@webpieces/rules-config 0.4.691 → 0.4.693

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@webpieces/rules-config",
3
- "version": "0.4.691",
3
+ "version": "0.4.693",
4
4
  "description": "Shared webpieces.config.json loader. Single source of truth for validation rule configuration consumed by @webpieces/ai-hook-rules, @webpieces/code-rules, and @webpieces/nx-webpieces-rules.",
5
5
  "type": "commonjs",
6
6
  "main": "./src/index.js",
@@ -1,6 +1,7 @@
1
1
  import { MaxMethodLinesConfig, MaxFileLinesConfig, RequireReturnTypeConfig, NoInlineTypeLiteralsConfig, NoAnyUnknownConfig, NoImplicitAnyConfig, PrismaValidateDtosConfig, PrismaConverterConfig, NoDestructureConfig, NoUnmanagedExceptionsConfig, CatchErrorPatternConfig, ThrowCauseRequiredConfig, AngularNoDirectApiInResolverConfig, NoSymbolDiTokensConfig, NoCustomCssConfig, NoProcessExitOutsideMainConfig, NoFunctionOutsideClassConfig, InjectAnnotationNotNeededForConcreteClassConfig, FrameworkTagConfig, RoleTagConfig, BranchCreationGuardConfig, PrLifecycleGuardConfig, NoFileImportCyclesConfig, RuntimeArchitectureConfig, DiGraphConfig, MissingDesignAnnotationConfig, NoJsFilesConfig, ValidateTsInSrcConfig } from './rule-configs';
2
2
  import { BranchStateGuardConfig } from './main-sync-guard-configs';
3
3
  import { NoClientCreationOutsideServerOrClientConfig } from './no-client-creation-config';
4
+ import { NoStatePathsInTemplatesConfig } from './no-state-paths-config';
4
5
  export declare class WebpiecesRulesConfig {
5
6
  'max-method-lines'?: MaxMethodLinesConfig;
6
7
  'max-file-lines'?: MaxFileLinesConfig;
@@ -18,6 +19,7 @@ export declare class WebpiecesRulesConfig {
18
19
  'no-symbol-di-tokens'?: NoSymbolDiTokensConfig;
19
20
  'no-client-creation-outside-server-or-client'?: NoClientCreationOutsideServerOrClientConfig;
20
21
  'no-custom-css'?: NoCustomCssConfig;
22
+ 'no-state-paths-in-templates'?: NoStatePathsInTemplatesConfig;
21
23
  'no-process-exit-outside-main'?: NoProcessExitOutsideMainConfig;
22
24
  'no-function-outside-class'?: NoFunctionOutsideClassConfig;
23
25
  'inject-annotation-not-needed-for-concrete-class'?: InjectAnnotationNotNeededForConcreteClassConfig;
@@ -18,6 +18,7 @@ class WebpiecesRulesConfig {
18
18
  'no-symbol-di-tokens';
19
19
  'no-client-creation-outside-server-or-client';
20
20
  'no-custom-css';
21
+ 'no-state-paths-in-templates';
21
22
  'no-process-exit-outside-main';
22
23
  'no-function-outside-class';
23
24
  'inject-annotation-not-needed-for-concrete-class';
@@ -1 +1 @@
1
- {"version":3,"file":"WebpiecesRulesConfig.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/WebpiecesRulesConfig.ts"],"names":[],"mappings":";;;AAiCA,MAAa,oBAAoB;IAC7B,kBAAkB,CAAwB;IAC1C,gBAAgB,CAAsB;IACtC,qBAAqB,CAA2B;IAChD,yBAAyB,CAA8B;IACvD,gBAAgB,CAAsB;IACtC,iBAAiB,CAAuB;IACxC,sBAAsB,CAA4B;IAClD,kBAAkB,CAAyB;IAC3C,gBAAgB,CAAuB;IACvC,yBAAyB,CAA+B;IACxD,qBAAqB,CAA2B;IAChD,sBAAsB,CAA4B;IAClD,mCAAmC,CAAsC;IACzE,qBAAqB,CAA0B;IAC/C,6CAA6C,CAA+C;IAC5F,eAAe,CAAqB;IACpC,8BAA8B,CAAkC;IAChE,2BAA2B,CAAgC;IAC3D,iDAAiD,CAAmD;IACpG,eAAe,CAAsB;IACrC,UAAU,CAAiB;IAC3B,gGAAgG;IAChG,8FAA8F;IAC9F,gGAAgG;IAChG,oBAAoB,CAA0B;IAC9C,uBAAuB,CAA6B;IACpD,oBAAoB,CAA0B;IAC9C,uBAAuB,CAA4B;IACnD,sBAAsB,CAA6B;IACnD,UAAU,CAAiB;IAC3B,2BAA2B,CAAiC;IAC5D,aAAa,CAAmB;IAChC,oBAAoB,CAAyB;IAC7C,QAAQ,CAAY;CACvB;AAnCD,oDAmCC","sourcesContent":["import {\n MaxMethodLinesConfig,\n MaxFileLinesConfig,\n RequireReturnTypeConfig,\n NoInlineTypeLiteralsConfig,\n NoAnyUnknownConfig,\n NoImplicitAnyConfig,\n PrismaValidateDtosConfig,\n PrismaConverterConfig,\n NoDestructureConfig,\n NoUnmanagedExceptionsConfig,\n CatchErrorPatternConfig,\n ThrowCauseRequiredConfig,\n AngularNoDirectApiInResolverConfig,\n NoSymbolDiTokensConfig,\n NoCustomCssConfig,\n NoProcessExitOutsideMainConfig,\n NoFunctionOutsideClassConfig,\n InjectAnnotationNotNeededForConcreteClassConfig,\n FrameworkTagConfig,\n RoleTagConfig,\n BranchCreationGuardConfig,\n PrLifecycleGuardConfig,\n NoFileImportCyclesConfig,\n RuntimeArchitectureConfig,\n DiGraphConfig,\n MissingDesignAnnotationConfig,\n NoJsFilesConfig,\n ValidateTsInSrcConfig,\n} from './rule-configs';\nimport { BranchStateGuardConfig } from './main-sync-guard-configs';\nimport { NoClientCreationOutsideServerOrClientConfig } from './no-client-creation-config';\n\nexport class WebpiecesRulesConfig {\n 'max-method-lines'?: MaxMethodLinesConfig;\n 'max-file-lines'?: MaxFileLinesConfig;\n 'require-return-type'?: RequireReturnTypeConfig;\n 'no-inline-type-literals'?: NoInlineTypeLiteralsConfig;\n 'no-any-unknown'?: NoAnyUnknownConfig;\n 'no-implicit-any'?: NoImplicitAnyConfig;\n 'prisma-validate-dtos'?: PrismaValidateDtosConfig;\n 'prisma-converter'?: PrismaConverterConfig;\n 'no-destructure'?: NoDestructureConfig;\n 'no-unmanaged-exceptions'?: NoUnmanagedExceptionsConfig;\n 'catch-error-pattern'?: CatchErrorPatternConfig;\n 'throw-cause-required'?: ThrowCauseRequiredConfig;\n 'angular-no-direct-api-in-resolver'?: AngularNoDirectApiInResolverConfig;\n 'no-symbol-di-tokens'?: NoSymbolDiTokensConfig;\n 'no-client-creation-outside-server-or-client'?: NoClientCreationOutsideServerOrClientConfig;\n 'no-custom-css'?: NoCustomCssConfig;\n 'no-process-exit-outside-main'?: NoProcessExitOutsideMainConfig;\n 'no-function-outside-class'?: NoFunctionOutsideClassConfig;\n 'inject-annotation-not-needed-for-concrete-class'?: InjectAnnotationNotNeededForConcreteClassConfig;\n 'framework-tag'?: FrameworkTagConfig;\n 'role-tag'?: RoleTagConfig;\n // The THREE hookGuards keys, complete. It used to list five of the nine class-named keys — both\n // bash guards were simply missing — and nothing caught it, because this class is populated by\n // dynamic key assignment in the loader. One key per POLICY makes completeness checkable by eye.\n 'branch-state-guard'?: BranchStateGuardConfig;\n 'branch-creation-guard'?: BranchCreationGuardConfig;\n 'pr-lifecycle-guard'?: PrLifecycleGuardConfig;\n 'no-file-import-cycles'?: NoFileImportCyclesConfig;\n 'runtime-architecture'?: RuntimeArchitectureConfig;\n 'di-graph'?: DiGraphConfig;\n 'missing-design-annotation'?: MissingDesignAnnotationConfig;\n 'no-js-files'?: NoJsFilesConfig;\n 'validate-ts-in-src'?: ValidateTsInSrcConfig;\n rulesDir?: string[];\n}\n"]}
1
