n * in the rules-config DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ConfigLoader {\n    constructor(private readonly configFile: ConfigFile) {}\n\n    /**\n     * Reads webpieces.config.json once, validates BOTH the `rules` map and the top-level `pr-gate`\n     * block, and throws one InformAiError listing every error. When no config file is found it returns\n     * lenient empties/defaults (matching prior no-file behavior).\n     */\n    // webpieces-disable max-lines-new-methods -- the single load+validate pass is one cohesive method\n    loadAndValidate(cwd: string): LoadedConfig {\n        const configPath = this.configFile.findConfigFile(cwd);\n        if (!configPath) {\n            const emptyCommands = buildCommandsConfig(undefined);\n            return new LoadedConfig(\n                new ResolvedConfig(new Map(), new Set(), [], null),\n                new WebpiecesRulesConfig(),\n                emptyCommands,\n                emptyCommands.prGate,\n                new ExcludePaths([]),\n                [],\n                null,\n            );\n        }\n\n        const consumerConfig = this.configFile.readRawConfig(configPath);\n        const rulesSection = consumerConfig.rules || {};\n        const hookGuardsSection = consumerConfig.hookGuards || {};\n        // Read only so validateCommandsSection can REJECT it. There is no fallback to it — a config\n        // carrying the retired top-level block never loads, so reading it as a value would be dead code.\n        const legacyPrGate = consumerConfig['pr-gate'];\n\n        // rules + hookGuards are validated/loaded as one flat name→config map (the runtime dispatches\n        // by each rule's own `scope`). Placement is enforced separately.\n        const overrideRules = { ...rulesSection, ...hookGuardsSection };\n\n        const rulesDir = consumerConfig.rulesDir ?? [];\n\n        // The repo root (dir holding webpieces.config.json) lets checklists[].docs existence be checked.\n        const repoRoot = path.dirname(configPath);\n        const errors = [\n            // webpieces-disable no-any-unknown -- the raw parsed config is opaque; only key names are read\n            ...validateTopLevelKeys(consumerConfig as unknown as Record<string, unknown>),\n            ...validateWebpiecesConfig(overrideRules, rulesDir.length > 0),\n            ...validateSectionPlacement(rulesSection, hookGuardsSection),\n            ...validateCommandsSection(consumerConfig.commands, legacyPrGate, repoRoot),\n            ...validateExcludePaths(consumerConfig.excludePaths),\n            ...validateMatchRulesSection(consumerConfig['match-rules']),\n        ];\n        if (errors.length > 0) {\n            throw new InformAiError(this.formatConfigErrorsBanner(errors));\n        }\n\n        const commands = buildCommandsConfig(consumerConfig.commands);\n        this.applyCommandDefaults(overrideRules, commands);\n\n        const userConfiguredRuleNames = new Set(Object.keys(overrideRules));\n        const mergedRules = new Map<string, ResolvedRuleConfig>();\n        const allRuleNames = new Set([\n            ...Object.keys(defaultRules),\n            ...Object.keys(overrideRules),\n        ]);\n        for (const name of allRuleNames) {\n            mergedRules.set(name, this.mergeRule(defaultRules[name], overrideRules[name]));\n        }\n        const resolved = new ResolvedConfig(mergedRules, userConfiguredRuleNames, rulesDir, configPath);\n\n        const rulesConfig = this.buildWebpiecesRulesConfig(overrideRules, rulesDir);\n        const excludePaths = this.parseExcludePaths(consumerConfig.excludePaths);\n        const matchRules = this.parseMatchRules(consumerConfig['match-rules']);\n\n        return new LoadedConfig(resolved, rulesConfig, commands, commands.prGate, excludePaths, matchRules, configPath);\n    }\n\n    // Inject the canonical command strings (from the `commands` section) as the DEFAULT for the guards\n    // that surface them in their fix hints. Only fills a gap — an explicit per-guard override wins.\n    private applyCommandDefaults(\n        // webpieces-disable no-any-unknown -- opaque merged rule/guard map\n        rules: Record<string, Record<string, unknown>>,\n        commands: CommandsConfig,\n    ): void {\n        const prCreation = rules['pr-creation-or-push-guard'];\n        if (prCreation && prCreation['upsertPrCommand'] === undefined) {\n            prCreation['upsertPrCommand'] = commands.upsertPr;\n        }\n        const mergeInProgress = rules['merge-in-progress-guard'];\n        if (mergeInProgress && mergeInProgress['mergeCompleteCommand'] === undefined) {\n            mergeInProgress['mergeCompleteCommand'] = commands.mergeComplete;\n        }\n    }\n\n    // webpieces-disable no-any-unknown -- merging opaque option bags from config JSON\n    private mergeRule(\n        // webpieces-disable no-any-unknown -- opaque option bag\n        baseRule: Record<string, unknown> | undefined,\n        // webpieces-disable no-any-unknown -- opaque option bag\n        overrideRule: Record<string, unknown> | undefined,\n    ): ResolvedRuleConfig {\n        if (!baseRule && !overrideRule) return new ResolvedRuleConfig({ mode: 'OFF' });\n        if (!baseRule) return new ResolvedRuleConfig(overrideRule! as RuleOptions);\n        if (!overrideRule) return new ResolvedRuleConfig(baseRule as RuleOptions);\n\n        // webpieces-disable no-any-unknown -- building merged option bag\n        const merged: Record<string, unknown> = {};\n        for (const key of Object.keys(baseRule)) merged[key] = baseRule[key];\n        for (const key of Object.keys(overrideRule)) merged[key] = overrideRule[key];\n        return new ResolvedRuleConfig(merged as RuleOptions);\n    }\n\n    // Parse the (already-validated) raw excludePaths block into the typed ExcludePaths. The ONLY accepted\n    // shape is a bare string[]; the retired two-list object cannot reach here, because validateExcludePaths\n    // has already failed the load with the migration instruction.\n    // webpieces-disable no-any-unknown -- `raw` is opaque consumer JSON until narrowed here\n    private parseExcludePaths(raw: unknown): ExcludePaths {\n        if (!Array.isArray(raw)) return new ExcludePaths([]);\n        return new ExcludePaths(raw.filter(p => typeof p === 'string'));\n    }\n\n    // Parse the (already-validated) raw match-rules array into typed MatchRuleConfig[]. The entries use\n    // the canonical field names (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch) that the match-rules\n    // engine reads directly, so no normalization is needed.\n    // webpieces-disable no-any-unknown -- validated array; each entry cast to the typed MatchRuleConfig\n    private parseMatchRules(raw: unknown): MatchRuleConfig[] {\n        if (!Array.isArray(raw)) return [];\n        return raw as MatchRuleConfig[];\n    }\n\n    private buildWebpiecesRulesConfig(\n        // webpieces-disable no-any-unknown -- JSON values are opaque until assigned to typed fields\n        rawRules: Record<string, Record<string, unknown>>,\n        rulesDir: string[],\n    ): WebpiecesRulesConfig {\n        const typed = new WebpiecesRulesConfig();\n        for (const key of Object.keys(rawRules)) {\n            // webpieces-disable no-any-unknown -- dynamic key assignment to typed class\n            (typed as Record<string, unknown>)[key] = rawRules[key];\n        }\n        typed.rulesDir = rulesDir;\n        return typed;\n    }\n\n    // Assemble the validation-failure banner. Most of these errors are version skew, not bad config.\n    private formatConfigErrorsBanner(errors: string[]): string {\n        return (\n            `webpieces.config.json has ${errors.length} validation error(s) — fix ALL, then retry:\\n\\n` +\n            errors.map(e => `  • ${e}`).join('\\n') +\n            `\\n\\n👉 FIX ORDER (do NOT start by deleting keys — that usually deletes VALID config):\\n` +\n            `  1. Run \\`pnpm install\\`. It is ALWAYS allowed through the guard (installer bypass), even ` +\n            `while this config is invalid. This is the #1 cause: your installed @webpieces guard is a ` +\n            `release BEHIND webpieces.config.json (a dep bump updated the config + lockfile, but ` +\n            `node_modules here was never re-installed), so the running validator doesn't know the newer ` +\n            `rule names/values yet. \\`pnpm install\\` syncs node_modules to the pinned version.\\n` +\n            `  2. Retry your command. If the errors are gone, you're DONE — do not touch webpieces.config.json.\\n` +\n            `  3. ONLY if an error survives a fresh install is it a genuine typo / removed / renamed rule. ` +\n            `Then edit webpieces.config.json (edits to it are ALWAYS allowed) to fix each • above.\\n` +\n            `  4. A \"RETIRED key\" error above already names where the value moved — apply that instruction ` +\n            `literally; there is no fallback that will accept the old shape. ` +\n            `\\`pnpm wp-install-ai-hooks --sync\\` performs the mechanical migrations. Background: ` +\n            `.webpieces/instruct-ai/webpieces.config-policy.md`\n        );\n    }\n}\n\n// Temporary migration delegator — consumers migrate to injecting ConfigLoader over follow-up PRs,\n// then this free function is removed. The logic now lives in the injected ConfigLoader class.\nconst configLoaderSvc = new ConfigLoader(new ConfigFile());\n\n// webpieces-disable no-function-outside-class -- temporary back-compat delegator to ConfigLoader; removed once all 118 consumers inject it\nexport function loadAndValidate(cwd: string): LoadedConfig {\n    return configLoaderSvc.loadAndValidate(cwd);\n}\n"]}
+{"version":3,"file":"load-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/load-config.ts"],"names":[],"mappings":";;;AAqMA,0CAEC;;AAvMD,mDAA6B;AAC7B,yCAA2D;AAE3D,uDAAwE;AACxE,+DAAiE;AACjE,+CAA2C;AAC3C,mDAA+C;AAC/C,6DAAoD;AACpD,uDAAkD;AAElD,mCAA0E;AAC1E,+EAAwE;AACxE,yDAA0D;AAC1D,uDAAuI;AAEvI,iEAA8D;AAE9D;;;GAGG;AACH,MAAa,YAAY;IAGR;IACA;IACA;IACA;IACA;IACA;IACA;IARb,yDAAyD;IACzD,YACa,QAAwB,EACxB,WAAiC,EACjC,QAAwB,EACxB,MAAoB,EACpB,YAA0B,EAC1B,UAAsC,EACtC,UAAyB;QANzB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,gBAAW,GAAX,WAAW,CAAsB;QACjC,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAc;QACpB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAA4B;QACtC,eAAU,GAAV,UAAU,CAAe;IACnC,CAAC;CACP;AAXD,oCAWC;AAED,wGAAwG;AACxG,2GAA2G;AAC3G,kGAAkG;AAClG,oGAAoG;AAEpG;;;;GAIG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACQ;IAA7B,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD;;;;OAIG;IACH,kGAAkG;IAClG,eAAe,CAAC,GAAW;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,aAAa,GAAG,IAAA,qCAAmB,EAAC,SAAS,CAAC,CAAC;YACrD,OAAO,IAAI,YAAY,CACnB,IAAI,sBAAc,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAClD,IAAI,2CAAoB,EAAE,EAC1B,aAAa,EACb,aAAa,CAAC,MAAM,EACpB,IAAI,iCAAY,CAAC,EAAE,CAAC,EACpB,EAAE,EACF,IAAI,CACP,CAAC;QACN,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,iBAAiB,GAAG,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC;QAC1D,4FAA4F;QAC5F,iGAAiG;QACjG,MAAM,YAAY,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAE/C,8FAA8F;QAC9F,iEAAiE;QACjE,MAAM,aAAa,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAEhE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,IAAI,EAAE,CAAC;QAE/C,iGAAiG;QACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG;YACX,+FAA+F;YAC/F,GAAG,IAAA,uCAAoB,EAAC,cAAoD,CAAC;YAC7E,GAAG,IAAA,yCAAuB,EAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC9D,GAAG,IAAA,0CAAwB,EAAC,YAAY,EAAE,iBAAiB,CAAC;YAC5D,GAAG,IAAA,qDAAuB,EAAC,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;YAC3E,GAAG,IAAA,sCAAoB,EAAC,cAAc,CAAC,YAAY,CAAC;YACpD,GAAG,IAAA,2CAAyB,EAAC,cAAc,CAAC,aAAa,CAAC,CAAC;SAC9D,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,+BAAa,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,qCAAmB,EAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEnD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;QAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;YACzB,GAAG,MAAM,CAAC,IAAI,CAAC,4BAAY,CAAC;YAC5B,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;SAChC,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAC9B,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,4BAAY,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,sBAAc,CAAC,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEhG,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;QAEvE,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACpH,CAAC;IAED,mGAAmG;IACnG,gGAAgG;IACxF,oBAAoB;IACxB,mEAAmE;IACnE,KAA8C,EAC9C,QAAwB;QAExB,MAAM,UAAU,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtD,IAAI,UAAU,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,UAAU,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACtD,CAAC;QACD,MAAM,eAAe,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzD,IAAI,eAAe,IAAI,eAAe,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3E,eAAe,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC;QACrE,CAAC;IACL,CAAC;IAED,kFAAkF;IAC1E,SAAS;IACb,wDAAwD;IACxD,QAA6C;IAC7C,wDAAwD;IACxD,YAAiD;QAEjD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,0BAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,0BAAkB,CAAC,YAA4B,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,0BAAkB,CAAC,QAAuB,CAAC,CAAC;QAE1E,iEAAiE;QACjE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7E,OAAO,IAAI,0BAAkB,CAAC,MAAqB,CAAC,CAAC;IACzD,CAAC;IAED,sGAAsG;IACtG,wGAAwG;IACxG,8DAA8D;IAC9D,wFAAwF;IAChF,iBAAiB,CAAC,GAAY;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,iCAAY,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,iCAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,oGAAoG;IACpG,oGAAoG;IACpG,wDAAwD;IACxD,oGAAoG;IAC5F,eAAe,CAAC,GAAY;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,GAAwB,CAAC;IACpC,CAAC;IAEO,yBAAyB;IAC7B,4FAA4F;IAC5F,QAAiD,EACjD,QAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,2CAAoB,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,4EAA4E;YAC3E,KAAiC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,kGAAkG;IAClG,gGAAgG;IACxF,wBAAwB,CAAC,MAAgB;QAC7C,OAAO,IAAA,8CAAwB,EAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;CACJ,CAAA;AAjJY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEI,wBAAU;GAD1C,YAAY,CAiJxB;AAED,kGAAkG;AAClG,8FAA8F;AAC9F,MAAM,eAAe,GAAG,IAAI,YAAY,CAAC,IAAI,wBAAU,EAAE,CAAC,CAAC;AAE3D,2IAA2I;AAC3I,SAAgB,eAAe,CAAC,GAAW;IACvC,OAAO,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC","sourcesContent":["import * as path from 'path';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nimport { buildCommandsConfig, CommandsConfig } from './commands-config';\nimport { formatConfigErrorsBanner } from './config-error-banner';\nimport { ConfigFile } from './config-file';\nimport { defaultRules } from './default-rules';\nimport { ExcludePaths } from './exclude-hook-paths';\nimport { InformAiError } from './inform-ai-error';\nimport { PrGateConfig } from './pr-gate-config';\nimport { ResolvedConfig, ResolvedRuleConfig, RuleOptions } from './types';\nimport { validateCommandsSection } from './commands-section-validators';\nimport { validateTopLevelKeys } from './config-key-rules';\nimport { validateExcludePaths, validateMatchRulesSection, validateSectionPlacement, validateWebpiecesConfig } from './validate-config';\nimport { MatchRuleConfig } from './match-rules-config';\nimport { WebpiecesRulesConfig } from './WebpiecesRulesConfig';\n\n/**\n * Everything a consumer might need from webpieces.config.json, produced from ONE parse + ONE\n * validation pass. Data-only (per CLAUDE.md, classes for data).\n */\nexport class LoadedConfig {\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(\n        readonly resolved: ResolvedConfig,\n        readonly rulesConfig: WebpiecesRulesConfig,\n        readonly commands: CommandsConfig,\n        readonly prGate: PrGateConfig,\n        readonly excludePaths: ExcludePaths,\n        readonly matchRules: readonly MatchRuleConfig[],\n        readonly configPath: string | null,\n    ) {}\n}\n\n// Renamed rules used to be normalized here — a DEPRECATED_RULE_ALIASES table rewrote the old key to its\n// canonical name BEFORE validation, so no validator ever saw it and no consumer was ever told. That is why\n// the aliases could never be removed: the old names kept working forever. The renames now live in\n// RETIRED_CONFIG_KEYS as hard errors naming the new key. See retired-config-keys.ts for the policy.\n\n/**\n * The single load+validate entry point for ALL consumers (ai-hook-rules, code-rules,\n * nx-webpieces-rules, pr-gate scripts). `@injectable(bindingScopeValues.Singleton)` + injects {@link ConfigFile} so it appears\n * in the rules-config DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ConfigLoader {\n    constructor(private readonly configFile: ConfigFile) {}\n\n    /**\n     * Reads webpieces.config.json once, validates BOTH the `rules` map and the top-level `pr-gate`\n     * block, and throws one InformAiError listing every error. When no config file is found it returns\n     * lenient empties/defaults (matching prior no-file behavior).\n     */\n    // webpieces-disable max-lines-new-methods -- the single load+validate pass is one cohesive method\n    loadAndValidate(cwd: string): LoadedConfig {\n        const configPath = this.configFile.findConfigFile(cwd);\n        if (!configPath) {\n            const emptyCommands = buildCommandsConfig(undefined);\n            return new LoadedConfig(\n                new ResolvedConfig(new Map(), new Set(), [], null),\n                new WebpiecesRulesConfig(),\n                emptyCommands,\n                emptyCommands.prGate,\n                new ExcludePaths([]),\n                [],\n                null,\n            );\n        }\n\n        const consumerConfig = this.configFile.readRawConfig(configPath);\n        const rulesSection = consumerConfig.rules || {};\n        const hookGuardsSection = consumerConfig.hookGuards || {};\n        // Read only so validateCommandsSection can REJECT it. There is no fallback to it — a config\n        // carrying the retired top-level block never loads, so reading it as a value would be dead code.\n        const legacyPrGate = consumerConfig['pr-gate'];\n\n        // rules + hookGuards are validated/loaded as one flat name→config map (the runtime dispatches\n        // by each rule's own `scope`). Placement is enforced separately.\n        const overrideRules = { ...rulesSection, ...hookGuardsSection };\n\n        const rulesDir = consumerConfig.rulesDir ?? [];\n\n        // The repo root (dir holding webpieces.config.json) lets checklists[].docs existence be checked.\n        const repoRoot = path.dirname(configPath);\n        const errors = [\n            // webpieces-disable no-any-unknown -- the raw parsed config is opaque; only key names are read\n            ...validateTopLevelKeys(consumerConfig as unknown as Record<string, unknown>),\n            ...validateWebpiecesConfig(overrideRules, rulesDir.length > 0),\n            ...validateSectionPlacement(rulesSection, hookGuardsSection),\n            ...validateCommandsSection(consumerConfig.commands, legacyPrGate, repoRoot),\n            ...validateExcludePaths(consumerConfig.excludePaths),\n            ...validateMatchRulesSection(consumerConfig['match-rules']),\n        ];\n        if (errors.length > 0) {\n            throw new InformAiError(this.formatConfigErrorsBanner(errors));\n        }\n\n        const commands = buildCommandsConfig(consumerConfig.commands);\n        this.applyCommandDefaults(overrideRules, commands);\n\n        const userConfiguredRuleNames = new Set(Object.keys(overrideRules));\n        const mergedRules = new Map<string, ResolvedRuleConfig>();\n        const allRuleNames = new Set([\n            ...Object.keys(defaultRules),\n            ...Object.keys(overrideRules),\n        ]);\n        for (const name of allRuleNames) {\n            mergedRules.set(name, this.mergeRule(defaultRules[name], overrideRules[name]));\n        }\n        const resolved = new ResolvedConfig(mergedRules, userConfiguredRuleNames, rulesDir, configPath);\n\n        const rulesConfig = this.buildWebpiecesRulesConfig(overrideRules, rulesDir);\n        const excludePaths = this.parseExcludePaths(consumerConfig.excludePaths);\n        const matchRules = this.parseMatchRules(consumerConfig['match-rules']);\n\n        return new LoadedConfig(resolved, rulesConfig, commands, commands.prGate, excludePaths, matchRules, configPath);\n    }\n\n    // Inject the canonical command strings (from the `commands` section) as the DEFAULT for the guards\n    // that surface them in their fix hints. Only fills a gap — an explicit per-guard override wins.\n    private applyCommandDefaults(\n        // webpieces-disable no-any-unknown -- opaque merged rule/guard map\n        rules: Record<string, Record<string, unknown>>,\n        commands: CommandsConfig,\n    ): void {\n        const prCreation = rules['pr-creation-or-push-guard'];\n        if (prCreation && prCreation['upsertPrCommand'] === undefined) {\n            prCreation['upsertPrCommand'] = commands.upsertPr;\n        }\n        const mergeInProgress = rules['merge-in-progress-guard'];\n        if (mergeInProgress && mergeInProgress['mergeCompleteCommand'] === undefined) {\n            mergeInProgress['mergeCompleteCommand'] = commands.mergeComplete;\n        }\n    }\n\n    // webpieces-disable no-any-unknown -- merging opaque option bags from config JSON\n    private mergeRule(\n        // webpieces-disable no-any-unknown -- opaque option bag\n        baseRule: Record<string, unknown> | undefined,\n        // webpieces-disable no-any-unknown -- opaque option bag\n        overrideRule: Record<string, unknown> | undefined,\n    ): ResolvedRuleConfig {\n        if (!baseRule && !overrideRule) return new ResolvedRuleConfig({ mode: 'OFF' });\n        if (!baseRule) return new ResolvedRuleConfig(overrideRule! as RuleOptions);\n        if (!overrideRule) return new ResolvedRuleConfig(baseRule as RuleOptions);\n\n        // webpieces-disable no-any-unknown -- building merged option bag\n        const merged: Record<string, unknown> = {};\n        for (const key of Object.keys(baseRule)) merged[key] = baseRule[key];\n        for (const key of Object.keys(overrideRule)) merged[key] = overrideRule[key];\n        return new ResolvedRuleConfig(merged as RuleOptions);\n    }\n\n    // Parse the (already-validated) raw excludePaths block into the typed ExcludePaths. The ONLY accepted\n    // shape is a bare string[]; the retired two-list object cannot reach here, because validateExcludePaths\n    // has already failed the load with the migration instruction.\n    // webpieces-disable no-any-unknown -- `raw` is opaque consumer JSON until narrowed here\n    private parseExcludePaths(raw: unknown): ExcludePaths {\n        if (!Array.isArray(raw)) return new ExcludePaths([]);\n        return new ExcludePaths(raw.filter(p => typeof p === 'string'));\n    }\n\n    // Parse the (already-validated) raw match-rules array into typed MatchRuleConfig[]. The entries use\n    // the canonical field names (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch) that the match-rules\n    // engine reads directly, so no normalization is needed.\n    // webpieces-disable no-any-unknown -- validated array; each entry cast to the typed MatchRuleConfig\n    private parseMatchRules(raw: unknown): MatchRuleConfig[] {\n        if (!Array.isArray(raw)) return [];\n        return raw as MatchRuleConfig[];\n    }\n\n    private buildWebpiecesRulesConfig(\n        // webpieces-disable no-any-unknown -- JSON values are opaque until assigned to typed fields\n        rawRules: Record<string, Record<string, unknown>>,\n        rulesDir: string[],\n    ): WebpiecesRulesConfig {\n        const typed = new WebpiecesRulesConfig();\n        for (const key of Object.keys(rawRules)) {\n            // webpieces-disable no-any-unknown -- dynamic key assignment to typed class\n            (typed as Record<string, unknown>)[key] = rawRules[key];\n        }\n        typed.rulesDir = rulesDir;\n        return typed;\n    }\n\n    // Assemble the validation-failure banner. Every error here came from validating this ONE file, so\n    // the cure is always \"edit it\" — see config-error-banner.ts for why nothing else belongs in it.\n    private formatConfigErrorsBanner(errors: string[]): string {\n        return formatConfigErrorsBanner(errors);\n    }\n}\n\n// Temporary migration delegator — consumers migrate to injecting ConfigLoader over follow-up PRs,\n// then this free function is removed. The logic now lives in the injected ConfigLoader class.\nconst configLoaderSvc = new ConfigLoader(new ConfigFile());\n\n// webpieces-disable no-function-outside-class -- temporary back-compat delegator to ConfigLoader; removed once all 118 consumers inject it\nexport function loadAndValidate(cwd: string): LoadedConfig {\n    return configLoaderSvc.loadAndValidate(cwd);\n}\n"]}

