@webpieces/rules-config 0.4.612 → 0.4.614

package/src/load-config.js

@@ -120,13 +120,9 @@ let ConfigLoader = class ConfigLoader {
         if (mergeInProgress && mergeInProgress['mergeCompleteCommand'] === undefined) {
             mergeInProgress['mergeCompleteCommand'] = commands.mergeComplete;
         }
-        // The whole-repo build guard REFUSES a build of the world and prints the narrow command
-        // instead. That command must be the one this repo's gate actually runs — the guard hard-coding
-        // its own copy is how a message starts teaching a command the project no longer uses.
-        const wholeRepoBuild = rules['whole-repo-build-guard'];
-        if (wholeRepoBuild && wholeRepoBuild['affectedBuildCommand'] === undefined) {
-            wholeRepoBuild['affectedBuildCommand'] = commands.prGate.buildCommand;
-        }
+        // whole-repo-build-guard is NOT injected here — it has no rules/hookGuards entry at all. It reads
+        // the same commands.pr-gate.buildCommand, handed to it directly by ai-hook-rules' runner off
+        // LoadedConfig.prGate. See home-config.ts for why that guard is home-config-only.
     }
     // webpieces-disable no-any-unknown -- merging opaque option bags from config JSON
     mergeRule(

package/src/load-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"load-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/load-config.ts"],"names":[],"mappings":";;;AA4MA,0CAEC;;AA9MD,mDAA6B;AAC7B,yCAA2D;AAE3D,uDAAwE;AACxE,+DAAiE;AACjE,+CAA2C;AAC3C,mDAA+C;AAC/C,6DAAoD;AACpD,uDAAkD;AAElD,mCAA0E;AAC1E,+EAAwE;AACxE,yDAA0D;AAC1D,uDAAuI;AAEvI,iEAA8D;AAE9D;;;GAGG;AACH,MAAa,YAAY;IAGR;IACA;IACA;IACA;IACA;IACA;IACA;IARb,yDAAyD;IACzD,YACa,QAAwB,EACxB,WAAiC,EACjC,QAAwB,EACxB,MAAoB,EACpB,YAA0B,EAC1B,UAAsC,EACtC,UAAyB;QANzB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,gBAAW,GAAX,WAAW,CAAsB;QACjC,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAc;QACpB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAA4B;QACtC,eAAU,GAAV,UAAU,CAAe;IACnC,CAAC;CACP;AAXD,oCAWC;AAED,wGAAwG;AACxG,2GAA2G;AAC3G,kGAAkG;AAClG,oGAAoG;AAEpG;;;;GAIG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACQ;IAA7B,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD;;;;OAIG;IACH,kGAAkG;IAClG,eAAe,CAAC,GAAW;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,aAAa,GAAG,IAAA,qCAAmB,EAAC,SAAS,CAAC,CAAC;YACrD,OAAO,IAAI,YAAY,CACnB,IAAI,sBAAc,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAClD,IAAI,2CAAoB,EAAE,EAC1B,aAAa,EACb,aAAa,CAAC,MAAM,EACpB,IAAI,iCAAY,CAAC,EAAE,CAAC,EACpB,EAAE,EACF,IAAI,CACP,CAAC;QACN,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,iBAAiB,GAAG,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC;QAC1D,4FAA4F;QAC5F,iGAAiG;QACjG,MAAM,YAAY,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAE/C,8FAA8F;QAC9F,iEAAiE;QACjE,MAAM,aAAa,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAEhE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,IAAI,EAAE,CAAC;QAE/C,iGAAiG;QACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG;YACX,+FAA+F;YAC/F,GAAG,IAAA,uCAAoB,EAAC,cAAoD,CAAC;YAC7E,GAAG,IAAA,yCAAuB,EAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC9D,GAAG,IAAA,0CAAwB,EAAC,YAAY,EAAE,iBAAiB,CAAC;YAC5D,GAAG,IAAA,qDAAuB,EAAC,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;YAC3E,GAAG,IAAA,sCAAoB,EAAC,cAAc,CAAC,YAAY,CAAC;YACpD,GAAG,IAAA,2CAAyB,EAAC,cAAc,CAAC,aAAa,CAAC,CAAC;SAC9D,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,+BAAa,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,qCAAmB,EAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEnD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;QAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;YACzB,GAAG,MAAM,CAAC,IAAI,CAAC,4BAAY,CAAC;YAC5B,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;SAChC,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAC9B,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,4BAAY,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,sBAAc,CAAC,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEhG,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;QAEvE,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACpH,CAAC;IAED,mGAAmG;IACnG,gGAAgG;IACxF,oBAAoB;IACxB,mEAAmE;IACnE,KAA8C,EAC9C,QAAwB;QAExB,MAAM,UAAU,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtD,IAAI,UAAU,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,UAAU,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACtD,CAAC;QACD,MAAM,eAAe,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzD,IAAI,eAAe,IAAI,eAAe,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3E,eAAe,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC;QACrE,CAAC;QACD,wFAAwF;QACxF,+FAA+F;QAC/F,sFAAsF;QACtF,MAAM,cAAc,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACvD,IAAI,cAAc,IAAI,cAAc,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;YACzE,cAAc,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;QAC1E,CAAC;IACL,CAAC;IAED,kFAAkF;IAC1E,SAAS;IACb,wDAAwD;IACxD,QAA6C;IAC7C,wDAAwD;IACxD,YAAiD;QAEjD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,0BAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,0BAAkB,CAAC,YAA4B,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,0BAAkB,CAAC,QAAuB,CAAC,CAAC;QAE1E,iEAAiE;QACjE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7E,OAAO,IAAI,0BAAkB,CAAC,MAAqB,CAAC,CAAC;IACzD,CAAC;IAED,sGAAsG;IACtG,wGAAwG;IACxG,8DAA8D;IAC9D,wFAAwF;IAChF,iBAAiB,CAAC,GAAY;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,iCAAY,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,iCAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,oGAAoG;IACpG,oGAAoG;IACpG,wDAAwD;IACxD,oGAAoG;IAC5F,eAAe,CAAC,GAAY;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,GAAwB,CAAC;IACpC,CAAC;IAEO,yBAAyB;IAC7B,4FAA4F;IAC5F,QAAiD,EACjD,QAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,2CAAoB,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,4EAA4E;YAC3E,KAAiC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,kGAAkG;IAClG,gGAAgG;IACxF,wBAAwB,CAAC,MAAgB;QAC7C,OAAO,IAAA,8CAAwB,EAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;CACJ,CAAA;AAxJY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEI,wBAAU;GAD1C,YAAY,CAwJxB;AAED,kGAAkG;AAClG,8FAA8F;AAC9F,MAAM,eAAe,GAAG,IAAI,YAAY,CAAC,IAAI,wBAAU,EAAE,CAAC,CAAC;AAE3D,2IAA2I;AAC3I,SAAgB,eAAe,CAAC,GAAW;IACvC,OAAO,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC","sourcesContent":["import * as path from 'path';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nimport { buildCommandsConfig, CommandsConfig } from './commands-config';\nimport { formatConfigErrorsBanner } from './config-error-banner';\nimport { ConfigFile } from './config-file';\nimport { defaultRules } from './default-rules';\nimport { ExcludePaths } from './exclude-hook-paths';\nimport { InformAiError } from './inform-ai-error';\nimport { PrGateConfig } from './pr-gate-config';\nimport { ResolvedConfig, ResolvedRuleConfig, RuleOptions } from './types';\nimport { validateCommandsSection } from './commands-section-validators';\nimport { validateTopLevelKeys } from './config-key-rules';\nimport { validateExcludePaths, validateMatchRulesSection, validateSectionPlacement, validateWebpiecesConfig } from './validate-config';\nimport { MatchRuleConfig } from './match-rules-config';\nimport { WebpiecesRulesConfig } from './WebpiecesRulesConfig';\n\n/**\n * Everything a consumer might need from webpieces.config.json, produced from ONE parse + ONE\n * validation pass. Data-only (per CLAUDE.md, classes for data).\n */\nexport class LoadedConfig {\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(\n        readonly resolved: ResolvedConfig,\n        readonly rulesConfig: WebpiecesRulesConfig,\n        readonly commands: CommandsConfig,\n        readonly prGate: PrGateConfig,\n        readonly excludePaths: ExcludePaths,\n        readonly matchRules: readonly MatchRuleConfig[],\n        readonly configPath: string | null,\n    ) {}\n}\n\n// Renamed rules used to be normalized here — a DEPRECATED_RULE_ALIASES table rewrote the old key to its\n// canonical name BEFORE validation, so no validator ever saw it and no consumer was ever told. That is why\n// the aliases could never be removed: the old names kept working forever. The renames now live in\n// RETIRED_CONFIG_KEYS as hard errors naming the new key. See retired-config-keys.ts for the policy.\n\n/**\n * The single load+validate entry point for ALL consumers (ai-hook-rules, code-rules,\n * nx-webpieces-rules, pr-gate scripts). `@injectable(bindingScopeValues.Singleton)` + injects {@link ConfigFile} so it appears\n * in the rules-config DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ConfigLoader {\n    constructor(private readonly configFile: ConfigFile) {}\n\n    /**\n     * Reads webpieces.config.json once, validates BOTH the `rules` map and the top-level `pr-gate`\n     * block, and throws one InformAiError listing every error. When no config file is found it returns\n     * lenient empties/defaults (matching prior no-file behavior).\n     */\n    // webpieces-disable max-lines-new-methods -- the single load+validate pass is one cohesive method\n    loadAndValidate(cwd: string): LoadedConfig {\n        const configPath = this.configFile.findConfigFile(cwd);\n        if (!configPath) {\n            const emptyCommands = buildCommandsConfig(undefined);\n            return new LoadedConfig(\n                new ResolvedConfig(new Map(), new Set(), [], null),\n                new WebpiecesRulesConfig(),\n                emptyCommands,\n                emptyCommands.prGate,\n                new ExcludePaths([]),\n                [],\n                null,\n            );\n        }\n\n        const consumerConfig = this.configFile.readRawConfig(configPath);\n        const rulesSection = consumerConfig.rules || {};\n        const hookGuardsSection = consumerConfig.hookGuards || {};\n        // Read only so validateCommandsSection can REJECT it. There is no fallback to it — a config\n        // carrying the retired top-level block never loads, so reading it as a value would be dead code.\n        const legacyPrGate = consumerConfig['pr-gate'];\n\n        // rules + hookGuards are validated/loaded as one flat name→config map (the runtime dispatches\n        // by each rule's own `scope`). Placement is enforced separately.\n        const overrideRules = { ...rulesSection, ...hookGuardsSection };\n\n        const rulesDir = consumerConfig.rulesDir ?? [];\n\n        // The repo root (dir holding webpieces.config.json) lets checklists[].docs existence be checked.\n        const repoRoot = path.dirname(configPath);\n        const errors = [\n            // webpieces-disable no-any-unknown -- the raw parsed config is opaque; only key names are read\n            ...validateTopLevelKeys(consumerConfig as unknown as Record<string, unknown>),\n            ...validateWebpiecesConfig(overrideRules, rulesDir.length > 0),\n            ...validateSectionPlacement(rulesSection, hookGuardsSection),\n            ...validateCommandsSection(consumerConfig.commands, legacyPrGate, repoRoot),\n            ...validateExcludePaths(consumerConfig.excludePaths),\n            ...validateMatchRulesSection(consumerConfig['match-rules']),\n        ];\n        if (errors.length > 0) {\n            throw new InformAiError(this.formatConfigErrorsBanner(errors));\n        }\n\n        const commands = buildCommandsConfig(consumerConfig.commands);\n        this.applyCommandDefaults(overrideRules, commands);\n\n        const userConfiguredRuleNames = new Set(Object.keys(overrideRules));\n        const mergedRules = new Map<string, ResolvedRuleConfig>();\n        const allRuleNames = new Set([\n            ...Object.keys(defaultRules),\n            ...Object.keys(overrideRules),\n        ]);\n        for (const name of allRuleNames) {\n            mergedRules.set(name, this.mergeRule(defaultRules[name], overrideRules[name]));\n        }\n        const resolved = new ResolvedConfig(mergedRules, userConfiguredRuleNames, rulesDir, configPath);\n\n        const rulesConfig = this.buildWebpiecesRulesConfig(overrideRules, rulesDir);\n        const excludePaths = this.parseExcludePaths(consumerConfig.excludePaths);\n        const matchRules = this.parseMatchRules(consumerConfig['match-rules']);\n\n        return new LoadedConfig(resolved, rulesConfig, commands, commands.prGate, excludePaths, matchRules, configPath);\n    }\n\n    // Inject the canonical command strings (from the `commands` section) as the DEFAULT for the guards\n    // that surface them in their fix hints. Only fills a gap — an explicit per-guard override wins.\n    private applyCommandDefaults(\n        // webpieces-disable no-any-unknown -- opaque merged rule/guard map\n        rules: Record<string, Record<string, unknown>>,\n        commands: CommandsConfig,\n    ): void {\n        const prCreation = rules['pr-creation-or-push-guard'];\n        if (prCreation && prCreation['upsertPrCommand'] === undefined) {\n            prCreation['upsertPrCommand'] = commands.upsertPr;\n        }\n        const mergeInProgress = rules['merge-in-progress-guard'];\n        if (mergeInProgress && mergeInProgress['mergeCompleteCommand'] === undefined) {\n            mergeInProgress['mergeCompleteCommand'] = commands.mergeComplete;\n        }\n        // The whole-repo build guard REFUSES a build of the world and prints the narrow command\n        // instead. That command must be the one this repo's gate actually runs — the guard hard-coding\n        // its own copy is how a message starts teaching a command the project no longer uses.\n        const wholeRepoBuild = rules['whole-repo-build-guard'];\n        if (wholeRepoBuild && wholeRepoBuild['affectedBuildCommand'] === undefined) {\n            wholeRepoBuild['affectedBuildCommand'] = commands.prGate.buildCommand;\n        }\n    }\n\n    // webpieces-disable no-any-unknown -- merging opaque option bags from config JSON\n    private mergeRule(\n        // webpieces-disable no-any-unknown -- opaque option bag\n        baseRule: Record<string, unknown> | undefined,\n        // webpieces-disable no-any-unknown -- opaque option bag\n        overrideRule: Record<string, unknown> | undefined,\n    ): ResolvedRuleConfig {\n        if (!baseRule && !overrideRule) return new ResolvedRuleConfig({ mode: 'OFF' });\n        if (!baseRule) return new ResolvedRuleConfig(overrideRule! as RuleOptions);\n        if (!overrideRule) return new ResolvedRuleConfig(baseRule as RuleOptions);\n\n        // webpieces-disable no-any-unknown -- building merged option bag\n        const merged: Record<string, unknown> = {};\n        for (const key of Object.keys(baseRule)) merged[key] = baseRule[key];\n        for (const key of Object.keys(overrideRule)) merged[key] = overrideRule[key];\n        return new ResolvedRuleConfig(merged as RuleOptions);\n    }\n\n    // Parse the (already-validated) raw excludePaths block into the typed ExcludePaths. The ONLY accepted\n    // shape is a bare string[]; the retired two-list object cannot reach here, because validateExcludePaths\n    // has already failed the load with the migration instruction.\n    // webpieces-disable no-any-unknown -- `raw` is opaque consumer JSON until narrowed here\n    private parseExcludePaths(raw: unknown): ExcludePaths {\n        if (!Array.isArray(raw)) return new ExcludePaths([]);\n        return new ExcludePaths(raw.filter(p => typeof p === 'string'));\n    }\n\n    // Parse the (already-validated) raw match-rules array into typed MatchRuleConfig[]. The entries use\n    // the canonical field names (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch) that the match-rules\n    // engine reads directly, so no normalization is needed.\n    // webpieces-disable no-any-unknown -- validated array; each entry cast to the typed MatchRuleConfig\n    private parseMatchRules(raw: unknown): MatchRuleConfig[] {\n        if (!Array.isArray(raw)) return [];\n        return raw as MatchRuleConfig[];\n    }\n\n    private buildWebpiecesRulesConfig(\n        // webpieces-disable no-any-unknown -- JSON values are opaque until assigned to typed fields\n        rawRules: Record<string, Record<string, unknown>>,\n        rulesDir: string[],\n    ): WebpiecesRulesConfig {\n        const typed = new WebpiecesRulesConfig();\n        for (const key of Object.keys(rawRules)) {\n            // webpieces-disable no-any-unknown -- dynamic key assignment to typed class\n            (typed as Record<string, unknown>)[key] = rawRules[key];\n        }\n        typed.rulesDir = rulesDir;\n        return typed;\n    }\n\n    // Assemble the validation-failure banner. Every error here came from validating this ONE file, so\n    // the cure is always \"edit it\" — see config-error-banner.ts for why nothing else belongs in it.\n    private formatConfigErrorsBanner(errors: string[]): string {\n        return formatConfigErrorsBanner(errors);\n    }\n}\n\n// Temporary migration delegator — consumers migrate to injecting ConfigLoader over follow-up PRs,\n// then this free function is removed. The logic now lives in the injected ConfigLoader class.\nconst configLoaderSvc = new ConfigLoader(new ConfigFile());\n\n// webpieces-disable no-function-outside-class -- temporary back-compat delegator to ConfigLoader; removed once all 118 consumers inject it\nexport function loadAndValidate(cwd: string): LoadedConfig {\n    return configLoaderSvc.loadAndValidate(cwd);\n}\n"]}