+ {"version":3,"file":"WebpiecesRulesConfig.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/WebpiecesRulesConfig.ts"],"names":[],"mappings":";;;AAkCA,MAAa,oBAAoB;IAC7B,kBAAkB,CAAwB;IAC1C,gBAAgB,CAAsB;IACtC,qBAAqB,CAA2B;IAChD,yBAAyB,CAA8B;IACvD,gBAAgB,CAAsB;IACtC,iBAAiB,CAAuB;IACxC,sBAAsB,CAA4B;IAClD,kBAAkB,CAAyB;IAC3C,gBAAgB,CAAuB;IACvC,yBAAyB,CAA+B;IACxD,qBAAqB,CAA2B;IAChD,sBAAsB,CAA4B;IAClD,mCAAmC,CAAsC;IACzE,qBAAqB,CAA0B;IAC/C,6CAA6C,CAA+C;IAC5F,eAAe,CAAqB;IACpC,6BAA6B,CAAiC;IAC9D,8BAA8B,CAAkC;IAChE,2BAA2B,CAAgC;IAC3D,iDAAiD,CAAmD;IACpG,eAAe,CAAsB;IACrC,UAAU,CAAiB;IAC3B,gGAAgG;IAChG,8FAA8F;IAC9F,gGAAgG;IAChG,oBAAoB,CAA0B;IAC9C,uBAAuB,CAA6B;IACpD,oBAAoB,CAA0B;IAC9C,uBAAuB,CAA4B;IACnD,sBAAsB,CAA6B;IACnD,UAAU,CAAiB;IAC3B,2BAA2B,CAAiC;IAC5D,aAAa,CAAmB;IAChC,oBAAoB,CAAyB;IAC7C,QAAQ,CAAY;CACvB;AApCD,oDAoCC","sourcesContent":["import {\n MaxMethodLinesConfig,\n MaxFileLinesConfig,\n RequireReturnTypeConfig,\n NoInlineTypeLiteralsConfig,\n NoAnyUnknownConfig,\n NoImplicitAnyConfig,\n PrismaValidateDtosConfig,\n PrismaConverterConfig,\n NoDestructureConfig,\n NoUnmanagedExceptionsConfig,\n CatchErrorPatternConfig,\n ThrowCauseRequiredConfig,\n AngularNoDirectApiInResolverConfig,\n NoSymbolDiTokensConfig,\n NoCustomCssConfig,\n NoProcessExitOutsideMainConfig,\n NoFunctionOutsideClassConfig,\n InjectAnnotationNotNeededForConcreteClassConfig,\n FrameworkTagConfig,\n RoleTagConfig,\n BranchCreationGuardConfig,\n PrLifecycleGuardConfig,\n NoFileImportCyclesConfig,\n RuntimeArchitectureConfig,\n DiGraphConfig,\n MissingDesignAnnotationConfig,\n NoJsFilesConfig,\n ValidateTsInSrcConfig,\n} from './rule-configs';\nimport { BranchStateGuardConfig } from './main-sync-guard-configs';\nimport { NoClientCreationOutsideServerOrClientConfig } from './no-client-creation-config';\nimport { NoStatePathsInTemplatesConfig } from './no-state-paths-config';\n\nexport class WebpiecesRulesConfig {\n 'max-method-lines'?: MaxMethodLinesConfig;\n 'max-file-lines'?: MaxFileLinesConfig;\n 'require-return-type'?: RequireReturnTypeConfig;\n 'no-inline-type-literals'?: NoInlineTypeLiteralsConfig;\n 'no-any-unknown'?: NoAnyUnknownConfig;\n 'no-implicit-any'?: NoImplicitAnyConfig;\n 'prisma-validate-dtos'?: PrismaValidateDtosConfig;\n 'prisma-converter'?: PrismaConverterConfig;\n 'no-destructure'?: NoDestructureConfig;\n 'no-unmanaged-exceptions'?: NoUnmanagedExceptionsConfig;\n 'catch-error-pattern'?: CatchErrorPatternConfig;\n 'throw-cause-required'?: ThrowCauseRequiredConfig;\n 'angular-no-direct-api-in-resolver'?: AngularNoDirectApiInResolverConfig;\n 'no-symbol-di-tokens'?: NoSymbolDiTokensConfig;\n 'no-client-creation-outside-server-or-client'?: NoClientCreationOutsideServerOrClientConfig;\n 'no-custom-css'?: NoCustomCssConfig;\n 'no-state-paths-in-templates'?: NoStatePathsInTemplatesConfig;\n 'no-process-exit-outside-main'?: NoProcessExitOutsideMainConfig;\n 'no-function-outside-class'?: NoFunctionOutsideClassConfig;\n 'inject-annotation-not-needed-for-concrete-class'?: InjectAnnotationNotNeededForConcreteClassConfig;\n 'framework-tag'?: FrameworkTagConfig;\n 'role-tag'?: RoleTagConfig;\n // The THREE hookGuards keys, complete. It used to list five of the nine class-named keys — both\n // bash guards were simply missing — and nothing caught it, because this class is populated by\n // dynamic key assignment in the loader. One key per POLICY makes completeness checkable by eye.\n 'branch-state-guard'?: BranchStateGuardConfig;\n 'branch-creation-guard'?: BranchCreationGuardConfig;\n 'pr-lifecycle-guard'?: PrLifecycleGuardConfig;\n 'no-file-import-cycles'?: NoFileImportCyclesConfig;\n 'runtime-architecture'?: RuntimeArchitectureConfig;\n 'di-graph'?: DiGraphConfig;\n 'missing-design-annotation'?: MissingDesignAnnotationConfig;\n 'no-js-files'?: NoJsFilesConfig;\n 'validate-ts-in-src'?: ValidateTsInSrcConfig;\n rulesDir?: string[];\n}\n"]}
@@ -17,6 +17,7 @@ export declare const RULE_NAMES: {
17
17
  readonly NO_INLINE_TYPES: "no-inline-types";
18
18
  readonly NO_DIRECT_API_RESOLVER: "no-direct-api-resolver";
19
19
  readonly NO_CUSTOM_CSS: "no-custom-css";
20
+ readonly NO_STATE_PATHS_IN_TEMPLATES: "no-state-paths-in-templates";
20
21
  readonly PRISMA_CONVERTER: "prisma-converter";
21
22
  readonly MAX_LINES_NEW_METHODS: "max-lines-new-methods";
22
23
  readonly MAX_LINES_MODIFIED_FILES: "max-lines-modified-files";
package/src/constants.js CHANGED
@@ -31,6 +31,7 @@ exports.RULE_NAMES = {
31
31
  NO_INLINE_TYPES: 'no-inline-types',
32
32
  NO_DIRECT_API_RESOLVER: 'no-direct-api-resolver',
33
33
  NO_CUSTOM_CSS: 'no-custom-css',
34
+ NO_STATE_PATHS_IN_TEMPLATES: 'no-state-paths-in-templates',
34
35
  PRISMA_CONVERTER: 'prisma-converter',
35
36
  MAX_LINES_NEW_METHODS: 'max-lines-new-methods',
36
37
  MAX_LINES_MODIFIED_FILES: 'max-lines-modified-files',
@@ -1 +1 @@
1
- {"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/constants.ts"],"names":[],"mappings":";AAAA,iFAAiF;AACjF,sEAAsE;AACtE,EAAE;AACF,yFAAyF;AACzF,qFAAqF;AACrF,kFAAkF;;;AA8FlF,gCAEC;AA9FY,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,kFAAkF;AAClF,uFAAuF;AACvF,uEAAuE;AACvE,sFAAsF;AACzE,QAAA,UAAU,GAAG;IACtB,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,uBAAuB,EAAE,yBAAyB;IAClD,mBAAmB,EAAE,qBAAqB;IAC1C,oBAAoB,EAAE,sBAAsB;IAC5C,mBAAmB,EAAE,qBAAqB;IAC1C,mBAAmB,EAAE,qBAAqB;IAC1C,2CAA2C,EAAE,6CAA6C;IAC1F,4BAA4B,EAAE,8BAA8B;IAC5D,yBAAyB,EAAE,2BAA2B;IACtD,+CAA+C,EAAE,iDAAiD;IAClG,aAAa,EAAE,eAAe;IAC9B,QAAQ,EAAE,UAAU;IACpB,eAAe,EAAE,iBAAiB;IAClC,sBAAsB,EAAE,wBAAwB;IAChD,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,kBAAkB;IACpC,qBAAqB,EAAE,uBAAuB;IAC9C,wBAAwB,EAAE,0BAA0B;IACpD,kBAAkB,EAAE,oBAAoB;CAClC,CAAC;AAEX,wFAAwF;AACxF,0FAA0F;AAC1F,sFAAsF;AACtF,0DAA0D;AAC1D,EAAE;AACF,mFAAmF;AACnF,uFAAuF;AACvF,0FAA0F;AAC1F,iGAAiG;AACjG,8FAA8F;AAC9F,yFAAyF;AACzF,mGAAmG;AACnG,2FAA2F;AAC3F,kGAAkG;AAClG,mGAAmG;AACnG,4DAA4D;AAC/C,QAAA,iBAAiB,GAAG,YAAY,CAAC;AACjC,QAAA,cAAc,GAAG,YAAY,CAAC;AAC3C,kGAAkG;AAClG,qGAAqG;AACrG,iCAAiC;AACpB,QAAA,aAAa,GAAG,WAAW,CAAC;AAC5B,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,uFAAuF;AACvF,qGAAqG;AACrG,8FAA8F;AAC9F,2DAA2D;AAC3D,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,oGAAoG;AACpG,kGAAkG;AACrF,QAAA,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,2FAA2F;AAC3F,mFAAmF;AACnF,uFAAuF;AACvF,uGAAuG;AACvG,kGAAkG;AAClG,kGAAkG;AAClG,iDAAiD;AACpC,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAE7D;;;;;;;;;GASG;AACU,QAAA,qBAAqB,GAAG,8BAA8B,CAAC;AAEpE;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,IAAY,EAAE,QAAgB;IACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,yBAAiB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC","sourcesContent":["// Single source of truth for the disable-comment token and rule-name identifiers\n// shared across rules-config, ai-hook-rules, code-rules, and pr-gate.\n//\n// There is exactly ONE disable form: `// webpieces-disable <rule>[, <rule2>] -- reason`.\n// The legacy `ai-hook-disable` alias and the `-file`/`-next`/`-all` variants and the\n// `*`/bare (no-rule) wildcard have been removed — every disable MUST name a rule.\n\nexport const WEBPIECES_DISABLE = 'webpieces-disable';\n\n// Rule-name tokens as they appear AFTER `webpieces-disable` in a disable comment.\n// Values must match existing comments exactly — changing a value silently breaks every\n// disable that names that rule. Note MAX_LINES_MODIFIED is a prefix of\n// MAX_LINES_MODIFIED_FILES (a historical substring-match quirk preserved on purpose).\nexport const RULE_NAMES = {\n NO_ANY_UNKNOWN: 'no-any-unknown',\n NO_IMPLICIT_ANY: 'no-implicit-any',\n NO_DESTRUCTURE: 'no-destructure',\n NO_UNMANAGED_EXCEPTIONS: 'no-unmanaged-exceptions',\n CATCH_ERROR_PATTERN: 'catch-error-pattern',\n THROW_CAUSE_REQUIRED: 'throw-cause-required',\n REQUIRE_RETURN_TYPE: 'require-return-type',\n NO_SYMBOL_DI_TOKENS: 'no-symbol-di-tokens',\n NO_CLIENT_CREATION_OUTSIDE_SERVER_OR_CLIENT: 'no-client-creation-outside-server-or-client',\n NO_PROCESS_EXIT_OUTSIDE_MAIN: 'no-process-exit-outside-main',\n NO_FUNCTION_OUTSIDE_CLASS: 'no-function-outside-class',\n INJECT_ANNOTATION_NOT_NEEDED_FOR_CONCRETE_CLASS: 'inject-annotation-not-needed-for-concrete-class',\n FRAMEWORK_TAG: 'framework-tag',\n ROLE_TAG: 'role-tag',\n NO_INLINE_TYPES: 'no-inline-types',\n NO_DIRECT_API_RESOLVER: 'no-direct-api-resolver',\n NO_CUSTOM_CSS: 'no-custom-css',\n PRISMA_CONVERTER: 'prisma-converter',\n MAX_LINES_NEW_METHODS: 'max-lines-new-methods',\n MAX_LINES_MODIFIED_FILES: 'max-lines-modified-files',\n MAX_LINES_MODIFIED: 'max-lines-modified',\n} as const;\n\n// Merge-state convention shared by the pr-gate scripts (which WRITE the marker during a\n// conflicted 3-point merge) and the ai-hook-rules merge-in-progress-guard (which READS it\n// to block commit/push/PR until the merge is validated). Kept here so neither package\n// depends on the other — they only share this vocabulary.