package/src/retired-config-keys.d.ts

@@ -51,6 +51,9 @@ export declare const RETIRED_CONFIG_KEYS: readonly RetiredConfigKey[];
 /**
  * The shared message. Leads with the retirement, then the destination, then the edit — an agent reading this
  * should not have to infer anything.
+ *
+ * RETIRED_KEY_MARKER is the phrase the banner classifier keys off to call this error DEFINITIVE (no
+ * install can revive a key this table names), so the marker is IMPORTED rather than re-typed here.
  */
 export declare function retiredKeyError(entry: RetiredConfigKey): string;
 /**

package/src/retired-config-keys.js

@@ -40,6 +40,7 @@ exports.retiredRuleFor = retiredRuleFor;
 exports.isRetiredKey = isRetiredKey;
 exports.retiredEntry = retiredEntry;
 exports.retiredKeyErrorsIn = retiredKeyErrorsIn;
+const config_error_banner_1 = require("./config-error-banner");
 // A retired key is matched one of two ways, because config keys live at two very different levels.
 // RULE — a rule/guard NAME, which may sit under either `rules` or `hookGuards`, so it is matched by bare
 //        name rather than by a fixed path.
@@ -99,13 +100,16 @@ exports.RETIRED_CONFIG_KEYS = [
 /**
  * The shared message. Leads with the retirement, then the destination, then the edit — an agent reading this
  * should not have to infer anything.
+ *
+ * RETIRED_KEY_MARKER is the phrase the banner classifier keys off to call this error DEFINITIVE (no
+ * install can revive a key this table names), so the marker is IMPORTED rather than re-typed here.
  */
 // webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package
 function retiredKeyError(entry) {
     const destination = entry.movedTo === ''
         ? 'It was removed with no replacement.'
         : `It moved to "${entry.movedTo}".`;
-    return `${entry.label} "${entry.key}" is a RETIRED webpieces.config.json key. ${destination} ${entry.instruction}`;
+    return `${entry.label} "${entry.key}" ${config_error_banner_1.RETIRED_KEY_MARKER}. ${destination} ${entry.instruction}`;
 }
 /**
  * The retired entry for a rule/guard NAME, or null. Callers must consult this BEFORE reporting a name as an

package/src/retired-config-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"retired-config-keys.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/retired-config-keys.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;AA4FH,0CAKC;AAQD,wCAEC;AAQD,oCAEC;AAQD,oCAEC;AAKD,gDAIC;AAtID,mGAAmG;AACnG,yGAAyG;AACzG,2CAA2C;AAC3C,kFAAkF;AACrE,QAAA,kBAAkB,GAAG,MAAM,CAAC;AAC5B,QAAA,iBAAiB,GAAG,KAAK,CAAC;AAEvC,kGAAkG;AAClG,MAAa,gBAAgB;IACzB,KAAK,CAAS;IACd,0DAA0D;IAC1D,GAAG,CAAS;IACZ,+FAA+F;IAC/F,OAAO,CAAS;IAChB,gEAAgE;IAChE,WAAW,CAAS;IACpB,0GAA0G;IAC1G,KAAK,CAAS;IAEd,yDAAyD;IACzD,YAAY,KAAa,EAAE,GAAW,EAAE,OAAe,EAAE,WAAmB,EAAE,KAAa;QACvF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AAnBD,4CAmBC;AAED;;;GAGG;AACU,QAAA,mBAAmB,GAAgC;IAC5D,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,uDAAuD;IACvD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EACxD,uEAAuE,EACvE,oBAAoB,CACvB;IACD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EACpE,mGAAmG;QACnG,yFAAyF,EACzF,qBAAqB,CACxB;IACD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAC1D,kGAAkG;QAClG,kGAAkG;QAClG,mCAAmC,EACnC,oBAAoB,CACvB;IAED,oGAAoG;IACpG,uFAAuF;IACvF,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,UAAU,EAAE,sCAAsC,EACrE,6FAA6F;QAC7F,kCAAkC,EAClC,YAAY,CACf;IACD,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,eAAe,EAAE,qCAAqC,EACzE,4FAA4F;QAC5F,uCAAuC,EACvC,YAAY,CACf;IAED,uGAAuG;IACvG,uGAAuG;IACvG,wGAAwG;IACxG,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,OAAO,EAAE,+BAA+B,EAC3D,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,4EAA4E,EAC5E,gBAAgB,CACnB;CACJ,CAAC;AAEF;;;GAGG;AACH,iHAAiH;AACjH,SAAgB,eAAe,CAAC,KAAuB;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,EAAE;QACpC,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,gBAAgB,KAAK,CAAC,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,6CAA6C,WAAW,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;AACvH,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,cAAc,CAAC,QAAgB;IAC3C,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,0BAAkB,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,YAAY,CAAC,GAAW,EAAE,KAAa;IACnD,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,YAAY,CAAC,GAAW,EAAE,KAAa;IACnD,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC;AACtH,CAAC;AAED,0GAA0G;AAC1G,mGAAmG;AACnG,iHAAiH;AACjH,SAAgB,kBAAkB,CAAC,OAAgC,EAAE,KAAa;IAC9E,OAAO,2BAAmB;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC;SACnF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Retired webpieces.config.json keys — the ONE place in the codebase where a dead config key may be named.\n *\n * ## THE POLICY: webpieces.config.json is never released backwards-compatible\n *\n * When a config key moves, is renamed, or is deleted, the loader REJECTS the old shape with an error that\n * names the destination. It does NOT quietly accept both. There is no fallback, no alias table applied\n * before validation, no \"still accepted for back-compat until every consumer migrates\".\n *\n * This is safe *here* in a way it is not for a normal library, and the reason is the consumer: every reader\n * of this file is a coding agent. The config is validated on startup, the agent is handed the exact edit,\n * and it applies it in one pass — so the upgrade is seamless without shipping a compatibility layer. That\n * makes a hard failure strictly cheaper than duality: two accepted shapes means two code paths, two sets of\n * defaults and two sets of error messages to keep honest forever, and the stale shape then lives in\n * consumer configs indefinitely because nothing ever forces the edit.\n *\n * A hard rejection here is always self-recoverable, which is what makes it safe to do:\n *   - editing webpieces.config.json is ALWAYS permitted, even while the config is invalid (see the banner\n *     in config-file.ts and the guard matrix — a Write/Edit targeting this file is an unconditional PASS),\n *   - `pnpm install` is ALWAYS permitted (installer bypass), which fixes the far more common cause of a\n *     validation failure: an installed validator lagging the config by a release.\n * So rejecting an old shape can never wedge a repo. \"It would deadlock the consumer\" is not a reason to add\n * a fallback; it is not true.\n *\n * ## Adding an entry\n *\n * When you retire a key, add it here and DELETE its read path — do not leave a `??` fallback behind. The\n * `instruction` is the whole product: it is read by an agent that will act on it verbatim, so give the\n * mechanical edit (\"rename X to Y\", \"move A into B\"), not a description of the change. Saying where a thing\n * moved to is exactly the point of this table; it is what makes the fallback unnecessary.\n *\n * retired-config-keys.spec.ts asserts every entry below actually FAILS the load. That spec is the guard: a\n * future fallback that silently swallows a retired key turns it red.\n */\n\n// A retired key is matched one of two ways, because config keys live at two very different levels.\n// RULE — a rule/guard NAME, which may sit under either `rules` or `hookGuards`, so it is matched by bare\n//        name rather than by a fixed path.\n// KEY  — a plain key inside a known section, matched by name within that section.\nexport const RETIRED_SCOPE_RULE = 'rule';\nexport const RETIRED_SCOPE_KEY = 'key';\n\n/** One retired config key and the mechanical edit that replaces it. Data-only (per CLAUDE.md). */\nexport class RetiredConfigKey {\n    scope: string;\n    // The key exactly as it appears in webpieces.config.json.\n    key: string;\n    // Where the value goes now. Empty string when the key is deleted outright with no replacement.\n    movedTo: string;\n    // The imperative fix, written for the agent that will apply it.\n    instruction: string;\n    // Bracketed label leading the error, matching the `[rule-name]` / `[section]` convention in this package.\n    label: string;\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(scope: string, key: string, movedTo: string, instruction: string, label: string) {\n        this.scope = scope;\n        this.key = key;\n        this.movedTo = movedTo;\n        this.instruction = instruction;\n        this.label = label;\n    }\n}\n\n/**\n * Every retired key. Keep the newest at the bottom with the release that retired it, so the list reads as a\n * changelog an agent can walk when a config is several versions behind.\n */\nexport const RETIRED_CONFIG_KEYS: readonly RetiredConfigKey[] = [\n    // --- Guard renames. Previously applied SILENTLY before validation (a DEPRECATED_RULE_ALIASES table in\n    // load-config.ts rewrote the key so no validator ever saw it). That hid the rename from the config file\n    // forever: the old name kept working, so no consumer ever updated, and the alias table could never be\n    // deleted. Now each is a hard error with the new name.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'pr-merge-cleanup', 'pr-merge-guard',\n        'Rename the key to \"pr-merge-guard\". Its value carries over unchanged.',\n        '[pr-merge-cleanup]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'pr-creation-guard', 'pr-creation-or-push-guard',\n        'Rename the key to \"pr-creation-or-push-guard\" — the guard grew a second blocked action (a manual ' +\n        'git push), so it is no longer only about PR creation. Its value carries over unchanged.',\n        '[pr-creation-guard]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'main-stale-guard', 'read-stale-guard',\n        'Rename the key to \"read-stale-guard\" — the guard grew a second blocked state (an already-merged ' +\n        'feature branch), so it is no longer about `main` at all; it is THE guard that can block a Read. ' +\n        'Its value carries over unchanged.',\n        '[main-stale-guard]',\n    ),\n\n    // --- The two flat guard-hint strings, superseded by commands.guardHints so that every guard-facing\n    // command string sits in one named sub-object instead of loose beside the gate config.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'upsertPr', 'commands.guardHints.prCreationOrPush',\n        'Move the value to \"guardHints\": { \"prCreationOrPush\": <value> } inside the same \"commands\" ' +\n        'section, then delete \"upsertPr\".',\n        '[commands]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'mergeComplete', 'commands.guardHints.mergeInProgress',\n        'Move the value to \"guardHints\": { \"mergeInProgress\": <value> } inside the same \"commands\" ' +\n        'section, then delete \"mergeComplete\".',\n        '[commands]',\n    ),\n\n    // --- The two-list excludePaths object. The split never earned its keep (every consumer set both lists\n    // to the same value), and the one case that would need them to differ is served better by a rule's own\n    // `excludePaths`. Retired as a SHAPE: `rules` is the entry validateExcludePaths reports for either key.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'rules', 'excludePaths (one flat array)',\n        'Replace the whole { \"rules\": [...], \"guards\": [...] } object with ONE array holding the union of ' +\n        'both lists, de-duplicated — e.g. \"excludePaths\": [\"repositories/**\"]. A path is governed by ' +\n        'webpieces or it is not, so there is no longer a per-engine split. To exclude a path from one rule ' +\n        'only, use that rule\\'s own \"excludePaths\" inside its config block instead.',\n        '[excludePaths]',\n    ),\n];\n\n/**\n * The shared message. Leads with the retirement, then the destination, then the edit — an agent reading this\n * should not have to infer anything.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredKeyError(entry: RetiredConfigKey): string {\n    const destination = entry.movedTo === ''\n        ? 'It was removed with no replacement.'\n        : `It moved to \"${entry.movedTo}\".`;\n    return `${entry.label} \"${entry.key}\" is a RETIRED webpieces.config.json key. ${destination} ${entry.instruction}`;\n}\n\n/**\n * The retired entry for a rule/guard NAME, or null. Callers must consult this BEFORE reporting a name as an\n * unknown rule: the unknown-rule message leads with \"run `pnpm install`, your validator may be stale\", which\n * is exactly the wrong advice for a name we know is dead.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredRuleFor(ruleName: string): RetiredConfigKey | null {\n    return RETIRED_CONFIG_KEYS.find(e => e.scope === RETIRED_SCOPE_RULE && e.key === ruleName) ?? null;\n}\n\n/**\n * Whether `key` is retired within `label`'s section. Unknown-key rejection consults this so a retired key\n * gets its migration message instead of a generic \"unknown key, delete it\" — the migration instruction is\n * the entire reason this table exists.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function isRetiredKey(key: string, label: string): boolean {\n    return RETIRED_CONFIG_KEYS.some(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key === key);\n}\n\n/**\n * The retired entry for `key` within `label`'s section. For a retirement that is a SHAPE rather than a\n * single key (the excludePaths object), the validator looks the entry up directly so one table row remains\n * the single source of the message.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredEntry(key: string, label: string): RetiredConfigKey | null {\n    return RETIRED_CONFIG_KEYS.find(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key === key) ?? null;\n}\n\n/** Errors for every retired plain key present in `section`. `label` scopes the lookup to that section. */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON; only key PRESENCE is read\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredKeyErrorsIn(section: Record<string, unknown>, label: string): string[] {\n    return RETIRED_CONFIG_KEYS\n        .filter(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key in section)\n        .map(e => retiredKeyError(e));\n}\n"]}
+{"version":3,"file":"retired-config-keys.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/retired-config-keys.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;AAiGH,0CAKC;AAQD,wCAEC;AAQD,oCAEC;AAQD,oCAEC;AAKD,gDAIC;AA3ID,+DAA2D;AAE3D,mGAAmG;AACnG,yGAAyG;AACzG,2CAA2C;AAC3C,kFAAkF;AACrE,QAAA,kBAAkB,GAAG,MAAM,CAAC;AAC5B,QAAA,iBAAiB,GAAG,KAAK,CAAC;AAEvC,kGAAkG;AAClG,MAAa,gBAAgB;IACzB,KAAK,CAAS;IACd,0DAA0D;IAC1D,GAAG,CAAS;IACZ,+FAA+F;IAC/F,OAAO,CAAS;IAChB,gEAAgE;IAChE,WAAW,CAAS;IACpB,0GAA0G;IAC1G,KAAK,CAAS;IAEd,yDAAyD;IACzD,YAAY,KAAa,EAAE,GAAW,EAAE,OAAe,EAAE,WAAmB,EAAE,KAAa;QACvF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AAnBD,4CAmBC;AAED;;;GAGG;AACU,QAAA,mBAAmB,GAAgC;IAC5D,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,uDAAuD;IACvD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EACxD,uEAAuE,EACvE,oBAAoB,CACvB;IACD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EACpE,mGAAmG;QACnG,yFAAyF,EACzF,qBAAqB,CACxB;IACD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAC1D,kGAAkG;QAClG,kGAAkG;QAClG,mCAAmC,EACnC,oBAAoB,CACvB;IAED,oGAAoG;IACpG,uFAAuF;IACvF,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,UAAU,EAAE,sCAAsC,EACrE,6FAA6F;QAC7F,kCAAkC,EAClC,YAAY,CACf;IACD,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,eAAe,EAAE,qCAAqC,EACzE,4FAA4F;QAC5F,uCAAuC,EACvC,YAAY,CACf;IAED,uGAAuG;IACvG,uGAAuG;IACvG,wGAAwG;IACxG,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,OAAO,EAAE,+BAA+B,EAC3D,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,4EAA4E,EAC5E,gBAAgB,CACnB;CACJ,CAAC;AAEF;;;;;;GAMG;AACH,iHAAiH;AACjH,SAAgB,eAAe,CAAC,KAAuB;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,EAAE;QACpC,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,gBAAgB,KAAK,CAAC,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,KAAK,wCAAkB,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,cAAc,CAAC,QAAgB;IAC3C,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,0BAAkB,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,YAAY,CAAC,GAAW,EAAE,KAAa;IACnD,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,YAAY,CAAC,GAAW,EAAE,KAAa;IACnD,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC;AACtH,CAAC;AAED,0GAA0G;AAC1G,mGAAmG;AACnG,iHAAiH;AACjH,SAAgB,kBAAkB,CAAC,OAAgC,EAAE,KAAa;IAC9E,OAAO,2BAAmB;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC;SACnF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Retired webpieces.config.json keys — the ONE place in the codebase where a dead config key may be named.\n *\n * ## THE POLICY: webpieces.config.json is never released backwards-compatible\n *\n * When a config key moves, is renamed, or is deleted, the loader REJECTS the old shape with an error that\n * names the destination. It does NOT quietly accept both. There is no fallback, no alias table applied\n * before validation, no \"still accepted for back-compat until every consumer migrates\".\n *\n * This is safe *here* in a way it is not for a normal library, and the reason is the consumer: every reader\n * of this file is a coding agent. The config is validated on startup, the agent is handed the exact edit,\n * and it applies it in one pass — so the upgrade is seamless without shipping a compatibility layer. That\n * makes a hard failure strictly cheaper than duality: two accepted shapes means two code paths, two sets of\n * defaults and two sets of error messages to keep honest forever, and the stale shape then lives in\n * consumer configs indefinitely because nothing ever forces the edit.\n *\n * A hard rejection here is always self-recoverable, which is what makes it safe to do:\n *   - editing webpieces.config.json is ALWAYS permitted, even while the config is invalid (see the banner\n *     in config-file.ts and the guard matrix — a Write/Edit targeting this file is an unconditional PASS),\n *   - `pnpm install` is ALWAYS permitted (installer bypass), which fixes the far more common cause of a\n *     validation failure: an installed validator lagging the config by a release.\n * So rejecting an old shape can never wedge a repo. \"It would deadlock the consumer\" is not a reason to add\n * a fallback; it is not true.\n *\n * ## Adding an entry\n *\n * When you retire a key, add it here and DELETE its read path — do not leave a `??` fallback behind. The\n * `instruction` is the whole product: it is read by an agent that will act on it verbatim, so give the\n * mechanical edit (\"rename X to Y\", \"move A into B\"), not a description of the change. Saying where a thing\n * moved to is exactly the point of this table; it is what makes the fallback unnecessary.\n *\n * retired-config-keys.spec.ts asserts every entry below actually FAILS the load. That spec is the guard: a\n * future fallback that silently swallows a retired key turns it red.\n */\n\nimport { RETIRED_KEY_MARKER } from './config-error-banner';\n\n// A retired key is matched one of two ways, because config keys live at two very different levels.\n// RULE — a rule/guard NAME, which may sit under either `rules` or `hookGuards`, so it is matched by bare\n//        name rather than by a fixed path.\n// KEY  — a plain key inside a known section, matched by name within that section.\nexport const RETIRED_SCOPE_RULE = 'rule';\nexport const RETIRED_SCOPE_KEY = 'key';\n\n/** One retired config key and the mechanical edit that replaces it. Data-only (per CLAUDE.md). */\nexport class RetiredConfigKey {\n    scope: string;\n    // The key exactly as it appears in webpieces.config.json.\n    key: string;\n    // Where the value goes now. Empty string when the key is deleted outright with no replacement.\n    movedTo: string;\n    // The imperative fix, written for the agent that will apply it.\n    instruction: string;\n    // Bracketed label leading the error, matching the `[rule-name]` / `[section]` convention in this package.\n    label: string;\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(scope: string, key: string, movedTo: string, instruction: string, label: string) {\n        this.scope = scope;\n        this.key = key;\n        this.movedTo = movedTo;\n        this.instruction = instruction;\n        this.label = label;\n    }\n}\n\n/**\n * Every retired key. Keep the newest at the bottom with the release that retired it, so the list reads as a\n * changelog an agent can walk when a config is several versions behind.\n */\nexport const RETIRED_CONFIG_KEYS: readonly RetiredConfigKey[] = [\n    // --- Guard renames. Previously applied SILENTLY before validation (a DEPRECATED_RULE_ALIASES table in\n    // load-config.ts rewrote the key so no validator ever saw it). That hid the rename from the config file\n    // forever: the old name kept working, so no consumer ever updated, and the alias table could never be\n    // deleted. Now each is a hard error with the new name.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'pr-merge-cleanup', 'pr-merge-guard',\n        'Rename the key to \"pr-merge-guard\". Its value carries over unchanged.',\n        '[pr-merge-cleanup]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'pr-creation-guard', 'pr-creation-or-push-guard',\n        'Rename the key to \"pr-creation-or-push-guard\" — the guard grew a second blocked action (a manual ' +\n        'git push), so it is no longer only about PR creation. Its value carries over unchanged.',\n        '[pr-creation-guard]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'main-stale-guard', 'read-stale-guard',\n        'Rename the key to \"read-stale-guard\" — the guard grew a second blocked state (an already-merged ' +\n        'feature branch), so it is no longer about `main` at all; it is THE guard that can block a Read. ' +\n        'Its value carries over unchanged.',\n        '[main-stale-guard]',\n    ),\n\n    // --- The two flat guard-hint strings, superseded by commands.guardHints so that every guard-facing\n    // command string sits in one named sub-object instead of loose beside the gate config.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'upsertPr', 'commands.guardHints.prCreationOrPush',\n        'Move the value to \"guardHints\": { \"prCreationOrPush\": <value> } inside the same \"commands\" ' +\n        'section, then delete \"upsertPr\".',\n        '[commands]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'mergeComplete', 'commands.guardHints.mergeInProgress',\n        'Move the value to \"guardHints\": { \"mergeInProgress\": <value> } inside the same \"commands\" ' +\n        'section, then delete \"mergeComplete\".',\n        '[commands]',\n    ),\n\n    // --- The two-list excludePaths object. The split never earned its keep (every consumer set both lists\n    // to the same value), and the one case that would need them to differ is served better by a rule's own\n    // `excludePaths`. Retired as a SHAPE: `rules` is the entry validateExcludePaths reports for either key.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'rules', 'excludePaths (one flat array)',\n        'Replace the whole { \"rules\": [...], \"guards\": [...] } object with ONE array holding the union of ' +\n        'both lists, de-duplicated — e.g. \"excludePaths\": [\"repositories/**\"]. A path is governed by ' +\n        'webpieces or it is not, so there is no longer a per-engine split. To exclude a path from one rule ' +\n        'only, use that rule\\'s own \"excludePaths\" inside its config block instead.',\n        '[excludePaths]',\n    ),\n];\n\n/**\n * The shared message. Leads with the retirement, then the destination, then the edit — an agent reading this\n * should not have to infer anything.\n *\n * RETIRED_KEY_MARKER is the phrase the banner classifier keys off to call this error DEFINITIVE (no\n * install can revive a key this table names), so the marker is IMPORTED rather than re-typed here.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredKeyError(entry: RetiredConfigKey): string {\n    const destination = entry.movedTo === ''\n        ? 'It was removed with no replacement.'\n        : `It moved to \"${entry.movedTo}\".`;\n    return `${entry.label} \"${entry.key}\" ${RETIRED_KEY_MARKER}. ${destination} ${entry.instruction}`;\n}\n\n/**\n * The retired entry for a rule/guard NAME, or null. Callers must consult this BEFORE reporting a name as an\n * unknown rule: the unknown-rule message leads with \"run `pnpm install`, your validator may be stale\", which\n * is exactly the wrong advice for a name we know is dead.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredRuleFor(ruleName: string): RetiredConfigKey | null {\n    return RETIRED_CONFIG_KEYS.find(e => e.scope === RETIRED_SCOPE_RULE && e.key === ruleName) ?? null;\n}\n\n/**\n * Whether `key` is retired within `label`'s section. Unknown-key rejection consults this so a retired key\n * gets its migration message instead of a generic \"unknown key, delete it\" — the migration instruction is\n * the entire reason this table exists.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function isRetiredKey(key: string, label: string): boolean {\n    return RETIRED_CONFIG_KEYS.some(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key === key);\n}\n\n/**\n * The retired entry for `key` within `label`'s section. For a retirement that is a SHAPE rather than a\n * single key (the excludePaths object), the validator looks the entry up directly so one table row remains\n * the single source of the message.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredEntry(key: string, label: string): RetiredConfigKey | null {\n    return RETIRED_CONFIG_KEYS.find(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key === key) ?? null;\n}\n\n/** Errors for every retired plain key present in `section`. `label` scopes the lookup to that section. */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON; only key PRESENCE is read\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredKeyErrorsIn(section: Record<string, unknown>, label: string): string[] {\n    return RETIRED_CONFIG_KEYS\n        .filter(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key in section)\n        .map(e => retiredKeyError(e));\n}\n"]}

