@webpieces/rules-config 0.4.653 → 0.4.655

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/rules-config",
-  "version": "0.4.653",
+  "version": "0.4.655",
   "description": "Shared webpieces.config.json loader. Single source of truth for validation rule configuration consumed by @webpieces/ai-hook-rules, @webpieces/code-rules, and @webpieces/nx-webpieces-rules.",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/index.d.ts

@@ -8,6 +8,7 @@ export { toError } from './to-error';
 export { loadAndValidate, LoadedConfig, ConfigLoader } from './load-config';
 export { formatConfigErrorsBanner, CONFIG_POLICY_DOC, RETIRED_KEY_MARKER, RETIRED_TOP_LEVEL_MARKER, SECTION_PLACEMENT_MARKER, } from './config-error-banner';
 export { findConfigFile, CONFIG_FILENAME, ConfigFile, ConfigParseAttempt, CONFIG_PARSE_ATTEMPTS, CONFIG_PARSE_RETRY_MILLIS } from './config-file';
+export type { RawConfigFile } from './config-file';
 export { RepoRootFinder, INSTRUCT_AI_DIR, INSTRUCT_AI_LEAF } from './repo-root';
 export { DotWebpieces, dotWebpieces, GitDirs, WORKTREE_STATE_DIR, LOGS_STATE_DIR } from './state-dir';
 export { StateDirMigrator, StateMigrationReport } from './state-dir-migration';
@@ -35,7 +36,7 @@ export { HOOK_GUARD_NAMES, BRANCH_STATE_GUARD_KEY, PR_LIFECYCLE_GUARD_KEY, isHoo
 export { FieldDef } from './field-def';
 export type { SchemaShape } from './field-def';
 export { shouldSkipRule, getCurrentBranch } from './skip-rule';
-export type { SkipRuleResult } from './skip-rule';
+export { SkipRuleResult } from './skip-rule';
 export { detectBase, resolveBase, getChangedFiles, getFileDiff, getChangedLineNumbers, findNewMethodSignaturesInDiff, hasChangesInRange, isNewOrModified, DiffScope, DiffRange, ChangedFilesOptions, } from './diff-scope';
 export { AbstractRule } from './abstract-rule';
 export { WEBPIECES_DISABLE, RULE_NAMES, hasDisable, WEBPIECES_TMP_DIR, MERGE_INFO_DIR, PR_REVIEW_DIR, MERGE_IN_PROGRESS_FILE, MERGE_EXPLANATION_FILE, PUSH_DEV_STATE_FILE, PRUNE_UNKNOWN_COMMAND, } from './constants';

package/src/index.js

@@ -2,11 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ExcludePaths = exports.DESIGN_METADATA_KEYS = exports.isDocumentDesign = exports.DocumentDesign = exports.RulesConfigDesign = exports.atRoot = exports.AtomicFile = exports.CLAUDE_PROJECT_DIR_UNSET = exports.CLAUDE_PROJECT_DIR_ENV = exports.claudeEnv = exports.ClaudeEnv = exports.RETENTION_DAYS = exports.SweepCount = exports.AgedTreeSweeper = exports.StateMigrationReport = exports.StateDirMigrator = exports.LOGS_STATE_DIR = exports.WORKTREE_STATE_DIR = exports.GitDirs = exports.dotWebpieces = exports.DotWebpieces = exports.INSTRUCT_AI_LEAF = exports.INSTRUCT_AI_DIR = exports.RepoRootFinder = exports.CONFIG_PARSE_RETRY_MILLIS = exports.CONFIG_PARSE_ATTEMPTS = exports.ConfigParseAttempt = exports.ConfigFile = exports.CONFIG_FILENAME = exports.findConfigFile = exports.SECTION_PLACEMENT_MARKER = exports.RETIRED_TOP_LEVEL_MARKER = exports.RETIRED_KEY_MARKER = exports.CONFIG_POLICY_DOC = exports.formatConfigErrorsBanner = exports.ConfigLoader = exports.LoadedConfig = exports.loadAndValidate = exports.toError = exports.runMain = exports.CliArgs = exports.CliArgsCheck = exports.CliArgSet = exports.CliFlag = exports.CliUsage = exports.CliExitError = exports.RuleFailError = exports.InformAiError = exports.ResolvedRuleConfig = exports.ResolvedConfig = void 0;
 exports.renderMatchRuleMessage = exports.compileMatchRulePatterns = exports.isMatchRuleAllowedPath = exports.findMatchRuleViolations = exports.MatchRuleViolation = exports.MatchRuleConfig = exports.HOME_KEY_BUILD_GATE_LOG_CAPTURE = exports.HOME_EXPERIMENTAL_SECTION = exports.HOME_CONFIG_FILE = exports.HOME_CONFIG_DIR = exports.RETIRED_HOME_CONFIG_KEYS = exports.RetiredHomeConfigKey = exports.HomeConfigService = exports.HomeConfig = exports.validateChecklistDocs = exports.PrunedKey = exports.PruneResult = exports.ConfigPruner = exports.retiredRuleFor = exports.retiredKeyErrorsIn = exports.retiredKeyError = exports.retiredEntry = exports.isRetiredKey = exports.RetiredConfigKey = exports.RETIRED_SCOPE_RULE = exports.RETIRED_SCOPE_KEY = exports.RETIRED_CONFIG_KEYS = exports.COMMENT_KEY_SUFFIX = exports.validateTopLevelKeys = exports.isCommentKey = exports.unknownKeyErrors = exports.validateCommandsSection = exports.seedEntryForRule = exports.recommendedSeedModeFor = exports.recommendedSeedMode = exports.allRuleNames = exports.validateMatchRulesSection = exports.validateExcludePaths = exports.validateSectionPlacement = exports.validateChecklistsSection = exports.validatePrGateSection = exports.validateWebpiecesConfig = exports.TemplateWriter = exports.writeTemplate = exports.writeTemplateIfMissing = exports.loadTemplate = exports.defaultRulesDir = exports.defaultRules = exports.matchesAnyGlob = exports.isPathExcluded = void 0;
-exports.NoUnmanagedExceptionsConfig = exports.NoDestructureConfig = exports.PrismaConverterConfig = exports.PrismaValidateDtosConfig = exports.NoImplicitAnyConfig = exports.NoAnyUnknownConfig = exports.NoInlineTypeLiteralsConfig = exports.RequireReturnTypeConfig = exports.MaxFileLinesConfig = exports.MaxMethodLinesConfig = exports.WP_FINISH_PUSH_DEV = exports.WP_PUSH_DEV = exports.WP_FINISH_UPSERT_PR = exports.WP_START_UPSERT_PR = exports.WP_FINISH_UPDATE = exports.WP_START_UPDATE = exports.SyncFlowGuidance = exports.WebpiecesRulesConfig = exports.PRUNE_UNKNOWN_COMMAND = exports.PUSH_DEV_STATE_FILE = exports.MERGE_EXPLANATION_FILE = exports.MERGE_IN_PROGRESS_FILE = exports.PR_REVIEW_DIR = exports.MERGE_INFO_DIR = exports.WEBPIECES_TMP_DIR = exports.hasDisable = exports.RULE_NAMES = exports.WEBPIECES_DISABLE = exports.AbstractRule = exports.ChangedFilesOptions = exports.DiffRange = exports.DiffScope = exports.isNewOrModified = exports.hasChangesInRange = exports.findNewMethodSignaturesInDiff = exports.getChangedLineNumbers = exports.getFileDiff = exports.getChangedFiles = exports.resolveBase = exports.detectBase = exports.getCurrentBranch = exports.shouldSkipRule = exports.FieldDef = exports.sectionForRule = exports.isHookGuard = exports.PR_LIFECYCLE_GUARD_KEY = exports.BRANCH_STATE_GUARD_KEY = exports.HOOK_GUARD_NAMES = exports.schemaFieldNames = exports.DEFAULT_MATCH_RULES = void 0;
-exports.defaultPrGateConfig = exports.defaultGates = exports.ReviewContextEntry = exports.DEFAULT_DEV_BRANCH = exports.DEFAULT_DEV_BRANCH_NAMESPACE = exports.DevDeployConfig = exports.LandPrConfig = exports.DEFAULT_BUILD_COMMAND = exports.PrGateConfig = exports.GateDefinition = exports.BranchStateGuardConfig = exports.CLIENT_CREATION_SEVERITIES = exports.NoClientCreationOutsideServerOrClientConfig = exports.VALIDATE_TS_MODES = exports.STRUCTURAL_MODES = exports.ON_OFF_MODES = exports.THROW_CAUSE_MODES = exports.DIRECT_API_RESOLVER_MODES = exports.PRISMA_CONVERTER_MODES = exports.PRISMA_DTOS_MODES = exports.PROJECT_MODES = exports.MODIFIED_CODE_MODES = exports.INLINE_TYPE_MODES = exports.RETURN_TYPE_MODES = exports.FILE_LIMIT_MODES = exports.METHOD_LIMIT_MODES = exports.BaseRuleConfig = exports.ValidateEslintSyncConfig = exports.ValidateVersionsLockedConfig = exports.ValidatePackageJsonConfig = exports.ValidateNoArchitectureCyclesConfig = exports.ValidateArchitectureUnchangedConfig = exports.ValidateTsInSrcConfig = exports.NoJsFilesConfig = exports.DiGraphConfig = exports.NxWiringConfig = exports.RuntimeArchitectureConfig = exports.NoFileImportCyclesConfig = exports.PrLifecycleGuardConfig = exports.BranchCreationGuardConfig = exports.RoleTagConfig = exports.FrameworkTagConfig = exports.InjectAnnotationNotNeededForConcreteClassConfig = exports.NoFunctionOutsideClassConfig = exports.NoProcessExitOutsideMainConfig = exports.NoCustomCssConfig = exports.NoSymbolDiTokensConfig = exports.AngularNoDirectApiInResolverConfig = exports.ThrowCauseRequiredConfig = exports.CatchErrorPatternConfig = void 0;
-exports.CK_BAD_FORMAT = exports.CK_MISSING = exports.CK_FAIL = exports.CK_OVERRIDDEN = exports.CK_WARN = exports.CK_PASS = exports.ChecklistVerdict = exports.ChecklistResult = exports.PrContext = exports.ReviewJson = exports.DEFAULT_RETENTION_DAYS = exports.ProvenanceWriteRequest = exports.OfferedContext = exports.ReviewerPaths = exports.ReviewerTranscript = exports.ReviewProvenance = exports.ReviewProvenanceService = exports.PROVENANCE_SKIPPED = exports.PROVENANCE_MISSING = exports.PROVENANCE_OK = exports.ProvenanceResult = exports.TranscriptScan = exports.ReviewerContext = exports.ReviewerEvidence = exports.SubagentProvenanceService = exports.verifyGateToken = exports.extractGateToken = exports.gateTokenMarker = exports.computeGateToken = exports.GateTokenService = exports.ALL_DIFF_ONE_READ_LINES = exports.READ_TRUNCATION_LINES = exports.ContextEntry = exports.BriefedFile = exports.ReviewerBriefing = exports.ReviewerInstructionsService = exports.ChecklistInstructionsService = exports.ChecklistValidator = exports.formatFileList = exports.normalizeChecklistDoc = exports.toChecklist = exports.ChecklistDefinition = exports.MERGE_MODES = exports.MERGE_MODE_NONE = exports.MERGE_MODE_AUTO = exports.buildDevDeployConfig = exports.buildLandPrConfig = exports.buildPrGateConfig = exports.defaultDevDeployConfig = exports.defaultLandPrConfig = void 0;
-exports.CLASSIFICATION_NEVER_PROPOSED = exports.CLASSIFICATION_CONTENT_IN_MAIN = exports.CLASSIFICATION_SUPERSEDED = exports.CLASSIFICATION_NO_COMMITS = exports.CLASSIFICATION_BACKUP_OF_LIVE = exports.CLASSIFICATION_BACKUP_OF_MERGED = exports.CLASSIFICATION_MERGED_PR = exports.CACHE_STALE_AFTER_MS = exports.CacheFreshness = exports.MergedBranchesService = exports.MergedBranchesCache = exports.DeletableWorktree = exports.DeletableBranch = exports.MergedBranch = exports.squashRecoverySteps = exports.stampCleanMainSyncStatus = exports.computeMainSyncStatus = exports.finishedLock = exports.inProcessLock = exports.tryAcquireMainSyncLock = exports.isRefreshInProgress = exports.isLockStale = exports.writeMainSyncLock = exports.readMainSyncLock = exports.computeAllMainSyncStatuses = exports.writeMainSyncStatusFile = exports.writeMainSyncStatus = exports.readMainSyncStatusFile = exports.readMainSyncStatus = exports.mainSyncLockPath = exports.mainSyncStatusPath = exports.DEFAULT_HANG_TIMEOUT_MINUTES = exports.MainSyncStatusService = exports.MainSyncLock = exports.MAIN_SYNC_STATUS_VERSION = exports.PullRequestIndex = exports.MainSyncFileStore = exports.MainSyncStatusFile = exports.MainSyncStatus = exports.reviewJsonSchemaHint = exports.reviewJsonPath = exports.prDirFor = exports.loadReviewJson = exports.ReviewJsonService = exports.ChecklistReviewContext = exports.RequiredChecklist = exports.VERDICT_STATUSES = exports.VERDICT_RED = exports.VERDICT_YELLOW = exports.VERDICT_GREEN = void 0;
-exports.DEFAULT_MERGE_COMPLETE_COMMAND = exports.DEFAULT_UPSERT_PR_COMMAND = exports.buildCommandsConfig = exports.CommandsConfig = exports.logBranchMutation = exports.branchMutationLogPath = exports.BranchMutationLog = exports.BranchMutationEvent = exports.WorktreeReaper = exports.WorktreeReapResult = exports.ReapedWorktree = exports.BranchReaper = exports.ReapResult = exports.ReapedBranch = exports.WorktreeService = exports.Worktree = exports.BRANCH_RETENTION_KEEP = exports.BRANCH_RETENTION_ARCHIVE_TAG = exports.BRANCH_RETENTION_DELETE = exports.BRANCH_RETENTIONS = exports.ARCHIVE_TAG_PREFIX = exports.ArchiveResult = exports.BranchArchiver = exports.PROMPTABLE_CLASSIFICATIONS = exports.CLASSIFICATION_DETACHED = exports.CLASSIFICATION_CURRENT = exports.CLASSIFICATION_LOCKED = exports.CLASSIFICATION_PRUNABLE = exports.CLASSIFICATION_IN_USE = void 0;
+exports.NoDestructureConfig = exports.PrismaConverterConfig = exports.PrismaValidateDtosConfig = exports.NoImplicitAnyConfig = exports.NoAnyUnknownConfig = exports.NoInlineTypeLiteralsConfig = exports.RequireReturnTypeConfig = exports.MaxFileLinesConfig = exports.MaxMethodLinesConfig = exports.WP_FINISH_PUSH_DEV = exports.WP_PUSH_DEV = exports.WP_FINISH_UPSERT_PR = exports.WP_START_UPSERT_PR = exports.WP_FINISH_UPDATE = exports.WP_START_UPDATE = exports.SyncFlowGuidance = exports.WebpiecesRulesConfig = exports.PRUNE_UNKNOWN_COMMAND = exports.PUSH_DEV_STATE_FILE = exports.MERGE_EXPLANATION_FILE = exports.MERGE_IN_PROGRESS_FILE = exports.PR_REVIEW_DIR = exports.MERGE_INFO_DIR = exports.WEBPIECES_TMP_DIR = exports.hasDisable = exports.RULE_NAMES = exports.WEBPIECES_DISABLE = exports.AbstractRule = exports.ChangedFilesOptions = exports.DiffRange = exports.DiffScope = exports.isNewOrModified = exports.hasChangesInRange = exports.findNewMethodSignaturesInDiff = exports.getChangedLineNumbers = exports.getFileDiff = exports.getChangedFiles = exports.resolveBase = exports.detectBase = exports.SkipRuleResult = exports.getCurrentBranch = exports.shouldSkipRule = exports.FieldDef = exports.sectionForRule = exports.isHookGuard = exports.PR_LIFECYCLE_GUARD_KEY = exports.BRANCH_STATE_GUARD_KEY = exports.HOOK_GUARD_NAMES = exports.schemaFieldNames = exports.DEFAULT_MATCH_RULES = void 0;
+exports.defaultGates = exports.ReviewContextEntry = exports.DEFAULT_DEV_BRANCH = exports.DEFAULT_DEV_BRANCH_NAMESPACE = exports.DevDeployConfig = exports.LandPrConfig = exports.DEFAULT_BUILD_COMMAND = exports.PrGateConfig = exports.GateDefinition = exports.BranchStateGuardConfig = exports.CLIENT_CREATION_SEVERITIES = exports.NoClientCreationOutsideServerOrClientConfig = exports.VALIDATE_TS_MODES = exports.STRUCTURAL_MODES = exports.ON_OFF_MODES = exports.THROW_CAUSE_MODES = exports.DIRECT_API_RESOLVER_MODES = exports.PRISMA_CONVERTER_MODES = exports.PRISMA_DTOS_MODES = exports.PROJECT_MODES = exports.MODIFIED_CODE_MODES = exports.INLINE_TYPE_MODES = exports.RETURN_TYPE_MODES = exports.FILE_LIMIT_MODES = exports.METHOD_LIMIT_MODES = exports.BaseRuleConfig = exports.ValidateEslintSyncConfig = exports.ValidateVersionsLockedConfig = exports.ValidatePackageJsonConfig = exports.ValidateNoArchitectureCyclesConfig = exports.ValidateArchitectureUnchangedConfig = exports.ValidateTsInSrcConfig = exports.NoJsFilesConfig = exports.DiGraphConfig = exports.NxWiringConfig = exports.RuntimeArchitectureConfig = exports.NoFileImportCyclesConfig = exports.PrLifecycleGuardConfig = exports.BranchCreationGuardConfig = exports.RoleTagConfig = exports.FrameworkTagConfig = exports.InjectAnnotationNotNeededForConcreteClassConfig = exports.NoFunctionOutsideClassConfig = exports.NoProcessExitOutsideMainConfig = exports.NoCustomCssConfig = exports.NoSymbolDiTokensConfig = exports.AngularNoDirectApiInResolverConfig = exports.ThrowCauseRequiredConfig = exports.CatchErrorPatternConfig = exports.NoUnmanagedExceptionsConfig = void 0;
+exports.CK_MISSING = exports.CK_FAIL = exports.CK_OVERRIDDEN = exports.CK_WARN = exports.CK_PASS = exports.ChecklistVerdict = exports.ChecklistResult = exports.PrContext = exports.ReviewJson = exports.DEFAULT_RETENTION_DAYS = exports.ProvenanceWriteRequest = exports.OfferedContext = exports.ReviewerPaths = exports.ReviewerTranscript = exports.ReviewProvenance = exports.ReviewProvenanceService = exports.PROVENANCE_SKIPPED = exports.PROVENANCE_MISSING = exports.PROVENANCE_OK = exports.ProvenanceResult = exports.TranscriptScan = exports.ReviewerContext = exports.ReviewerEvidence = exports.SubagentProvenanceService = exports.verifyGateToken = exports.extractGateToken = exports.gateTokenMarker = exports.computeGateToken = exports.GateTokenService = exports.ALL_DIFF_ONE_READ_LINES = exports.READ_TRUNCATION_LINES = exports.ContextEntry = exports.BriefedFile = exports.ReviewerBriefing = exports.ReviewerInstructionsService = exports.ChecklistInstructionsService = exports.ChecklistValidator = exports.formatFileList = exports.normalizeChecklistDoc = exports.toChecklist = exports.ChecklistDefinition = exports.MERGE_MODES = exports.MERGE_MODE_NONE = exports.MERGE_MODE_AUTO = exports.buildDevDeployConfig = exports.buildLandPrConfig = exports.buildPrGateConfig = exports.defaultDevDeployConfig = exports.defaultLandPrConfig = exports.defaultPrGateConfig = void 0;
+exports.CLASSIFICATION_CONTENT_IN_MAIN = exports.CLASSIFICATION_SUPERSEDED = exports.CLASSIFICATION_NO_COMMITS = exports.CLASSIFICATION_BACKUP_OF_LIVE = exports.CLASSIFICATION_BACKUP_OF_MERGED = exports.CLASSIFICATION_MERGED_PR = exports.CACHE_STALE_AFTER_MS = exports.CacheFreshness = exports.MergedBranchesService = exports.MergedBranchesCache = exports.DeletableWorktree = exports.DeletableBranch = exports.MergedBranch = exports.squashRecoverySteps = exports.stampCleanMainSyncStatus = exports.computeMainSyncStatus = exports.finishedLock = exports.inProcessLock = exports.tryAcquireMainSyncLock = exports.isRefreshInProgress = exports.isLockStale = exports.writeMainSyncLock = exports.readMainSyncLock = exports.computeAllMainSyncStatuses = exports.writeMainSyncStatusFile = exports.writeMainSyncStatus = exports.readMainSyncStatusFile = exports.readMainSyncStatus = exports.mainSyncLockPath = exports.mainSyncStatusPath = exports.DEFAULT_HANG_TIMEOUT_MINUTES = exports.MainSyncStatusService = exports.MainSyncLock = exports.MAIN_SYNC_STATUS_VERSION = exports.PullRequestIndex = exports.MainSyncFileStore = exports.MainSyncStatusFile = exports.MainSyncStatus = exports.reviewJsonSchemaHint = exports.reviewJsonPath = exports.prDirFor = exports.loadReviewJson = exports.ReviewJsonService = exports.ChecklistReviewContext = exports.RequiredChecklist = exports.VERDICT_STATUSES = exports.VERDICT_RED = exports.VERDICT_YELLOW = exports.VERDICT_GREEN = exports.CK_BAD_FORMAT = void 0;
+exports.DEFAULT_MERGE_COMPLETE_COMMAND = exports.DEFAULT_UPSERT_PR_COMMAND = exports.buildCommandsConfig = exports.CommandsConfig = exports.logBranchMutation = exports.branchMutationLogPath = exports.BranchMutationLog = exports.BranchMutationEvent = exports.WorktreeReaper = exports.WorktreeReapResult = exports.ReapedWorktree = exports.BranchReaper = exports.ReapResult = exports.ReapedBranch = exports.WorktreeService = exports.Worktree = exports.BRANCH_RETENTION_KEEP = exports.BRANCH_RETENTION_ARCHIVE_TAG = exports.BRANCH_RETENTION_DELETE = exports.BRANCH_RETENTIONS = exports.ARCHIVE_TAG_PREFIX = exports.ArchiveResult = exports.BranchArchiver = exports.PROMPTABLE_CLASSIFICATIONS = exports.CLASSIFICATION_DETACHED = exports.CLASSIFICATION_CURRENT = exports.CLASSIFICATION_LOCKED = exports.CLASSIFICATION_PRUNABLE = exports.CLASSIFICATION_IN_USE = exports.CLASSIFICATION_NEVER_PROPOSED = void 0;
 var types_1 = require("./types");
 Object.defineProperty(exports, "ResolvedConfig", { enumerable: true, get: function () { return types_1.ResolvedConfig; } });
 Object.defineProperty(exports, "ResolvedRuleConfig", { enumerable: true, get: function () { return types_1.ResolvedRuleConfig; } });
@@ -172,6 +172,8 @@ Object.defineProperty(exports, "FieldDef", { enumerable: true, get: function ()
 var skip_rule_1 = require("./skip-rule");
 Object.defineProperty(exports, "shouldSkipRule", { enumerable: true, get: function () { return skip_rule_1.shouldSkipRule; } });
 Object.defineProperty(exports, "getCurrentBranch", { enumerable: true, get: function () { return skip_rule_1.getCurrentBranch; } });
+var skip_rule_2 = require("./skip-rule");
+Object.defineProperty(exports, "SkipRuleResult", { enumerable: true, get: function () { return skip_rule_2.SkipRuleResult; } });
 var diff_scope_1 = require("./diff-scope");
 Object.defineProperty(exports, "detectBase", { enumerable: true, get: function () { return diff_scope_1.detectBase; } });
 Object.defineProperty(exports, "resolveBase", { enumerable: true, get: function () { return diff_scope_1.resolveBase; } });