+{"version":3,"file":"load-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/load-config.ts"],"names":[],"mappings":";;;AAwMA,0CAEC;;AA1MD,mDAA6B;AAC7B,yCAA2D;AAE3D,uDAAwE;AACxE,+DAAiE;AACjE,+CAA2C;AAC3C,mDAA+C;AAC/C,6DAAoD;AACpD,uDAAkD;AAElD,mCAA0E;AAC1E,+EAAwE;AACxE,yDAA0D;AAC1D,uDAAuI;AAEvI,iEAA8D;AAE9D;;;GAGG;AACH,MAAa,YAAY;IAGR;IACA;IACA;IACA;IACA;IACA;IACA;IARb,yDAAyD;IACzD,YACa,QAAwB,EACxB,WAAiC,EACjC,QAAwB,EACxB,MAAoB,EACpB,YAA0B,EAC1B,UAAsC,EACtC,UAAyB;QANzB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,gBAAW,GAAX,WAAW,CAAsB;QACjC,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAc;QACpB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAA4B;QACtC,eAAU,GAAV,UAAU,CAAe;IACnC,CAAC;CACP;AAXD,oCAWC;AAED,wGAAwG;AACxG,2GAA2G;AAC3G,kGAAkG;AAClG,oGAAoG;AAEpG;;;;GAIG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACQ;IAA7B,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD;;;;OAIG;IACH,kGAAkG;IAClG,eAAe,CAAC,GAAW;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,aAAa,GAAG,IAAA,qCAAmB,EAAC,SAAS,CAAC,CAAC;YACrD,OAAO,IAAI,YAAY,CACnB,IAAI,sBAAc,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAClD,IAAI,2CAAoB,EAAE,EAC1B,aAAa,EACb,aAAa,CAAC,MAAM,EACpB,IAAI,iCAAY,CAAC,EAAE,CAAC,EACpB,EAAE,EACF,IAAI,CACP,CAAC;QACN,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,iBAAiB,GAAG,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC;QAC1D,4FAA4F;QAC5F,iGAAiG;QACjG,MAAM,YAAY,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAE/C,8FAA8F;QAC9F,iEAAiE;QACjE,MAAM,aAAa,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAEhE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,IAAI,EAAE,CAAC;QAE/C,iGAAiG;QACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG;YACX,+FAA+F;YAC/F,GAAG,IAAA,uCAAoB,EAAC,cAAoD,CAAC;YAC7E,GAAG,IAAA,yCAAuB,EAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC9D,GAAG,IAAA,0CAAwB,EAAC,YAAY,EAAE,iBAAiB,CAAC;YAC5D,GAAG,IAAA,qDAAuB,EAAC,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC;YAC3E,GAAG,IAAA,sCAAoB,EAAC,cAAc,CAAC,YAAY,CAAC;YACpD,GAAG,IAAA,2CAAyB,EAAC,cAAc,CAAC,aAAa,CAAC,CAAC;SAC9D,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,+BAAa,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,qCAAmB,EAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEnD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;QAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;YACzB,GAAG,MAAM,CAAC,IAAI,CAAC,4BAAY,CAAC;YAC5B,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;SAChC,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAC9B,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,4BAAY,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,sBAAc,CAAC,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEhG,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;QAEvE,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACpH,CAAC;IAED,mGAAmG;IACnG,gGAAgG;IACxF,oBAAoB;IACxB,mEAAmE;IACnE,KAA8C,EAC9C,QAAwB;QAExB,MAAM,UAAU,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtD,IAAI,UAAU,IAAI,UAAU,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,UAAU,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACtD,CAAC;QACD,MAAM,eAAe,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzD,IAAI,eAAe,IAAI,eAAe,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3E,eAAe,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC;QACrE,CAAC;QACD,kGAAkG;QAClG,6FAA6F;QAC7F,kFAAkF;IACtF,CAAC;IAED,kFAAkF;IAC1E,SAAS;IACb,wDAAwD;IACxD,QAA6C;IAC7C,wDAAwD;IACxD,YAAiD;QAEjD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,0BAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,0BAAkB,CAAC,YAA4B,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,0BAAkB,CAAC,QAAuB,CAAC,CAAC;QAE1E,iEAAiE;QACjE,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7E,OAAO,IAAI,0BAAkB,CAAC,MAAqB,CAAC,CAAC;IACzD,CAAC;IAED,sGAAsG;IACtG,wGAAwG;IACxG,8DAA8D;IAC9D,wFAAwF;IAChF,iBAAiB,CAAC,GAAY;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,iCAAY,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,iCAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,oGAAoG;IACpG,oGAAoG;IACpG,wDAAwD;IACxD,oGAAoG;IAC5F,eAAe,CAAC,GAAY;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,GAAwB,CAAC;IACpC,CAAC;IAEO,yBAAyB;IAC7B,4FAA4F;IAC5F,QAAiD,EACjD,QAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,2CAAoB,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,4EAA4E;YAC3E,KAAiC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,kGAAkG;IAClG,gGAAgG;IACxF,wBAAwB,CAAC,MAAgB;QAC7C,OAAO,IAAA,8CAAwB,EAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;CACJ,CAAA;AApJY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEI,wBAAU;GAD1C,YAAY,CAoJxB;AAED,kGAAkG;AAClG,8FAA8F;AAC9F,MAAM,eAAe,GAAG,IAAI,YAAY,CAAC,IAAI,wBAAU,EAAE,CAAC,CAAC;AAE3D,2IAA2I;AAC3I,SAAgB,eAAe,CAAC,GAAW;IACvC,OAAO,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC","sourcesContent":["import * as path from 'path';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nimport { buildCommandsConfig, CommandsConfig } from './commands-config';\nimport { formatConfigErrorsBanner } from './config-error-banner';\nimport { ConfigFile } from './config-file';\nimport { defaultRules } from './default-rules';\nimport { ExcludePaths } from './exclude-hook-paths';\nimport { InformAiError } from './inform-ai-error';\nimport { PrGateConfig } from './pr-gate-config';\nimport { ResolvedConfig, ResolvedRuleConfig, RuleOptions } from './types';\nimport { validateCommandsSection } from './commands-section-validators';\nimport { validateTopLevelKeys } from './config-key-rules';\nimport { validateExcludePaths, validateMatchRulesSection, validateSectionPlacement, validateWebpiecesConfig } from './validate-config';\nimport { MatchRuleConfig } from './match-rules-config';\nimport { WebpiecesRulesConfig } from './WebpiecesRulesConfig';\n\n/**\n * Everything a consumer might need from webpieces.config.json, produced from ONE parse + ONE\n * validation pass. Data-only (per CLAUDE.md, classes for data).\n */\nexport class LoadedConfig {\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(\n        readonly resolved: ResolvedConfig,\n        readonly rulesConfig: WebpiecesRulesConfig,\n        readonly commands: CommandsConfig,\n        readonly prGate: PrGateConfig,\n        readonly excludePaths: ExcludePaths,\n        readonly matchRules: readonly MatchRuleConfig[],\n        readonly configPath: string | null,\n    ) {}\n}\n\n// Renamed rules used to be normalized here — a DEPRECATED_RULE_ALIASES table rewrote the old key to its\n// canonical name BEFORE validation, so no validator ever saw it and no consumer was ever told. That is why\n// the aliases could never be removed: the old names kept working forever. The renames now live in\n// RETIRED_CONFIG_KEYS as hard errors naming the new key. See retired-config-keys.ts for the policy.\n\n/**\n * The single load+validate entry point for ALL consumers (ai-hook-rules, code-rules,\n * nx-webpieces-rules, pr-gate scripts). `@injectable(bindingScopeValues.Singleton)` + injects {@link ConfigFile} so it appears\n * in the rules-config DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ConfigLoader {\n    constructor(private readonly configFile: ConfigFile) {}\n\n    /**\n     * Reads webpieces.config.json once, validates BOTH the `rules` map and the top-level `pr-gate`\n     * block, and throws one InformAiError listing every error. When no config file is found it returns\n     * lenient empties/defaults (matching prior no-file behavior).\n     */\n    // webpieces-disable max-lines-new-methods -- the single load+validate pass is one cohesive method\n    loadAndValidate(cwd: string): LoadedConfig {\n        const configPath = this.configFile.findConfigFile(cwd);\n        if (!configPath) {\n            const emptyCommands = buildCommandsConfig(undefined);\n            return new LoadedConfig(\n                new ResolvedConfig(new Map(), new Set(), [], null),\n                new WebpiecesRulesConfig(),\n                emptyCommands,\n                emptyCommands.prGate,\n                new ExcludePaths([]),\n                [],\n                null,\n            );\n        }\n\n        const consumerConfig = this.configFile.readRawConfig(configPath);\n        const rulesSection = consumerConfig.rules || {};\n        const hookGuardsSection = consumerConfig.hookGuards || {};\n        // Read only so validateCommandsSection can REJECT it. There is no fallback to it — a config\n        // carrying the retired top-level block never loads, so reading it as a value would be dead code.\n        const legacyPrGate = consumerConfig['pr-gate'];\n\n        // rules + hookGuards are validated/loaded as one flat name→config map (the runtime dispatches\n        // by each rule's own `scope`). Placement is enforced separately.\n        const overrideRules = { ...rulesSection, ...hookGuardsSection };\n\n        const rulesDir = consumerConfig.rulesDir ?? [];\n\n        // The repo root (dir holding webpieces.config.json) lets checklists[].docs existence be checked.\n        const repoRoot = path.dirname(configPath);\n        const errors = [\n            // webpieces-disable no-any-unknown -- the raw parsed config is opaque; only key names are read\n            ...validateTopLevelKeys(consumerConfig as unknown as Record<string, unknown>),\n            ...validateWebpiecesConfig(overrideRules, rulesDir.length > 0),\n            ...validateSectionPlacement(rulesSection, hookGuardsSection),\n            ...validateCommandsSection(consumerConfig.commands, legacyPrGate, repoRoot),\n            ...validateExcludePaths(consumerConfig.excludePaths),\n            ...validateMatchRulesSection(consumerConfig['match-rules']),\n        ];\n        if (errors.length > 0) {\n            throw new InformAiError(this.formatConfigErrorsBanner(errors));\n        }\n\n        const commands = buildCommandsConfig(consumerConfig.commands);\n        this.applyCommandDefaults(overrideRules, commands);\n\n        const userConfiguredRuleNames = new Set(Object.keys(overrideRules));\n        const mergedRules = new Map<string, ResolvedRuleConfig>();\n        const allRuleNames = new Set([\n            ...Object.keys(defaultRules),\n            ...Object.keys(overrideRules),\n        ]);\n        for (const name of allRuleNames) {\n            mergedRules.set(name, this.mergeRule(defaultRules[name], overrideRules[name]));\n        }\n        const resolved = new ResolvedConfig(mergedRules, userConfiguredRuleNames, rulesDir, configPath);\n\n        const rulesConfig = this.buildWebpiecesRulesConfig(overrideRules, rulesDir);\n        const excludePaths = this.parseExcludePaths(consumerConfig.excludePaths);\n        const matchRules = this.parseMatchRules(consumerConfig['match-rules']);\n\n        return new LoadedConfig(resolved, rulesConfig, commands, commands.prGate, excludePaths, matchRules, configPath);\n    }\n\n    // Inject the canonical command strings (from the `commands` section) as the DEFAULT for the guards\n    // that surface them in their fix hints. Only fills a gap — an explicit per-guard override wins.\n    private applyCommandDefaults(\n        // webpieces-disable no-any-unknown -- opaque merged rule/guard map\n        rules: Record<string, Record<string, unknown>>,\n        commands: CommandsConfig,\n    ): void {\n        const prCreation = rules['pr-creation-or-push-guard'];\n        if (prCreation && prCreation['upsertPrCommand'] === undefined) {\n            prCreation['upsertPrCommand'] = commands.upsertPr;\n        }\n        const mergeInProgress = rules['merge-in-progress-guard'];\n        if (mergeInProgress && mergeInProgress['mergeCompleteCommand'] === undefined) {\n            mergeInProgress['mergeCompleteCommand'] = commands.mergeComplete;\n        }\n        // whole-repo-build-guard is NOT injected here — it has no rules/hookGuards entry at all. It reads\n        // the same commands.pr-gate.buildCommand, handed to it directly by ai-hook-rules' runner off\n        // LoadedConfig.prGate. See home-config.ts for why that guard is home-config-only.\n    }\n\n    // webpieces-disable no-any-unknown -- merging opaque option bags from config JSON\n    private mergeRule(\n        // webpieces-disable no-any-unknown -- opaque option bag\n        baseRule: Record<string, unknown> | undefined,\n        // webpieces-disable no-any-unknown -- opaque option bag\n        overrideRule: Record<string, unknown> | undefined,\n    ): ResolvedRuleConfig {\n        if (!baseRule && !overrideRule) return new ResolvedRuleConfig({ mode: 'OFF' });\n        if (!baseRule) return new ResolvedRuleConfig(overrideRule! as RuleOptions);\n        if (!overrideRule) return new ResolvedRuleConfig(baseRule as RuleOptions);\n\n        // webpieces-disable no-any-unknown -- building merged option bag\n        const merged: Record<string, unknown> = {};\n        for (const key of Object.keys(baseRule)) merged[key] = baseRule[key];\n        for (const key of Object.keys(overrideRule)) merged[key] = overrideRule[key];\n        return new ResolvedRuleConfig(merged as RuleOptions);\n    }\n\n    // Parse the (already-validated) raw excludePaths block into the typed ExcludePaths. The ONLY accepted\n    // shape is a bare string[]; the retired two-list object cannot reach here, because validateExcludePaths\n    // has already failed the load with the migration instruction.\n    // webpieces-disable no-any-unknown -- `raw` is opaque consumer JSON until narrowed here\n    private parseExcludePaths(raw: unknown): ExcludePaths {\n        if (!Array.isArray(raw)) return new ExcludePaths([]);\n        return new ExcludePaths(raw.filter(p => typeof p === 'string'));\n    }\n\n    // Parse the (already-validated) raw match-rules array into typed MatchRuleConfig[]. The entries use\n    // the canonical field names (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch) that the match-rules\n    // engine reads directly, so no normalization is needed.\n    // webpieces-disable no-any-unknown -- validated array; each entry cast to the typed MatchRuleConfig\n    private parseMatchRules(raw: unknown): MatchRuleConfig[] {\n        if (!Array.isArray(raw)) return [];\n        return raw as MatchRuleConfig[];\n    }\n\n    private buildWebpiecesRulesConfig(\n        // webpieces-disable no-any-unknown -- JSON values are opaque until assigned to typed fields\n        rawRules: Record<string, Record<string, unknown>>,\n        rulesDir: string[],\n    ): WebpiecesRulesConfig {\n        const typed = new WebpiecesRulesConfig();\n        for (const key of Object.keys(rawRules)) {\n            // webpieces-disable no-any-unknown -- dynamic key assignment to typed class\n            (typed as Record<string, unknown>)[key] = rawRules[key];\n        }\n        typed.rulesDir = rulesDir;\n        return typed;\n    }\n\n    // Assemble the validation-failure banner. Every error here came from validating this ONE file, so\n    // the cure is always \"edit it\" — see config-error-banner.ts for why nothing else belongs in it.\n    private formatConfigErrorsBanner(errors: string[]): string {\n        return formatConfigErrorsBanner(errors);\n    }\n}\n\n// Temporary migration delegator — consumers migrate to injecting ConfigLoader over follow-up PRs,\n// then this free function is removed. The logic now lives in the injected ConfigLoader class.\nconst configLoaderSvc = new ConfigLoader(new ConfigFile());\n\n// webpieces-disable no-function-outside-class -- temporary back-compat delegator to ConfigLoader; removed once all 118 consumers inject it\nexport function loadAndValidate(cwd: string): LoadedConfig {\n    return configLoaderSvc.loadAndValidate(cwd);\n}\n"]}