\n//\n// `.webpieces/` is the single working dir for all webpieces tooling: ai-hook-rules\n// bootstrap/cache, the instruct-ai docs, and the workflow state. To keep the top level\n// quiet, per-feature workflow dirs are nested one level down under `merge-info/<feature>`\n// and `pr-review/<feature>` rather than scattered as top-level `merge-<feature>`/`pr-<feature>`.\n// `.webpieces/` is gitignored; only the per-feature subdirs under those two homes are subject\n// to 30-day cleanup (the homes themselves, like hooks/ and instruct-ai/, are permanent).\n// The DIRECTORY NAME only. Never join it onto a root yourself — go through `DotWebpieces.shared()`\n// (repo-wide state), `DotWebpieces.local()` (this worktree's own tooling-written state) or\n// `DotWebpieces.aiWritable()` (this worktree's state that a CODING AGENT writes) so the call site\n// declares its scope. In a linked worktree the three resolve to different places, and getting that\n// silently wrong is the bug those methods exist to prevent.\nexport const WEBPIECES_TMP_DIR = '.webpieces';\nexport const MERGE_INFO_DIR = 'merge-info';\n// The PR working home. Renamed from the legacy `pr-info` to `pr-review` for clarity (it holds the\n// AI's PR review + rendered body). Old `pr-info/` dirs are gitignored local state and self-clear via\n// cleanTmp's legacy `pr-` sweep.\nexport const PR_REVIEW_DIR = 'pr-review';\nexport const MERGE_IN_PROGRESS_FILE = 'merge-in-progress.json';\n\n// The dev-deploy resolve state file, written by `wp-push-dev --resolve` and cleared by\n// `wp-finish-push-dev` (or `--abort`). Named here for the same reason MERGE_IN_PROGRESS_FILE is: the\n// pr-gate commands WRITE it and things outside pr-gate READ it to decide whether a resolve is\n// half-finished, and neither side may depend on the other.\n//\n// It lives directly under `.webpieces/` local state (NOT under merge-info/), because a dev-deploy\n// resolve is not a 3-point merge: it never touches the feature branch, never produces merge-info\n// context, and must NOT be picked up by merge-in-progress-guard's marker scan — that guard's remedy\n// is `pnpm wp-finish-upsert-pr`, which is the wrong command here and would strand the tmp branch.\nexport const PUSH_DEV_STATE_FILE = 'push-dev-in-progress.json';\n\n// Proof-of-work the AI must produce for every conflicted file it resolves during a 3-point\n// merge: a short explanation written NEXT TO that file's 3-point context (the same\n// `updatemain-<safe_path>/` dir that holds A-forkpoint.txt / B-A.diff / C-A.diff). The\n// wp-finish-upsert-pr gate requires a non-empty file of this name per conflicted file before passing —\n// it is the only check on the part of the process the AI actually owns (resolving files). Using a\n// sidecar file (rather than an in-source comment) works for any file type, including comment-less\n// ones like JSON and files resolved by deletion.\nexport const MERGE_EXPLANATION_FILE = 'merge-explanation.md';\n\n/**\n * The command that MECHANICALLY strips every unknown key from webpieces.config.json.\n *\n * An unknown key controls nothing, so deleting it is the cure — but \"delete it\" is a judgement call made\n * while the guard denies every Bash call, which is exactly when a reader is least able to make one. This\n * command turns that judgement into one keystroke, and every message that reports an unknown key names it.\n *\n * Lives in this leaf module (no imports) so both the banner and the validators can name it without\n * importing the pruner and re-creating an import cycle.\n */\nexport const PRUNE_UNKNOWN_COMMAND = 'pnpm wp-prune-unknown-config';\n\n/**\n * Fast predicate: does this text carry a webpieces-disable for the given rule?\n * Line-agnostic — the caller decides which line(s) or block of text to feed it.\n * This is the cheap substring form used by code-rules detection and pr-gate's\n * dashboard grep/count. (ai-hook-rules uses a richer line-mapping parser.)\n */\nexport function hasDisable(text: string, ruleName: string): boolean {\n return text.includes(WEBPIECES_DISABLE) && text.includes(ruleName);\n}\n"]}
1
+ {"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/constants.ts"],"names":[],"mappings":";AAAA,iFAAiF;AACjF,sEAAsE;AACtE,EAAE;AACF,yFAAyF;AACzF,qFAAqF;AACrF,kFAAkF;;;AA+FlF,gCAEC;AA/FY,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,kFAAkF;AAClF,uFAAuF;AACvF,uEAAuE;AACvE,sFAAsF;AACzE,QAAA,UAAU,GAAG;IACtB,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,uBAAuB,EAAE,yBAAyB;IAClD,mBAAmB,EAAE,qBAAqB;IAC1C,oBAAoB,EAAE,sBAAsB;IAC5C,mBAAmB,EAAE,qBAAqB;IAC1C,mBAAmB,EAAE,qBAAqB;IAC1C,2CAA2C,EAAE,6CAA6C;IAC1F,4BAA4B,EAAE,8BAA8B;IAC5D,yBAAyB,EAAE,2BAA2B;IACtD,+CAA+C,EAAE,iDAAiD;IAClG,aAAa,EAAE,eAAe;IAC9B,QAAQ,EAAE,UAAU;IACpB,eAAe,EAAE,iBAAiB;IAClC,sBAAsB,EAAE,wBAAwB;IAChD,aAAa,EAAE,eAAe;IAC9B,2BAA2B,EAAE,6BAA6B;IAC1D,gBAAgB,EAAE,kBAAkB;IACpC,qBAAqB,EAAE,uBAAuB;IAC9C,wBAAwB,EAAE,0BAA0B;IACpD,kBAAkB,EAAE,oBAAoB;CAClC,CAAC;AAEX,wFAAwF;AACxF,0FAA0F;AAC1F,sFAAsF;AACtF,0DAA0D;AAC1D,EAAE;AACF,mFAAmF;AACnF,uFAAuF;AACvF,0FAA0F;AAC1F,iGAAiG;AACjG,8FAA8F;AAC9F,yFAAyF;AACzF,mGAAmG;AACnG,2FAA2F;AAC3F,kGAAkG;AAClG,mGAAmG;AACnG,4DAA4D;AAC/C,QAAA,iBAAiB,GAAG,YAAY,CAAC;AACjC,QAAA,cAAc,GAAG,YAAY,CAAC;AAC3C,kGAAkG;AAClG,qGAAqG;AACrG,iCAAiC;AACpB,QAAA,aAAa,GAAG,WAAW,CAAC;AAC5B,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,uFAAuF;AACvF,qGAAqG;AACrG,8FAA8F;AAC9F,2DAA2D;AAC3D,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,oGAAoG;AACpG,kGAAkG;AACrF,QAAA,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D,2FAA2F;AAC3F,mFAAmF;AACnF,uFAAuF;AACvF,uGAAuG;AACvG,kGAAkG;AAClG,kGAAkG;AAClG,iDAAiD;AACpC,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAE7D;;;;;;;;;GASG;AACU,QAAA,qBAAqB,GAAG,8BAA8B,CAAC;AAEpE;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,IAAY,EAAE,QAAgB;IACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,yBAAiB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC","sourcesContent":["// Single source of truth for the disable-comment token and rule-name identifiers\n// shared across rules-config, ai-hook-rules, code-rules, and pr-gate.\n//\n// There is exactly ONE disable form: `// webpieces-disable <rule>[, <rule2>] -- reason`.\n// The legacy `ai-hook-disable` alias and the `-file`/`-next`/`-all` variants and the\n// `*`/bare (no-rule) wildcard have been removed — every disable MUST name a rule.\n\nexport const WEBPIECES_DISABLE = 'webpieces-disable';\n\n// Rule-name tokens as they appear AFTER `webpieces-disable` in a disable comment.\n// Values must match existing comments exactly — changing a value silently breaks every\n// disable that names that rule. Note MAX_LINES_MODIFIED is a prefix of\n// MAX_LINES_MODIFIED_FILES (a historical substring-match quirk preserved on purpose).