package/src/sync-flow-guidance.d.ts

@@ -33,6 +33,17 @@ export declare class SyncFlowGuidance {
      * interpolated straight into the shim's double-quoted shell REASON string.
      */
     updateMainAdvice(): string;
+    /**
+     * The FEATURE-BRANCH half, split out of updateMainAdvice() on purpose.
+     *
+     * It names `wp-start-update` / `wp-start-upsert-pr`, and NEITHER is on the L0 allowlist — correctly
+     * so, since a 3-point merge is not a tooling-integrity cure. While an L0 fault is up, printing this
+     * sentence unqualified hands the reader a command the guard will reject, which is the deadlock shape
+     * the whole L0 module exists to prevent. So a caller printing this from inside an L0 deny must first
+     * say how to CLEAR the fault (for drift: `pnpm install`), and only then offer this. Same free of
+     * backticks / `$` / `"` as its sibling, so it stays safe inside the shim's double-quoted REASON.
+     */
+    featureBranchSyncAdvice(): string;
     /**
      * The read-only alternatives, for when the AI only wanted to LOOK at how it stands vs main. This
      * exists because `git merge --ff-only origin/main` gets typed as if it were a query — it is not,

package/src/sync-flow-guidance.js

@@ -96,7 +96,20 @@ class SyncFlowGuidance {
             + '\'git fetch origin main\' and branch off origin/main. Do NOT reach for git merge '
             + '--ff-only / git reset --hard / git checkout -B main: merge and rebase are blocked in '
             + 'EVERY form by redirect-how-to-merge-main, and the reset/-B forms silently throw away '
-            + 'commits. To sync a FEATURE branch from main use pnpm wp-start-update (no PR open) or '
+            + 'commits.';
+    }
+    /**
+     * The FEATURE-BRANCH half, split out of updateMainAdvice() on purpose.
+     *
+     * It names `wp-start-update` / `wp-start-upsert-pr`, and NEITHER is on the L0 allowlist — correctly
+     * so, since a 3-point merge is not a tooling-integrity cure. While an L0 fault is up, printing this
+     * sentence unqualified hands the reader a command the guard will reject, which is the deadlock shape
+     * the whole L0 module exists to prevent. So a caller printing this from inside an L0 deny must first
+     * say how to CLEAR the fault (for drift: `pnpm install`), and only then offer this. Same free of
+     * backticks / `$` / `"` as its sibling, so it stays safe inside the shim's double-quoted REASON.
+     */
+    featureBranchSyncAdvice() {
+        return 'To sync a FEATURE branch from main use pnpm wp-start-update (no PR open) or '
             + 'pnpm wp-start-upsert-pr (a PR is open).';
     }
     /**

package/src/sync-flow-guidance.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-flow-guidance.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/sync-flow-guidance.ts"],"names":[],"mappings":";AAAA,oFAAoF;AACpF,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,wBAAwB;;;AAExB,6EAA6E;AAChE,QAAA,eAAe,GAAG,sBAAsB,CAAC;AACzC,QAAA,gBAAgB,GAAG,uBAAuB,CAAC;AAC3C,QAAA,kBAAkB,GAAG,yBAAyB,CAAC;AAC/C,QAAA,mBAAmB,GAAG,0BAA0B,CAAC;AAE9D;;;GAGG;AACH,MAAa,gBAAgB;IACzB;;;OAGG;IACH,KAAK;QACD,OAAO;YACH,4EAA4E;YAC5E,8CAA8C;YAC9C,EAAE;SACL;aACI,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;aAC7B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;aACZ,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;aACrB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;aACZ,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;aACZ,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,+BAA+B;IAC/B,cAAc;QACV,OAAO;YACH,qFAAqF;YACrF,WAAW,uBAAe,2DAA2D;YACrF,qFAAqF;YACrF,WAAW,wBAAgB,6CAA6C;SAC3E,CAAC;IACN,CAAC;IAED,iDAAiD;IACjD,MAAM;QACF,OAAO;YACH,qEAAqE;YACrE,WAAW,0BAAkB,oCAAoC;YACjE,qFAAqF;YACrF,WAAW,2BAAmB,yDAAyD;SAC1F,CAAC;IACN,CAAC;IAED,kGAAkG;IAClG,WAAW;QACP,OAAO;YACH,qFAAqF;YACrF,yCAAyC;YACzC,4CAA4C;SAC/C,CAAC;IACN,CAAC;IAED,8FAA8F;IAC9F,gBAAgB;QACZ,OAAO;YACH,6FAA6F;YAC7F,2FAA2F;YAC3F,8FAA8F;YAC9F,4FAA4F;YAC5F,4DAA4D;SAC/D,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,aAAqB;QAC7B,IAAI,aAAa,KAAK,kBAAkB;YAAE,OAAO,iBAAiB,CAAC;QACnE,IAAI,aAAa,KAAK,qBAAqB;YAAE,OAAO,oBAAoB,CAAC;QACzE,OAAO,aAAa,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACZ,OAAO,0FAA0F;cAC3F,iFAAiF;cACjF,mFAAmF;cACnF,uFAAuF;cACvF,uFAAuF;cACvF,uFAAuF;cACvF,yCAAyC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,cAAc;QACV,OAAO;YACH,4FAA4F;YAC5F,6FAA6F;YAC7F,0FAA0F;YAC1F,sFAAsF;YACtF,yFAAyF;YACzF,iGAAiG;YACjG,4FAA4F;YAC5F,2FAA2F;YAC3F,2FAA2F;YAC3F,kFAAkF;SACrF,CAAC;IACN,CAAC;CACJ;AA1GD,4CA0GC","sourcesContent":["// SINGLE SOURCE OF TRUTH for \"how do I bring main into my branch\" as told to an AI.\n//\n// Why this file exists: the guards and the pr-gate bins each used to hand-write their own version of\n// this advice, and they drifted — one message told the AI to START with `wp-start-update` and FINISH\n// with `wp-finish-upsert-pr`, which is a pairing that does not exist. An AI reading that cannot tell\n// which flow it is in. Every guard/bin message now renders from HERE, so the two flows can only ever\n// be described one way.\n\n// The four gated bins, as the AI must type them. Two flows, two halves each.\nexport const WP_START_UPDATE = 'pnpm wp-start-update';\nexport const WP_FINISH_UPDATE = 'pnpm wp-finish-update';\nexport const WP_START_UPSERT_PR = 'pnpm wp-start-upsert-pr';\nexport const WP_FINISH_UPSERT_PR = 'pnpm wp-finish-upsert-pr';\n\n/**\n * Renders the canonical guidance blocks. Methods return string[] (not a joined string) so callers can\n * indent//interleave them into their own message without re-wrapping.\n */\nexport class SyncFlowGuidance {\n    /**\n     * Both flows, ALWAYS paired. Use this when the caller does NOT know whether a PR is open — an AI\n     * shown only one flow picks it even when the other one is the correct one.\n     */\n    flows(): string[] {\n        return [\n            'There are exactly TWO flows. Which one you use is decided by ONE question:',\n            'is there already an OPEN PR for this branch?',\n            '',\n        ]\n            .concat(this.updateOnlyFlow())\n            .concat([''])\n            .concat(this.prFlow())\n            .concat([''])\n            .concat(this.pairingRule())\n            .concat([''])\n            .concat(this.whyPrForcesFlowB());\n    }\n\n    /** Flow A — no PR open yet. */\n    updateOnlyFlow(): string[] {\n        return [\n            '  A. NO PR yet — update-only flow (you are mid-work and just want main\\'s changes):',\n            `     1. ${WP_START_UPDATE}      ← 3-point merge from main (auto-finalizes if clean)`,\n            '     2. /wp-merge                 ← resolve conflicts (ONLY if step 1 reported any)',\n            `     3. ${WP_FINISH_UPDATE}     ← finalize (ONLY on the conflict path)`,\n        ];\n    }\n\n    /** Flow B — a PR is open (or is about to be). */\n    prFlow(): string[] {\n        return [\n            '  B. A PR IS ALREADY OPEN (or you are ready to post one) — PR flow:',\n            `     1. ${WP_START_UPSERT_PR}   ← same 3-point merge, then push`,\n            '     2. /wp-merge                 ← resolve conflicts (ONLY if step 1 reported any)',\n            `     3. ${WP_FINISH_UPSERT_PR}  ← authoritative build gate, then create/update the PR`,\n        ];\n    }\n\n    /** The half that keeps drifting: a start from one pair NEVER finishes with the other's finish. */\n    pairingRule(): string[] {\n        return [\n            'PAIRING IS NOT OPTIONAL — a start and a finish from different flows is not a thing:',\n            '  wp-start-update    → wp-finish-update',\n            '  wp-start-upsert-pr → wp-finish-upsert-pr',\n        ];\n    }\n\n    /** Why an open PR removes the choice. Safe to print on its own alongside just the PR flow. */\n    whyPrForcesFlowB(): string[] {\n        return [\n            'If a PR is open you MUST use the upsert-pr pair. The 3-point merge REWRITES this branch (it',\n            'squashes onto main and force-pushes a new generation), so the open PR\\'s history is blown',\n            'away and has to be re-pointed in the SAME run. The update-only pair never touches the PR, so',\n            'running it with a PR open would strand that PR on the OLD branch generation — which is why',\n            'wp-start-update refuses outright when it finds an open PR.',\n        ];\n    }\n\n    /**\n     * The start bin that PAIRS with a finish bin (bare names, no `pnpm` prefix) — so generated text can\n     * name the command that actually produced it instead of guessing one of the two. Anything\n     * unrecognized comes back unchanged rather than inventing a name.\n     */\n    pairedStart(finishCommand: string): string {\n        if (finishCommand === 'wp-finish-update') return 'wp-start-update';\n        if (finishCommand === 'wp-finish-upsert-pr') return 'wp-start-upsert-pr';\n        return finishCommand;\n    }\n\n    /**\n     * \"How do I get main itself current?\" — a DIFFERENT question from syncing a feature branch, and\n     * the one that had no answer in the merge block (which sent readers to reset --hard for lack of\n     * one). Single line, and deliberately free of backticks / `$` / double quotes so it can be\n     * interpolated straight into the shim's double-quoted shell REASON string.\n     */\n    updateMainAdvice(): string {\n        return 'To get main itself current: ON main, run \\'git pull origin main\\'. In a linked worktree '\n            + '(main is checked out in the primary clone, so checkout main fatals there), run '\n            + '\\'git fetch origin main\\' and branch off origin/main. Do NOT reach for git merge '\n            + '--ff-only / git reset --hard / git checkout -B main: merge and rebase are blocked in '\n            + 'EVERY form by redirect-how-to-merge-main, and the reset/-B forms silently throw away '\n            + 'commits. To sync a FEATURE branch from main use pnpm wp-start-update (no PR open) or '\n            + 'pnpm wp-start-upsert-pr (a PR is open).';\n    }\n\n    /**\n     * The read-only alternatives, for when the AI only wanted to LOOK at how it stands vs main. This\n     * exists because `git merge --ff-only origin/main` gets typed as if it were a query — it is not,\n     * it mutates the branch whenever it succeeds, which is exactly the case you were probing for.\n     */\n    readOnlyChecks(): string[] {\n        return [\n            'Only wanted to LOOK (am I behind main? would it fast-forward?) — none of the below mutate:',\n            '  git fetch origin main                                 ← refresh the remote ref (no merge)',\n            '  git merge-base --is-ancestor origin/main HEAD         ← exit 0 = already contains main',\n            '  git rev-list --left-right --count origin/main...HEAD  ← prints \"<behind>  <ahead>\"',\n            '  git log --oneline HEAD..origin/main                   ← what main has that you do not',\n            '  git diff --stat origin/main...HEAD                    ← what you changed since the fork point',\n            '  cat .webpieces/main-sync-status.json                  ← the tooling\\'s own answer, incl.',\n            '                                                          the files predicted to conflict',\n            '`git merge --ff-only` is NOT a look — it MUTATES on success (that is the whole point of a',\n            'fast-forward), so it is blocked like every other merge. Never use it as a probe.',\n        ];\n    }\n}\n"]}
+{"version":3,"file":"sync-flow-guidance.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/sync-flow-guidance.ts"],"names":[],"mappings":";AAAA,oFAAoF;AACpF,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,wBAAwB;;;AAExB,6EAA6E;AAChE,QAAA,eAAe,GAAG,sBAAsB,CAAC;AACzC,QAAA,gBAAgB,GAAG,uBAAuB,CAAC;AAC3C,QAAA,kBAAkB,GAAG,yBAAyB,CAAC;AAC/C,QAAA,mBAAmB,GAAG,0BAA0B,CAAC;AAE9D;;;GAGG;AACH,MAAa,gBAAgB;IACzB;;;OAGG;IACH,KAAK;QACD,OAAO;YACH,4EAA4E;YAC5E,8CAA8C;YAC9C,EAAE;SACL;aACI,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;aAC7B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;aACZ,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;aACrB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;aACZ,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;aACZ,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,+BAA+B;IAC/B,cAAc;QACV,OAAO;YACH,qFAAqF;YACrF,WAAW,uBAAe,2DAA2D;YACrF,qFAAqF;YACrF,WAAW,wBAAgB,6CAA6C;SAC3E,CAAC;IACN,CAAC;IAED,iDAAiD;IACjD,MAAM;QACF,OAAO;YACH,qEAAqE;YACrE,WAAW,0BAAkB,oCAAoC;YACjE,qFAAqF;YACrF,WAAW,2BAAmB,yDAAyD;SAC1F,CAAC;IACN,CAAC;IAED,kGAAkG;IAClG,WAAW;QACP,OAAO;YACH,qFAAqF;YACrF,yCAAyC;YACzC,4CAA4C;SAC/C,CAAC;IACN,CAAC;IAED,8FAA8F;IAC9F,gBAAgB;QACZ,OAAO;YACH,6FAA6F;YAC7F,2FAA2F;YAC3F,8FAA8F;YAC9F,4FAA4F;YAC5F,4DAA4D;SAC/D,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,aAAqB;QAC7B,IAAI,aAAa,KAAK,kBAAkB;YAAE,OAAO,iBAAiB,CAAC;QACnE,IAAI,aAAa,KAAK,qBAAqB;YAAE,OAAO,oBAAoB,CAAC;QACzE,OAAO,aAAa,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,gBAAgB;QACZ,OAAO,0FAA0F;cAC3F,iFAAiF;cACjF,mFAAmF;cACnF,uFAAuF;cACvF,uFAAuF;cACvF,UAAU,CAAC;IACrB,CAAC;IAED;;;;;;;;;OASG;IACH,uBAAuB;QACnB,OAAO,8EAA8E;cAC/E,yCAAyC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,cAAc;QACV,OAAO;YACH,4FAA4F;YAC5F,6FAA6F;YAC7F,0FAA0F;YAC1F,sFAAsF;YACtF,yFAAyF;YACzF,iGAAiG;YACjG,4FAA4F;YAC5F,2FAA2F;YAC3F,2FAA2F;YAC3F,kFAAkF;SACrF,CAAC;IACN,CAAC;CACJ;AAxHD,4CAwHC","sourcesContent":["// SINGLE SOURCE OF TRUTH for \"how do I bring main into my branch\" as told to an AI.\n//\n// Why this file exists: the guards and the pr-gate bins each used to hand-write their own version of\n// this advice, and they drifted — one message told the AI to START with `wp-start-update` and FINISH\n// with `wp-finish-upsert-pr`, which is a pairing that does not exist. An AI reading that cannot tell\n// which flow it is in. Every guard/bin message now renders from HERE, so the two flows can only ever\n// be described one way.\n\n// The four gated bins, as the AI must type them. Two flows, two halves each.\nexport const WP_START_UPDATE = 'pnpm wp-start-update';\nexport const WP_FINISH_UPDATE = 'pnpm wp-finish-update';\nexport const WP_START_UPSERT_PR = 'pnpm wp-start-upsert-pr';\nexport const WP_FINISH_UPSERT_PR = 'pnpm wp-finish-upsert-pr';\n\n/**\n * Renders the canonical guidance blocks. Methods return string[] (not a joined string) so callers can\n * indent//interleave them into their own message without re-wrapping.\n */\nexport class SyncFlowGuidance {\n    /**\n     * Both flows, ALWAYS paired. Use this when the caller does NOT know whether a PR is open — an AI\n     * shown only one flow picks it even when the other one is the correct one.\n     */\n    flows(): string[] {\n        return [\n            'There are exactly TWO flows. Which one you use is decided by ONE question:',\n            'is there already an OPEN PR for this branch?',\n            '',\n        ]\n            .concat(this.updateOnlyFlow())\n            .concat([''])\n            .concat(this.prFlow())\n            .concat([''])\n            .concat(this.pairingRule())\n            .concat([''])\n            .concat(this.whyPrForcesFlowB());\n    }\n\n    /** Flow A — no PR open yet. */\n    updateOnlyFlow(): string[] {\n        return [\n            '  A. NO PR yet — update-only flow (you are mid-work and just want main\\'s changes):',\n            `     1. ${WP_START_UPDATE}      ← 3-point merge from main (auto-finalizes if clean)`,\n            '     2. /wp-merge                 ← resolve conflicts (ONLY if step 1 reported any)',\n            `     3. ${WP_FINISH_UPDATE}     ← finalize (ONLY on the conflict path)`,\n        ];\n    }\n\n    /** Flow B — a PR is open (or is about to be). */\n    prFlow(): string[] {\n        return [\n            '  B. A PR IS ALREADY OPEN (or you are ready to post one) — PR flow:',\n            `     1. ${WP_START_UPSERT_PR}   ← same 3-point merge, then push`,\n            '     2. /wp-merge                 ← resolve conflicts (ONLY if step 1 reported any)',\n            `     3. ${WP_FINISH_UPSERT_PR}  ← authoritative build gate, then create/update the PR`,\n        ];\n    }\n\n    /** The half that keeps drifting: a start from one pair NEVER finishes with the other's finish. */\n    pairingRule(): string[] {\n        return [\n            'PAIRING IS NOT OPTIONAL — a start and a finish from different flows is not a thing:',\n            '  wp-start-update    → wp-finish-update',\n            '  wp-start-upsert-pr → wp-finish-upsert-pr',\n        ];\n    }\n\n    /** Why an open PR removes the choice. Safe to print on its own alongside just the PR flow. */\n    whyPrForcesFlowB(): string[] {\n        return [\n            'If a PR is open you MUST use the upsert-pr pair. The 3-point merge REWRITES this branch (it',\n            'squashes onto main and force-pushes a new generation), so the open PR\\'s history is blown',\n            'away and has to be re-pointed in the SAME run. The update-only pair never touches the PR, so',\n            'running it with a PR open would strand that PR on the OLD branch generation — which is why',\n            'wp-start-update refuses outright when it finds an open PR.',\n        ];\n    }\n\n    /**\n     * The start bin that PAIRS with a finish bin (bare names, no `pnpm` prefix) — so generated text can\n     * name the command that actually produced it instead of guessing one of the two. Anything\n     * unrecognized comes back unchanged rather than inventing a name.\n     */\n    pairedStart(finishCommand: string): string {\n        if (finishCommand === 'wp-finish-update') return 'wp-start-update';\n        if (finishCommand === 'wp-finish-upsert-pr') return 'wp-start-upsert-pr';\n        return finishCommand;\n    }\n\n    /**\n     * \"How do I get main itself current?\" — a DIFFERENT question from syncing a feature branch, and\n     * the one that had no answer in the merge block (which sent readers to reset --hard for lack of\n     * one). Single line, and deliberately free of backticks / `$` / double quotes so it can be\n     * interpolated straight into the shim's double-quoted shell REASON string.\n     */\n    updateMainAdvice(): string {\n        return 'To get main itself current: ON main, run \\'git pull origin main\\'. In a linked worktree '\n            + '(main is checked out in the primary clone, so checkout main fatals there), run '\n            + '\\'git fetch origin main\\' and branch off origin/main. Do NOT reach for git merge '\n            + '--ff-only / git reset --hard / git checkout -B main: merge and rebase are blocked in '\n            + 'EVERY form by redirect-how-to-merge-main, and the reset/-B forms silently throw away '\n            + 'commits.';\n    }\n\n    /**\n     * The FEATURE-BRANCH half, split out of updateMainAdvice() on purpose.\n     *\n     * It names `wp-start-update` / `wp-start-upsert-pr`, and NEITHER is on the L0 allowlist — correctly\n     * so, since a 3-point merge is not a tooling-integrity cure. While an L0 fault is up, printing this\n     * sentence unqualified hands the reader a command the guard will reject, which is the deadlock shape\n     * the whole L0 module exists to prevent. So a caller printing this from inside an L0 deny must first\n     * say how to CLEAR the fault (for drift: `pnpm install`), and only then offer this. Same free of\n     * backticks / `$` / `\"` as its sibling, so it stays safe inside the shim's double-quoted REASON.\n     */\n    featureBranchSyncAdvice(): string {\n        return 'To sync a FEATURE branch from main use pnpm wp-start-update (no PR open) or '\n            + 'pnpm wp-start-upsert-pr (a PR is open).';\n    }\n\n    /**\n     * The read-only alternatives, for when the AI only wanted to LOOK at how it stands vs main. This\n     * exists because `git merge --ff-only origin/main` gets typed as if it were a query — it is not,\n     * it mutates the branch whenever it succeeds, which is exactly the case you were probing for.\n     */\n    readOnlyChecks(): string[] {\n        return [\n            'Only wanted to LOOK (am I behind main? would it fast-forward?) — none of the below mutate:',\n            '  git fetch origin main                                 ← refresh the remote ref (no merge)',\n            '  git merge-base --is-ancestor origin/main HEAD         ← exit 0 = already contains main',\n            '  git rev-list --left-right --count origin/main...HEAD  ← prints \"<behind>  <ahead>\"',\n            '  git log --oneline HEAD..origin/main                   ← what main has that you do not',\n            '  git diff --stat origin/main...HEAD                    ← what you changed since the fork point',\n            '  cat .webpieces/main-sync-status.json                  ← the tooling\\'s own answer, incl.',\n            '                                                          the files predicted to conflict',\n            '`git merge --ff-only` is NOT a look — it MUTATES on success (that is the whole point of a',\n            'fast-forward), so it is blocked like every other merge. Never use it as a probe.',\n        ];\n    }\n}\n"]}