package/src/retired-config-keys.js

@@ -96,6 +96,17 @@ exports.RETIRED_CONFIG_KEYS = [
         'both lists, de-duplicated — e.g. "excludePaths": ["repositories/**"]. A path is governed by ' +
         'webpieces or it is not, so there is no longer a per-engine split. To exclude a path from one rule ' +
         'only, use that rule\'s own "excludePaths" inside its config block instead.', '[excludePaths]'),
+    // --- whole-repo-build-guard, retired as a REPO-CONFIG key one release after it was added. It shipped
+    // as a conventional validated guard (mode ON by default, entry REQUIRED under hookGuards), so every
+    // consumer that upgraded hit fault Y — every Bash call blocked — for an experimental feature nobody
+    // had opted into. The switch now lives ONLY in the optional machine-local ~/.webpieces/config.json,
+    // whose absent state is byte-for-byte the old behaviour. A repo that never added the entry has nothing
+    // to do; a repo that added it to escape fault Y is told right here to take it back out.
+    new RetiredConfigKey(exports.RETIRED_SCOPE_RULE, 'whole-repo-build-guard', '~/.webpieces/config.json → experimental.whole-repo-build-guard', 'DELETE this entry from webpieces.config.json — no repo config key controls this guard any more, ' +
+        'and with the entry gone the guard is silently off for everyone in this repo. To switch it on for ' +
+        'YOUR machine only, put {"experimental": {"whole-repo-build-guard": true}} in ' +
+        '~/.webpieces/config.json — that file is optional, is tracked by no repo, and every webpieces ' +
+        'command behaves exactly as it does by default when it does not exist.', '[whole-repo-build-guard]'),
 ];
 /**
  * The shared message. Leads with the retirement, then the destination, then the edit — an agent reading this

package/src/retired-config-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"retired-config-keys.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/retired-config-keys.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;AAiGH,0CAKC;AAQD,wCAEC;AAQD,oCAEC;AAQD,oCAEC;AAKD,gDAIC;AA3ID,+DAA2D;AAE3D,mGAAmG;AACnG,yGAAyG;AACzG,2CAA2C;AAC3C,kFAAkF;AACrE,QAAA,kBAAkB,GAAG,MAAM,CAAC;AAC5B,QAAA,iBAAiB,GAAG,KAAK,CAAC;AAEvC,kGAAkG;AAClG,MAAa,gBAAgB;IACzB,KAAK,CAAS;IACd,0DAA0D;IAC1D,GAAG,CAAS;IACZ,+FAA+F;IAC/F,OAAO,CAAS;IAChB,gEAAgE;IAChE,WAAW,CAAS;IACpB,0GAA0G;IAC1G,KAAK,CAAS;IAEd,yDAAyD;IACzD,YAAY,KAAa,EAAE,GAAW,EAAE,OAAe,EAAE,WAAmB,EAAE,KAAa;QACvF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AAnBD,4CAmBC;AAED;;;GAGG;AACU,QAAA,mBAAmB,GAAgC;IAC5D,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,uDAAuD;IACvD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EACxD,uEAAuE,EACvE,oBAAoB,CACvB;IACD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EACpE,mGAAmG;QACnG,yFAAyF,EACzF,qBAAqB,CACxB;IACD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAC1D,kGAAkG;QAClG,kGAAkG;QAClG,mCAAmC,EACnC,oBAAoB,CACvB;IAED,oGAAoG;IACpG,uFAAuF;IACvF,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,UAAU,EAAE,sCAAsC,EACrE,6FAA6F;QAC7F,kCAAkC,EAClC,YAAY,CACf;IACD,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,eAAe,EAAE,qCAAqC,EACzE,4FAA4F;QAC5F,uCAAuC,EACvC,YAAY,CACf;IAED,uGAAuG;IACvG,uGAAuG;IACvG,wGAAwG;IACxG,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,OAAO,EAAE,+BAA+B,EAC3D,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,4EAA4E,EAC5E,gBAAgB,CACnB;CACJ,CAAC;AAEF;;;;;;GAMG;AACH,iHAAiH;AACjH,SAAgB,eAAe,CAAC,KAAuB;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,EAAE;QACpC,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,gBAAgB,KAAK,CAAC,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,KAAK,wCAAkB,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,cAAc,CAAC,QAAgB;IAC3C,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,0BAAkB,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,YAAY,CAAC,GAAW,EAAE,KAAa;IACnD,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,YAAY,CAAC,GAAW,EAAE,KAAa;IACnD,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC;AACtH,CAAC;AAED,0GAA0G;AAC1G,mGAAmG;AACnG,iHAAiH;AACjH,SAAgB,kBAAkB,CAAC,OAAgC,EAAE,KAAa;IAC9E,OAAO,2BAAmB;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC;SACnF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Retired webpieces.config.json keys — the ONE place in the codebase where a dead config key may be named.\n *\n * ## THE POLICY: webpieces.config.json is never released backwards-compatible\n *\n * When a config key moves, is renamed, or is deleted, the loader REJECTS the old shape with an error that\n * names the destination. It does NOT quietly accept both. There is no fallback, no alias table applied\n * before validation, no \"still accepted for back-compat until every consumer migrates\".\n *\n * This is safe *here* in a way it is not for a normal library, and the reason is the consumer: every reader\n * of this file is a coding agent. The config is validated on startup, the agent is handed the exact edit,\n * and it applies it in one pass — so the upgrade is seamless without shipping a compatibility layer. That\n * makes a hard failure strictly cheaper than duality: two accepted shapes means two code paths, two sets of\n * defaults and two sets of error messages to keep honest forever, and the stale shape then lives in\n * consumer configs indefinitely because nothing ever forces the edit.\n *\n * A hard rejection here is always self-recoverable, which is what makes it safe to do:\n *   - editing webpieces.config.json is ALWAYS permitted, even while the config is invalid (see the banner\n *     in config-file.ts and the guard matrix — a Write/Edit targeting this file is an unconditional PASS),\n *   - `pnpm install` is ALWAYS permitted (installer bypass), which fixes the far more common cause of a\n *     validation failure: an installed validator lagging the config by a release.\n * So rejecting an old shape can never wedge a repo. \"It would deadlock the consumer\" is not a reason to add\n * a fallback; it is not true.\n *\n * ## Adding an entry\n *\n * When you retire a key, add it here and DELETE its read path — do not leave a `??` fallback behind. The\n * `instruction` is the whole product: it is read by an agent that will act on it verbatim, so give the\n * mechanical edit (\"rename X to Y\", \"move A into B\"), not a description of the change. Saying where a thing\n * moved to is exactly the point of this table; it is what makes the fallback unnecessary.\n *\n * retired-config-keys.spec.ts asserts every entry below actually FAILS the load. That spec is the guard: a\n * future fallback that silently swallows a retired key turns it red.\n */\n\nimport { RETIRED_KEY_MARKER } from './config-error-banner';\n\n// A retired key is matched one of two ways, because config keys live at two very different levels.\n// RULE — a rule/guard NAME, which may sit under either `rules` or `hookGuards`, so it is matched by bare\n//        name rather than by a fixed path.\n// KEY  — a plain key inside a known section, matched by name within that section.\nexport const RETIRED_SCOPE_RULE = 'rule';\nexport const RETIRED_SCOPE_KEY = 'key';\n\n/** One retired config key and the mechanical edit that replaces it. Data-only (per CLAUDE.md). */\nexport class RetiredConfigKey {\n    scope: string;\n    // The key exactly as it appears in webpieces.config.json.\n    key: string;\n    // Where the value goes now. Empty string when the key is deleted outright with no replacement.\n    movedTo: string;\n    // The imperative fix, written for the agent that will apply it.\n    instruction: string;\n    // Bracketed label leading the error, matching the `[rule-name]` / `[section]` convention in this package.\n    label: string;\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(scope: string, key: string, movedTo: string, instruction: string, label: string) {\n        this.scope = scope;\n        this.key = key;\n        this.movedTo = movedTo;\n        this.instruction = instruction;\n        this.label = label;\n    }\n}\n\n/**\n * Every retired key. Keep the newest at the bottom with the release that retired it, so the list reads as a\n * changelog an agent can walk when a config is several versions behind.\n */\nexport const RETIRED_CONFIG_KEYS: readonly RetiredConfigKey[] = [\n    // --- Guard renames. Previously applied SILENTLY before validation (a DEPRECATED_RULE_ALIASES table in\n    // load-config.ts rewrote the key so no validator ever saw it). That hid the rename from the config file\n    // forever: the old name kept working, so no consumer ever updated, and the alias table could never be\n    // deleted. Now each is a hard error with the new name.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'pr-merge-cleanup', 'pr-merge-guard',\n        'Rename the key to \"pr-merge-guard\". Its value carries over unchanged.',\n        '[pr-merge-cleanup]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'pr-creation-guard', 'pr-creation-or-push-guard',\n        'Rename the key to \"pr-creation-or-push-guard\" — the guard grew a second blocked action (a manual ' +\n        'git push), so it is no longer only about PR creation. Its value carries over unchanged.',\n        '[pr-creation-guard]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'main-stale-guard', 'read-stale-guard',\n        'Rename the key to \"read-stale-guard\" — the guard grew a second blocked state (an already-merged ' +\n        'feature branch), so it is no longer about `main` at all; it is THE guard that can block a Read. ' +\n        'Its value carries over unchanged.',\n        '[main-stale-guard]',\n    ),\n\n    // --- The two flat guard-hint strings, superseded by commands.guardHints so that every guard-facing\n    // command string sits in one named sub-object instead of loose beside the gate config.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'upsertPr', 'commands.guardHints.prCreationOrPush',\n        'Move the value to \"guardHints\": { \"prCreationOrPush\": <value> } inside the same \"commands\" ' +\n        'section, then delete \"upsertPr\".',\n        '[commands]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'mergeComplete', 'commands.guardHints.mergeInProgress',\n        'Move the value to \"guardHints\": { \"mergeInProgress\": <value> } inside the same \"commands\" ' +\n        'section, then delete \"mergeComplete\".',\n        '[commands]',\n    ),\n\n    // --- The two-list excludePaths object. The split never earned its keep (every consumer set both lists\n    // to the same value), and the one case that would need them to differ is served better by a rule's own\n    // `excludePaths`. Retired as a SHAPE: `rules` is the entry validateExcludePaths reports for either key.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'rules', 'excludePaths (one flat array)',\n        'Replace the whole { \"rules\": [...], \"guards\": [...] } object with ONE array holding the union of ' +\n        'both lists, de-duplicated — e.g. \"excludePaths\": [\"repositories/**\"]. A path is governed by ' +\n        'webpieces or it is not, so there is no longer a per-engine split. To exclude a path from one rule ' +\n        'only, use that rule\\'s own \"excludePaths\" inside its config block instead.',\n        '[excludePaths]',\n    ),\n];\n\n/**\n * The shared message. Leads with the retirement, then the destination, then the edit — an agent reading this\n * should not have to infer anything.\n *\n * RETIRED_KEY_MARKER is the phrase the banner classifier keys off to call this error DEFINITIVE (no\n * install can revive a key this table names), so the marker is IMPORTED rather than re-typed here.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredKeyError(entry: RetiredConfigKey): string {\n    const destination = entry.movedTo === ''\n        ? 'It was removed with no replacement.'\n        : `It moved to \"${entry.movedTo}\".`;\n    return `${entry.label} \"${entry.key}\" ${RETIRED_KEY_MARKER}. ${destination} ${entry.instruction}`;\n}\n\n/**\n * The retired entry for a rule/guard NAME, or null. Callers must consult this BEFORE reporting a name as an\n * unknown rule: the unknown-rule message leads with \"run `pnpm install`, your validator may be stale\", which\n * is exactly the wrong advice for a name we know is dead.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredRuleFor(ruleName: string): RetiredConfigKey | null {\n    return RETIRED_CONFIG_KEYS.find(e => e.scope === RETIRED_SCOPE_RULE && e.key === ruleName) ?? null;\n}\n\n/**\n * Whether `key` is retired within `label`'s section. Unknown-key rejection consults this so a retired key\n * gets its migration message instead of a generic \"unknown key, delete it\" — the migration instruction is\n * the entire reason this table exists.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function isRetiredKey(key: string, label: string): boolean {\n    return RETIRED_CONFIG_KEYS.some(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key === key);\n}\n\n/**\n * The retired entry for `key` within `label`'s section. For a retirement that is a SHAPE rather than a\n * single key (the excludePaths object), the validator looks the entry up directly so one table row remains\n * the single source of the message.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredEntry(key: string, label: string): RetiredConfigKey | null {\n    return RETIRED_CONFIG_KEYS.find(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key === key) ?? null;\n}\n\n/** Errors for every retired plain key present in `section`. `label` scopes the lookup to that section. */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON; only key PRESENCE is read\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredKeyErrorsIn(section: Record<string, unknown>, label: string): string[] {\n    return RETIRED_CONFIG_KEYS\n        .filter(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key in section)\n        .map(e => retiredKeyError(e));\n}\n"]}
+{"version":3,"file":"retired-config-keys.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/retired-config-keys.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;AAiHH,0CAKC;AAQD,wCAEC;AAQD,oCAEC;AAQD,oCAEC;AAKD,gDAIC;AA3JD,+DAA2D;AAE3D,mGAAmG;AACnG,yGAAyG;AACzG,2CAA2C;AAC3C,kFAAkF;AACrE,QAAA,kBAAkB,GAAG,MAAM,CAAC;AAC5B,QAAA,iBAAiB,GAAG,KAAK,CAAC;AAEvC,kGAAkG;AAClG,MAAa,gBAAgB;IACzB,KAAK,CAAS;IACd,0DAA0D;IAC1D,GAAG,CAAS;IACZ,+FAA+F;IAC/F,OAAO,CAAS;IAChB,gEAAgE;IAChE,WAAW,CAAS;IACpB,0GAA0G;IAC1G,KAAK,CAAS;IAEd,yDAAyD;IACzD,YAAY,KAAa,EAAE,GAAW,EAAE,OAAe,EAAE,WAAmB,EAAE,KAAa;QACvF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AAnBD,4CAmBC;AAED;;;GAGG;AACU,QAAA,mBAAmB,GAAgC;IAC5D,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,uDAAuD;IACvD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EACxD,uEAAuE,EACvE,oBAAoB,CACvB;IACD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,mBAAmB,EAAE,2BAA2B,EACpE,mGAAmG;QACnG,yFAAyF,EACzF,qBAAqB,CACxB;IACD,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAC1D,kGAAkG;QAClG,kGAAkG;QAClG,mCAAmC,EACnC,oBAAoB,CACvB;IAED,oGAAoG;IACpG,uFAAuF;IACvF,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,UAAU,EAAE,sCAAsC,EACrE,6FAA6F;QAC7F,kCAAkC,EAClC,YAAY,CACf;IACD,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,eAAe,EAAE,qCAAqC,EACzE,4FAA4F;QAC5F,uCAAuC,EACvC,YAAY,CACf;IAED,uGAAuG;IACvG,uGAAuG;IACvG,wGAAwG;IACxG,IAAI,gBAAgB,CAChB,yBAAiB,EAAE,OAAO,EAAE,+BAA+B,EAC3D,mGAAmG;QACnG,8FAA8F;QAC9F,oGAAoG;QACpG,4EAA4E,EAC5E,gBAAgB,CACnB;IAED,sGAAsG;IACtG,oGAAoG;IACpG,oGAAoG;IACpG,oGAAoG;IACpG,uGAAuG;IACvG,wFAAwF;IACxF,IAAI,gBAAgB,CAChB,0BAAkB,EAAE,wBAAwB,EAAE,gEAAgE,EAC9G,kGAAkG;QAClG,mGAAmG;QACnG,+EAA+E;QAC/E,+FAA+F;QAC/F,uEAAuE,EACvE,0BAA0B,CAC7B;CACJ,CAAC;AAEF;;;;;;GAMG;AACH,iHAAiH;AACjH,SAAgB,eAAe,CAAC,KAAuB;IACnD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,KAAK,EAAE;QACpC,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,gBAAgB,KAAK,CAAC,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,KAAK,wCAAkB,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,cAAc,CAAC,QAAgB;IAC3C,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,0BAAkB,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,YAAY,CAAC,GAAW,EAAE,KAAa;IACnD,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,iHAAiH;AACjH,SAAgB,YAAY,CAAC,GAAW,EAAE,KAAa;IACnD,OAAO,2BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC;AACtH,CAAC;AAED,0GAA0G;AAC1G,mGAAmG;AACnG,iHAAiH;AACjH,SAAgB,kBAAkB,CAAC,OAAgC,EAAE,KAAa;IAC9E,OAAO,2BAAmB;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,yBAAiB,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC;SACnF,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Retired webpieces.config.json keys — the ONE place in the codebase where a dead config key may be named.\n *\n * ## THE POLICY: webpieces.config.json is never released backwards-compatible\n *\n * When a config key moves, is renamed, or is deleted, the loader REJECTS the old shape with an error that\n * names the destination. It does NOT quietly accept both. There is no fallback, no alias table applied\n * before validation, no \"still accepted for back-compat until every consumer migrates\".\n *\n * This is safe *here* in a way it is not for a normal library, and the reason is the consumer: every reader\n * of this file is a coding agent. The config is validated on startup, the agent is handed the exact edit,\n * and it applies it in one pass — so the upgrade is seamless without shipping a compatibility layer. That\n * makes a hard failure strictly cheaper than duality: two accepted shapes means two code paths, two sets of\n * defaults and two sets of error messages to keep honest forever, and the stale shape then lives in\n * consumer configs indefinitely because nothing ever forces the edit.\n *\n * A hard rejection here is always self-recoverable, which is what makes it safe to do:\n *   - editing webpieces.config.json is ALWAYS permitted, even while the config is invalid (see the banner\n *     in config-file.ts and the guard matrix — a Write/Edit targeting this file is an unconditional PASS),\n *   - `pnpm install` is ALWAYS permitted (installer bypass), which fixes the far more common cause of a\n *     validation failure: an installed validator lagging the config by a release.\n * So rejecting an old shape can never wedge a repo. \"It would deadlock the consumer\" is not a reason to add\n * a fallback; it is not true.\n *\n * ## Adding an entry\n *\n * When you retire a key, add it here and DELETE its read path — do not leave a `??` fallback behind. The\n * `instruction` is the whole product: it is read by an agent that will act on it verbatim, so give the\n * mechanical edit (\"rename X to Y\", \"move A into B\"), not a description of the change. Saying where a thing\n * moved to is exactly the point of this table; it is what makes the fallback unnecessary.\n *\n * retired-config-keys.spec.ts asserts every entry below actually FAILS the load. That spec is the guard: a\n * future fallback that silently swallows a retired key turns it red.\n */\n\nimport { RETIRED_KEY_MARKER } from './config-error-banner';\n\n// A retired key is matched one of two ways, because config keys live at two very different levels.\n// RULE — a rule/guard NAME, which may sit under either `rules` or `hookGuards`, so it is matched by bare\n//        name rather than by a fixed path.\n// KEY  — a plain key inside a known section, matched by name within that section.\nexport const RETIRED_SCOPE_RULE = 'rule';\nexport const RETIRED_SCOPE_KEY = 'key';\n\n/** One retired config key and the mechanical edit that replaces it. Data-only (per CLAUDE.md). */\nexport class RetiredConfigKey {\n    scope: string;\n    // The key exactly as it appears in webpieces.config.json.\n    key: string;\n    // Where the value goes now. Empty string when the key is deleted outright with no replacement.\n    movedTo: string;\n    // The imperative fix, written for the agent that will apply it.\n    instruction: string;\n    // Bracketed label leading the error, matching the `[rule-name]` / `[section]` convention in this package.\n    label: string;\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(scope: string, key: string, movedTo: string, instruction: string, label: string) {\n        this.scope = scope;\n        this.key = key;\n        this.movedTo = movedTo;\n        this.instruction = instruction;\n        this.label = label;\n    }\n}\n\n/**\n * Every retired key. Keep the newest at the bottom with the release that retired it, so the list reads as a\n * changelog an agent can walk when a config is several versions behind.\n */\nexport const RETIRED_CONFIG_KEYS: readonly RetiredConfigKey[] = [\n    // --- Guard renames. Previously applied SILENTLY before validation (a DEPRECATED_RULE_ALIASES table in\n    // load-config.ts rewrote the key so no validator ever saw it). That hid the rename from the config file\n    // forever: the old name kept working, so no consumer ever updated, and the alias table could never be\n    // deleted. Now each is a hard error with the new name.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'pr-merge-cleanup', 'pr-merge-guard',\n        'Rename the key to \"pr-merge-guard\". Its value carries over unchanged.',\n        '[pr-merge-cleanup]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'pr-creation-guard', 'pr-creation-or-push-guard',\n        'Rename the key to \"pr-creation-or-push-guard\" — the guard grew a second blocked action (a manual ' +\n        'git push), so it is no longer only about PR creation. Its value carries over unchanged.',\n        '[pr-creation-guard]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'main-stale-guard', 'read-stale-guard',\n        'Rename the key to \"read-stale-guard\" — the guard grew a second blocked state (an already-merged ' +\n        'feature branch), so it is no longer about `main` at all; it is THE guard that can block a Read. ' +\n        'Its value carries over unchanged.',\n        '[main-stale-guard]',\n    ),\n\n    // --- The two flat guard-hint strings, superseded by commands.guardHints so that every guard-facing\n    // command string sits in one named sub-object instead of loose beside the gate config.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'upsertPr', 'commands.guardHints.prCreationOrPush',\n        'Move the value to \"guardHints\": { \"prCreationOrPush\": <value> } inside the same \"commands\" ' +\n        'section, then delete \"upsertPr\".',\n        '[commands]',\n    ),\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'mergeComplete', 'commands.guardHints.mergeInProgress',\n        'Move the value to \"guardHints\": { \"mergeInProgress\": <value> } inside the same \"commands\" ' +\n        'section, then delete \"mergeComplete\".',\n        '[commands]',\n    ),\n\n    // --- The two-list excludePaths object. The split never earned its keep (every consumer set both lists\n    // to the same value), and the one case that would need them to differ is served better by a rule's own\n    // `excludePaths`. Retired as a SHAPE: `rules` is the entry validateExcludePaths reports for either key.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_KEY, 'rules', 'excludePaths (one flat array)',\n        'Replace the whole { \"rules\": [...], \"guards\": [...] } object with ONE array holding the union of ' +\n        'both lists, de-duplicated — e.g. \"excludePaths\": [\"repositories/**\"]. A path is governed by ' +\n        'webpieces or it is not, so there is no longer a per-engine split. To exclude a path from one rule ' +\n        'only, use that rule\\'s own \"excludePaths\" inside its config block instead.',\n        '[excludePaths]',\n    ),\n\n    // --- whole-repo-build-guard, retired as a REPO-CONFIG key one release after it was added. It shipped\n    // as a conventional validated guard (mode ON by default, entry REQUIRED under hookGuards), so every\n    // consumer that upgraded hit fault Y — every Bash call blocked — for an experimental feature nobody\n    // had opted into. The switch now lives ONLY in the optional machine-local ~/.webpieces/config.json,\n    // whose absent state is byte-for-byte the old behaviour. A repo that never added the entry has nothing\n    // to do; a repo that added it to escape fault Y is told right here to take it back out.\n    new RetiredConfigKey(\n        RETIRED_SCOPE_RULE, 'whole-repo-build-guard', '~/.webpieces/config.json → experimental.whole-repo-build-guard',\n        'DELETE this entry from webpieces.config.json — no repo config key controls this guard any more, ' +\n        'and with the entry gone the guard is silently off for everyone in this repo. To switch it on for ' +\n        'YOUR machine only, put {\"experimental\": {\"whole-repo-build-guard\": true}} in ' +\n        '~/.webpieces/config.json — that file is optional, is tracked by no repo, and every webpieces ' +\n        'command behaves exactly as it does by default when it does not exist.',\n        '[whole-repo-build-guard]',\n    ),\n];\n\n/**\n * The shared message. Leads with the retirement, then the destination, then the edit — an agent reading this\n * should not have to infer anything.\n *\n * RETIRED_KEY_MARKER is the phrase the banner classifier keys off to call this error DEFINITIVE (no\n * install can revive a key this table names), so the marker is IMPORTED rather than re-typed here.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredKeyError(entry: RetiredConfigKey): string {\n    const destination = entry.movedTo === ''\n        ? 'It was removed with no replacement.'\n        : `It moved to \"${entry.movedTo}\".`;\n    return `${entry.label} \"${entry.key}\" ${RETIRED_KEY_MARKER}. ${destination} ${entry.instruction}`;\n}\n\n/**\n * The retired entry for a rule/guard NAME, or null. Callers must consult this BEFORE reporting a name as an\n * unknown rule: the unknown-rule message leads with \"run `pnpm install`, your validator may be stale\", which\n * is exactly the wrong advice for a name we know is dead.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredRuleFor(ruleName: string): RetiredConfigKey | null {\n    return RETIRED_CONFIG_KEYS.find(e => e.scope === RETIRED_SCOPE_RULE && e.key === ruleName) ?? null;\n}\n\n/**\n * Whether `key` is retired within `label`'s section. Unknown-key rejection consults this so a retired key\n * gets its migration message instead of a generic \"unknown key, delete it\" — the migration instruction is\n * the entire reason this table exists.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function isRetiredKey(key: string, label: string): boolean {\n    return RETIRED_CONFIG_KEYS.some(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key === key);\n}\n\n/**\n * The retired entry for `key` within `label`'s section. For a retirement that is a SHAPE rather than a\n * single key (the excludePaths object), the validator looks the entry up directly so one table row remains\n * the single source of the message.\n */\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredEntry(key: string, label: string): RetiredConfigKey | null {\n    return RETIRED_CONFIG_KEYS.find(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key === key) ?? null;\n}\n\n/** Errors for every retired plain key present in `section`. `label` scopes the lookup to that section. */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON; only key PRESENCE is read\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this package\nexport function retiredKeyErrorsIn(section: Record<string, unknown>, label: string): string[] {\n    return RETIRED_CONFIG_KEYS\n        .filter(e => e.scope === RETIRED_SCOPE_KEY && e.label === label && e.key in section)\n        .map(e => retiredKeyError(e));\n}\n"]}