\nexport const RULE_NAMES = {\n NO_ANY_UNKNOWN: 'no-any-unknown',\n NO_IMPLICIT_ANY: 'no-implicit-any',\n NO_DESTRUCTURE: 'no-destructure',\n NO_UNMANAGED_EXCEPTIONS: 'no-unmanaged-exceptions',\n CATCH_ERROR_PATTERN: 'catch-error-pattern',\n THROW_CAUSE_REQUIRED: 'throw-cause-required',\n REQUIRE_RETURN_TYPE: 'require-return-type',\n NO_SYMBOL_DI_TOKENS: 'no-symbol-di-tokens',\n NO_CLIENT_CREATION_OUTSIDE_SERVER_OR_CLIENT: 'no-client-creation-outside-server-or-client',\n NO_PROCESS_EXIT_OUTSIDE_MAIN: 'no-process-exit-outside-main',\n NO_FUNCTION_OUTSIDE_CLASS: 'no-function-outside-class',\n INJECT_ANNOTATION_NOT_NEEDED_FOR_CONCRETE_CLASS: 'inject-annotation-not-needed-for-concrete-class',\n FRAMEWORK_TAG: 'framework-tag',\n ROLE_TAG: 'role-tag',\n NO_INLINE_TYPES: 'no-inline-types',\n NO_DIRECT_API_RESOLVER: 'no-direct-api-resolver',\n NO_CUSTOM_CSS: 'no-custom-css',\n NO_STATE_PATHS_IN_TEMPLATES: 'no-state-paths-in-templates',\n PRISMA_CONVERTER: 'prisma-converter',\n MAX_LINES_NEW_METHODS: 'max-lines-new-methods',\n MAX_LINES_MODIFIED_FILES: 'max-lines-modified-files',\n MAX_LINES_MODIFIED: 'max-lines-modified',\n} as const;\n\n// Merge-state convention shared by the pr-gate scripts (which WRITE the marker during a\n// conflicted 3-point merge) and the ai-hook-rules merge-in-progress-guard (which READS it\n// to block commit/push/PR until the merge is validated). Kept here so neither package\n// depends on the other — they only share this vocabulary.\n//\n// `.webpieces/` is the single working dir for all webpieces tooling: ai-hook-rules\n// bootstrap/cache, the instruct-ai docs, and the workflow state. To keep the top level\n// quiet, per-feature workflow dirs are nested one level down under `merge-info/<feature>`\n// and `pr-review/<feature>` rather than scattered as top-level `merge-<feature>`/`pr-<feature>`.\n// `.webpieces/` is gitignored; only the per-feature subdirs under those two homes are subject\n// to 30-day cleanup (the homes themselves, like hooks/ and instruct-ai/, are permanent).\n// The DIRECTORY NAME only. Never join it onto a root yourself — go through `DotWebpieces.shared()`\n// (repo-wide state), `DotWebpieces.local()` (this worktree's own tooling-written state) or\n// `DotWebpieces.aiWritable()` (this worktree's state that a CODING AGENT writes) so the call site\n// declares its scope. In a linked worktree the three resolve to different places, and getting that\n// silently wrong is the bug those methods exist to prevent.\nexport const WEBPIECES_TMP_DIR = '.webpieces';\nexport const MERGE_INFO_DIR = 'merge-info';\n// The PR working home. Renamed from the legacy `pr-info` to `pr-review` for clarity (it holds the\n// AI's PR review + rendered body). Old `pr-info/` dirs are gitignored local state and self-clear via\n// cleanTmp's legacy `pr-` sweep.\nexport const PR_REVIEW_DIR = 'pr-review';\nexport const MERGE_IN_PROGRESS_FILE = 'merge-in-progress.json';\n\n// The dev-deploy resolve state file, written by `wp-push-dev --resolve` and cleared by\n// `wp-finish-push-dev` (or `--abort`). Named here for the same reason MERGE_IN_PROGRESS_FILE is: the\n// pr-gate commands WRITE it and things outside pr-gate READ it to decide whether a resolve is\n// half-finished, and neither side may depend on the other.\n//\n// It lives directly under `.webpieces/` local state (NOT under merge-info/), because a dev-deploy\n// resolve is not a 3-point merge: it never touches the feature branch, never produces merge-info\n// context, and must NOT be picked up by merge-in-progress-guard's marker scan — that guard's remedy\n// is `pnpm wp-finish-upsert-pr`, which is the wrong command here and would strand the tmp branch.\nexport const PUSH_DEV_STATE_FILE = 'push-dev-in-progress.json';\n\n// Proof-of-work the AI must produce for every conflicted file it resolves during a 3-point\n// merge: a short explanation written NEXT TO that file's 3-point context (the same\n// `updatemain-<safe_path>/` dir that holds A-forkpoint.txt / B-A.diff / C-A.diff). The\n// wp-finish-upsert-pr gate requires a non-empty file of this name per conflicted file before passing —\n// it is the only check on the part of the process the AI actually owns (resolving files). Using a\n// sidecar file (rather than an in-source comment) works for any file type, including comment-less\n// ones like JSON and files resolved by deletion.\nexport const MERGE_EXPLANATION_FILE = 'merge-explanation.md';\n\n/**\n * The command that MECHANICALLY strips every unknown key from webpieces.config.json.\n *\n * An unknown key controls nothing, so deleting it is the cure — but \"delete it\" is a judgement call made\n * while the guard denies every Bash call, which is exactly when a reader is least able to make one. This\n * command turns that judgement into one keystroke, and every message that reports an unknown key names it.\n *\n * Lives in this leaf module (no imports) so both the banner and the validators can name it without\n * importing the pruner and re-creating an import cycle.\n */\nexport const PRUNE_UNKNOWN_COMMAND = 'pnpm wp-prune-unknown-config';\n\n/**\n * Fast predicate: does this text carry a webpieces-disable for the given rule?\n * Line-agnostic — the caller decides which line(s) or block of text to feed it.\n * This is the cheap substring form used by code-rules detection and pr-gate's\n * dashboard grep/count. (ai-hook-rules uses a richer line-mapping parser.)\n */\nexport function hasDisable(text: string, ruleName: string): boolean {\n return text.includes(WEBPIECES_DISABLE) && text.includes(ruleName);\n}\n"]}
@@ -34,6 +34,11 @@ exports.defaultRules = {
34
34
  // failing until a repo flips it to "error").
35
35
  'no-client-creation-outside-server-or-client': { mode: 'OFF' },
36
36
  'no-custom-css': { allowGlobs: [] },
37
+ // Ships ARMED, and diff-scoped. A template that restates a `.webpieces/` path ships that path into
38
+ // every governed repo as instruction, and the paths are per-worktree — so the default has to be the
39
+ // one that stops the NEXT one, not one a repo has to discover. NEW_AND_MODIFIED_CODE is what makes
40
+ // that safe: the docs whose subject IS the layout are untouched until somebody edits the line.
41
+ 'no-state-paths-in-templates': { mode: 'NEW_AND_MODIFIED_CODE' },
37
42
  'no-process-exit-outside-main': {},
38
43
  'inject-annotation-not-needed-for-concrete-class': {},
39
44
  'framework-tag': { mode: 'MODIFIED_PROJECTS', knownTypes: ['browser', 'react', 'angular', 'node', 'express'] },
@@ -64,7 +69,8 @@ exports.defaultRules = {
64
69
  // pile up, and the pile is what makes a real branch hard to find. The reap is also NOT destructive
65
70
  // in the way the old comment implied — BranchReaper deletes only provably-dead branches (a merged
66
71
  // PR, a squash-merge backup of one, or no commits of their own), spares everything else for a
67
- // human, and logs each deletion to .webpieces/logs/branch-mutations.log with the pre-delete SHA
72
+ // human, and logs each deletion to the branch-mutation log (BranchMutationLog.branchMutationLogPath,
73
+ // which is per-worktree) with the pre-delete SHA
68
74
  // and a ready-made `recover=` command. So the worst case is one paste to undo, which a human can
69
75
  // resolve; the previous default's worst case was unbounded accumulation nobody ever cleaned.