package/src/validate-config.js

@@ -7,6 +7,9 @@ exports.validatePrGateSection = validatePrGateSection;
 exports.validateExcludePaths = validateExcludePaths;
 exports.validateMatchRulesSection = validateMatchRulesSection;
 exports.validateSectionPlacement = validateSectionPlacement;
+// Imported, never re-typed: the banner offers the bulk migrator only for errors it actually covers, and
+// this marker is how it recognizes a placement error. See config-error-banner.ts.
+const config_error_banner_1 = require("./config-error-banner");
 const sections_1 = require("./sections");
 const rule_configs_1 = require("./rule-configs");
 const main_sync_guard_configs_1 = require("./main-sync-guard-configs");
@@ -523,14 +526,14 @@ function validateSectionPlacement(rulesSection, hookGuardsSection) {
     const errors = [];
     for (const name of Object.keys(rulesSection)) {
         if ((0, sections_1.isHookGuard)(name)) {
-            errors.push(`[${name}] is a hook guard and belongs in the "hookGuards" section, not "rules". ` +
+            errors.push(`[${name}] is a hook guard and ${config_error_banner_1.SECTION_PLACEMENT_MARKER} "hookGuards" section, not "rules". ` +
                 `Move it (or run \`pnpm wp-install-ai-hooks --sync\` to migrate automatically).`);
         }
     }
     for (const name of Object.keys(hookGuardsSection)) {
         // Only flag KNOWN code rules misplaced into hookGuards; unknown names may be custom rules.
         if (!(0, sections_1.isHookGuard)(name) && RULE_SCHEMAS[name]) {
-            errors.push(`[${name}] is a code rule and belongs in the "rules" section, not "hookGuards". ` +
+            errors.push(`[${name}] is a code rule and ${config_error_banner_1.SECTION_PLACEMENT_MARKER} "rules" section, not "hookGuards". ` +
                 `Move it (or run \`pnpm wp-install-ai-hooks --sync\` to migrate automatically).`);
         }
     }