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/index.ts"],"names":[],"mappings":";;;;;;;;;AAAA,iCAA0E;AAAjE,uGAAA,cAAc,OAAA;AAAE,2GAAA,kBAAkB,OAAA;AAC3C,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,mDAAgD;AAAvC,8GAAA,YAAY,OAAA;AACrB,uCAAiF;AAAxE,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAAE,qGAAA,SAAS,OAAA;AAAE,wGAAA,YAAY,OAAA;AAAE,mGAAA,OAAO,OAAA;AAC5D,uCAAqC;AAA5B,mGAAA,OAAO,OAAA;AAChB,uCAAqC;AAA5B,mGAAA,OAAO,OAAA;AAChB,6CAA4E;AAAnE,8GAAA,eAAe,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,2GAAA,YAAY,OAAA;AACpD,iGAAiG;AACjG,sCAAsC;AACtC,6DAM+B;AAL3B,+HAAA,wBAAwB,OAAA;AACxB,wHAAA,iBAAiB,OAAA;AACjB,yHAAA,kBAAkB,OAAA;AAClB,+HAAA,wBAAwB,OAAA;AACxB,+HAAA,wBAAwB,OAAA;AAE5B,6CAAkJ;AAAzI,6GAAA,cAAc,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,yGAAA,UAAU,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,wHAAA,yBAAyB,OAAA;AAC1H,yCAAgF;AAAvE,2GAAA,cAAc,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAC1D,wGAAwG;AACxG,8FAA8F;AAC9F,yCAAsG;AAA7F,yGAAA,YAAY,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,oGAAA,OAAO,OAAA;AAAE,+GAAA,kBAAkB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAChF,6DAA+E;AAAtE,uHAAA,gBAAgB,OAAA;AAAE,2HAAA,oBAAoB,OAAA;AAC/C,uGAAuG;AACvG,yGAAyG;AACzG,mGAAmG;AACnG,2FAA2F;AAC3F,4DAA4D;AAC5D,qDAAgF;AAAvE,kHAAA,eAAe,OAAA;AAAE,6GAAA,UAAU,OAAA;AAAE,iHAAA,cAAc,OAAA;AACpD,2CAAsG;AAA7F,uGAAA,SAAS,OAAA;AAAE,uGAAA,SAAS,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAAE,sHAAA,wBAAwB,OAAA;AAC/E,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,iGAAiG;AACjG,gGAAgG;AAChG,qCAAmC;AAA1B,iGAAA,MAAM,OAAA;AACf,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,2BAA8E;AAArE,oGAAA,cAAc,OAAA;AAAE,sGAAA,gBAAgB,OAAA;AAAE,0GAAA,oBAAoB,OAAA;AAC/D,2DAAoD;AAA3C,kHAAA,YAAY,OAAA;AACrB,iDAAiE;AAAxD,+GAAA,cAAc,OAAA;AAAE,+GAAA,cAAc,OAAA;AACvC,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,iDAAsG;AAA7F,6GAAA,YAAY,OAAA;AAAE,uHAAA,sBAAsB,OAAA;AAAE,8GAAA,aAAa,OAAA;AAAE,+GAAA,cAAc,OAAA;AAC5E,qDAAsQ;AAA7P,0HAAA,uBAAuB,OAAA;AAAE,wHAAA,qBAAqB,OAAA;AAAE,4HAAA,yBAAyB,OAAA;AAAE,2HAAA,wBAAwB,OAAA;AAAE,uHAAA,oBAAoB,OAAA;AAAE,4HAAA,yBAAyB,OAAA;AAAE,+GAAA,YAAY,OAAA;AAAE,sHAAA,mBAAmB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAC1O,6EAAwE;AAA/D,sIAAA,uBAAuB,OAAA;AAChC,uDAA8G;AAArG,oHAAA,gBAAgB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,wHAAA,oBAAoB,OAAA;AAAE,sHAAA,kBAAkB,OAAA;AACjF,uGAAuG;AACvG,wEAAwE;AACxE,6DAAsM;AAA7L,0HAAA,mBAAmB,OAAA;AAAE,wHAAA,iBAAiB,OAAA;AAAE,yHAAA,kBAAkB,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAAE,mHAAA,YAAY,OAAA;AAAE,mHAAA,YAAY,OAAA;AAAE,sHAAA,eAAe,OAAA;AAAE,yHAAA,kBAAkB,OAAA;AAAE,qHAAA,cAAc,OAAA;AACtK,0GAA0G;AAC1G,uGAAuG;AACvG,0FAA0F;AAC1F,iDAAuE;AAA9D,6GAAA,YAAY,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,0GAAA,SAAS,OAAA;AAC7C,uEAAmE;AAA1D,iIAAA,qBAAqB,OAAA;AAC9B,gHAAgH;AAChH,+GAA+G;AAC/G,8GAA8G;AAC9G,kEAAkE;AAClE,6CAGuB;AAFnB,yGAAA,UAAU,OAAA;AAAE,gHAAA,iBAAiB,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAAE,uHAAA,wBAAwB,OAAA;AAC7E,8GAAA,eAAe,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAAE,wHAAA,yBAAyB,OAAA;AAAE,8HAAA,+BAA+B,OAAA;AAEjG,2DAQ8B;AAP1B,qHAAA,eAAe,OAAA;AACf,wHAAA,kBAAkB,OAAA;AAClB,6HAAA,uBAAuB,OAAA;AACvB,4HAAA,sBAAsB,OAAA;AACtB,8HAAA,wBAAwB,OAAA;AACxB,4HAAA,sBAAsB,OAAA;AACtB,yHAAA,mBAAmB,OAAA;AAGvB,+CAAkD;AAAzC,gHAAA,gBAAgB,OAAA;AACzB,uCAA2H;AAAlH,4GAAA,gBAAgB,OAAA;AAAE,kHAAA,sBAAsB,OAAA;AAAE,kHAAA,sBAAsB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAAE,0GAAA,cAAc,OAAA;AACtG,yCAAuC;AAA9B,qGAAA,QAAQ,OAAA;AAEjB,yCAA+D;AAAtD,2GAAA,cAAc,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAEzC,2CAYsB;AAXlB,wGAAA,UAAU,OAAA;AACV,yGAAA,WAAW,OAAA;AACX,6GAAA,eAAe,OAAA;AACf,yGAAA,WAAW,OAAA;AACX,mHAAA,qBAAqB,OAAA;AACrB,2HAAA,6BAA6B,OAAA;AAC7B,+GAAA,iBAAiB,OAAA;AACjB,6GAAA,eAAe,OAAA;AACf,uGAAA,SAAS,OAAA;AACT,uGAAA,SAAS,OAAA;AACT,iHAAA,mBAAmB,OAAA;AAEvB,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AACrB,yCAWqB;AAVjB,8GAAA,iBAAiB,OAAA;AACjB,uGAAA,UAAU,OAAA;AACV,uGAAA,UAAU,OAAA;AACV,8GAAA,iBAAiB,OAAA;AACjB,2GAAA,cAAc,OAAA;AACd,0GAAA,aAAa,OAAA;AACb,mHAAA,sBAAsB,OAAA;AACtB,mHAAA,sBAAsB,OAAA;AACtB,gHAAA,mBAAmB,OAAA;AACnB,kHAAA,qBAAqB,OAAA;AAEzB,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,2DAQ8B;AAP1B,sHAAA,gBAAgB,OAAA;AAChB,qHAAA,eAAe,OAAA;AACf,sHAAA,gBAAgB,OAAA;AAChB,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AACnB,iHAAA,WAAW,OAAA;AACX,wHAAA,kBAAkB,OAAA;AAEtB,+CAmCwB;AAlCpB,oHAAA,oBAAoB,OAAA;AACpB,kHAAA,kBAAkB,OAAA;AAClB,uHAAA,uBAAuB,OAAA;AACvB,0HAAA,0BAA0B,OAAA;AAC1B,kHAAA,kBAAkB,OAAA;AAClB,mHAAA,mBAAmB,OAAA;AACnB,wHAAA,wBAAwB,OAAA;AACxB,qHAAA,qBAAqB,OAAA;AACrB,mHAAA,mBAAmB,OAAA;AACnB,2HAAA,2BAA2B,OAAA;AAC3B,uHAAA,uBAAuB,OAAA;AACvB,wHAAA,wBAAwB,OAAA;AACxB,kIAAA,kCAAkC,OAAA;AAClC,sHAAA,sBAAsB,OAAA;AACtB,iHAAA,iBAAiB,OAAA;AACjB,8HAAA,8BAA8B,OAAA;AAC9B,4HAAA,4BAA4B,OAAA;AAC5B,+IAAA,+CAA+C,OAAA;AAC/C,kHAAA,kBAAkB,OAAA;AAClB,6GAAA,aAAa,OAAA;AACb,yHAAA,yBAAyB,OAAA;AACzB,sHAAA,sBAAsB,OAAA;AACtB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,8GAAA,cAAc,OAAA;AACd,6GAAA,aAAa,OAAA;AACb,+GAAA,eAAe,OAAA;AACf,qHAAA,qBAAqB,OAAA;AACrB,mIAAA,mCAAmC,OAAA;AACnC,kIAAA,kCAAkC,OAAA;AAClC,yHAAA,yBAAyB,OAAA;AACzB,4HAAA,4BAA4B,OAAA;AAC5B,wHAAA,wBAAwB,OAAA;AACxB,8GAAA,cAAc,OAAA;AAElB,wFAAwF;AACxF,+CAcwB;AAbpB,kHAAA,kBAAkB,OAAA;AAClB,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AACjB,iHAAA,iBAAiB,OAAA;AACjB,mHAAA,mBAAmB,OAAA;AACnB,6GAAA,aAAa,OAAA;AACb,iHAAA,iBAAiB,OAAA;AACjB,sHAAA,sBAAsB,OAAA;AACtB,yHAAA,yBAAyB,OAAA;AACzB,iHAAA,iBAAiB,OAAA;AACjB,4GAAA,YAAY,OAAA;AACZ,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AAErB,yEAGqC;AAFjC,wJAAA,2CAA2C,OAAA;AAC3C,uIAAA,0BAA0B,OAAA;AAkB9B,qEAEmC;AAD/B,iIAAA,sBAAsB,OAAA;AAE1B,mDAmB0B;AAlBtB,gHAAA,cAAc,OAAA;AACd,8GAAA,YAAY,OAAA;AACZ,uHAAA,qBAAqB,OAAA;AACrB,8GAAA,YAAY,OAAA;AACZ,iHAAA,eAAe,OAAA;AACf,8HAAA,4BAA4B,OAAA;AAC5B,oHAAA,kBAAkB,OAAA;AAClB,oHAAA,kBAAkB,OAAA;AAClB,8GAAA,YAAY,OAAA;AACZ,qHAAA,mBAAmB,OAAA;AACnB,qHAAA,mBAAmB,OAAA;AACnB,wHAAA,sBAAsB,OAAA;AACtB,mHAAA,iBAAiB,OAAA;AACjB,mHAAA,iBAAiB,OAAA;AACjB,sHAAA,oBAAoB,OAAA;AACpB,iHAAA,eAAe,OAAA;AACf,iHAAA,eAAe,OAAA;AACf,6GAAA,WAAW,OAAA;AAEf,uDAK4B;AAJxB,uHAAA,mBAAmB,OAAA;AACnB,+GAAA,WAAW,OAAA;AACX,yHAAA,qBAAqB,OAAA;AACrB,kHAAA,cAAc,OAAA;AAGlB,6DAA2D;AAAlD,yHAAA,kBAAkB,OAAA;AAC3B,mEAAwE;AAA/D,sIAAA,4BAA4B,OAAA;AACrC,iEAOiC;AAN7B,oIAAA,2BAA2B,OAAA;AAC3B,yHAAA,gBAAgB,OAAA;AAChB,oHAAA,WAAW,OAAA;AACX,qHAAA,YAAY,OAAA;AACZ,8HAAA,qBAAqB,OAAA;AACrB,gIAAA,uBAAuB,OAAA;AAE3B,2CAMsB;AALlB,8GAAA,gBAAgB,OAAA;AAChB,8GAAA,gBAAgB,OAAA;AAChB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAChB,6GAAA,eAAe,OAAA;AAEnB,6DAS+B;AAR3B,gIAAA,yBAAyB,OAAA;AACzB,uHAAA,gBAAgB,OAAA;AAChB,sHAAA,eAAe,OAAA;AACf,qHAAA,cAAc,OAAA;AACd,uHAAA,gBAAgB,OAAA;AAChB,oHAAA,aAAa,OAAA;AACb,yHAAA,kBAAkB,OAAA;AAClB,yHAAA,kBAAkB,OAAA;AAEtB,yDAQ6B;AAPzB,4HAAA,uBAAuB,OAAA;AACvB,qHAAA,gBAAgB,OAAA;AAChB,uHAAA,kBAAkB,OAAA;AAClB,kHAAA,aAAa,OAAA;AACb,mHAAA,cAAc,OAAA;AACd,2HAAA,sBAAsB,OAAA;AACtB,2HAAA,sBAAsB,OAAA;AAE1B,6CAsBuB;AArBnB,yGAAA,UAAU,OAAA;AACV,wGAAA,SAAS,OAAA;AACT,8GAAA,eAAe,OAAA;AACf,+GAAA,gBAAgB,OAAA;AAChB,sGAAA,OAAO,OAAA;AACP,sGAAA,OAAO,OAAA;AACP,4GAAA,aAAa,OAAA;AACb,sGAAA,OAAO,OAAA;AACP,yGAAA,UAAU,OAAA;AACV,4GAAA,aAAa,OAAA;AACb,4GAAA,aAAa,OAAA;AACb,6GAAA,cAAc,OAAA;AACd,0GAAA,WAAW,OAAA;AACX,+GAAA,gBAAgB,OAAA;AAChB,gHAAA,iBAAiB,OAAA;AACjB,qHAAA,sBAAsB,OAAA;AACtB,gHAAA,iBAAiB,OAAA;AACjB,6GAAA,cAAc,OAAA;AACd,uGAAA,QAAQ,OAAA;AACR,6GAAA,cAAc,OAAA;AACd,mHAAA,oBAAoB,OAAA;AAExB,mDAM0B;AALtB,gHAAA,cAAc,OAAA;AACd,oHAAA,kBAAkB,OAAA;AAClB,mHAAA,iBAAiB,OAAA;AACjB,kHAAA,gBAAgB,OAAA;AAChB,0HAAA,wBAAwB,OAAA;AAE5B,uDAqB4B;AApBxB,gHAAA,YAAY,OAAA;AACZ,yHAAA,qBAAqB,OAAA;AACrB,gIAAA,4BAA4B,OAAA;AAC5B,sHAAA,kBAAkB,OAAA;AAClB,oHAAA,gBAAgB,OAAA;AAChB,sHAAA,kBAAkB,OAAA;AAClB,0HAAA,sBAAsB,OAAA;AACtB,uHAAA,mBAAmB,OAAA;AACnB,2HAAA,uBAAuB,OAAA;AACvB,8HAAA,0BAA0B,OAAA;AAC1B,oHAAA,gBAAgB,OAAA;AAChB,qHAAA,iBAAiB,OAAA;AACjB,+GAAA,WAAW,OAAA;AACX,uHAAA,mBAAmB,OAAA;AACnB,0HAAA,sBAAsB,OAAA;AACtB,iHAAA,aAAa,OAAA;AACb,gHAAA,YAAY,OAAA;AACZ,yHAAA,qBAAqB,OAAA;AACrB,4HAAA,wBAAwB,OAAA;AACxB,uHAAA,mBAAmB,OAAA;AAEvB,qDAqB2B;AApBvB,+GAAA,YAAY,OAAA;AACZ,kHAAA,eAAe,OAAA;AACf,oHAAA,iBAAiB,OAAA;AACjB,sHAAA,mBAAmB,OAAA;AACnB,wHAAA,qBAAqB,OAAA;AACrB,iHAAA,cAAc,OAAA;AACd,uHAAA,oBAAoB,OAAA;AACpB,2HAAA,wBAAwB,OAAA;AACxB,kIAAA,+BAA+B,OAAA;AAC/B,gIAAA,6BAA6B,OAAA;AAC7B,4HAAA,yBAAyB,OAAA;AACzB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA;AAC9B,gIAAA,6BAA6B,OAAA;AAC7B,wHAAA,qBAAqB,OAAA;AACrB,0HAAA,uBAAuB,OAAA;AACvB,wHAAA,qBAAqB,OAAA;AACrB,yHAAA,sBAAsB,OAAA;AACtB,0HAAA,uBAAuB,OAAA;AACvB,6HAAA,0BAA0B,OAAA;AAE9B,qDAQ2B;AAPvB,iHAAA,cAAc,OAAA;AACd,gHAAA,aAAa,OAAA;AACb,qHAAA,kBAAkB,OAAA;AAClB,oHAAA,iBAAiB,OAAA;AACjB,0HAAA,uBAAuB,OAAA;AACvB,+HAAA,4BAA4B,OAAA;AAC5B,wHAAA,qBAAqB,OAAA;AAEzB,yCAGqB;AAFjB,qGAAA,QAAQ,OAAA;AACR,4GAAA,eAAe,OAAA;AAEnB,iDAIyB;AAHrB,6GAAA,YAAY,OAAA;AACZ,2GAAA,UAAU,OAAA;AACV,6GAAA,YAAY,OAAA;AAEhB,qDAI2B;AAHvB,iHAAA,cAAc,OAAA;AACd,qHAAA,kBAAkB,OAAA;AAClB,iHAAA,cAAc,OAAA;AAGlB,6DAK+B;AAJ3B,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AAErB,qDAK2B;AAJvB,iHAAA,cAAc,OAAA;AACd,sHAAA,mBAAmB,OAAA;AACnB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA","sourcesContent":["export { ResolvedConfig, ResolvedRuleConfig, RuleOptions } from './types';\nexport { InformAiError } from './inform-ai-error';\nexport { RuleFailError } from './rule-fail-error';\nexport { CliExitError } from './cli-exit-error';\nexport { CliUsage, CliFlag, CliArgSet, CliArgsCheck, CliArgs } from './cli-args';\nexport { runMain } from './run-main';\nexport { toError } from './to-error';\nexport { loadAndValidate, LoadedConfig, ConfigLoader } from './load-config';\n// The validation-failure banner: ONE cure (edit the file), plus the marker phrases the validator\n// messages embed rather than re-type.\nexport {\n    formatConfigErrorsBanner,\n    CONFIG_POLICY_DOC,\n    RETIRED_KEY_MARKER,\n    RETIRED_TOP_LEVEL_MARKER,\n    SECTION_PLACEMENT_MARKER,\n} from './config-error-banner';\nexport { findConfigFile, CONFIG_FILENAME, ConfigFile, ConfigParseAttempt, CONFIG_PARSE_ATTEMPTS, CONFIG_PARSE_RETRY_MILLIS } from './config-file';\nexport { RepoRootFinder, INSTRUCT_AI_DIR, INSTRUCT_AI_LEAF } from './repo-root';\n// The scoped `.webpieces` resolver. EVERY reader/writer of `.webpieces/...` goes through one of its two\n// named methods so the call site declares whether the state is repo-wide or worktree-private.\nexport { DotWebpieces, dotWebpieces, GitDirs, WORKTREE_STATE_DIR, LOGS_STATE_DIR } from './state-dir';\nexport { StateDirMigrator, StateMigrationReport } from './state-dir-migration';\n// There is NO machine-global state root. `MachineStateHome`/`StateHome`/`WEBPIECES_STATE_HOME` and the\n// `PrBodyStore` that used them are DELETED: the one artifact that needed a scope above the clone was the\n// gated squash body, and GitHub holds it now (it IS the PR description). Every `.webpieces` path a\n// webpieces tool writes is `{repo}/.webpieces`, resolved through `DotWebpieces` above. See\n// `decisions/0005-the-pr-description-is-the-merge-body.md`.\nexport { AgedTreeSweeper, SweepCount, RETENTION_DAYS } from './aged-tree-sweep';\nexport { ClaudeEnv, claudeEnv, CLAUDE_PROJECT_DIR_ENV, CLAUDE_PROJECT_DIR_UNSET } from './claude-env';\nexport { AtomicFile } from './atomic-file';\n// The ONE formatter for a remedy that must run in a named directory: `cd '<root>' && <command>`.\n// Single-quoted so a repo path containing a space is still runnable (and still un-smuggleable).\nexport { atRoot } from './at-root';\nexport { RulesConfigDesign } from './rules-config-design';\nexport { DocumentDesign, isDocumentDesign, DESIGN_METADATA_KEYS } from './di';\nexport { ExcludePaths } from './exclude-hook-paths';\nexport { isPathExcluded, matchesAnyGlob } from './exclude-paths';\nexport { defaultRules, defaultRulesDir } from './default-rules';\nexport { loadTemplate, writeTemplateIfMissing, writeTemplate, TemplateWriter } from './load-template';\nexport { validateWebpiecesConfig, validatePrGateSection, validateChecklistsSection, validateSectionPlacement, validateExcludePaths, validateMatchRulesSection, allRuleNames, recommendedSeedMode, recommendedSeedModeFor, seedEntryForRule } from './validate-config';\nexport { validateCommandsSection } from './commands-section-validators';\nexport { unknownKeyErrors, isCommentKey, validateTopLevelKeys, COMMENT_KEY_SUFFIX } from './config-key-rules';\n// The retired-key table + the no-back-compat policy it enforces. Exported so the installer can migrate\n// what the errors instruct, and so consumers can enumerate retirements.\nexport { RETIRED_CONFIG_KEYS, RETIRED_SCOPE_KEY, RETIRED_SCOPE_RULE, RetiredConfigKey, isRetiredKey, retiredEntry, retiredKeyError, retiredKeyErrorsIn, retiredRuleFor } from './retired-config-keys';\n// The MECHANICAL cure the unknown-rule error and the banner both name: strip every key no validator has a\n// schema for, so cleanliness is one command rather than a judgement call made while every Bash call is\n// blocked. `PRUNE_UNKNOWN_COMMAND` (constants.ts) is the single spelling of that command.\nexport { ConfigPruner, PruneResult, PrunedKey } from './config-pruner';\nexport { validateChecklistDocs } from './checklist-docs-validator';\n// EXPERIMENTAL, and deliberately NOT an advertised knob. The OPTIONAL machine-local `~/.webpieces/config.json`:\n// absent (the normal state for every consumer) means all-defaults, silently; present means strictly validated,\n// with its own retirement table. `isHomeConfigPath` is what grants the file its unconditional Write/Edit PASS\n// in the hook guards, which is what keeps a rejection repairable.\nexport {\n    HomeConfig, HomeConfigService, RetiredHomeConfigKey, RETIRED_HOME_CONFIG_KEYS,\n    HOME_CONFIG_DIR, HOME_CONFIG_FILE, HOME_EXPERIMENTAL_SECTION, HOME_KEY_BUILD_GATE_LOG_CAPTURE,\n} from './home-config';\nexport {\n    MatchRuleConfig,\n    MatchRuleViolation,\n    findMatchRuleViolations,\n    isMatchRuleAllowedPath,\n    compileMatchRulePatterns,\n    renderMatchRuleMessage,\n    DEFAULT_MATCH_RULES,\n} from './match-rules-config';\nexport type { ConfigSection } from './sections';\nexport { schemaFieldNames } from './rule-schemas';\nexport { HOOK_GUARD_NAMES, BRANCH_STATE_GUARD_KEY, PR_LIFECYCLE_GUARD_KEY, isHookGuard, sectionForRule } from './sections';\nexport { FieldDef } from './field-def';\nexport type { SchemaShape } from './field-def';\nexport { shouldSkipRule, getCurrentBranch } from './skip-rule';\nexport type { SkipRuleResult } from './skip-rule';\nexport {\n    detectBase,\n    resolveBase,\n    getChangedFiles,\n    getFileDiff,\n    getChangedLineNumbers,\n    findNewMethodSignaturesInDiff,\n    hasChangesInRange,\n    isNewOrModified,\n    DiffScope,\n    DiffRange,\n    ChangedFilesOptions,\n} from './diff-scope';\nexport { AbstractRule } from './abstract-rule';\nexport {\n    WEBPIECES_DISABLE,\n    RULE_NAMES,\n    hasDisable,\n    WEBPIECES_TMP_DIR,\n    MERGE_INFO_DIR,\n    PR_REVIEW_DIR,\n    MERGE_IN_PROGRESS_FILE,\n    MERGE_EXPLANATION_FILE,\n    PUSH_DEV_STATE_FILE,\n    PRUNE_UNKNOWN_COMMAND,\n} from './constants';\nexport { WebpiecesRulesConfig } from './WebpiecesRulesConfig';\nexport {\n    SyncFlowGuidance,\n    WP_START_UPDATE,\n    WP_FINISH_UPDATE,\n    WP_START_UPSERT_PR,\n    WP_FINISH_UPSERT_PR,\n    WP_PUSH_DEV,\n    WP_FINISH_PUSH_DEV,\n} from './sync-flow-guidance';\nexport {\n    MaxMethodLinesConfig,\n    MaxFileLinesConfig,\n    RequireReturnTypeConfig,\n    NoInlineTypeLiteralsConfig,\n    NoAnyUnknownConfig,\n    NoImplicitAnyConfig,\n    PrismaValidateDtosConfig,\n    PrismaConverterConfig,\n    NoDestructureConfig,\n    NoUnmanagedExceptionsConfig,\n    CatchErrorPatternConfig,\n    ThrowCauseRequiredConfig,\n    AngularNoDirectApiInResolverConfig,\n    NoSymbolDiTokensConfig,\n    NoCustomCssConfig,\n    NoProcessExitOutsideMainConfig,\n    NoFunctionOutsideClassConfig,\n    InjectAnnotationNotNeededForConcreteClassConfig,\n    FrameworkTagConfig,\n    RoleTagConfig,\n    BranchCreationGuardConfig,\n    PrLifecycleGuardConfig,\n    NoFileImportCyclesConfig,\n    RuntimeArchitectureConfig,\n    NxWiringConfig,\n    DiGraphConfig,\n    NoJsFilesConfig,\n    ValidateTsInSrcConfig,\n    ValidateArchitectureUnchangedConfig,\n    ValidateNoArchitectureCyclesConfig,\n    ValidatePackageJsonConfig,\n    ValidateVersionsLockedConfig,\n    ValidateEslintSyncConfig,\n    BaseRuleConfig,\n} from './rule-configs';\n// Mode unions + their value arrays — the single source of truth shared with code-rules.\nexport {\n    METHOD_LIMIT_MODES,\n    FILE_LIMIT_MODES,\n    RETURN_TYPE_MODES,\n    INLINE_TYPE_MODES,\n    MODIFIED_CODE_MODES,\n    PROJECT_MODES,\n    PRISMA_DTOS_MODES,\n    PRISMA_CONVERTER_MODES,\n    DIRECT_API_RESOLVER_MODES,\n    THROW_CAUSE_MODES,\n    ON_OFF_MODES,\n    STRUCTURAL_MODES,\n    VALIDATE_TS_MODES,\n} from './rule-configs';\nexport {\n    NoClientCreationOutsideServerOrClientConfig,\n    CLIENT_CREATION_SEVERITIES,\n} from './no-client-creation-config';\nexport type { ClientCreationSeverity } from './no-client-creation-config';\nexport type {\n    MethodLimitMode,\n    FileLimitMode,\n    ReturnTypeMode,\n    InlineTypeMode,\n    ModifiedCodeMode,\n    ProjectMode,\n    PrismaValidateDtosMode,\n    PrismaConverterMode,\n    DirectApiResolverMode,\n    ThrowCauseMode,\n    OnOffMode,\n    StructuralMode,\n    ValidateTsMode,\n} from './rule-configs';\nexport {\n    BranchStateGuardConfig,\n} from './main-sync-guard-configs';\nexport {\n    GateDefinition,\n    PrGateConfig,\n    DEFAULT_BUILD_COMMAND,\n    LandPrConfig,\n    DevDeployConfig,\n    DEFAULT_DEV_BRANCH_NAMESPACE,\n    DEFAULT_DEV_BRANCH,\n    ReviewContextEntry,\n    defaultGates,\n    defaultPrGateConfig,\n    defaultLandPrConfig,\n    defaultDevDeployConfig,\n    buildPrGateConfig,\n    buildLandPrConfig,\n    buildDevDeployConfig,\n    MERGE_MODE_AUTO,\n    MERGE_MODE_NONE,\n    MERGE_MODES,\n} from './pr-gate-config';\nexport {\n    ChecklistDefinition,\n    toChecklist,\n    normalizeChecklistDoc,\n    formatFileList,\n} from './checklist-config';\nexport type { RawChecklistItem } from './checklist-config';\nexport { ChecklistValidator } from './checklist-validator';\nexport { ChecklistInstructionsService } from './checklist-instructions';\nexport {\n    ReviewerInstructionsService,\n    ReviewerBriefing,\n    BriefedFile,\n    ContextEntry,\n    READ_TRUNCATION_LINES,\n    ALL_DIFF_ONE_READ_LINES,\n} from './reviewer-instructions';\nexport {\n    GateTokenService,\n    computeGateToken,\n    gateTokenMarker,\n    extractGateToken,\n    verifyGateToken,\n} from './gate-token';\nexport {\n    SubagentProvenanceService,\n    ReviewerEvidence,\n    ReviewerContext,\n    TranscriptScan,\n    ProvenanceResult,\n    PROVENANCE_OK,\n    PROVENANCE_MISSING,\n    PROVENANCE_SKIPPED,\n} from './subagent-provenance';\nexport {\n    ReviewProvenanceService,\n    ReviewProvenance,\n    ReviewerTranscript,\n    ReviewerPaths,\n    OfferedContext,\n    ProvenanceWriteRequest,\n    DEFAULT_RETENTION_DAYS,\n} from './review-provenance';\nexport {\n    ReviewJson,\n    PrContext,\n    ChecklistResult,\n    ChecklistVerdict,\n    CK_PASS,\n    CK_WARN,\n    CK_OVERRIDDEN,\n    CK_FAIL,\n    CK_MISSING,\n    CK_BAD_FORMAT,\n    VERDICT_GREEN,\n    VERDICT_YELLOW,\n    VERDICT_RED,\n    VERDICT_STATUSES,\n    RequiredChecklist,\n    ChecklistReviewContext,\n    ReviewJsonService,\n    loadReviewJson,\n    prDirFor,\n    reviewJsonPath,\n    reviewJsonSchemaHint,\n} from './review-json';\nexport {\n    MainSyncStatus,\n    MainSyncStatusFile,\n    MainSyncFileStore,\n    PullRequestIndex,\n    MAIN_SYNC_STATUS_VERSION,\n} from './main-sync-file';\nexport {\n    MainSyncLock,\n    MainSyncStatusService,\n    DEFAULT_HANG_TIMEOUT_MINUTES,\n    mainSyncStatusPath,\n    mainSyncLockPath,\n    readMainSyncStatus,\n    readMainSyncStatusFile,\n    writeMainSyncStatus,\n    writeMainSyncStatusFile,\n    computeAllMainSyncStatuses,\n    readMainSyncLock,\n    writeMainSyncLock,\n    isLockStale,\n    isRefreshInProgress,\n    tryAcquireMainSyncLock,\n    inProcessLock,\n    finishedLock,\n    computeMainSyncStatus,\n    stampCleanMainSyncStatus,\n    squashRecoverySteps,\n} from './main-sync-status';\nexport {\n    MergedBranch,\n    DeletableBranch,\n    DeletableWorktree,\n    MergedBranchesCache,\n    MergedBranchesService,\n    CacheFreshness,\n    CACHE_STALE_AFTER_MS,\n    CLASSIFICATION_MERGED_PR,\n    CLASSIFICATION_BACKUP_OF_MERGED,\n    CLASSIFICATION_BACKUP_OF_LIVE,\n    CLASSIFICATION_NO_COMMITS,\n    CLASSIFICATION_SUPERSEDED,\n    CLASSIFICATION_CONTENT_IN_MAIN,\n    CLASSIFICATION_NEVER_PROPOSED,\n    CLASSIFICATION_IN_USE,\n    CLASSIFICATION_PRUNABLE,\n    CLASSIFICATION_LOCKED,\n    CLASSIFICATION_CURRENT,\n    CLASSIFICATION_DETACHED,\n    PROMPTABLE_CLASSIFICATIONS,\n} from './merged-branches';\nexport {\n    BranchArchiver,\n    ArchiveResult,\n    ARCHIVE_TAG_PREFIX,\n    BRANCH_RETENTIONS,\n    BRANCH_RETENTION_DELETE,\n    BRANCH_RETENTION_ARCHIVE_TAG,\n    BRANCH_RETENTION_KEEP,\n} from './branch-archiver';\nexport {\n    Worktree,\n    WorktreeService,\n} from './worktrees';\nexport {\n    ReapedBranch,\n    ReapResult,\n    BranchReaper,\n} from './branch-reaper';\nexport {\n    ReapedWorktree,\n    WorktreeReapResult,\n    WorktreeReaper,\n} from './worktree-reaper';\nexport type { MutationVerb, MutationPhase } from './branch-mutation-log';\nexport {\n    BranchMutationEvent,\n    BranchMutationLog,\n    branchMutationLogPath,\n    logBranchMutation,\n} from './branch-mutation-log';\nexport {\n    CommandsConfig,\n    buildCommandsConfig,\n    DEFAULT_UPSERT_PR_COMMAND,\n    DEFAULT_MERGE_COMPLETE_COMMAND,\n} from './commands-config';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/index.ts"],"names":[],"mappings":";;;;;;;;;AAAA,iCAA0E;AAAjE,uGAAA,cAAc,OAAA;AAAE,2GAAA,kBAAkB,OAAA;AAC3C,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,mDAAgD;AAAvC,8GAAA,YAAY,OAAA;AACrB,uCAAiF;AAAxE,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAAE,qGAAA,SAAS,OAAA;AAAE,wGAAA,YAAY,OAAA;AAAE,mGAAA,OAAO,OAAA;AAC5D,uCAAqC;AAA5B,mGAAA,OAAO,OAAA;AAChB,uCAAqC;AAA5B,mGAAA,OAAO,OAAA;AAChB,6CAA4E;AAAnE,8GAAA,eAAe,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,2GAAA,YAAY,OAAA;AACpD,iGAAiG;AACjG,sCAAsC;AACtC,6DAM+B;AAL3B,+HAAA,wBAAwB,OAAA;AACxB,wHAAA,iBAAiB,OAAA;AACjB,yHAAA,kBAAkB,OAAA;AAClB,+HAAA,wBAAwB,OAAA;AACxB,+HAAA,wBAAwB,OAAA;AAE5B,6CAAkJ;AAAzI,6GAAA,cAAc,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,yGAAA,UAAU,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,wHAAA,yBAAyB,OAAA;AAI1H,yCAAgF;AAAvE,2GAAA,cAAc,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAC1D,wGAAwG;AACxG,8FAA8F;AAC9F,yCAAsG;AAA7F,yGAAA,YAAY,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,oGAAA,OAAO,OAAA;AAAE,+GAAA,kBAAkB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAChF,6DAA+E;AAAtE,uHAAA,gBAAgB,OAAA;AAAE,2HAAA,oBAAoB,OAAA;AAC/C,uGAAuG;AACvG,yGAAyG;AACzG,mGAAmG;AACnG,2FAA2F;AAC3F,4DAA4D;AAC5D,qDAAgF;AAAvE,kHAAA,eAAe,OAAA;AAAE,6GAAA,UAAU,OAAA;AAAE,iHAAA,cAAc,OAAA;AACpD,2CAAsG;AAA7F,uGAAA,SAAS,OAAA;AAAE,uGAAA,SAAS,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAAE,sHAAA,wBAAwB,OAAA;AAC/E,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,iGAAiG;AACjG,gGAAgG;AAChG,qCAAmC;AAA1B,iGAAA,MAAM,OAAA;AACf,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,2BAA8E;AAArE,oGAAA,cAAc,OAAA;AAAE,sGAAA,gBAAgB,OAAA;AAAE,0GAAA,oBAAoB,OAAA;AAC/D,2DAAoD;AAA3C,kHAAA,YAAY,OAAA;AACrB,iDAAiE;AAAxD,+GAAA,cAAc,OAAA;AAAE,+GAAA,cAAc,OAAA;AACvC,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,iDAAsG;AAA7F,6GAAA,YAAY,OAAA;AAAE,uHAAA,sBAAsB,OAAA;AAAE,8GAAA,aAAa,OAAA;AAAE,+GAAA,cAAc,OAAA;AAC5E,qDAAsQ;AAA7P,0HAAA,uBAAuB,OAAA;AAAE,wHAAA,qBAAqB,OAAA;AAAE,4HAAA,yBAAyB,OAAA;AAAE,2HAAA,wBAAwB,OAAA;AAAE,uHAAA,oBAAoB,OAAA;AAAE,4HAAA,yBAAyB,OAAA;AAAE,+GAAA,YAAY,OAAA;AAAE,sHAAA,mBAAmB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAAE,mHAAA,gBAAgB,OAAA;AAC1O,6EAAwE;AAA/D,sIAAA,uBAAuB,OAAA;AAChC,uDAA8G;AAArG,oHAAA,gBAAgB,OAAA;AAAE,gHAAA,YAAY,OAAA;AAAE,wHAAA,oBAAoB,OAAA;AAAE,sHAAA,kBAAkB,OAAA;AACjF,uGAAuG;AACvG,wEAAwE;AACxE,6DAAsM;AAA7L,0HAAA,mBAAmB,OAAA;AAAE,wHAAA,iBAAiB,OAAA;AAAE,yHAAA,kBAAkB,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAAE,mHAAA,YAAY,OAAA;AAAE,mHAAA,YAAY,OAAA;AAAE,sHAAA,eAAe,OAAA;AAAE,yHAAA,kBAAkB,OAAA;AAAE,qHAAA,cAAc,OAAA;AACtK,0GAA0G;AAC1G,uGAAuG;AACvG,0FAA0F;AAC1F,iDAAuE;AAA9D,6GAAA,YAAY,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,0GAAA,SAAS,OAAA;AAC7C,uEAAmE;AAA1D,iIAAA,qBAAqB,OAAA;AAC9B,gHAAgH;AAChH,+GAA+G;AAC/G,8GAA8G;AAC9G,kEAAkE;AAClE,6CAGuB;AAFnB,yGAAA,UAAU,OAAA;AAAE,gHAAA,iBAAiB,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAAE,uHAAA,wBAAwB,OAAA;AAC7E,8GAAA,eAAe,OAAA;AAAE,+GAAA,gBAAgB,OAAA;AAAE,wHAAA,yBAAyB,OAAA;AAAE,8HAAA,+BAA+B,OAAA;AAEjG,2DAQ8B;AAP1B,qHAAA,eAAe,OAAA;AACf,wHAAA,kBAAkB,OAAA;AAClB,6HAAA,uBAAuB,OAAA;AACvB,4HAAA,sBAAsB,OAAA;AACtB,8HAAA,wBAAwB,OAAA;AACxB,4HAAA,sBAAsB,OAAA;AACtB,yHAAA,mBAAmB,OAAA;AAGvB,+CAAkD;AAAzC,gHAAA,gBAAgB,OAAA;AACzB,uCAA2H;AAAlH,4GAAA,gBAAgB,OAAA;AAAE,kHAAA,sBAAsB,OAAA;AAAE,kHAAA,sBAAsB,OAAA;AAAE,uGAAA,WAAW,OAAA;AAAE,0GAAA,cAAc,OAAA;AACtG,yCAAuC;AAA9B,qGAAA,QAAQ,OAAA;AAEjB,yCAA+D;AAAtD,2GAAA,cAAc,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AACzC,yCAA6C;AAApC,2GAAA,cAAc,OAAA;AACvB,2CAYsB;AAXlB,wGAAA,UAAU,OAAA;AACV,yGAAA,WAAW,OAAA;AACX,6GAAA,eAAe,OAAA;AACf,yGAAA,WAAW,OAAA;AACX,mHAAA,qBAAqB,OAAA;AACrB,2HAAA,6BAA6B,OAAA;AAC7B,+GAAA,iBAAiB,OAAA;AACjB,6GAAA,eAAe,OAAA;AACf,uGAAA,SAAS,OAAA;AACT,uGAAA,SAAS,OAAA;AACT,iHAAA,mBAAmB,OAAA;AAEvB,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AACrB,yCAWqB;AAVjB,8GAAA,iBAAiB,OAAA;AACjB,uGAAA,UAAU,OAAA;AACV,uGAAA,UAAU,OAAA;AACV,8GAAA,iBAAiB,OAAA;AACjB,2GAAA,cAAc,OAAA;AACd,0GAAA,aAAa,OAAA;AACb,mHAAA,sBAAsB,OAAA;AACtB,mHAAA,sBAAsB,OAAA;AACtB,gHAAA,mBAAmB,OAAA;AACnB,kHAAA,qBAAqB,OAAA;AAEzB,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,2DAQ8B;AAP1B,sHAAA,gBAAgB,OAAA;AAChB,qHAAA,eAAe,OAAA;AACf,sHAAA,gBAAgB,OAAA;AAChB,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AACnB,iHAAA,WAAW,OAAA;AACX,wHAAA,kBAAkB,OAAA;AAEtB,+CAmCwB;AAlCpB,oHAAA,oBAAoB,OAAA;AACpB,kHAAA,kBAAkB,OAAA;AAClB,uHAAA,uBAAuB,OAAA;AACvB,0HAAA,0BAA0B,OAAA;AAC1B,kHAAA,kBAAkB,OAAA;AAClB,mHAAA,mBAAmB,OAAA;AACnB,wHAAA,wBAAwB,OAAA;AACxB,qHAAA,qBAAqB,OAAA;AACrB,mHAAA,mBAAmB,OAAA;AACnB,2HAAA,2BAA2B,OAAA;AAC3B,uHAAA,uBAAuB,OAAA;AACvB,wHAAA,wBAAwB,OAAA;AACxB,kIAAA,kCAAkC,OAAA;AAClC,sHAAA,sBAAsB,OAAA;AACtB,iHAAA,iBAAiB,OAAA;AACjB,8HAAA,8BAA8B,OAAA;AAC9B,4HAAA,4BAA4B,OAAA;AAC5B,+IAAA,+CAA+C,OAAA;AAC/C,kHAAA,kBAAkB,OAAA;AAClB,6GAAA,aAAa,OAAA;AACb,yHAAA,yBAAyB,OAAA;AACzB,sHAAA,sBAAsB,OAAA;AACtB,wHAAA,wBAAwB,OAAA;AACxB,yHAAA,yBAAyB,OAAA;AACzB,8GAAA,cAAc,OAAA;AACd,6GAAA,aAAa,OAAA;AACb,+GAAA,eAAe,OAAA;AACf,qHAAA,qBAAqB,OAAA;AACrB,mIAAA,mCAAmC,OAAA;AACnC,kIAAA,kCAAkC,OAAA;AAClC,yHAAA,yBAAyB,OAAA;AACzB,4HAAA,4BAA4B,OAAA;AAC5B,wHAAA,wBAAwB,OAAA;AACxB,8GAAA,cAAc,OAAA;AAElB,wFAAwF;AACxF,+CAcwB;AAbpB,kHAAA,kBAAkB,OAAA;AAClB,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AACjB,iHAAA,iBAAiB,OAAA;AACjB,mHAAA,mBAAmB,OAAA;AACnB,6GAAA,aAAa,OAAA;AACb,iHAAA,iBAAiB,OAAA;AACjB,sHAAA,sBAAsB,OAAA;AACtB,yHAAA,yBAAyB,OAAA;AACzB,iHAAA,iBAAiB,OAAA;AACjB,4GAAA,YAAY,OAAA;AACZ,gHAAA,gBAAgB,OAAA;AAChB,iHAAA,iBAAiB,OAAA;AAErB,yEAGqC;AAFjC,wJAAA,2CAA2C,OAAA;AAC3C,uIAAA,0BAA0B,OAAA;AAkB9B,qEAEmC;AAD/B,iIAAA,sBAAsB,OAAA;AAE1B,mDAmB0B;AAlBtB,gHAAA,cAAc,OAAA;AACd,8GAAA,YAAY,OAAA;AACZ,uHAAA,qBAAqB,OAAA;AACrB,8GAAA,YAAY,OAAA;AACZ,iHAAA,eAAe,OAAA;AACf,8HAAA,4BAA4B,OAAA;AAC5B,oHAAA,kBAAkB,OAAA;AAClB,oHAAA,kBAAkB,OAAA;AAClB,8GAAA,YAAY,OAAA;AACZ,qHAAA,mBAAmB,OAAA;AACnB,qHAAA,mBAAmB,OAAA;AACnB,wHAAA,sBAAsB,OAAA;AACtB,mHAAA,iBAAiB,OAAA;AACjB,mHAAA,iBAAiB,OAAA;AACjB,sHAAA,oBAAoB,OAAA;AACpB,iHAAA,eAAe,OAAA;AACf,iHAAA,eAAe,OAAA;AACf,6GAAA,WAAW,OAAA;AAEf,uDAK4B;AAJxB,uHAAA,mBAAmB,OAAA;AACnB,+GAAA,WAAW,OAAA;AACX,yHAAA,qBAAqB,OAAA;AACrB,kHAAA,cAAc,OAAA;AAGlB,6DAA2D;AAAlD,yHAAA,kBAAkB,OAAA;AAC3B,mEAAwE;AAA/D,sIAAA,4BAA4B,OAAA;AACrC,iEAOiC;AAN7B,oIAAA,2BAA2B,OAAA;AAC3B,yHAAA,gBAAgB,OAAA;AAChB,oHAAA,WAAW,OAAA;AACX,qHAAA,YAAY,OAAA;AACZ,8HAAA,qBAAqB,OAAA;AACrB,gIAAA,uBAAuB,OAAA;AAE3B,2CAMsB;AALlB,8GAAA,gBAAgB,OAAA;AAChB,8GAAA,gBAAgB,OAAA;AAChB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAChB,6GAAA,eAAe,OAAA;AAEnB,6DAS+B;AAR3B,gIAAA,yBAAyB,OAAA;AACzB,uHAAA,gBAAgB,OAAA;AAChB,sHAAA,eAAe,OAAA;AACf,qHAAA,cAAc,OAAA;AACd,uHAAA,gBAAgB,OAAA;AAChB,oHAAA,aAAa,OAAA;AACb,yHAAA,kBAAkB,OAAA;AAClB,yHAAA,kBAAkB,OAAA;AAEtB,yDAQ6B;AAPzB,4HAAA,uBAAuB,OAAA;AACvB,qHAAA,gBAAgB,OAAA;AAChB,uHAAA,kBAAkB,OAAA;AAClB,kHAAA,aAAa,OAAA;AACb,mHAAA,cAAc,OAAA;AACd,2HAAA,sBAAsB,OAAA;AACtB,2HAAA,sBAAsB,OAAA;AAE1B,6CAsBuB;AArBnB,yGAAA,UAAU,OAAA;AACV,wGAAA,SAAS,OAAA;AACT,8GAAA,eAAe,OAAA;AACf,+GAAA,gBAAgB,OAAA;AAChB,sGAAA,OAAO,OAAA;AACP,sGAAA,OAAO,OAAA;AACP,4GAAA,aAAa,OAAA;AACb,sGAAA,OAAO,OAAA;AACP,yGAAA,UAAU,OAAA;AACV,4GAAA,aAAa,OAAA;AACb,4GAAA,aAAa,OAAA;AACb,6GAAA,cAAc,OAAA;AACd,0GAAA,WAAW,OAAA;AACX,+GAAA,gBAAgB,OAAA;AAChB,gHAAA,iBAAiB,OAAA;AACjB,qHAAA,sBAAsB,OAAA;AACtB,gHAAA,iBAAiB,OAAA;AACjB,6GAAA,cAAc,OAAA;AACd,uGAAA,QAAQ,OAAA;AACR,6GAAA,cAAc,OAAA;AACd,mHAAA,oBAAoB,OAAA;AAExB,mDAM0B;AALtB,gHAAA,cAAc,OAAA;AACd,oHAAA,kBAAkB,OAAA;AAClB,mHAAA,iBAAiB,OAAA;AACjB,kHAAA,gBAAgB,OAAA;AAChB,0HAAA,wBAAwB,OAAA;AAE5B,uDAqB4B;AApBxB,gHAAA,YAAY,OAAA;AACZ,yHAAA,qBAAqB,OAAA;AACrB,gIAAA,4BAA4B,OAAA;AAC5B,sHAAA,kBAAkB,OAAA;AAClB,oHAAA,gBAAgB,OAAA;AAChB,sHAAA,kBAAkB,OAAA;AAClB,0HAAA,sBAAsB,OAAA;AACtB,uHAAA,mBAAmB,OAAA;AACnB,2HAAA,uBAAuB,OAAA;AACvB,8HAAA,0BAA0B,OAAA;AAC1B,oHAAA,gBAAgB,OAAA;AAChB,qHAAA,iBAAiB,OAAA;AACjB,+GAAA,WAAW,OAAA;AACX,uHAAA,mBAAmB,OAAA;AACnB,0HAAA,sBAAsB,OAAA;AACtB,iHAAA,aAAa,OAAA;AACb,gHAAA,YAAY,OAAA;AACZ,yHAAA,qBAAqB,OAAA;AACrB,4HAAA,wBAAwB,OAAA;AACxB,uHAAA,mBAAmB,OAAA;AAEvB,qDAqB2B;AApBvB,+GAAA,YAAY,OAAA;AACZ,kHAAA,eAAe,OAAA;AACf,oHAAA,iBAAiB,OAAA;AACjB,sHAAA,mBAAmB,OAAA;AACnB,wHAAA,qBAAqB,OAAA;AACrB,iHAAA,cAAc,OAAA;AACd,uHAAA,oBAAoB,OAAA;AACpB,2HAAA,wBAAwB,OAAA;AACxB,kIAAA,+BAA+B,OAAA;AAC/B,gIAAA,6BAA6B,OAAA;AAC7B,4HAAA,yBAAyB,OAAA;AACzB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA;AAC9B,gIAAA,6BAA6B,OAAA;AAC7B,wHAAA,qBAAqB,OAAA;AACrB,0HAAA,uBAAuB,OAAA;AACvB,wHAAA,qBAAqB,OAAA;AACrB,yHAAA,sBAAsB,OAAA;AACtB,0HAAA,uBAAuB,OAAA;AACvB,6HAAA,0BAA0B,OAAA;AAE9B,qDAQ2B;AAPvB,iHAAA,cAAc,OAAA;AACd,gHAAA,aAAa,OAAA;AACb,qHAAA,kBAAkB,OAAA;AAClB,oHAAA,iBAAiB,OAAA;AACjB,0HAAA,uBAAuB,OAAA;AACvB,+HAAA,4BAA4B,OAAA;AAC5B,wHAAA,qBAAqB,OAAA;AAEzB,yCAGqB;AAFjB,qGAAA,QAAQ,OAAA;AACR,4GAAA,eAAe,OAAA;AAEnB,iDAIyB;AAHrB,6GAAA,YAAY,OAAA;AACZ,2GAAA,UAAU,OAAA;AACV,6GAAA,YAAY,OAAA;AAEhB,qDAI2B;AAHvB,iHAAA,cAAc,OAAA;AACd,qHAAA,kBAAkB,OAAA;AAClB,iHAAA,cAAc,OAAA;AAGlB,6DAK+B;AAJ3B,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AAErB,qDAK2B;AAJvB,iHAAA,cAAc,OAAA;AACd,sHAAA,mBAAmB,OAAA;AACnB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA","sourcesContent":["export { ResolvedConfig, ResolvedRuleConfig, RuleOptions } from './types';\nexport { InformAiError } from './inform-ai-error';\nexport { RuleFailError } from './rule-fail-error';\nexport { CliExitError } from './cli-exit-error';\nexport { CliUsage, CliFlag, CliArgSet, CliArgsCheck, CliArgs } from './cli-args';\nexport { runMain } from './run-main';\nexport { toError } from './to-error';\nexport { loadAndValidate, LoadedConfig, ConfigLoader } from './load-config';\n// The validation-failure banner: ONE cure (edit the file), plus the marker phrases the validator\n// messages embed rather than re-type.\nexport {\n    formatConfigErrorsBanner,\n    CONFIG_POLICY_DOC,\n    RETIRED_KEY_MARKER,\n    RETIRED_TOP_LEVEL_MARKER,\n    SECTION_PLACEMENT_MARKER,\n} from './config-error-banner';\nexport { findConfigFile, CONFIG_FILENAME, ConfigFile, ConfigParseAttempt, CONFIG_PARSE_ATTEMPTS, CONFIG_PARSE_RETRY_MILLIS } from './config-file';\n// The PARSED-BUT-UNVALIDATED config shape. Exported for readers that walk the file generically rather\n// than through the typed config (the pr-gate active-hatch dashboard section reads every rule's hatches).\nexport type { RawConfigFile } from './config-file';\nexport { RepoRootFinder, INSTRUCT_AI_DIR, INSTRUCT_AI_LEAF } from './repo-root';\n// The scoped `.webpieces` resolver. EVERY reader/writer of `.webpieces/...` goes through one of its two\n// named methods so the call site declares whether the state is repo-wide or worktree-private.\nexport { DotWebpieces, dotWebpieces, GitDirs, WORKTREE_STATE_DIR, LOGS_STATE_DIR } from './state-dir';\nexport { StateDirMigrator, StateMigrationReport } from './state-dir-migration';\n// There is NO machine-global state root. `MachineStateHome`/`StateHome`/`WEBPIECES_STATE_HOME` and the\n// `PrBodyStore` that used them are DELETED: the one artifact that needed a scope above the clone was the\n// gated squash body, and GitHub holds it now (it IS the PR description). Every `.webpieces` path a\n// webpieces tool writes is `{repo}/.webpieces`, resolved through `DotWebpieces` above. See\n// `decisions/0005-the-pr-description-is-the-merge-body.md`.\nexport { AgedTreeSweeper, SweepCount, RETENTION_DAYS } from './aged-tree-sweep';\nexport { ClaudeEnv, claudeEnv, CLAUDE_PROJECT_DIR_ENV, CLAUDE_PROJECT_DIR_UNSET } from './claude-env';\nexport { AtomicFile } from './atomic-file';\n// The ONE formatter for a remedy that must run in a named directory: `cd '<root>' && <command>`.\n// Single-quoted so a repo path containing a space is still runnable (and still un-smuggleable).\nexport { atRoot } from './at-root';\nexport { RulesConfigDesign } from './rules-config-design';\nexport { DocumentDesign, isDocumentDesign, DESIGN_METADATA_KEYS } from './di';\nexport { ExcludePaths } from './exclude-hook-paths';\nexport { isPathExcluded, matchesAnyGlob } from './exclude-paths';\nexport { defaultRules, defaultRulesDir } from './default-rules';\nexport { loadTemplate, writeTemplateIfMissing, writeTemplate, TemplateWriter } from './load-template';\nexport { validateWebpiecesConfig, validatePrGateSection, validateChecklistsSection, validateSectionPlacement, validateExcludePaths, validateMatchRulesSection, allRuleNames, recommendedSeedMode, recommendedSeedModeFor, seedEntryForRule } from './validate-config';\nexport { validateCommandsSection } from './commands-section-validators';\nexport { unknownKeyErrors, isCommentKey, validateTopLevelKeys, COMMENT_KEY_SUFFIX } from './config-key-rules';\n// The retired-key table + the no-back-compat policy it enforces. Exported so the installer can migrate\n// what the errors instruct, and so consumers can enumerate retirements.\nexport { RETIRED_CONFIG_KEYS, RETIRED_SCOPE_KEY, RETIRED_SCOPE_RULE, RetiredConfigKey, isRetiredKey, retiredEntry, retiredKeyError, retiredKeyErrorsIn, retiredRuleFor } from './retired-config-keys';\n// The MECHANICAL cure the unknown-rule error and the banner both name: strip every key no validator has a\n// schema for, so cleanliness is one command rather than a judgement call made while every Bash call is\n// blocked. `PRUNE_UNKNOWN_COMMAND` (constants.ts) is the single spelling of that command.\nexport { ConfigPruner, PruneResult, PrunedKey } from './config-pruner';\nexport { validateChecklistDocs } from './checklist-docs-validator';\n// EXPERIMENTAL, and deliberately NOT an advertised knob. The OPTIONAL machine-local `~/.webpieces/config.json`:\n// absent (the normal state for every consumer) means all-defaults, silently; present means strictly validated,\n// with its own retirement table. `isHomeConfigPath` is what grants the file its unconditional Write/Edit PASS\n// in the hook guards, which is what keeps a rejection repairable.\nexport {\n    HomeConfig, HomeConfigService, RetiredHomeConfigKey, RETIRED_HOME_CONFIG_KEYS,\n    HOME_CONFIG_DIR, HOME_CONFIG_FILE, HOME_EXPERIMENTAL_SECTION, HOME_KEY_BUILD_GATE_LOG_CAPTURE,\n} from './home-config';\nexport {\n    MatchRuleConfig,\n    MatchRuleViolation,\n    findMatchRuleViolations,\n    isMatchRuleAllowedPath,\n    compileMatchRulePatterns,\n    renderMatchRuleMessage,\n    DEFAULT_MATCH_RULES,\n} from './match-rules-config';\nexport type { ConfigSection } from './sections';\nexport { schemaFieldNames } from './rule-schemas';\nexport { HOOK_GUARD_NAMES, BRANCH_STATE_GUARD_KEY, PR_LIFECYCLE_GUARD_KEY, isHookGuard, sectionForRule } from './sections';\nexport { FieldDef } from './field-def';\nexport type { SchemaShape } from './field-def';\nexport { shouldSkipRule, getCurrentBranch } from './skip-rule';\nexport { SkipRuleResult } from './skip-rule';\nexport {\n    detectBase,\n    resolveBase,\n    getChangedFiles,\n    getFileDiff,\n    getChangedLineNumbers,\n    findNewMethodSignaturesInDiff,\n    hasChangesInRange,\n    isNewOrModified,\n    DiffScope,\n    DiffRange,\n    ChangedFilesOptions,\n} from './diff-scope';\nexport { AbstractRule } from './abstract-rule';\nexport {\n    WEBPIECES_DISABLE,\n    RULE_NAMES,\n    hasDisable,\n    WEBPIECES_TMP_DIR,\n    MERGE_INFO_DIR,\n    PR_REVIEW_DIR,\n    MERGE_IN_PROGRESS_FILE,\n    MERGE_EXPLANATION_FILE,\n    PUSH_DEV_STATE_FILE,\n    PRUNE_UNKNOWN_COMMAND,\n} from './constants';\nexport { WebpiecesRulesConfig } from './WebpiecesRulesConfig';\nexport {\n    SyncFlowGuidance,\n    WP_START_UPDATE,\n    WP_FINISH_UPDATE,\n    WP_START_UPSERT_PR,\n    WP_FINISH_UPSERT_PR,\n    WP_PUSH_DEV,\n    WP_FINISH_PUSH_DEV,\n} from './sync-flow-guidance';\nexport {\n    MaxMethodLinesConfig,\n    MaxFileLinesConfig,\n    RequireReturnTypeConfig,\n    NoInlineTypeLiteralsConfig,\n    NoAnyUnknownConfig,\n    NoImplicitAnyConfig,\n    PrismaValidateDtosConfig,\n    PrismaConverterConfig,\n    NoDestructureConfig,\n    NoUnmanagedExceptionsConfig,\n    CatchErrorPatternConfig,\n    ThrowCauseRequiredConfig,\n    AngularNoDirectApiInResolverConfig,\n    NoSymbolDiTokensConfig,\n    NoCustomCssConfig,\n    NoProcessExitOutsideMainConfig,\n    NoFunctionOutsideClassConfig,\n    InjectAnnotationNotNeededForConcreteClassConfig,\n    FrameworkTagConfig,\n    RoleTagConfig,\n    BranchCreationGuardConfig,\n    PrLifecycleGuardConfig,\n    NoFileImportCyclesConfig,\n    RuntimeArchitectureConfig,\n    NxWiringConfig,\n    DiGraphConfig,\n    NoJsFilesConfig,\n    ValidateTsInSrcConfig,\n    ValidateArchitectureUnchangedConfig,\n    ValidateNoArchitectureCyclesConfig,\n    ValidatePackageJsonConfig,\n    ValidateVersionsLockedConfig,\n    ValidateEslintSyncConfig,\n    BaseRuleConfig,\n} from './rule-configs';\n// Mode unions + their value arrays — the single source of truth shared with code-rules.\nexport {\n    METHOD_LIMIT_MODES,\n    FILE_LIMIT_MODES,\n    RETURN_TYPE_MODES,\n    INLINE_TYPE_MODES,\n    MODIFIED_CODE_MODES,\n    PROJECT_MODES,\n    PRISMA_DTOS_MODES,\n    PRISMA_CONVERTER_MODES,\n    DIRECT_API_RESOLVER_MODES,\n    THROW_CAUSE_MODES,\n    ON_OFF_MODES,\n    STRUCTURAL_MODES,\n    VALIDATE_TS_MODES,\n} from './rule-configs';\nexport {\n    NoClientCreationOutsideServerOrClientConfig,\n    CLIENT_CREATION_SEVERITIES,\n} from './no-client-creation-config';\nexport type { ClientCreationSeverity } from './no-client-creation-config';\nexport type {\n    MethodLimitMode,\n    FileLimitMode,\n    ReturnTypeMode,\n    InlineTypeMode,\n    ModifiedCodeMode,\n    ProjectMode,\n    PrismaValidateDtosMode,\n    PrismaConverterMode,\n    DirectApiResolverMode,\n    ThrowCauseMode,\n    OnOffMode,\n    StructuralMode,\n    ValidateTsMode,\n} from './rule-configs';\nexport {\n    BranchStateGuardConfig,\n} from './main-sync-guard-configs';\nexport {\n    GateDefinition,\n    PrGateConfig,\n    DEFAULT_BUILD_COMMAND,\n    LandPrConfig,\n    DevDeployConfig,\n    DEFAULT_DEV_BRANCH_NAMESPACE,\n    DEFAULT_DEV_BRANCH,\n    ReviewContextEntry,\n    defaultGates,\n    defaultPrGateConfig,\n    defaultLandPrConfig,\n    defaultDevDeployConfig,\n    buildPrGateConfig,\n    buildLandPrConfig,\n    buildDevDeployConfig,\n    MERGE_MODE_AUTO,\n    MERGE_MODE_NONE,\n    MERGE_MODES,\n} from './pr-gate-config';\nexport {\n    ChecklistDefinition,\n    toChecklist,\n    normalizeChecklistDoc,\n    formatFileList,\n} from './checklist-config';\nexport type { RawChecklistItem } from './checklist-config';\nexport { ChecklistValidator } from './checklist-validator';\nexport { ChecklistInstructionsService } from './checklist-instructions';\nexport {\n    ReviewerInstructionsService,\n    ReviewerBriefing,\n    BriefedFile,\n    ContextEntry,\n    READ_TRUNCATION_LINES,\n    ALL_DIFF_ONE_READ_LINES,\n} from './reviewer-instructions';\nexport {\n    GateTokenService,\n    computeGateToken,\n    gateTokenMarker,\n    extractGateToken,\n    verifyGateToken,\n} from './gate-token';\nexport {\n    SubagentProvenanceService,\n    ReviewerEvidence,\n    ReviewerContext,\n    TranscriptScan,\n    ProvenanceResult,\n    PROVENANCE_OK,\n    PROVENANCE_MISSING,\n    PROVENANCE_SKIPPED,\n} from './subagent-provenance';\nexport {\n    ReviewProvenanceService,\n    ReviewProvenance,\n    ReviewerTranscript,\n    ReviewerPaths,\n    OfferedContext,\n    ProvenanceWriteRequest,\n    DEFAULT_RETENTION_DAYS,\n} from './review-provenance';\nexport {\n    ReviewJson,\n    PrContext,\n    ChecklistResult,\n    ChecklistVerdict,\n    CK_PASS,\n    CK_WARN,\n    CK_OVERRIDDEN,\n    CK_FAIL,\n    CK_MISSING,\n    CK_BAD_FORMAT,\n    VERDICT_GREEN,\n    VERDICT_YELLOW,\n    VERDICT_RED,\n    VERDICT_STATUSES,\n    RequiredChecklist,\n    ChecklistReviewContext,\n    ReviewJsonService,\n    loadReviewJson,\n    prDirFor,\n    reviewJsonPath,\n    reviewJsonSchemaHint,\n} from './review-json';\nexport {\n    MainSyncStatus,\n    MainSyncStatusFile,\n    MainSyncFileStore,\n    PullRequestIndex,\n    MAIN_SYNC_STATUS_VERSION,\n} from './main-sync-file';\nexport {\n    MainSyncLock,\n    MainSyncStatusService,\n    DEFAULT_HANG_TIMEOUT_MINUTES,\n    mainSyncStatusPath,\n    mainSyncLockPath,\n    readMainSyncStatus,\n    readMainSyncStatusFile,\n    writeMainSyncStatus,\n    writeMainSyncStatusFile,\n    computeAllMainSyncStatuses,\n    readMainSyncLock,\n    writeMainSyncLock,\n    isLockStale,\n    isRefreshInProgress,\n    tryAcquireMainSyncLock,\n    inProcessLock,\n    finishedLock,\n    computeMainSyncStatus,\n    stampCleanMainSyncStatus,\n    squashRecoverySteps,\n} from './main-sync-status';\nexport {\n    MergedBranch,\n    DeletableBranch,\n    DeletableWorktree,\n    MergedBranchesCache,\n    MergedBranchesService,\n    CacheFreshness,\n    CACHE_STALE_AFTER_MS,\n    CLASSIFICATION_MERGED_PR,\n    CLASSIFICATION_BACKUP_OF_MERGED,\n    CLASSIFICATION_BACKUP_OF_LIVE,\n    CLASSIFICATION_NO_COMMITS,\n    CLASSIFICATION_SUPERSEDED,\n    CLASSIFICATION_CONTENT_IN_MAIN,\n    CLASSIFICATION_NEVER_PROPOSED,\n    CLASSIFICATION_IN_USE,\n    CLASSIFICATION_PRUNABLE,\n    CLASSIFICATION_LOCKED,\n    CLASSIFICATION_CURRENT,\n    CLASSIFICATION_DETACHED,\n    PROMPTABLE_CLASSIFICATIONS,\n} from './merged-branches';\nexport {\n    BranchArchiver,\n    ArchiveResult,\n    ARCHIVE_TAG_PREFIX,\n    BRANCH_RETENTIONS,\n    BRANCH_RETENTION_DELETE,\n    BRANCH_RETENTION_ARCHIVE_TAG,\n    BRANCH_RETENTION_KEEP,\n} from './branch-archiver';\nexport {\n    Worktree,\n    WorktreeService,\n} from './worktrees';\nexport {\n    ReapedBranch,\n    ReapResult,\n    BranchReaper,\n} from './branch-reaper';\nexport {\n    ReapedWorktree,\n    WorktreeReapResult,\n    WorktreeReaper,\n} from './worktree-reaper';\nexport type { MutationVerb, MutationPhase } from './branch-mutation-log';\nexport {\n    BranchMutationEvent,\n    BranchMutationLog,\n    branchMutationLogPath,\n    logBranchMutation,\n} from './branch-mutation-log';\nexport {\n    CommandsConfig,\n    buildCommandsConfig,\n    DEFAULT_UPSERT_PR_COMMAND,\n    DEFAULT_MERGE_COMPLETE_COMMAND,\n} from './commands-config';\n"]}