70
76
  //
@@ -1 +1 @@
1
- {"version":3,"file":"default-rules.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/default-rules.ts"],"names":[],"mappings":";;;AAAA,2DAA2D;AAC3D,4EAA4E;AAC5E,kEAAkE;AAClE,0EAA0E;AAC1E,MAAM,qBAAqB,GAAsB;IAC7C,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IACrC,WAAW,EAAE,mBAAmB;CACnC,CAAC;AAEF,2EAA2E;AAC3E,6EAA6E;AAC7E,sFAAsF;AACtF,iFAAiF;AACpE,QAAA,YAAY,GAA4C;IACjE,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;IACrB,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;IAChC,kBAAkB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;IACjC,qBAAqB,EAAE,EAAE;IACzB,yBAAyB,EAAE,EAAE;IAC7B,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACzC,qBAAqB,EAAE,EAAE;IACzB,yBAAyB,EAAE,EAAE;IAC7B,uBAAuB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACnD,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,EAAE;IACrE,sBAAsB,EAAE,EAAE;IAC1B,kBAAkB,EAAE,EAAE;IACtB,mCAAmC,EAAE,EAAE;IACvC,qBAAqB,EAAE,EAAE;IACzB,sFAAsF;IACtF,6FAA6F;IAC7F,6CAA6C;IAC7C,6CAA6C,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;IAC9D,eAAe,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACnC,8BAA8B,EAAE,EAAE;IAClC,iDAAiD,EAAE,EAAE;IACrD,eAAe,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;IAC9G,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;IACpH,WAAW,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACvC,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACtC,2BAA2B,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACvD,oBAAoB,EAAE;QAClB,IAAI,EAAE,wBAAwB;QAC9B,gBAAgB,EAAE,CAAC,eAAe,CAAC;QACnC,YAAY,EAAE,CAAC,GAAG,qBAAqB,CAAC;KAC3C;IACD,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;IAC9B,iGAAiG;IACjG,kGAAkG;IAClG,0EAA0E;IAC1E,yFAAyF;IACzF,oFAAoF;IACpF,iCAAiC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7D,iCAAiC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7D,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAClD,0BAA0B,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACtD,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAClD,wFAAwF;IACxF,EAAE;IACF,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,kGAAkG;IAClG,8FAA8F;IAC9F,gGAAgG;IAChG,iGAAiG;IACjG,6FAA6F;IAC7F,EAAE;IACF,2EAA2E;IAC3E,uBAAuB,EAAE;QACrB,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,sCAAsC;QACvD,sBAAsB,EAAE,IAAI;KAC/B;IACD,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACpC,mGAAmG;IACnG,mGAAmG;IACnG,+EAA+E;IAC/E,mGAAmG;IACnG,gGAAgG;IAChG,uCAAuC;IACvC,EAAE;IACF,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,+CAA+C;IAC/C,EAAE;IACF,mGAAmG;IACnG,oGAAoG;IACpG,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;CACvC,CAAC;AAEW,QAAA,eAAe,GAAsB,EAAE,CAAC","sourcesContent":["// Default holistic exclude list for the validate-ts-in-src\n// rules. Bare names match a directory segment at any depth; globs match the\n// workspace-relative path. `**/*.d.ts` (ambient declarations) and\n// `**/jest.config.ts` legitimately live outside src/ and are exempt here.\nconst DEFAULT_EXCLUDE_PATHS: readonly string[] = [\n 'node_modules', 'dist', '.nx', '.git',\n '**/*.d.ts', '**/jest.config.ts',\n];\n\n// On/off is driven by `mode` (\"OFF\" disables; an absent mode leaves a rule\n// on). Code-rules entries omit `mode` so each executor keeps its own default\n// scope; structural rules declare `mode: 'RUN_EVERY_TIME'`, bash guards `mode: 'ON'`.\n// webpieces-disable no-any-unknown -- rule options are opaque at framework level\nexport const defaultRules: Record<string, Record<string, unknown>> = {\n 'no-any-unknown': {},\n 'no-implicit-any': {},\n 'max-file-lines': { limit: 900 },\n 'max-method-lines': { limit: 80 },\n 'require-return-type': {},\n 'no-inline-type-literals': {},\n 'no-destructure': { allowTopLevel: true },\n 'catch-error-pattern': {},\n 'no-unmanaged-exceptions': {},\n 'no-file-import-cycles': { mode: 'RUN_EVERY_TIME' },\n 'runtime-architecture': { mode: 'RUN_EVERY_TIME', allowedCycles: [] },\n 'prisma-validate-dtos': {},\n 'prisma-converter': {},\n 'angular-no-direct-api-in-resolver': {},\n 'no-symbol-di-tokens': {},\n // Ships OFF: a repo opts in per webpieces.config.json once it is ready to migrate any\n // client-in-a-lib sites (severity defaults to \"warn\" so even when enabled it reports without\n // failing until a repo flips it to \"error\").\n 'no-client-creation-outside-server-or-client': { mode: 'OFF' },\n 'no-custom-css': { allowGlobs: [] },\n 'no-process-exit-outside-main': {},\n 'inject-annotation-not-needed-for-concrete-class': {},\n 'framework-tag': { mode: 'MODIFIED_PROJECTS', knownTypes: ['browser', 'react', 'angular', 'node', 'express'] },\n 'role-tag': { mode: 'MODIFIED_PROJECTS', knownTypes: ['server', 'app', 'designed-lib', 'lib', 'client', 'api-lib'] },\n 'nx-wiring': { mode: 'RUN_EVERY_TIME' },\n 'di-graph': { mode: 'RUN_EVERY_TIME' },\n 'missing-design-annotation': { mode: 'RUN_EVERY_TIME' },\n 'validate-ts-in-src': {\n mode: 'NEW_AND_MODIFIED_FILES',\n allowedRootFiles: ['jest.setup.ts'],\n excludePaths: [...DEFAULT_EXCLUDE_PATHS],\n },\n 'no-js-files': { mode: 'OFF' },\n // The five Nx infrastructure validators. They enforced unconditionally before they were wired to\n // config, so RUN_EVERY_TIME is the only default that keeps existing repos behaving identically on\n // upgrade. Set \"mode\": \"OFF\" to disable one; the two graph-baseline rules\n // (validate-architecture-unchanged / validate-no-architecture-cycles) additionally honor\n // turnOffRuleUntilEpoch — the other three are all-or-nothing (see rule-configs.ts).\n 'validate-architecture-unchanged': { mode: 'RUN_EVERY_TIME' },\n 'validate-no-architecture-cycles': { mode: 'RUN_EVERY_TIME' },\n 'validate-packagejson': { mode: 'RUN_EVERY_TIME' },\n 'validate-versions-locked': { mode: 'RUN_EVERY_TIME' },\n 'validate-eslint-sync': { mode: 'RUN_EVERY_TIME' },\n // autoReapMergedBranches ships TRUE, and it is also what a fresh config is seeded with.\n //\n // It shipped FALSE on the reasoning that an upgrade must never delete branches unattended before a\n // human opts in. In practice that produced the opposite of safety: nobody opts in, dead branches\n // pile up, and the pile is what makes a real branch hard to find. The reap is also NOT destructive\n // in the way the old comment implied — BranchReaper deletes only provably-dead branches (a merged\n // PR, a squash-merge backup of one, or no commits of their own), spares everything else for a\n // human, and logs each deletion to .webpieces/logs/branch-mutations.log with the pre-delete SHA\n // and a ready-made `recover=` command. So the worst case is one paste to undo, which a human can\n // resolve; the previous default's worst case was unbounded accumulation nobody ever cleaned.\n //\n // Set it false to keep reaping manual; `pnpm wp-cleanup` works either way.\n 'branch-creation-guard': {\n mode: 'ON',\n subBranchNaming: 'feature/<ticket>/<short-description>',\n autoReapMergedBranches: true,\n },\n 'pr-lifecycle-guard': { mode: 'ON' },\n // NOTE: `whole-repo-build-guard` is deliberately ABSENT from this table, and from RULE_SCHEMAS and\n // HOOK_GUARD_NAMES with it. It is EXPERIMENTAL and OFF by default; the ONLY thing that turns it on\n // is `experimental.whole-repo-build-guard: true` in the optional machine-local\n // ~/.webpieces/config.json. Adding it back here would make it a rule every consumer must CONFIGURE\n // — which is fault Y, i.e. every Bash call blocked on upgrade, which is exactly what it did the\n // first time. See RETIRED_CONFIG_KEYS.\n //\n // branch-state-guard ships ON, INCLUDING its Read-blocking half.\n //\n // Its predecessor `read-stale-guard` shipped OFF as a \"phase 1\" staged rollout, on the reasoning\n // that Read is the highest-blast-radius tool there is and nobody should be armed before verifying\n // the fail-open paths against their own git layout. Phase 1 is over: this repo has run it ON in\n // production for releases, and the fail-open paths (branch undeterminable, cache absent, cache for\n // another branch, offline, dirty tree on main) are each covered by tests. Keeping it OFF now buys\n // nothing and costs the exact incident the guard exists for — a session spent reading a tree 18\n // commits behind while the log read \"handled\".\n //\n // Nothing is armed behind anyone's back either way: every built-in requires an explicit entry (the\n // config-sync check blocks until one exists), so a consumer states this mode themselves on upgrade.\n 'branch-state-guard': { mode: 'ON' },\n};\n\nexport const defaultRulesDir: readonly string[] = [];\n"]}
1
