@webpieces/rules-config 0.4.701 → 0.4.703

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/rules-config",
-  "version": "0.4.701",
+  "version": "0.4.703",
   "description": "Shared webpieces.config.json loader. Single source of truth for validation rule configuration consumed by @webpieces/ai-hook-rules, @webpieces/code-rules, and @webpieces/nx-webpieces-rules.",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/default-rules.js

@@ -24,7 +24,7 @@ exports.defaultRules = {
     'catch-error-pattern': {},
     'no-unmanaged-exceptions': {},
     'no-file-import-cycles': { mode: 'RUN_EVERY_TIME' },
-    'runtime-architecture': { mode: 'RUN_EVERY_TIME', allowedCycles: [] },
+    'runtime-architecture': { mode: 'RUN_EVERY_TIME' },
     'prisma-validate-dtos': {},
     'prisma-converter': {},
     'angular-no-direct-api-in-resolver': {},

package/src/default-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"default-rules.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/default-rules.ts"],"names":[],"mappings":";;;AAAA,2DAA2D;AAC3D,4EAA4E;AAC5E,kEAAkE;AAClE,0EAA0E;AAC1E,MAAM,qBAAqB,GAAsB;IAC7C,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IACrC,WAAW,EAAE,mBAAmB;CACnC,CAAC;AAEF,2EAA2E;AAC3E,6EAA6E;AAC7E,sFAAsF;AACtF,iFAAiF;AACpE,QAAA,YAAY,GAA4C;IACjE,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;IACrB,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;IAChC,kBAAkB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;IACjC,qBAAqB,EAAE,EAAE;IACzB,yBAAyB,EAAE,EAAE;IAC7B,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACzC,qBAAqB,EAAE,EAAE;IACzB,yBAAyB,EAAE,EAAE;IAC7B,uBAAuB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACnD,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,EAAE;IACrE,sBAAsB,EAAE,EAAE;IAC1B,kBAAkB,EAAE,EAAE;IACtB,mCAAmC,EAAE,EAAE;IACvC,qBAAqB,EAAE,EAAE;IACzB,sFAAsF;IACtF,6FAA6F;IAC7F,6CAA6C;IAC7C,6CAA6C,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;IAC9D,eAAe,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACnC,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,+FAA+F;IAC/F,6BAA6B,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAChE,8BAA8B,EAAE,EAAE;IAClC,iDAAiD,EAAE,EAAE;IACrD,eAAe,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;IAC9G,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;IACpH,WAAW,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACvC,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACtC,2BAA2B,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACvD,oBAAoB,EAAE;QAClB,IAAI,EAAE,wBAAwB;QAC9B,gBAAgB,EAAE,CAAC,eAAe,CAAC;QACnC,YAAY,EAAE,CAAC,GAAG,qBAAqB,CAAC;KAC3C;IACD,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;IAC9B,iGAAiG;IACjG,kGAAkG;IAClG,0EAA0E;IAC1E,yFAAyF;IACzF,oFAAoF;IACpF,iCAAiC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7D,iCAAiC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7D,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAClD,0BAA0B,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACtD,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAClD,wFAAwF;IACxF,EAAE;IACF,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,kGAAkG;IAClG,8FAA8F;IAC9F,qGAAqG;IACrG,iDAAiD;IACjD,iGAAiG;IACjG,6FAA6F;IAC7F,EAAE;IACF,2EAA2E;IAC3E,uBAAuB,EAAE;QACrB,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,sCAAsC;QACvD,sBAAsB,EAAE,IAAI;KAC/B;IACD,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACpC,mGAAmG;IACnG,mGAAmG;IACnG,+EAA+E;IAC/E,mGAAmG;IACnG,gGAAgG;IAChG,uCAAuC;IACvC,EAAE;IACF,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,+CAA+C;IAC/C,EAAE;IACF,mGAAmG;IACnG,oGAAoG;IACpG,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;CACvC,CAAC;AAEW,QAAA,eAAe,GAAsB,EAAE,CAAC","sourcesContent":["// Default holistic exclude list for the validate-ts-in-src\n// rules. Bare names match a directory segment at any depth; globs match the\n// workspace-relative path. `**/*.d.ts` (ambient declarations) and\n// `**/jest.config.ts` legitimately live outside src/ and are exempt here.