package/src/validate-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/validate-config.ts"],"names":[],"mappings":";;;AA4GA,oCAEC;AAiHD,0DAoEC;AAkFD,sDAiEC;AA2BD,oDAmBC;AA2FD,8DAuBC;AAUD,4DAuBC;AApnBD,yCAAyD;AACzD,iDAAqD;AACrD,uEAKmC;AACnC,6EAA6H;AAIpH,0GAJA,sDAAyB,OAIA;AAHlC,+DAAsF;AAItF,6DAA2D;AAC3D,yCAAqC;AACrC,iDAsCwB;AACxB,2EAA0F;AAE1F,sEAAsE;AACtE,iEAAiE;AACjE,MAAM,YAAY,GAA6C;IAC3D,kBAAkB,EAAE,mCAAoB,CAAC,MAAM;IAC/C,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,qBAAqB,EAAE,sCAAuB,CAAC,MAAM;IACrD,yBAAyB,EAAE,yCAA0B,CAAC,MAAM;IAC5D,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,iBAAiB,EAAE,kCAAmB,CAAC,MAAM;IAC7C,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;IACvD,kBAAkB,EAAE,oCAAqB,CAAC,MAAM;IAChD,gBAAgB,EAAE,kCAAmB,CAAC,MAAM;IAC5C,yBAAyB,EAAE,0CAA2B,CAAC,MAAM;IAC7D,qBAAqB,EAAE,sCAAuB,CAAC,MAAM;IACrD,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;IACvD,mCAAmC,EAAE,iDAAkC,CAAC,MAAM;IAC9E,qBAAqB,EAAE,qCAAsB,CAAC,MAAM;IACpD,6CAA6C,EAAE,uEAA2C,CAAC,MAAM;IACjG,eAAe,EAAE,gCAAiB,CAAC,MAAM;IACzC,8BAA8B,EAAE,6CAA8B,CAAC,MAAM;IACrE,2BAA2B,EAAE,2CAA4B,CAAC,MAAM;IAChE,iDAAiD,EAAE,8DAA+C,CAAC,MAAM;IACzG,eAAe,EAAE,iCAAkB,CAAC,MAAM;IAC1C,UAAU,EAAE,4BAAa,CAAC,MAAM;IAChC,uBAAuB,EAAE,wCAAyB,CAAC,MAAM;IACzD,2BAA2B,EAAE,0CAA2B,CAAC,MAAM;IAC/D,yBAAyB,EAAE,yCAA0B,CAAC,MAAM;IAC5D,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,4BAA4B,EAAE,2CAA4B,CAAC,MAAM;IACjE,sBAAsB,EAAE,kDAAwB,CAAC,MAAM;IACvD,kBAAkB,EAAE,8CAAoB,CAAC,MAAM;IAC/C,0BAA0B,EAAE,qDAA2B,CAAC,MAAM;IAC9D,uBAAuB,EAAE,kDAAwB,CAAC,MAAM;IACxD,uBAAuB,EAAE,uCAAwB,CAAC,MAAM;IACxD,sBAAsB,EAAE,wCAAyB,CAAC,MAAM;IACxD,WAAW,EAAE,6BAAc,CAAC,MAAM;IAClC,UAAU,EAAE,4BAAa,CAAC,MAAM;IAChC,2BAA2B,EAAE,4CAA6B,CAAC,MAAM;IACjE,aAAa,EAAE,8BAAe,CAAC,MAAM;IACrC,oBAAoB,EAAE,oCAAqB,CAAC,MAAM;IAClD,iCAAiC,EAAE,kDAAmC,CAAC,MAAM;IAC7E,iCAAiC,EAAE,iDAAkC,CAAC,MAAM;IAC5E,sBAAsB,EAAE,wCAAyB,CAAC,MAAM;IACxD,0BAA0B,EAAE,2CAA4B,CAAC,MAAM;IAC/D,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;CAC1D,CAAC;AAEF,kGAAkG;AAClG,mGAAmG;AACnG,SAAgB,YAAY;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY;IAC1C,oGAAoG;IACpG,oGAAoG;IACpG,IAAI,GAAG,KAAK,uBAAuB;QAAE,OAAO,8DAA8D,CAAC;IAC3G,IAAI,GAAG,KAAK,0BAA0B;QAAE,OAAO,4FAA4F,CAAC;IAC5I,OAAO,GAAG,CAAC,UAAU;QACjB,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;QACnC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB;YAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAG,CAAC,CAAC,UAAU;gBACtC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAE,CAAC,CAAC,WAAW;oBACvC,CAAC,CAAC,YAAY,CAAC;AACvB,CAAC;AAED,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,MAAM,uBAAuB,GAAG;IAC5B,mBAAmB;IACnB,uBAAuB;IACvB,0BAA0B;IAC1B,gBAAgB;IAChB,aAAa;IACb,wBAAwB;CAC3B,CAAC;AAEF,yGAAyG;AACzG,SAAS,UAAU,CAAC,MAAgC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,CACH,2CAA2C,WAAW,mCAAmC;QACzF,4FAA4F;QAC5F,4CAA4C,MAAM,EAAE,CACvD,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,MAAgC;IAC1E,+EAA+E;IAC/E,oGAAoG;IACpG,yGAAyG;IACzG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,GACH,IAAI,QAAQ,qEAAqE,OAAO,aAAa;QACrG,mDAAmD;QACnD,MAAM,QAAQ,SAAS,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAE5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,GAAG;YACC,sEAAsE;gBACtE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACf,CAAC;AAED,uGAAuG;AACvG,oGAAoG;AACpG,uGAAuG;AACvG,wGAAwG;AACxG,oGAAoG;AACpG,sFAAsF;AACtF,uGAAuG;AACvG,uGAAuG;AACvG,iEAAiE;AACjE,SAAS,gBAAgB,CAAC,QAAgB;IACtC,OAAO,CACH,IAAI,QAAQ,iFAAiF;QAC7F,mGAAmG;QACnG,qGAAqG;QACrG,yBAAyB,QAAQ,+DAA+D;QAChG,qDAAqD,QAAQ,mCAAmC,CACnG,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,wGAAwG;AACxG,iGAAiG;AACjG,MAAM,mBAAmB,GAA2B;IAChD,mCAAmC,EAC/B,8FAA8F;QAC9F,2EAA2E;IAC/E,sCAAsC,EAClC,8FAA8F;QAC9F,iGAAiG;QACjG,wDAAwD;CAC/D,CAAC;AAEF,+FAA+F;AAC/F,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,qBAAqB,GAA2B;IAClD,wBAAwB,EAAE,uBAAuB;IACjD,uBAAuB,EAAE,0BAA0B;CACtD,CAAC;AAGF,mEAAmE;AACnE,8GAA8G;AAC9G,SAAS,iBAAiB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;IACpE,OAAO,GAAG,KAAK,mBAAmB,MAAM,0BAA0B,MAAM,0GAA0G,CAAC;AACvL,CAAC;AAED,4GAA4G;AAC5G,SAAgB,uBAAuB,CACnC,QAAiD,EACjD,oBAA6B,KAAK;IAElC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,wFAAwF;YACxF,0FAA0F;YAC1F,0FAA0F;YAC1F,MAAM,OAAO,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,IAAA,qCAAe,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtC,SAAS;YACb,CAAC;YACD,mFAAmF;YACnF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,CAAC,iBAAiB;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChE,SAAS;QACb,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,SAAS,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,QAAQ,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;oBAChE,SAAS;gBACb,CAAC;gBACD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,oBAAoB,GAAG,qBAAqB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;gBACjH,SAAS;YACb,CAAC;YACD,8FAA8F;YAC9F,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ;gBAAE,SAAS;YAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACjE,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;YACrF,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,aAAa,QAAQ,CAAC,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC,CAAC;YACzF,CAAC;iBAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;gBAC/E,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,QAAQ,KAAK,mCAAmC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxH,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,2EAA2E;QAC3E,0FAA0F;QAC1F,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,6BAA6B,GAAG,UAAU,GAAG,KAAK,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,mEAAmE;IACnE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAC7C,6FAA6F;AAC7F,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAEtD,iGAAiG;AACjG,kGAAkG;AAClG,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAChB,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;IACtD,8FAA8F;IAC9F,+FAA+F;IAC/F,kGAAkG;IAClG,oEAAoE;IACpE,iGAAiG;IACjG,6FAA6F;IAC7F,6EAA6E,CACpF,CAAC;AAEF,gGAAgG;AAChG,6FAA6F;AAC7F,SAAS,aAAa;IAClB,OAAO,CACH,kBAAkB;QAClB,qBAAqB;QACrB,0IAA0I;QAC1I,kBAAkB;QAClB,8GAA8G;QAC9G,UAAU;QACV,4FAA4F;QAC5F,qHAAqH;QACrH,SAAS;QACT,KAAK,CACR,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,kCAAkC;AAClC,uGAAuG;AACvG,8GAA8G;AAC9G,SAAS,oBAAoB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,oFAAoF,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAa,EAAE,KAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,mBAAmB,KAAK,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,0FAA0F;IAC1F,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,0BAA0B,CAAC,CAAC;IACnG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS;QAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oGAAoG,CAAC,CAAC;SACzI,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK;QAClE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oFAAoF,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS;QACjE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,wEAAwE,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,8GAA8G;AAC9G,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,QAAiB;IACrE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,yFAAyF;gBACzF,8CAA8C,aAAa,EAAE,EAAE;SAClE,CAAC;IACN,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,4CAA4C,aAAa,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,4DAA4D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAiC,CAAC,EAAE,CAAC;QAC7G,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC;IAED,iGAAiG;IACjG,8FAA8F;IAC9F,oDAAoD;IACpD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACP,0FAA0F;gBAC1F,oGAAoG,CACvG,CAAC;QACN,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,iDAAiD,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAwC,CAAC,EAAE,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,EAAE,CAAC,mBAAmB,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,IAAI,OAAO,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnE,sGAAsG;IACtG,sFAAsF;IACtF,IAAI,YAAY,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,sDAAyB,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE5F,qGAAqG;IACrG,oGAAoG;IACpG,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,0KAA0K,CAAC,CAAC;QAC5L,CAAC;IACL,CAAC;IAED,wFAAwF;IACxF,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,kDAAqB,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEtE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,wDAA2B,EAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,qGAAqG;IACrG,IAAI,mBAAmB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;IAC3H,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB;IACxB,OAAO,qCAAqC,CAAC;AACjD,CAAC;AAED,gFAAgF;AAChF,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,KAAc,EAAE,GAAW;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,mBAAmB,GAAG,uDAAuD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,6FAA6F;AAC7F,SAAgB,oBAAoB,CAAC,OAAgB;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,kFAAkF;gBAClF,2DAA2D,mBAAmB,EAAE,EAAE;SACrF,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChF,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,mGAAmG;IACnG,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAA,kCAAY,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACxD,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,IAAA,qCAAe,EAAC,OAAO,CAAC,SAAS,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,8EAA8E;AAC9E,kGAAkG;AAClG,sGAAsG;AACtG,yGAAyG;AACzG,8EAA8E;AAE9E,SAAS,iBAAiB;IACtB,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,wCAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,OAAe;IAC/B,8DAA8D;IAC9D,IAAI,CAAC;QACD,kFAAkF;QAClF,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,SAAS,CAAC;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACzB,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,+GAA+G;AAC/G,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,uBAAuB,KAAK,kHAAkH,CAAC,CAAC;IAC5J,CAAC;IACD,+FAA+F;IAC/F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,+EAA+E,CAAC,CAAC;IAE7H,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oDAAoD,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACJ,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,aAAa,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,0CAA0C,CAAC,CAAC;IAElF,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,kCAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAuC,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,yBAAyB,kCAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElG,qGAAqG;IACrG,mGAAmG;IACnG,mGAAmG;IACnG,qCAAqC;IACrC,IAAI,OAAO,CAAC,CAAC,uBAAuB,CAAC,KAAK,QAAQ;QAC9C,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oGAAoG,CAAC,CAAC;IAC5I,IAAI,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,0BAA0B,CAAC,KAAK,QAAQ,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oFAAoF,CAAC,CAAC;IAE5H,iEAAiE;IACjE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,mDAAmD,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,iEAAiE,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC7E,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oCAAoC,CAAC,CAAC;IAE5E,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,SAAgB,yBAAyB,CAAC,OAAgB;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,6FAA6F;gBAC7F,uGAAuG,iBAAiB,EAAE,EAAE;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,wEAAwE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,0FAA0F;QAC1F,MAAM,IAAI,GAAI,OAAO,CAAC,CAAC,CAAoC,EAAE,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,0CAA0C,CAAC,CAAC;YACvH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,4EAA4E;AAC5E,SAAgB,wBAAwB,CACpC,YAAqD,EACrD,iBAA0D;IAE1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAA,sBAAW,EAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,0EAA0E;gBAClF,gFAAgF,CACnF,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,2FAA2F;QAC3F,IAAI,CAAC,IAAA,sBAAW,EAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,yEAAyE;gBACjF,gFAAgF,CACnF,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { FieldDef } from './field-def';\nimport { sectionForRule, isHookGuard } from './sections';\nimport { MODIFIED_CODE_MODES } from './rule-configs';\nimport {\n    FeatureBranchGuardConfig,\n    ReadStaleGuardConfig,\n    MergedBranchBashGuardConfig,\n    StaleMainBashGuardConfig,\n} from './main-sync-guard-configs';\nimport { validateChecklistsSection, validateLandPrSection, validateNoGateSaltRationale } from './pr-gate-section-validators';\nimport { retiredEntry, retiredKeyError, retiredRuleFor } from './retired-config-keys';\n\n// Re-exported so the isolated validate-checklist-docs target keeps importing it from here.\nexport { validateChecklistsSection };\nimport { DEFAULT_MATCH_RULES } from './match-rules-config';\nimport { toError } from './to-error';\nimport {\n    MaxMethodLinesConfig,\n    MaxFileLinesConfig,\n    RequireReturnTypeConfig,\n    NoInlineTypeLiteralsConfig,\n    NoAnyUnknownConfig,\n    NoImplicitAnyConfig,\n    PrismaValidateDtosConfig,\n    PrismaConverterConfig,\n    NoDestructureConfig,\n    NoUnmanagedExceptionsConfig,\n    CatchErrorPatternConfig,\n    ThrowCauseRequiredConfig,\n    AngularNoDirectApiInResolverConfig,\n    NoSymbolDiTokensConfig,\n    NoCustomCssConfig,\n    NoProcessExitOutsideMainConfig,\n    NoFunctionOutsideClassConfig,\n    InjectAnnotationNotNeededForConcreteClassConfig,\n    FrameworkTagConfig,\n    RoleTagConfig,\n    BranchCreationGuardConfig,\n    PrCreationOrPushGuardConfig,\n    MergeInProgressGuardConfig,\n    PrMergeGuardConfig,\n    RedirectHowToMergeMainConfig,\n    NoFileImportCyclesConfig,\n    RuntimeArchitectureConfig,\n    NxWiringConfig,\n    DiGraphConfig,\n    MissingDesignAnnotationConfig,\n    NoJsFilesConfig,\n    ValidateTsInSrcConfig,\n    ValidateArchitectureUnchangedConfig,\n    ValidateNoArchitectureCyclesConfig,\n    ValidatePackageJsonConfig,\n    ValidateVersionsLockedConfig,\n    ValidateEslintSyncConfig,\n} from './rule-configs';\nimport { NoClientCreationOutsideServerOrClientConfig } from './no-client-creation-config';\n\n// Thin lookup table — each entry delegates to the class's own SCHEMA.\n// No field lists here; all schemas live with their config class.\nconst RULE_SCHEMAS: Record<string, Record<string, FieldDef>> = {\n    'max-method-lines': MaxMethodLinesConfig.SCHEMA,\n    'max-file-lines': MaxFileLinesConfig.SCHEMA,\n    'require-return-type': RequireReturnTypeConfig.SCHEMA,\n    'no-inline-type-literals': NoInlineTypeLiteralsConfig.SCHEMA,\n    'no-any-unknown': NoAnyUnknownConfig.SCHEMA,\n    'no-implicit-any': NoImplicitAnyConfig.SCHEMA,\n    'prisma-validate-dtos': PrismaValidateDtosConfig.SCHEMA,\n    'prisma-converter': PrismaConverterConfig.SCHEMA,\n    'no-destructure': NoDestructureConfig.SCHEMA,\n    'no-unmanaged-exceptions': NoUnmanagedExceptionsConfig.SCHEMA,\n    'catch-error-pattern': CatchErrorPatternConfig.SCHEMA,\n    'throw-cause-required': ThrowCauseRequiredConfig.SCHEMA,\n    'angular-no-direct-api-in-resolver': AngularNoDirectApiInResolverConfig.SCHEMA,\n    'no-symbol-di-tokens': NoSymbolDiTokensConfig.SCHEMA,\n    'no-client-creation-outside-server-or-client': NoClientCreationOutsideServerOrClientConfig.SCHEMA,\n    'no-custom-css': NoCustomCssConfig.SCHEMA,\n    'no-process-exit-outside-main': NoProcessExitOutsideMainConfig.SCHEMA,\n    'no-function-outside-class': NoFunctionOutsideClassConfig.SCHEMA,\n    'inject-annotation-not-needed-for-concrete-class': InjectAnnotationNotNeededForConcreteClassConfig.SCHEMA,\n    'framework-tag': FrameworkTagConfig.SCHEMA,\n    'role-tag': RoleTagConfig.SCHEMA,\n    'branch-creation-guard': BranchCreationGuardConfig.SCHEMA,\n    'pr-creation-or-push-guard': PrCreationOrPushGuardConfig.SCHEMA,\n    'merge-in-progress-guard': MergeInProgressGuardConfig.SCHEMA,\n    'pr-merge-guard': PrMergeGuardConfig.SCHEMA,\n    'redirect-how-to-merge-main': RedirectHowToMergeMainConfig.SCHEMA,\n    'feature-branch-guard': FeatureBranchGuardConfig.SCHEMA,\n    'read-stale-guard': ReadStaleGuardConfig.SCHEMA,\n    'merged-branch-bash-guard': MergedBranchBashGuardConfig.SCHEMA,\n    'stale-main-bash-guard': StaleMainBashGuardConfig.SCHEMA,\n    'no-file-import-cycles': NoFileImportCyclesConfig.SCHEMA,\n    'runtime-architecture': RuntimeArchitectureConfig.SCHEMA,\n    'nx-wiring': NxWiringConfig.SCHEMA,\n    'di-graph': DiGraphConfig.SCHEMA,\n    'missing-design-annotation': MissingDesignAnnotationConfig.SCHEMA,\n    'no-js-files': NoJsFilesConfig.SCHEMA,\n    'validate-ts-in-src': ValidateTsInSrcConfig.SCHEMA,\n    'validate-architecture-unchanged': ValidateArchitectureUnchangedConfig.SCHEMA,\n    'validate-no-architecture-cycles': ValidateNoArchitectureCyclesConfig.SCHEMA,\n    'validate-packagejson': ValidatePackageJsonConfig.SCHEMA,\n    'validate-versions-locked': ValidateVersionsLockedConfig.SCHEMA,\n    'validate-eslint-sync': ValidateEslintSyncConfig.SCHEMA,\n};\n\n// Every built-in rule name that has a typed schema (code rules + bash guards). The installer uses\n// this (with sectionForRule) to seed a fresh webpieces.config.json with every rule in its section.\nexport function allRuleNames(): readonly string[] {\n    return Object.keys(RULE_SCHEMAS);\n}\n\nfunction valueHint(def: FieldDef, key?: string): string {\n    // The two universal escape hatches, REQUIRED on every rule so they're always visible. Spell out the\n    // \"off\" value so a fresh config seeds them in the active/no-op state (0 / null), not a placeholder.\n    if (key === 'turnOffRuleUntilEpoch') return '0  (0 = active; future unix-epoch seconds = temporarily off)';\n    if (key === 'turnOffRuleWhileOnBranch') return 'null  (null = always on; a branch name disables the rule while that branch is checked out)';\n    return def.enumValues\n        ? `\"${def.enumValues.join(' | ')}\"`\n        : def.type === 'string[]' ? '[\"<string>\", ...]'\n        : def.type === 'number'   ? '<number>'\n        : def.type === 'boolean'  ? '<boolean>'\n        : '\"<string>\"';\n}\n\n// Scoped modes (narrowest → broadest) that enforce ONLY on what changed, so a rule can be\n// adopted gradually instead of all-at-once. When a rule offers one, recommend the first it\n// supports so a fresh config opts into a low-friction rollout rather than reflexively OFF.\nconst GRADUAL_MODE_PREFERENCE = [\n    'MODIFIED_PROJECTS',\n    'NEW_AND_MODIFIED_CODE',\n    'NEW_AND_MODIFIED_METHODS',\n    'MODIFIED_CLASS',\n    'NEW_METHODS',\n    'NEW_AND_MODIFIED_FILES',\n];\n\n/** A rollout hint for the copy-paste snippet: recommend the narrowest gradual mode the rule supports. */\nfunction rolloutTip(schema: Record<string, FieldDef>): string {\n    const modes = schema['mode']?.enumValues ?? [];\n    const recommended = GRADUAL_MODE_PREFERENCE.find((m: string) => modes.includes(m));\n    if (!recommended) return '';\n    const optOut = modes.includes('OFF') ? ' Set \"mode\": \"OFF\" to opt out entirely.' : '';\n    return (\n        `\\n\\n💡 Recommended: start with \"mode\": \"${recommended}\" — it enforces only on what you ` +\n        `actually change, so the rule rolls out gradually (existing code stays grandfathered until ` +\n        `you next touch that project/file/method).${optOut}`\n    );\n}\n\nfunction missingRuleSnippet(ruleName: string, schema: Record<string, FieldDef>): string {\n    // Required fields go in the copy-paste entry. The two universal escape hatches\n    // (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch) are now REQUIRED, so they land in that block —\n    // which is the whole point: every seeded rule shows both hatches. Optional fields are listed separately.\n    const fields = Object.keys(schema);\n    const required = fields.filter(f => !schema[f].optional);\n    const optional = fields.filter(f => schema[f].optional);\n\n    const requiredLines = required.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n    const section = sectionForRule(ruleName);\n    let out =\n        `[${ruleName}] Not configured in webpieces.config.json. Add this entry to the \"${section}\" section\\n` +\n        `(choose values appropriate for your project):\\n\\n` +\n        `  \"${ruleName}\": {\\n${requiredLines.join(',\\n')}\\n  }`;\n\n    if (optional.length > 0) {\n        const optionalLines = optional.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n        out +=\n            `\\n\\nOptional fields you may add to this rule (omit if not needed):\\n` +\n            `${optionalLines.join(',\\n')}`;\n    }\n    out += rolloutTip(schema);\n    return out;\n}\n\n// A config key under rules/hookGuards that the RUNNING validator has no schema for (and no rulesDir is\n// set to supply custom rules). Two very different causes, so the message leads with the common one:\n//   1. Version skew (most common — happens right after a dep bump): webpieces.config.json references a\n//      rule a NEWER @webpieces release added, but the installed guard is OLDER and doesn't know it yet.\n//      Fix = `pnpm install` (NOT deleting the key — the key is valid, the validator is just stale).\n//   2. A genuinely removed/renamed rule left behind, or a typo. Fix = remove the key.\n// Do NOT tell the AI to delete first — that destroys valid config in case 1 (the trap that made the AI\n// gut a working config instead of running `pnpm install`). The banner in load-config.ts spells out the\n// ordered \"run pnpm install, THEN edit only if it persists\" fix.\nfunction unknownRuleError(ruleName: string): string {\n    return (\n        `[${ruleName}] Unknown rule — the running @webpieces validator has no schema for it, and no ` +\n        `\"rulesDir\" is configured to supply custom rules. Most often this means your installed guard is a ` +\n        `release BEHIND this webpieces.config.json: run \\`pnpm install\\` first (see the fix steps below) so ` +\n        `the validator learns \"${ruleName}\". Only if it is STILL unknown after a fresh install is it a ` +\n        `removed/renamed rule or a typo — then remove the \"${ruleName}\" key from webpieces.config.json.`\n    );\n}\n\n// Fields we DELETED from a rule's schema, keyed by \"<rule>.<field>\". The generic unknown-field error\n// (\"Unknown field ... Valid fields: [...]\") is correct but doesn't say WHY the field vanished, so an AI\n// might re-add it. These hints explain the removal so the only action left is to delete the key.\nconst RETIRED_FIELD_HINTS: Record<string, string> = {\n    'runtime-architecture.servicePaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json (apiRelations + project roles). Delete it.',\n    'runtime-architecture.apiProjectPaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json, so there is NO list of api libs to maintain. Delete it (do not ' +\n        'enumerate api libs and do not replace it with a glob).',\n};\n\n// Universal field renames (apply to EVERY rule/guard AND every match-rule, unlike the per-rule\n// RETIRED_FIELD_HINTS). When an entry still uses the old escape-hatch name, the generic unknown-field\n// error is replaced with a precise \"renamed to X — rename it\" instruction so the fix is mechanical.\nconst RENAMED_FIELD_ALIASES: Record<string, string> = {\n    ignoreModifiedUntilEpoch: 'turnOffRuleUntilEpoch',\n    ignoreRuleWhileOnBranch: 'turnOffRuleWhileOnBranch',\n};\n\n\n// The renamed-field message shared by keyed rules and match-rules.\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction renamedFieldError(scope: string, oldKey: string, newKey: string): string {\n    return `${scope} Unknown field \"${oldKey}\" — it was renamed to \"${newKey}\". Rename it (the value carries over unchanged; for the branch hatch, use null when there is no branch).`;\n}\n\n// webpieces-disable no-any-unknown -- rawRules values are opaque JSON; each field is validated individually\nexport function validateWebpiecesConfig(\n    rawRules: Record<string, Record<string, unknown>>,\n    hasCustomRulesDir: boolean = false,\n): string[] {\n    const errors: string[] = [];\n\n    // Check field-level correctness for rules that are present\n    for (const [ruleName, entry] of Object.entries(rawRules)) {\n        const schema = RULE_SCHEMAS[ruleName];\n        if (!schema) {\n            // A name we KNOW is retired beats the unknown-rule message, which leads with \"run `pnpm\n            // install`, your validator may be stale\" — precisely the wrong advice for a dead name. It\n            // fires even when a rulesDir is set, because a custom rule must not reuse a retired name.\n            const retired = retiredRuleFor(ruleName);\n            if (retired) {\n                errors.push(retiredKeyError(retired));\n                continue;\n            }\n            // No built-in schema. With no rulesDir there are no custom rules, so this key is a\n            // dead/typo'd entry — tell the AI to remove it (a removed rule like no-shell-substitution\n            // lingers here otherwise). With a rulesDir it may be a legitimate custom rule → skip.\n            if (!hasCustomRulesDir) errors.push(unknownRuleError(ruleName));\n            continue;\n        }\n        for (const [key, value] of Object.entries(entry)) {\n            const fieldDef = schema[key];\n            if (!fieldDef) {\n                const renamedTo = RENAMED_FIELD_ALIASES[key];\n                if (renamedTo) {\n                    errors.push(renamedFieldError(`[${ruleName}]`, key, renamedTo));\n                    continue;\n                }\n                const retiredHint = RETIRED_FIELD_HINTS[`${ruleName}.${key}`];\n                const suffix = retiredHint ? ` ${retiredHint}` : '';\n                errors.push(`[${ruleName}] Unknown field \"${key}\". Valid fields: [${Object.keys(schema).join(', ')}].${suffix}`);\n                continue;\n            }\n            // A nullable field (e.g. turnOffRuleWhileOnBranch) accepts JSON null in addition to its type.\n            if (value === null && fieldDef.nullable) continue;\n            if (fieldDef.type === 'string[]') {\n                if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))\n                    errors.push(`[${ruleName}] \"${key}\" must be string[], got ${typeof value}.`);\n            } else if (typeof value !== fieldDef.type) {\n                errors.push(`[${ruleName}] \"${key}\" must be ${fieldDef.type}, got ${typeof value}.`);\n            } else if (fieldDef.enumValues && !fieldDef.enumValues.includes(value as string)) {\n                errors.push(`[${ruleName}] \"${key}\" = \"${value}\" is not valid. Must be one of: ${fieldDef.enumValues.join(', ')}.`);\n            }\n        }\n        // Required fields must actually be present. Until now the loop above only checked\n        // fields that WERE present, so an entry like `{}` (or one missing `mode` /\n        // `turnOffRuleUntilEpoch`) slipped through. Every non-optional schema field is mandatory.\n        for (const [key, fieldDef] of Object.entries(schema)) {\n            if (!fieldDef.optional && !(key in entry)) {\n                errors.push(`[${ruleName}] Missing required field \"${key}\". Add ${key}: ${valueHint(fieldDef, key)}.`);\n            }\n        }\n    }\n\n    // Every built-in rule must be explicitly configured — no silent defaults.\n    // When a new rule is added to the framework, this check surfaces it immediately\n    // with a ready-to-copy snippet so AI can configure it in one pass.\n    for (const [ruleName, schema] of Object.entries(RULE_SCHEMAS)) {\n        if (!(ruleName in rawRules)) {\n            errors.push(missingRuleSnippet(ruleName, schema));\n        }\n    }\n\n    return errors;\n}\n\nconst PR_GATE_MODES = ['ON', 'OFF'] as const;\n// Optional — omitted means DETECT. Kept inline (like prGateExample) to avoid a load-config ↔\n// pr-gate-config import cycle; the canonical list + semantics live in pr-gate-config.ts.\nconst PR_GATE_MERGE_MODES = ['AUTO', 'NONE'] as const;\n\n// Spelled out because the choice is a POLICY decision with a consequence the chooser cannot see:\n// only the AUTO path can put the compact risk/flags body in main's history, because a UI merge is\n// limited to the repo's squash_merge_commit_title/message settings and no setting produces it.\nconst MERGE_MODE_HELP = (\n        `Must be one of: ${PR_GATE_MERGE_MODES.join(', ')}.\\n` +\n        `  \"AUTO\" — wp-finish-upsert-pr lands the PR: it squash-merges when mergeable, else enables\\n` +\n        `           GitHub auto-merge, both with an explicit --subject/--body-file so main's history\\n` +\n        `           gets the PR title + the compact risk/flags body. Needs allow_auto_merge on the repo\\n` +\n        `           (gh api repos/{owner}/{repo} --jq .allow_auto_merge).\\n` +\n        `  \"NONE\" — wp-finish-upsert-pr only opens/updates the PR; a human merges it. The compact body\\n` +\n        `           is then impossible, so set the repo's squash_merge_commit_title to PR_TITLE or\\n` +\n        `           commits land as the internal \"Squash merge of <branch>\" subject.`\n);\n\n// Copy-paste example for the top-level `pr-gate` block (sibling of `rules`). Kept inline rather\n// than imported from pr-gate-config.ts to avoid a load-config ↔ pr-gate-config import cycle.\nfunction prGateExample(): string {\n    return (\n        `  \"pr-gate\": {\\n` +\n        `    \"mode\": \"ON\",\\n` +\n        `    \"buildCommand\": \"<command CI runs to validate a PR, e.g. pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)>\",\\n` +\n        `    \"gates\": [\\n` +\n        `      { \"name\": \"API Changed\", \"patterns\": [\"libraries/apis/**\", \"**/*Api.ts\"], \"warningColor\": \"yellow\" }\\n` +\n        `    ],\\n` +\n        `    \"checklists\": [   // OPTIONAL — per-area review, one distinct reviewer subagent each\\n` +\n        `      { \"subagent\": \"db-migration-reviewer\", \"doc\": \".claude/review/db-migrations.md\", \"patterns\": [\"**/*.sql\"] }\\n` +\n        `    ]\\n` +\n        `  }`\n    );\n}\n\n// The `gates` array: dashboard-only warning flags. Extracted from validatePrGateSection to keep that\n// method inside the length limit.\n// webpieces-disable no-any-unknown -- `value` is the opaque consumer `gates` value until narrowed here\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction validateGatesSection(value: unknown): string[] {\n    if (!Array.isArray(value)) {\n        return [`[pr-gate] \"gates\" must be an array of { name, patterns, warningColor, disabled? }.`];\n    }\n    const errors: string[] = [];\n    for (let i = 0; i < value.length; i += 1) {\n        errors.push(...validateGate(value[i], i));\n    }\n    return errors;\n}\n\n// webpieces-disable no-any-unknown -- one gate entry from opaque consumer JSON, validated field-by-field\nfunction validateGate(gate: unknown, index: number): string[] {\n    if (typeof gate !== 'object' || gate === null) {\n        return [`[pr-gate] gates[${index}] must be an object { name, patterns, warningColor, disabled? }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque gate object from consumer JSON\n    const g = gate as Record<string, unknown>;\n    const errors: string[] = [];\n    if (typeof g['name'] !