+ {"version":3,"file":"default-rules.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/default-rules.ts"],"names":[],"mappings":";;;AAAA,2DAA2D;AAC3D,4EAA4E;AAC5E,kEAAkE;AAClE,0EAA0E;AAC1E,MAAM,qBAAqB,GAAsB;IAC7C,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IACrC,WAAW,EAAE,mBAAmB;CACnC,CAAC;AAEF,2EAA2E;AAC3E,6EAA6E;AAC7E,sFAAsF;AACtF,iFAAiF;AACpE,QAAA,YAAY,GAA4C;IACjE,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;IACrB,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;IAChC,kBAAkB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;IACjC,qBAAqB,EAAE,EAAE;IACzB,yBAAyB,EAAE,EAAE;IAC7B,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACzC,qBAAqB,EAAE,EAAE;IACzB,yBAAyB,EAAE,EAAE;IAC7B,uBAAuB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACnD,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,EAAE;IACrE,sBAAsB,EAAE,EAAE;IAC1B,kBAAkB,EAAE,EAAE;IACtB,mCAAmC,EAAE,EAAE;IACvC,qBAAqB,EAAE,EAAE;IACzB,sFAAsF;IACtF,6FAA6F;IAC7F,6CAA6C;IAC7C,6CAA6C,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;IAC9D,eAAe,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACnC,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,+FAA+F;IAC/F,6BAA6B,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAChE,8BAA8B,EAAE,EAAE;IAClC,iDAAiD,EAAE,EAAE;IACrD,eAAe,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;IAC9G,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;IACpH,WAAW,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACvC,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACtC,2BAA2B,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACvD,oBAAoB,EAAE;QAClB,IAAI,EAAE,wBAAwB;QAC9B,gBAAgB,EAAE,CAAC,eAAe,CAAC;QACnC,YAAY,EAAE,CAAC,GAAG,qBAAqB,CAAC;KAC3C;IACD,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;IAC9B,iGAAiG;IACjG,kGAAkG;IAClG,0EAA0E;IAC1E,yFAAyF;IACzF,oFAAoF;IACpF,iCAAiC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7D,iCAAiC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7D,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAClD,0BAA0B,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACtD,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAClD,wFAAwF;IACxF,EAAE;IACF,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,kGAAkG;IAClG,8FAA8F;IAC9F,qGAAqG;IACrG,iDAAiD;IACjD,iGAAiG;IACjG,6FAA6F;IAC7F,EAAE;IACF,2EAA2E;IAC3E,uBAAuB,EAAE;QACrB,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,sCAAsC;QACvD,sBAAsB,EAAE,IAAI;KAC/B;IACD,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACpC,mGAAmG;IACnG,mGAAmG;IACnG,+EAA+E;IAC/E,mGAAmG;IACnG,gGAAgG;IAChG,uCAAuC;IACvC,EAAE;IACF,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,+CAA+C;IAC/C,EAAE;IACF,mGAAmG;IACnG,oGAAoG;IACpG,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;CACvC,CAAC;AAEW,QAAA,eAAe,GAAsB,EAAE,CAAC","sourcesContent":["// Default holistic exclude list for the validate-ts-in-src\n// rules. Bare names match a directory segment at any depth; globs match the\n// workspace-relative path. `**/*.d.ts` (ambient declarations) and\n// `**/jest.config.ts` legitimately live outside src/ and are exempt here.\nconst DEFAULT_EXCLUDE_PATHS: readonly string[] = [\n 'node_modules', 'dist', '.nx', '.git',\n '**/*.d.ts', '**/jest.config.ts',\n];\n\n// On/off is driven by `mode` (\"OFF\" disables; an absent mode leaves a rule\n// on). Code-rules entries omit `mode` so each executor keeps its own default\n// scope; structural rules declare `mode: 'RUN_EVERY_TIME'`, bash guards `mode: 'ON'`.\n// webpieces-disable no-any-unknown -- rule options are opaque at framework level\nexport const defaultRules: Record<string, Record<string, unknown>> = {\n 'no-any-unknown': {},\n 'no-implicit-any': {},\n 'max-file-lines': { limit: 900 },\n 'max-method-lines': { limit: 80 },\n 'require-return-type': {},\n 'no-inline-type-literals': {},\n 'no-destructure': { allowTopLevel: true },\n 'catch-error-pattern': {},\n 'no-unmanaged-exceptions': {},\n 'no-file-import-cycles': { mode: 'RUN_EVERY_TIME' },\n 'runtime-architecture': { mode: 'RUN_EVERY_TIME', allowedCycles: [] },\n 'prisma-validate-dtos': {},\n 'prisma-converter': {},\n 'angular-no-direct-api-in-resolver': {},\n 'no-symbol-di-tokens': {},\n // Ships OFF: a repo opts in per webpieces.config.json once it is ready to migrate any\n // client-in-a-lib sites (severity defaults to \"warn\" so even when enabled it reports without\n // failing until a repo flips it to \"error\").\n 'no-client-creation-outside-server-or-client': { mode: 'OFF' },\n 'no-custom-css': { allowGlobs: [] },\n // Ships ARMED, and diff-scoped. A template that restates a `.webpieces/` path ships that path into\n // every governed repo as instruction, and the paths are per-worktree — so the default has to be the\n // one that stops the NEXT one, not one a repo has to discover. NEW_AND_MODIFIED_CODE is what makes\n // that safe: the docs whose subject IS the layout are untouched until somebody edits the line.\n 'no-state-paths-in-templates': { mode: 'NEW_AND_MODIFIED_CODE' },\n 'no-process-exit-outside-main': {},\n 'inject-annotation-not-needed-for-concrete-class': {},\n 'framework-tag': { mode: 'MODIFIED_PROJECTS', knownTypes: ['browser', 'react', 'angular', 'node', 'express'] },\n 'role-tag': { mode: 'MODIFIED_PROJECTS', knownTypes: ['server', 'app', 'designed-lib', 'lib', 'client', 'api-lib'] },\n 'nx-wiring': { mode: 'RUN_EVERY_TIME' },\n 'di-graph': { mode: 'RUN_EVERY_TIME' },\n 'missing-design-annotation': { mode: 'RUN_EVERY_TIME' },\n 'validate-ts-in-src': {\n mode: 'NEW_AND_MODIFIED_FILES',\n allowedRootFiles: ['jest.setup.ts'],\n excludePaths: [...DEFAULT_EXCLUDE_PATHS],\n },\n 'no-js-files': { mode: 'OFF' },\n // The five Nx infrastructure validators. They enforced unconditionally before they were wired to\n // config, so RUN_EVERY_TIME is the only default that keeps existing repos behaving identically on\n // upgrade. Set \"mode\": \"OFF\" to disable one; the two graph-baseline rules\n // (validate-architecture-unchanged / validate-no-architecture-cycles) additionally honor\n // turnOffRuleUntilEpoch — the other three are all-or-nothing (see rule-configs.ts).\n 'validate-architecture-unchanged': { mode: 'RUN_EVERY_TIME' },\n 'validate-no-architecture-cycles': { mode: 'RUN_EVERY_TIME' },\n 'validate-packagejson': { mode: 'RUN_EVERY_TIME' },\n 'validate-versions-locked': { mode: 'RUN_EVERY_TIME' },\n 'validate-eslint-sync': { mode: 'RUN_EVERY_TIME' },\n // autoReapMergedBranches ships TRUE, and it is also what a fresh config is seeded with.\n //\n // It shipped FALSE on the reasoning that an upgrade must never delete branches unattended before a\n // human opts in. In practice that produced the opposite of safety: nobody opts in, dead branches\n // pile up, and the pile is what makes a real branch hard to find. The reap is also NOT destructive\n // in the way the old comment implied — BranchReaper deletes only provably-dead branches (a merged\n // PR, a squash-merge backup of one, or no commits of their own), spares everything else for a\n // human, and logs each deletion to the branch-mutation log (BranchMutationLog.branchMutationLogPath,\n // which is per-worktree) with the pre-delete SHA\n // and a ready-made `recover=` command. So the worst case is one paste to undo, which a human can\n // resolve; the previous default's worst case was unbounded accumulation nobody ever cleaned.\n //\n // Set it false to keep reaping manual; `pnpm wp-cleanup` works either way.\n 'branch-creation-guard': {\n mode: 'ON',\n subBranchNaming: 'feature/<ticket>/<short-description>',\n autoReapMergedBranches: true,\n },\n 'pr-lifecycle-guard': { mode: 'ON' },\n // NOTE: `whole-repo-build-guard` is deliberately ABSENT from this table, and from RULE_SCHEMAS and\n // HOOK_GUARD_NAMES with it. It is EXPERIMENTAL and OFF by default; the ONLY thing that turns it on\n // is `experimental.whole-repo-build-guard: true` in the optional machine-local\n // ~/.webpieces/config.json. Adding it back here would make it a rule every consumer must CONFIGURE\n // — which is fault Y, i.e. every Bash call blocked on upgrade, which is exactly what it did the\n // first time. See RETIRED_CONFIG_KEYS.\n //\n // branch-state-guard ships ON, INCLUDING its Read-blocking half.\n //\n // Its predecessor `read-stale-guard` shipped OFF as a \"phase 1\" staged rollout, on the reasoning\n // that Read is the highest-blast-radius tool there is and nobody should be armed before verifying\n // the fail-open paths against their own git layout. Phase 1 is over: this repo has run it ON in\n // production for releases, and the fail-open paths (branch undeterminable, cache absent, cache for\n // another branch, offline, dirty tree on main) are each covered by tests. Keeping it OFF now buys\n // nothing and costs the exact incident the guard exists for — a session spent reading a tree 18\n // commits behind while the log read \"handled\".\n //\n // Nothing is armed behind anyone's back either way: every built-in requires an explicit entry (the\n // config-sync check blocks until one exists), so a consumer states this mode themselves on upgrade.\n 'branch-state-guard': { mode: 'ON' },\n};\n\nexport const defaultRulesDir: readonly string[] = [];\n"]}
@@ -123,7 +123,6 @@
123
123
  export declare const HOME_CONFIG_DIR = ".webpieces";
124
124
  export declare const HOME_CONFIG_FILE = "config.json";
125
125
  export declare const HOME_EXPERIMENTAL_SECTION = "experimental";
126
- export declare const HOME_KEY_BUILD_GATE_LOG_CAPTURE = "buildGateLogCapture";
127
126
  export declare const HOME_KEY_WHOLE_REPO_BUILD_GUARD = "whole-repo-build-guard";
128
127
  export declare const HOME_KEY_ORPHAN_DIR_SWEEP = "orphan-dir-sweep";
129
128
  /**
@@ -169,12 +168,6 @@ export declare const ALLOWED_EXPERIMENTAL_NUMBERS: readonly string[];
169
168
  export declare const ALLOWED_EXPERIMENTAL: readonly string[];
170
169
  /** The parsed `~/.webpieces/config.json`. Data-only (per CLAUDE.md — classes, not interfaces, for data). */
171
170
  export declare class HomeConfig {
172
- /**
173
- * EXPERIMENTAL, under test, not a supported knob. When true, the pr-gate build gate captures its full
174
- * output to `.webpieces/logs/` and hands a failing build's pointer to that file to the AI instead of
175
- * an instruction to rebuild. Default false — i.e. the behaviour every consumer has today.