package/src/rule-configs.js

@@ -47,6 +47,10 @@ exports.STRUCTURAL_MODES = ['OFF', 'RUN_EVERY_TIME'];
 //   turnOffRuleUntilEpoch:    0 = rule active (epoch in the past); a future unix epoch IN SECONDS =
 //                             temporarily disabled until that moment.
 //   turnOffRuleWhileOnBranch: null = always on; a branch name = disabled while that branch is checked out.
+//                             The name is matched EXACTLY (===). Globs/wildcards are NOT supported and
+//                             must not be added: a pattern would switch a rule off on branches nobody
+//                             enumerated. It is also ignored (loudly — shouldSkipRule throws) on a pull
+//                             request from a FORK, where the branch name is the contributor's to choose.
 //                             Required-but-nullable so its "unset" state is present-and-visible (null)
 //                             rather than omitted.
 // The earlier spellings of these two fields were RENAMED to the names above and are no longer accepted —

package/src/rule-configs.js.map

@@ -1 +1 @@
-{"version":3,"file":"rule-configs.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/rule-configs.ts"],"names":[],"mappings":";;;AAAA,2CAAoD;AAEpD,kFAAkF;AAClF,yFAAyF;AAEzF,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,qDAAqD;AACxC,QAAA,kBAAkB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG3G,QAAA,gBAAgB,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAU,CAAC;AAG9D,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG1G,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG1G,QAAA,mBAAmB,GAAG,CAAC,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,CAAU,CAAC;AAGvG,iGAAiG;AACjG,gGAAgG;AAChG,8EAA8E;AACjE,QAAA,aAAa,GAAG,CAAC,KAAK,EAAE,mBAAmB,CAAU,CAAC;AAGtD,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,CAAU,CAAC;AAGjF,QAAA,sBAAsB,GAAG,CAAC,KAAK,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAGhG,QAAA,yBAAyB,GAAG,CAAC,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG5H,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,uBAAuB,CAAU,CAAC;AAG9D,QAAA,YAAY,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAGnD,uFAAuF;AACvF,2FAA2F;AAC3F,+FAA+F;AAC/F,wDAAwD;AAC3C,QAAA,kBAAkB,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAU,CAAC;AAGjE,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAU,CAAC;AAG5E,gGAAgG;AAChG,kGAAkG;AAClG,gGAAgG;AAChG,uFAAuF;AAC1E,QAAA,gBAAgB,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAU,CAAC;AAGnE,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,oCAAoC;AACpC,oGAAoG;AACpG,sEAAsE;AACtE,2GAA2G;AAC3G,uGAAuG;AACvG,mDAAmD;AACnD,yGAAyG;AACzG,wGAAwG;AACxG,sGAAsG;AACtG,8EAA8E;AAC9E,MAAsB,cAAc;IAChC,0FAA0F;IAC1F,8FAA8F;IAC9F,+CAA+C;IAC/C,IAAI,CAAU;IACd,mGAAmG;IACnG,mEAAmE;IACnE,qBAAqB,CAAU;IAC/B,wBAAwB,CAAiB;CAC5C;AATD,wCASC;AAEY,QAAA,gBAAgB,GAAG;IAC5B,qBAAqB,EAAE,IAAI,oBAAQ,CAAC,QAAQ,CAAC;IAC7C,wBAAwB,EAAE,oBAAQ,CAAC,cAAc,EAAE;CACtD,CAAC;AAEF,MAAa,oBAAqB,SAAQ,cAAc;IAEpD,KAAK,CAAU;IACf,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAsC;QACxD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,0BAAkB,CAAC;QAChD,KAAK,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,oDAWC;AAED,MAAa,kBAAmB,SAAQ,cAAc;IAElD,KAAK,CAAU;IACf,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,KAAK,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,gDAWC;AAED,MAAa,uBAAwB,SAAQ,cAAc;IAEvD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAyC;QAC3D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,0DASC;AAED,MAAa,0BAA2B,SAAQ,cAAc;IAE1D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA4C;QAC9D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,gEASC;AAED,MAAa,kBAAmB,SAAQ,cAAc;IAElD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,gDASC;AAED,MAAa,mBAAoB,SAAQ,cAAc;IAEnD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAqC;QACvD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,kDASC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IACzB,gBAAgB,CAAU;IAC1B,cAAc,CAAY;IAE1B,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7C,GAAG,wBAAgB;KACtB,CAAC;;AAZN,4DAaC;AAED,MAAa,qBAAsB,SAAQ,cAAc;IAErD,cAAc,CAAW;IACzB,UAAU,CAAU;IACpB,eAAe,CAAY;IAC3B,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAuC;QACzD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,8BAAsB,CAAC;QACpD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAdN,sDAeC;AAED,kGAAkG;AAClG,qGAAqG;AACrG,mGAAmG;AACnG,gGAAgG;AAChG,MAAa,mBAAoB,SAAQ,cAAc;IAEnD,aAAa,CAAW;IACxB,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAqC;QACvD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAZN,kDAaC;AAED,MAAa,2BAA4B,SAAQ,cAAc;IAE3D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA6C;QAC/D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,kEASC;AAED,MAAa,uBAAwB,SAAQ,cAAc;IAEvD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAyC;QAC3D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,0DASC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,4DASC;AAED,MAAa,kCAAmC,SAAQ,cAAc;IAElE,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAoD;QACtE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,iCAAyB,CAAC;QACvD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,gFAWC;AAED,mGAAmG;AACnG,sGAAsG;AACtG,sGAAsG;AACtG,MAAa,iBAAkB,SAAQ,cAAc;IAEjD,cAAc,CAAW;IACzB,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAAmC;QACrD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AAVN,8CAWC;AAED,MAAa,sBAAuB,SAAQ,cAAc;IAEtD,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAwC;QAC1D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,wDAWC;AAED,oGAAoG;AACpG,iGAAiG;AACjG,6FAA6F;AAC7F,8FAA8F;AAC9F,MAAa,8BAA+B,SAAQ,cAAc;IAE9D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAgD;QAClE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,wEASC;AAED,qGAAqG;AACrG,6FAA6F;AAC7F,qGAAqG;AACrG,yGAAyG;AACzG,sGAAsG;AACtG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,8FAA8F;AAC9F,MAAa,4BAA6B,SAAQ,cAAc;IAE5D,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAA8C;QAChE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,oEAWC;AAED,kGAAkG;AAClG,uGAAuG;AACvG,sGAAsG;AACtG,sGAAsG;AACtG,uGAAuG;AACvG,oGAAoG;AACpG,wGAAwG;AACxG,oGAAoG;AACpG,wGAAwG;AACxG,qEAAqE;AACrE,MAAa,+CAAgD,SAAQ,cAAc;IAE/E,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAiE;QACnF,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,0GAWC;AAED,qFAAqF;AACrF,kGAAkG;AAClG,iGAAiG;AACjG,mGAAmG;AACnG,iGAAiG;AACjG,sGAAsG;AACtG,MAAa,kBAAmB,SAAQ,cAAc;IAElD,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,qBAAa,CAAC;QAC3C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AARN,gDASC;AAED,8EAA8E;AAC9E,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAClG,0FAA0F;AAC1F,kFAAkF;AAClF,MAAa,aAAc,SAAQ,cAAc;IAE7C,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAA+B;QACjD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,qBAAa,CAAC;QAC3C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AARN,sCASC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAEzD,6FAA6F;IAC7F,6EAA6E;IAC7E,eAAe,CAAU;IACzB,6FAA6F;IAC7F,4FAA4F;IAC5F,YAAY,CAAU;IACtB,kGAAkG;IAClG,+FAA+F;IAC/F,6FAA6F;IAC7F,qFAAqF;IACrF,gBAAgB,CAAU;IAC1B,4FAA4F;IAC5F,+FAA+F;IAC/F,8FAA8F;IAC9F,kFAAkF;IAClF,YAAY,CAAU;IACtB,yFAAyF;IACzF,mGAAmG;IACnG,4CAA4C;IAC5C,+FAA+F;IAC/F,2FAA2F;IAC3F,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,uBAAuB;IACvB,sBAAsB,CAAW;IAEjC,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,0BAAkB,CAAC;QAChD,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,sBAAsB,EAAE,IAAI,oBAAQ,CAAC,SAAS,CAAC;QAC/C,GAAG,wBAAgB;KACtB,CAAC;;AAxCN,8DAyCC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAa,sBAAuB,SAAQ,cAAc;IAGtD,MAAM,CAAU,MAAM,GAAwC;QAC1D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,oBAAY,CAAC;QAC1C,GAAG,wBAAgB;KACtB,CAAC;;AANN,wDAOC;AAED,oGAAoG;AACpG,yGAAyG;AACzG,wGAAwG;AACxG,sGAAsG;AACtG,2FAA2F;AAE3F,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IACzB,eAAe,CAAY;IAC3B,0FAA0F;IAC1F,kGAAkG;IAClG,6FAA6F;IAC7F,kGAAkG;IAClG,8FAA8F;IAC9F,yFAAyF;IACzF,oFAAoF;IACpF,aAAa,CAAY;IAEzB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAnBN,4DAoBC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAEzD,kGAAkG;IAClG,0FAA0F;IAC1F,oGAAoG;IACpG,kGAAkG;IAClG,0CAA0C;IAC1C,aAAa,CAAY;IACzB;;;;;OAKG;IACH,iBAAiB,CAAW;IAC5B;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAY;IAE5B,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5C,iBAAiB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/C,GAAG,wBAAgB;KACtB,CAAC;;AAnCN,8DAoCC;AAED,MAAa,cAAe,SAAQ,cAAc;IAG9C,MAAM,CAAU,MAAM,GAAgC;QAClD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,wCAOC;AAED,MAAa,aAAc,SAAQ,cAAc;IAK7C,MAAM,CAAU,MAAM,GAA+B;QACjD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AARN,sCASC;AAED,MAAa,6BAA8B,SAAQ,cAAc;IAK7D,MAAM,CAAU,MAAM,GAA+C;QACjE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AARN,sEASC;AAED,MAAa,eAAgB,SAAQ,cAAc;IAI/C,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAiC;QACnD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,0CAWC;AAED,8EAA8E;AAC9E,yFAAyF;AACzF,qGAAqG;AACrG,iGAAiG;AACjG,kGAAkG;AAClG,EAAE;AACF,qGAAqG;AACrG,wEAAwE;AACxE,sGAAsG;AACtG,iGAAiG;AACjG,qGAAqG;AACrG,uGAAuG;AACvG,yFAAyF;AACzF,8EAA8E;AAE9E,MAAa,mCAAoC,SAAQ,cAAc;IAGnE,MAAM,CAAU,MAAM,GAAqD;QACvE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,kFAOC;AAED,MAAa,kCAAmC,SAAQ,cAAc;IAGlE,MAAM,CAAU,MAAM,GAAoD;QACtE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,gFAOC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAGzD,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,8DAOC;AAED,MAAa,4BAA6B,SAAQ,cAAc;IAG5D,MAAM,CAAU,MAAM,GAA8C;QAChE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,oEAOC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAGxD,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,4DAOC;AAED,MAAa,qBAAsB,SAAQ,cAAc;IAErD,gBAAgB,CAAY;IAC5B,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAuC;QACzD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,sDAWC","sourcesContent":["import { FieldDef, SchemaShape } from './field-def';\n\n// Mode const arrays — TypeScript union types derived from them, and FieldDef enum\n// values reference the same array. Impossible for the type and runtime check to diverge.\n\n// Single source of truth for rule \"mode\" values. Exported so code-rules (and any other\n// consumer) imports these instead of re-declaring the same unions — a rename here ripples\n// everywhere at compile time. The FieldDef SCHEMA below references the same arrays, so the\n// type and the runtime validation can never diverge.\nexport const METHOD_LIMIT_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type MethodLimitMode = typeof METHOD_LIMIT_MODES[number];\n\nexport const FILE_LIMIT_MODES = ['OFF', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type FileLimitMode = typeof FILE_LIMIT_MODES[number];\n\nexport const RETURN_TYPE_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ReturnTypeMode = typeof RETURN_TYPE_MODES[number];\n\nexport const INLINE_TYPE_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type InlineTypeMode = typeof INLINE_TYPE_MODES[number];\n\nexport const MODIFIED_CODE_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ModifiedCodeMode = typeof MODIFIED_CODE_MODES[number];\n\n// PROJECT-level rules (e.g. framework-tag): the check is neither line- nor file-scoped — it runs\n// for a whole project when ANY file the project owns is touched. `MODIFIED_PROJECTS` names that\n// honestly (nx `affected` already narrows execution to the changed projects).\nexport const PROJECT_MODES = ['OFF', 'MODIFIED_PROJECTS'] as const;\nexport type ProjectMode = typeof PROJECT_MODES[number];\n\nexport const PRISMA_DTOS_MODES = ['OFF', 'MODIFIED_CLASS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type PrismaValidateDtosMode = typeof PRISMA_DTOS_MODES[number];\n\nexport const PRISMA_CONVERTER_MODES = ['OFF', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type PrismaConverterMode = typeof PRISMA_CONVERTER_MODES[number];\n\nexport const DIRECT_API_RESOLVER_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type DirectApiResolverMode = typeof DIRECT_API_RESOLVER_MODES[number];\n\nexport const THROW_CAUSE_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE'] as const;\nexport type ThrowCauseMode = typeof THROW_CAUSE_MODES[number];\n\nexport const ON_OFF_MODES = ['ON', 'OFF'] as const;\nexport type OnOffMode = typeof ON_OFF_MODES[number];\n\n// branch-creation-guard modes. ON_NO_SUBBRANCHES is the strict variant: it hard-blocks\n// creating a branch off any non-main branch (no sub-branch affordance), pointing the agent\n// back to `git checkout main && git pull && git checkout -b <branch>`. Temporarily overridable\n// via the universal turnOffRuleUntilEpoch escape hatch.\nexport const BRANCH_GUARD_MODES = ['ON', 'OFF', 'ON_NO_SUBBRANCHES'] as const;\nexport type BranchGuardMode = typeof BRANCH_GUARD_MODES[number];\n\nexport const VALIDATE_TS_MODES = ['OFF', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ValidateTsMode = typeof VALIDATE_TS_MODES[number];\n\n// Structural / whole-graph rules (import-cycle, runtime-architecture, nx-wiring). They can't be\n// scoped to changed lines/files — a cycle or wiring break can route through a project that wasn't\n// itself edited — so when active they run the FULL check every time (nx-affected already limits\n// them to affected projects externally). RUN_EVERY_TIME replaces the old, vaguer \"ON\".\nexport const STRUCTURAL_MODES = ['OFF', 'RUN_EVERY_TIME'] as const;\nexport type StructuralMode = typeof STRUCTURAL_MODES[number];\n\n// ---------------------------------------------------------------------------\n// Universal escape hatches — EVERY rule supports temporarily disabling itself\n// either while on a named git branch (turnOffRuleWhileOnBranch) or until an\n// epoch passes (turnOffRuleUntilEpoch). They live on a shared base class so the\n// fields (and their schema entries) are declared once instead of repeated per\n// rule. `mode` stays per-rule because its allowed values vary (ON/OFF vs\n// NEW_AND_MODIFIED_CODE vs NEW_AND_MODIFIED_METHODS, etc).\n//\n// BOTH fields are REQUIRED on every rule so both hatches are ALWAYS VISIBLE in the config — an AI\n// editing webpieces.config.json sees them on every rule and cannot miss that a rule can be time-boxed\n// or branch-scoped off. Convention:\n//   turnOffRuleUntilEpoch:    0 = rule active (epoch in the past); a future unix epoch IN SECONDS =\n//                             temporarily disabled until that moment.\n//   turnOffRuleWhileOnBranch: null = always on; a branch name = disabled while that branch is checked out.\n//                             Required-but-nullable so its \"unset\" state is present-and-visible (null)\n//                             rather than omitted.\n// The earlier spellings of these two fields were RENAMED to the names above and are no longer accepted —\n// the validator rejects them with a \"renamed to X\" hint. RENAMED_FIELD_ALIASES in validate-config.ts is\n// the ONE place in src/ a dead spelling may still be written (see escape-hatch-key-spelling.spec.ts).\n// ---------------------------------------------------------------------------\nexport abstract class BaseRuleConfig {\n    // `mode` is declared here (loosely typed) so the shared AbstractRule base can read it for\n    // on/off. Each concrete *Config narrows it to its own union (e.g. `mode?: ModifiedCodeMode`),\n    // which is an assignable (covariant) override.\n    mode?: string;\n    // TS-optional, but schema-REQUIRED (see BASE_RULE_SCHEMA) — same split as `mode`. Read directly by\n    // AbstractRule.shouldRun, RuleGate, and the code-rules validators.\n    turnOffRuleUntilEpoch?: number;\n    turnOffRuleWhileOnBranch?: string | null;\n}\n\nexport const BASE_RULE_SCHEMA = {\n    turnOffRuleUntilEpoch: new FieldDef('number'),\n    turnOffRuleWhileOnBranch: FieldDef.nullableString(),\n};\n\nexport class MaxMethodLinesConfig extends BaseRuleConfig {\n    declare mode?: MethodLimitMode;\n    limit?: number;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<MaxMethodLinesConfig> = {\n        mode: new FieldDef('string', METHOD_LIMIT_MODES),\n        limit: FieldDef.optional('number'),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class MaxFileLinesConfig extends BaseRuleConfig {\n    declare mode?: FileLimitMode;\n    limit?: number;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<MaxFileLinesConfig> = {\n        mode: new FieldDef('string', FILE_LIMIT_MODES),\n        limit: FieldDef.optional('number'),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class RequireReturnTypeConfig extends BaseRuleConfig {\n    declare mode?: ReturnTypeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<RequireReturnTypeConfig> = {\n        mode: new FieldDef('string', RETURN_TYPE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoInlineTypeLiteralsConfig extends BaseRuleConfig {\n    declare mode?: InlineTypeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoInlineTypeLiteralsConfig> = {\n        mode: new FieldDef('string', INLINE_TYPE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoAnyUnknownConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoAnyUnknownConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoImplicitAnyConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoImplicitAnyConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class PrismaValidateDtosConfig extends BaseRuleConfig {\n    declare mode?: PrismaValidateDtosMode;\n    disableAllowed?: boolean;\n    prismaSchemaPath?: string;\n    dtoSourcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<PrismaValidateDtosConfig> = {\n        mode: new FieldDef('string', PRISMA_DTOS_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        prismaSchemaPath: FieldDef.optional('string'),\n        dtoSourcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class PrismaConverterConfig extends BaseRuleConfig {\n    declare mode?: PrismaConverterMode;\n    disableAllowed?: boolean;\n    schemaPath?: string;\n    convertersPaths?: string[];\n    enforcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<PrismaConverterConfig> = {\n        mode: new FieldDef('string', PRISMA_CONVERTER_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        schemaPath: FieldDef.optional('string'),\n        convertersPaths: FieldDef.optional('string[]'),\n        enforcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// `allowedPaths` exempts whole file trees whose idioms are destructuring by construction (React /\n// React Native components and hooks — `const [x, setX] = useState()`, destructured props — framework\n// glue), matched with the shared glob/prefix/segment semantics of `isPathExcluded`. It is the ONLY\n// escape when `disableAllowed: false`, since that setting deliberately ignores inline disables.\nexport class NoDestructureConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    allowTopLevel?: boolean;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoDestructureConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        allowTopLevel: FieldDef.optional('boolean'),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoUnmanagedExceptionsConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoUnmanagedExceptionsConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class CatchErrorPatternConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<CatchErrorPatternConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ThrowCauseRequiredConfig extends BaseRuleConfig {\n    declare mode?: ThrowCauseMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<ThrowCauseRequiredConfig> = {\n        mode: new FieldDef('string', THROW_CAUSE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class AngularNoDirectApiInResolverConfig extends BaseRuleConfig {\n    declare mode?: DirectApiResolverMode;\n    disableAllowed?: boolean;\n    enforcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<AngularNoDirectApiInResolverConfig> = {\n        mode: new FieldDef('string', DIRECT_API_RESOLVER_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        enforcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Bans hand-written CSS in Angular sources (styles:/styleUrls:/styleUrl: in @Component, and inline\n// style=/[style.x]/[ngStyle] in templates) so teams style with Tailwind utility classes. `allowGlobs`\n// exempts paths WITHIN the Angular scope (e.g. a vendored Fuse kit copied verbatim with its own CSS).\nexport class NoCustomCssConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowGlobs?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoCustomCssConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowGlobs: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoSymbolDiTokensConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoSymbolDiTokensConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Flags `process.exit(...)` outside a main()/runMain wrapper (and `import { main }`) so a deep exit\n// can't silently kill a reused server/command. Gradual-rollout knobs via the standard base: mode\n// (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch, branch, and\n// disableAllowed for the inline `// webpieces-disable` escape at genuine terminal boundaries.\nexport class NoProcessExitOutsideMainConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoProcessExitOutsideMainConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Flags a function CREATED OUTSIDE A CLASS at module scope: a top-level `function foo()` declaration\n// or a top-level `const foo = () => {}` / `= function(){}`. The point is that webpieces DI +\n// @DocumentDesign only work when behavior lives in injectable classes — a module-scope function is a\n// dead-end the DI graph can't reach. Inline callbacks, nested functions inside methods, and non-function\n// top-level consts (objects, zod schemas, primitives) are NOT flagged. Standard rollout knobs via the\n// base: mode (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch, branch,\n// and disableAllowed for the inline `// webpieces-disable` escape. `allowedPaths` exempts whole file\n// trees that legitimately live outside the class-per-behavior model (e.g. React component/hook files,\n// framework glue), matched with the shared glob/prefix/segment semantics of `isPathExcluded`.\nexport class NoFunctionOutsideClassConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoFunctionOutsideClassConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// inject-annotation-not-needed-for-concrete-class — flags a REDUNDANT `@inject(X)` whose token is\n// textually identical to the parameter's own declared type (`@inject(Foo) private readonly foo: Foo`).\n// In this inversify setup the decorator is pure noise there: reflect-metadata (emitDecoratorMetadata)\n// already resolves a constructor parameter by its class type, so `private readonly foo: Foo` binds on\n// its own (see CLAUDE.md, and the no-symbol-di-tokens rule that pushes the same way). Symbol/interface\n// tokens are NOT flagged because they never equal the type (`@inject(FOO_TOKEN) x: Provider<Foo>`).\n// AI keeps carpet-bombing `@inject`; this fails the build on the redundant form. Standard rollout knobs\n// via the base: mode (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch,\n// branch, and disableAllowed for the inline `// webpieces-disable` escape. `allowedPaths` exempts whole\n// file trees, matched with the shared glob/prefix/segment semantics.\nexport class InjectAnnotationNotNeededForConcreteClassConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<InjectAnnotationNotNeededForConcreteClassConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// framework-tag — every project that a changed source file belongs to must carry >=1\n// `framework:<browser|react|angular|node|express>` nx tag in its project.json. Those tags are the\n// project's \"libType\" — the SET of runtime environments it runs in — and the source of truth for\n// the dependencies.json `framework` field and the `library-types-match-client` rule. Multiple tags\n// are allowed (the env set) and values are validated against the known set (`framework:all` is a\n// hard error). `knownTypes` customizes that set (defaults to browser, react, angular, node, express).\nexport class FrameworkTagConfig extends BaseRuleConfig {\n    declare mode?: ProjectMode;\n    knownTypes?: string[];\n\n    static readonly SCHEMA: SchemaShape<FrameworkTagConfig> = {\n        mode: new FieldDef('string', PROJECT_MODES),\n        knownTypes: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// role-tag — every project that a changed source file belongs to must carry a\n// `role:<server|designed-lib|lib|client>` nx tag in its project.json. That tag is the project's\n// ROLE (orthogonal to `framework` libType) — the source of truth for the dependencies.json `role`\n// field, the `role-dependency` edge rule (apps are never depended upon), and DI-design generation\n// (server→@Controller, designed-lib→@ApiImplementation, lib→none, client→angular design).\n// `knownTypes` customizes the list suggested to the author when a tag is missing.\nexport class RoleTagConfig extends BaseRuleConfig {\n    declare mode?: ProjectMode;\n    knownTypes?: string[];\n\n    static readonly SCHEMA: SchemaShape<RoleTagConfig> = {\n        mode: new FieldDef('string', PROJECT_MODES),\n        knownTypes: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class BranchCreationGuardConfig extends BaseRuleConfig {\n    declare mode?: BranchGuardMode;\n    // Naming pattern for stacked SUB-branches only (branches created off another feature branch,\n    // which require human approval). Never applied to branches created off main.\n    subBranchNaming?: string;\n    // Human-sentence instruction telling the AI how to name a NEW branch off main. Surfaced back\n    // to the agent in the guard's fix hints. May mirror no-edit-on-main.branchNamingConvention.\n    branchFormat?: string;\n    // Hard cap on local feature branches (excluding main). Creating one past the cap is BLOCKED until\n    // already-merged branches are reaped, which is what keeps the branch list from growing without\n    // bound. Branch creation is the gate because it is the only moment cleanup is both cheap and\n    // obviously worth it. See merged-branches.ts for how \"already merged\" is determined.\n    maxLocalBranches?: number;\n    // Hard cap on LINKED worktrees (the primary clone is never counted). A separate budget from\n    // maxLocalBranches: every worktree holds a branch, so if worktree-held branches also spent the\n    // branch budget, five worktrees would leave room for zero branches. Held branches count here;\n    // parked branches count against maxLocalBranches. Enforced at `git worktree add`.\n    maxWorktrees?: number;\n    // Let the detached background refresher DELETE dead branches on its own, instead of only\n    // reporting them. Every candidate is provably dead (a MERGED PR — its own, or the PR of the branch\n    // it snapshots; nothing else qualifies) and\n    // recoverable by the SHA logged to branch-mutations.log — but it is still UNATTENDED deletion,\n    // so this is schema-REQUIRED like `mode` and `turnOffRuleUntilEpoch`. \"Every built-in rule\n    // must be explicitly configured — no silent defaults\" (validate-config.ts) applies with extra\n    // force here: branches disappearing on a preference nobody ever stated is precisely the kind of\n    // default that must not exist. Validation makes each consumer answer the question once.\n    //\n    // TS-optional but schema-required — the same split `mode` uses. Absent at RUNTIME therefore means\n    // the config never passed validation, and the only safe reading of \"nobody has answered\" is: do\n    // not delete anything.\n    autoReapMergedBranches?: boolean;\n\n    static readonly SCHEMA: SchemaShape<BranchCreationGuardConfig> = {\n        mode: new FieldDef('string', BRANCH_GUARD_MODES),\n        subBranchNaming: FieldDef.optional('string'),\n        branchFormat: FieldDef.optional('string'),\n        maxLocalBranches: FieldDef.optional('number'),\n        maxWorktrees: FieldDef.optional('number'),\n        autoReapMergedBranches: new FieldDef('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n/**\n * `pr-lifecycle-guard` — ONE key, ONE policy: *PRs and merges go through the gated flow.*\n *\n * Four CLASSES implement it, and their names are unchanged (they are the operator identity every\n * decision-log line and every deny report carries):\n *\n *   pr-creation-or-push-guard  a manual `git push` / `gh pr create|edit` / a raw pulls API call\n *   merge-in-progress-guard    a PR command while a 3-point merge is half-finished\n *   pr-merge-guard             a bare `gh pr merge`\n *   redirect-how-to-merge-main \"how do I get main into my branch?\" → the documented flow\n *\n * ## Say this out loud: `\"mode\": \"OFF\"` releases the unvalidated-merge gate too\n *\n * Three of the four are pure COMMAND-SHAPE blocks and can never fire spuriously. The fourth,\n * merge-in-progress-guard, is STATE-conditional — it fires only while a 3-point merge is actually in\n * progress, and it is the one state L2 explicitly stands down for. So turning this key OFF to unblock\n * `gh pr merge` ALSO drops the \"you have an unfinished merge\" gate. That is the honest cost of one key\n * per policy, and it is stated here, in guards/L4-pr-lifecycle.md, and in the error path, rather than\n * being papered over with a granular sub-mode (which would be four knobs wearing one key's name).\n *\n * ## The command strings are NOT here\n *\n * `upsertPrCommand` and `mergeCompleteCommand` used to sit on the two guards, and — being read at the\n * point of use — they BEAT `commands.guardHints`, so `guardHintsWhy`'s claim that renaming a gated\n * command there makes \"every guard message follow\" was simply false. They are DELETED, not deprecated.\n * `commands.guardHints.prCreationOrPush` / `.mergeInProgress` is the one place those strings live, and\n * the loader hands the resolved values to the two rules directly. A consumer that still sets the old\n * per-guard field gets a RETIRED_FIELD_HINTS error naming the destination.\n */\nexport class PrLifecycleGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n\n    static readonly SCHEMA: SchemaShape<PrLifecycleGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// NOTE: there is deliberately no `WholeRepoBuildGuardConfig`. That guard is EXPERIMENTAL and has NO\n// webpieces.config.json entry — its only switch is `experimental.whole-repo-build-guard` in the optional\n// machine-local ~/.webpieces/config.json (see home-config.ts), and the affected-build command it prints\n// is handed to it directly from `commands.pr-gate.buildCommand` by ai-hook-rules' runner. Re-adding a\n// config class here puts the guard back in RULE_SCHEMAS and makes it a fault-Y rule again.\n\nexport class NoFileImportCyclesConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    ignoreTypeOnly?: boolean;\n    excludePackages?: string[];\n    // Raw regex escape hatch for a cycle inside the project being checked — generated code, a\n    // vendored tree, or a deliberate bidirectional domain model — that `excludePackages` cannot reach\n    // (it resolves npm package NAMES, so it only excludes a *sibling* package, never a directory\n    // inside this one). Patterns are handed to madge verbatim and matched against ids RELATIVE TO THE\n    // PROJECT (e.g. \"^src/generated/\", \"^src/modules/(item|category)/\") — NOT workspace-rooted or\n    // absolute, which silently match nothing. The executor warns when a pattern matches zero\n    // traversed files, so a mis-anchored pattern is visible rather than a silent no-op.\n    excludeRegExp?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoFileImportCyclesConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ignoreTypeOnly: FieldDef.optional('boolean'),\n        excludePackages: FieldDef.optional('string[]'),\n        excludeRegExp: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class RuntimeArchitectureConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    // NOTE: `servicePaths` / `apiProjectPaths` were removed — they were never read. The runtime graph\n    // is derived SOLELY from architecture/dependencies.json apiRelations + project roles (see\n    // nx-webpieces-rules/src/lib/runtime-graph.ts), so any config still listing them (a hand-maintained\n    // enumeration of api libs) now fails the unknown-field check in validateWebpiecesConfig. There is\n    // nothing to enumerate — delete the keys.\n    allowedCycles?: string[];\n    /**\n     * Draw a dashed terminal node for every contract a service calls that NOTHING in-repo\n     * implements (firestore, gmail, ...) — the vendor systems the runtime graph otherwise stops one\n     * hop short of. Defaults to true; set false in a repo whose external surface is noisy. Purely a\n     * RENDER switch: levels, cycle detection and runtime-dependencies.json are identical either way.\n     */\n    showExternalNodes?: boolean;\n    /**\n     * Project roots whose exported `*Api` types are contracts for systems OUTSIDE this repo\n     * (firestore, gmail, gcp-storage, ...), e.g. `[\"libraries/apis/external/**\"]`. Globs, matched\n     * against the nx project root.\n     *\n     * Needed because an external contract does NOT look like an in-repo one: it is a plain\n     * `interface` bound to a Symbol token and injected, never an `abstract class` carrying @ApiPath\n     * reached through `createRpcClient`. Without this list the scanner has no way to tell a vendor\n     * seam from any other library, so every call leaving the repo is invisible to the runtime graph.\n     *\n     * Defaults to none, which is correct for a repo with no vendor wrapper libraries.\n     */\n    externalApiPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<RuntimeArchitectureConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        allowedCycles: FieldDef.optional('string[]'),\n        showExternalNodes: FieldDef.optional('boolean'),\n        externalApiPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NxWiringConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<NxWiringConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class DiGraphConfig extends BaseRuleConfig {\n    // Structural: the DI graph is regenerated whole-project on every build (generate +\n    // unchanged gate), so it cannot be scoped to changed lines.\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<DiGraphConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class MissingDesignAnnotationConfig extends BaseRuleConfig {\n    // Structural: enforced per-project by the di-graph-generate executor, which\n    // roots the whole DI design on @DocumentDesign classes — cannot be line-scoped.\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<MissingDesignAnnotationConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoJsFilesConfig extends BaseRuleConfig {\n    // File-tier: NEW_AND_MODIFIED_FILES (active) intercepts a .js/.jsx Write — the file being\n    // written is inherently a new/modified file, so it's already diff-scoped in practice.\n    declare mode?: FileLimitMode;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoJsFilesConfig> = {\n        mode: new FieldDef('string', FILE_LIMIT_MODES),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// ---------------------------------------------------------------------------\n// The five Nx infrastructure validators (architecture-unchanged, no-architecture-cycles,\n// packagejson, versions-locked, eslint-sync). Each is whole-graph / whole-repo by nature (a cycle, a\n// drifted dependencies.json, an unlocked version can be introduced by a file nobody in this diff\n// touched), so the only honest mode set is STRUCTURAL_MODES: RUN_EVERY_TIME (the default) or OFF.\n//\n// All five now honor the universal escape hatches (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch)\n// via shouldSkipRule — the RuleGate is called with honorEpoch:true from\n// every executor. This lets a repo time-box or branch-scope a failing infrastructure check (e.g. hold\n// validate-packagejson off until an upgrade PR lands) with a one-value edit, instead of only the\n// blunt \"mode\": \"OFF\". Originally packagejson/versions-locked/eslint-sync were all-or-nothing on the\n// theory that \"no blessed baseline\" made grandfathering meaningless, but a time-box is a schedule, not\n// a baseline: \"do not enforce this until <epoch>/off <branch>\" is coherent for any rule.\n// ---------------------------------------------------------------------------\n\nexport class ValidateArchitectureUnchangedConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateArchitectureUnchangedConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateNoArchitectureCyclesConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateNoArchitectureCyclesConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidatePackageJsonConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidatePackageJsonConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateVersionsLockedConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateVersionsLockedConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateEslintSyncConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateEslintSyncConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateTsInSrcConfig extends BaseRuleConfig {\n    declare mode?: ValidateTsMode;\n    allowedRootFiles?: string[];\n    excludePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<ValidateTsInSrcConfig> = {\n        mode: new FieldDef('string', VALIDATE_TS_MODES),\n        allowedRootFiles: FieldDef.optional('string[]'),\n        excludePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n"]}