package/src/reviewer-instructions.d.ts

@@ -68,7 +68,7 @@ export declare const ALL_DIFF_ONE_READ_LINES = 1500;
  * Renders the per-reviewer instructions file that `wp-review-upsert-pr` writes to
  * `.webpieces/pr-review/<feature>/instructions/<subagent>.instructions.md`.
  *
- * WHY this file exists, measured rather than assumed: a reviewer subagent on monorepo-nx2 spent **14 of its
+ * WHY this file exists, measured rather than assumed: a reviewer subagent on consumer-monorepo2 spent **14 of its
  * 26 tool calls** rediscovering context the tooling already had — three separate greps into
  * `node_modules/@webpieces` to locate a scanner, a hunt through terraform for queue names, and a
  * re-derivation of the dependency graph. It did not over-review; it was under-supplied. Everything below is

package/src/reviewer-instructions.js

@@ -125,7 +125,7 @@ exports.ALL_DIFF_ONE_READ_LINES = 1500;
  * Renders the per-reviewer instructions file that `wp-review-upsert-pr` writes to
  * `.webpieces/pr-review/<feature>/instructions/<subagent>.instructions.md`.
  *
- * WHY this file exists, measured rather than assumed: a reviewer subagent on monorepo-nx2 spent **14 of its
+ * WHY this file exists, measured rather than assumed: a reviewer subagent on consumer-monorepo2 spent **14 of its
  * 26 tool calls** rediscovering context the tooling already had — three separate greps into
  * `node_modules/@webpieces` to locate a scanner, a hunt through terraform for queue names, and a
  * re-derivation of the dependency graph. It did not over-review; it was under-supplied. Everything below is