176
- */
177
- buildGateLogCapture: boolean;
178
171
  /**
179
172
  * EXPERIMENTAL, and OFF unless this machine opts IN with an explicit `true`. When true,
180
173
  * `whole-repo-build-guard` BLOCKS a Bash command that would build the WHOLE monorepo and hands back
@@ -213,7 +206,7 @@ export declare class HomeConfig {
213
206
  * you wedge a PR — though their builds do count toward what refuses an ad-hoc `wp-build`.
214
207
  */
215
208
  maxConcurrentBuilds: number;
216
- constructor(buildGateLogCapture: boolean, wholeRepoBuildGuard: boolean, orphanDirSweep: boolean, maxConcurrentBuilds: number);
209
+ constructor(wholeRepoBuildGuard: boolean, orphanDirSweep: boolean, maxConcurrentBuilds: number);
217
210
  }
218
211
  /**
219
212
  * One retired `~/.webpieces/config.json` key and the mechanical edit that replaces it. Data-only.
@@ -347,9 +340,9 @@ export declare class HomeConfigService {
347
340
  * A near-miss of a RETIRED key, pointed at its migration — or '' when nothing retired is close.
348
341
  *
349
342
  * The gap this closes: `assertNotRetired` matches a retired key EXACTLY, so `captureBuildGateLog`
350
- * throws with its rename instruction while `captureBuildGateLogg` — one stray character away, and a
351
- * far likelier thing to type — falls through to the generic "IGNORED, might be from a newer release"
352
- * line. That is the least helpful of the three answers offered to the reader whose intent is the
343
+ * throws with its migration instruction while `captureBuildGateLogg` — one stray character away, and
344
+ * a far likelier thing to type — falls through to the generic "IGNORED, might be from a newer
345
+ * release" line. That is the least helpful of the three answers offered to the reader whose intent is the
353
346
  * clearest, so the retired table is consulted here too, at the same distance-2 threshold.
354
347
  *
355
348
  * It only ever produces a WARNING, never a throw: this release cannot know whether the reader meant
@@ -365,9 +358,9 @@ export declare class HomeConfigService {
365
358
  * This used to be a case-insensitive EQUALITY test, which was adequate while an unknown key was a
366
359
  * hard error — the error itself was the signal, and the suggestion only saved a reading. Now the
367
360
  * suggestion IS the signal, so it has to catch the typos an equality test misses: a doubled letter,
368
- * a dropped one, a transposition, a stray trailing `d` (`buildGateLogCaptured`). Two is the useful
369
- * threshold — it covers every one of those and still refuses to guess for a genuinely new key, which
370
- * is the case that must NOT be dressed up as a typo.
361
+ * a dropped one, a transposition, a stray trailing character (`orphan-dir-sweeped`). Two is the
362
+ * useful threshold — it covers every one of those and still refuses to guess for a genuinely new
363
+ * key, which is the case that must NOT be dressed up as a typo.
371
364
  */
372
365
  private nearestKnownKey;
373
366
  /** Ordinary Levenshtein distance, one row at a time — the key names are short and this runs once. */
@@ -1,6 +1,6 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.HomeConfigService = exports.RETIRED_HOME_CONFIG_KEYS = exports.RetiredHomeConfigKey = exports.HomeConfig = exports.ALLOWED_EXPERIMENTAL = exports.ALLOWED_EXPERIMENTAL_NUMBERS = exports.ALLOWED_EXPERIMENTAL_BOOLEANS = exports.ALLOWED_TOP_LEVEL = exports.DEFAULT_MAX_CONCURRENT_BUILDS = exports.HOME_KEY_MAX_CONCURRENT_BUILDS = exports.HOME_KEY_ORPHAN_DIR_SWEEP = exports.HOME_KEY_WHOLE_REPO_BUILD_GUARD = exports.HOME_KEY_BUILD_GATE_LOG_CAPTURE = exports.HOME_EXPERIMENTAL_SECTION = exports.HOME_CONFIG_FILE = exports.HOME_CONFIG_DIR = void 0;
3
+ exports.HomeConfigService = exports.RETIRED_HOME_CONFIG_KEYS = exports.RetiredHomeConfigKey = exports.HomeConfig = exports.ALLOWED_EXPERIMENTAL = exports.ALLOWED_EXPERIMENTAL_NUMBERS = exports.ALLOWED_EXPERIMENTAL_BOOLEANS = exports.ALLOWED_TOP_LEVEL = exports.DEFAULT_MAX_CONCURRENT_BUILDS = exports.HOME_KEY_MAX_CONCURRENT_BUILDS = exports.HOME_KEY_ORPHAN_DIR_SWEEP = exports.HOME_KEY_WHOLE_REPO_BUILD_GUARD = exports.HOME_EXPERIMENTAL_SECTION = exports.HOME_CONFIG_FILE = exports.HOME_CONFIG_DIR = void 0;
4
4
  const tslib_1 = require("tslib");
5
5
  const fs = tslib_1.__importStar(require("fs"));
6
6
  const os = tslib_1.__importStar(require("os"));
@@ -136,11 +136,16 @@ exports.HOME_CONFIG_FILE = 'config.json';
136
136
  // text must spell them identically — a validator whose message names a different key than the one it
137
137
  // checks is worse than no message.
138
138
  exports.HOME_EXPERIMENTAL_SECTION = 'experimental';
139
- exports.HOME_KEY_BUILD_GATE_LOG_CAPTURE = 'buildGateLogCapture';
140
139
  // The on/off switch for `whole-repo-build-guard`. Spelled with the GUARD's own name, hyphens and all,
141
140
  // so `grep -rn whole-repo-build-guard` finds the switch beside the guard — and so nobody has to learn a
142
- // second name for one thing. It is a DIFFERENT key from buildGateLogCapture, which is #620's build-log
143
- // feature and merely selects WHICH refusal this guard prints.
141
+ // second name for one thing.
142
+ //
143
+ // `buildGateLogCapture` used to sit beside it and is GONE: capturing the build's output to a file is now
144
+ // what the gate always does (see BuildAffected.runBuildGate), so the flag had nothing left to switch. It
145
+ // is deliberately NOT in RETIRED_HOME_CONFIG_KEYS — a retired key here is a HARD FAILURE on exact match,
146
+ // and this file is machine-global and hand-authored, so a machine that opted INTO a behaviour it now
147
+ // gets unconditionally must not have its shell broken for saying yes early. It falls through to the
148
+ // unknown-key WARNING instead, which says the key had no effect and names what is understood.
144
149
  exports.HOME_KEY_WHOLE_REPO_BUILD_GUARD = 'whole-repo-build-guard';
145
150
  // The on/off switch for the orphan-directory sweep `wp-checkout-clean-main` runs. Named for the thing
146
151
  // it switches, exactly as the guard key above is — one name, greppable from either end.
@@ -197,7 +202,7 @@ exports.ALLOWED_TOP_LEVEL = [exports.HOME_EXPERIMENTAL_SECTION];
197
202
  * hand-maintained beside them, so it cannot fall out of step.