+{"version":3,"file":"rule-configs.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/rule-configs.ts"],"names":[],"mappings":";;;AAAA,2CAAoD;AAEpD,kFAAkF;AAClF,yFAAyF;AAEzF,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,qDAAqD;AACxC,QAAA,kBAAkB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG3G,QAAA,gBAAgB,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAU,CAAC;AAG9D,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG1G,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG1G,QAAA,mBAAmB,GAAG,CAAC,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,CAAU,CAAC;AAGvG,iGAAiG;AACjG,gGAAgG;AAChG,8EAA8E;AACjE,QAAA,aAAa,GAAG,CAAC,KAAK,EAAE,mBAAmB,CAAU,CAAC;AAGtD,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,CAAU,CAAC;AAGjF,QAAA,sBAAsB,GAAG,CAAC,KAAK,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAGhG,QAAA,yBAAyB,GAAG,CAAC,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG5H,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,uBAAuB,CAAU,CAAC;AAG9D,QAAA,YAAY,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAGnD,uFAAuF;AACvF,2FAA2F;AAC3F,+FAA+F;AAC/F,wDAAwD;AAC3C,QAAA,kBAAkB,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAU,CAAC;AAGjE,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAU,CAAC;AAG5E,gGAAgG;AAChG,kGAAkG;AAClG,gGAAgG;AAChG,uFAAuF;AAC1E,QAAA,gBAAgB,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAU,CAAC;AAGnE,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,oCAAoC;AACpC,oGAAoG;AACpG,sEAAsE;AACtE,2GAA2G;AAC3G,uGAAuG;AACvG,sGAAsG;AACtG,wGAAwG;AACxG,yGAAyG;AACzG,uGAAuG;AACvG,mDAAmD;AACnD,yGAAyG;AACzG,wGAAwG;AACxG,sGAAsG;AACtG,8EAA8E;AAC9E,MAAsB,cAAc;IAChC,0FAA0F;IAC1F,8FAA8F;IAC9F,+CAA+C;IAC/C,IAAI,CAAU;IACd,mGAAmG;IACnG,mEAAmE;IACnE,qBAAqB,CAAU;IAC/B,wBAAwB,CAAiB;CAC5C;AATD,wCASC;AAEY,QAAA,gBAAgB,GAAG;IAC5B,qBAAqB,EAAE,IAAI,oBAAQ,CAAC,QAAQ,CAAC;IAC7C,wBAAwB,EAAE,oBAAQ,CAAC,cAAc,EAAE;CACtD,CAAC;AAEF,MAAa,oBAAqB,SAAQ,cAAc;IAEpD,KAAK,CAAU;IACf,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAsC;QACxD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,0BAAkB,CAAC;QAChD,KAAK,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,oDAWC;AAED,MAAa,kBAAmB,SAAQ,cAAc;IAElD,KAAK,CAAU;IACf,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,KAAK,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,gDAWC;AAED,MAAa,uBAAwB,SAAQ,cAAc;IAEvD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAyC;QAC3D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,0DASC;AAED,MAAa,0BAA2B,SAAQ,cAAc;IAE1D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA4C;QAC9D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,gEASC;AAED,MAAa,kBAAmB,SAAQ,cAAc;IAElD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,gDASC;AAED,MAAa,mBAAoB,SAAQ,cAAc;IAEnD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAqC;QACvD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,kDASC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IACzB,gBAAgB,CAAU;IAC1B,cAAc,CAAY;IAE1B,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7C,GAAG,wBAAgB;KACtB,CAAC;;AAZN,4DAaC;AAED,MAAa,qBAAsB,SAAQ,cAAc;IAErD,cAAc,CAAW;IACzB,UAAU,CAAU;IACpB,eAAe,CAAY;IAC3B,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAuC;QACzD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,8BAAsB,CAAC;QACpD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAdN,sDAeC;AAED,kGAAkG;AAClG,qGAAqG;AACrG,mGAAmG;AACnG,gGAAgG;AAChG,MAAa,mBAAoB,SAAQ,cAAc;IAEnD,aAAa,CAAW;IACxB,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAqC;QACvD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAZN,kDAaC;AAED,MAAa,2BAA4B,SAAQ,cAAc;IAE3D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA6C;QAC/D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,kEASC;AAED,MAAa,uBAAwB,SAAQ,cAAc;IAEvD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAyC;QAC3D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,0DASC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,4DASC;AAED,MAAa,kCAAmC,SAAQ,cAAc;IAElE,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAoD;QACtE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,iCAAyB,CAAC;QACvD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,gFAWC;AAED,mGAAmG;AACnG,sGAAsG;AACtG,sGAAsG;AACtG,MAAa,iBAAkB,SAAQ,cAAc;IAEjD,cAAc,CAAW;IACzB,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAAmC;QACrD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AAVN,8CAWC;AAED,MAAa,sBAAuB,SAAQ,cAAc;IAEtD,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAwC;QAC1D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,wDAWC;AAED,oGAAoG;AACpG,iGAAiG;AACjG,6FAA6F;AAC7F,8FAA8F;AAC9F,MAAa,8BAA+B,SAAQ,cAAc;IAE9D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAgD;QAClE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,wEASC;AAED,qGAAqG;AACrG,6FAA6F;AAC7F,qGAAqG;AACrG,yGAAyG;AACzG,sGAAsG;AACtG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,8FAA8F;AAC9F,MAAa,4BAA6B,SAAQ,cAAc;IAE5D,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAA8C;QAChE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,oEAWC;AAED,kGAAkG;AAClG,uGAAuG;AACvG,sGAAsG;AACtG,sGAAsG;AACtG,uGAAuG;AACvG,oGAAoG;AACpG,wGAAwG;AACxG,oGAAoG;AACpG,wGAAwG;AACxG,qEAAqE;AACrE,MAAa,+CAAgD,SAAQ,cAAc;IAE/E,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAiE;QACnF,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,0GAWC;AAED,qFAAqF;AACrF,kGAAkG;AAClG,iGAAiG;AACjG,mGAAmG;AACnG,iGAAiG;AACjG,sGAAsG;AACtG,MAAa,kBAAmB,SAAQ,cAAc;IAElD,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,qBAAa,CAAC;QAC3C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AARN,gDASC;AAED,8EAA8E;AAC9E,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAClG,0FAA0F;AAC1F,kFAAkF;AAClF,MAAa,aAAc,SAAQ,cAAc;IAE7C,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAA+B;QACjD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,qBAAa,CAAC;QAC3C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AARN,sCASC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAEzD,6FAA6F;IAC7F,6EAA6E;IAC7E,eAAe,CAAU;IACzB,6FAA6F;IAC7F,4FAA4F;IAC5F,YAAY,CAAU;IACtB,kGAAkG;IAClG,+FAA+F;IAC/F,6FAA6F;IAC7F,qFAAqF;IACrF,gBAAgB,CAAU;IAC1B,4FAA4F;IAC5F,+FAA+F;IAC/F,8FAA8F;IAC9F,kFAAkF;IAClF,YAAY,CAAU;IACtB,yFAAyF;IACzF,mGAAmG;IACnG,4CAA4C;IAC5C,+FAA+F;IAC/F,2FAA2F;IAC3F,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,uBAAuB;IACvB,sBAAsB,CAAW;IAEjC,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,0BAAkB,CAAC;QAChD,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,sBAAsB,EAAE,IAAI,oBAAQ,CAAC,SAAS,CAAC;QAC/C,GAAG,wBAAgB;KACtB,CAAC;;AAxCN,8DAyCC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAa,sBAAuB,SAAQ,cAAc;IAGtD,MAAM,CAAU,MAAM,GAAwC;QAC1D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,oBAAY,CAAC;QAC1C,GAAG,wBAAgB;KACtB,CAAC;;AANN,wDAOC;AAED,oGAAoG;AACpG,yGAAyG;AACzG,wGAAwG;AACxG,sGAAsG;AACtG,2FAA2F;AAE3F,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IACzB,eAAe,CAAY;IAC3B,0FAA0F;IAC1F,kGAAkG;IAClG,6FAA6F;IAC7F,kGAAkG;IAClG,8FAA8F;IAC9F,yFAAyF;IACzF,oFAAoF;IACpF,aAAa,CAAY;IAEzB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAnBN,4DAoBC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAEzD,kGAAkG;IAClG,0FAA0F;IAC1F,oGAAoG;IACpG,kGAAkG;IAClG,0CAA0C;IAC1C,aAAa,CAAY;IACzB;;;;;OAKG;IACH,iBAAiB,CAAW;IAC5B;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAY;IAE5B,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5C,iBAAiB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/C,GAAG,wBAAgB;KACtB,CAAC;;AAnCN,8DAoCC;AAED,MAAa,cAAe,SAAQ,cAAc;IAG9C,MAAM,CAAU,MAAM,GAAgC;QAClD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,wCAOC;AAED,MAAa,aAAc,SAAQ,cAAc;IAK7C,MAAM,CAAU,MAAM,GAA+B;QACjD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AARN,sCASC;AAED,MAAa,6BAA8B,SAAQ,cAAc;IAK7D,MAAM,CAAU,MAAM,GAA+C;QACjE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AARN,sEASC;AAED,MAAa,eAAgB,SAAQ,cAAc;IAI/C,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAiC;QACnD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,0CAWC;AAED,8EAA8E;AAC9E,yFAAyF;AACzF,qGAAqG;AACrG,iGAAiG;AACjG,kGAAkG;AAClG,EAAE;AACF,qGAAqG;AACrG,wEAAwE;AACxE,sGAAsG;AACtG,iGAAiG;AACjG,qGAAqG;AACrG,uGAAuG;AACvG,yFAAyF;AACzF,8EAA8E;AAE9E,MAAa,mCAAoC,SAAQ,cAAc;IAGnE,MAAM,CAAU,MAAM,GAAqD;QACvE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,kFAOC;AAED,MAAa,kCAAmC,SAAQ,cAAc;IAGlE,MAAM,CAAU,MAAM,GAAoD;QACtE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,gFAOC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAGzD,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,8DAOC;AAED,MAAa,4BAA6B,SAAQ,cAAc;IAG5D,MAAM,CAAU,MAAM,GAA8C;QAChE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,oEAOC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAGxD,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,4DAOC;AAED,MAAa,qBAAsB,SAAQ,cAAc;IAErD,gBAAgB,CAAY;IAC5B,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAuC;QACzD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,sDAWC","sourcesContent":["import { FieldDef, SchemaShape } from './field-def';\n\n// Mode const arrays — TypeScript union types derived from them, and FieldDef enum\n// values reference the same array. Impossible for the type and runtime check to diverge.\n\n// Single source of truth for rule \"mode\" values. Exported so code-rules (and any other\n// consumer) imports these instead of re-declaring the same unions — a rename here ripples\n// everywhere at compile time. The FieldDef SCHEMA below references the same arrays, so the\n// type and the runtime validation can never diverge.\nexport const METHOD_LIMIT_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type MethodLimitMode = typeof METHOD_LIMIT_MODES[number];\n\nexport const FILE_LIMIT_MODES = ['OFF', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type FileLimitMode = typeof FILE_LIMIT_MODES[number];\n\nexport const RETURN_TYPE_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ReturnTypeMode = typeof RETURN_TYPE_MODES[number];\n\nexport const INLINE_TYPE_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type InlineTypeMode = typeof INLINE_TYPE_MODES[number];\n\nexport const MODIFIED_CODE_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ModifiedCodeMode = typeof MODIFIED_CODE_MODES[number];\n\n// PROJECT-level rules (e.g. framework-tag): the check is neither line- nor file-scoped — it runs\n// for a whole project when ANY file the project owns is touched. `MODIFIED_PROJECTS` names that\n// honestly (nx `affected` already narrows execution to the changed projects).\nexport const PROJECT_MODES = ['OFF', 'MODIFIED_PROJECTS'] as const;\nexport type ProjectMode = typeof PROJECT_MODES[number];\n\nexport const PRISMA_DTOS_MODES = ['OFF', 'MODIFIED_CLASS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type PrismaValidateDtosMode = typeof PRISMA_DTOS_MODES[number];\n\nexport const PRISMA_CONVERTER_MODES = ['OFF', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type PrismaConverterMode = typeof PRISMA_CONVERTER_MODES[number];\n\nexport const DIRECT_API_RESOLVER_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type DirectApiResolverMode = typeof DIRECT_API_RESOLVER_MODES[number];\n\nexport const THROW_CAUSE_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE'] as const;\nexport type ThrowCauseMode = typeof THROW_CAUSE_MODES[number];\n\nexport const ON_OFF_MODES = ['ON', 'OFF'] as const;\nexport type OnOffMode = typeof ON_OFF_MODES[number];\n\n// branch-creation-guard modes. ON_NO_SUBBRANCHES is the strict variant: it hard-blocks\n// creating a branch off any non-main branch (no sub-branch affordance), pointing the agent\n// back to `git checkout main && git pull && git checkout -b <branch>`. Temporarily overridable\n// via the universal turnOffRuleUntilEpoch escape hatch.\nexport const BRANCH_GUARD_MODES = ['ON', 'OFF', 'ON_NO_SUBBRANCHES'] as const;\nexport type BranchGuardMode = typeof BRANCH_GUARD_MODES[number];\n\nexport const VALIDATE_TS_MODES = ['OFF', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ValidateTsMode = typeof VALIDATE_TS_MODES[number];\n\n// Structural / whole-graph rules (import-cycle, runtime-architecture, nx-wiring). They can't be\n// scoped to changed lines/files — a cycle or wiring break can route through a project that wasn't\n// itself edited — so when active they run the FULL check every time (nx-affected already limits\n// them to affected projects externally). RUN_EVERY_TIME replaces the old, vaguer \"ON\".\nexport const STRUCTURAL_MODES = ['OFF', 'RUN_EVERY_TIME'] as const;\nexport type StructuralMode = typeof STRUCTURAL_MODES[number];\n\n// ---------------------------------------------------------------------------\n// Universal escape hatches — EVERY rule supports temporarily disabling itself\n// either while on a named git branch (turnOffRuleWhileOnBranch) or until an\n// epoch passes (turnOffRuleUntilEpoch). They live on a shared base class so the\n// fields (and their schema entries) are declared once instead of repeated per\n// rule. `mode` stays per-rule because its allowed values vary (ON/OFF vs\n// NEW_AND_MODIFIED_CODE vs NEW_AND_MODIFIED_METHODS, etc).\n//\n// BOTH fields are REQUIRED on every rule so both hatches are ALWAYS VISIBLE in the config — an AI\n// editing webpieces.config.json sees them on every rule and cannot miss that a rule can be time-boxed\n// or branch-scoped off. Convention:\n//   turnOffRuleUntilEpoch:    0 = rule active (epoch in the past); a future unix epoch IN SECONDS =\n//                             temporarily disabled until that moment.\n//   turnOffRuleWhileOnBranch: null = always on; a branch name = disabled while that branch is checked out.\n//                             The name is matched EXACTLY (===). Globs/wildcards are NOT supported and\n//                             must not be added: a pattern would switch a rule off on branches nobody\n//                             enumerated. It is also ignored (loudly — shouldSkipRule throws) on a pull\n//                             request from a FORK, where the branch name is the contributor's to choose.\n//                             Required-but-nullable so its \"unset\" state is present-and-visible (null)\n//                             rather than omitted.\n// The earlier spellings of these two fields were RENAMED to the names above and are no longer accepted —\n// the validator rejects them with a \"renamed to X\" hint. RENAMED_FIELD_ALIASES in validate-config.ts is\n// the ONE place in src/ a dead spelling may still be written (see escape-hatch-key-spelling.spec.ts).\n// ---------------------------------------------------------------------------\nexport abstract class BaseRuleConfig {\n    // `mode` is declared here (loosely typed) so the shared AbstractRule base can read it for\n    // on/off. Each concrete *Config narrows it to its own union (e.g. `mode?: ModifiedCodeMode`),\n    // which is an assignable (covariant) override.\n    mode?: string;\n    // TS-optional, but schema-REQUIRED (see BASE_RULE_SCHEMA) — same split as `mode`. Read directly by\n    // AbstractRule.shouldRun, RuleGate, and the code-rules validators.\n    turnOffRuleUntilEpoch?: number;\n    turnOffRuleWhileOnBranch?: string | null;\n}\n\nexport const BASE_RULE_SCHEMA = {\n    turnOffRuleUntilEpoch: new FieldDef('number'),\n    turnOffRuleWhileOnBranch: FieldDef.nullableString(),\n};\n\nexport class MaxMethodLinesConfig extends BaseRuleConfig {\n    declare mode?: MethodLimitMode;\n    limit?: number;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<MaxMethodLinesConfig> = {\n        mode: new FieldDef('string', METHOD_LIMIT_MODES),\n        limit: FieldDef.optional('number'),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class MaxFileLinesConfig extends BaseRuleConfig {\n    declare mode?: FileLimitMode;\n    limit?: number;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<MaxFileLinesConfig> = {\n        mode: new FieldDef('string', FILE_LIMIT_MODES),\n        limit: FieldDef.optional('number'),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class RequireReturnTypeConfig extends BaseRuleConfig {\n    declare mode?: ReturnTypeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<RequireReturnTypeConfig> = {\n        mode: new FieldDef('string', RETURN_TYPE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoInlineTypeLiteralsConfig extends BaseRuleConfig {\n    declare mode?: InlineTypeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoInlineTypeLiteralsConfig> = {\n        mode: new FieldDef('string', INLINE_TYPE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoAnyUnknownConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoAnyUnknownConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoImplicitAnyConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoImplicitAnyConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class PrismaValidateDtosConfig extends BaseRuleConfig {\n    declare mode?: PrismaValidateDtosMode;\n    disableAllowed?: boolean;\n    prismaSchemaPath?: string;\n    dtoSourcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<PrismaValidateDtosConfig> = {\n        mode: new FieldDef('string', PRISMA_DTOS_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        prismaSchemaPath: FieldDef.optional('string'),\n        dtoSourcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class PrismaConverterConfig extends BaseRuleConfig {\n    declare mode?: PrismaConverterMode;\n    disableAllowed?: boolean;\n    schemaPath?: string;\n    convertersPaths?: string[];\n    enforcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<PrismaConverterConfig> = {\n        mode: new FieldDef('string', PRISMA_CONVERTER_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        schemaPath: FieldDef.optional('string'),\n        convertersPaths: FieldDef.optional('string[]'),\n        enforcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// `allowedPaths` exempts whole file trees whose idioms are destructuring by construction (React /\n// React Native components and hooks — `const [x, setX] = useState()`, destructured props — framework\n// glue), matched with the shared glob/prefix/segment semantics of `isPathExcluded`. It is the ONLY\n// escape when `disableAllowed: false`, since that setting deliberately ignores inline disables.\nexport class NoDestructureConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    allowTopLevel?: boolean;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoDestructureConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        allowTopLevel: FieldDef.optional('boolean'),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoUnmanagedExceptionsConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoUnmanagedExceptionsConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class CatchErrorPatternConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<CatchErrorPatternConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ThrowCauseRequiredConfig extends BaseRuleConfig {\n    declare mode?: ThrowCauseMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<ThrowCauseRequiredConfig> = {\n        mode: new FieldDef('string', THROW_CAUSE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class AngularNoDirectApiInResolverConfig extends BaseRuleConfig {\n    declare mode?: DirectApiResolverMode;\n    disableAllowed?: boolean;\n    enforcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<AngularNoDirectApiInResolverConfig> = {\n        mode: new FieldDef('string', DIRECT_API_RESOLVER_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        enforcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Bans hand-written CSS in Angular sources (styles:/styleUrls:/styleUrl: in @Component, and inline\n// style=/[style.x]/[ngStyle] in templates) so teams style with Tailwind utility classes. `allowGlobs`\n// exempts paths WITHIN the Angular scope (e.g. a vendored Fuse kit copied verbatim with its own CSS).\nexport class NoCustomCssConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowGlobs?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoCustomCssConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowGlobs: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoSymbolDiTokensConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoSymbolDiTokensConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Flags `process.exit(...)` outside a main()/runMain wrapper (and `import { main }`) so a deep exit\n// can't silently kill a reused server/command. Gradual-rollout knobs via the standard base: mode\n// (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch, branch, and\n// disableAllowed for the inline `// webpieces-disable` escape at genuine terminal boundaries.\nexport class NoProcessExitOutsideMainConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoProcessExitOutsideMainConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Flags a function CREATED OUTSIDE A CLASS at module scope: a top-level `function foo()` declaration\n// or a top-level `const foo = () => {}` / `= function(){}`. The point is that webpieces DI +\n// @DocumentDesign only work when behavior lives in injectable classes — a module-scope function is a\n// dead-end the DI graph can't reach. Inline callbacks, nested functions inside methods, and non-function\n// top-level consts (objects, zod schemas, primitives) are NOT flagged. Standard rollout knobs via the\n// base: mode (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch, branch,\n// and disableAllowed for the inline `// webpieces-disable` escape. `allowedPaths` exempts whole file\n// trees that legitimately live outside the class-per-behavior model (e.g. React component/hook files,\n// framework glue), matched with the shared glob/prefix/segment semantics of `isPathExcluded`.\nexport class NoFunctionOutsideClassConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoFunctionOutsideClassConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// inject-annotation-not-needed-for-concrete-class — flags a REDUNDANT `@inject(X)` whose token is\n// textually identical to the parameter's own declared type (`@inject(Foo) private readonly foo: Foo`).\n// In this inversify setup the decorator is pure noise there: reflect-metadata (emitDecoratorMetadata)\n// already resolves a constructor parameter by its class type, so `private readonly foo: Foo` binds on\n// its own (see CLAUDE.md, and the no-symbol-di-tokens rule that pushes the same way). Symbol/interface\n// tokens are NOT flagged because they never equal the type (`@inject(FOO_TOKEN) x: Provider<Foo>`).\n// AI keeps carpet-bombing `@inject`; this fails the build on the redundant form. Standard rollout knobs\n// via the base: mode (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch,\n// branch, and disableAllowed for the inline `// webpieces-disable` escape. `allowedPaths` exempts whole\n// file trees, matched with the shared glob/prefix/segment semantics.\nexport class InjectAnnotationNotNeededForConcreteClassConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<InjectAnnotationNotNeededForConcreteClassConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// framework-tag — every project that a changed source file belongs to must carry >=1\n// `framework:<browser|react|angular|node|express>` nx tag in its project.json. Those tags are the\n// project's \"libType\" — the SET of runtime environments it runs in — and the source of truth for\n// the dependencies.json `framework` field and the `library-types-match-client` rule. Multiple tags\n// are allowed (the env set) and values are validated against the known set (`framework:all` is a\n// hard error). `knownTypes` customizes that set (defaults to browser, react, angular, node, express).\nexport class FrameworkTagConfig extends BaseRuleConfig {\n    declare mode?: ProjectMode;\n    knownTypes?: string[];\n\n    static readonly SCHEMA: SchemaShape<FrameworkTagConfig> = {\n        mode: new FieldDef('string', PROJECT_MODES),\n        knownTypes: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// role-tag — every project that a changed source file belongs to must carry a\n// `role:<server|designed-lib|lib|client>` nx tag in its project.json. That tag is the project's\n// ROLE (orthogonal to `framework` libType) — the source of truth for the dependencies.json `role`\n// field, the `role-dependency` edge rule (apps are never depended upon), and DI-design generation\n// (server→@Controller, designed-lib→@ApiImplementation, lib→none, client→angular design).\n// `knownTypes` customizes the list suggested to the author when a tag is missing.\nexport class RoleTagConfig extends BaseRuleConfig {\n    declare mode?: ProjectMode;\n    knownTypes?: string[];\n\n    static readonly SCHEMA: SchemaShape<RoleTagConfig> = {\n        mode: new FieldDef('string', PROJECT_MODES),\n        knownTypes: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class BranchCreationGuardConfig extends BaseRuleConfig {\n    declare mode?: BranchGuardMode;\n    // Naming pattern for stacked SUB-branches only (branches created off another feature branch,\n    // which require human approval). Never applied to branches created off main.\n    subBranchNaming?: string;\n    // Human-sentence instruction telling the AI how to name a NEW branch off main. Surfaced back\n    // to the agent in the guard's fix hints. May mirror no-edit-on-main.branchNamingConvention.\n    branchFormat?: string;\n    // Hard cap on local feature branches (excluding main). Creating one past the cap is BLOCKED until\n    // already-merged branches are reaped, which is what keeps the branch list from growing without\n    // bound. Branch creation is the gate because it is the only moment cleanup is both cheap and\n    // obviously worth it. See merged-branches.ts for how \"already merged\" is determined.\n    maxLocalBranches?: number;\n    // Hard cap on LINKED worktrees (the primary clone is never counted). A separate budget from\n    // maxLocalBranches: every worktree holds a branch, so if worktree-held branches also spent the\n    // branch budget, five worktrees would leave room for zero branches. Held branches count here;\n    // parked branches count against maxLocalBranches. Enforced at `git worktree add`.\n    maxWorktrees?: number;\n    // Let the detached background refresher DELETE dead branches on its own, instead of only\n    // reporting them. Every candidate is provably dead (a MERGED PR — its own, or the PR of the branch\n    // it snapshots; nothing else qualifies) and\n    // recoverable by the SHA logged to branch-mutations.log — but it is still UNATTENDED deletion,\n    // so this is schema-REQUIRED like `mode` and `turnOffRuleUntilEpoch`. \"Every built-in rule\n    // must be explicitly configured — no silent defaults\" (validate-config.ts) applies with extra\n    // force here: branches disappearing on a preference nobody ever stated is precisely the kind of\n    // default that must not exist. Validation makes each consumer answer the question once.\n    //\n    // TS-optional but schema-required — the same split `mode` uses. Absent at RUNTIME therefore means\n    // the config never passed validation, and the only safe reading of \"nobody has answered\" is: do\n    // not delete anything.\n    autoReapMergedBranches?: boolean;\n\n    static readonly SCHEMA: SchemaShape<BranchCreationGuardConfig> = {\n        mode: new FieldDef('string', BRANCH_GUARD_MODES),\n        subBranchNaming: FieldDef.optional('string'),\n        branchFormat: FieldDef.optional('string'),\n        maxLocalBranches: FieldDef.optional('number'),\n        maxWorktrees: FieldDef.optional('number'),\n        autoReapMergedBranches: new FieldDef('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n/**\n * `pr-lifecycle-guard` — ONE key, ONE policy: *PRs and merges go through the gated flow.*\n *\n * Four CLASSES implement it, and their names are unchanged (they are the operator identity every\n * decision-log line and every deny report carries):\n *\n *   pr-creation-or-push-guard  a manual `git push` / `gh pr create|edit` / a raw pulls API call\n *   merge-in-progress-guard    a PR command while a 3-point merge is half-finished\n *   pr-merge-guard             a bare `gh pr merge`\n *   redirect-how-to-merge-main \"how do I get main into my branch?\" → the documented flow\n *\n * ## Say this out loud: `\"mode\": \"OFF\"` releases the unvalidated-merge gate too\n *\n * Three of the four are pure COMMAND-SHAPE blocks and can never fire spuriously. The fourth,\n * merge-in-progress-guard, is STATE-conditional — it fires only while a 3-point merge is actually in\n * progress, and it is the one state L2 explicitly stands down for. So turning this key OFF to unblock\n * `gh pr merge` ALSO drops the \"you have an unfinished merge\" gate. That is the honest cost of one key\n * per policy, and it is stated here, in guards/L4-pr-lifecycle.md, and in the error path, rather than\n * being papered over with a granular sub-mode (which would be four knobs wearing one key's name).\n *\n * ## The command strings are NOT here\n *\n * `upsertPrCommand` and `mergeCompleteCommand` used to sit on the two guards, and — being read at the\n * point of use — they BEAT `commands.guardHints`, so `guardHintsWhy`'s claim that renaming a gated\n * command there makes \"every guard message follow\" was simply false. They are DELETED, not deprecated.\n * `commands.guardHints.prCreationOrPush` / `.mergeInProgress` is the one place those strings live, and\n * the loader hands the resolved values to the two rules directly. A consumer that still sets the old\n * per-guard field gets a RETIRED_FIELD_HINTS error naming the destination.\n */\nexport class PrLifecycleGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n\n    static readonly SCHEMA: SchemaShape<PrLifecycleGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// NOTE: there is deliberately no `WholeRepoBuildGuardConfig`. That guard is EXPERIMENTAL and has NO\n// webpieces.config.json entry — its only switch is `experimental.whole-repo-build-guard` in the optional\n// machine-local ~/.webpieces/config.json (see home-config.ts), and the affected-build command it prints\n// is handed to it directly from `commands.pr-gate.buildCommand` by ai-hook-rules' runner. Re-adding a\n// config class here puts the guard back in RULE_SCHEMAS and makes it a fault-Y rule again.\n\nexport class NoFileImportCyclesConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    ignoreTypeOnly?: boolean;\n    excludePackages?: string[];\n    // Raw regex escape hatch for a cycle inside the project being checked — generated code, a\n    // vendored tree, or a deliberate bidirectional domain model — that `excludePackages` cannot reach\n    // (it resolves npm package NAMES, so it only excludes a *sibling* package, never a directory\n    // inside this one). Patterns are handed to madge verbatim and matched against ids RELATIVE TO THE\n    // PROJECT (e.g. \"^src/generated/\", \"^src/modules/(item|category)/\") — NOT workspace-rooted or\n    // absolute, which silently match nothing. The executor warns when a pattern matches zero\n    // traversed files, so a mis-anchored pattern is visible rather than a silent no-op.\n    excludeRegExp?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoFileImportCyclesConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ignoreTypeOnly: FieldDef.optional('boolean'),\n        excludePackages: FieldDef.optional('string[]'),\n        excludeRegExp: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class RuntimeArchitectureConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    // NOTE: `servicePaths` / `apiProjectPaths` were removed — they were never read. The runtime graph\n    // is derived SOLELY from architecture/dependencies.json apiRelations + project roles (see\n    // nx-webpieces-rules/src/lib/runtime-graph.ts), so any config still listing them (a hand-maintained\n    // enumeration of api libs) now fails the unknown-field check in validateWebpiecesConfig. There is\n    // nothing to enumerate — delete the keys.\n    allowedCycles?: string[];\n    /**\n     * Draw a dashed terminal node for every contract a service calls that NOTHING in-repo\n     * implements (firestore, gmail, ...) — the vendor systems the runtime graph otherwise stops one\n     * hop short of. Defaults to true; set false in a repo whose external surface is noisy. Purely a\n     * RENDER switch: levels, cycle detection and runtime-dependencies.json are identical either way.\n     */\n    showExternalNodes?: boolean;\n    /**\n     * Project roots whose exported `*Api` types are contracts for systems OUTSIDE this repo\n     * (firestore, gmail, gcp-storage, ...), e.g. `[\"libraries/apis/external/**\"]`. Globs, matched\n     * against the nx project root.\n     *\n     * Needed because an external contract does NOT look like an in-repo one: it is a plain\n     * `interface` bound to a Symbol token and injected, never an `abstract class` carrying @ApiPath\n     * reached through `createRpcClient`. Without this list the scanner has no way to tell a vendor\n     * seam from any other library, so every call leaving the repo is invisible to the runtime graph.\n     *\n     * Defaults to none, which is correct for a repo with no vendor wrapper libraries.\n     */\n    externalApiPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<RuntimeArchitectureConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        allowedCycles: FieldDef.optional('string[]'),\n        showExternalNodes: FieldDef.optional('boolean'),\n        externalApiPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NxWiringConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<NxWiringConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class DiGraphConfig extends BaseRuleConfig {\n    // Structural: the DI graph is regenerated whole-project on every build (generate +\n    // unchanged gate), so it cannot be scoped to changed lines.\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<DiGraphConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class MissingDesignAnnotationConfig extends BaseRuleConfig {\n    // Structural: enforced per-project by the di-graph-generate executor, which\n    // roots the whole DI design on @DocumentDesign classes — cannot be line-scoped.\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<MissingDesignAnnotationConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoJsFilesConfig extends BaseRuleConfig {\n    // File-tier: NEW_AND_MODIFIED_FILES (active) intercepts a .js/.jsx Write — the file being\n    // written is inherently a new/modified file, so it's already diff-scoped in practice.\n    declare mode?: FileLimitMode;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoJsFilesConfig> = {\n        mode: new FieldDef('string', FILE_LIMIT_MODES),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// ---------------------------------------------------------------------------\n// The five Nx infrastructure validators (architecture-unchanged, no-architecture-cycles,\n// packagejson, versions-locked, eslint-sync). Each is whole-graph / whole-repo by nature (a cycle, a\n// drifted dependencies.json, an unlocked version can be introduced by a file nobody in this diff\n// touched), so the only honest mode set is STRUCTURAL_MODES: RUN_EVERY_TIME (the default) or OFF.\n//\n// All five now honor the universal escape hatches (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch)\n// via shouldSkipRule — the RuleGate is called with honorEpoch:true from\n// every executor. This lets a repo time-box or branch-scope a failing infrastructure check (e.g. hold\n// validate-packagejson off until an upgrade PR lands) with a one-value edit, instead of only the\n// blunt \"mode\": \"OFF\". Originally packagejson/versions-locked/eslint-sync were all-or-nothing on the\n// theory that \"no blessed baseline\" made grandfathering meaningless, but a time-box is a schedule, not\n// a baseline: \"do not enforce this until <epoch>/off <branch>\" is coherent for any rule.\n// ---------------------------------------------------------------------------\n\nexport class ValidateArchitectureUnchangedConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateArchitectureUnchangedConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateNoArchitectureCyclesConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateNoArchitectureCyclesConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidatePackageJsonConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidatePackageJsonConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateVersionsLockedConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateVersionsLockedConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateEslintSyncConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateEslintSyncConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateTsInSrcConfig extends BaseRuleConfig {\n    declare mode?: ValidateTsMode;\n    allowedRootFiles?: string[];\n    excludePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<ValidateTsInSrcConfig> = {\n        mode: new FieldDef('string', VALIDATE_TS_MODES),\n        allowedRootFiles: FieldDef.optional('string[]'),\n        excludePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n"]}