package/src/reviewer-instructions.js.map

@@ -1 +1 @@
-{"version":3,"file":"reviewer-instructions.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/reviewer-instructions.ts"],"names":[],"mappings":";;;;AAAA,mDAA6B;AAC7B,yCAA2D;AAC3D,+CAAkD;AAElD,2GAA2G;AAC3G,MAAa,YAAY;IACrB,KAAK,CAAS;IACd,IAAI,CAAS,CAAK,gDAAgD;IAClE,IAAI,CAAS,CAAK,0EAA0E;IAE5F,YAAY,KAAa,EAAE,SAAiB,EAAE,IAAI,GAAG,EAAE;QACnD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;CACJ;AAVD,oCAUC;AAED;;;;;;;GAOG;AACH,MAAa,WAAW;IACpB,IAAI,CAAS,CAAQ,4BAA4B;IACjD,QAAQ,CAAS,CAAI,uCAAuC;IAC5D,UAAU,CAAS,CAAE,oFAAoF;IACzG,MAAM,CAAS,CAAM,+DAA+D;IACpF,SAAS,CAAS;IAClB,SAAS,CAAU;IAEnB,yDAAyD;IACzD,YAAY,IAAY,EAAE,QAAgB,EAAE,UAAU,GAAG,EAAE,EAAE,MAAM,GAAG,GAAG,EAAE,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK;QACvG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;CACJ;AAjBD,kCAiBC;AAED;;;;;;GAMG;AACH,MAAa,gBAAgB;IACzB,QAAQ,CAAS;IACjB,OAAO,CAAS,CAAc,gEAAgE;IAC9F,QAAQ,CAAS;IACjB,OAAO,CAAS,CAAc,mCAAmC;IACjE,WAAW,CAAS;IACpB,YAAY,CAAS;IACrB,OAAO,CAAgB,CAAO,qCAAqC;IACnE,eAAe,CAAW,CAAI,+CAA+C;IAC7E,UAAU,CAAW,CAAS,0CAA0C;IACxE,cAAc,CAAiB;IAC/B,WAAW,CAAS,CAAU,4BAA4B;IAC1D,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,KAAK,CAAU;IACf,0GAA0G;IAC1G,gBAAgB,CAAS;IACzB,cAAc,CAAS;IACvB,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,YAAY,CAAS;IACrB,yGAAyG;IACzG,uGAAuG;IACvG,aAAa,CAAS;IACtB,eAAe,CAAS;IACxB,YAAY,CAAS;IACrB,kBAAkB,CAAS,CAAG,kFAAkF;IAChH,mGAAmG;IACnG,iGAAiG;IACjG,sGAAsG;IACtG,qGAAqG;IACrG,uBAAuB;IACvB,QAAQ,CAAU;IAElB,yDAAyD;IACzD,YAAY,QAAgB,EAAE,WAAmB,EAAE,QAAgB;QAC/D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC;QAC7B,mGAAmG;QACnG,4DAA4D;QAC5D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACzB,CAAC;CACJ;AA/DD,4CA+DC;AAED;;;GAGG;AACU,QAAA,qBAAqB,GAAG,IAAI,CAAC;AAE1C,6GAA6G;AAChG,QAAA,uBAAuB,GAAG,IAAI,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AAEI,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACP;IAA7B,YAA6B,iBAAoC;QAApC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAAG,CAAC;IAErE,oFAAoF;IACpF,kBAAkB,CAAC,QAAgB,EAAE,WAAmB;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7F,CAAC;IAED,6DAA6D;IAC7D,WAAW,CAAC,QAAgB;QACxB,OAAO,GAAG,QAAQ,kBAAkB,CAAC;IACzC,CAAC;IAED,mEAAmE;IACnE,OAAO,CAAC,QAAgB,EAAE,WAAmB,EAAE,QAAgB;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,CAAC,QAA0B;QAC7B,OAAO;YACH,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAClC,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC7B,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAC/B,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;YAChC,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;YAChC,GAAG,IAAI,CAAC,aAAa,EAAE;SAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC;IAEO,QAAQ,CAAC,CAAmB;QAChC,OAAO;YACH,eAAe,CAAC,CAAC,QAAQ,IAAI;YAC7B,EAAE;YACF,kFAAkF;YAClF,qDAAqD;YACrD,EAAE;YACF,oGAAoG;YACpG,4FAA4F;YAC5F,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;YAC1B,EAAE;YACF,gGAAgG;YAChG,2FAA2F;YAC3F,EAAE;SACL,CAAC;IACN,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,CAAmB;QACvC,IAAI,CAAC,CAAC,kBAAkB,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3C,OAAO;YACH,EAAE;YACF,iDAAiD,CAAC,CAAC,kBAAkB,IAAI;YACzE,8FAA8F;YAC9F,oGAAoG;SACvG,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,CAAmB;QACxC,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,4EAA4E,EAAE,EAAE,CAAC,CAAC;QACvH,CAAC;QACD,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;OASG;IACK,WAAW,CAAC,CAAmB;QACnC,MAAM,KAAK,GAAG,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;YAC1F,KAAK,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;YACxG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9G,IAAI,CAAC,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;QAC1G,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,CAAmB;QACrC,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC,EAAE,CAAC;QAClH,OAAO;YACH,oDAAoD,CAAC,CAAC,YAAY,IAAI;YACtE,KAAK,CAAC,CAAC,gBAAgB,cAAc,CAAC,CAAC,cAAc,gBAAgB,CAAC,CAAC,aAAa,YAAY,IAAI,EAAE;YACtG,uGAAuG;YACvG,uFAAuF;YACvF,EAAE;SACL,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,CAAmB;QAClC,IAAI,CAAC,CAAC,aAAa,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,aAAa,CAAC;QACtD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,cAAc;YAChD,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,sDAAsD;gBACtF,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,oCAAoC,CAAC;QAC5D,OAAO;YACH,qFAAqF;YACrF,KAAK;YACL,qBAAqB,CAAC,CAAC,aAAa,EAAE;YACtC,qBAAqB,CAAC,CAAC,eAAe,EAAE;YACxC,qBAAqB,KAAK,EAAE;YAC5B,KAAK;YACL,sDAAsD;YACtD,EAAE;SACL,CAAC;IACN,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,CAAmB;QACpC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YACtC,CAAC,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,MAAM,sFAAsF;YAC3H,CAAC,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,uBAAuB,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAS,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnI,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAc,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,4CAA4C,EAAE,mBAAmB,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IACrG,CAAC;IAED;;;;OAIG;IACK,OAAO,CAAC,CAAc;QAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC;QAC3F,OAAO,OAAO,CAAC,CAAC,IAAI,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,SAAS,aAAa,MAAM,IAAI,CAAC;IAClG,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,CAAmB;QACpC,IAAI,CAAC,CAAC,WAAW,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,YAAY,CAAC,CAAC,YAAY,QAAQ,CAAC;QAChG,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,mBAAmB,IAAI,8CAA8C,CAAC,CAAC,WAAW,IAAI;gBAC1F,uGAAuG,EAAE,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,GAAG,+BAAuB,EAAE,CAAC;YAC3C,OAAO,CAAC,2BAA2B,CAAC,CAAC,YAAY,0DAA0D;gBACvG,iBAAiB,6BAAqB,uEAAuE;gBAC7G,KAAK,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,oBAAoB,IAAI,4EAA4E;YACxG,KAAK,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,CAAmB;QACrC,MAAM,KAAK,GAAG,CAAC,kDAAkD,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3G,KAAK,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;QACvG,KAAK,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;QAC3G,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;QAC7G,KAAK,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;QAC7G,KAAK,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;QACvG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACjD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,CAAmB;QACtC,mGAAmG;QACnG,2FAA2F;QAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,yBAAyB,EAAE,EAAE;gBACjC,iGAAiG;gBACjG,sGAAsG;gBACtG,EAAE,CAAC,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,uDAAuD,EAAE,EAAE,CAAC,CAAC;QAC5E,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,CAAmB;QACtC,OAAO;YACH,uBAAuB;YACvB,EAAE;YACF,qDAAqD,CAAC,CAAC,WAAW,IAAI;YACtE,EAAE;YACF,KAAK;YACL,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;YAC9D,KAAK;YACL,EAAE;SACL,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACK,aAAa;QACjB,OAAO;YACH,WAAW;YACX,EAAE;YACF,mGAAmG;YACnG,iGAAiG;YACjG,4CAA4C;YAC5C,EAAE;YACF,qGAAqG;YACrG,8FAA8F;YAC9F,EAAE;YACF,mGAAmG;YACnG,qBAAqB;YACrB,EAAE;YACF,oGAAoG;YACpG,kGAAkG;YAClG,kGAAkG;YAClG,0FAA0F;SAC7F,CAAC;IACN,CAAC;CACJ,CAAA;AAvRY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEW,+BAAiB;GADxD,2BAA2B,CAuRvC","sourcesContent":["import * as path from 'path';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { ReviewJsonService } from './review-json';\n\n/** One pre-resolved place a reviewer would otherwise have to go hunting for. Data-only (per CLAUDE.md). */\nexport class ContextEntry {\n    label: string;\n    path: string;     // ABSOLUTE, or '' when it could not be resolved\n    note: string;     // '(not installed)' / '(configured but missing)' — never silently dropped\n\n    constructor(label: string, entryPath: string, note = '') {\n        this.label = label;\n        this.path = entryPath;\n        this.note = note;\n    }\n}\n\n/**\n * One reviewer's matched file, the extracted diff for it, AND the absolute path of the file itself.\n *\n * `sourcePath` exists because of a measured 0/4: four reviewers on one PR read the diff and not one opened a\n * single full source file. The instructions handed them an absolute path per diff and only a parent DIRECTORY\n * per source, so reading the diff was a paste and reading the source was \"join this dir to that filename\n * yourself\". Identical affordance, or the cheaper one wins every time. Data-only.\n */\nexport class BriefedFile {\n    file: string;        // repo-relative source path\n    diffPath: string;    // ABSOLUTE path of the extracted .diff\n    sourcePath: string;  // ABSOLUTE path of the file itself; '' for a deleted file, which has no after-state\n    status: string;      // 'M' | 'A' | 'D' | 'U' (untracked) | 'X' (excluded by config)\n    diffBytes: number;\n    truncated: boolean;\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(file: string, diffPath: string, sourcePath = '', status = 'M', diffBytes = 0, truncated = false) {\n        this.file = file;\n        this.diffPath = diffPath;\n        this.sourcePath = sourcePath;\n        this.status = status;\n        this.diffBytes = diffBytes;\n        this.truncated = truncated;\n    }\n}\n\n/**\n * Everything ONE reviewer needs, with every path already resolved to an ABSOLUTE one.\n *\n * Absolute is not fussiness: a subagent's working directory is not guaranteed to be the repo root, and a\n * relative path that fails to resolve turns into a search, which is the cost this whole class exists to\n * remove. Data-only.\n */\nexport class ReviewerBriefing {\n    subagent: string;\n    docPath: string;              // the checklist's guidance doc ('' when the checklist has none)\n    repoRoot: string;\n    diffDir: string;              // '' when nothing was materialized\n    allDiffPath: string;\n    manifestPath: string;\n    myFiles: BriefedFile[];       // ONLY this reviewer's matched files\n    matchedPatterns: string[];    // [] ⇒ patternless: the whole diff is in scope\n    sourceDirs: string[];         // deduped ABSOLUTE parent dirs of myFiles\n    contextEntries: ContextEntry[];\n    verdictPath: string;          // ABSOLUTE review-<id>.json\n    checklistId: string;\n    fileDiffCommand: string;\n    dirty: boolean;\n    // Facts ABOUT the manifest, surfaced inline so a reviewer learns the diff is complete without opening it.\n    changedFileCount: number;\n    truncatedCount: number;\n    excludedCount: number;\n    allDiffLines: number;\n    allDiffBytes: number;\n    // The three shas, by the names DiffManifest already uses. Printing two bare shas told a reviewer nothing\n    // about WHAT the diff is taken against; C beside A makes \"main has moved since the fork\" self-evident.\n    hashForkPoint: string;\n    hashFeatureHead: string;\n    hashMainHead: string;\n    ownAgentFileInDiff: string;   // ABSOLUTE path when this diff edits THIS reviewer's own agent file; '' otherwise\n    // From the checklist's config `required`. Carried so the stage-② report can group the spawn blocks\n    // (must run) apart from the ones the human is merely OFFERED, without a second lookup that could\n    // disagree with the scan. The reviewer's OWN instructions do not mention it: a reviewer that has been\n    // spawned reviews the same way either way, and telling an optional one it was optional invites it to\n    // grade itself softer.\n    required: boolean;\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(subagent: string, checklistId: string, repoRoot: string) {\n        this.subagent = subagent;\n        this.checklistId = checklistId;\n        this.repoRoot = repoRoot;\n        this.docPath = '';\n        this.diffDir = '';\n        this.allDiffPath = '';\n        this.manifestPath = '';\n        this.myFiles = [];\n        this.matchedPatterns = [];\n        this.sourceDirs = [];\n        this.contextEntries = [];\n        this.verdictPath = '';\n        this.fileDiffCommand = '';\n        this.dirty = false;\n        this.changedFileCount = 0;\n        this.truncatedCount = 0;\n        this.excludedCount = 0;\n        this.allDiffLines = 0;\n        this.allDiffBytes = 0;\n        this.hashForkPoint = '';\n        this.hashFeatureHead = '';\n        this.hashMainHead = '';\n        this.ownAgentFileInDiff = '';\n        // Fails CLOSED, like RequiredChecklist.required: a briefing built without the flag being copied is\n        // treated as a blocking reviewer, never as a skippable one.\n        this.required = true;\n    }\n}\n\n/**\n * The Read tool truncates at roughly this many lines, silently. Any path this file prints alongside a bigger\n * line count has to say so, or a reviewer reviews a fraction of a change and reports on all of it.\n */\nexport const READ_TRUNCATION_LINES = 2000;\n\n/** Comfortably under {@link READ_TRUNCATION_LINES} — the size at which ALL.diff really is one clean Read. */\nexport const ALL_DIFF_ONE_READ_LINES = 1500;\n\n/**\n * Renders the per-reviewer instructions file that `wp-review-upsert-pr` writes to\n * `.webpieces/pr-review/<feature>/instructions/<subagent>.instructions.md`.\n *\n * WHY this file exists, measured rather than assumed: a reviewer subagent on monorepo-nx2 spent **14 of its\n * 26 tool calls** rediscovering context the tooling already had — three separate greps into\n * `node_modules/@webpieces` to locate a scanner, a hunt through terraform for queue names, and a\n * re-derivation of the dependency graph. It did not over-review; it was under-supplied. Everything below is\n * chosen to delete a specific one of those calls.\n *\n * It is GENERATED per run, and the registered `.claude/agents/<subagent>.md` is a thin stub that points\n * here, because content a human maintains goes stale and a reviewer follows the stale copy. The verdict\n * schema in particular comes from {@link ReviewJsonService.verdictSchemaFor}.\n *\n * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ReviewerInstructionsService {\n    constructor(private readonly reviewJsonService: ReviewJsonService) {}\n\n    /** The dir holding this branch's generated instructions, beside its review.json. */\n    instructionsDirFor(repoRoot: string, featureName: string): string {\n        return path.join(this.reviewJsonService.prDirFor(repoRoot, featureName), 'instructions');\n    }\n\n    /** The file name for a reviewer's generated instructions. */\n    fileNameFor(subagent: string): string {\n        return `${subagent}.instructions.md`;\n    }\n\n    /** Absolute path of one reviewer's generated instructions file. */\n    pathFor(repoRoot: string, featureName: string, subagent: string): string {\n        return path.join(this.instructionsDirFor(repoRoot, featureName), this.fileNameFor(subagent));\n    }\n\n    render(briefing: ReviewerBriefing): string {\n        return [\n            ...this.identity(briefing),\n            ...this.checklistSection(briefing),\n            ...this.diffSection(briefing),\n            ...this.sourceSection(briefing),\n            ...this.contextSection(briefing),\n            ...this.verdictSection(briefing),\n            ...this.budgetSection(),\n        ].join('\\n') + '\\n';\n    }\n\n    private identity(b: ReviewerBriefing): string[] {\n        return [\n            `# You are \\`${b.subagent}\\``,\n            '',\n            'Review as YOURSELF, against your own checklist — not as a general code reviewer.',\n            'You may not write another reviewer\\'s verdict file.',\n            '',\n            '\"You may not review your own authorship\" means: you did not write this diff, so review it — but if',\n            'the diff CHANGES YOU, say so in `output` rather than pretending the conflict is not there.',\n            ...this.selfEditWarning(b),\n            '',\n            '_Generated per run by `wp-review-upsert-pr`. Everything below is already resolved for you; the',\n            'paths are absolute because your working directory is not guaranteed to be the repo root._',\n            '',\n        ];\n    }\n\n    /**\n     * Every PR that edits the review gate hits this: on the measured run, 5 of 8 changed files were the\n     * reviewer agent files themselves, two reviewers reviewed their OWN definition, and neither flagged it —\n     * neither had any guidance to. Detected by the tooling rather than left to the reviewer to notice.\n     */\n    private selfEditWarning(b: ReviewerBriefing): string[] {\n        if (b.ownAgentFileInDiff === '') return [];\n        return [\n            '',\n            `⚠️  THIS DIFF MODIFIES YOUR OWN AGENT FILE: \\`${b.ownAgentFileInDiff}\\``,\n            'You are reviewing a change to your own definition. Review it anyway — and state that fact in',\n            '`output`, so a human reading your verdict knows the reviewer and the reviewed were the same thing.',\n        ];\n    }\n\n    private checklistSection(b: ReviewerBriefing): string[] {\n        if (b.docPath === '') {\n            return ['## Your checklist', '', 'This checklist has no guidance doc — judge the diff on your own standards.', ''];\n        }\n        return ['## Your checklist', '', `Read this FIRST: \\`${b.docPath}\\``, ''];\n    }\n\n    /**\n     * The change itself. The MANIFEST leads, and the per-file table with it; `ALL.diff` is demoted to one\n     * option among several, recommended only where it is actually the right read.\n     *\n     * That ordering is the fix for a measured 4/4 failure. `ALL.diff` used to be bolded, first, and framed as\n     * \"everything\", with the manifest one unbolded line below it called a \"path map\" — which reads like a\n     * lookup aid, not something to open. All four reviewers on that PR read `ALL.diff`, none opened the\n     * manifest, and none could therefore have established that the combined view was complete. Reviewers did\n     * exactly what the emphasis told them to; so the emphasis moved.\n     */\n    private diffSection(b: ReviewerBriefing): string[] {\n        const lines = ['## The change you are reviewing', ''];\n        if (b.dirty) {\n            lines.push('> ⚠️ This diff INCLUDES uncommitted and untracked work, so it is not what a');\n            lines.push('> commit-to-commit range would show. Judge it anyway — it is what your checklist matched.');\n            lines.push('');\n        }\n        lines.push(...this.manifestLines(b), ...this.basisLines(b), ...this.myFilesTable(b), ...this.allDiffLines(b));\n        if (b.fileDiffCommand !== '') {\n            lines.push(`Reproduce any single file: \\`${b.fileDiffCommand}\\``);\n            lines.push('');\n        }\n        lines.push('Path matching is COARSE. Judge the change, not the path — if a matched file turns out to be');\n        lines.push('irrelevant to your checklist, say so in one sentence and move on.');\n        lines.push('');\n        return lines;\n    }\n\n    /**\n     * The manifest, named as the authority AND with its own headline facts inlined. Inlining them is the\n     * point: a reviewer that never opens the manifest still learns whether anything was truncated or\n     * excluded, which is the one thing it could not otherwise have known it was missing.\n     */\n    private manifestLines(b: ReviewerBriefing): string[] {\n        if (b.manifestPath === '') return [];\n        const warn = b.truncatedCount + b.excludedCount > 0 ? '  ⚠️ NOT everything is materialized — see the table.' : '';\n        return [\n            `**Path map — AUTHORITATIVE. Read this first:** \\`${b.manifestPath}\\``,\n            `  ${b.changedFileCount} file(s) · ${b.truncatedCount} truncated · ${b.excludedCount} excluded${warn}`,\n            '  Per file it carries: `status` (M/A/D/U/X), `bytes`, `file`/`fileAbs`, `diffFile`/`diffAbs`, and the',\n            '  three shas below. It is the only place that records what was truncated or left out.',\n            '',\n        ];\n    }\n\n    /**\n     * What the diff is taken AGAINST. Two bare shas in a `git diff` command said nothing about this, so a\n     * reviewer could not tell a fork-point diff from a diff against main's current tip — and therefore could\n     * not tell that anything merged to main since the fork is simply absent from what it is judging.