\nconst DEFAULT_EXCLUDE_PATHS: readonly string[] = [\n    'node_modules', 'dist', '.nx', '.git',\n    '**/*.d.ts', '**/jest.config.ts',\n];\n\n// On/off is driven by `mode` (\"OFF\" disables; an absent mode leaves a rule\n// on). Code-rules entries omit `mode` so each executor keeps its own default\n// scope; structural rules declare `mode: 'RUN_EVERY_TIME'`, bash guards `mode: 'ON'`.\n// webpieces-disable no-any-unknown -- rule options are opaque at framework level\nexport const defaultRules: Record<string, Record<string, unknown>> = {\n    'no-any-unknown': {},\n    'no-implicit-any': {},\n    'max-file-lines': { limit: 900 },\n    'max-method-lines': { limit: 80 },\n    'require-return-type': {},\n    'no-inline-type-literals': {},\n    'no-destructure': { allowTopLevel: true },\n    'catch-error-pattern': {},\n    'no-unmanaged-exceptions': {},\n    'no-file-import-cycles': { mode: 'RUN_EVERY_TIME' },\n    'runtime-architecture': { mode: 'RUN_EVERY_TIME', allowedCycles: [] },\n    'prisma-validate-dtos': {},\n    'prisma-converter': {},\n    'angular-no-direct-api-in-resolver': {},\n    'no-symbol-di-tokens': {},\n    // Ships OFF: a repo opts in per webpieces.config.json once it is ready to migrate any\n    // client-in-a-lib sites (severity defaults to \"warn\" so even when enabled it reports without\n    // failing until a repo flips it to \"error\").\n    'no-client-creation-outside-server-or-client': { mode: 'OFF' },\n    'no-custom-css': { allowGlobs: [] },\n    // Ships ARMED, and diff-scoped. A template that restates a `.webpieces/` path ships that path into\n    // every governed repo as instruction, and the paths are per-worktree — so the default has to be the\n    // one that stops the NEXT one, not one a repo has to discover. NEW_AND_MODIFIED_CODE is what makes\n    // that safe: the docs whose subject IS the layout are untouched until somebody edits the line.\n    'no-state-paths-in-templates': { mode: 'NEW_AND_MODIFIED_CODE' },\n    'no-process-exit-outside-main': {},\n    'inject-annotation-not-needed-for-concrete-class': {},\n    'framework-tag': { mode: 'MODIFIED_PROJECTS', knownTypes: ['browser', 'react', 'angular', 'node', 'express'] },\n    'role-tag': { mode: 'MODIFIED_PROJECTS', knownTypes: ['server', 'app', 'designed-lib', 'lib', 'client', 'api-lib'] },\n    'nx-wiring': { mode: 'RUN_EVERY_TIME' },\n    'di-graph': { mode: 'RUN_EVERY_TIME' },\n    'missing-design-annotation': { mode: 'RUN_EVERY_TIME' },\n    'validate-ts-in-src': {\n        mode: 'NEW_AND_MODIFIED_FILES',\n        allowedRootFiles: ['jest.setup.ts'],\n        excludePaths: [...DEFAULT_EXCLUDE_PATHS],\n    },\n    'no-js-files': { mode: 'OFF' },\n    // The five Nx infrastructure validators. They enforced unconditionally before they were wired to\n    // config, so RUN_EVERY_TIME is the only default that keeps existing repos behaving identically on\n    // upgrade. Set \"mode\": \"OFF\" to disable one; the two graph-baseline rules\n    // (validate-architecture-unchanged / validate-no-architecture-cycles) additionally honor\n    // turnOffRuleUntilEpoch — the other three are all-or-nothing (see rule-configs.ts).\n    'validate-architecture-unchanged': { mode: 'RUN_EVERY_TIME' },\n    'validate-no-architecture-cycles': { mode: 'RUN_EVERY_TIME' },\n    'validate-packagejson': { mode: 'RUN_EVERY_TIME' },\n    'validate-versions-locked': { mode: 'RUN_EVERY_TIME' },\n    'validate-eslint-sync': { mode: 'RUN_EVERY_TIME' },\n    // autoReapMergedBranches ships TRUE, and it is also what a fresh config is seeded with.