package/src/skip-rule.d.ts

@@ -1,6 +1,22 @@
-export interface SkipRuleResult {
+/**
+ * The skip decision. A CLASS, not an interface (CLAUDE.md rule 1), because it carries a THIRD fact
+ * beyond yes/no that a caller has to be able to read rather than read about in a log line.
+ *
+ * `hatchNotApplied` is that fact: a branch hatch WAS configured, and it could NOT apply — today only
+ * because HEAD is detached (a tag checkout, a `git bisect` step, a CI checkout of a merge ref). The rule
+ * is ENFORCED in that case, so there is nothing to report unless the rule then FAILS; when it does, its
+ * own RuleFailError is where this belongs, as context on why the hatch the config shows did not save it.
+ *
+ * It is deliberately NOT printed here. Everything in this framework throws to ONE place that renders per
+ * audience; a console write from a library function cannot be caught, re-rendered or asserted on.
+ */
+export declare class SkipRuleResult {
     skip: boolean;
-    reason?: string;
+    /** Why the rule IS being skipped. '' whenever `skip` is false. */
+    reason: string;
+    /** Why a CONFIGURED branch hatch did not apply, or '' when there is nothing to say. */
+    hatchNotApplied: string;
+    constructor(skip: boolean, reason?: string, hatchNotApplied?: string);
 }
 export declare function getCurrentBranch(): string;
-export declare function shouldSkipRule(epoch: number | undefined, branchPattern: string | undefined | null): SkipRuleResult;
+export declare function shouldSkipRule(epoch: number | undefined, branchName: string | undefined | null): SkipRuleResult;

package/src/skip-rule.js

@@ -1,10 +1,43 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkipRuleResult = void 0;
 exports.getCurrentBranch = getCurrentBranch;
 exports.shouldSkipRule = shouldSkipRule;
+const tslib_1 = require("tslib");
 const child_process_1 = require("child_process");
+const fs = tslib_1.__importStar(require("fs"));
 const inform_ai_error_1 = require("./inform-ai-error");
+const rule_fail_error_1 = require("./rule-fail-error");
 const to_error_1 = require("./to-error");
+// Universal "should this rule be skipped right now?" logic, shared by code-rules,
+// ai-hook-rules and the Nx executors so every rule honors the same two escape
+// hatches: turnOffRuleWhileOnBranch (skip while on a named branch) and
+// turnOffRuleUntilEpoch (skip until an epoch passes).
+/**
+ * The skip decision. A CLASS, not an interface (CLAUDE.md rule 1), because it carries a THIRD fact
+ * beyond yes/no that a caller has to be able to read rather than read about in a log line.
+ *
+ * `hatchNotApplied` is that fact: a branch hatch WAS configured, and it could NOT apply — today only
+ * because HEAD is detached (a tag checkout, a `git bisect` step, a CI checkout of a merge ref). The rule
+ * is ENFORCED in that case, so there is nothing to report unless the rule then FAILS; when it does, its
+ * own RuleFailError is where this belongs, as context on why the hatch the config shows did not save it.
+ *
+ * It is deliberately NOT printed here. Everything in this framework throws to ONE place that renders per
+ * audience; a console write from a library function cannot be caught, re-rendered or asserted on.
+ */
+class SkipRuleResult {
+    skip;
+    /** Why the rule IS being skipped. '' whenever `skip` is false. */
+    reason;
+    /** Why a CONFIGURED branch hatch did not apply, or '' when there is nothing to say. */
+    hatchNotApplied;
+    constructor(skip, reason = '', hatchNotApplied = '') {
+        this.skip = skip;
+        this.reason = reason;
+        this.hatchNotApplied = hatchNotApplied;
+    }
+}
+exports.SkipRuleResult = SkipRuleResult;
 // The actual checked-out branch. The grab bag of ambient env vars (BRANCH_NAME, GIT_BRANCH,
 // CI_COMMIT_BRANCH, …) was intentionally REMOVED and must stay removed: a stray GIT_BRANCH=main
 // locally made this return "main" on a feature branch, which (a) mislabeled the main-sync cache and
@@ -19,6 +52,12 @@ const to_error_1 = require("./to-error");
 //                      GITHUB_REF_NAME: on pull_request that is "<N>/merge", not a branch.)
 //   WEBPIECES_BRANCH — one documented opt-in override for CI systems not special-cased here
 //                      (GitLab, CircleCI, Buildkite). Nobody sets it by accident.
+//
+// This getter answers "what branch am I on?" and NOTHING about whether that answer may be TRUSTED to
+// unlock an escape hatch. That second question is asked by shouldSkipRule alone (see
+// assertBranchIsTrustworthy) because this getter has callers — the main-sync cache label, merged-PR
+// detection, code-rules' re-export of it — for which a fork's own branch name is a perfectly good
+// answer, and making the getter itself throw would redden all of them.
 function getCurrentBranch() {
     const prBranch = process.env['GITHUB_HEAD_REF'];
     if (prBranch)
@@ -36,40 +75,137 @@ function getCurrentBranch() {
         throw new inform_ai_error_1.InformAiError(`Failed to determine current git branch: ${error.message}`, { cause: error });
     }
 }
+/**
+ * Refuse the branch hatch on a pull request whose head branch this repo does not own.
+ *
+ * The hole it closes: hatch names live in `webpieces.config.json`, which is COMMITTED and public. On a
+ * `pull_request` from a FORK the runner sets GITHUB_HEAD_REF to the FORK AUTHOR's branch name, so an
+ * outside contributor who names their branch after one of your hatches silently disables that rule on
+ * their PR — the one place you least want a rule off.
+ *
+ * It is answered with no network and no token, from `$GITHUB_EVENT_PATH` — a JSON file the runner writes
+ * before the job starts:
+ *   - `pull_request_target` runs with the BASE repo's secrets against contributor-authored code, so it is
+ *     untrusted unconditionally; there is nothing to compare.
+ *   - `pull_request` is trusted only when the head repo's `full_name` EQUALS `GITHUB_REPOSITORY`.
+ *
+ * "Cannot tell" counts as untrusted — a `pull_request` run with no readable event file cannot make the
+ * comparison, and a hatch that cannot be proven to be yours must not fire.
+ *
+ * This is the ONE hard failure left in this module, and it is not the "no branch here" case (see
+ * shouldSkipRule, which enforces quietly when HEAD is detached). It is a hatch name that DOES resolve but
+ * is attacker-chosen — a security property, not a checkout that happens not to be editing.
+ *
+ * Called ONLY from inside `if (branchName)`. With turnOffRuleWhileOnBranch null — the overwhelmingly
+ * common value — nothing here runs and no fork PR is affected in any way.
+ */
+// webpieces-disable no-function-outside-class -- module-scope helper of the module-scope shouldSkipRule it serves; this whole module is functional by design (imported as free functions by code-rules, ai-hook-rules and the nx executors)
+function assertBranchIsTrustworthy(branchName) {
+    const eventName = process.env['GITHUB_EVENT_NAME'];
+    if (eventName !== 'pull_request' && eventName !== 'pull_request_target')
+        return;
+    if (eventName === 'pull_request_target')
+        throw forkRefusal(branchName, 'pull_request_target run');
+    const headRepo = readHeadRepoFullName(branchName);
+    const thisRepo = process.env['GITHUB_REPOSITORY'] ?? '';
+    if (headRepo !== null && thisRepo !== '' && headRepo === thisRepo)
+        return;
+    throw forkRefusal(branchName, headRepo === null
+        ? 'pull_request run with no readable $GITHUB_EVENT_PATH, so the head branch cannot be proven to belong to this repo'
+        : `pull_request run whose head branch lives in "${headRepo}", not in "${thisRepo}"`);
+}
+/**
+ * The head repo's `owner/name` from the runner's event file, or null when there is no such file.
+ *
+ * A file that exists but cannot be parsed is a different thing from one that is absent, and it throws:
+ * it means the runner wrote something this code does not understand, and silently downgrading that to
+ * "untrusted" would hide a real incompatibility behind a message about forks.
+ */
+// webpieces-disable no-function-outside-class -- module-scope helper, see assertBranchIsTrustworthy
+function readHeadRepoFullName(branchName) {
+    const eventPath = process.env['GITHUB_EVENT_PATH'];
+    if (!eventPath || !fs.existsSync(eventPath))
+        return null;
+    // webpieces-disable no-unmanaged-exceptions -- chokepoint: a raw SyntaxError from the runner's event file would say nothing about hatches; this names the hatch, the file and the rule that stayed ON
+    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- see above
+    try {
+        const parsed = JSON.parse(fs.readFileSync(eventPath, 'utf8'));
+        return parsed.pull_request?.head?.repo?.full_name ?? null;
+    }
+    catch (err) {
+        const error = (0, to_error_1.toError)(err);
+        throw new rule_fail_error_1.RuleFailError('turnOffRuleWhileOnBranch', `turnOffRuleWhileOnBranch: "${branchName}" is configured and this is a pull_request run, so the ` +
+            `head repository must be checked before the hatch may fire — but the runner's event file ` +
+            `${eventPath} could not be read: ${error.message}`, undefined, undefined, ['Use turnOffRuleUntilEpoch instead — it is TIME based and needs no event file.',
+            'Or clear turnOffRuleWhileOnBranch (set it to null) so no trust check is needed at all.'], undefined, error);
+    }
+}
+/**
+ * The fork refusal, as a `RuleFailError`.
+ *
+ * The cures are `fixHints` — a LIST — because the framework owns how they are labelled and numbered
+ * (`rule-reporter.ts` prefixes each with "Fix: "; the hook runner folds them into its Violation). A
+ * hand-numbered "WORKAROUNDS: 1. … 2. …" string literal, which is what this used to be, is exactly the
+ * shape `FixHint`/`Option` exist to prevent. `FixHint` itself lives in `ai-hook-rules`, which
+ * `rules-config` sits BELOW and cannot import, so `RuleFailError.fixHints` is the structured list
+ * available at this layer.
+ *
+ * `ruleName` is the HATCH, not the rule being evaluated: `shouldSkipRule` is handed only the two hatch
+ * values and does not know whose rule it is deciding for — and the thing that failed genuinely is the
+ * hatch, which cannot be honored here.
+ */
+// webpieces-disable no-function-outside-class -- module-scope helper, see assertBranchIsTrustworthy
+function forkRefusal(branchName, what) {
+    return new rule_fail_error_1.RuleFailError('turnOffRuleWhileOnBranch', `turnOffRuleWhileOnBranch: "${branchName}" is configured, but this is a ${what}. The branch name ` +
+        `there is chosen by the PULL REQUEST AUTHOR, and hatch names are public (webpieces.config.json ` +
+        `is committed), so honoring the hatch would let anyone turn this rule off on their own PR just ` +
+        `by naming their branch after it. The rule is NOT skipped, and this fails loudly rather than ` +
+        `quietly enforcing a rule the config says is off.`, undefined, undefined, [
+        'If the rule must be off for outside contributions too, use turnOffRuleUntilEpoch — it is TIME ' +
+            'based, so it cannot be self-granted by naming a branch. Keep the date short: it is repo-wide ' +
+            'while it lasts, so it also shelters unrelated work landing in the same window.',
+        'Otherwise clear turnOffRuleWhileOnBranch (set it to null) and fix the findings on the ' +
+            'contributed branch like any other.',
+    ]);
+}
 function shouldSkipRule(epoch, 
+// The branch hatch is an EXACT branch name — compared with `===`, never a glob, regex or prefix.
+// That is deliberate and is not to be "improved": the hatch turns a rule OFF, and a pattern lets one
+// config line switch rules off on branches nobody enumerated when it was written. If two branches
+// need the same rule off, that is two branches renamed to one hatch name, not one wildcard.
+//
 // null (the "no branch / always on" value of turnOffRuleWhileOnBranch) is treated exactly like
 // undefined — no branch scoping. Only a non-empty branch name activates the branch hatch.
-branchPattern) {
-    if (branchPattern) {
+branchName) {
+    if (branchName) {
+        // The fork gate fires ONLY inside `if (branchName)`. With turnOffRuleWhileOnBranch=null — the
+        // overwhelmingly common value — nothing below runs, so an outside contribution to a repo that
+        // configured no hatch is an ordinary run.
+        //
+        // A DETACHED HEAD is NOT an error here. The branch hatch exists to relax a rule while you EDIT on
+        // a branch; a tag checkout or a `git bisect` step is not editing (you cannot commit to a tag, and
+        // to edit you branch off it first). So when no branch can be resolved the hatch simply does not
+        // apply and THE RULE IS ENFORCED — whoever hits a violation then gets that rule's own message and
+        // cure, which is the useful output. WHY the hatch did not fire rides back on the result
+        // (SkipRuleResult.hatchNotApplied) rather than being printed, so a caller that does fail can fold
+        // it into its own error instead of a library writing to a console nobody can catch.
+        assertBranchIsTrustworthy(branchName);
         const current = getCurrentBranch();
-        // ONLY inside `if (branchPattern)`. A detached HEAD with turnOffRuleWhileOnBranch=null (the
-        // overwhelmingly common value) is a non-event and must stay silent, or every tag build,
-        // bisect and `gh pr checkout --detach` starts failing for no reason. The fault reported here
-        // is "you asked for branch scoping where no branch exists", never "HEAD is detached".
         if (current === 'HEAD' || current === '') {
-            throw new inform_ai_error_1.InformAiError(`turnOffRuleWhileOnBranch: "${branchPattern}" is configured, but the current branch ` +
-                `cannot be determined — HEAD is detached, which is what a CI checkout of a merge ref ` +
-                `looks like. The hatch would silently NOT apply, so this fails now rather than passing ` +
-                `on your machine and failing in CI with an unrelated-looking error.\n\n` +
-                `WORKAROUNDS, in order of preference:\n` +
-                `  1. Upgrade to a webpieces that reads GITHUB_HEAD_REF (no workflow change needed).\n` +
-                `  2. Set WEBPIECES_BRANCH in the workflow so the branch can be resolved.\n` +
-                `  3. Use turnOffRuleUntilEpoch instead — it is TIME based, so it survives any checkout ` +
-                `including a detached one, and it is the only hatch that works in CI today. Set it to a ` +
-                `SHORT date (a few days): unlike branch scoping it is repo-wide while it lasts, so it ` +
-                `also shelters unrelated work that lands in the same window.`);
+            return new SkipRuleResult(false, '', `turnOffRuleWhileOnBranch: "${branchName}" did not apply — HEAD is detached, so there is no ` +
+                `branch to match (a tag checkout, a git bisect step, or a CI checkout of a merge ref).`);
         }
-        if (current === branchPattern) {
-            return { skip: true, reason: `on branch "${branchPattern}"` };
+        if (current === branchName) {
+            return new SkipRuleResult(true, `on branch "${branchName}"`);
         }
     }
     if (epoch !== undefined) {
         const nowSeconds = Date.now() / 1000;
         if (nowSeconds < epoch) {
             const expiresDate = new Date(epoch * 1000).toISOString().split('T')[0];
-            return { skip: true, reason: `turnOffRuleUntilEpoch active, expires: ${expiresDate}` };
+            return new SkipRuleResult(true, `turnOffRuleUntilEpoch active, expires: ${expiresDate}`);
         }
     }
-    return { skip: false };
+    return new SkipRuleResult(false);
 }
 //# sourceMappingURL=skip-rule.js.map