\n     * Rendering C beside A makes \"main has moved\" self-evident exactly when it has.\n     */\n    private basisLines(b: ReviewerBriefing): string[] {\n        if (b.hashForkPoint === '') return [];\n        const sameAsFork = b.hashMainHead === b.hashForkPoint;\n        const cNote = b.hashMainHead === '' ? '(unresolved)'\n            : sameAsFork ? `${b.hashMainHead}   ← same as A, so main has not moved since the fork`\n            : `${b.hashMainHead}   ← main HAS MOVED since the fork`;\n        return [\n            'This diff is **fork-point → feature-head**, NOT a diff against main\\'s current tip:',\n            '```',\n            `fork point   (A)  ${b.hashForkPoint}`,\n            `feature head (B)  ${b.hashFeatureHead}`,\n            `main head    (C)  ${cNote}`,\n            '```',\n            'Anything merged to main after A is NOT in this diff.',\n            '',\n        ];\n    }\n\n    /**\n     * Source and diff get IDENTICAL affordance — an absolute path each, in adjacent columns. The previous\n     * table gave an absolute path for the diff and nothing for the source, and the source went unread 4/4.\n     */\n    private myFilesTable(b: ReviewerBriefing): string[] {\n        if (b.myFiles.length === 0) return ['_No files matched your patterns._', ''];\n        const why = b.matchedPatterns.length === 0\n            ? `**In scope: ALL ${b.myFiles.length} changed file(s)** — your checklist has no \\`patterns\\`, so the whole diff is yours.`\n            : `**In scope: ${b.myFiles.length} file(s)** matching ${b.matchedPatterns.map((p: string): string => `\\`${p}\\``).join(', ')}:`;\n        const rows = b.myFiles.map((f: BriefedFile): string => this.fileRow(f));\n        return [why, '', '| file | status | its diff | full source |', '|---|---|---|---|', ...rows, ''];\n    }\n\n    /**\n     * One row. A truncated or excluded diff is flagged HERE, in the row, not left as a field inside a file the\n     * reviewer has to think to open — and an oversized diff states the line count that makes a single Read\n     * come back silently incomplete.\n     */\n    private fileRow(f: BriefedFile): string {\n        const flags: string[] = [];\n        if (f.truncated) flags.push('⚠️ diff TRUNCATED — read the source');\n        if (f.status === 'X') flags.push('⚠️ EXCLUDED, not materialized — read the source');\n        const status = [`\\`${f.status}\\``, ...flags].join(' ');\n        const source = f.sourcePath === '' ? '_deleted — no file on disk_' : `\\`${f.sourcePath}\\``;\n        return `| \\`${f.file}\\` | ${status} | \\`${f.diffPath}\\` (${f.diffBytes} bytes) | ${source} |`;\n    }\n\n    /**\n     * `ALL.diff`, recommended ONLY where it is the right read. It is kept — for a patternless reviewer on a\n     * small diff it is genuinely one Read instead of N, which is why all four used it — but the blanket\n     * \"everything on this branch\" line was wrong in two different ways at once: it invited a pattern-scoped\n     * reviewer to spend its budget on files it was explicitly not asked about, and it pointed a reviewer on a\n     * large PR at a file that cannot survive one Read.\n     */\n    private allDiffLines(b: ReviewerBriefing): string[] {\n        if (b.allDiffPath === '') return [];\n        const size = b.allDiffLines === 0 ? '' : ` — ${b.allDiffLines} lines / ${b.allDiffBytes} bytes`;\n        if (b.matchedPatterns.length > 0) {\n            return [`The whole branch${size}, for CROSS-FILE CONTEXT if you need it: \\`${b.allDiffPath}\\``,\n                'Your own files above are what you are reviewing; the rest of the branch is someone else\\'s checklist.', ''];\n        }\n        if (b.allDiffLines > ALL_DIFF_ONE_READ_LINES) {\n            return [`⚠️ The combined diff is ${b.allDiffLines} lines and will NOT survive a single Read (the Read tool`,\n                `truncates at ~${READ_TRUNCATION_LINES} lines, silently). Read the per-file diffs above instead, or page it:`,\n                `\\`${b.allDiffPath}\\``, ''];\n        }\n        return [`Whole-branch diff${size} — convenient at this size, but the per-file table above is authoritative:`,\n            `\\`${b.allDiffPath}\\``, ''];\n    }\n\n    /**\n     * The rule that used to say \"when you need to\", and lost 4/4 to the more emphatic budget section 40 lines\n     * later. \"When you need to\" delegates the judgment to a reviewer that, by construction, does not yet know\n     * what it is missing. It has no opt-out now.\n     */\n    private sourceSection(b: ReviewerBriefing): string[] {\n        const lines = ['## Read the full source — every file, every time', '', `Repo root: \\`${b.repoRoot}\\``, ''];\n        lines.push('**READ THE FULL SOURCE OF EVERY FILE IN YOUR TABLE.** Not \"if you need to\" — every time.');\n        lines.push('A hunk shows what changed; only the whole file shows what it changed INTO, and a change that');\n        lines.push('looks fine in isolation can still be wrong in place.');\n        lines.push('');\n        lines.push('The `full source` column above is the path. For files marked `A` (added) you have already done');\n        lines.push('this: an add-diff IS the complete file, byte for byte, so its diff and its source are the same');\n        lines.push('text. For `M` (modified) and `D` (deleted) files the diff is a fragment — open the file.');\n        lines.push('');\n        if (b.sourceDirs.length > 0) {\n            lines.push('The neighbouring code lives under:');\n            for (const dir of b.sourceDirs) lines.push(`- \\`${dir}\\``);\n            lines.push('');\n        }\n        return lines;\n    }\n\n    /**\n     * The section that deletes the `node_modules` greps. Entries come from config, because the tooling\n     * cannot guess that a repo keeps its queue names in terraform — but it CAN resolve where a package\n     * installed to, and it must never drop an entry silently: a missing path is stated as missing.\n     */\n    private contextSection(b: ReviewerBriefing): string[] {\n        // Emitting NOTHING made the section this class exists for look like a feature that does not exist.\n        // One line naming the config keys costs nothing and is the only hint a repo will ever get.\n        if (b.contextEntries.length === 0) {\n            return ['## Pre-resolved context', '',\n                '_None configured for this repo. If you find yourself hunting for the same path on every review,',\n                'it belongs in `pr-gate.reviewContext` / `pr-gate.reviewContextPackages` in `webpieces.config.json`._',\n                ''];\n        }\n        const lines = ['## Pre-resolved context (do not go hunting for these)', ''];\n        for (const entry of b.contextEntries) {\n            const suffix = entry.note === '' ? '' : `  ${entry.note}`;\n            lines.push(`- **${entry.label}** — \\`${entry.path === '' ? entry.note : entry.path}\\`${entry.path === '' ? '' : suffix}`);\n        }\n        lines.push('');\n        return lines;\n    }\n\n    /**\n     * The verdict shape, GENERATED — never restated in a hand-maintained file. `id` is pre-filled with this\n     * reviewer's own checklist id so there is nothing to substitute and nothing to get wrong.\n     */\n    private verdictSection(b: ReviewerBriefing): string[] {\n        return [\n            '## Write your verdict',\n            '',\n            `Write EXACTLY this shape, to EXACTLY this file: \\`${b.verdictPath}\\``,\n            '',\n            '```',\n            this.reviewJsonService.verdictSchemaFor(b.checklistId, '', ''),\n            '```',\n            '',\n        ];\n    }\n\n    /**\n     * The anti-hunting rule, with the changed files carved out explicitly.\n     *\n     * It used to read as \"stay inside what you were given\" and, being the LAST thing in the file, it beat\n     * the source-reading instruction 4 times out of 4. It never distinguished HUNTING — greps into\n     * `node_modules`, re-deriving the dependency graph — from OPENING A FILE IT WAS EXPLICITLY HANDED. The\n     * distinction is now stated, because where two instructions conflict the later and more emphatic one wins.\n     */\n    private budgetSection(): string[] {\n        return [\n            '## Budget',\n            '',\n            'Do NOT search `node_modules`, do NOT re-derive the dependency graph, and do NOT hunt the repo for',\n            'infrastructure config. That is hunting, and it is what wastes a review budget — those paths are',\n            'either given above or were not configured.',\n            '',\n            'Reading the full text of a file that is IN your table is NOT hunting — it is the review. Budget for',\n            'it: read the diff to see what changed, and the source to judge whether it is right in place.',\n            '',\n            'If something you genuinely need is missing, name it in `output` and give your verdict on what you',\n            'could actually see.',\n            '',\n            'Open your diff files before writing a verdict. `wp-finish-upsert-pr` reads your own transcript and',\n            'reports a verdict written without opening the diff. It also records the path of that transcript,',\n            'beside what you were offered and what you read, in `provenance.json` next to your verdict file —',\n            'so the review is auditable after the fact. You do not write that file; the tooling does.',\n        ];\n    }\n}\n"]}
+{"version":3,"file":"reviewer-instructions.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/reviewer-instructions.ts"],"names":[],"mappings":";;;;AAAA,mDAA6B;AAC7B,yCAA2D;AAC3D,+CAAkD;AAElD,2GAA2G;AAC3G,MAAa,YAAY;IACrB,KAAK,CAAS;IACd,IAAI,CAAS,CAAK,gDAAgD;IAClE,IAAI,CAAS,CAAK,0EAA0E;IAE5F,YAAY,KAAa,EAAE,SAAiB,EAAE,IAAI,GAAG,EAAE;QACnD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;CACJ;AAVD,oCAUC;AAED;;;;;;;GAOG;AACH,MAAa,WAAW;IACpB,IAAI,CAAS,CAAQ,4BAA4B;IACjD,QAAQ,CAAS,CAAI,uCAAuC;IAC5D,UAAU,CAAS,CAAE,oFAAoF;IACzG,MAAM,CAAS,CAAM,+DAA+D;IACpF,SAAS,CAAS;IAClB,SAAS,CAAU;IAEnB,yDAAyD;IACzD,YAAY,IAAY,EAAE,QAAgB,EAAE,UAAU,GAAG,EAAE,EAAE,MAAM,GAAG,GAAG,EAAE,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK;QACvG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;CACJ;AAjBD,kCAiBC;AAED;;;;;;GAMG;AACH,MAAa,gBAAgB;IACzB,QAAQ,CAAS;IACjB,OAAO,CAAS,CAAc,gEAAgE;IAC9F,QAAQ,CAAS;IACjB,OAAO,CAAS,CAAc,mCAAmC;IACjE,WAAW,CAAS;IACpB,YAAY,CAAS;IACrB,OAAO,CAAgB,CAAO,qCAAqC;IACnE,eAAe,CAAW,CAAI,+CAA+C;IAC7E,UAAU,CAAW,CAAS,0CAA0C;IACxE,cAAc,CAAiB;IAC/B,WAAW,CAAS,CAAU,4BAA4B;IAC1D,WAAW,CAAS;IACpB,eAAe,CAAS;IACxB,KAAK,CAAU;IACf,0GAA0G;IAC1G,gBAAgB,CAAS;IACzB,cAAc,CAAS;IACvB,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,YAAY,CAAS;IACrB,yGAAyG;IACzG,uGAAuG;IACvG,aAAa,CAAS;IACtB,eAAe,CAAS;IACxB,YAAY,CAAS;IACrB,kBAAkB,CAAS,CAAG,kFAAkF;IAChH,mGAAmG;IACnG,iGAAiG;IACjG,sGAAsG;IACtG,qGAAqG;IACrG,uBAAuB;IACvB,QAAQ,CAAU;IAElB,yDAAyD;IACzD,YAAY,QAAgB,EAAE,WAAmB,EAAE,QAAgB;QAC/D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC;QAC7B,mGAAmG;QACnG,4DAA4D;QAC5D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACzB,CAAC;CACJ;AA/DD,4CA+DC;AAED;;;GAGG;AACU,QAAA,qBAAqB,GAAG,IAAI,CAAC;AAE1C,6GAA6G;AAChG,QAAA,uBAAuB,GAAG,IAAI,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AAEI,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACP;IAA7B,YAA6B,iBAAoC;QAApC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAAG,CAAC;IAErE,oFAAoF;IACpF,kBAAkB,CAAC,QAAgB,EAAE,WAAmB;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7F,CAAC;IAED,6DAA6D;IAC7D,WAAW,CAAC,QAAgB;QACxB,OAAO,GAAG,QAAQ,kBAAkB,CAAC;IACzC,CAAC;IAED,mEAAmE;IACnE,OAAO,CAAC,QAAgB,EAAE,WAAmB,EAAE,QAAgB;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,CAAC,QAA0B;QAC7B,OAAO;YACH,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAClC,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC7B,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAC/B,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;YAChC,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;YAChC,GAAG,IAAI,CAAC,aAAa,EAAE;SAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC;IAEO,QAAQ,CAAC,CAAmB;QAChC,OAAO;YACH,eAAe,CAAC,CAAC,QAAQ,IAAI;YAC7B,EAAE;YACF,kFAAkF;YAClF,qDAAqD;YACrD,EAAE;YACF,oGAAoG;YACpG,4FAA4F;YAC5F,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;YAC1B,EAAE;YACF,gGAAgG;YAChG,2FAA2F;YAC3F,EAAE;SACL,CAAC;IACN,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,CAAmB;QACvC,IAAI,CAAC,CAAC,kBAAkB,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3C,OAAO;YACH,EAAE;YACF,iDAAiD,CAAC,CAAC,kBAAkB,IAAI;YACzE,8FAA8F;YAC9F,oGAAoG;SACvG,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,CAAmB;QACxC,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,4EAA4E,EAAE,EAAE,CAAC,CAAC;QACvH,CAAC;QACD,OAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;;;OASG;IACK,WAAW,CAAC,CAAmB;QACnC,MAAM,KAAK,GAAG,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;YAC1F,KAAK,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;YACxG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9G,IAAI,CAAC,CAAC,eAAe,KAAK,EAAE,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;QAC1G,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,CAAmB;QACrC,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC,CAAC,EAAE,CAAC;QAClH,OAAO;YACH,oDAAoD,CAAC,CAAC,YAAY,IAAI;YACtE,KAAK,CAAC,CAAC,gBAAgB,cAAc,CAAC,CAAC,cAAc,gBAAgB,CAAC,CAAC,aAAa,YAAY,IAAI,EAAE;YACtG,uGAAuG;YACvG,uFAAuF;YACvF,EAAE;SACL,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,CAAmB;QAClC,IAAI,CAAC,CAAC,aAAa,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,aAAa,CAAC;QACtD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,cAAc;YAChD,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,sDAAsD;gBACtF,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,oCAAoC,CAAC;QAC5D,OAAO;YACH,qFAAqF;YACrF,KAAK;YACL,qBAAqB,CAAC,CAAC,aAAa,EAAE;YACtC,qBAAqB,CAAC,CAAC,eAAe,EAAE;YACxC,qBAAqB,KAAK,EAAE;YAC5B,KAAK;YACL,sDAAsD;YACtD,EAAE;SACL,CAAC;IACN,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,CAAmB;QACpC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,CAAC,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YACtC,CAAC,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,MAAM,sFAAsF;YAC3H,CAAC,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,uBAAuB,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAS,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnI,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAc,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,4CAA4C,EAAE,mBAAmB,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IACrG,CAAC;IAED;;;;OAIG;IACK,OAAO,CAAC,CAAc;QAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC;QAC3F,OAAO,OAAO,CAAC,CAAC,IAAI,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,SAAS,aAAa,MAAM,IAAI,CAAC;IAClG,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,CAAmB;QACpC,IAAI,CAAC,CAAC,WAAW,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,YAAY,CAAC,CAAC,YAAY,QAAQ,CAAC;QAChG,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,mBAAmB,IAAI,8CAA8C,CAAC,CAAC,WAAW,IAAI;gBAC1F,uGAAuG,EAAE,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,GAAG,+BAAuB,EAAE,CAAC;YAC3C,OAAO,CAAC,2BAA2B,CAAC,CAAC,YAAY,0DAA0D;gBACvG,iBAAiB,6BAAqB,uEAAuE;gBAC7G,KAAK,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,oBAAoB,IAAI,4EAA4E;YACxG,KAAK,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,CAAmB;QACrC,MAAM,KAAK,GAAG,CAAC,kDAAkD,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3G,KAAK,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;QACvG,KAAK,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;QAC3G,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;QAC7G,KAAK,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;QAC7G,KAAK,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;QACvG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACjD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,CAAmB;QACtC,mGAAmG;QACnG,2FAA2F;QAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,yBAAyB,EAAE,EAAE;gBACjC,iGAAiG;gBACjG,sGAAsG;gBACtG,EAAE,CAAC,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,uDAAuD,EAAE,EAAE,CAAC,CAAC;QAC5E,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,CAAmB;QACtC,OAAO;YACH,uBAAuB;YACvB,EAAE;YACF,qDAAqD,CAAC,CAAC,WAAW,IAAI;YACtE,EAAE;YACF,KAAK;YACL,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;YAC9D,KAAK;YACL,EAAE;SACL,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACK,aAAa;QACjB,OAAO;YACH,WAAW;YACX,EAAE;YACF,mGAAmG;YACnG,iGAAiG;YACjG,4CAA4C;YAC5C,EAAE;YACF,qGAAqG;YACrG,8FAA8F;YAC9F,EAAE;YACF,mGAAmG;YACnG,qBAAqB;YACrB,EAAE;YACF,oGAAoG;YACpG,kGAAkG;YAClG,kGAAkG;YAClG,0FAA0F;SAC7F,CAAC;IACN,CAAC;CACJ,CAAA;AAvRY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAEW,+BAAiB;GADxD,2BAA2B,CAuRvC","sourcesContent":["import * as path from 'path';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { ReviewJsonService } from './review-json';\n\n/** One pre-resolved place a reviewer would otherwise have to go hunting for. Data-only (per CLAUDE.md). */\nexport class ContextEntry {\n    label: string;\n    path: string;     // ABSOLUTE, or '' when it could not be resolved\n    note: string;     // '(not installed)' / '(configured but missing)' — never silently dropped\n\n    constructor(label: string, entryPath: string, note = '') {\n        this.label = label;\n        this.path = entryPath;\n        this.note = note;\n    }\n}\n\n/**\n * One reviewer's matched file, the extracted diff for it, AND the absolute path of the file itself.\n *\n * `sourcePath` exists because of a measured 0/4: four reviewers on one PR read the diff and not one opened a\n * single full source file. The instructions handed them an absolute path per diff and only a parent DIRECTORY\n * per source, so reading the diff was a paste and reading the source was \"join this dir to that filename\n * yourself\". Identical affordance, or the cheaper one wins every time. Data-only.\n */\nexport class BriefedFile {\n    file: string;        // repo-relative source path\n    diffPath: string;    // ABSOLUTE path of the extracted .diff\n    sourcePath: string;  // ABSOLUTE path of the file itself; '' for a deleted file, which has no after-state\n    status: string;      // 'M' | 'A' | 'D' | 'U' (untracked) | 'X' (excluded by config)\n    diffBytes: number;\n    truncated: boolean;\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(file: string, diffPath: string, sourcePath = '', status = 'M', diffBytes = 0, truncated = false) {\n        this.file = file;\n        this.diffPath = diffPath;\n        this.sourcePath = sourcePath;\n        this.status = status;\n        this.diffBytes = diffBytes;\n        this.truncated = truncated;\n    }\n}\n\n/**\n * Everything ONE reviewer needs, with every path already resolved to an ABSOLUTE one.\n *\n * Absolute is not fussiness: a subagent's working directory is not guaranteed to be the repo root, and a\n * relative path that fails to resolve turns into a search, which is the cost this whole class exists to\n * remove. Data-only.