== 'string') errors.push(`[pr-gate] gates[${index}].name must be a string.`);\n    if (!Array.isArray(g['patterns']) || !g['patterns'].every(p => typeof p === 'string'))\n        errors.push(`[pr-gate] gates[${index}].patterns must be string[].`);\n    if (g['warningColor'] === undefined)\n        errors.push(`[pr-gate] gates[${index}].warningColor is required — set it to \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    else if (g['warningColor'] !== 'yellow' && g['warningColor'] !== 'red')\n        errors.push(`[pr-gate] gates[${index}].warningColor must be \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    if (g['disabled'] !== undefined && typeof g['disabled'] !== 'boolean')\n        errors.push(`[pr-gate] gates[${index}].disabled must be a boolean (example/inactive gate kept in the file).`);\n    return errors;\n}\n\n/**\n * Validate the top-level `pr-gate` section. It is REQUIRED (a client that opts out sets mode \"OFF\").\n * `buildCommand` is required unless mode is \"OFF\". Returns human-readable, copy-paste-friendly errors\n * — never throws. The pr-gate block lives outside the FieldDef-driven `rules` schema because its\n * nested `gates`/`checklists` arrays can't be expressed there, so they get structural validation here.\n * `repoRoot` (when known) lets the `checklists[].docs` existence check run.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validatePrGateSection(section: unknown, repoRoot?: string): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[pr-gate] Not configured in webpieces.config.json. Add this block under the \"commands\" ` +\n            `section (set \"mode\": \"OFF\" to opt out):\\n\\n${prGateExample()}`,\n        ];\n    }\n    if (typeof section !== 'object' || Array.isArray(section)) {\n        return [`[pr-gate] Must be an object. Example:\\n\\n${prGateExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque pr-gate section from consumer JSON\n    const s = section as Record<string, unknown>;\n    const errors: string[] = [];\n\n    if (!('mode' in s)) {\n        errors.push(`[pr-gate] Missing required field \"mode\". Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    } else if (typeof s['mode'] !== 'string' || !PR_GATE_MODES.includes(s['mode'] as typeof PR_GATE_MODES[number])) {\n        errors.push(`[pr-gate] \"mode\" = \"${String(s['mode'])}\" is not valid. Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    }\n\n    // buildCommand and mergeMode are both required whenever the gate is active (mode !== OFF). There\n    // is deliberately NO default for mergeMode: whether the tooling may land your PRs is a policy\n    // decision, and either guess is wrong for somebody.\n    if (s['mode'] !== 'OFF') {\n        const cmd = s['buildCommand'];\n        if (typeof cmd !== 'string' || cmd.trim() === '') {\n            errors.push(\n                `[pr-gate] Missing required field \"buildCommand\" — the command CI runs to validate a PR. ` +\n                `Add e.g. \"buildCommand\": \"pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)\".`,\n            );\n        }\n        const mm = s['mergeMode'];\n        if (!('mergeMode' in s)) {\n            errors.push(`[pr-gate] Missing required field \"mergeMode\". ${MERGE_MODE_HELP}`);\n        } else if (typeof mm !== 'string' || !PR_GATE_MERGE_MODES.includes(mm as typeof PR_GATE_MERGE_MODES[number])) {\n            errors.push(`[pr-gate] \"mergeMode\" = \"${String(mm)}\" is not valid. ${MERGE_MODE_HELP}`);\n        }\n    }\n\n    if ('gates' in s) errors.push(...validateGatesSection(s['gates']));\n\n    // Optional extension point: company review checklists, as an ARRAY right here in the config. Absent ⇒\n    // none. The removed { doc } manifest shape is rejected with the exact migration edit.\n    if ('checklists' in s) errors.push(...validateChecklistsSection(s['checklists'], repoRoot));\n\n    // Optional server-token salt. Absent ⇒ no token minted, CI enforcement is a no-op. Present ⇒ must be\n    // a non-empty string (an empty salt would mint a token anyone can forge from a known-empty secret).\n    if ('gateSalt' in s) {\n        const salt = s['gateSalt'];\n        if (typeof salt !== 'string' || salt.trim() === '') {\n            errors.push(`[pr-gate] \"gateSalt\" must be a non-empty string — it is the shared secret the gate token is HMAC'd with. Omit the key entirely to disable server-side token enforcement.`);\n        }\n    }\n\n    // Optional: what happens to the LOCAL branch once its PR lands. Absent ⇒ \"archive-tag\".\n    if ('landPr' in s) errors.push(...validateLandPrSection(s['landPr']));\n\n    errors.push(...validateNoGateSaltRationale(s));\n\n    // Optional: publish reviewer output as a PR comment (defaults true). Must be a boolean when present.\n    if ('checklistComments' in s && typeof s['checklistComments'] !== 'boolean') {\n        errors.push(`[pr-gate] \"checklistComments\" must be a boolean (defaults to true; set false to keep the PR body-only).`);\n    }\n\n    return errors;\n}\n\nfunction excludePathsExample(): string {\n    return '\"excludePaths\": [\"repositories/**\"]';\n}\n\n// A glob list: must be a string[] (may be empty). `key` names it for the error.\n// webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed here\nfunction validateExcludeList(value: unknown, key: string): string[] {\n    if (!(Array.isArray(value) && value.every(p => typeof p === 'string'))) {\n        return [`[excludePaths] \"${key}\" must be a string[] of glob paths (use [] for none).`];\n    }\n    return [];\n}\n\n/**\n * Validate the REQUIRED top-level `excludePaths` block: ONE glob list suppressing hook enforcement per\n * file path, for code-style rules and file-scoped guards alike. Required so every client upgrading is\n * forced to declare it (as [] to keep today's behavior, or with real paths). Returns copy-paste\n * friendly errors and never throws — same contract as validatePrGateSection.\n *\n * The two-list object form `{ \"rules\": [...], \"guards\": [...] }` is RETIRED, not tolerated. It used to be\n * accepted and silently unioned, which is why this repo's own config sat on the dead shape for releases: an\n * accepted shape is never migrated. Rejecting it cannot wedge a consumer — editing webpieces.config.json is\n * always permitted, even while it is invalid. See retired-config-keys.ts.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateExcludePaths(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[excludePaths] Not configured in webpieces.config.json. Add this REQUIRED block ` +\n            `(use an empty array to keep enforcing everywhere):\\n\\n  ${excludePathsExample()}`,\n        ];\n    }\n    if (Array.isArray(section)) return validateExcludeList(section, 'excludePaths');\n    if (typeof section !== 'object') {\n        return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque excludePaths section from consumer JSON\n    const s = section as Record<string, unknown>;\n    // The retired two-list object. One table row owns the message for either key present.\n    const retired = retiredEntry('rules', '[excludePaths]');\n    if (retired && (s['rules'] !== undefined || s['guards'] !== undefined)) {\n        return [`${retiredKeyError(retired)}\\n\\n  ${excludePathsExample()}`];\n    }\n    return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n}\n\n// ---------------------------------------------------------------------------\n// match-rules — a new top-level ARRAY section (parallel to pr-gate/excludePaths). Each entry is a\n// client-authored content guard (raw-regex patterns + message + scoping). Validated structurally here\n// the same way pr-gate's `gates` are, because an array of objects can't be expressed in FieldDef schema.\n// ---------------------------------------------------------------------------\n\nfunction matchRulesExample(): string {\n    return `\"match-rules\": ${JSON.stringify(DEFAULT_MATCH_RULES, null, 4)}`;\n}\n\n// webpieces-disable no-any-unknown -- generic type guard over an opaque JSON value\nfunction isStringArray(value: unknown): value is string[] {\n    return Array.isArray(value) && value.every(v => typeof v === 'string');\n}\n\n// Compile a pattern to validate it; returns the error message, or undefined when it compiles.\nfunction regexError(pattern: string): string | undefined {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Constructed only to validate the syntax; the object is intentionally discarded.\n        void new RegExp(pattern);\n        return undefined;\n    } catch (err: unknown) {\n        const error = toError(err);\n        return error.message;\n    }\n}\n\n// One entry of the match-rules array, validated field-by-field (see validateGate for the pattern).\n// webpieces-disable no-any-unknown -- one match-rule entry from opaque consumer JSON, validated field-by-field\nfunction validateMatchRule(entry: unknown, index: number): string[] {\n    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {\n        return [`[match-rules] entry[${index}] must be an object { name, patterns, mainMessage, mode, turnOffRuleUntilEpoch, turnOffRuleWhileOnBranch, ... }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque match-rule entry from consumer JSON\n    const e = entry as Record<string, unknown>;\n    const label = typeof e['name'] === 'string' ? `\"${e['name']}\"` : `entry[${index}]`;\n    const errors: string[] = [];\n\n    if (typeof e['name'] !== 'string' || e['name'].trim() === '')\n        errors.push(`[match-rules] entry[${index}].name must be a non-empty string (it is the disable token and report label).`);\n\n    if (!isStringArray(e['patterns']) || e['patterns'].length === 0) {\n        errors.push(`[match-rules] ${label}.patterns must be a non-empty string[] of regexes.`);\n    } else {\n        e['patterns'].forEach((p: string, pi: number) => {\n            const rxErr = regexError(p);\n            if (rxErr) errors.push(`[match-rules] ${label}.patterns[${pi}] is not a valid regex: ${rxErr}`);\n        });\n    }\n\n    if (typeof e['mainMessage'] !== 'string' || e['mainMessage'].trim() === '')\n        errors.push(`[match-rules] ${label}.mainMessage must be a non-empty string.`);\n\n    if (typeof e['mode'] !== 'string' || !MODIFIED_CODE_MODES.includes(e['mode'] as typeof MODIFIED_CODE_MODES[number]))\n        errors.push(`[match-rules] ${label}.mode must be one of: ${MODIFIED_CODE_MODES.join(', ')}.`);\n\n    // Both escape hatches are REQUIRED on every match-rule too (same as keyed rules), so they are always\n    // visible. turnOffRuleUntilEpoch: number (0 = active; a future unix-epoch in seconds = temporarily\n    // off). turnOffRuleWhileOnBranch: string | null (null = always on; a branch name disables the rule\n    // while that branch is checked out).\n    if (typeof e['turnOffRuleUntilEpoch'] !== 'number')\n        errors.push(`[match-rules] ${label}.turnOffRuleUntilEpoch must be a number (0 = active; future unix-epoch seconds = temporarily off).`);\n    if (!(e['turnOffRuleWhileOnBranch'] === null || typeof e['turnOffRuleWhileOnBranch'] === 'string'))\n        errors.push(`[match-rules] ${label}.turnOffRuleWhileOnBranch must be a string or null (null = no branch / always on).`);\n\n    // The old escape-hatch names were renamed — flag them precisely.\n    for (const oldKey of Object.keys(RENAMED_FIELD_ALIASES)) {\n        if (oldKey in e) errors.push(renamedFieldError(`[match-rules] ${label}`, oldKey, RENAMED_FIELD_ALIASES[oldKey]));\n    }\n\n    if (e['options'] !== undefined && !isStringArray(e['options']))\n        errors.push(`[match-rules] ${label}.options must be a string[] (omit if not needed).`);\n    if (e['allowedPaths'] !== undefined && !isStringArray(e['allowedPaths']))\n        errors.push(`[match-rules] ${label}.allowedPaths must be a string[] of globs (omit if not needed).`);\n    if (e['disableAllowed'] !== undefined && typeof e['disableAllowed'] !== 'boolean')\n        errors.push(`[match-rules] ${label}.disableAllowed must be a boolean.`);\n\n    return errors;\n}\n\n/**\n * Validate the REQUIRED top-level `match-rules` array (client-authored content guards). MISSING →\n * one error printing the ready-to-paste `no-fetch` example (add at least this; more can follow).\n * Present-but-`[]` → allowed (a conscious opt-out, matching pr-gate mode:OFF / excludePaths []).\n * Otherwise every entry is validated field-by-field (each regex compile-checked) plus name\n * uniqueness. Copy-paste-friendly errors; never throws — same contract as validatePrGateSection.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateMatchRulesSection(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[match-rules] Not configured in webpieces.config.json. Add this REQUIRED top-level array — ` +\n            `seed it with the no-fetch guard below (you can add more entries: no-moment, no-lodash-chain, …):\\n\\n${matchRulesExample()}`,\n        ];\n    }\n    if (!Array.isArray(section)) {\n        return [`[match-rules] Must be an array of content-guard objects. Example:\\n\\n${matchRulesExample()}`];\n    }\n\n    const errors: string[] = [];\n    const seen = new Set<string>();\n    for (let i = 0; i < section.length; i += 1) {\n        errors.push(...validateMatchRule(section[i], i));\n        // webpieces-disable no-any-unknown -- reading the name off an opaque entry only to dedupe\n        const name = (section[i] as Record<string, unknown> | null)?.['name'];\n        if (typeof name === 'string') {\n            if (seen.has(name)) errors.push(`[match-rules] duplicate entry name \"${name}\" — each match-rule name must be unique.`);\n            seen.add(name);\n        }\n    }\n    return errors;\n}\n\n/**\n * Enforce that each built-in lives in its correct section: code rules under `rules`, bash guards\n * under `hookGuards`. A guard left in `rules` (or a rule placed in `hookGuards`) is reported with a\n * \"move it\" message so the split stays clean. Unknown/custom names are ignored (they may be custom\n * rules from rulesDir). Presence (\"every built-in must be configured\") is checked separately by\n * validateWebpiecesConfig against the merged map.\n */\n// webpieces-disable no-any-unknown -- section maps are opaque consumer JSON\nexport function validateSectionPlacement(\n    rulesSection: Record<string, Record<string, unknown>>,\n    hookGuardsSection: Record<string, Record<string, unknown>>,\n): string[] {\n    const errors: string[] = [];\n    for (const name of Object.keys(rulesSection)) {\n        if (isHookGuard(name)) {\n            errors.push(\n                `[${name}] is a hook guard and belongs in the \"hookGuards\" section, not \"rules\". ` +\n                `Move it (or run \\`pnpm wp-install-ai-hooks --sync\\` to migrate automatically).`,\n            );\n        }\n    }\n    for (const name of Object.keys(hookGuardsSection)) {\n        // Only flag KNOWN code rules misplaced into hookGuards; unknown names may be custom rules.\n        if (!isHookGuard(name) && RULE_SCHEMAS[name]) {\n            errors.push(\n                `[${name}] is a code rule and belongs in the \"rules\" section, not \"hookGuards\". ` +\n                `Move it (or run \\`pnpm wp-install-ai-hooks --sync\\` to migrate automatically).`,\n            );\n        }\n    }\n    return errors;\n}\n"]}
+{"version":3,"file":"validate-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/validate-config.ts"],"names":[],"mappings":";;;AA+GA,oCAEC;AAiHD,0DAoEC;AAkFD,sDAiEC;AA2BD,oDAmBC;AA2FD,8DAuBC;AAUD,4DAuBC;AAvnBD,wGAAwG;AACxG,kFAAkF;AAClF,+DAAiE;AACjE,yCAAyD;AACzD,iDAAqD;AACrD,uEAKmC;AACnC,6EAA6H;AAIpH,0GAJA,sDAAyB,OAIA;AAHlC,+DAAsF;AAItF,6DAA2D;AAC3D,yCAAqC;AACrC,iDAsCwB;AACxB,2EAA0F;AAE1F,sEAAsE;AACtE,iEAAiE;AACjE,MAAM,YAAY,GAA6C;IAC3D,kBAAkB,EAAE,mCAAoB,CAAC,MAAM;IAC/C,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,qBAAqB,EAAE,sCAAuB,CAAC,MAAM;IACrD,yBAAyB,EAAE,yCAA0B,CAAC,MAAM;IAC5D,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,iBAAiB,EAAE,kCAAmB,CAAC,MAAM;IAC7C,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;IACvD,kBAAkB,EAAE,oCAAqB,CAAC,MAAM;IAChD,gBAAgB,EAAE,kCAAmB,CAAC,MAAM;IAC5C,yBAAyB,EAAE,0CAA2B,CAAC,MAAM;IAC7D,qBAAqB,EAAE,sCAAuB,CAAC,MAAM;IACrD,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;IACvD,mCAAmC,EAAE,iDAAkC,CAAC,MAAM;IAC9E,qBAAqB,EAAE,qCAAsB,CAAC,MAAM;IACpD,6CAA6C,EAAE,uEAA2C,CAAC,MAAM;IACjG,eAAe,EAAE,gCAAiB,CAAC,MAAM;IACzC,8BAA8B,EAAE,6CAA8B,CAAC,MAAM;IACrE,2BAA2B,EAAE,2CAA4B,CAAC,MAAM;IAChE,iDAAiD,EAAE,8DAA+C,CAAC,MAAM;IACzG,eAAe,EAAE,iCAAkB,CAAC,MAAM;IAC1C,UAAU,EAAE,4BAAa,CAAC,MAAM;IAChC,uBAAuB,EAAE,wCAAyB,CAAC,MAAM;IACzD,2BAA2B,EAAE,0CAA2B,CAAC,MAAM;IAC/D,yBAAyB,EAAE,yCAA0B,CAAC,MAAM;IAC5D,gBAAgB,EAAE,iCAAkB,CAAC,MAAM;IAC3C,4BAA4B,EAAE,2CAA4B,CAAC,MAAM;IACjE,sBAAsB,EAAE,kDAAwB,CAAC,MAAM;IACvD,kBAAkB,EAAE,8CAAoB,CAAC,MAAM;IAC/C,0BAA0B,EAAE,qDAA2B,CAAC,MAAM;IAC9D,uBAAuB,EAAE,kDAAwB,CAAC,MAAM;IACxD,uBAAuB,EAAE,uCAAwB,CAAC,MAAM;IACxD,sBAAsB,EAAE,wCAAyB,CAAC,MAAM;IACxD,WAAW,EAAE,6BAAc,CAAC,MAAM;IAClC,UAAU,EAAE,4BAAa,CAAC,MAAM;IAChC,2BAA2B,EAAE,4CAA6B,CAAC,MAAM;IACjE,aAAa,EAAE,8BAAe,CAAC,MAAM;IACrC,oBAAoB,EAAE,oCAAqB,CAAC,MAAM;IAClD,iCAAiC,EAAE,kDAAmC,CAAC,MAAM;IAC7E,iCAAiC,EAAE,iDAAkC,CAAC,MAAM;IAC5E,sBAAsB,EAAE,wCAAyB,CAAC,MAAM;IACxD,0BAA0B,EAAE,2CAA4B,CAAC,MAAM;IAC/D,sBAAsB,EAAE,uCAAwB,CAAC,MAAM;CAC1D,CAAC;AAEF,kGAAkG;AAClG,mGAAmG;AACnG,SAAgB,YAAY;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY;IAC1C,oGAAoG;IACpG,oGAAoG;IACpG,IAAI,GAAG,KAAK,uBAAuB;QAAE,OAAO,8DAA8D,CAAC;IAC3G,IAAI,GAAG,KAAK,0BAA0B;QAAE,OAAO,4FAA4F,CAAC;IAC5I,OAAO,GAAG,CAAC,UAAU;QACjB,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;QACnC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB;YAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAG,CAAC,CAAC,UAAU;gBACtC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAE,CAAC,CAAC,WAAW;oBACvC,CAAC,CAAC,YAAY,CAAC;AACvB,CAAC;AAED,0FAA0F;AAC1F,2FAA2F;AAC3F,2FAA2F;AAC3F,MAAM,uBAAuB,GAAG;IAC5B,mBAAmB;IACnB,uBAAuB;IACvB,0BAA0B;IAC1B,gBAAgB;IAChB,aAAa;IACb,wBAAwB;CAC3B,CAAC;AAEF,yGAAyG;AACzG,SAAS,UAAU,CAAC,MAAgC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,CACH,2CAA2C,WAAW,mCAAmC;QACzF,4FAA4F;QAC5F,4CAA4C,MAAM,EAAE,CACvD,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,MAAgC;IAC1E,+EAA+E;IAC/E,oGAAoG;IACpG,yGAAyG;IACzG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,GACH,IAAI,QAAQ,qEAAqE,OAAO,aAAa;QACrG,mDAAmD;QACnD,MAAM,QAAQ,SAAS,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAE5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,GAAG;YACC,sEAAsE;gBACtE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACf,CAAC;AAED,uGAAuG;AACvG,oGAAoG;AACpG,uGAAuG;AACvG,wGAAwG;AACxG,oGAAoG;AACpG,sFAAsF;AACtF,uGAAuG;AACvG,uGAAuG;AACvG,iEAAiE;AACjE,SAAS,gBAAgB,CAAC,QAAgB;IACtC,OAAO,CACH,IAAI,QAAQ,iFAAiF;QAC7F,mGAAmG;QACnG,qGAAqG;QACrG,yBAAyB,QAAQ,+DAA+D;QAChG,qDAAqD,QAAQ,mCAAmC,CACnG,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,wGAAwG;AACxG,iGAAiG;AACjG,MAAM,mBAAmB,GAA2B;IAChD,mCAAmC,EAC/B,8FAA8F;QAC9F,2EAA2E;IAC/E,sCAAsC,EAClC,8FAA8F;QAC9F,iGAAiG;QACjG,wDAAwD;CAC/D,CAAC;AAEF,+FAA+F;AAC/F,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,qBAAqB,GAA2B;IAClD,wBAAwB,EAAE,uBAAuB;IACjD,uBAAuB,EAAE,0BAA0B;CACtD,CAAC;AAGF,mEAAmE;AACnE,8GAA8G;AAC9G,SAAS,iBAAiB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;IACpE,OAAO,GAAG,KAAK,mBAAmB,MAAM,0BAA0B,MAAM,0GAA0G,CAAC;AACvL,CAAC;AAED,4GAA4G;AAC5G,SAAgB,uBAAuB,CACnC,QAAiD,EACjD,oBAA6B,KAAK;IAElC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,wFAAwF;YACxF,0FAA0F;YAC1F,0FAA0F;YAC1F,MAAM,OAAO,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,IAAA,qCAAe,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtC,SAAS;YACb,CAAC;YACD,mFAAmF;YACnF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,CAAC,iBAAiB;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChE,SAAS;QACb,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,SAAS,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,QAAQ,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;oBAChE,SAAS;gBACb,CAAC;gBACD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,oBAAoB,GAAG,qBAAqB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;gBACjH,SAAS;YACb,CAAC;YACD,8FAA8F;YAC9F,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ;gBAAE,SAAS;YAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACjE,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;YACrF,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,aAAa,QAAQ,CAAC,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC,CAAC;YACzF,CAAC;iBAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;gBAC/E,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,QAAQ,KAAK,mCAAmC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxH,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,2EAA2E;QAC3E,0FAA0F;QAC1F,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,6BAA6B,GAAG,UAAU,GAAG,KAAK,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,mEAAmE;IACnE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAC7C,6FAA6F;AAC7F,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAEtD,iGAAiG;AACjG,kGAAkG;AAClG,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAChB,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;IACtD,8FAA8F;IAC9F,+FAA+F;IAC/F,kGAAkG;IAClG,oEAAoE;IACpE,iGAAiG;IACjG,6FAA6F;IAC7F,6EAA6E,CACpF,CAAC;AAEF,gGAAgG;AAChG,6FAA6F;AAC7F,SAAS,aAAa;IAClB,OAAO,CACH,kBAAkB;QAClB,qBAAqB;QACrB,0IAA0I;QAC1I,kBAAkB;QAClB,8GAA8G;QAC9G,UAAU;QACV,4FAA4F;QAC5F,qHAAqH;QACrH,SAAS;QACT,KAAK,CACR,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,kCAAkC;AAClC,uGAAuG;AACvG,8GAA8G;AAC9G,SAAS,oBAAoB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,oFAAoF,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAa,EAAE,KAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,mBAAmB,KAAK,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,0FAA0F;IAC1F,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,0BAA0B,CAAC,CAAC;IACnG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS;QAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oGAAoG,CAAC,CAAC;SACzI,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK;QAClE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oFAAoF,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS;QACjE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,wEAAwE,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,8GAA8G;AAC9G,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,QAAiB;IACrE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,yFAAyF;gBACzF,8CAA8C,aAAa,EAAE,EAAE;SAClE,CAAC;IACN,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,4CAA4C,aAAa,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,4DAA4D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAiC,CAAC,EAAE,CAAC;QAC7G,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC;IAED,iGAAiG;IACjG,8FAA8F;IAC9F,oDAAoD;IACpD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACP,0FAA0F;gBAC1F,oGAAoG,CACvG,CAAC;QACN,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,iDAAiD,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAwC,CAAC,EAAE,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,EAAE,CAAC,mBAAmB,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,IAAI,OAAO,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnE,sGAAsG;IACtG,sFAAsF;IACtF,IAAI,YAAY,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,sDAAyB,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE5F,qGAAqG;IACrG,oGAAoG;IACpG,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,0KAA0K,CAAC,CAAC;QAC5L,CAAC;IACL,CAAC;IAED,wFAAwF;IACxF,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,kDAAqB,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEtE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,wDAA2B,EAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,qGAAqG;IACrG,IAAI,mBAAmB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;IAC3H,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB;IACxB,OAAO,qCAAqC,CAAC;AACjD,CAAC;AAED,gFAAgF;AAChF,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,KAAc,EAAE,GAAW;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,mBAAmB,GAAG,uDAAuD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,6FAA6F;AAC7F,SAAgB,oBAAoB,CAAC,OAAgB;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,kFAAkF;gBAClF,2DAA2D,mBAAmB,EAAE,EAAE;SACrF,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChF,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,mGAAmG;IACnG,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAA,kCAAY,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACxD,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,IAAA,qCAAe,EAAC,OAAO,CAAC,SAAS,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,8EAA8E;AAC9E,kGAAkG;AAClG,sGAAsG;AACtG,yGAAyG;AACzG,8EAA8E;AAE9E,SAAS,iBAAiB;IACtB,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,wCAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,OAAe;IAC/B,8DAA8D;IAC9D,IAAI,CAAC;QACD,kFAAkF;QAClF,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,SAAS,CAAC;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACzB,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,+GAA+G;AAC/G,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,uBAAuB,KAAK,kHAAkH,CAAC,CAAC;IAC5J,CAAC;IACD,+FAA+F;IAC/F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,+EAA+E,CAAC,CAAC;IAE7H,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oDAAoD,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACJ,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,aAAa,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,0CAA0C,CAAC,CAAC;IAElF,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,kCAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAuC,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,yBAAyB,kCAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElG,qGAAqG;IACrG,mGAAmG;IACnG,mGAAmG;IACnG,qCAAqC;IACrC,IAAI,OAAO,CAAC,CAAC,uBAAuB,CAAC,KAAK,QAAQ;QAC9C,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oGAAoG,CAAC,CAAC;IAC5I,IAAI,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,0BAA0B,CAAC,KAAK,QAAQ,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oFAAoF,CAAC,CAAC;IAE5H,iEAAiE;IACjE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,mDAAmD,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,iEAAiE,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC7E,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oCAAoC,CAAC,CAAC;IAE5E,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,SAAgB,yBAAyB,CAAC,OAAgB;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,6FAA6F;gBAC7F,uGAAuG,iBAAiB,EAAE,EAAE;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,wEAAwE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,0FAA0F;QAC1F,MAAM,IAAI,GAAI,OAAO,CAAC,CAAC,CAAoC,EAAE,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,0CAA0C,CAAC,CAAC;YACvH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,4EAA4E;AAC5E,SAAgB,wBAAwB,CACpC,YAAqD,EACrD,iBAA0D;IAE1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAA,sBAAW,EAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,yBAAyB,8CAAwB,sCAAsC;gBAC/F,gFAAgF,CACnF,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,2FAA2F;QAC3F,IAAI,CAAC,IAAA,sBAAW,EAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,wBAAwB,8CAAwB,sCAAsC;gBAC9F,gFAAgF,CACnF,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { FieldDef } from './field-def';\n// Imported, never re-typed: the banner offers the bulk migrator only for errors it actually covers, and\n// this marker is how it recognizes a placement error. See config-error-banner.ts.\nimport { SECTION_PLACEMENT_MARKER } from './config-error-banner';\nimport { sectionForRule, isHookGuard } from './sections';\nimport { MODIFIED_CODE_MODES } from './rule-configs';\nimport {\n    FeatureBranchGuardConfig,\n    ReadStaleGuardConfig,\n    MergedBranchBashGuardConfig,\n    StaleMainBashGuardConfig,\n} from './main-sync-guard-configs';\nimport { validateChecklistsSection, validateLandPrSection, validateNoGateSaltRationale } from './pr-gate-section-validators';\nimport { retiredEntry, retiredKeyError, retiredRuleFor } from './retired-config-keys';\n\n// Re-exported so the isolated validate-checklist-docs target keeps importing it from here.\nexport { validateChecklistsSection };\nimport { DEFAULT_MATCH_RULES } from './match-rules-config';\nimport { toError } from './to-error';\nimport {\n    MaxMethodLinesConfig,\n    MaxFileLinesConfig,\n    RequireReturnTypeConfig,\n    NoInlineTypeLiteralsConfig,\n    NoAnyUnknownConfig,\n    NoImplicitAnyConfig,\n    PrismaValidateDtosConfig,\n    PrismaConverterConfig,\n    NoDestructureConfig,\n    NoUnmanagedExceptionsConfig,\n    CatchErrorPatternConfig,\n    ThrowCauseRequiredConfig,\n    AngularNoDirectApiInResolverConfig,\n    NoSymbolDiTokensConfig,\n    NoCustomCssConfig,\n    NoProcessExitOutsideMainConfig,\n    NoFunctionOutsideClassConfig,\n    InjectAnnotationNotNeededForConcreteClassConfig,\n    FrameworkTagConfig,\n    RoleTagConfig,\n    BranchCreationGuardConfig,\n    PrCreationOrPushGuardConfig,\n    MergeInProgressGuardConfig,\n    PrMergeGuardConfig,\n    RedirectHowToMergeMainConfig,\n    NoFileImportCyclesConfig,\n    RuntimeArchitectureConfig,\n    NxWiringConfig,\n    DiGraphConfig,\n    MissingDesignAnnotationConfig,\n    NoJsFilesConfig,\n    ValidateTsInSrcConfig,\n    ValidateArchitectureUnchangedConfig,\n    ValidateNoArchitectureCyclesConfig,\n    ValidatePackageJsonConfig,\n    ValidateVersionsLockedConfig,\n    ValidateEslintSyncConfig,\n} from './rule-configs';\nimport { NoClientCreationOutsideServerOrClientConfig } from './no-client-creation-config';\n\n// Thin lookup table — each entry delegates to the class's own SCHEMA.\n// No field lists here; all schemas live with their config class.