package/src/skip-rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"skip-rule.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/skip-rule.ts"],"names":[],"mappings":";;AA6BA,4CAeC;AAED,wCAuCC;AArFD,iDAAyC;AAEzC,uDAAkD;AAClD,yCAAqC;AAYrC,4FAA4F;AAC5F,gGAAgG;AAChG,oGAAoG;AACpG,2EAA2E;AAC3E,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,+CAA+C;AAC/C,oGAAoG;AACpG,mGAAmG;AACnG,4FAA4F;AAC5F,4FAA4F;AAC5F,kFAAkF;AAClF,SAAgB,gBAAgB;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,wHAAwH;IACxH,0IAA0I;IAC1I,IAAI,CAAC;QACD,OAAO,IAAA,wBAAQ,EAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,+BAAa,CAAC,2CAA2C,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1G,CAAC;AACL,CAAC;AAED,SAAgB,cAAc,CAC1B,KAAyB;AACzB,+FAA+F;AAC/F,0FAA0F;AAC1F,aAAwC;IAExC,IAAI,aAAa,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,4FAA4F;QAC5F,wFAAwF;QACxF,6FAA6F;QAC7F,sFAAsF;QACtF,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,+BAAa,CACnB,8BAA8B,aAAa,0CAA0C;gBACjF,sFAAsF;gBACtF,wFAAwF;gBACxF,wEAAwE;gBACxE,wCAAwC;gBACxC,uFAAuF;gBACvF,4EAA4E;gBAC5E,yFAAyF;gBACzF,yFAAyF;gBACzF,uFAAuF;gBACvF,6DAA6D,CACpE,CAAC;QACN,CAAC;QACD,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,aAAa,GAAG,EAAE,CAAC;QAClE,CAAC;IACL,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACrC,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;YACrB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,0CAA0C,WAAW,EAAE,EAAE,CAAC;QAC3F,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import { execSync } from 'child_process';\n\nimport { InformAiError } from './inform-ai-error';\nimport { toError } from './to-error';\n\n// Universal \"should this rule be skipped right now?\" logic, shared by code-rules,\n// ai-hook-rules and the Nx executors so every rule honors the same two escape\n// hatches: turnOffRuleWhileOnBranch (skip while on a named branch) and\n// turnOffRuleUntilEpoch (skip until an epoch passes).\n\nexport interface SkipRuleResult {\n    skip: boolean;\n    reason?: string;\n}\n\n// The actual checked-out branch. The grab bag of ambient env vars (BRANCH_NAME, GIT_BRANCH,\n// CI_COMMIT_BRANCH, …) was intentionally REMOVED and must stay removed: a stray GIT_BRANCH=main\n// locally made this return \"main\" on a feature branch, which (a) mislabeled the main-sync cache and\n// (b) silently disabled merged-PR detection (detectMergedPr skips \"main\").\n//\n// The two vars below are NOT that. They are consulted BEFORE git because git cannot answer at all in\n// the case they cover — a `pull_request` checkout leaves HEAD detached on refs/pull/<N>/merge, where\n// `git rev-parse --abbrev-ref HEAD` returns the literal string \"HEAD\" and no branch hatch can match.\n// Neither can go stale the way GIT_BRANCH did:\n//   GITHUB_HEAD_REF  — set by the GitHub runner ONLY on pull_request/pull_request_target, and it IS\n//                      the source branch name. Absent on push, so the fallthrough stays safe. (Not\n//                      GITHUB_REF_NAME: on pull_request that is \"<N>/merge\", not a branch.)\n//   WEBPIECES_BRANCH — one documented opt-in override for CI systems not special-cased here\n//                      (GitLab, CircleCI, Buildkite). Nobody sets it by accident.\nexport function getCurrentBranch(): string {\n    const prBranch = process.env['GITHUB_HEAD_REF'];\n    if (prBranch) return prBranch;\n\n    const override = process.env['WEBPIECES_BRANCH'];\n    if (override) return override;\n\n    // webpieces-disable no-unmanaged-exceptions -- rethrow as InformAiError so global catch surfaces readable message to AI\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- rethrow as InformAiError so global catch surfaces readable message to AI\n    try {\n        return execSync('git rev-parse --abbrev-ref HEAD', { encoding: 'utf8' }).trim();\n    } catch (err: unknown) {\n        const error = toError(err);\n        throw new InformAiError(`Failed to determine current git branch: ${error.message}`, { cause: error });\n    }\n}\n\nexport function shouldSkipRule(\n    epoch: number | undefined,\n    // null (the \"no branch / always on\" value of turnOffRuleWhileOnBranch) is treated exactly like\n    // undefined — no branch scoping. Only a non-empty branch name activates the branch hatch.\n    branchPattern: string | undefined | null\n): SkipRuleResult {\n    if (branchPattern) {\n        const current = getCurrentBranch();\n        // ONLY inside `if (branchPattern)`. A detached HEAD with turnOffRuleWhileOnBranch=null (the\n        // overwhelmingly common value) is a non-event and must stay silent, or every tag build,\n        // bisect and `gh pr checkout --detach` starts failing for no reason. The fault reported here\n        // is \"you asked for branch scoping where no branch exists\", never \"HEAD is detached\".\n        if (current === 'HEAD' || current === '') {\n            throw new InformAiError(\n                `turnOffRuleWhileOnBranch: \"${branchPattern}\" is configured, but the current branch ` +\n                    `cannot be determined — HEAD is detached, which is what a CI checkout of a merge ref ` +\n                    `looks like. The hatch would silently NOT apply, so this fails now rather than passing ` +\n                    `on your machine and failing in CI with an unrelated-looking error.\\n\\n` +\n                    `WORKAROUNDS, in order of preference:\\n` +\n                    `  1. Upgrade to a webpieces that reads GITHUB_HEAD_REF (no workflow change needed).\\n` +\n                    `  2. Set WEBPIECES_BRANCH in the workflow so the branch can be resolved.\\n` +\n                    `  3. Use turnOffRuleUntilEpoch instead — it is TIME based, so it survives any checkout ` +\n                    `including a detached one, and it is the only hatch that works in CI today. Set it to a ` +\n                    `SHORT date (a few days): unlike branch scoping it is repo-wide while it lasts, so it ` +\n                    `also shelters unrelated work that lands in the same window.`\n            );\n        }\n        if (current === branchPattern) {\n            return { skip: true, reason: `on branch \"${branchPattern}\"` };\n        }\n    }\n    if (epoch !== undefined) {\n        const nowSeconds = Date.now() / 1000;\n        if (nowSeconds < epoch) {\n            const expiresDate = new Date(epoch * 1000).toISOString().split('T')[0];\n            return { skip: true, reason: `turnOffRuleUntilEpoch active, expires: ${expiresDate}` };\n        }\n    }\n    return { skip: false };\n}\n"]}
+{"version":3,"file":"skip-rule.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/skip-rule.ts"],"names":[],"mappings":";;;AA0DA,4CAeC;AAuHD,wCA0CC;;AA1OD,iDAAyC;AACzC,+CAAyB;AAEzB,uDAAkD;AAClD,uDAAkD;AAClD,yCAAqC;AAErC,kFAAkF;AAClF,8EAA8E;AAC9E,uEAAuE;AACvE,sDAAsD;AAEtD;;;;;;;;;;;GAWG;AACH,MAAa,cAAc;IACvB,IAAI,CAAU;IACd,kEAAkE;IAClE,MAAM,CAAS;IACf,uFAAuF;IACvF,eAAe,CAAS;IAExB,YAAY,IAAa,EAAE,SAAiB,EAAE,EAAE,kBAA0B,EAAE;QACxE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IAC3C,CAAC;CACJ;AAZD,wCAYC;AAED,4FAA4F;AAC5F,gGAAgG;AAChG,oGAAoG;AACpG,2EAA2E;AAC3E,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,+CAA+C;AAC/C,oGAAoG;AACpG,mGAAmG;AACnG,4FAA4F;AAC5F,4FAA4F;AAC5F,kFAAkF;AAClF,EAAE;AACF,qGAAqG;AACrG,qFAAqF;AACrF,oGAAoG;AACpG,kGAAkG;AAClG,uEAAuE;AACvE,SAAgB,gBAAgB;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,wHAAwH;IACxH,0IAA0I;IAC1I,IAAI,CAAC;QACD,OAAO,IAAA,wBAAQ,EAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,+BAAa,CAAC,2CAA2C,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1G,CAAC;AACL,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,4OAA4O;AAC5O,SAAS,yBAAyB,CAAC,UAAkB;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,cAAc,IAAI,SAAS,KAAK,qBAAqB;QAAE,OAAO;IAChF,IAAI,SAAS,KAAK,qBAAqB;QAAE,MAAM,WAAW,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;IAElG,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAC1E,MAAM,WAAW,CAAC,UAAU,EAAE,QAAQ,KAAK,IAAI;QAC3C,CAAC,CAAC,kHAAkH;QACpH,CAAC,CAAC,gDAAgD,QAAQ,cAAc,QAAQ,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,oGAAoG;AACpG,SAAS,oBAAoB,CAAC,UAAkB;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,sMAAsM;IACtM,2EAA2E;IAC3E,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAwB,CAAC;QACrF,OAAO,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,+BAAa,CACnB,0BAA0B,EAC1B,8BAA8B,UAAU,yDAAyD;YAC7F,0FAA0F;YAC1F,GAAG,SAAS,uBAAuB,KAAK,CAAC,OAAO,EAAE,EACtD,SAAS,EACT,SAAS,EACT,CAAC,+EAA+E;YAC/E,wFAAwF,CAAC,EAC1F,SAAS,EACT,KAAK,CAAC,CAAC;IACf,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,oGAAoG;AACpG,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAY;IACjD,OAAO,IAAI,+BAAa,CACpB,0BAA0B,EAC1B,8BAA8B,UAAU,kCAAkC,IAAI,oBAAoB;QAC9F,gGAAgG;QAChG,gGAAgG;QAChG,8FAA8F;QAC9F,kDAAkD,EACtD,SAAS,EACT,SAAS,EACT;QACI,gGAAgG;YAC5F,+FAA+F;YAC/F,gFAAgF;QACpF,wFAAwF;YACpF,oCAAoC;KAC3C,CACJ,CAAC;AACN,CAAC;AAED,SAAgB,cAAc,CAC1B,KAAyB;AACzB,iGAAiG;AACjG,qGAAqG;AACrG,kGAAkG;AAClG,4FAA4F;AAC5F,EAAE;AACF,+FAA+F;AAC/F,0FAA0F;AAC1F,UAAqC;IAErC,IAAI,UAAU,EAAE,CAAC;QACb,8FAA8F;QAC9F,8FAA8F;QAC9F,0CAA0C;QAC1C,EAAE;QACF,kGAAkG;QAClG,kGAAkG;QAClG,gGAAgG;QAChG,kGAAkG;QAClG,wFAAwF;QACxF,kGAAkG;QAClG,oFAAoF;QACpF,yBAAyB,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACvC,OAAO,IAAI,cAAc,CAAC,KAAK,EAAE,EAAE,EAC/B,8BAA8B,UAAU,qDAAqD;gBAC7F,uFAAuF,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YACzB,OAAO,IAAI,cAAc,CAAC,IAAI,EAAE,cAAc,UAAU,GAAG,CAAC,CAAC;QACjE,CAAC;IACL,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACrC,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;YACrB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,OAAO,IAAI,cAAc,CAAC,IAAI,EAAE,0CAA0C,WAAW,EAAE,CAAC,CAAC;QAC7F,CAAC;IACL,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import { execSync } from 'child_process';\nimport * as fs from 'fs';\n\nimport { InformAiError } from './inform-ai-error';\nimport { RuleFailError } from './rule-fail-error';\nimport { toError } from './to-error';\n\n// Universal \"should this rule be skipped right now?\" logic, shared by code-rules,\n// ai-hook-rules and the Nx executors so every rule honors the same two escape\n// hatches: turnOffRuleWhileOnBranch (skip while on a named branch) and\n// turnOffRuleUntilEpoch (skip until an epoch passes).\n\n/**\n * The skip decision. A CLASS, not an interface (CLAUDE.md rule 1), because it carries a THIRD fact\n * beyond yes/no that a caller has to be able to read rather than read about in a log line.\n *\n * `hatchNotApplied` is that fact: a branch hatch WAS configured, and it could NOT apply — today only\n * because HEAD is detached (a tag checkout, a `git bisect` step, a CI checkout of a merge ref). The rule\n * is ENFORCED in that case, so there is nothing to report unless the rule then FAILS; when it does, its\n * own RuleFailError is where this belongs, as context on why the hatch the config shows did not save it.\n *\n * It is deliberately NOT printed here. Everything in this framework throws to ONE place that renders per\n * audience; a console write from a library function cannot be caught, re-rendered or asserted on.\n */\nexport class SkipRuleResult {\n    skip: boolean;\n    /** Why the rule IS being skipped. '' whenever `skip` is false. */\n    reason: string;\n    /** Why a CONFIGURED branch hatch did not apply, or '' when there is nothing to say. */\n    hatchNotApplied: string;\n\n    constructor(skip: boolean, reason: string = '', hatchNotApplied: string = '') {\n        this.skip = skip;\n        this.reason = reason;\n        this.hatchNotApplied = hatchNotApplied;\n    }\n}\n\n// The actual checked-out branch. The grab bag of ambient env vars (BRANCH_NAME, GIT_BRANCH,\n// CI_COMMIT_BRANCH, …) was intentionally REMOVED and must stay removed: a stray GIT_BRANCH=main\n// locally made this return \"main\" on a feature branch, which (a) mislabeled the main-sync cache and\n// (b) silently disabled merged-PR detection (detectMergedPr skips \"main\").\n//\n// The two vars below are NOT that. They are consulted BEFORE git because git cannot answer at all in\n// the case they cover — a `pull_request` checkout leaves HEAD detached on refs/pull/<N>/merge, where\n// `git rev-parse --abbrev-ref HEAD` returns the literal string \"HEAD\" and no branch hatch can match.\n// Neither can go stale the way GIT_BRANCH did:\n//   GITHUB_HEAD_REF  — set by the GitHub runner ONLY on pull_request/pull_request_target, and it IS\n//                      the source branch name. Absent on push, so the fallthrough stays safe. (Not\n//                      GITHUB_REF_NAME: on pull_request that is \"<N>/merge\", not a branch.)\n//   WEBPIECES_BRANCH — one documented opt-in override for CI systems not special-cased here\n//                      (GitLab, CircleCI, Buildkite). Nobody sets it by accident.\n//\n// This getter answers \"what branch am I on?\" and NOTHING about whether that answer may be TRUSTED to\n// unlock an escape hatch. That second question is asked by shouldSkipRule alone (see\n// assertBranchIsTrustworthy) because this getter has callers — the main-sync cache label, merged-PR\n// detection, code-rules' re-export of it — for which a fork's own branch name is a perfectly good\n// answer, and making the getter itself throw would redden all of them.\nexport function getCurrentBranch(): string {\n    const prBranch = process.env['GITHUB_HEAD_REF'];\n    if (prBranch) return prBranch;\n\n    const override = process.env['WEBPIECES_BRANCH'];\n    if (override) return override;\n\n    // webpieces-disable no-unmanaged-exceptions -- rethrow as InformAiError so global catch surfaces readable message to AI\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- rethrow as InformAiError so global catch surfaces readable message to AI\n    try {\n        return execSync('git rev-parse --abbrev-ref HEAD', { encoding: 'utf8' }).trim();\n    } catch (err: unknown) {\n        const error = toError(err);\n        throw new InformAiError(`Failed to determine current git branch: ${error.message}`, { cause: error });\n    }\n}\n\n// The slice of the GitHub `pull_request` event payload that says WHO OWNS the head branch. Only the\n// one field below is read; everything else in that file is ignored.\ninterface RawPullRequestEvent {\n    pull_request?: {\n        head?: {\n            repo?: {\n                full_name?: string;\n            };\n        };\n    };\n}\n\n/**\n * Refuse the branch hatch on a pull request whose head branch this repo does not own.\n *\n * The hole it closes: hatch names live in `webpieces.config.json`, which is COMMITTED and public. On a\n * `pull_request` from a FORK the runner sets GITHUB_HEAD_REF to the FORK AUTHOR's branch name, so an\n * outside contributor who names their branch after one of your hatches silently disables that rule on\n * their PR — the one place you least want a rule off.\n *\n * It is answered with no network and no token, from `$GITHUB_EVENT_PATH` — a JSON file the runner writes\n * before the job starts:\n *   - `pull_request_target` runs with the BASE repo's secrets against contributor-authored code, so it is\n *     untrusted unconditionally; there is nothing to compare.\n *   - `pull_request` is trusted only when the head repo's `full_name` EQUALS `GITHUB_REPOSITORY`.\n *\n * \"Cannot tell\" counts as untrusted — a `pull_request` run with no readable event file cannot make the\n * comparison, and a hatch that cannot be proven to be yours must not fire.\n *\n * This is the ONE hard failure left in this module, and it is not the \"no branch here\" case (see\n * shouldSkipRule, which enforces quietly when HEAD is detached). It is a hatch name that DOES resolve but\n * is attacker-chosen — a security property, not a checkout that happens not to be editing.\n *\n * Called ONLY from inside `if (branchName)`. With turnOffRuleWhileOnBranch null — the overwhelmingly\n * common value — nothing here runs and no fork PR is affected in any way.\n */\n// webpieces-disable no-function-outside-class -- module-scope helper of the module-scope shouldSkipRule it serves; this whole module is functional by design (imported as free functions by code-rules, ai-hook-rules and the nx executors)\nfunction assertBranchIsTrustworthy(branchName: string): void {\n    const eventName = process.env['GITHUB_EVENT_NAME'];\n    if (eventName !== 'pull_request' && eventName !== 'pull_request_target') return;\n    if (eventName === 'pull_request_target') throw forkRefusal(branchName, 'pull_request_target run');\n\n    const headRepo = readHeadRepoFullName(branchName);\n    const thisRepo = process.env['GITHUB_REPOSITORY'] ?? '';\n    if (headRepo !== null && thisRepo !== '' && headRepo === thisRepo) return;\n    throw forkRefusal(branchName, headRepo === null\n        ? 'pull_request run with no readable $GITHUB_EVENT_PATH, so the head branch cannot be proven to belong to this repo'\n        : `pull_request run whose head branch lives in \"${headRepo}\", not in \"${thisRepo}\"`);\n}\n\n/**\n * The head repo's `owner/name` from the runner's event file, or null when there is no such file.\n *\n * A file that exists but cannot be parsed is a different thing from one that is absent, and it throws:\n * it means the runner wrote something this code does not understand, and silently downgrading that to\n * \"untrusted\" would hide a real incompatibility behind a message about forks.\n */\n// webpieces-disable no-function-outside-class -- module-scope helper, see assertBranchIsTrustworthy\nfunction readHeadRepoFullName(branchName: string): string | null {\n    const eventPath = process.env['GITHUB_EVENT_PATH'];\n    if (!eventPath || !fs.existsSync(eventPath)) return null;\n    // webpieces-disable no-unmanaged-exceptions -- chokepoint: a raw SyntaxError from the runner's event file would say nothing about hatches; this names the hatch, the file and the rule that stayed ON\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- see above\n    try {\n        const parsed = JSON.parse(fs.readFileSync(eventPath, 'utf8')) as RawPullRequestEvent;\n        return parsed.pull_request?.head?.repo?.full_name ?? null;\n    } catch (err: unknown) {\n        const error = toError(err);\n        throw new RuleFailError(\n            'turnOffRuleWhileOnBranch',\n            `turnOffRuleWhileOnBranch: \"${branchName}\" is configured and this is a pull_request run, so the ` +\n                `head repository must be checked before the hatch may fire — but the runner's event file ` +\n                `${eventPath} could not be read: ${error.message}`,\n            undefined,\n            undefined,\n            ['Use turnOffRuleUntilEpoch instead — it is TIME based and needs no event file.',\n             'Or clear turnOffRuleWhileOnBranch (set it to null) so no trust check is needed at all.'],\n            undefined,\n            error);\n    }\n}\n\n/**\n * The fork refusal, as a `RuleFailError`.\n *\n * The cures are `fixHints` — a LIST — because the framework owns how they are labelled and numbered\n * (`rule-reporter.ts` prefixes each with \"Fix: \"; the hook runner folds them into its Violation). A\n * hand-numbered \"WORKAROUNDS: 1. … 2. …\" string literal, which is what this used to be, is exactly the\n * shape `FixHint`/`Option` exist to prevent. `FixHint` itself lives in `ai-hook-rules`, which\n * `rules-config` sits BELOW and cannot import, so `RuleFailError.fixHints` is the structured list\n * available at this layer.\n *\n * `ruleName` is the HATCH, not the rule being evaluated: `shouldSkipRule` is handed only the two hatch\n * values and does not know whose rule it is deciding for — and the thing that failed genuinely is the\n * hatch, which cannot be honored here.\n */\n// webpieces-disable no-function-outside-class -- module-scope helper, see assertBranchIsTrustworthy\nfunction forkRefusal(branchName: string, what: string): RuleFailError {\n    return new RuleFailError(\n        'turnOffRuleWhileOnBranch',\n        `turnOffRuleWhileOnBranch: \"${branchName}\" is configured, but this is a ${what}. The branch name ` +\n            `there is chosen by the PULL REQUEST AUTHOR, and hatch names are public (webpieces.config.json ` +\n            `is committed), so honoring the hatch would let anyone turn this rule off on their own PR just ` +\n            `by naming their branch after it. The rule is NOT skipped, and this fails loudly rather than ` +\n            `quietly enforcing a rule the config says is off.`,\n        undefined,\n        undefined,\n        [\n            'If the rule must be off for outside contributions too, use turnOffRuleUntilEpoch — it is TIME ' +\n                'based, so it cannot be self-granted by naming a branch. Keep the date short: it is repo-wide ' +\n                'while it lasts, so it also shelters unrelated work landing in the same window.',\n            'Otherwise clear turnOffRuleWhileOnBranch (set it to null) and fix the findings on the ' +\n                'contributed branch like any other.',\n        ],\n    );\n}\n\nexport function shouldSkipRule(\n    epoch: number | undefined,\n    // The branch hatch is an EXACT branch name — compared with `===`, never a glob, regex or prefix.\n    // That is deliberate and is not to be \"improved\": the hatch turns a rule OFF, and a pattern lets one\n    // config line switch rules off on branches nobody enumerated when it was written. If two branches\n    // need the same rule off, that is two branches renamed to one hatch name, not one wildcard.\n    //\n    // null (the \"no branch / always on\" value of turnOffRuleWhileOnBranch) is treated exactly like\n    // undefined — no branch scoping. Only a non-empty branch name activates the branch hatch.\n    branchName: string | undefined | null\n): SkipRuleResult {\n    if (branchName) {\n        // The fork gate fires ONLY inside `if (branchName)`. With turnOffRuleWhileOnBranch=null — the\n        // overwhelmingly common value — nothing below runs, so an outside contribution to a repo that\n        // configured no hatch is an ordinary run.\n        //\n        // A DETACHED HEAD is NOT an error here. The branch hatch exists to relax a rule while you EDIT on\n        // a branch; a tag checkout or a `git bisect` step is not editing (you cannot commit to a tag, and\n        // to edit you branch off it first). So when no branch can be resolved the hatch simply does not\n        // apply and THE RULE IS ENFORCED — whoever hits a violation then gets that rule's own message and\n        // cure, which is the useful output. WHY the hatch did not fire rides back on the result\n        // (SkipRuleResult.hatchNotApplied) rather than being printed, so a caller that does fail can fold\n        // it into its own error instead of a library writing to a console nobody can catch.\n        assertBranchIsTrustworthy(branchName);\n        const current = getCurrentBranch();\n        if (current === 'HEAD' || current === '') {\n            return new SkipRuleResult(false, '',\n                `turnOffRuleWhileOnBranch: \"${branchName}\" did not apply — HEAD is detached, so there is no ` +\n                `branch to match (a tag checkout, a git bisect step, or a CI checkout of a merge ref).`);\n        }\n        if (current === branchName) {\n            return new SkipRuleResult(true, `on branch \"${branchName}\"`);\n        }\n    }\n    if (epoch !== undefined) {\n        const nowSeconds = Date.now() / 1000;\n        if (nowSeconds < epoch) {\n            const expiresDate = new Date(epoch * 1000).toISOString().split('T')[0];\n            return new SkipRuleResult(true, `turnOffRuleUntilEpoch active, expires: ${expiresDate}`);\n        }\n    }\n    return new SkipRuleResult(false);\n}\n"]}

package/src/validate-config.d.ts

@@ -2,6 +2,18 @@ import { validateChecklistsSection } from './pr-gate-section-validators';
 export { validateChecklistsSection };
 export { allRuleNames } from './rule-schemas';
 export { recommendedSeedMode, recommendedSeedModeFor, seedEntryForRule } from './seed-entry';
+/**
+ * The longest a `turnOffRuleUntilEpoch` may reach into the future: ONE WEEK. Poke it again next week to
+ * extend — that weekly re-set IS the intended workflow, not a workaround: it is what makes a rule that is
+ * off on purpose stay a decision somebody keeps making, instead of one nobody remembers.
+ *
+ * DELIBERATELY ASYMMETRIC with turnOffRuleWhileOnBranch, which has NO cap and must not get one. The epoch
+ * hatch is REPO-WIDE while it lasts, so a long window shelters every unrelated change that lands inside it
+ * (a fleet repo was found with max-file-lines/max-method-lines switched off until 2026-10-01 — 43 days
+ * out, six times this cap). The branch hatch fires only on ONE exact branch name — a big refactor
+ * legitimately runs 35+ days, and capping that would only interrupt the one branch that opted in.
+ */
+export declare const MAX_TURN_OFF_EPOCH_DAYS = 7;
 export declare function validateWebpiecesConfig(rawRules: Record<string, Record<string, unknown>>, hasCustomRulesDir?: boolean): string[];
 /**
  * Validate the top-level `pr-gate` section. It is REQUIRED (a client that opts out sets mode "OFF").

package/src/validate-config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.seedEntryForRule = exports.recommendedSeedModeFor = exports.recommendedSeedMode = exports.allRuleNames = exports.validateChecklistsSection = void 0;
+exports.MAX_TURN_OFF_EPOCH_DAYS = exports.seedEntryForRule = exports.recommendedSeedModeFor = exports.recommendedSeedMode = exports.allRuleNames = exports.validateChecklistsSection = void 0;
 exports.validateWebpiecesConfig = validateWebpiecesConfig;
 exports.validatePrGateSection = validatePrGateSection;
 exports.validateExcludePaths = validateExcludePaths;
@@ -26,13 +26,48 @@ Object.defineProperty(exports, "recommendedSeedModeFor", { enumerable: true, get
 Object.defineProperty(exports, "seedEntryForRule", { enumerable: true, get: function () { return seed_entry_2.seedEntryForRule; } });
 const match_rules_config_1 = require("./match-rules-config");
 const to_error_1 = require("./to-error");
+/**
+ * The longest a `turnOffRuleUntilEpoch` may reach into the future: ONE WEEK. Poke it again next week to
+ * extend — that weekly re-set IS the intended workflow, not a workaround: it is what makes a rule that is
+ * off on purpose stay a decision somebody keeps making, instead of one nobody remembers.
+ *
+ * DELIBERATELY ASYMMETRIC with turnOffRuleWhileOnBranch, which has NO cap and must not get one. The epoch
+ * hatch is REPO-WIDE while it lasts, so a long window shelters every unrelated change that lands inside it
+ * (a fleet repo was found with max-file-lines/max-method-lines switched off until 2026-10-01 — 43 days
+ * out, six times this cap). The branch hatch fires only on ONE exact branch name — a big refactor
+ * legitimately runs 35+ days, and capping that would only interrupt the one branch that opted in.
+ */
+exports.MAX_TURN_OFF_EPOCH_DAYS = 7;
+const SECONDS_PER_DAY = 24 * 60 * 60;
+/**
+ * Reject a `turnOffRuleUntilEpoch` more than MAX_TURN_OFF_EPOCH_DAYS into the future.
+ *
+ * A PAST epoch is always valid: it is inert (it skips nothing), and every existing config is full of them.
+ * The BOUNDARY is inclusive — exactly MAX_TURN_OFF_EPOCH_DAYS out is accepted, only strictly beyond it is
+ * refused — so a config written as "now + 7 days" is never rejected by the second it took to save.
+ */
+// webpieces-disable no-function-outside-class -- module-scope validator helper, matching every other check in this file
+function epochCapError(label, value) {
+    const maxEpoch = Math.floor(Date.now() / 1000) + exports.MAX_TURN_OFF_EPOCH_DAYS * SECONDS_PER_DAY;
+    if (value <= maxEpoch)
+        return null;
+    const daysOut = Math.round((value - Date.now() / 1000) / SECONDS_PER_DAY);
+    const maxDate = new Date(maxEpoch * 1000).toISOString().split('T')[0];
+    return (`${label} "turnOffRuleUntilEpoch": ${value} is ${daysOut} days in the future — the maximum is ` +
+        `${exports.MAX_TURN_OFF_EPOCH_DAYS} days. A rule switched off for longer than that is off for work nobody ` +
+        `had in mind when it was written, because this hatch is REPO-WIDE while it lasts.\n` +
+        `  CURE: set it to at most ${maxEpoch} (${maxDate}), then re-set it WEEKLY for as long as you ` +
+        `still need it — that renewal is the intended workflow, not a workaround. If the rule is off for ` +
+        `ONE branch's work, use "turnOffRuleWhileOnBranch": "<exact branch name>" instead; that one has ` +
+        `no cap.`);
+}
 function valueHint(def, key) {
     // The two universal escape hatches, REQUIRED on every rule so they're always visible. Spell out the
     // "off" value so a fresh config seeds them in the active/no-op state (0 / null), not a placeholder.
     if (key === 'turnOffRuleUntilEpoch')
         return '0  (0 = active; future unix-epoch seconds = temporarily off)';
     if (key === 'turnOffRuleWhileOnBranch')
-        return 'null  (null = always on; a branch name disables the rule while that branch is checked out)';
+        return 'null  (null = always on; an EXACT branch name — no globs — disables the rule while that branch is checked out)';
     return def.enumValues
         ? `"${def.enumValues.join(' | ')}"`
         : def.type === 'string[]' ? '["<string>", ...]'
@@ -138,6 +173,51 @@ const RENAMED_FIELD_ALIASES = {
 function renamedFieldError(scope, oldKey, newKey) {
     return `${scope} Unknown field "${oldKey}" — it was renamed to "${newKey}". Rename it (the value carries over unchanged; for the branch hatch, use null when there is no branch).`;
 }
+/**
+ * Field-level errors for ONE configured rule entry: unknown/renamed/retired keys, type and enum
+ * mismatches, and the two-week cap on turnOffRuleUntilEpoch.
+ *
+ * Extracted out of validateWebpiecesConfig purely so that function stays inside max-method-lines; it is
+ * the same checks in the same order.
+ */
+// webpieces-disable no-any-unknown -- one config entry as opaque JSON; every field is typed-checked below
+// webpieces-disable no-function-outside-class -- module-scope validator helper, matching every other check in this file
+function fieldErrors(ruleName, entry, schema) {
+    const errors = [];
+    for (const [key, value] of Object.entries(entry)) {
+        const fieldDef = schema[key];
+        if (!fieldDef) {
+            const renamedTo = RENAMED_FIELD_ALIASES[key];
+            if (renamedTo) {
+                errors.push(renamedFieldError(`[${ruleName}]`, key, renamedTo));
+                continue;
+            }
+            const retiredHint = RETIRED_FIELD_HINTS[`${ruleName}.${key}`];
+            const suffix = retiredHint ? ` ${retiredHint}` : '';
+            errors.push(`[${ruleName}] Unknown field "${key}". Valid fields: [${Object.keys(schema).join(', ')}].${suffix}`);
+            continue;
+        }
+        // A nullable field (e.g. turnOffRuleWhileOnBranch) accepts JSON null in addition to its type.
+        if (value === null && fieldDef.nullable)
+            continue;
+        if (fieldDef.type === 'string[]') {
+            if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))
+                errors.push(`[${ruleName}] "${key}" must be string[], got ${typeof value}.`);
+        }
+        else if (typeof value !== fieldDef.type) {
+            errors.push(`[${ruleName}] "${key}" must be ${fieldDef.type}, got ${typeof value}.`);
+        }
+        else if (fieldDef.enumValues && !fieldDef.enumValues.includes(value)) {
+            errors.push(`[${ruleName}] "${key}" = "${value}" is not valid. Must be one of: ${fieldDef.enumValues.join(', ')}.`);
+        }
+        else if (key === 'turnOffRuleUntilEpoch') {
+            const capError = epochCapError(`[${ruleName}]`, value);
+            if (capError)
+                errors.push(capError);
+        }
+    }
+    return errors;
+}
 // webpieces-disable no-any-unknown -- rawRules values are opaque JSON; each field is validated individually
 function validateWebpiecesConfig(rawRules, hasCustomRulesDir = false) {
     const errors = [];
@@ -161,33 +241,7 @@ function validateWebpiecesConfig(rawRules, hasCustomRulesDir = false) {
                 errors.push(unknownRuleError(ruleName));
             continue;
         }
-        for (const [key, value] of Object.entries(entry)) {
-            const fieldDef = schema[key];
-            if (!fieldDef) {
-                const renamedTo = RENAMED_FIELD_ALIASES[key];
-                if (renamedTo) {
-                    errors.push(renamedFieldError(`[${ruleName}]`, key, renamedTo));
-                    continue;
-                }
-                const retiredHint = RETIRED_FIELD_HINTS[`${ruleName}.${key}`];
-                const suffix = retiredHint ? ` ${retiredHint}` : '';
-                errors.push(`[${ruleName}] Unknown field "${key}". Valid fields: [${Object.keys(schema).join(', ')}].${suffix}`);
-                continue;
-            }
-            // A nullable field (e.g. turnOffRuleWhileOnBranch) accepts JSON null in addition to its type.
-            if (value === null && fieldDef.nullable)
-                continue;
-            if (fieldDef.type === 'string[]') {
-                if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))
-                    errors.push(`[${ruleName}] "${key}" must be string[], got ${typeof value}.`);
-            }
-            else if (typeof value !== fieldDef.type) {
-                errors.push(`[${ruleName}] "${key}" must be ${fieldDef.type}, got ${typeof value}.`);
-            }
-            else if (fieldDef.enumValues && !fieldDef.enumValues.includes(value)) {
-                errors.push(`[${ruleName}] "${key}" = "${value}" is not valid. Must be one of: ${fieldDef.enumValues.join(', ')}.`);
-            }
-        }
+        errors.push(...fieldErrors(ruleName, entry, schema));
         // Required fields must actually be present. Until now the loop above only checked
         // fields that WERE present, so an entry like `{}` (or one missing `mode` /
         // `turnOffRuleUntilEpoch`) slipped through. Every non-optional schema field is mandatory.
@@ -440,12 +494,18 @@ function validateMatchRule(entry, index) {
         errors.push(`[match-rules] ${label}.mode must be one of: ${rule_configs_1.MODIFIED_CODE_MODES.join(', ')}.`);
     // Both escape hatches are REQUIRED on every match-rule too (same as keyed rules), so they are always
     // visible. turnOffRuleUntilEpoch: number (0 = active; a future unix-epoch in seconds = temporarily
-    // off). turnOffRuleWhileOnBranch: string | null (null = always on; a branch name disables the rule
-    // while that branch is checked out).
-    if (typeof e['turnOffRuleUntilEpoch'] !== 'number')
+    // off). turnOffRuleWhileOnBranch: string | null (null = always on; an EXACT branch name — matched
+    // with ===, never as a glob — disables the rule while that branch is checked out).
+    if (typeof e['turnOffRuleUntilEpoch'] !== 'number') {
         errors.push(`[match-rules] ${label}.turnOffRuleUntilEpoch must be a number (0 = active; future unix-epoch seconds = temporarily off).`);
+    }
+    else {
+        const capError = epochCapError(`[match-rules] ${label}`, e['turnOffRuleUntilEpoch']);
+        if (capError)
+            errors.push(capError);
+    }
     if (!(e['turnOffRuleWhileOnBranch'] === null || typeof e['turnOffRuleWhileOnBranch'] === 'string'))
-        errors.push(`[match-rules] ${label}.turnOffRuleWhileOnBranch must be a string or null (null = no branch / always on).`);
+        errors.push(`[match-rules] ${label}.turnOffRuleWhileOnBranch must be a string or null (null = no branch / always on; a string is an EXACT branch name, globs are not supported).`);
     // The old escape-hatch names were renamed — flag them precisely.
     for (const oldKey of Object.keys(RENAMED_FIELD_ALIASES)) {
         if (oldKey in e)