\n */\nexport class ReviewerBriefing {\n    subagent: string;\n    docPath: string;              // the checklist's guidance doc ('' when the checklist has none)\n    repoRoot: string;\n    diffDir: string;              // '' when nothing was materialized\n    allDiffPath: string;\n    manifestPath: string;\n    myFiles: BriefedFile[];       // ONLY this reviewer's matched files\n    matchedPatterns: string[];    // [] ⇒ patternless: the whole diff is in scope\n    sourceDirs: string[];         // deduped ABSOLUTE parent dirs of myFiles\n    contextEntries: ContextEntry[];\n    verdictPath: string;          // ABSOLUTE review-<id>.json\n    checklistId: string;\n    fileDiffCommand: string;\n    dirty: boolean;\n    // Facts ABOUT the manifest, surfaced inline so a reviewer learns the diff is complete without opening it.\n    changedFileCount: number;\n    truncatedCount: number;\n    excludedCount: number;\n    allDiffLines: number;\n    allDiffBytes: number;\n    // The three shas, by the names DiffManifest already uses. Printing two bare shas told a reviewer nothing\n    // about WHAT the diff is taken against; C beside A makes \"main has moved since the fork\" self-evident.\n    hashForkPoint: string;\n    hashFeatureHead: string;\n    hashMainHead: string;\n    ownAgentFileInDiff: string;   // ABSOLUTE path when this diff edits THIS reviewer's own agent file; '' otherwise\n    // From the checklist's config `required`. Carried so the stage-② report can group the spawn blocks\n    // (must run) apart from the ones the human is merely OFFERED, without a second lookup that could\n    // disagree with the scan. The reviewer's OWN instructions do not mention it: a reviewer that has been\n    // spawned reviews the same way either way, and telling an optional one it was optional invites it to\n    // grade itself softer.\n    required: boolean;\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(subagent: string, checklistId: string, repoRoot: string) {\n        this.subagent = subagent;\n        this.checklistId = checklistId;\n        this.repoRoot = repoRoot;\n        this.docPath = '';\n        this.diffDir = '';\n        this.allDiffPath = '';\n        this.manifestPath = '';\n        this.myFiles = [];\n        this.matchedPatterns = [];\n        this.sourceDirs = [];\n        this.contextEntries = [];\n        this.verdictPath = '';\n        this.fileDiffCommand = '';\n        this.dirty = false;\n        this.changedFileCount = 0;\n        this.truncatedCount = 0;\n        this.excludedCount = 0;\n        this.allDiffLines = 0;\n        this.allDiffBytes = 0;\n        this.hashForkPoint = '';\n        this.hashFeatureHead = '';\n        this.hashMainHead = '';\n        this.ownAgentFileInDiff = '';\n        // Fails CLOSED, like RequiredChecklist.required: a briefing built without the flag being copied is\n        // treated as a blocking reviewer, never as a skippable one.\n        this.required = true;\n    }\n}\n\n/**\n * The Read tool truncates at roughly this many lines, silently. Any path this file prints alongside a bigger\n * line count has to say so, or a reviewer reviews a fraction of a change and reports on all of it.\n */\nexport const READ_TRUNCATION_LINES = 2000;\n\n/** Comfortably under {@link READ_TRUNCATION_LINES} — the size at which ALL.diff really is one clean Read. */\nexport const ALL_DIFF_ONE_READ_LINES = 1500;\n\n/**\n * Renders the per-reviewer instructions file that `wp-review-upsert-pr` writes to\n * `.webpieces/pr-review/<feature>/instructions/<subagent>.instructions.md`.\n *\n * WHY this file exists, measured rather than assumed: a reviewer subagent on consumer-monorepo2 spent **14 of its\n * 26 tool calls** rediscovering context the tooling already had — three separate greps into\n * `node_modules/@webpieces` to locate a scanner, a hunt through terraform for queue names, and a\n * re-derivation of the dependency graph. It did not over-review; it was under-supplied. Everything below is\n * chosen to delete a specific one of those calls.\n *\n * It is GENERATED per run, and the registered `.claude/agents/<subagent>.md` is a thin stub that points\n * here, because content a human maintains goes stale and a reviewer follows the stale copy. The verdict\n * schema in particular comes from {@link ReviewJsonService.verdictSchemaFor}.\n *\n * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ReviewerInstructionsService {\n    constructor(private readonly reviewJsonService: ReviewJsonService) {}\n\n    /** The dir holding this branch's generated instructions, beside its review.json. */\n    instructionsDirFor(repoRoot: string, featureName: string): string {\n        return path.join(this.reviewJsonService.prDirFor(repoRoot, featureName), 'instructions');\n    }\n\n    /** The file name for a reviewer's generated instructions. */\n    fileNameFor(subagent: string): string {\n        return `${subagent}.instructions.md`;\n    }\n\n    /** Absolute path of one reviewer's generated instructions file. */\n    pathFor(repoRoot: string, featureName: string, subagent: string): string {\n        return path.join(this.instructionsDirFor(repoRoot, featureName), this.fileNameFor(subagent));\n    }\n\n    render(briefing: ReviewerBriefing): string {\n        return [\n            ...this.identity(briefing),\n            ...this.checklistSection(briefing),\n            ...this.diffSection(briefing),\n            ...this.sourceSection(briefing),\n            ...this.contextSection(briefing),\n            ...this.verdictSection(briefing),\n            ...this.budgetSection(),\n        ].join('\\n') + '\\n';\n    }\n\n    private identity(b: ReviewerBriefing): string[] {\n        return [\n            `# You are \\`${b.subagent}\\``,\n            '',\n            'Review as YOURSELF, against your own checklist — not as a general code reviewer.',\n            'You may not write another reviewer\\'s verdict file.',\n            '',\n            '\"You may not review your own authorship\" means: you did not write this diff, so review it — but if',\n            'the diff CHANGES YOU, say so in `output` rather than pretending the conflict is not there.',\n            ...this.selfEditWarning(b),\n            '',\n            '_Generated per run by `wp-review-upsert-pr`. Everything below is already resolved for you; the',\n            'paths are absolute because your working directory is not guaranteed to be the repo root._',\n            '',\n        ];\n    }\n\n    /**\n     * Every PR that edits the review gate hits this: on the measured run, 5 of 8 changed files were the\n     * reviewer agent files themselves, two reviewers reviewed their OWN definition, and neither flagged it —\n     * neither had any guidance to. Detected by the tooling rather than left to the reviewer to notice.\n     */\n    private selfEditWarning(b: ReviewerBriefing): string[] {\n        if (b.ownAgentFileInDiff === '') return [];\n        return [\n            '',\n            `⚠️  THIS DIFF MODIFIES YOUR OWN AGENT FILE: \\`${b.ownAgentFileInDiff}\\``,\n            'You are reviewing a change to your own definition. Review it anyway — and state that fact in',\n            '`output`, so a human reading your verdict knows the reviewer and the reviewed were the same thing.',\n        ];\n    }\n\n    private checklistSection(b: ReviewerBriefing): string[] {\n        if (b.docPath === '') {\n            return ['## Your checklist', '', 'This checklist has no guidance doc — judge the diff on your own standards.', ''];\n        }\n        return ['## Your checklist', '', `Read this FIRST: \\`${b.docPath}\\``, ''];\n    }\n\n    /**\n     * The change itself. The MANIFEST leads, and the per-file table with it; `ALL.diff` is demoted to one\n     * option among several, recommended only where it is actually the right read.\n     *\n     * That ordering is the fix for a measured 4/4 failure. `ALL.diff` used to be bolded, first, and framed as\n     * \"everything\", with the manifest one unbolded line below it called a \"path map\" — which reads like a\n     * lookup aid, not something to open. All four reviewers on that PR read `ALL.diff`, none opened the\n     * manifest, and none could therefore have established that the combined view was complete. Reviewers did\n     * exactly what the emphasis told them to; so the emphasis moved.\n     */\n    private diffSection(b: ReviewerBriefing): string[] {\n        const lines = ['## The change you are reviewing', ''];\n        if (b.dirty) {\n            lines.push('> ⚠️ This diff INCLUDES uncommitted and untracked work, so it is not what a');\n            lines.push('> commit-to-commit range would show. Judge it anyway — it is what your checklist matched.');\n            lines.push('');\n        }\n        lines.push(...this.manifestLines(b), ...this.basisLines(b), ...this.myFilesTable(b), ...this.allDiffLines(b));\n        if (b.fileDiffCommand !== '') {\n            lines.push(`Reproduce any single file: \\`${b.fileDiffCommand}\\``);\n            lines.push('');\n        }\n        lines.push('Path matching is COARSE. Judge the change, not the path — if a matched file turns out to be');\n        lines.push('irrelevant to your checklist, say so in one sentence and move on.');\n        lines.push('');\n        return lines;\n    }\n\n    /**\n     * The manifest, named as the authority AND with its own headline facts inlined. Inlining them is the\n     * point: a reviewer that never opens the manifest still learns whether anything was truncated or\n     * excluded, which is the one thing it could not otherwise have known it was missing.\n     */\n    private manifestLines(b: ReviewerBriefing): string[] {\n        if (b.manifestPath === '') return [];\n        const warn = b.truncatedCount + b.excludedCount > 0 ? '  ⚠️ NOT everything is materialized — see the table.' : '';\n        return [\n            `**Path map — AUTHORITATIVE. Read this first:** \\`${b.manifestPath}\\``,\n            `  ${b.changedFileCount} file(s) · ${b.truncatedCount} truncated · ${b.excludedCount} excluded${warn}`,\n            '  Per file it carries: `status` (M/A/D/U/X), `bytes`, `file`/`fileAbs`, `diffFile`/`diffAbs`, and the',\n            '  three shas below. It is the only place that records what was truncated or left out.',\n            '',\n        ];\n    }\n\n    /**\n     * What the diff is taken AGAINST. Two bare shas in a `git diff` command said nothing about this, so a\n     * reviewer could not tell a fork-point diff from a diff against main's current tip — and therefore could\n     * not tell that anything merged to main since the fork is simply absent from what it is judging.\n     * Rendering C beside A makes \"main has moved\" self-evident exactly when it has.\n     */\n    private basisLines(b: ReviewerBriefing): string[] {\n        if (b.hashForkPoint === '') return [];\n        const sameAsFork = b.hashMainHead === b.hashForkPoint;\n        const cNote = b.hashMainHead === '' ? '(unresolved)'\n            : sameAsFork ? `${b.hashMainHead}   ← same as A, so main has not moved since the fork`\n            : `${b.hashMainHead}   ← main HAS MOVED since the fork`;\n        return [\n            'This diff is **fork-point → feature-head**, NOT a diff against main\\'s current tip:',\n            '```',\n            `fork point   (A)  ${b.hashForkPoint}`,\n            `feature head (B)  ${b.hashFeatureHead}`,\n            `main head    (C)  ${cNote}`,\n            '```',\n            'Anything merged to main after A is NOT in this diff.',\n            '',\n        ];\n    }\n\n    /**\n     * Source and diff get IDENTICAL affordance — an absolute path each, in adjacent columns. The previous\n     * table gave an absolute path for the diff and nothing for the source, and the source went unread 4/4.\n     */\n    private myFilesTable(b: ReviewerBriefing): string[] {\n        if (b.myFiles.length === 0) return ['_No files matched your patterns._', ''];\n        const why = b.matchedPatterns.length === 0\n            ? `**In scope: ALL ${b.myFiles.length} changed file(s)** — your checklist has no \\`patterns\\`, so the whole diff is yours.`\n            : `**In scope: ${b.myFiles.length} file(s)** matching ${b.matchedPatterns.map((p: string): string => `\\`${p}\\``).join(', ')}:`;\n        const rows = b.myFiles.map((f: BriefedFile): string => this.fileRow(f));\n        return [why, '', '| file | status | its diff | full source |', '|---|---|---|---|', ...rows, ''];\n    }\n\n    /**\n     * One row. A truncated or excluded diff is flagged HERE, in the row, not left as a field inside a file the\n     * reviewer has to think to open — and an oversized diff states the line count that makes a single Read\n     * come back silently incomplete.\n     */\n    private fileRow(f: BriefedFile): string {\n        const flags: string[] = [];\n        if (f.truncated) flags.push('⚠️ diff TRUNCATED — read the source');\n        if (f.status === 'X') flags.push('⚠️ EXCLUDED, not materialized — read the source');\n        const status = [`\\`${f.status}\\``, ...flags].join(' ');\n        const source = f.sourcePath === '' ? '_deleted — no file on disk_' : `\\`${f.sourcePath}\\``;\n        return `| \\`${f.file}\\` | ${status} | \\`${f.diffPath}\\` (${f.diffBytes} bytes) | ${source} |`;\n    }\n\n    /**\n     * `ALL.diff`, recommended ONLY where it is the right read. It is kept — for a patternless reviewer on a\n     * small diff it is genuinely one Read instead of N, which is why all four used it — but the blanket\n     * \"everything on this branch\" line was wrong in two different ways at once: it invited a pattern-scoped\n     * reviewer to spend its budget on files it was explicitly not asked about, and it pointed a reviewer on a\n     * large PR at a file that cannot survive one Read.\n     */\n    private allDiffLines(b: ReviewerBriefing): string[] {\n        if (b.allDiffPath === '') return [];\n        const size = b.allDiffLines === 0 ? '' : ` — ${b.allDiffLines} lines / ${b.allDiffBytes} bytes`;\n        if (b.matchedPatterns.length > 0) {\n            return [`The whole branch${size}, for CROSS-FILE CONTEXT if you need it: \\`${b.allDiffPath}\\``,\n                'Your own files above are what you are reviewing; the rest of the branch is someone else\\'s checklist.', ''];\n        }\n        if (b.allDiffLines > ALL_DIFF_ONE_READ_LINES) {\n            return [`⚠️ The combined diff is ${b.allDiffLines} lines and will NOT survive a single Read (the Read tool`,\n                `truncates at ~${READ_TRUNCATION_LINES} lines, silently). Read the per-file diffs above instead, or page it:`,\n                `\\`${b.allDiffPath}\\``, ''];\n        }\n        return [`Whole-branch diff${size} — convenient at this size, but the per-file table above is authoritative:`,\n            `\\`${b.allDiffPath}\\``, ''];\n    }\n\n    /**\n     * The rule that used to say \"when you need to\", and lost 4/4 to the more emphatic budget section 40 lines\n     * later. \"When you need to\" delegates the judgment to a reviewer that, by construction, does not yet know\n     * what it is missing. It has no opt-out now.\n     */\n    private sourceSection(b: ReviewerBriefing): string[] {\n        const lines = ['## Read the full source — every file, every time', '', `Repo root: \\`${b.repoRoot}\\``, ''];\n        lines.push('**READ THE FULL SOURCE OF EVERY FILE IN YOUR TABLE.** Not \"if you need to\" — every time.');\n        lines.push('A hunk shows what changed; only the whole file shows what it changed INTO, and a change that');\n        lines.push('looks fine in isolation can still be wrong in place.');\n        lines.push('');\n        lines.push('The `full source` column above is the path. For files marked `A` (added) you have already done');\n        lines.push('this: an add-diff IS the complete file, byte for byte, so its diff and its source are the same');\n        lines.push('text. For `M` (modified) and `D` (deleted) files the diff is a fragment — open the file.');\n        lines.push('');\n        if (b.sourceDirs.length > 0) {\n            lines.push('The neighbouring code lives under:');\n            for (const dir of b.sourceDirs) lines.push(`- \\`${dir}\\``);\n            lines.push('');\n        }\n        return lines;\n    }\n\n    /**\n     * The section that deletes the `node_modules` greps. Entries come from config, because the tooling\n     * cannot guess that a repo keeps its queue names in terraform — but it CAN resolve where a package\n     * installed to, and it must never drop an entry silently: a missing path is stated as missing.\n     */\n    private contextSection(b: ReviewerBriefing): string[] {\n        // Emitting NOTHING made the section this class exists for look like a feature that does not exist.\n        // One line naming the config keys costs nothing and is the only hint a repo will ever get.\n        if (b.contextEntries.length === 0) {\n            return ['## Pre-resolved context', '',\n                '_None configured for this repo. If you find yourself hunting for the same path on every review,',\n                'it belongs in `pr-gate.reviewContext` / `pr-gate.reviewContextPackages` in `webpieces.config.json`._',\n                ''];\n        }\n        const lines = ['## Pre-resolved context (do not go hunting for these)', ''];\n        for (const entry of b.contextEntries) {\n            const suffix = entry.note === '' ? '' : `  ${entry.note}`;\n            lines.push(`- **${entry.label}** — \\`${entry.path === '' ? entry.note : entry.path}\\`${entry.path === '' ? '' : suffix}`);\n        }\n        lines.push('');\n        return lines;\n    }\n\n    /**\n     * The verdict shape, GENERATED — never restated in a hand-maintained file. `id` is pre-filled with this\n     * reviewer's own checklist id so there is nothing to substitute and nothing to get wrong.\n     */\n    private verdictSection(b: ReviewerBriefing): string[] {\n        return [\n            '## Write your verdict',\n            '',\n            `Write EXACTLY this shape, to EXACTLY this file: \\`${b.verdictPath}\\``,\n            '',\n            '```',\n            this.reviewJsonService.verdictSchemaFor(b.checklistId, '', ''),\n            '```',\n            '',\n        ];\n    }\n\n    /**\n     * The anti-hunting rule, with the changed files carved out explicitly.\n     *\n     * It used to read as \"stay inside what you were given\" and, being the LAST thing in the file, it beat\n     * the source-reading instruction 4 times out of 4. It never distinguished HUNTING — greps into\n     * `node_modules`, re-deriving the dependency graph — from OPENING A FILE IT WAS EXPLICITLY HANDED. The\n     * distinction is now stated, because where two instructions conflict the later and more emphatic one wins.\n     */\n    private budgetSection(): string[] {\n        return [\n            '## Budget',\n            '',\n            'Do NOT search `node_modules`, do NOT re-derive the dependency graph, and do NOT hunt the repo for',\n            'infrastructure config. That is hunting, and it is what wastes a review budget — those paths are',\n            'either given above or were not configured.',\n            '',\n            'Reading the full text of a file that is IN your table is NOT hunting — it is the review. Budget for',\n            'it: read the diff to see what changed, and the source to judge whether it is right in place.',\n            '',\n            'If something you genuinely need is missing, name it in `output` and give your verdict on what you',\n            'could actually see.',\n            '',\n            'Open your diff files before writing a verdict. `wp-finish-upsert-pr` reads your own transcript and',\n            'reports a verdict written without opening the diff. It also records the path of that transcript,',\n            'beside what you were offered and what you read, in `provenance.json` next to your verdict file —',\n            'so the review is auditable after the fact. You do not write that file; the tooling does.',\n        ];\n    }\n}\n"]}