\nconst RULE_SCHEMAS: Record<string, Record<string, FieldDef>> = {\n    'max-method-lines': MaxMethodLinesConfig.SCHEMA,\n    'max-file-lines': MaxFileLinesConfig.SCHEMA,\n    'require-return-type': RequireReturnTypeConfig.SCHEMA,\n    'no-inline-type-literals': NoInlineTypeLiteralsConfig.SCHEMA,\n    'no-any-unknown': NoAnyUnknownConfig.SCHEMA,\n    'no-implicit-any': NoImplicitAnyConfig.SCHEMA,\n    'prisma-validate-dtos': PrismaValidateDtosConfig.SCHEMA,\n    'prisma-converter': PrismaConverterConfig.SCHEMA,\n    'no-destructure': NoDestructureConfig.SCHEMA,\n    'no-unmanaged-exceptions': NoUnmanagedExceptionsConfig.SCHEMA,\n    'catch-error-pattern': CatchErrorPatternConfig.SCHEMA,\n    'throw-cause-required': ThrowCauseRequiredConfig.SCHEMA,\n    'angular-no-direct-api-in-resolver': AngularNoDirectApiInResolverConfig.SCHEMA,\n    'no-symbol-di-tokens': NoSymbolDiTokensConfig.SCHEMA,\n    'no-client-creation-outside-server-or-client': NoClientCreationOutsideServerOrClientConfig.SCHEMA,\n    'no-custom-css': NoCustomCssConfig.SCHEMA,\n    'no-process-exit-outside-main': NoProcessExitOutsideMainConfig.SCHEMA,\n    'no-function-outside-class': NoFunctionOutsideClassConfig.SCHEMA,\n    'inject-annotation-not-needed-for-concrete-class': InjectAnnotationNotNeededForConcreteClassConfig.SCHEMA,\n    'framework-tag': FrameworkTagConfig.SCHEMA,\n    'role-tag': RoleTagConfig.SCHEMA,\n    'branch-creation-guard': BranchCreationGuardConfig.SCHEMA,\n    'pr-creation-or-push-guard': PrCreationOrPushGuardConfig.SCHEMA,\n    'merge-in-progress-guard': MergeInProgressGuardConfig.SCHEMA,\n    'pr-merge-guard': PrMergeGuardConfig.SCHEMA,\n    'redirect-how-to-merge-main': RedirectHowToMergeMainConfig.SCHEMA,\n    'feature-branch-guard': FeatureBranchGuardConfig.SCHEMA,\n    'read-stale-guard': ReadStaleGuardConfig.SCHEMA,\n    'merged-branch-bash-guard': MergedBranchBashGuardConfig.SCHEMA,\n    'stale-main-bash-guard': StaleMainBashGuardConfig.SCHEMA,\n    'no-file-import-cycles': NoFileImportCyclesConfig.SCHEMA,\n    'runtime-architecture': RuntimeArchitectureConfig.SCHEMA,\n    'nx-wiring': NxWiringConfig.SCHEMA,\n    'di-graph': DiGraphConfig.SCHEMA,\n    'missing-design-annotation': MissingDesignAnnotationConfig.SCHEMA,\n    'no-js-files': NoJsFilesConfig.SCHEMA,\n    'validate-ts-in-src': ValidateTsInSrcConfig.SCHEMA,\n    'validate-architecture-unchanged': ValidateArchitectureUnchangedConfig.SCHEMA,\n    'validate-no-architecture-cycles': ValidateNoArchitectureCyclesConfig.SCHEMA,\n    'validate-packagejson': ValidatePackageJsonConfig.SCHEMA,\n    'validate-versions-locked': ValidateVersionsLockedConfig.SCHEMA,\n    'validate-eslint-sync': ValidateEslintSyncConfig.SCHEMA,\n};\n\n// Every built-in rule name that has a typed schema (code rules + bash guards). The installer uses\n// this (with sectionForRule) to seed a fresh webpieces.config.json with every rule in its section.\nexport function allRuleNames(): readonly string[] {\n    return Object.keys(RULE_SCHEMAS);\n}\n\nfunction valueHint(def: FieldDef, key?: string): string {\n    // The two universal escape hatches, REQUIRED on every rule so they're always visible. Spell out the\n    // \"off\" value so a fresh config seeds them in the active/no-op state (0 / null), not a placeholder.\n    if (key === 'turnOffRuleUntilEpoch') return '0  (0 = active; future unix-epoch seconds = temporarily off)';\n    if (key === 'turnOffRuleWhileOnBranch') return 'null  (null = always on; a branch name disables the rule while that branch is checked out)';\n    return def.enumValues\n        ? `\"${def.enumValues.join(' | ')}\"`\n        : def.type === 'string[]' ? '[\"<string>\", ...]'\n        : def.type === 'number'   ? '<number>'\n        : def.type === 'boolean'  ? '<boolean>'\n        : '\"<string>\"';\n}\n\n// Scoped modes (narrowest → broadest) that enforce ONLY on what changed, so a rule can be\n// adopted gradually instead of all-at-once. When a rule offers one, recommend the first it\n// supports so a fresh config opts into a low-friction rollout rather than reflexively OFF.\nconst GRADUAL_MODE_PREFERENCE = [\n    'MODIFIED_PROJECTS',\n    'NEW_AND_MODIFIED_CODE',\n    'NEW_AND_MODIFIED_METHODS',\n    'MODIFIED_CLASS',\n    'NEW_METHODS',\n    'NEW_AND_MODIFIED_FILES',\n];\n\n/** A rollout hint for the copy-paste snippet: recommend the narrowest gradual mode the rule supports. */\nfunction rolloutTip(schema: Record<string, FieldDef>): string {\n    const modes = schema['mode']?.enumValues ?? [];\n    const recommended = GRADUAL_MODE_PREFERENCE.find((m: string) => modes.includes(m));\n    if (!recommended) return '';\n    const optOut = modes.includes('OFF') ? ' Set \"mode\": \"OFF\" to opt out entirely.' : '';\n    return (\n        `\\n\\n💡 Recommended: start with \"mode\": \"${recommended}\" — it enforces only on what you ` +\n        `actually change, so the rule rolls out gradually (existing code stays grandfathered until ` +\n        `you next touch that project/file/method).${optOut}`\n    );\n}\n\nfunction missingRuleSnippet(ruleName: string, schema: Record<string, FieldDef>): string {\n    // Required fields go in the copy-paste entry. The two universal escape hatches\n    // (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch) are now REQUIRED, so they land in that block —\n    // which is the whole point: every seeded rule shows both hatches. Optional fields are listed separately.\n    const fields = Object.keys(schema);\n    const required = fields.filter(f => !schema[f].optional);\n    const optional = fields.filter(f => schema[f].optional);\n\n    const requiredLines = required.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n    const section = sectionForRule(ruleName);\n    let out =\n        `[${ruleName}] Not configured in webpieces.config.json. Add this entry to the \"${section}\" section\\n` +\n        `(choose values appropriate for your project):\\n\\n` +\n        `  \"${ruleName}\": {\\n${requiredLines.join(',\\n')}\\n  }`;\n\n    if (optional.length > 0) {\n        const optionalLines = optional.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n        out +=\n            `\\n\\nOptional fields you may add to this rule (omit if not needed):\\n` +\n            `${optionalLines.join(',\\n')}`;\n    }\n    out += rolloutTip(schema);\n    return out;\n}\n\n// A config key under rules/hookGuards that the RUNNING validator has no schema for (and no rulesDir is\n// set to supply custom rules). Two very different causes, so the message leads with the common one:\n//   1. Version skew (most common — happens right after a dep bump): webpieces.config.json references a\n//      rule a NEWER @webpieces release added, but the installed guard is OLDER and doesn't know it yet.\n//      Fix = `pnpm install` (NOT deleting the key — the key is valid, the validator is just stale).\n//   2. A genuinely removed/renamed rule left behind, or a typo. Fix = remove the key.\n// Do NOT tell the AI to delete first — that destroys valid config in case 1 (the trap that made the AI\n// gut a working config instead of running `pnpm install`). The banner in load-config.ts spells out the\n// ordered \"run pnpm install, THEN edit only if it persists\" fix.\nfunction unknownRuleError(ruleName: string): string {\n    return (\n        `[${ruleName}] Unknown rule — the running @webpieces validator has no schema for it, and no ` +\n        `\"rulesDir\" is configured to supply custom rules. Most often this means your installed guard is a ` +\n        `release BEHIND this webpieces.config.json: run \\`pnpm install\\` first (see the fix steps below) so ` +\n        `the validator learns \"${ruleName}\". Only if it is STILL unknown after a fresh install is it a ` +\n        `removed/renamed rule or a typo — then remove the \"${ruleName}\" key from webpieces.config.json.`\n    );\n}\n\n// Fields we DELETED from a rule's schema, keyed by \"<rule>.<field>\". The generic unknown-field error\n// (\"Unknown field ... Valid fields: [...]\") is correct but doesn't say WHY the field vanished, so an AI\n// might re-add it. These hints explain the removal so the only action left is to delete the key.\nconst RETIRED_FIELD_HINTS: Record<string, string> = {\n    'runtime-architecture.servicePaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json (apiRelations + project roles). Delete it.',\n    'runtime-architecture.apiProjectPaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json, so there is NO list of api libs to maintain. Delete it (do not ' +\n        'enumerate api libs and do not replace it with a glob).',\n};\n\n// Universal field renames (apply to EVERY rule/guard AND every match-rule, unlike the per-rule\n// RETIRED_FIELD_HINTS). When an entry still uses the old escape-hatch name, the generic unknown-field\n// error is replaced with a precise \"renamed to X — rename it\" instruction so the fix is mechanical.\nconst RENAMED_FIELD_ALIASES: Record<string, string> = {\n    ignoreModifiedUntilEpoch: 'turnOffRuleUntilEpoch',\n    ignoreRuleWhileOnBranch: 'turnOffRuleWhileOnBranch',\n};\n\n\n// The renamed-field message shared by keyed rules and match-rules.\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction renamedFieldError(scope: string, oldKey: string, newKey: string): string {\n    return `${scope} Unknown field \"${oldKey}\" — it was renamed to \"${newKey}\". Rename it (the value carries over unchanged; for the branch hatch, use null when there is no branch).`;\n}\n\n// webpieces-disable no-any-unknown -- rawRules values are opaque JSON; each field is validated individually\nexport function validateWebpiecesConfig(\n    rawRules: Record<string, Record<string, unknown>>,\n    hasCustomRulesDir: boolean = false,\n): string[] {\n    const errors: string[] = [];\n\n    // Check field-level correctness for rules that are present\n    for (const [ruleName, entry] of Object.entries(rawRules)) {\n        const schema = RULE_SCHEMAS[ruleName];\n        if (!schema) {\n            // A name we KNOW is retired beats the unknown-rule message, which leads with \"run `pnpm\n            // install`, your validator may be stale\" — precisely the wrong advice for a dead name. It\n            // fires even when a rulesDir is set, because a custom rule must not reuse a retired name.\n            const retired = retiredRuleFor(ruleName);\n            if (retired) {\n                errors.push(retiredKeyError(retired));\n                continue;\n            }\n            // No built-in schema. With no rulesDir there are no custom rules, so this key is a\n            // dead/typo'd entry — tell the AI to remove it (a removed rule like no-shell-substitution\n            // lingers here otherwise). With a rulesDir it may be a legitimate custom rule → skip.\n            if (!hasCustomRulesDir) errors.push(unknownRuleError(ruleName));\n            continue;\n        }\n        for (const [key, value] of Object.entries(entry)) {\n            const fieldDef = schema[key];\n            if (!fieldDef) {\n                const renamedTo = RENAMED_FIELD_ALIASES[key];\n                if (renamedTo) {\n                    errors.push(renamedFieldError(`[${ruleName}]`, key, renamedTo));\n                    continue;\n                }\n                const retiredHint = RETIRED_FIELD_HINTS[`${ruleName}.${key}`];\n                const suffix = retiredHint ? ` ${retiredHint}` : '';\n                errors.push(`[${ruleName}] Unknown field \"${key}\". Valid fields: [${Object.keys(schema).join(', ')}].${suffix}`);\n                continue;\n            }\n            // A nullable field (e.g. turnOffRuleWhileOnBranch) accepts JSON null in addition to its type.\n            if (value === null && fieldDef.nullable) continue;\n            if (fieldDef.type === 'string[]') {\n                if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))\n                    errors.push(`[${ruleName}] \"${key}\" must be string[], got ${typeof value}.`);\n            } else if (typeof value !== fieldDef.type) {\n                errors.push(`[${ruleName}] \"${key}\" must be ${fieldDef.type}, got ${typeof value}.`);\n            } else if (fieldDef.enumValues && !fieldDef.enumValues.includes(value as string)) {\n                errors.push(`[${ruleName}] \"${key}\" = \"${value}\" is not valid. Must be one of: ${fieldDef.enumValues.join(', ')}.`);\n            }\n        }\n        // Required fields must actually be present. Until now the loop above only checked\n        // fields that WERE present, so an entry like `{}` (or one missing `mode` /\n        // `turnOffRuleUntilEpoch`) slipped through. Every non-optional schema field is mandatory.\n        for (const [key, fieldDef] of Object.entries(schema)) {\n            if (!fieldDef.optional && !(key in entry)) {\n                errors.push(`[${ruleName}] Missing required field \"${key}\". Add ${key}: ${valueHint(fieldDef, key)}.`);\n            }\n        }\n    }\n\n    // Every built-in rule must be explicitly configured — no silent defaults.\n    // When a new rule is added to the framework, this check surfaces it immediately\n    // with a ready-to-copy snippet so AI can configure it in one pass.\n    for (const [ruleName, schema] of Object.entries(RULE_SCHEMAS)) {\n        if (!(ruleName in rawRules)) {\n            errors.push(missingRuleSnippet(ruleName, schema));\n        }\n    }\n\n    return errors;\n}\n\nconst PR_GATE_MODES = ['ON', 'OFF'] as const;\n// Optional — omitted means DETECT. Kept inline (like prGateExample) to avoid a load-config ↔\n// pr-gate-config import cycle; the canonical list + semantics live in pr-gate-config.ts.\nconst PR_GATE_MERGE_MODES = ['AUTO', 'NONE'] as const;\n\n// Spelled out because the choice is a POLICY decision with a consequence the chooser cannot see:\n// only the AUTO path can put the compact risk/flags body in main's history, because a UI merge is\n// limited to the repo's squash_merge_commit_title/message settings and no setting produces it.\nconst MERGE_MODE_HELP = (\n        `Must be one of: ${PR_GATE_MERGE_MODES.join(', ')}.\\n` +\n        `  \"AUTO\" — wp-finish-upsert-pr lands the PR: it squash-merges when mergeable, else enables\\n` +\n        `           GitHub auto-merge, both with an explicit --subject/--body-file so main's history\\n` +\n        `           gets the PR title + the compact risk/flags body. Needs allow_auto_merge on the repo\\n` +\n        `           (gh api repos/{owner}/{repo} --jq .allow_auto_merge).\\n` +\n        `  \"NONE\" — wp-finish-upsert-pr only opens/updates the PR; a human merges it. The compact body\\n` +\n        `           is then impossible, so set the repo's squash_merge_commit_title to PR_TITLE or\\n` +\n        `           commits land as the internal \"Squash merge of <branch>\" subject.`\n);\n\n// Copy-paste example for the top-level `pr-gate` block (sibling of `rules`). Kept inline rather\n// than imported from pr-gate-config.ts to avoid a load-config ↔ pr-gate-config import cycle.\nfunction prGateExample(): string {\n    return (\n        `  \"pr-gate\": {\\n` +\n        `    \"mode\": \"ON\",\\n` +\n        `    \"buildCommand\": \"<command CI runs to validate a PR, e.g. pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)>\",\\n` +\n        `    \"gates\": [\\n` +\n        `      { \"name\": \"API Changed\", \"patterns\": [\"libraries/apis/**\", \"**/*Api.ts\"], \"warningColor\": \"yellow\" }\\n` +\n        `    ],\\n` +\n        `    \"checklists\": [   // OPTIONAL — per-area review, one distinct reviewer subagent each\\n` +\n        `      { \"subagent\": \"db-migration-reviewer\", \"doc\": \".claude/review/db-migrations.md\", \"patterns\": [\"**/*.sql\"] }\\n` +\n        `    ]\\n` +\n        `  }`\n    );\n}\n\n// The `gates` array: dashboard-only warning flags. Extracted from validatePrGateSection to keep that\n// method inside the length limit.\n// webpieces-disable no-any-unknown -- `value` is the opaque consumer `gates` value until narrowed here\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction validateGatesSection(value: unknown): string[] {\n    if (!Array.isArray(value)) {\n        return [`[pr-gate] \"gates\" must be an array of { name, patterns, warningColor, disabled? }.`];\n    }\n    const errors: string[] = [];\n    for (let i = 0; i < value.length; i += 1) {\n        errors.push(...validateGate(value[i], i));\n    }\n    return errors;\n}\n\n// webpieces-disable no-any-unknown -- one gate entry from opaque consumer JSON, validated field-by-field\nfunction validateGate(gate: unknown, index: number): string[] {\n    if (typeof gate !== 'object' || gate === null) {\n        return [`[pr-gate] gates[${index}] must be an object { name, patterns, warningColor, disabled? }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque gate object from consumer JSON\n    const g = gate as Record<string, unknown>;\n    const errors: string[] = [];\n    if (typeof g['name'] !== 'string') errors.push(`[pr-gate] gates[${index}].name must be a string.`);\n    if (!Array.isArray(g['patterns']) || !g['patterns'].every(p => typeof p === 'string'))\n        errors.push(`[pr-gate] gates[${index}].patterns must be string[].`);\n    if (g['warningColor'] === undefined)\n        errors.push(`[pr-gate] gates[${index}].warningColor is required — set it to \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    else if (g['warningColor'] !== 'yellow' && g['warningColor'] !== 'red')\n        errors.push(`[pr-gate] gates[${index}].warningColor must be \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    if (g['disabled'] !== undefined && typeof g['disabled'] !== 'boolean')\n        errors.push(`[pr-gate] gates[${index}].disabled must be a boolean (example/inactive gate kept in the file).`);\n    return errors;\n}\n\n/**\n * Validate the top-level `pr-gate` section. It is REQUIRED (a client that opts out sets mode \"OFF\").\n * `buildCommand` is required unless mode is \"OFF\". Returns human-readable, copy-paste-friendly errors\n * — never throws. The pr-gate block lives outside the FieldDef-driven `rules` schema because its\n * nested `gates`/`checklists` arrays can't be expressed there, so they get structural validation here.\n * `repoRoot` (when known) lets the `checklists[].docs` existence check run.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validatePrGateSection(section: unknown, repoRoot?: string): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[pr-gate] Not configured in webpieces.config.json. Add this block under the \"commands\" ` +\n            `section (set \"mode\": \"OFF\" to opt out):\\n\\n${prGateExample()}`,\n        ];\n    }\n    if (typeof section !== 'object' || Array.isArray(section)) {\n        return [`[pr-gate] Must be an object. Example:\\n\\n${prGateExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque pr-gate section from consumer JSON\n    const s = section as Record<string, unknown>;\n    const errors: string[] = [];\n\n    if (!('mode' in s)) {\n        errors.push(`[pr-gate] Missing required field \"mode\". Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    } else if (typeof s['mode'] !== 'string' || !PR_GATE_MODES.includes(s['mode'] as typeof PR_GATE_MODES[number])) {\n        errors.push(`[pr-gate] \"mode\" = \"${String(s['mode'])}\" is not valid. Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    }\n\n    // buildCommand and mergeMode are both required whenever the gate is active (mode !== OFF). There\n    // is deliberately NO default for mergeMode: whether the tooling may land your PRs is a policy\n    // decision, and either guess is wrong for somebody.\n    if (s['mode'] !== 'OFF') {\n        const cmd = s['buildCommand'];\n        if (typeof cmd !== 'string' || cmd.trim() === '') {\n            errors.push(\n                `[pr-gate] Missing required field \"buildCommand\" — the command CI runs to validate a PR. ` +\n                `Add e.g. \"buildCommand\": \"pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)\".`,\n            );\n        }\n        const mm = s['mergeMode'];\n        if (!('mergeMode' in s)) {\n            errors.push(`[pr-gate] Missing required field \"mergeMode\". ${MERGE_MODE_HELP}`);\n        } else if (typeof mm !== 'string' || !PR_GATE_MERGE_MODES.includes(mm as typeof PR_GATE_MERGE_MODES[number])) {\n            errors.push(`[pr-gate] \"mergeMode\" = \"${String(mm)}\" is not valid. ${MERGE_MODE_HELP}`);\n        }\n    }\n\n    if ('gates' in s) errors.push(...validateGatesSection(s['gates']));\n\n    // Optional extension point: company review checklists, as an ARRAY right here in the config. Absent ⇒\n    // none. The removed { doc } manifest shape is rejected with the exact migration edit.\n    if ('checklists' in s) errors.push(...validateChecklistsSection(s['checklists'], repoRoot));\n\n    // Optional server-token salt. Absent ⇒ no token minted, CI enforcement is a no-op. Present ⇒ must be\n    // a non-empty string (an empty salt would mint a token anyone can forge from a known-empty secret).\n    if ('gateSalt' in s) {\n        const salt = s['gateSalt'];\n        if (typeof salt !== 'string' || salt.trim() === '') {\n            errors.push(`[pr-gate] \"gateSalt\" must be a non-empty string — it is the shared secret the gate token is HMAC'd with. Omit the key entirely to disable server-side token enforcement.`);\n        }\n    }\n\n    // Optional: what happens to the LOCAL branch once its PR lands. Absent ⇒ \"archive-tag\".\n    if ('landPr' in s) errors.push(...validateLandPrSection(s['landPr']));\n\n    errors.push(...validateNoGateSaltRationale(s));\n\n    // Optional: publish reviewer output as a PR comment (defaults true). Must be a boolean when present.\n    if ('checklistComments' in s && typeof s['checklistComments'] !== 'boolean') {\n        errors.push(`[pr-gate] \"checklistComments\" must be a boolean (defaults to true; set false to keep the PR body-only).`);\n    }\n\n    return errors;\n}\n\nfunction excludePathsExample(): string {\n    return '\"excludePaths\": [\"repositories/**\"]';\n}\n\n// A glob list: must be a string[] (may be empty). `key` names it for the error.\n// webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed here\nfunction validateExcludeList(value: unknown, key: string): string[] {\n    if (!(Array.isArray(value) && value.every(p => typeof p === 'string'))) {\n        return [`[excludePaths] \"${key}\" must be a string[] of glob paths (use [] for none).`];\n    }\n    return [];\n}\n\n/**\n * Validate the REQUIRED top-level `excludePaths` block: ONE glob list suppressing hook enforcement per\n * file path, for code-style rules and file-scoped guards alike. Required so every client upgrading is\n * forced to declare it (as [] to keep today's behavior, or with real paths). Returns copy-paste\n * friendly errors and never throws — same contract as validatePrGateSection.\n *\n * The two-list object form `{ \"rules\": [...], \"guards\": [...] }` is RETIRED, not tolerated. It used to be\n * accepted and silently unioned, which is why this repo's own config sat on the dead shape for releases: an\n * accepted shape is never migrated. Rejecting it cannot wedge a consumer — editing webpieces.config.json is\n * always permitted, even while it is invalid. See retired-config-keys.ts.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateExcludePaths(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[excludePaths] Not configured in webpieces.config.json. Add this REQUIRED block ` +\n            `(use an empty array to keep enforcing everywhere):\\n\\n  ${excludePathsExample()}`,\n        ];\n    }\n    if (Array.isArray(section)) return validateExcludeList(section, 'excludePaths');\n    if (typeof section !== 'object') {\n        return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque excludePaths section from consumer JSON\n    const s = section as Record<string, unknown>;\n    // The retired two-list object. One table row owns the message for either key present.\n    const retired = retiredEntry('rules', '[excludePaths]');\n    if (retired && (s['rules'] !== undefined || s['guards'] !== undefined)) {\n        return [`${retiredKeyError(retired)}\\n\\n  ${excludePathsExample()}`];\n    }\n    return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n}\n\n// ---------------------------------------------------------------------------\n// match-rules — a new top-level ARRAY section (parallel to pr-gate/excludePaths). Each entry is a\n// client-authored content guard (raw-regex patterns + message + scoping). Validated structurally here\n// the same way pr-gate's `gates` are, because an array of objects can't be expressed in FieldDef schema.\n// ---------------------------------------------------------------------------\n\nfunction matchRulesExample(): string {\n    return `\"match-rules\": ${JSON.stringify(DEFAULT_MATCH_RULES, null, 4)}`;\n}\n\n// webpieces-disable no-any-unknown -- generic type guard over an opaque JSON value\nfunction isStringArray(value: unknown): value is string[] {\n    return Array.isArray(value) && value.every(v => typeof v === 'string');\n}\n\n// Compile a pattern to validate it; returns the error message, or undefined when it compiles.\nfunction regexError(pattern: string): string | undefined {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Constructed only to validate the syntax; the object is intentionally discarded.\n        void new RegExp(pattern);\n        return undefined;\n    } catch (err: unknown) {\n        const error = toError(err);\n        return error.message;\n    }\n}\n\n// One entry of the match-rules array, validated field-by-field (see validateGate for the pattern).\n// webpieces-disable no-any-unknown -- one match-rule entry from opaque consumer JSON, validated field-by-field\nfunction validateMatchRule(entry: unknown, index: number): string[] {\n    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {\n        return [`[match-rules] entry[${index}] must be an object { name, patterns, mainMessage, mode, turnOffRuleUntilEpoch, turnOffRuleWhileOnBranch, ... }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque match-rule entry from consumer JSON\n    const e = entry as Record<string, unknown>;\n    const label = typeof e['name'] === 'string' ? `\"${e['name']}\"` : `entry[${index}]`;\n    const errors: string[] = [];\n\n    if (typeof e['name'] !== 'string' || e['name'].trim() === '')\n        errors.push(`[match-rules] entry[${index}].name must be a non-empty string (it is the disable token and report label).`);\n\n    if (!isStringArray(e['patterns']) || e['patterns'].length === 0) {\n        errors.push(`[match-rules] ${label}.patterns must be a non-empty string[] of regexes.`);\n    } else {\n        e['patterns'].forEach((p: string, pi: number) => {\n            const rxErr = regexError(p);\n            if (rxErr) errors.push(`[match-rules] ${label}.patterns[${pi}] is not a valid regex: ${rxErr}`);\n        });\n    }\n\n    if (typeof e['mainMessage'] !== 'string' || e['mainMessage'].trim() === '')\n        errors.push(`[match-rules] ${label}.mainMessage must be a non-empty string.`);\n\n    if (typeof e['mode'] !== 'string' || !MODIFIED_CODE_MODES.includes(e['mode'] as typeof MODIFIED_CODE_MODES[number]))\n        errors.push(`[match-rules] ${label}.mode must be one of: ${MODIFIED_CODE_MODES.join(', ')}.`);\n\n    // Both escape hatches are REQUIRED on every match-rule too (same as keyed rules), so they are always\n    // visible. turnOffRuleUntilEpoch: number (0 = active; a future unix-epoch in seconds = temporarily\n    // off). turnOffRuleWhileOnBranch: string | null (null = always on; a branch name disables the rule\n    // while that branch is checked out).\n    if (typeof e['turnOffRuleUntilEpoch'] !== 'number')\n        errors.push(`[match-rules] ${label}.turnOffRuleUntilEpoch must be a number (0 = active; future unix-epoch seconds = temporarily off).`);\n    if (!(e['turnOffRuleWhileOnBranch'] === null || typeof e['turnOffRuleWhileOnBranch'] === 'string'))\n        errors.push(`[match-rules] ${label}.turnOffRuleWhileOnBranch must be a string or null (null = no branch / always on).`);\n\n    // The old escape-hatch names were renamed — flag them precisely.\n    for (const oldKey of Object.keys(RENAMED_FIELD_ALIASES)) {\n        if (oldKey in e) errors.push(renamedFieldError(`[match-rules] ${label}`, oldKey, RENAMED_FIELD_ALIASES[oldKey]));\n    }\n\n    if (e['options'] !== undefined && !isStringArray(e['options']))\n        errors.push(`[match-rules] ${label}.options must be a string[] (omit if not needed).`);\n    if (e['allowedPaths'] !== undefined && !isStringArray(e['allowedPaths']))\n        errors.push(`[match-rules] ${label}.allowedPaths must be a string[] of globs (omit if not needed).`);\n    if (e['disableAllowed'] !== undefined && typeof e['disableAllowed'] !== 'boolean')\n        errors.push(`[match-rules] ${label}.disableAllowed must be a boolean.`);\n\n    return errors;\n}\n\n/**\n * Validate the REQUIRED top-level `match-rules` array (client-authored content guards). MISSING →\n * one error printing the ready-to-paste `no-fetch` example (add at least this; more can follow).\n * Present-but-`[]` → allowed (a conscious opt-out, matching pr-gate mode:OFF / excludePaths []).\n * Otherwise every entry is validated field-by-field (each regex compile-checked) plus name\n * uniqueness. Copy-paste-friendly errors; never throws — same contract as validatePrGateSection.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateMatchRulesSection(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[match-rules] Not configured in webpieces.config.json. Add this REQUIRED top-level array — ` +\n            `seed it with the no-fetch guard below (you can add more entries: no-moment, no-lodash-chain, …):\\n\\n${matchRulesExample()}`,\n        ];\n    }\n    if (!Array.isArray(section)) {\n        return [`[match-rules] Must be an array of content-guard objects. Example:\\n\\n${matchRulesExample()}`];\n    }\n\n    const errors: string[] = [];\n    const seen = new Set<string>();\n    for (let i = 0; i < section.length; i += 1) {\n        errors.push(...validateMatchRule(section[i], i));\n        // webpieces-disable no-any-unknown -- reading the name off an opaque entry only to dedupe\n        const name = (section[i] as Record<string, unknown> | null)?.['name'];\n        if (typeof name === 'string') {\n            if (seen.has(name)) errors.push(`[match-rules] duplicate entry name \"${name}\" — each match-rule name must be unique.`);\n            seen.add(name);\n        }\n    }\n    return errors;\n}\n\n/**\n * Enforce that each built-in lives in its correct section: code rules under `rules`, bash guards\n * under `hookGuards`. A guard left in `rules` (or a rule placed in `hookGuards`) is reported with a\n * \"move it\" message so the split stays clean. Unknown/custom names are ignored (they may be custom\n * rules from rulesDir). Presence (\"every built-in must be configured\") is checked separately by\n * validateWebpiecesConfig against the merged map.\n */\n// webpieces-disable no-any-unknown -- section maps are opaque consumer JSON\nexport function validateSectionPlacement(\n    rulesSection: Record<string, Record<string, unknown>>,\n    hookGuardsSection: Record<string, Record<string, unknown>>,\n): string[] {\n    const errors: string[] = [];\n    for (const name of Object.keys(rulesSection)) {\n        if (isHookGuard(name)) {\n            errors.push(\n                `[${name}] is a hook guard and ${SECTION_PLACEMENT_MARKER} \"hookGuards\" section, not \"rules\". ` +\n                `Move it (or run \\`pnpm wp-install-ai-hooks --sync\\` to migrate automatically).`,\n            );\n        }\n    }\n    for (const name of Object.keys(hookGuardsSection)) {\n        // Only flag KNOWN code rules misplaced into hookGuards; unknown names may be custom rules.\n        if (!isHookGuard(name) && RULE_SCHEMAS[name]) {\n            errors.push(\n                `[${name}] is a code rule and ${SECTION_PLACEMENT_MARKER} \"rules\" section, not \"hookGuards\". ` +\n                `Move it (or run \\`pnpm wp-install-ai-hooks --sync\\` to migrate automatically).`,\n            );\n        }\n    }\n    return errors;\n}\n"]}