package/src/validate-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/validate-config.ts"],"names":[],"mappings":";;;AAuJA,0DAqEC;AAmFD,sDAoEC;AA2BD,oDAmBC;AA2FD,8DAuBC;AAUD,4DAuBC;AAjjBD,wGAAwG;AACxG,kFAAkF;AAClF,+DAAiE;AACjE,yCAAyD;AACzD,iDAA4D;AAC5D,6CAAqE;AACrE,iDAAqD;AACrD,6EAAuJ;AAK9I,0GALA,sDAAyB,OAKA;AAJlC,+DAAsF;AACtF,2CAAoD;AAIpD,yFAAyF;AACzF,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AACrB,2CAA6F;AAApF,iHAAA,mBAAmB,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AACtE,6DAA2D;AAC3D,yCAAqC;AAErC,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY;IAC1C,oGAAoG;IACpG,oGAAoG;IACpG,IAAI,GAAG,KAAK,uBAAuB;QAAE,OAAO,8DAA8D,CAAC;IAC3G,IAAI,GAAG,KAAK,0BAA0B;QAAE,OAAO,4FAA4F,CAAC;IAC5I,OAAO,GAAG,CAAC,UAAU;QACjB,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;QACnC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB;YAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAG,CAAC,CAAC,UAAU;gBACtC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAE,CAAC,CAAC,WAAW;oBACvC,CAAC,CAAC,YAAY,CAAC;AACvB,CAAC;AAED,yGAAyG;AACzG,SAAS,UAAU,CAAC,MAAgC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;IAC/C,iGAAiG;IACjG,8FAA8F;IAC9F,MAAM,WAAW,GAAG,IAAA,mCAAsB,EAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,IAAA,0BAAa,EAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,CACH,2CAA2C,WAAW,mCAAmC;QACzF,4FAA4F;QAC5F,4CAA4C,MAAM,EAAE,CACvD,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,MAAgC;IAC1E,+EAA+E;IAC/E,oGAAoG;IACpG,yGAAyG;IACzG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,GACH,IAAI,QAAQ,qEAAqE,OAAO,aAAa;QACrG,mDAAmD;QACnD,MAAM,QAAQ,SAAS,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAE5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,GAAG;YACC,sEAAsE;gBACtE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACtC,OAAO,CACH,IAAI,QAAQ,iFAAiF;QAC7F,iGAAiG;QACjG,eAAe,QAAQ,4CAA4C,iCAAqB,QAAQ;QAChG,mGAAmG;QACnG,6FAA6F;QAC7F,mGAAmG;QACnG,sFAAsF;QACtF,IAAI,QAAQ,oFAAoF;QAChG,mGAAmG;QACnG,mGAAmG;QACnG,6DAA6D,CAChE,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,wGAAwG;AACxG,iGAAiG;AACjG,MAAM,mBAAmB,GAA2B;IAChD,mCAAmC,EAC/B,8FAA8F;QAC9F,2EAA2E;IAC/E,sCAAsC,EAClC,8FAA8F;QAC9F,iGAAiG;QACjG,wDAAwD;IAC5D,mGAAmG;IACnG,mGAAmG;IACnG,oGAAoG;IACpG,2FAA2F;IAC3F,oCAAoC,EAChC,4FAA4F;QAC5F,kGAAkG;QAClG,WAAW;IACf,yCAAyC,EACrC,4FAA4F;QAC5F,iGAAiG;QACjG,WAAW;CAClB,CAAC;AAEF,+FAA+F;AAC/F,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,qBAAqB,GAA2B;IAClD,wBAAwB,EAAE,uBAAuB;IACjD,uBAAuB,EAAE,0BAA0B;CACtD,CAAC;AAGF,mEAAmE;AACnE,8GAA8G;AAC9G,SAAS,iBAAiB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;IACpE,OAAO,GAAG,KAAK,mBAAmB,MAAM,0BAA0B,MAAM,0GAA0G,CAAC;AACvL,CAAC;AAED,4GAA4G;AAC5G,SAAgB,uBAAuB,CACnC,QAAiD,EACjD,oBAA6B,KAAK;IAElC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,2BAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,2FAA2F;YAC3F,yFAAyF;YACzF,2FAA2F;YAC3F,iCAAiC;YACjC,MAAM,OAAO,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,IAAA,qCAAe,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtC,SAAS;YACb,CAAC;YACD,mFAAmF;YACnF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,CAAC,iBAAiB;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChE,SAAS;QACb,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,SAAS,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,QAAQ,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;oBAChE,SAAS;gBACb,CAAC;gBACD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,oBAAoB,GAAG,qBAAqB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;gBACjH,SAAS;YACb,CAAC;YACD,8FAA8F;YAC9F,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ;gBAAE,SAAS;YAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACjE,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;YACrF,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,aAAa,QAAQ,CAAC,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC,CAAC;YACzF,CAAC;iBAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;gBAC/E,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,QAAQ,KAAK,mCAAmC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxH,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,2EAA2E;QAC3E,0FAA0F;QAC1F,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,6BAA6B,GAAG,UAAU,GAAG,KAAK,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,mEAAmE;IACnE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,2BAAY,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAC7C,6FAA6F;AAC7F,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAEtD,iGAAiG;AACjG,kGAAkG;AAClG,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAChB,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;IACtD,8FAA8F;IAC9F,+FAA+F;IAC/F,kGAAkG;IAClG,oEAAoE;IACpE,+FAA+F;IAC/F,2GAA2G;IAC3G,mGAAmG;IACnG,uEAAuE,CAC9E,CAAC;AAEF,gGAAgG;AAChG,6FAA6F;AAC7F,SAAS,aAAa;IAClB,OAAO,CACH,kBAAkB;QAClB,qBAAqB;QACrB,0IAA0I;QAC1I,kBAAkB;QAClB,8GAA8G;QAC9G,UAAU;QACV,4FAA4F;QAC5F,qHAAqH;QACrH,SAAS;QACT,KAAK,CACR,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,kCAAkC;AAClC,uGAAuG;AACvG,8GAA8G;AAC9G,SAAS,oBAAoB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,oFAAoF,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAa,EAAE,KAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,mBAAmB,KAAK,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,0FAA0F;IAC1F,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,0BAA0B,CAAC,CAAC;IACnG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS;QAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oGAAoG,CAAC,CAAC;SACzI,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK;QAClE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oFAAoF,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS;QACjE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,wEAAwE,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,8GAA8G;AAC9G,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,QAAiB;IACrE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,yFAAyF;gBACzF,8CAA8C,aAAa,EAAE,EAAE;SAClE,CAAC;IACN,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,4CAA4C,aAAa,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,4DAA4D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAiC,CAAC,EAAE,CAAC;QAC7G,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC;IAED,iGAAiG;IACjG,8FAA8F;IAC9F,oDAAoD;IACpD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACP,0FAA0F;gBAC1F,oGAAoG,CACvG,CAAC;QACN,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,iDAAiD,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAwC,CAAC,EAAE,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,EAAE,CAAC,mBAAmB,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,IAAI,OAAO,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnE,sGAAsG;IACtG,sFAAsF;IACtF,IAAI,YAAY,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,sDAAyB,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE5F,qGAAqG;IACrG,oGAAoG;IACpG,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,0KAA0K,CAAC,CAAC;QAC5L,CAAC;IACL,CAAC;IAED,wFAAwF;IACxF,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,kDAAqB,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEtE,6FAA6F;IAC7F,IAAI,WAAW,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,qDAAwB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,wDAA2B,EAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,qGAAqG;IACrG,IAAI,mBAAmB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;IAC3H,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB;IACxB,OAAO,qCAAqC,CAAC;AACjD,CAAC;AAED,gFAAgF;AAChF,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,KAAc,EAAE,GAAW;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,mBAAmB,GAAG,uDAAuD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,6FAA6F;AAC7F,SAAgB,oBAAoB,CAAC,OAAgB;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,kFAAkF;gBAClF,2DAA2D,mBAAmB,EAAE,EAAE;SACrF,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChF,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,mGAAmG;IACnG,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAA,kCAAY,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACxD,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,IAAA,qCAAe,EAAC,OAAO,CAAC,SAAS,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,8EAA8E;AAC9E,kGAAkG;AAClG,sGAAsG;AACtG,yGAAyG;AACzG,8EAA8E;AAE9E,SAAS,iBAAiB;IACtB,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,wCAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,OAAe;IAC/B,8DAA8D;IAC9D,IAAI,CAAC;QACD,kFAAkF;QAClF,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,SAAS,CAAC;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACzB,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,+GAA+G;AAC/G,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,uBAAuB,KAAK,kHAAkH,CAAC,CAAC;IAC5J,CAAC;IACD,+FAA+F;IAC/F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,+EAA+E,CAAC,CAAC;IAE7H,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oDAAoD,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACJ,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,aAAa,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,0CAA0C,CAAC,CAAC;IAElF,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,kCAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAuC,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,yBAAyB,kCAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElG,qGAAqG;IACrG,mGAAmG;IACnG,mGAAmG;IACnG,qCAAqC;IACrC,IAAI,OAAO,CAAC,CAAC,uBAAuB,CAAC,KAAK,QAAQ;QAC9C,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oGAAoG,CAAC,CAAC;IAC5I,IAAI,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,0BAA0B,CAAC,KAAK,QAAQ,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oFAAoF,CAAC,CAAC;IAE5H,iEAAiE;IACjE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,mDAAmD,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,iEAAiE,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC7E,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oCAAoC,CAAC,CAAC;IAE5E,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,SAAgB,yBAAyB,CAAC,OAAgB;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,6FAA6F;gBAC7F,uGAAuG,iBAAiB,EAAE,EAAE;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,wEAAwE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,0FAA0F;QAC1F,MAAM,IAAI,GAAI,OAAO,CAAC,CAAC,CAAoC,EAAE,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,0CAA0C,CAAC,CAAC;YACvH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,4EAA4E;AAC5E,SAAgB,wBAAwB,CACpC,YAAqD,EACrD,iBAA0D;IAE1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAA,sBAAW,EAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,yBAAyB,8CAAwB,sCAAsC;gBAC/F,UAAU,CACb,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,2FAA2F;QAC3F,IAAI,CAAC,IAAA,sBAAW,EAAC,IAAI,CAAC,IAAI,2BAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,wBAAwB,8CAAwB,sCAAsC;gBAC9F,UAAU,CACb,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { FieldDef } from './field-def';\n// Imported, never re-typed: the banner offers the bulk migrator only for errors it actually covers, and\n// this marker is how it recognizes a placement error. See config-error-banner.ts.\nimport { SECTION_PLACEMENT_MARKER } from './config-error-banner';\nimport { sectionForRule, isHookGuard } from './sections';\nimport { RULE_SCHEMAS, allRuleNames } from './rule-schemas';\nimport { recommendedSeedModeFor, isGradualMode } from './seed-entry';\nimport { MODIFIED_CODE_MODES } from './rule-configs';\nimport { validateChecklistsSection, validateDevDeploySection, validateLandPrSection, validateNoGateSaltRationale } from './pr-gate-section-validators';\nimport { retiredEntry, retiredKeyError, retiredRuleFor } from './retired-config-keys';\nimport { PRUNE_UNKNOWN_COMMAND } from './constants';\n\n// Re-exported so the isolated validate-checklist-docs target keeps importing it from here.\nexport { validateChecklistsSection };\n// Re-exported from their new homes: this module was the historical entry point for both.\nexport { allRuleNames } from './rule-schemas';\nexport { recommendedSeedMode, recommendedSeedModeFor, seedEntryForRule } from './seed-entry';\nimport { DEFAULT_MATCH_RULES } from './match-rules-config';\nimport { toError } from './to-error';\n\nfunction valueHint(def: FieldDef, key?: string): string {\n    // The two universal escape hatches, REQUIRED on every rule so they're always visible. Spell out the\n    // \"off\" value so a fresh config seeds them in the active/no-op state (0 / null), not a placeholder.\n    if (key === 'turnOffRuleUntilEpoch') return '0  (0 = active; future unix-epoch seconds = temporarily off)';\n    if (key === 'turnOffRuleWhileOnBranch') return 'null  (null = always on; a branch name disables the rule while that branch is checked out)';\n    return def.enumValues\n        ? `\"${def.enumValues.join(' | ')}\"`\n        : def.type === 'string[]' ? '[\"<string>\", ...]'\n        : def.type === 'number'   ? '<number>'\n        : def.type === 'boolean'  ? '<boolean>'\n        : '\"<string>\"';\n}\n\n/** A rollout hint for the copy-paste snippet: recommend the narrowest gradual mode the rule supports. */\nfunction rolloutTip(schema: Record<string, FieldDef>): string {\n    const modes = schema['mode']?.enumValues ?? [];\n    // Same source of truth as the seeder; only a GRADUAL recommendation gets the rollout prose, so a\n    // rule whose recommendation falls through to ON/RUN_EVERY_TIME/OFF prints no tip (as before).\n    const recommended = recommendedSeedModeFor(modes);\n    if (!isGradualMode(recommended)) return '';\n    const optOut = modes.includes('OFF') ? ' Set \"mode\": \"OFF\" to opt out entirely.' : '';\n    return (\n        `\\n\\n💡 Recommended: start with \"mode\": \"${recommended}\" — it enforces only on what you ` +\n        `actually change, so the rule rolls out gradually (existing code stays grandfathered until ` +\n        `you next touch that project/file/method).${optOut}`\n    );\n}\n\nfunction missingRuleSnippet(ruleName: string, schema: Record<string, FieldDef>): string {\n    // Required fields go in the copy-paste entry. The two universal escape hatches\n    // (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch) are now REQUIRED, so they land in that block —\n    // which is the whole point: every seeded rule shows both hatches. Optional fields are listed separately.\n    const fields = Object.keys(schema);\n    const required = fields.filter(f => !schema[f].optional);\n    const optional = fields.filter(f => schema[f].optional);\n\n    const requiredLines = required.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n    const section = sectionForRule(ruleName);\n    let out =\n        `[${ruleName}] Not configured in webpieces.config.json. Add this entry to the \"${section}\" section\\n` +\n        `(choose values appropriate for your project):\\n\\n` +\n        `  \"${ruleName}\": {\\n${requiredLines.join(',\\n')}\\n  }`;\n\n    if (optional.length > 0) {\n        const optionalLines = optional.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n        out +=\n            `\\n\\nOptional fields you may add to this rule (omit if not needed):\\n` +\n            `${optionalLines.join(',\\n')}`;\n    }\n    out += rolloutTip(schema);\n    return out;\n}\n\n/**\n * A config key under rules/hookGuards that the RUNNING validator has no schema for (and no rulesDir is set\n * to supply custom rules). THE FALLBACK: it fires for any name the table in retired-config-keys.ts does not\n * know, which very much includes RETIRED names on a tree whose validator predates the retirement — the\n * ordinary linked-worktree layout, where the worktree is on one release and the parent checkout that\n * supplies the hook's resolution is on an older one. So this text has to be useful with NO table entry.\n *\n * DELETION LEADS, and it is not a hedge. A key the running validator has no schema for controls nothing:\n * every code path that would read it is keyed off the schema. Leaving it is dead config that reads as live\n * config, and for a retired key deleting it is the entire fix.\n *\n * This message used to lead with `pnpm install` instead, on the theory that the key might be valid and the\n * validator merely stale. Two things are wrong with that. First, it CONTRADICTED the banner this error is\n * printed inside, which states outright that `pnpm install` cannot help — one output, two opposite orders.\n * Second, the premise is already handled upstream: the shim's version-drift guard compares the pin against\n * the installed version and denies every tool call BEFORE exec'ing this validator, with its own message and\n * its own cure. If this text is on screen, that guard found no drift. The pin therefore appears here only as\n * a secondary note, so a valid-but-newer key is never dropped without the reader being told the case exists.\n */\nfunction unknownRuleError(ruleName: string): string {\n    return (\n        `[${ruleName}] Unknown rule — the running @webpieces validator has no schema for it, and no ` +\n        `\"rulesDir\" is configured to supply custom rules. A key no validator knows controls NOTHING, so ` +\n        `DELETE the \"${ruleName}\" key from webpieces.config.json — run \\`${PRUNE_UNKNOWN_COMMAND}\\` to ` +\n        `strip it (and every other unknown key) mechanically. It may be RETIRED: a newer release can move ` +\n        `a setting out of this file entirely, in which case deleting the key here is the WHOLE fix. ` +\n        `MACHINE-LOCAL settings in particular now live in ~/.webpieces/config.json under \"experimental\" — ` +\n        `an optional file tracked by no repo, whose absence is the default behaviour — so if ` +\n        `\"${ruleName}\" is one of those, delete it here and set it there. Secondary, and rare: a key is ` +\n        `valid-but-unlearned when package.json pins an @webpieces OLDER than this config was written for, ` +\n        `and the version-drift guard reports THAT separately with its own cure (bump the pin) before this ` +\n        `validator ever runs — so it is not what you are looking at.`\n    );\n}\n\n// Fields we DELETED from a rule's schema, keyed by \"<rule>.<field>\". The generic unknown-field error\n// (\"Unknown field ... Valid fields: [...]\") is correct but doesn't say WHY the field vanished, so an AI\n// might re-add it. These hints explain the removal so the only action left is to delete the key.\nconst RETIRED_FIELD_HINTS: Record<string, string> = {\n    'runtime-architecture.servicePaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json (apiRelations + project roles). Delete it.',\n    'runtime-architecture.apiProjectPaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json, so there is NO list of api libs to maintain. Delete it (do not ' +\n        'enumerate api libs and do not replace it with a glob).',\n    // The two per-guard command strings, deleted as SECOND SPELLINGS of commands.guardHints. They were\n    // read at the point of use, so they BEAT the commands section — which made guardHintsWhy's promise\n    // (\"rename a gated command here and every guard message follows\") false for any repo that set them.\n    // Keyed on the new policy key, since that is the entry a consumer's field now sits inside.\n    'pr-lifecycle-guard.upsertPrCommand':\n        'This field was removed. The command the push/PR-creation block prints lives in ONE place: ' +\n        '\"commands\": { \"guardHints\": { \"prCreationOrPush\": <value> } }. Move your value there and delete ' +\n        'this key.',\n    'pr-lifecycle-guard.mergeCompleteCommand':\n        'This field was removed. The command the unfinished-merge block prints lives in ONE place: ' +\n        '\"commands\": { \"guardHints\": { \"mergeInProgress\": <value> } }. Move your value there and delete ' +\n        'this key.',\n};\n\n// Universal field renames (apply to EVERY rule/guard AND every match-rule, unlike the per-rule\n// RETIRED_FIELD_HINTS). When an entry still uses the old escape-hatch name, the generic unknown-field\n// error is replaced with a precise \"renamed to X — rename it\" instruction so the fix is mechanical.\nconst RENAMED_FIELD_ALIASES: Record<string, string> = {\n    ignoreModifiedUntilEpoch: 'turnOffRuleUntilEpoch',\n    ignoreRuleWhileOnBranch: 'turnOffRuleWhileOnBranch',\n};\n\n\n// The renamed-field message shared by keyed rules and match-rules.\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction renamedFieldError(scope: string, oldKey: string, newKey: string): string {\n    return `${scope} Unknown field \"${oldKey}\" — it was renamed to \"${newKey}\". Rename it (the value carries over unchanged; for the branch hatch, use null when there is no branch).`;\n}\n\n// webpieces-disable no-any-unknown -- rawRules values are opaque JSON; each field is validated individually\nexport function validateWebpiecesConfig(\n    rawRules: Record<string, Record<string, unknown>>,\n    hasCustomRulesDir: boolean = false,\n): string[] {\n    const errors: string[] = [];\n\n    // Check field-level correctness for rules that are present\n    for (const [ruleName, entry] of Object.entries(rawRules)) {\n        const schema = RULE_SCHEMAS[ruleName];\n        if (!schema) {\n            // A name we KNOW is retired beats the generic unknown-rule message, because only the table\n            // knows WHERE the setting went — a rename carries its value over, and a bare \"delete it\"\n            // would throw that value away. It fires even when a rulesDir is set, because a custom rule\n            // must not reuse a retired name.\n            const retired = retiredRuleFor(ruleName);\n            if (retired) {\n                errors.push(retiredKeyError(retired));\n                continue;\n            }\n            // No built-in schema. With no rulesDir there are no custom rules, so this key is a\n            // dead/typo'd entry — tell the AI to remove it (a removed rule like no-shell-substitution\n            // lingers here otherwise). With a rulesDir it may be a legitimate custom rule → skip.\n            if (!hasCustomRulesDir) errors.push(unknownRuleError(ruleName));\n            continue;\n        }\n        for (const [key, value] of Object.entries(entry)) {\n            const fieldDef = schema[key];\n            if (!fieldDef) {\n                const renamedTo = RENAMED_FIELD_ALIASES[key];\n                if (renamedTo) {\n                    errors.push(renamedFieldError(`[${ruleName}]`, key, renamedTo));\n                    continue;\n                }\n                const retiredHint = RETIRED_FIELD_HINTS[`${ruleName}.${key}`];\n                const suffix = retiredHint ? ` ${retiredHint}` : '';\n                errors.push(`[${ruleName}] Unknown field \"${key}\". Valid fields: [${Object.keys(schema).join(', ')}].${suffix}`);\n                continue;\n            }\n            // A nullable field (e.g. turnOffRuleWhileOnBranch) accepts JSON null in addition to its type.\n            if (value === null && fieldDef.nullable) continue;\n            if (fieldDef.type === 'string[]') {\n                if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))\n                    errors.push(`[${ruleName}] \"${key}\" must be string[], got ${typeof value}.`);\n            } else if (typeof value !== fieldDef.type) {\n                errors.push(`[${ruleName}] \"${key}\" must be ${fieldDef.type}, got ${typeof value}.`);\n            } else if (fieldDef.enumValues && !fieldDef.enumValues.includes(value as string)) {\n                errors.push(`[${ruleName}] \"${key}\" = \"${value}\" is not valid. Must be one of: ${fieldDef.enumValues.join(', ')}.`);\n            }\n        }\n        // Required fields must actually be present. Until now the loop above only checked\n        // fields that WERE present, so an entry like `{}` (or one missing `mode` /\n        // `turnOffRuleUntilEpoch`) slipped through. Every non-optional schema field is mandatory.\n        for (const [key, fieldDef] of Object.entries(schema)) {\n            if (!fieldDef.optional && !(key in entry)) {\n                errors.push(`[${ruleName}] Missing required field \"${key}\". Add ${key}: ${valueHint(fieldDef, key)}.`);\n            }\n        }\n    }\n\n    // Every built-in rule must be explicitly configured — no silent defaults.\n    // When a new rule is added to the framework, this check surfaces it immediately\n    // with a ready-to-copy snippet so AI can configure it in one pass.\n    for (const [ruleName, schema] of Object.entries(RULE_SCHEMAS)) {\n        if (!(ruleName in rawRules)) {\n            errors.push(missingRuleSnippet(ruleName, schema));\n        }\n    }\n\n    return errors;\n}\n\nconst PR_GATE_MODES = ['ON', 'OFF'] as const;\n// Optional — omitted means DETECT. Kept inline (like prGateExample) to avoid a load-config ↔\n// pr-gate-config import cycle; the canonical list + semantics live in pr-gate-config.ts.\nconst PR_GATE_MERGE_MODES = ['AUTO', 'NONE'] as const;\n\n// Spelled out because the choice is a POLICY decision with a consequence the chooser cannot see:\n// only the AUTO path can put the compact risk/flags body in main's history, because a UI merge is\n// composed from the repo's squash_merge_commit_title/message settings, which the tooling pins.\nconst MERGE_MODE_HELP = (\n        `Must be one of: ${PR_GATE_MERGE_MODES.join(', ')}.\\n` +\n        `  \"AUTO\" — wp-finish-upsert-pr lands the PR: it squash-merges when mergeable, else enables\\n` +\n        `           GitHub auto-merge, both with an explicit --subject/--body-file so main's history\\n` +\n        `           gets the PR title + the compact risk/flags body. Needs allow_auto_merge on the repo\\n` +\n        `           (gh api repos/{owner}/{repo} --jq .allow_auto_merge).\\n` +\n        `  \"NONE\" — wp-finish-upsert-pr only opens/updates the PR; a human merges it, and that still\\n` +\n        `           lands the compact body: the PR DESCRIPTION *is* that body, and stage \\u2462 keeps the repo's\\n` +\n        `           squash_merge_commit_title/message pinned to PR_TITLE/PR_BODY so a UI merge copies it\\n` +\n        `           verbatim (SquashSettingsEnforcer). Nothing to set by hand.`\n);\n\n// Copy-paste example for the top-level `pr-gate` block (sibling of `rules`). Kept inline rather\n// than imported from pr-gate-config.ts to avoid a load-config ↔ pr-gate-config import cycle.\nfunction prGateExample(): string {\n    return (\n        `  \"pr-gate\": {\\n` +\n        `    \"mode\": \"ON\",\\n` +\n        `    \"buildCommand\": \"<command CI runs to validate a PR, e.g. pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)>\",\\n` +\n        `    \"gates\": [\\n` +\n        `      { \"name\": \"API Changed\", \"patterns\": [\"libraries/apis/**\", \"**/*Api.ts\"], \"warningColor\": \"yellow\" }\\n` +\n        `    ],\\n` +\n        `    \"checklists\": [   // OPTIONAL — per-area review, one distinct reviewer subagent each\\n` +\n        `      { \"subagent\": \"db-migration-reviewer\", \"doc\": \".claude/review/db-migrations.md\", \"patterns\": [\"**/*.sql\"] }\\n` +\n        `    ]\\n` +\n        `  }`\n    );\n}\n\n// The `gates` array: dashboard-only warning flags. Extracted from validatePrGateSection to keep that\n// method inside the length limit.\n// webpieces-disable no-any-unknown -- `value` is the opaque consumer `gates` value until narrowed here\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction validateGatesSection(value: unknown): string[] {\n    if (!Array.isArray(value)) {\n        return [`[pr-gate] \"gates\" must be an array of { name, patterns, warningColor, disabled? }.`];\n    }\n    const errors: string[] = [];\n    for (let i = 0; i < value.length; i += 1) {\n        errors.push(...validateGate(value[i], i));\n    }\n    return errors;\n}\n\n// webpieces-disable no-any-unknown -- one gate entry from opaque consumer JSON, validated field-by-field\nfunction validateGate(gate: unknown, index: number): string[] {\n    if (typeof gate !== 'object' || gate === null) {\n        return [`[pr-gate] gates[${index}] must be an object { name, patterns, warningColor, disabled? }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque gate object from consumer JSON\n    const g = gate as Record<string, unknown>;\n    const errors: string[] = [];\n    if (typeof g['name'] !== 'string') errors.push(`[pr-gate] gates[${index}].name must be a string.`);\n    if (!Array.isArray(g['patterns']) || !g['patterns'].every(p => typeof p === 'string'))\n        errors.push(`[pr-gate] gates[${index}].patterns must be string[].`);\n    if (g['warningColor'] === undefined)\n        errors.push(`[pr-gate] gates[${index}].warningColor is required — set it to \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    else if (g['warningColor'] !== 'yellow' && g['warningColor'] !== 'red')\n        errors.push(`[pr-gate] gates[${index}].warningColor must be \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    if (g['disabled'] !== undefined && typeof g['disabled'] !== 'boolean')\n        errors.push(`[pr-gate] gates[${index}].disabled must be a boolean (example/inactive gate kept in the file).`);\n    return errors;\n}\n\n/**\n * Validate the top-level `pr-gate` section. It is REQUIRED (a client that opts out sets mode \"OFF\").\n * `buildCommand` is required unless mode is \"OFF\". Returns human-readable, copy-paste-friendly errors\n * — never throws. The pr-gate block lives outside the FieldDef-driven `rules` schema because its\n * nested `gates`/`checklists` arrays can't be expressed there, so they get structural validation here.\n * `repoRoot` (when known) lets the `checklists[].docs` existence check run.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validatePrGateSection(section: unknown, repoRoot?: string): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[pr-gate] Not configured in webpieces.config.json. Add this block under the \"commands\" ` +\n            `section (set \"mode\": \"OFF\" to opt out):\\n\\n${prGateExample()}`,\n        ];\n    }\n    if (typeof section !== 'object' || Array.isArray(section)) {\n        return [`[pr-gate] Must be an object. Example:\\n\\n${prGateExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque pr-gate section from consumer JSON\n    const s = section as Record<string, unknown>;\n    const errors: string[] = [];\n\n    if (!('mode' in s)) {\n        errors.push(`[pr-gate] Missing required field \"mode\". Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    } else if (typeof s['mode'] !== 'string' || !PR_GATE_MODES.includes(s['mode'] as typeof PR_GATE_MODES[number])) {\n        errors.push(`[pr-gate] \"mode\" = \"${String(s['mode'])}\" is not valid. Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    }\n\n    // buildCommand and mergeMode are both required whenever the gate is active (mode !== OFF). There\n    // is deliberately NO default for mergeMode: whether the tooling may land your PRs is a policy\n    // decision, and either guess is wrong for somebody.\n    if (s['mode'] !== 'OFF') {\n        const cmd = s['buildCommand'];\n        if (typeof cmd !== 'string' || cmd.trim() === '') {\n            errors.push(\n                `[pr-gate] Missing required field \"buildCommand\" — the command CI runs to validate a PR. ` +\n                `Add e.g. \"buildCommand\": \"pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)\".`,\n            );\n        }\n        const mm = s['mergeMode'];\n        if (!('mergeMode' in s)) {\n            errors.push(`[pr-gate] Missing required field \"mergeMode\". ${MERGE_MODE_HELP}`);\n        } else if (typeof mm !== 'string' || !PR_GATE_MERGE_MODES.includes(mm as typeof PR_GATE_MERGE_MODES[number])) {\n            errors.push(`[pr-gate] \"mergeMode\" = \"${String(mm)}\" is not valid. ${MERGE_MODE_HELP}`);\n        }\n    }\n\n    if ('gates' in s) errors.push(...validateGatesSection(s['gates']));\n\n    // Optional extension point: company review checklists, as an ARRAY right here in the config. Absent ⇒\n    // none. The removed { doc } manifest shape is rejected with the exact migration edit.\n    if ('checklists' in s) errors.push(...validateChecklistsSection(s['checklists'], repoRoot));\n\n    // Optional server-token salt. Absent ⇒ no token minted, CI enforcement is a no-op. Present ⇒ must be\n    // a non-empty string (an empty salt would mint a token anyone can forge from a known-empty secret).\n    if ('gateSalt' in s) {\n        const salt = s['gateSalt'];\n        if (typeof salt !== 'string' || salt.trim() === '') {\n            errors.push(`[pr-gate] \"gateSalt\" must be a non-empty string — it is the shared secret the gate token is HMAC'd with. Omit the key entirely to disable server-side token enforcement.`);\n        }\n    }\n\n    // Optional: what happens to the LOCAL branch once its PR lands. Absent ⇒ \"archive-tag\".\n    if ('landPr' in s) errors.push(...validateLandPrSection(s['landPr']));\n\n    // Optional: where wp-push-dev publishes the disposable copy. Absent ⇒ \"dev-include\" / \"dev\".\n    if ('devDeploy' in s) errors.push(...validateDevDeploySection(s['devDeploy']));\n\n    errors.push(...validateNoGateSaltRationale(s));\n\n    // Optional: publish reviewer output as a PR comment (defaults true). Must be a boolean when present.\n    if ('checklistComments' in s && typeof s['checklistComments'] !== 'boolean') {\n        errors.push(`[pr-gate] \"checklistComments\" must be a boolean (defaults to true; set false to keep the PR body-only).`);\n    }\n\n    return errors;\n}\n\nfunction excludePathsExample(): string {\n    return '\"excludePaths\": [\"repositories/**\"]';\n}\n\n// A glob list: must be a string[] (may be empty). `key` names it for the error.\n// webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed here\nfunction validateExcludeList(value: unknown, key: string): string[] {\n    if (!(Array.isArray(value) && value.every(p => typeof p === 'string'))) {\n        return [`[excludePaths] \"${key}\" must be a string[] of glob paths (use [] for none).`];\n    }\n    return [];\n}\n\n/**\n * Validate the REQUIRED top-level `excludePaths` block: ONE glob list suppressing hook enforcement per\n * file path, for code-style rules and file-scoped guards alike. Required so every client upgrading is\n * forced to declare it (as [] to keep today's behavior, or with real paths). Returns copy-paste\n * friendly errors and never throws — same contract as validatePrGateSection.\n *\n * The two-list object form `{ \"rules\": [...], \"guards\": [...] }` is RETIRED, not tolerated. It used to be\n * accepted and silently unioned, which is why this repo's own config sat on the dead shape for releases: an\n * accepted shape is never migrated. Rejecting it cannot wedge a consumer — editing webpieces.config.json is\n * always permitted, even while it is invalid. See retired-config-keys.ts.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateExcludePaths(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[excludePaths] Not configured in webpieces.config.json. Add this REQUIRED block ` +\n            `(use an empty array to keep enforcing everywhere):\\n\\n  ${excludePathsExample()}`,\n        ];\n    }\n    if (Array.isArray(section)) return validateExcludeList(section, 'excludePaths');\n    if (typeof section !== 'object') {\n        return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque excludePaths section from consumer JSON\n    const s = section as Record<string, unknown>;\n    // The retired two-list object. One table row owns the message for either key present.\n    const retired = retiredEntry('rules', '[excludePaths]');\n    if (retired && (s['rules'] !== undefined || s['guards'] !== undefined)) {\n        return [`${retiredKeyError(retired)}\\n\\n  ${excludePathsExample()}`];\n    }\n    return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n}\n\n// ---------------------------------------------------------------------------\n// match-rules — a new top-level ARRAY section (parallel to pr-gate/excludePaths). Each entry is a\n// client-authored content guard (raw-regex patterns + message + scoping). Validated structurally here\n// the same way pr-gate's `gates` are, because an array of objects can't be expressed in FieldDef schema.\n// ---------------------------------------------------------------------------\n\nfunction matchRulesExample(): string {\n    return `\"match-rules\": ${JSON.stringify(DEFAULT_MATCH_RULES, null, 4)}`;\n}\n\n// webpieces-disable no-any-unknown -- generic type guard over an opaque JSON value\nfunction isStringArray(value: unknown): value is string[] {\n    return Array.isArray(value) && value.every(v => typeof v === 'string');\n}\n\n// Compile a pattern to validate it; returns the error message, or undefined when it compiles.\nfunction regexError(pattern: string): string | undefined {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Constructed only to validate the syntax; the object is intentionally discarded.\n        void new RegExp(pattern);\n        return undefined;\n    } catch (err: unknown) {\n        const error = toError(err);\n        return error.message;\n    }\n}\n\n// One entry of the match-rules array, validated field-by-field (see validateGate for the pattern).\n// webpieces-disable no-any-unknown -- one match-rule entry from opaque consumer JSON, validated field-by-field\nfunction validateMatchRule(entry: unknown, index: number): string[] {\n    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {\n        return [`[match-rules] entry[${index}] must be an object { name, patterns, mainMessage, mode, turnOffRuleUntilEpoch, turnOffRuleWhileOnBranch, ... }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque match-rule entry from consumer JSON\n    const e = entry as Record<string, unknown>;\n    const label = typeof e['name'] === 'string' ? `\"${e['name']}\"` : `entry[${index}]`;\n    const errors: string[] = [];\n\n    if (typeof e['name'] !== 'string' || e['name'].trim() === '')\n        errors.push(`[match-rules] entry[${index}].name must be a non-empty string (it is the disable token and report label).`);\n\n    if (!isStringArray(e['patterns']) || e['patterns'].length === 0) {\n        errors.push(`[match-rules] ${label}.patterns must be a non-empty string[] of regexes.`);\n    } else {\n        e['patterns'].forEach((p: string, pi: number) => {\n            const rxErr = regexError(p);\n            if (rxErr) errors.push(`[match-rules] ${label}.patterns[${pi}] is not a valid regex: ${rxErr}`);\n        });\n    }\n\n    if (typeof e['mainMessage'] !== 'string' || e['mainMessage'].trim() === '')\n        errors.push(`[match-rules] ${label}.mainMessage must be a non-empty string.`);\n\n    if (typeof e['mode'] !== 'string' || !MODIFIED_CODE_MODES.includes(e['mode'] as typeof MODIFIED_CODE_MODES[number]))\n        errors.push(`[match-rules] ${label}.mode must be one of: ${MODIFIED_CODE_MODES.join(', ')}.`);\n\n    // Both escape hatches are REQUIRED on every match-rule too (same as keyed rules), so they are always\n    // visible. turnOffRuleUntilEpoch: number (0 = active; a future unix-epoch in seconds = temporarily\n    // off). turnOffRuleWhileOnBranch: string | null (null = always on; a branch name disables the rule\n    // while that branch is checked out).\n    if (typeof e['turnOffRuleUntilEpoch'] !== 'number')\n        errors.push(`[match-rules] ${label}.turnOffRuleUntilEpoch must be a number (0 = active; future unix-epoch seconds = temporarily off).`);\n    if (!(e['turnOffRuleWhileOnBranch'] === null || typeof e['turnOffRuleWhileOnBranch'] === 'string'))\n        errors.push(`[match-rules] ${label}.turnOffRuleWhileOnBranch must be a string or null (null = no branch / always on).`);\n\n    // The old escape-hatch names were renamed — flag them precisely.\n    for (const oldKey of Object.keys(RENAMED_FIELD_ALIASES)) {\n        if (oldKey in e) errors.push(renamedFieldError(`[match-rules] ${label}`, oldKey, RENAMED_FIELD_ALIASES[oldKey]));\n    }\n\n    if (e['options'] !== undefined && !isStringArray(e['options']))\n        errors.push(`[match-rules] ${label}.options must be a string[] (omit if not needed).`);\n    if (e['allowedPaths'] !== undefined && !isStringArray(e['allowedPaths']))\n        errors.push(`[match-rules] ${label}.allowedPaths must be a string[] of globs (omit if not needed).`);\n    if (e['disableAllowed'] !== undefined && typeof e['disableAllowed'] !== 'boolean')\n        errors.push(`[match-rules] ${label}.disableAllowed must be a boolean.`);\n\n    return errors;\n}\n\n/**\n * Validate the REQUIRED top-level `match-rules` array (client-authored content guards). MISSING →\n * one error printing the ready-to-paste `no-fetch` example (add at least this; more can follow).\n * Present-but-`[]` → allowed (a conscious opt-out, matching pr-gate mode:OFF / excludePaths []).\n * Otherwise every entry is validated field-by-field (each regex compile-checked) plus name\n * uniqueness. Copy-paste-friendly errors; never throws — same contract as validatePrGateSection.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateMatchRulesSection(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[match-rules] Not configured in webpieces.config.json. Add this REQUIRED top-level array — ` +\n            `seed it with the no-fetch guard below (you can add more entries: no-moment, no-lodash-chain, …):\\n\\n${matchRulesExample()}`,\n        ];\n    }\n    if (!Array.isArray(section)) {\n        return [`[match-rules] Must be an array of content-guard objects. Example:\\n\\n${matchRulesExample()}`];\n    }\n\n    const errors: string[] = [];\n    const seen = new Set<string>();\n    for (let i = 0; i < section.length; i += 1) {\n        errors.push(...validateMatchRule(section[i], i));\n        // webpieces-disable no-any-unknown -- reading the name off an opaque entry only to dedupe\n        const name = (section[i] as Record<string, unknown> | null)?.['name'];\n        if (typeof name === 'string') {\n            if (seen.has(name)) errors.push(`[match-rules] duplicate entry name \"${name}\" — each match-rule name must be unique.`);\n            seen.add(name);\n        }\n    }\n    return errors;\n}\n\n/**\n * Enforce that each built-in lives in its correct section: code rules under `rules`, bash guards\n * under `hookGuards`. A guard left in `rules` (or a rule placed in `hookGuards`) is reported with a\n * \"move it\" message so the split stays clean. Unknown/custom names are ignored (they may be custom\n * rules from rulesDir). Presence (\"every built-in must be configured\") is checked separately by\n * validateWebpiecesConfig against the merged map.\n */\n// webpieces-disable no-any-unknown -- section maps are opaque consumer JSON\nexport function validateSectionPlacement(\n    rulesSection: Record<string, Record<string, unknown>>,\n    hookGuardsSection: Record<string, Record<string, unknown>>,\n): string[] {\n    const errors: string[] = [];\n    for (const name of Object.keys(rulesSection)) {\n        if (isHookGuard(name)) {\n            errors.push(\n                `[${name}] is a hook guard and ${SECTION_PLACEMENT_MARKER} \"hookGuards\" section, not \"rules\". ` +\n                `Move it.`,\n            );\n        }\n    }\n    for (const name of Object.keys(hookGuardsSection)) {\n        // Only flag KNOWN code rules misplaced into hookGuards; unknown names may be custom rules.\n        if (!isHookGuard(name) && RULE_SCHEMAS[name]) {\n            errors.push(\n                `[${name}] is a code rule and ${SECTION_PLACEMENT_MARKER} \"rules\" section, not \"hookGuards\". ` +\n                `Move it.`,\n            );\n        }\n    }\n    return errors;\n}\n"]}