198
203
  */
199
204
  exports.ALLOWED_EXPERIMENTAL_BOOLEANS = [
200
- exports.HOME_KEY_WHOLE_REPO_BUILD_GUARD, exports.HOME_KEY_BUILD_GATE_LOG_CAPTURE, exports.HOME_KEY_ORPHAN_DIR_SWEEP,
205
+ exports.HOME_KEY_WHOLE_REPO_BUILD_GUARD, exports.HOME_KEY_ORPHAN_DIR_SWEEP,
201
206
  ];
202
207
  exports.ALLOWED_EXPERIMENTAL_NUMBERS = [exports.HOME_KEY_MAX_CONCURRENT_BUILDS];
203
208
  exports.ALLOWED_EXPERIMENTAL = [
@@ -232,12 +237,6 @@ exports.ALLOWED_EXPERIMENTAL = [
232
237
  const ABSENT_ERROR_CODES = ['ENOENT', 'ENOTDIR', 'EACCES', 'EPERM', 'EISDIR', 'ELOOP', 'ENAMETOOLONG'];
233
238
  /** The parsed `~/.webpieces/config.json`. Data-only (per CLAUDE.md — classes, not interfaces, for data). */
234
239
  class HomeConfig {
235
- /**
236
- * EXPERIMENTAL, under test, not a supported knob. When true, the pr-gate build gate captures its full
237
- * output to `.webpieces/logs/` and hands a failing build's pointer to that file to the AI instead of
238
- * an instruction to rebuild. Default false — i.e. the behaviour every consumer has today.
239
- */
240
- buildGateLogCapture;
241
240
  /**
242
241
  * EXPERIMENTAL, and OFF unless this machine opts IN with an explicit `true`. When true,
243
242
  * `whole-repo-build-guard` BLOCKS a Bash command that would build the WHOLE monorepo and hands back
@@ -276,14 +275,13 @@ class HomeConfig {
276
275
  * you wedge a PR — though their builds do count toward what refuses an ad-hoc `wp-build`.
277
276
  */
278
277
  maxConcurrentBuilds;
279
- // ALL FOUR required, no defaults. A defaulted parameter would leave `new HomeConfig(true)` compiling
278
+ // ALL THREE required, no defaults. A defaulted parameter would leave `new HomeConfig(true)` compiling
280
279
  // after this class grew a second flag, silently meaning "guard off" — an old spelling that still
281
280
  // typechecks with a changed meaning is exactly the shim this repo does not ship. The 3-arg arity this
282
281
  // class had before `maxConcurrentBuilds` is DELETED rather than overloaded, per CLAUDE.md § "NO
283
282
  // webpieces surface is released backwards-compatible": the compile errors ARE the migration. The
284
283
  // absent-file state is constructed in exactly one place — load()'s absent-file branch.
285
- constructor(buildGateLogCapture, wholeRepoBuildGuard, orphanDirSweep, maxConcurrentBuilds) {
286
- this.buildGateLogCapture = buildGateLogCapture;
284
+ constructor(wholeRepoBuildGuard, orphanDirSweep, maxConcurrentBuilds) {
287
285
  this.wholeRepoBuildGuard = wholeRepoBuildGuard;
288
286
  this.orphanDirSweep = orphanDirSweep;
289
287
  this.maxConcurrentBuilds = maxConcurrentBuilds;
@@ -320,12 +318,14 @@ exports.RetiredHomeConfigKey = RetiredHomeConfigKey;
320
318
  * every entry below actually FAILS the load, so a fallback that quietly accepts one turns it red.
321
319
  */
322
320
  exports.RETIRED_HOME_CONFIG_KEYS = [
323
- // `captureBuildGateLog` was the working name while this feature was being built, and it appears in
324
- // the branch history and in in-flight drafts, so it is exactly the spelling an agent reconstructing
325
- // the file from memory will type. It never shipped in a release; it is listed so that typing it
326
- // produces the rename instruction rather than a bare "unknown key".
327
- new RetiredHomeConfigKey('experimental.captureBuildGateLog', 'experimental.buildGateLogCapture', 'Rename the key to "buildGateLogCapture" inside the same "experimental" object. Its boolean value ' +
328
- 'carries over unchanged.'),
321
+ // `captureBuildGateLog` was the working name while the build-log feature was being built, and it
322
+ // appears in the branch history and in in-flight drafts, so it is exactly the spelling an agent
323
+ // reconstructing the file from memory will type. It never shipped in a release; it is listed so that
324
+ // typing it produces the DELETION instruction rather than a bare "unknown key". It used to point at
325
+ // `experimental.buildGateLogCapture`; that key is itself gone now (capture is unconditional), so the
326
+ // destination is "no replacement, delete it" and this entry is the only place either name survives.
327
+ new RetiredHomeConfigKey('experimental.captureBuildGateLog', '', 'Delete the key. Capturing the build gate\'s output to a log file is no longer optional — every ' +
328
+ 'build the PR gate runs writes its full output to a file and prints a "FullLog :" pointer at it.'),
329
329
  ];
330
330
  /**
331
331
  * Loads and validates `~/.webpieces/config.json`, and resolves whether a path IS that file (for the
@@ -354,7 +354,7 @@ let HomeConfigService = class HomeConfigService {
354
354
  // can never disagree. Spelled out rather than defaulted in the constructor — see the note there
355
355
  // on why a defaulted parameter is a shim.
356
356
  if (raw === null) {
357
- return new HomeConfig(GUARD_OFF_WHEN_ABSENT, GUARD_OFF_WHEN_ABSENT, GUARD_OFF_WHEN_ABSENT, exports.DEFAULT_MAX_CONCURRENT_BUILDS);
357
+ return new HomeConfig(GUARD_OFF_WHEN_ABSENT, GUARD_OFF_WHEN_ABSENT, exports.DEFAULT_MAX_CONCURRENT_BUILDS);
358
358
  }
359
359
  return this.validate(this.parse(raw, this.configPath(homeDir)), this.configPath(homeDir));
360
360
  }
@@ -441,7 +441,7 @@ let HomeConfigService = class HomeConfigService {
441
441
  // webpieces-disable no-any-unknown -- narrowed to a non-null, non-array object one line above
442
442
  const experimental = (section ?? {});
443
443
  this.warnUnknownKeys(Object.keys(experimental), exports.ALLOWED_EXPERIMENTAL, `${exports.HOME_EXPERIMENTAL_SECTION}.`);
444
- return new HomeConfig(this.readOptionalBoolean(experimental, exports.HOME_KEY_BUILD_GATE_LOG_CAPTURE, file, GUARD_OFF_WHEN_ABSENT), this.readOptionalBoolean(experimental, exports.HOME_KEY_WHOLE_REPO_BUILD_GUARD, file, GUARD_OFF_WHEN_ABSENT), this.readOptionalBoolean(experimental, exports.HOME_KEY_ORPHAN_DIR_SWEEP, file, GUARD_OFF_WHEN_ABSENT), this.readOptionalPositiveInteger(experimental, exports.HOME_KEY_MAX_CONCURRENT_BUILDS, file, exports.DEFAULT_MAX_CONCURRENT_BUILDS));
444
+ return new HomeConfig(this.readOptionalBoolean(experimental, exports.HOME_KEY_WHOLE_REPO_BUILD_GUARD, file, GUARD_OFF_WHEN_ABSENT), this.readOptionalBoolean(experimental, exports.HOME_KEY_ORPHAN_DIR_SWEEP, file, GUARD_OFF_WHEN_ABSENT), this.readOptionalPositiveInteger(experimental, exports.HOME_KEY_MAX_CONCURRENT_BUILDS, file, exports.DEFAULT_MAX_CONCURRENT_BUILDS));
445
445
  }
446
446
  /**
447
447
  * The NUMERIC sibling of {@link readOptionalBoolean}, and the same three rules apply unchanged: the
@@ -577,9 +577,9 @@ let HomeConfigService = class HomeConfigService {
577
577
  * A near-miss of a RETIRED key, pointed at its migration — or '' when nothing retired is close.
578
578
  *
579
579
  * The gap this closes: `assertNotRetired` matches a retired key EXACTLY, so `captureBuildGateLog`
580
- * throws with its rename instruction while `captureBuildGateLogg` — one stray character away, and a
581
- * far likelier thing to type — falls through to the generic "IGNORED, might be from a newer release"
582
- * line. That is the least helpful of the three answers offered to the reader whose intent is the
580
+ * throws with its migration instruction while `captureBuildGateLogg` — one stray character away, and
581
+ * a far likelier thing to type — falls through to the generic "IGNORED, might be from a newer
582
+ * release" line. That is the least helpful of the three answers offered to the reader whose intent is the
583
583
  * clearest, so the retired table is consulted here too, at the same distance-2 threshold.
584
584
  *
585
585
  * It only ever produces a WARNING, never a throw: this release cannot know whether the reader meant
@@ -609,9 +609,9 @@ let HomeConfigService = class HomeConfigService {
609
609
  * This used to be a case-insensitive EQUALITY test, which was adequate while an unknown key was a
610
610
  * hard error — the error itself was the signal, and the suggestion only saved a reading. Now the
611
611
  * suggestion IS the signal, so it has to catch the typos an equality test misses: a doubled letter,
612
- * a dropped one, a transposition, a stray trailing `d` (`buildGateLogCaptured`). Two is the useful
613
- * threshold — it covers every one of those and still refuses to guess for a genuinely new key, which
614
- * is the case that must NOT be dressed up as a typo.
612
+ * a dropped one, a transposition, a stray trailing character (`orphan-dir-sweeped`). Two is the
613
+ * useful threshold — it covers every one of those and still refuses to guess for a genuinely new
614
+ * key, which is the case that must NOT be dressed up as a typo.
615
615
  */
616
616
  nearestKnownKey(key, allowed) {
617
617
  let best = '';