package/templates/webpieces.guard-matrix.md

@@ -22,6 +22,40 @@ reading this, one of the six faults below fired and named this file.
 First match wins. `D`/`X`/`K` are decided in POSIX `sh` inside the committed shim, BEFORE the
 guard bin runs — a stale, missing or broken validator cannot be trusted to validate itself.
 
+## The fix, per fault
+
+Every command below is rendered from that fault's `cures` array and is asserted, by unit test,
+to be accepted by `isAllowed()` — so nothing here can be a command the guard then rejects. Type
+the option you pick EXACTLY as written and run nothing else on that line.
+
+### `D` — version drift — root package.json pin != installed version
+
+- **Option 1 (preferred)**: `pnpm install`  ← pick this when node_modules is OLDER than the pin, OR you are on a feature branch and want YOUR branch pin (usually the case) — it always clears the drift
+- **Option 2**: `git pull`  ← pick this when node_modules is NEWER than the pin AND you are on main — the PIN is the stale side, so pull first and install second; a bare install would downgrade you
+
+### `X` — guard bin missing (fresh clone / new worktree / package removed)
+
+- **Option 1 (preferred)**: `pnpm install`  ← pick this when this fault fires at all — nothing is installed in THIS tree, and a new git worktree copies no node_modules
+
+### `K` — guard bin present but CRASHED (exit code not 0 or 2 — corrupt node_modules)
+
+- **Option 1 (preferred)**: `rm -rf node_modules && pnpm install`  ← pick this when this fault fires at all — a BARE pnpm install SKIPS the corrupt package, because pnpm sees the right version on disk and considers it installed; only the delete forces a rewrite
+
+### `S` — committed .claude/webpieces/ai-hook.sh != renderShim()
+
+- **Option 1 (preferred)**: `pnpm wp-install-ai-hooks --sync`  ← pick this when you are on a current release — it re-arms the shim as step 1 and returns before the interactive hook wiring, so it is the only non-interactive spelling
+- **Option 2**: `pnpm exec wp-upgrade-shim`  ← pick this when you want the shim regenerated and NOTHING else; needs installed @webpieces/ai-hook-rules 0.4.408 or newer
+- **Option 3**: `cp node_modules/@webpieces/ai-hook-rules/templates/ai-hook.sh .claude/webpieces/ai-hook.sh`  ← pick this when the installed @webpieces/ai-hook-rules is OLDER than 0.4.408, so wp-upgrade-shim does not exist yet — this works on every release
+
+### `C` — webpieces.config.json missing
+
+- **Option 1 (preferred)**: edit `webpieces.config.json` yourself  ← pick this when this fault fires at all — it is the only cure that needs no other tool, and it is never denied
+- **Option 2**: `pnpm exec wp-install-ai-hooks`  ← pick this when you are at an INTERACTIVE terminal and can answer its two hook-target prompts
+
+### `Y` — a loaded rule has no webpieces.config.json key
+
+- **Option 1 (preferred)**: edit `webpieces.config.json` yourself  ← pick this when this fault fires at all — it is the only cure that needs no other tool, and it is never denied
+
 ## The matrix
 
 L0 has NO genuine second dimension. Every branch reduces to one question:
@@ -50,7 +84,7 @@ that denied `rm -rf node_modules && pnpm install` while allowing a bare `pnpm in
 | 5 | git pull / git fetch - merge is NOT on the list | ALLOW |
 | 6 | pnpm exec wp-upgrade-shim | ALLOW |
 | 7 | cp node_modules/@webpieces/ai-hook-rules/templates/ai-hook.sh .claude/webpieces/ai-hook.sh | ALLOW |
-| 8 | pnpm exec wp-install-ai-hooks | ALLOW |
+| 8 | pnpm exec wp-install-ai-hooks (flags allowed, e.g. --sync) | ALLOW |
 
 - **PASS** — L0 has no objection; the call falls THROUGH so the downstream guards still judge it.
 - **ALLOW** — terminal; bypasses everything, because a cure must stay reachable even when a