+{"version":3,"file":"validate-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/validate-config.ts"],"names":[],"mappings":";;;AAuOA,0DA8CC;AAmFD,sDAoEC;AA2BD,oDAmBC;AA+FD,8DAuBC;AAUD,4DAuBC;AA9mBD,wGAAwG;AACxG,kFAAkF;AAClF,+DAAiE;AACjE,yCAAyD;AACzD,iDAA4D;AAC5D,6CAAqE;AACrE,iDAAqD;AACrD,6EAAuJ;AAK9I,0GALA,sDAAyB,OAKA;AAJlC,+DAAsF;AACtF,2CAAoD;AAIpD,yFAAyF;AACzF,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AACrB,2CAA6F;AAApF,iHAAA,mBAAmB,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AACtE,6DAA2D;AAC3D,yCAAqC;AAErC;;;;;;;;;;GAUG;AACU,QAAA,uBAAuB,GAAG,CAAC,CAAC;AAEzC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAErC;;;;;;GAMG;AACH,wHAAwH;AACxH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,+BAAuB,GAAG,eAAe,CAAC;IAC3F,IAAI,KAAK,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CACH,GAAG,KAAK,6BAA6B,KAAK,OAAO,OAAO,uCAAuC;QAC/F,GAAG,+BAAuB,yEAAyE;QACnG,oFAAoF;QACpF,6BAA6B,QAAQ,KAAK,OAAO,8CAA8C;QAC/F,kGAAkG;QAClG,iGAAiG;QACjG,SAAS,CACZ,CAAC;AACN,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY;IAC1C,oGAAoG;IACpG,oGAAoG;IACpG,IAAI,GAAG,KAAK,uBAAuB;QAAE,OAAO,8DAA8D,CAAC;IAC3G,IAAI,GAAG,KAAK,0BAA0B;QAAE,OAAO,gHAAgH,CAAC;IAChK,OAAO,GAAG,CAAC,UAAU;QACjB,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;QACnC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB;YAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAG,CAAC,CAAC,UAAU;gBACtC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAE,CAAC,CAAC,WAAW;oBACvC,CAAC,CAAC,YAAY,CAAC;AACvB,CAAC;AAED,yGAAyG;AACzG,SAAS,UAAU,CAAC,MAAgC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;IAC/C,iGAAiG;IACjG,8FAA8F;IAC9F,MAAM,WAAW,GAAG,IAAA,mCAAsB,EAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,IAAA,0BAAa,EAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,CACH,2CAA2C,WAAW,mCAAmC;QACzF,4FAA4F;QAC5F,4CAA4C,MAAM,EAAE,CACvD,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,MAAgC;IAC1E,+EAA+E;IAC/E,oGAAoG;IACpG,yGAAyG;IACzG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,GACH,IAAI,QAAQ,qEAAqE,OAAO,aAAa;QACrG,mDAAmD;QACnD,MAAM,QAAQ,SAAS,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAE5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,GAAG;YACC,sEAAsE;gBACtE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACtC,OAAO,CACH,IAAI,QAAQ,iFAAiF;QAC7F,iGAAiG;QACjG,eAAe,QAAQ,4CAA4C,iCAAqB,QAAQ;QAChG,mGAAmG;QACnG,6FAA6F;QAC7F,mGAAmG;QACnG,sFAAsF;QACtF,IAAI,QAAQ,oFAAoF;QAChG,mGAAmG;QACnG,mGAAmG;QACnG,6DAA6D,CAChE,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,wGAAwG;AACxG,iGAAiG;AACjG,MAAM,mBAAmB,GAA2B;IAChD,mCAAmC,EAC/B,8FAA8F;QAC9F,2EAA2E;IAC/E,sCAAsC,EAClC,8FAA8F;QAC9F,iGAAiG;QACjG,wDAAwD;IAC5D,mGAAmG;IACnG,mGAAmG;IACnG,oGAAoG;IACpG,2FAA2F;IAC3F,oCAAoC,EAChC,4FAA4F;QAC5F,kGAAkG;QAClG,WAAW;IACf,yCAAyC,EACrC,4FAA4F;QAC5F,iGAAiG;QACjG,WAAW;CAClB,CAAC;AAEF,+FAA+F;AAC/F,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,qBAAqB,GAA2B;IAClD,wBAAwB,EAAE,uBAAuB;IACjD,uBAAuB,EAAE,0BAA0B;CACtD,CAAC;AAGF,mEAAmE;AACnE,8GAA8G;AAC9G,SAAS,iBAAiB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;IACpE,OAAO,GAAG,KAAK,mBAAmB,MAAM,0BAA0B,MAAM,0GAA0G,CAAC;AACvL,CAAC;AAED;;;;;;GAMG;AACH,0GAA0G;AAC1G,wHAAwH;AACxH,SAAS,WAAW,CAAC,QAAgB,EAAE,KAA8B,EAAE,MAAgC;IACnG,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,SAAS,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,QAAQ,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBAChE,SAAS;YACb,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,oBAAoB,GAAG,qBAAqB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YACjH,SAAS;QACb,CAAC;QACD,8FAA8F;QAC9F,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ;YAAE,SAAS;QAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,aAAa,QAAQ,CAAC,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,QAAQ,KAAK,mCAAmC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxH,CAAC;aAAM,IAAI,GAAG,KAAK,uBAAuB,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,QAAQ,GAAG,EAAE,KAAe,CAAC,CAAC;YACjE,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,4GAA4G;AAC5G,SAAgB,uBAAuB,CACnC,QAAiD,EACjD,oBAA6B,KAAK;IAElC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,2BAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,2FAA2F;YAC3F,yFAAyF;YACzF,2FAA2F;YAC3F,iCAAiC;YACjC,MAAM,OAAO,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,IAAA,qCAAe,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtC,SAAS;YACb,CAAC;YACD,mFAAmF;YACnF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,CAAC,iBAAiB;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChE,SAAS;QACb,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,kFAAkF;QAClF,2EAA2E;QAC3E,0FAA0F;QAC1F,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,6BAA6B,GAAG,UAAU,GAAG,KAAK,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,mEAAmE;IACnE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,2BAAY,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAC7C,6FAA6F;AAC7F,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAEtD,iGAAiG;AACjG,kGAAkG;AAClG,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAChB,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;IACtD,8FAA8F;IAC9F,+FAA+F;IAC/F,kGAAkG;IAClG,oEAAoE;IACpE,+FAA+F;IAC/F,2GAA2G;IAC3G,mGAAmG;IACnG,uEAAuE,CAC9E,CAAC;AAEF,gGAAgG;AAChG,6FAA6F;AAC7F,SAAS,aAAa;IAClB,OAAO,CACH,kBAAkB;QAClB,qBAAqB;QACrB,0IAA0I;QAC1I,kBAAkB;QAClB,8GAA8G;QAC9G,UAAU;QACV,4FAA4F;QAC5F,qHAAqH;QACrH,SAAS;QACT,KAAK,CACR,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,kCAAkC;AAClC,uGAAuG;AACvG,8GAA8G;AAC9G,SAAS,oBAAoB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,oFAAoF,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAa,EAAE,KAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,mBAAmB,KAAK,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,0FAA0F;IAC1F,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,0BAA0B,CAAC,CAAC;IACnG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS;QAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oGAAoG,CAAC,CAAC;SACzI,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK;QAClE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oFAAoF,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS;QACjE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,wEAAwE,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,8GAA8G;AAC9G,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,QAAiB;IACrE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,yFAAyF;gBACzF,8CAA8C,aAAa,EAAE,EAAE;SAClE,CAAC;IACN,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,4CAA4C,aAAa,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,4DAA4D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAiC,CAAC,EAAE,CAAC;QAC7G,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC;IAED,iGAAiG;IACjG,8FAA8F;IAC9F,oDAAoD;IACpD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACP,0FAA0F;gBAC1F,oGAAoG,CACvG,CAAC;QACN,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,iDAAiD,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAwC,CAAC,EAAE,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,EAAE,CAAC,mBAAmB,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,IAAI,OAAO,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnE,sGAAsG;IACtG,sFAAsF;IACtF,IAAI,YAAY,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,sDAAyB,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE5F,qGAAqG;IACrG,oGAAoG;IACpG,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,0KAA0K,CAAC,CAAC;QAC5L,CAAC;IACL,CAAC;IAED,wFAAwF;IACxF,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,kDAAqB,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEtE,6FAA6F;IAC7F,IAAI,WAAW,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,qDAAwB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,wDAA2B,EAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,qGAAqG;IACrG,IAAI,mBAAmB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;IAC3H,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB;IACxB,OAAO,qCAAqC,CAAC;AACjD,CAAC;AAED,gFAAgF;AAChF,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,KAAc,EAAE,GAAW;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,mBAAmB,GAAG,uDAAuD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,6FAA6F;AAC7F,SAAgB,oBAAoB,CAAC,OAAgB;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,kFAAkF;gBAClF,2DAA2D,mBAAmB,EAAE,EAAE;SACrF,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChF,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,mGAAmG;IACnG,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAA,kCAAY,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACxD,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,IAAA,qCAAe,EAAC,OAAO,CAAC,SAAS,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,8EAA8E;AAC9E,kGAAkG;AAClG,sGAAsG;AACtG,yGAAyG;AACzG,8EAA8E;AAE9E,SAAS,iBAAiB;IACtB,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,wCAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,OAAe;IAC/B,8DAA8D;IAC9D,IAAI,CAAC;QACD,kFAAkF;QAClF,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,SAAS,CAAC;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACzB,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,+GAA+G;AAC/G,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,uBAAuB,KAAK,kHAAkH,CAAC,CAAC;IAC5J,CAAC;IACD,+FAA+F;IAC/F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,+EAA+E,CAAC,CAAC;IAE7H,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oDAAoD,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACJ,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,aAAa,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,0CAA0C,CAAC,CAAC;IAElF,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,kCAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAuC,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,yBAAyB,kCAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElG,qGAAqG;IACrG,mGAAmG;IACnG,kGAAkG;IAClG,mFAAmF;IACnF,IAAI,OAAO,CAAC,CAAC,uBAAuB,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oGAAoG,CAAC,CAAC;IAC5I,CAAC;SAAM,CAAC;QACJ,MAAM,QAAQ,GAAG,aAAa,CAAC,iBAAiB,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACrF,IAAI,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,0BAA0B,CAAC,KAAK,QAAQ,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,+IAA+I,CAAC,CAAC;IAEvL,iEAAiE;IACjE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,mDAAmD,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,iEAAiE,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC7E,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oCAAoC,CAAC,CAAC;IAE5E,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,SAAgB,yBAAyB,CAAC,OAAgB;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,6FAA6F;gBAC7F,uGAAuG,iBAAiB,EAAE,EAAE;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,wEAAwE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,0FAA0F;QAC1F,MAAM,IAAI,GAAI,OAAO,CAAC,CAAC,CAAoC,EAAE,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,0CAA0C,CAAC,CAAC;YACvH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,4EAA4E;AAC5E,SAAgB,wBAAwB,CACpC,YAAqD,EACrD,iBAA0D;IAE1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAA,sBAAW,EAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,yBAAyB,8CAAwB,sCAAsC;gBAC/F,UAAU,CACb,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,2FAA2F;QAC3F,IAAI,CAAC,IAAA,sBAAW,EAAC,IAAI,CAAC,IAAI,2BAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,wBAAwB,8CAAwB,sCAAsC;gBAC9F,UAAU,CACb,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { FieldDef } from './field-def';\n// Imported, never re-typed: the banner offers the bulk migrator only for errors it actually covers, and\n// this marker is how it recognizes a placement error. See config-error-banner.ts.\nimport { SECTION_PLACEMENT_MARKER } from './config-error-banner';\nimport { sectionForRule, isHookGuard } from './sections';\nimport { RULE_SCHEMAS, allRuleNames } from './rule-schemas';\nimport { recommendedSeedModeFor, isGradualMode } from './seed-entry';\nimport { MODIFIED_CODE_MODES } from './rule-configs';\nimport { validateChecklistsSection, validateDevDeploySection, validateLandPrSection, validateNoGateSaltRationale } from './pr-gate-section-validators';\nimport { retiredEntry, retiredKeyError, retiredRuleFor } from './retired-config-keys';\nimport { PRUNE_UNKNOWN_COMMAND } from './constants';\n\n// Re-exported so the isolated validate-checklist-docs target keeps importing it from here.\nexport { validateChecklistsSection };\n// Re-exported from their new homes: this module was the historical entry point for both.\nexport { allRuleNames } from './rule-schemas';\nexport { recommendedSeedMode, recommendedSeedModeFor, seedEntryForRule } from './seed-entry';\nimport { DEFAULT_MATCH_RULES } from './match-rules-config';\nimport { toError } from './to-error';\n\n/**\n * The longest a `turnOffRuleUntilEpoch` may reach into the future: ONE WEEK. Poke it again next week to\n * extend — that weekly re-set IS the intended workflow, not a workaround: it is what makes a rule that is\n * off on purpose stay a decision somebody keeps making, instead of one nobody remembers.\n *\n * DELIBERATELY ASYMMETRIC with turnOffRuleWhileOnBranch, which has NO cap and must not get one. The epoch\n * hatch is REPO-WIDE while it lasts, so a long window shelters every unrelated change that lands inside it\n * (a fleet repo was found with max-file-lines/max-method-lines switched off until 2026-10-01 — 43 days\n * out, six times this cap). The branch hatch fires only on ONE exact branch name — a big refactor\n * legitimately runs 35+ days, and capping that would only interrupt the one branch that opted in.\n */\nexport const MAX_TURN_OFF_EPOCH_DAYS = 7;\n\nconst SECONDS_PER_DAY = 24 * 60 * 60;\n\n/**\n * Reject a `turnOffRuleUntilEpoch` more than MAX_TURN_OFF_EPOCH_DAYS into the future.\n *\n * A PAST epoch is always valid: it is inert (it skips nothing), and every existing config is full of them.\n * The BOUNDARY is inclusive — exactly MAX_TURN_OFF_EPOCH_DAYS out is accepted, only strictly beyond it is\n * refused — so a config written as \"now + 7 days\" is never rejected by the second it took to save.\n */\n// webpieces-disable no-function-outside-class -- module-scope validator helper, matching every other check in this file\nfunction epochCapError(label: string, value: number): string | null {\n    const maxEpoch = Math.floor(Date.now() / 1000) + MAX_TURN_OFF_EPOCH_DAYS * SECONDS_PER_DAY;\n    if (value <= maxEpoch) return null;\n    const daysOut = Math.round((value - Date.now() / 1000) / SECONDS_PER_DAY);\n    const maxDate = new Date(maxEpoch * 1000).toISOString().split('T')[0];\n    return (\n        `${label} \"turnOffRuleUntilEpoch\": ${value} is ${daysOut} days in the future — the maximum is ` +\n        `${MAX_TURN_OFF_EPOCH_DAYS} days. A rule switched off for longer than that is off for work nobody ` +\n        `had in mind when it was written, because this hatch is REPO-WIDE while it lasts.\\n` +\n        `  CURE: set it to at most ${maxEpoch} (${maxDate}), then re-set it WEEKLY for as long as you ` +\n        `still need it — that renewal is the intended workflow, not a workaround. If the rule is off for ` +\n        `ONE branch's work, use \"turnOffRuleWhileOnBranch\": \"<exact branch name>\" instead; that one has ` +\n        `no cap.`\n    );\n}\n\nfunction valueHint(def: FieldDef, key?: string): string {\n    // The two universal escape hatches, REQUIRED on every rule so they're always visible. Spell out the\n    // \"off\" value so a fresh config seeds them in the active/no-op state (0 / null), not a placeholder.\n    if (key === 'turnOffRuleUntilEpoch') return '0  (0 = active; future unix-epoch seconds = temporarily off)';\n    if (key === 'turnOffRuleWhileOnBranch') return 'null  (null = always on; an EXACT branch name — no globs — disables the rule while that branch is checked out)';\n    return def.enumValues\n        ? `\"${def.enumValues.join(' | ')}\"`\n        : def.type === 'string[]' ? '[\"<string>\", ...]'\n        : def.type === 'number'   ? '<number>'\n        : def.type === 'boolean'  ? '<boolean>'\n        : '\"<string>\"';\n}\n\n/** A rollout hint for the copy-paste snippet: recommend the narrowest gradual mode the rule supports. */\nfunction rolloutTip(schema: Record<string, FieldDef>): string {\n    const modes = schema['mode']?.enumValues ?? [];\n    // Same source of truth as the seeder; only a GRADUAL recommendation gets the rollout prose, so a\n    // rule whose recommendation falls through to ON/RUN_EVERY_TIME/OFF prints no tip (as before).\n    const recommended = recommendedSeedModeFor(modes);\n    if (!isGradualMode(recommended)) return '';\n    const optOut = modes.includes('OFF') ? ' Set \"mode\": \"OFF\" to opt out entirely.' : '';\n    return (\n        `\\n\\n💡 Recommended: start with \"mode\": \"${recommended}\" — it enforces only on what you ` +\n        `actually change, so the rule rolls out gradually (existing code stays grandfathered until ` +\n        `you next touch that project/file/method).${optOut}`\n    );\n}\n\nfunction missingRuleSnippet(ruleName: string, schema: Record<string, FieldDef>): string {\n    // Required fields go in the copy-paste entry. The two universal escape hatches\n    // (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch) are now REQUIRED, so they land in that block —\n    // which is the whole point: every seeded rule shows both hatches. Optional fields are listed separately.\n    const fields = Object.keys(schema);\n    const required = fields.filter(f => !schema[f].optional);\n    const optional = fields.filter(f => schema[f].optional);\n\n    const requiredLines = required.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n    const section = sectionForRule(ruleName);\n    let out =\n        `[${ruleName}] Not configured in webpieces.config.json. Add this entry to the \"${section}\" section\\n` +\n        `(choose values appropriate for your project):\\n\\n` +\n        `  \"${ruleName}\": {\\n${requiredLines.join(',\\n')}\\n  }`;\n\n    if (optional.length > 0) {\n        const optionalLines = optional.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n        out +=\n            `\\n\\nOptional fields you may add to this rule (omit if not needed):\\n` +\n            `${optionalLines.join(',\\n')}`;\n    }\n    out += rolloutTip(schema);\n    return out;\n}\n\n/**\n * A config key under rules/hookGuards that the RUNNING validator has no schema for (and no rulesDir is set\n * to supply custom rules). THE FALLBACK: it fires for any name the table in retired-config-keys.ts does not\n * know, which very much includes RETIRED names on a tree whose validator predates the retirement — the\n * ordinary linked-worktree layout, where the worktree is on one release and the parent checkout that\n * supplies the hook's resolution is on an older one. So this text has to be useful with NO table entry.\n *\n * DELETION LEADS, and it is not a hedge. A key the running validator has no schema for controls nothing:\n * every code path that would read it is keyed off the schema. Leaving it is dead config that reads as live\n * config, and for a retired key deleting it is the entire fix.\n *\n * This message used to lead with `pnpm install` instead, on the theory that the key might be valid and the\n * validator merely stale. Two things are wrong with that. First, it CONTRADICTED the banner this error is\n * printed inside, which states outright that `pnpm install` cannot help — one output, two opposite orders.\n * Second, the premise is already handled upstream: the shim's version-drift guard compares the pin against\n * the installed version and denies every tool call BEFORE exec'ing this validator, with its own message and\n * its own cure. If this text is on screen, that guard found no drift. The pin therefore appears here only as\n * a secondary note, so a valid-but-newer key is never dropped without the reader being told the case exists.\n */\nfunction unknownRuleError(ruleName: string): string {\n    return (\n        `[${ruleName}] Unknown rule — the running @webpieces validator has no schema for it, and no ` +\n        `\"rulesDir\" is configured to supply custom rules. A key no validator knows controls NOTHING, so ` +\n        `DELETE the \"${ruleName}\" key from webpieces.config.json — run \\`${PRUNE_UNKNOWN_COMMAND}\\` to ` +\n        `strip it (and every other unknown key) mechanically. It may be RETIRED: a newer release can move ` +\n        `a setting out of this file entirely, in which case deleting the key here is the WHOLE fix. ` +\n        `MACHINE-LOCAL settings in particular now live in ~/.webpieces/config.json under \"experimental\" — ` +\n        `an optional file tracked by no repo, whose absence is the default behaviour — so if ` +\n        `\"${ruleName}\" is one of those, delete it here and set it there. Secondary, and rare: a key is ` +\n        `valid-but-unlearned when package.json pins an @webpieces OLDER than this config was written for, ` +\n        `and the version-drift guard reports THAT separately with its own cure (bump the pin) before this ` +\n        `validator ever runs — so it is not what you are looking at.`\n    );\n}\n\n// Fields we DELETED from a rule's schema, keyed by \"<rule>.<field>\". The generic unknown-field error\n// (\"Unknown field ... Valid fields: [...]\") is correct but doesn't say WHY the field vanished, so an AI\n// might re-add it. These hints explain the removal so the only action left is to delete the key.\nconst RETIRED_FIELD_HINTS: Record<string, string> = {\n    'runtime-architecture.servicePaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json (apiRelations + project roles). Delete it.',\n    'runtime-architecture.apiProjectPaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json, so there is NO list of api libs to maintain. Delete it (do not ' +\n        'enumerate api libs and do not replace it with a glob).',\n    // The two per-guard command strings, deleted as SECOND SPELLINGS of commands.guardHints. They were\n    // read at the point of use, so they BEAT the commands section — which made guardHintsWhy's promise\n    // (\"rename a gated command here and every guard message follows\") false for any repo that set them.\n    // Keyed on the new policy key, since that is the entry a consumer's field now sits inside.\n    'pr-lifecycle-guard.upsertPrCommand':\n        'This field was removed. The command the push/PR-creation block prints lives in ONE place: ' +\n        '\"commands\": { \"guardHints\": { \"prCreationOrPush\": <value> } }. Move your value there and delete ' +\n        'this key.',\n    'pr-lifecycle-guard.mergeCompleteCommand':\n        'This field was removed. The command the unfinished-merge block prints lives in ONE place: ' +\n        '\"commands\": { \"guardHints\": { \"mergeInProgress\": <value> } }. Move your value there and delete ' +\n        'this key.',\n};\n\n// Universal field renames (apply to EVERY rule/guard AND every match-rule, unlike the per-rule\n// RETIRED_FIELD_HINTS). When an entry still uses the old escape-hatch name, the generic unknown-field\n// error is replaced with a precise \"renamed to X — rename it\" instruction so the fix is mechanical.\nconst RENAMED_FIELD_ALIASES: Record<string, string> = {\n    ignoreModifiedUntilEpoch: 'turnOffRuleUntilEpoch',\n    ignoreRuleWhileOnBranch: 'turnOffRuleWhileOnBranch',\n};\n\n\n// The renamed-field message shared by keyed rules and match-rules.\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction renamedFieldError(scope: string, oldKey: string, newKey: string): string {\n    return `${scope} Unknown field \"${oldKey}\" — it was renamed to \"${newKey}\". Rename it (the value carries over unchanged; for the branch hatch, use null when there is no branch).`;\n}\n\n/**\n * Field-level errors for ONE configured rule entry: unknown/renamed/retired keys, type and enum\n * mismatches, and the two-week cap on turnOffRuleUntilEpoch.\n *\n * Extracted out of validateWebpiecesConfig purely so that function stays inside max-method-lines; it is\n * the same checks in the same order.\n */\n// webpieces-disable no-any-unknown -- one config entry as opaque JSON; every field is typed-checked below\n// webpieces-disable no-function-outside-class -- module-scope validator helper, matching every other check in this file\nfunction fieldErrors(ruleName: string, entry: Record<string, unknown>, schema: Record<string, FieldDef>): string[] {\n    const errors: string[] = [];\n    for (const [key, value] of Object.entries(entry)) {\n        const fieldDef = schema[key];\n        if (!fieldDef) {\n            const renamedTo = RENAMED_FIELD_ALIASES[key];\n            if (renamedTo) {\n                errors.push(renamedFieldError(`[${ruleName}]`, key, renamedTo));\n                continue;\n            }\n            const retiredHint = RETIRED_FIELD_HINTS[`${ruleName}.${key}`];\n            const suffix = retiredHint ? ` ${retiredHint}` : '';\n            errors.push(`[${ruleName}] Unknown field \"${key}\". Valid fields: [${Object.keys(schema).join(', ')}].${suffix}`);\n            continue;\n        }\n        // A nullable field (e.g. turnOffRuleWhileOnBranch) accepts JSON null in addition to its type.\n        if (value === null && fieldDef.nullable) continue;\n        if (fieldDef.type === 'string[]') {\n            if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))\n                errors.push(`[${ruleName}] \"${key}\" must be string[], got ${typeof value}.`);\n        } else if (typeof value !== fieldDef.type) {\n            errors.push(`[${ruleName}] \"${key}\" must be ${fieldDef.type}, got ${typeof value}.`);\n        } else if (fieldDef.enumValues && !fieldDef.enumValues.includes(value as string)) {\n            errors.push(`[${ruleName}] \"${key}\" = \"${value}\" is not valid. Must be one of: ${fieldDef.enumValues.join(', ')}.`);\n        } else if (key === 'turnOffRuleUntilEpoch') {\n            const capError = epochCapError(`[${ruleName}]`, value as number);\n            if (capError) errors.push(capError);\n        }\n    }\n    return errors;\n}\n\n// webpieces-disable no-any-unknown -- rawRules values are opaque JSON; each field is validated individually\nexport function validateWebpiecesConfig(\n    rawRules: Record<string, Record<string, unknown>>,\n    hasCustomRulesDir: boolean = false,\n): string[] {\n    const errors: string[] = [];\n\n    // Check field-level correctness for rules that are present\n    for (const [ruleName, entry] of Object.entries(rawRules)) {\n        const schema = RULE_SCHEMAS[ruleName];\n        if (!schema) {\n            // A name we KNOW is retired beats the generic unknown-rule message, because only the table\n            // knows WHERE the setting went — a rename carries its value over, and a bare \"delete it\"\n            // would throw that value away. It fires even when a rulesDir is set, because a custom rule\n            // must not reuse a retired name.\n            const retired = retiredRuleFor(ruleName);\n            if (retired) {\n                errors.push(retiredKeyError(retired));\n                continue;\n            }\n            // No built-in schema. With no rulesDir there are no custom rules, so this key is a\n            // dead/typo'd entry — tell the AI to remove it (a removed rule like no-shell-substitution\n            // lingers here otherwise). With a rulesDir it may be a legitimate custom rule → skip.\n            if (!hasCustomRulesDir) errors.push(unknownRuleError(ruleName));\n            continue;\n        }\n        errors.push(...fieldErrors(ruleName, entry, schema));\n        // Required fields must actually be present. Until now the loop above only checked\n        // fields that WERE present, so an entry like `{}` (or one missing `mode` /\n        // `turnOffRuleUntilEpoch`) slipped through. Every non-optional schema field is mandatory.\n        for (const [key, fieldDef] of Object.entries(schema)) {\n            if (!fieldDef.optional && !(key in entry)) {\n                errors.push(`[${ruleName}] Missing required field \"${key}\". Add ${key}: ${valueHint(fieldDef, key)}.`);\n            }\n        }\n    }\n\n    // Every built-in rule must be explicitly configured — no silent defaults.\n    // When a new rule is added to the framework, this check surfaces it immediately\n    // with a ready-to-copy snippet so AI can configure it in one pass.\n    for (const [ruleName, schema] of Object.entries(RULE_SCHEMAS)) {\n        if (!(ruleName in rawRules)) {\n            errors.push(missingRuleSnippet(ruleName, schema));\n        }\n    }\n\n    return errors;\n}\n\nconst PR_GATE_MODES = ['ON', 'OFF'] as const;\n// Optional — omitted means DETECT. Kept inline (like prGateExample) to avoid a load-config ↔\n// pr-gate-config import cycle; the canonical list + semantics live in pr-gate-config.ts.\nconst PR_GATE_MERGE_MODES = ['AUTO', 'NONE'] as const;\n\n// Spelled out because the choice is a POLICY decision with a consequence the chooser cannot see:\n// only the AUTO path can put the compact risk/flags body in main's history, because a UI merge is\n// composed from the repo's squash_merge_commit_title/message settings, which the tooling pins.\nconst MERGE_MODE_HELP = (\n        `Must be one of: ${PR_GATE_MERGE_MODES.join(', ')}.\\n` +\n        `  \"AUTO\" — wp-finish-upsert-pr lands the PR: it squash-merges when mergeable, else enables\\n` +\n        `           GitHub auto-merge, both with an explicit --subject/--body-file so main's history\\n` +\n        `           gets the PR title + the compact risk/flags body. Needs allow_auto_merge on the repo\\n` +\n        `           (gh api repos/{owner}/{repo} --jq .allow_auto_merge).\\n` +\n        `  \"NONE\" — wp-finish-upsert-pr only opens/updates the PR; a human merges it, and that still\\n` +\n        `           lands the compact body: the PR DESCRIPTION *is* that body, and stage \\u2462 keeps the repo's\\n` +\n        `           squash_merge_commit_title/message pinned to PR_TITLE/PR_BODY so a UI merge copies it\\n` +\n        `           verbatim (SquashSettingsEnforcer). Nothing to set by hand.`\n);\n\n// Copy-paste example for the top-level `pr-gate` block (sibling of `rules`). Kept inline rather\n// than imported from pr-gate-config.ts to avoid a load-config ↔ pr-gate-config import cycle.\nfunction prGateExample(): string {\n    return (\n        `  \"pr-gate\": {\\n` +\n        `    \"mode\": \"ON\",\\n` +\n        `    \"buildCommand\": \"<command CI runs to validate a PR, e.g. pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)>\",\\n` +\n        `    \"gates\": [\\n` +\n        `      { \"name\": \"API Changed\", \"patterns\": [\"libraries/apis/**\", \"**/*Api.ts\"], \"warningColor\": \"yellow\" }\\n` +\n        `    ],\\n` +\n        `    \"checklists\": [   // OPTIONAL — per-area review, one distinct reviewer subagent each\\n` +\n        `      { \"subagent\": \"db-migration-reviewer\", \"doc\": \".claude/review/db-migrations.md\", \"patterns\": [\"**/*.sql\"] }\\n` +\n        `    ]\\n` +\n        `  }`\n    );\n}\n\n// The `gates` array: dashboard-only warning flags. Extracted from validatePrGateSection to keep that\n// method inside the length limit.\n// webpieces-disable no-any-unknown -- `value` is the opaque consumer `gates` value until narrowed here\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction validateGatesSection(value: unknown): string[] {\n    if (!Array.isArray(value)) {\n        return [`[pr-gate] \"gates\" must be an array of { name, patterns, warningColor, disabled? }.`];\n    }\n    const errors: string[] = [];\n    for (let i = 0; i < value.length; i += 1) {\n        errors.push(...validateGate(value[i], i));\n    }\n    return errors;\n}\n\n// webpieces-disable no-any-unknown -- one gate entry from opaque consumer JSON, validated field-by-field\nfunction validateGate(gate: unknown, index: number): string[] {\n    if (typeof gate !== 'object' || gate === null) {\n        return [`[pr-gate] gates[${index}] must be an object { name, patterns, warningColor, disabled? }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque gate object from consumer JSON\n    const g = gate as Record<string, unknown>;\n    const errors: string[] = [];\n    if (typeof g['name'] !== 'string') errors.push(`[pr-gate] gates[${index}].name must be a string.`);\n    if (!Array.isArray(g['patterns']) || !g['patterns'].every(p => typeof p === 'string'))\n        errors.push(`[pr-gate] gates[${index}].patterns must be string[].`);\n    if (g['warningColor'] === undefined)\n        errors.push(`[pr-gate] gates[${index}].warningColor is required — set it to \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    else if (g['warningColor'] !== 'yellow' && g['warningColor'] !== 'red')\n        errors.push(`[pr-gate] gates[${index}].warningColor must be \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    if (g['disabled'] !== undefined && typeof g['disabled'] !== 'boolean')\n        errors.push(`[pr-gate] gates[${index}].disabled must be a boolean (example/inactive gate kept in the file).`);\n    return errors;\n}\n\n/**\n * Validate the top-level `pr-gate` section. It is REQUIRED (a client that opts out sets mode \"OFF\").\n * `buildCommand` is required unless mode is \"OFF\". Returns human-readable, copy-paste-friendly errors\n * — never throws. The pr-gate block lives outside the FieldDef-driven `rules` schema because its\n * nested `gates`/`checklists` arrays can't be expressed there, so they get structural validation here.\n * `repoRoot` (when known) lets the `checklists[].docs` existence check run.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validatePrGateSection(section: unknown, repoRoot?: string): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[pr-gate] Not configured in webpieces.config.json. Add this block under the \"commands\" ` +\n            `section (set \"mode\": \"OFF\" to opt out):\\n\\n${prGateExample()}`,\n        ];\n    }\n    if (typeof section !== 'object' || Array.isArray(section)) {\n        return [`[pr-gate] Must be an object. Example:\\n\\n${prGateExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque pr-gate section from consumer JSON\n    const s = section as Record<string, unknown>;\n    const errors: string[] = [];\n\n    if (!('mode' in s)) {\n        errors.push(`[pr-gate] Missing required field \"mode\". Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    } else if (typeof s['mode'] !== 'string' || !PR_GATE_MODES.includes(s['mode'] as typeof PR_GATE_MODES[number])) {\n        errors.push(`[pr-gate] \"mode\" = \"${String(s['mode'])}\" is not valid. Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    }\n\n    // buildCommand and mergeMode are both required whenever the gate is active (mode !== OFF). There\n    // is deliberately NO default for mergeMode: whether the tooling may land your PRs is a policy\n    // decision, and either guess is wrong for somebody.\n    if (s['mode'] !== 'OFF') {\n        const cmd = s['buildCommand'];\n        if (typeof cmd !== 'string' || cmd.trim() === '') {\n            errors.push(\n                `[pr-gate] Missing required field \"buildCommand\" — the command CI runs to validate a PR. ` +\n                `Add e.g. \"buildCommand\": \"pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)\".`,\n            );\n        }\n        const mm = s['mergeMode'];\n        if (!('mergeMode' in s)) {\n            errors.push(`[pr-gate] Missing required field \"mergeMode\". ${MERGE_MODE_HELP}`);\n        } else if (typeof mm !== 'string' || !PR_GATE_MERGE_MODES.includes(mm as typeof PR_GATE_MERGE_MODES[number])) {\n            errors.push(`[pr-gate] \"mergeMode\" = \"${String(mm)}\" is not valid. ${MERGE_MODE_HELP}`);\n        }\n    }\n\n    if ('gates' in s) errors.push(...validateGatesSection(s['gates']));\n\n    // Optional extension point: company review checklists, as an ARRAY right here in the config. Absent ⇒\n    // none. The removed { doc } manifest shape is rejected with the exact migration edit.\n    if ('checklists' in s) errors.push(...validateChecklistsSection(s['checklists'], repoRoot));\n\n    // Optional server-token salt. Absent ⇒ no token minted, CI enforcement is a no-op. Present ⇒ must be\n    // a non-empty string (an empty salt would mint a token anyone can forge from a known-empty secret).\n    if ('gateSalt' in s) {\n        const salt = s['gateSalt'];\n        if (typeof salt !== 'string' || salt.trim() === '') {\n            errors.push(`[pr-gate] \"gateSalt\" must be a non-empty string — it is the shared secret the gate token is HMAC'd with. Omit the key entirely to disable server-side token enforcement.`);\n        }\n    }\n\n    // Optional: what happens to the LOCAL branch once its PR lands. Absent ⇒ \"archive-tag\".\n    if ('landPr' in s) errors.push(...validateLandPrSection(s['landPr']));\n\n    // Optional: where wp-push-dev publishes the disposable copy. Absent ⇒ \"dev-include\" / \"dev\".\n    if ('devDeploy' in s) errors.push(...validateDevDeploySection(s['devDeploy']));\n\n    errors.push(...validateNoGateSaltRationale(s));\n\n    // Optional: publish reviewer output as a PR comment (defaults true). Must be a boolean when present.\n    if ('checklistComments' in s && typeof s['checklistComments'] !== 'boolean') {\n        errors.push(`[pr-gate] \"checklistComments\" must be a boolean (defaults to true; set false to keep the PR body-only).`);\n    }\n\n    return errors;\n}\n\nfunction excludePathsExample(): string {\n    return '\"excludePaths\": [\"repositories/**\"]';\n}\n\n// A glob list: must be a string[] (may be empty). `key` names it for the error.\n// webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed here\nfunction validateExcludeList(value: unknown, key: string): string[] {\n    if (!(Array.isArray(value) && value.every(p => typeof p === 'string'))) {\n        return [`[excludePaths] \"${key}\" must be a string[] of glob paths (use [] for none).`];\n    }\n    return [];\n}\n\n/**\n * Validate the REQUIRED top-level `excludePaths` block: ONE glob list suppressing hook enforcement per\n * file path, for code-style rules and file-scoped guards alike. Required so every client upgrading is\n * forced to declare it (as [] to keep today's behavior, or with real paths). Returns copy-paste\n * friendly errors and never throws — same contract as validatePrGateSection.\n *\n * The two-list object form `{ \"rules\": [...], \"guards\": [...] }` is RETIRED, not tolerated. It used to be\n * accepted and silently unioned, which is why this repo's own config sat on the dead shape for releases: an\n * accepted shape is never migrated. Rejecting it cannot wedge a consumer — editing webpieces.config.json is\n * always permitted, even while it is invalid. See retired-config-keys.ts.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateExcludePaths(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[excludePaths] Not configured in webpieces.config.json. Add this REQUIRED block ` +\n            `(use an empty array to keep enforcing everywhere):\\n\\n  ${excludePathsExample()}`,\n        ];\n    }\n    if (Array.isArray(section)) return validateExcludeList(section, 'excludePaths');\n    if (typeof section !== 'object') {\n        return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque excludePaths section from consumer JSON\n    const s = section as Record<string, unknown>;\n    // The retired two-list object. One table row owns the message for either key present.\n    const retired = retiredEntry('rules', '[excludePaths]');\n    if (retired && (s['rules'] !== undefined || s['guards'] !== undefined)) {\n        return [`${retiredKeyError(retired)}\\n\\n  ${excludePathsExample()}`];\n    }\n    return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n}\n\n// ---------------------------------------------------------------------------\n// match-rules — a new top-level ARRAY section (parallel to pr-gate/excludePaths). Each entry is a\n// client-authored content guard (raw-regex patterns + message + scoping). Validated structurally here\n// the same way pr-gate's `gates` are, because an array of objects can't be expressed in FieldDef schema.\n// ---------------------------------------------------------------------------\n\nfunction matchRulesExample(): string {\n    return `\"match-rules\": ${JSON.stringify(DEFAULT_MATCH_RULES, null, 4)}`;\n}\n\n// webpieces-disable no-any-unknown -- generic type guard over an opaque JSON value\nfunction isStringArray(value: unknown): value is string[] {\n    return Array.isArray(value) && value.every(v => typeof v === 'string');\n}\n\n// Compile a pattern to validate it; returns the error message, or undefined when it compiles.\nfunction regexError(pattern: string): string | undefined {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Constructed only to validate the syntax; the object is intentionally discarded.\n        void new RegExp(pattern);\n        return undefined;\n    } catch (err: unknown) {\n        const error = toError(err);\n        return error.message;\n    }\n}\n\n// One entry of the match-rules array, validated field-by-field (see validateGate for the pattern).\n// webpieces-disable no-any-unknown -- one match-rule entry from opaque consumer JSON, validated field-by-field\nfunction validateMatchRule(entry: unknown, index: number): string[] {\n    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {\n        return [`[match-rules] entry[${index}] must be an object { name, patterns, mainMessage, mode, turnOffRuleUntilEpoch, turnOffRuleWhileOnBranch, ... }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque match-rule entry from consumer JSON\n    const e = entry as Record<string, unknown>;\n    const label = typeof e['name'] === 'string' ? `\"${e['name']}\"` : `entry[${index}]`;\n    const errors: string[] = [];\n\n    if (typeof e['name'] !== 'string' || e['name'].trim() === '')\n        errors.push(`[match-rules] entry[${index}].name must be a non-empty string (it is the disable token and report label).`);\n\n    if (!isStringArray(e['patterns']) || e['patterns'].length === 0) {\n        errors.push(`[match-rules] ${label}.patterns must be a non-empty string[] of regexes.`);\n    } else {\n        e['patterns'].forEach((p: string, pi: number) => {\n            const rxErr = regexError(p);\n            if (rxErr) errors.push(`[match-rules] ${label}.patterns[${pi}] is not a valid regex: ${rxErr}`);\n        });\n    }\n\n    if (typeof e['mainMessage'] !== 'string' || e['mainMessage'].trim() === '')\n        errors.push(`[match-rules] ${label}.mainMessage must be a non-empty string.`);\n\n    if (typeof e['mode'] !== 'string' || !MODIFIED_CODE_MODES.includes(e['mode'] as typeof MODIFIED_CODE_MODES[number]))\n        errors.push(`[match-rules] ${label}.mode must be one of: ${MODIFIED_CODE_MODES.join(', ')}.`);\n\n    // Both escape hatches are REQUIRED on every match-rule too (same as keyed rules), so they are always\n    // visible. turnOffRuleUntilEpoch: number (0 = active; a future unix-epoch in seconds = temporarily\n    // off). turnOffRuleWhileOnBranch: string | null (null = always on; an EXACT branch name — matched\n    // with ===, never as a glob — disables the rule while that branch is checked out).\n    if (typeof e['turnOffRuleUntilEpoch'] !== 'number') {\n        errors.push(`[match-rules] ${label}.turnOffRuleUntilEpoch must be a number (0 = active; future unix-epoch seconds = temporarily off).`);\n    } else {\n        const capError = epochCapError(`[match-rules] ${label}`, e['turnOffRuleUntilEpoch']);\n        if (capError) errors.push(capError);\n    }\n    if (!(e['turnOffRuleWhileOnBranch'] === null || typeof e['turnOffRuleWhileOnBranch'] === 'string'))\n        errors.push(`[match-rules] ${label}.turnOffRuleWhileOnBranch must be a string or null (null = no branch / always on; a string is an EXACT branch name, globs are not supported).`);\n\n    // The old escape-hatch names were renamed — flag them precisely.\n    for (const oldKey of Object.keys(RENAMED_FIELD_ALIASES)) {\n        if (oldKey in e) errors.push(renamedFieldError(`[match-rules] ${label}`, oldKey, RENAMED_FIELD_ALIASES[oldKey]));\n    }\n\n    if (e['options'] !== undefined && !isStringArray(e['options']))\n        errors.push(`[match-rules] ${label}.options must be a string[] (omit if not needed).`);\n    if (e['allowedPaths'] !== undefined && !isStringArray(e['allowedPaths']))\n        errors.push(`[match-rules] ${label}.allowedPaths must be a string[] of globs (omit if not needed).`);\n    if (e['disableAllowed'] !== undefined && typeof e['disableAllowed'] !== 'boolean')\n        errors.push(`[match-rules] ${label}.disableAllowed must be a boolean.`);\n\n    return errors;\n}\n\n/**\n * Validate the REQUIRED top-level `match-rules` array (client-authored content guards). MISSING →\n * one error printing the ready-to-paste `no-fetch` example (add at least this; more can follow).\n * Present-but-`[]` → allowed (a conscious opt-out, matching pr-gate mode:OFF / excludePaths []).\n * Otherwise every entry is validated field-by-field (each regex compile-checked) plus name\n * uniqueness. Copy-paste-friendly errors; never throws — same contract as validatePrGateSection.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateMatchRulesSection(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[match-rules] Not configured in webpieces.config.json. Add this REQUIRED top-level array — ` +\n            `seed it with the no-fetch guard below (you can add more entries: no-moment, no-lodash-chain, …):\\n\\n${matchRulesExample()}`,\n        ];\n    }\n    if (!Array.isArray(section)) {\n        return [`[match-rules] Must be an array of content-guard objects. Example:\\n\\n${matchRulesExample()}`];\n    }\n\n    const errors: string[] = [];\n    const seen = new Set<string>();\n    for (let i = 0; i < section.length; i += 1) {\n        errors.push(...validateMatchRule(section[i], i));\n        // webpieces-disable no-any-unknown -- reading the name off an opaque entry only to dedupe\n        const name = (section[i] as Record<string, unknown> | null)?.['name'];\n        if (typeof name === 'string') {\n            if (seen.has(name)) errors.push(`[match-rules] duplicate entry name \"${name}\" — each match-rule name must be unique.`);\n            seen.add(name);\n        }\n    }\n    return errors;\n}\n\n/**\n * Enforce that each built-in lives in its correct section: code rules under `rules`, bash guards\n * under `hookGuards`. A guard left in `rules` (or a rule placed in `hookGuards`) is reported with a\n * \"move it\" message so the split stays clean. Unknown/custom names are ignored (they may be custom\n * rules from rulesDir). Presence (\"every built-in must be configured\") is checked separately by\n * validateWebpiecesConfig against the merged map.\n */\n// webpieces-disable no-any-unknown -- section maps are opaque consumer JSON\nexport function validateSectionPlacement(\n    rulesSection: Record<string, Record<string, unknown>>,\n    hookGuardsSection: Record<string, Record<string, unknown>>,\n): string[] {\n    const errors: string[] = [];\n    for (const name of Object.keys(rulesSection)) {\n        if (isHookGuard(name)) {\n            errors.push(\n                `[${name}] is a hook guard and ${SECTION_PLACEMENT_MARKER} \"hookGuards\" section, not \"rules\". ` +\n                `Move it.`,\n            );\n        }\n    }\n    for (const name of Object.keys(hookGuardsSection)) {\n        // Only flag KNOWN code rules misplaced into hookGuards; unknown names may be custom rules.\n        if (!isHookGuard(name) && RULE_SCHEMAS[name]) {\n            errors.push(\n                `[${name}] is a code rule and ${SECTION_PLACEMENT_MARKER} \"rules\" section, not \"hookGuards\". ` +\n                `Move it.`,\n            );\n        }\n    }\n    return errors;\n}\n"]}