package/src/rule-configs.d.ts

@@ -177,22 +177,6 @@ export declare class RedirectHowToMergeMainConfig extends BaseRuleConfig {
     mode?: OnOffMode;
     static readonly SCHEMA: SchemaShape<RedirectHowToMergeMainConfig>;
 }
-/**
- * Blocks a Bash command that would build the WHOLE monorepo (`pnpm run build-all`, an unnarrowed
- * `nx run-many`, `nx affected` with no `--base`, a bare `vitest run`), and names the affected-scoped
- * command to run instead.
- *
- * `affectedBuildCommand` is NOT a knob to set — it is how the ONE command reaches this guard. A rule
- * only ever sees its own config entry, so load-config injects `commands.pr-gate.buildCommand` here
- * (exactly as it injects `upsertPrCommand` into pr-creation-or-push-guard and `mergeCompleteCommand`
- * into merge-in-progress-guard), and the refusal then quotes whatever THIS repo's gate actually runs.
- * Leave it out; setting it by hand is how a refusal starts naming a command the gate does not run.
- */
-export declare class WholeRepoBuildGuardConfig extends BaseRuleConfig {
-    mode?: OnOffMode;
-    affectedBuildCommand?: string;
-    static readonly SCHEMA: SchemaShape<WholeRepoBuildGuardConfig>;
-}
 export declare class NoFileImportCyclesConfig extends BaseRuleConfig {
     mode?: StructuralMode;
     ignoreTypeOnly?: boolean;

package/src/rule-configs.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ValidateNoArchitectureCyclesConfig = exports.ValidateArchitectureUnchangedConfig = exports.NoJsFilesConfig = exports.MissingDesignAnnotationConfig = exports.DiGraphConfig = exports.NxWiringConfig = exports.RuntimeArchitectureConfig = exports.NoFileImportCyclesConfig = exports.WholeRepoBuildGuardConfig = exports.RedirectHowToMergeMainConfig = exports.PrMergeGuardConfig = exports.MergeInProgressGuardConfig = exports.PrCreationOrPushGuardConfig = exports.BranchCreationGuardConfig = exports.RoleTagConfig = exports.FrameworkTagConfig = exports.InjectAnnotationNotNeededForConcreteClassConfig = exports.NoFunctionOutsideClassConfig = exports.NoProcessExitOutsideMainConfig = exports.NoSymbolDiTokensConfig = exports.NoCustomCssConfig = exports.AngularNoDirectApiInResolverConfig = exports.ThrowCauseRequiredConfig = exports.CatchErrorPatternConfig = exports.NoUnmanagedExceptionsConfig = exports.NoDestructureConfig = exports.PrismaConverterConfig = exports.PrismaValidateDtosConfig = exports.NoImplicitAnyConfig = exports.NoAnyUnknownConfig = exports.NoInlineTypeLiteralsConfig = exports.RequireReturnTypeConfig = exports.MaxFileLinesConfig = exports.MaxMethodLinesConfig = exports.BASE_RULE_SCHEMA = exports.BaseRuleConfig = exports.STRUCTURAL_MODES = exports.VALIDATE_TS_MODES = exports.BRANCH_GUARD_MODES = exports.ON_OFF_MODES = exports.THROW_CAUSE_MODES = exports.DIRECT_API_RESOLVER_MODES = exports.PRISMA_CONVERTER_MODES = exports.PRISMA_DTOS_MODES = exports.PROJECT_MODES = exports.MODIFIED_CODE_MODES = exports.INLINE_TYPE_MODES = exports.RETURN_TYPE_MODES = exports.FILE_LIMIT_MODES = exports.METHOD_LIMIT_MODES = void 0;
-exports.ValidateTsInSrcConfig = exports.ValidateEslintSyncConfig = exports.ValidateVersionsLockedConfig = exports.ValidatePackageJsonConfig = void 0;
+exports.ValidatePackageJsonConfig = exports.ValidateNoArchitectureCyclesConfig = exports.ValidateArchitectureUnchangedConfig = exports.NoJsFilesConfig = exports.MissingDesignAnnotationConfig = exports.DiGraphConfig = exports.NxWiringConfig = exports.RuntimeArchitectureConfig = exports.NoFileImportCyclesConfig = exports.RedirectHowToMergeMainConfig = exports.PrMergeGuardConfig = exports.MergeInProgressGuardConfig = exports.PrCreationOrPushGuardConfig = exports.BranchCreationGuardConfig = exports.RoleTagConfig = exports.FrameworkTagConfig = exports.InjectAnnotationNotNeededForConcreteClassConfig = exports.NoFunctionOutsideClassConfig = exports.NoProcessExitOutsideMainConfig = exports.NoSymbolDiTokensConfig = exports.NoCustomCssConfig = exports.AngularNoDirectApiInResolverConfig = exports.ThrowCauseRequiredConfig = exports.CatchErrorPatternConfig = exports.NoUnmanagedExceptionsConfig = exports.NoDestructureConfig = exports.PrismaConverterConfig = exports.PrismaValidateDtosConfig = exports.NoImplicitAnyConfig = exports.NoAnyUnknownConfig = exports.NoInlineTypeLiteralsConfig = exports.RequireReturnTypeConfig = exports.MaxFileLinesConfig = exports.MaxMethodLinesConfig = exports.BASE_RULE_SCHEMA = exports.BaseRuleConfig = exports.STRUCTURAL_MODES = exports.VALIDATE_TS_MODES = exports.BRANCH_GUARD_MODES = exports.ON_OFF_MODES = exports.THROW_CAUSE_MODES = exports.DIRECT_API_RESOLVER_MODES = exports.PRISMA_CONVERTER_MODES = exports.PRISMA_DTOS_MODES = exports.PROJECT_MODES = exports.MODIFIED_CODE_MODES = exports.INLINE_TYPE_MODES = exports.RETURN_TYPE_MODES = exports.FILE_LIMIT_MODES = exports.METHOD_LIMIT_MODES = void 0;
+exports.ValidateTsInSrcConfig = exports.ValidateEslintSyncConfig = exports.ValidateVersionsLockedConfig = void 0;
 const field_def_1 = require("./field-def");
 // Mode const arrays — TypeScript union types derived from them, and FieldDef enum
 // values reference the same array. Impossible for the type and runtime check to diverge.
@@ -395,26 +395,11 @@ class RedirectHowToMergeMainConfig extends BaseRuleConfig {
     };
 }
 exports.RedirectHowToMergeMainConfig = RedirectHowToMergeMainConfig;
-/**
- * Blocks a Bash command that would build the WHOLE monorepo (`pnpm run build-all`, an unnarrowed
- * `nx run-many`, `nx affected` with no `--base`, a bare `vitest run`), and names the affected-scoped
- * command to run instead.
- *
- * `affectedBuildCommand` is NOT a knob to set — it is how the ONE command reaches this guard. A rule
- * only ever sees its own config entry, so load-config injects `commands.pr-gate.buildCommand` here
- * (exactly as it injects `upsertPrCommand` into pr-creation-or-push-guard and `mergeCompleteCommand`
- * into merge-in-progress-guard), and the refusal then quotes whatever THIS repo's gate actually runs.
- * Leave it out; setting it by hand is how a refusal starts naming a command the gate does not run.
- */
-class WholeRepoBuildGuardConfig extends BaseRuleConfig {
-    affectedBuildCommand;
-    static SCHEMA = {
-        mode: new field_def_1.FieldDef('string', exports.ON_OFF_MODES),
-        affectedBuildCommand: field_def_1.FieldDef.optional('string'),
-        ...exports.BASE_RULE_SCHEMA,
-    };
-}
-exports.WholeRepoBuildGuardConfig = WholeRepoBuildGuardConfig;
+// NOTE: there is deliberately no `WholeRepoBuildGuardConfig`. That guard is EXPERIMENTAL and has NO
+// webpieces.config.json entry — its only switch is `experimental.whole-repo-build-guard` in the optional
+// machine-local ~/.webpieces/config.json (see home-config.ts), and the affected-build command it prints
+// is handed to it directly from `commands.pr-gate.buildCommand` by ai-hook-rules' runner. Re-adding a
+// config class here puts the guard back in RULE_SCHEMAS and makes it a fault-Y rule again.
 class NoFileImportCyclesConfig extends BaseRuleConfig {
     ignoreTypeOnly;
     excludePackages;