\n    //\n    // It shipped FALSE on the reasoning that an upgrade must never delete branches unattended before a\n    // human opts in. In practice that produced the opposite of safety: nobody opts in, dead branches\n    // pile up, and the pile is what makes a real branch hard to find. The reap is also NOT destructive\n    // in the way the old comment implied — BranchReaper deletes only provably-dead branches (a merged\n    // PR, a squash-merge backup of one, or no commits of their own), spares everything else for a\n    // human, and logs each deletion to the branch-mutation log (BranchMutationLog.branchMutationLogPath,\n    // which is per-worktree) with the pre-delete SHA\n    // and a ready-made `recover=` command. So the worst case is one paste to undo, which a human can\n    // resolve; the previous default's worst case was unbounded accumulation nobody ever cleaned.\n    //\n    // Set it false to keep reaping manual; `pnpm wp-cleanup` works either way.\n    'branch-creation-guard': {\n        mode: 'ON',\n        subBranchNaming: 'feature/<ticket>/<short-description>',\n        autoReapMergedBranches: true,\n    },\n    'pr-lifecycle-guard': { mode: 'ON' },\n    // NOTE: `whole-repo-build-guard` is deliberately ABSENT from this table, and from RULE_SCHEMAS and\n    // HOOK_GUARD_NAMES with it. It is EXPERIMENTAL and OFF by default; the ONLY thing that turns it on\n    // is `experimental.whole-repo-build-guard: true` in the optional machine-local\n    // ~/.webpieces/config.json. Adding it back here would make it a rule every consumer must CONFIGURE\n    // — which is fault Y, i.e. every Bash call blocked on upgrade, which is exactly what it did the\n    // first time. See RETIRED_CONFIG_KEYS.\n    //\n    // branch-state-guard ships ON, INCLUDING its Read-blocking half.\n    //\n    // Its predecessor `read-stale-guard` shipped OFF as a \"phase 1\" staged rollout, on the reasoning\n    // that Read is the highest-blast-radius tool there is and nobody should be armed before verifying\n    // the fail-open paths against their own git layout. Phase 1 is over: this repo has run it ON in\n    // production for releases, and the fail-open paths (branch undeterminable, cache absent, cache for\n    // another branch, offline, dirty tree on main) are each covered by tests. Keeping it OFF now buys\n    // nothing and costs the exact incident the guard exists for — a session spent reading a tree 18\n    // commits behind while the log read \"handled\".\n    //\n    // Nothing is armed behind anyone's back either way: every built-in requires an explicit entry (the\n    // config-sync check blocks until one exists), so a consumer states this mode themselves on upgrade.\n    'branch-state-guard': { mode: 'ON' },\n};\n\nexport const defaultRulesDir: readonly string[] = [];\n"]}
+{"version":3,"file":"default-rules.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/default-rules.ts"],"names":[],"mappings":";;;AAAA,2DAA2D;AAC3D,4EAA4E;AAC5E,kEAAkE;AAClE,0EAA0E;AAC1E,MAAM,qBAAqB,GAAsB;IAC7C,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IACrC,WAAW,EAAE,mBAAmB;CACnC,CAAC;AAEF,2EAA2E;AAC3E,6EAA6E;AAC7E,sFAAsF;AACtF,iFAAiF;AACpE,QAAA,YAAY,GAA4C;IACjE,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;IACrB,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;IAChC,kBAAkB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;IACjC,qBAAqB,EAAE,EAAE;IACzB,yBAAyB,EAAE,EAAE;IAC7B,gBAAgB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACzC,qBAAqB,EAAE,EAAE;IACzB,yBAAyB,EAAE,EAAE;IAC7B,uBAAuB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACnD,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAClD,sBAAsB,EAAE,EAAE;IAC1B,kBAAkB,EAAE,EAAE;IACtB,mCAAmC,EAAE,EAAE;IACvC,qBAAqB,EAAE,EAAE;IACzB,sFAAsF;IACtF,6FAA6F;IAC7F,6CAA6C;IAC7C,6CAA6C,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;IAC9D,eAAe,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;IACnC,mGAAmG;IACnG,oGAAoG;IACpG,mGAAmG;IACnG,+FAA+F;IAC/F,6BAA6B,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAChE,8BAA8B,EAAE,EAAE;IAClC,iDAAiD,EAAE,EAAE;IACrD,eAAe,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;IAC9G,UAAU,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE;IACpH,WAAW,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACvC,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACtC,2BAA2B,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACvD,oBAAoB,EAAE;QAClB,IAAI,EAAE,wBAAwB;QAC9B,gBAAgB,EAAE,CAAC,eAAe,CAAC;QACnC,YAAY,EAAE,CAAC,GAAG,qBAAqB,CAAC;KAC3C;IACD,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;IAC9B,iGAAiG;IACjG,kGAAkG;IAClG,0EAA0E;IAC1E,yFAAyF;IACzF,oFAAoF;IACpF,iCAAiC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7D,iCAAiC,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC7D,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAClD,0BAA0B,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACtD,sBAAsB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAClD,wFAAwF;IACxF,EAAE;IACF,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,kGAAkG;IAClG,8FAA8F;IAC9F,qGAAqG;IACrG,iDAAiD;IACjD,iGAAiG;IACjG,6FAA6F;IAC7F,EAAE;IACF,2EAA2E;IAC3E,uBAAuB,EAAE;QACrB,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,sCAAsC;QACvD,sBAAsB,EAAE,IAAI;KAC/B;IACD,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACpC,mGAAmG;IACnG,mGAAmG;IACnG,+EAA+E;IAC/E,mGAAmG;IACnG,gGAAgG;IAChG,uCAAuC;IACvC,EAAE;IACF,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,gGAAgG;IAChG,+CAA+C;IAC/C,EAAE;IACF,mGAAmG;IACnG,oGAAoG;IACpG,oBAAoB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;CACvC,CAAC;AAEW,QAAA,eAAe,GAAsB,EAAE,CAAC","sourcesContent":["// Default holistic exclude list for the validate-ts-in-src\n// rules. Bare names match a directory segment at any depth; globs match the\n// workspace-relative path. `**/*.d.ts` (ambient declarations) and\n// `**/jest.config.ts` legitimately live outside src/ and are exempt here.\nconst DEFAULT_EXCLUDE_PATHS: readonly string[] = [\n    'node_modules', 'dist', '.nx', '.git',\n    '**/*.d.ts', '**/jest.config.ts',\n];\n\n// On/off is driven by `mode` (\"OFF\" disables; an absent mode leaves a rule\n// on). Code-rules entries omit `mode` so each executor keeps its own default\n// scope; structural rules declare `mode: 'RUN_EVERY_TIME'`, bash guards `mode: 'ON'`.\n// webpieces-disable no-any-unknown -- rule options are opaque at framework level\nexport const defaultRules: Record<string, Record<string, unknown>> = {\n    'no-any-unknown': {},\n    'no-implicit-any': {},\n    'max-file-lines': { limit: 900 },\n    'max-method-lines': { limit: 80 },\n    'require-return-type': {},\n    'no-inline-type-literals': {},\n    'no-destructure': { allowTopLevel: true },\n    'catch-error-pattern': {},\n    'no-unmanaged-exceptions': {},\n    'no-file-import-cycles': { mode: 'RUN_EVERY_TIME' },\n    'runtime-architecture': { mode: 'RUN_EVERY_TIME' },\n    'prisma-validate-dtos': {},\n    'prisma-converter': {},\n    'angular-no-direct-api-in-resolver': {},\n    'no-symbol-di-tokens': {},\n    // Ships OFF: a repo opts in per webpieces.config.json once it is ready to migrate any\n    // client-in-a-lib sites (severity defaults to \"warn\" so even when enabled it reports without\n    // failing until a repo flips it to \"error\").\n    'no-client-creation-outside-server-or-client': { mode: 'OFF' },\n    'no-custom-css': { allowGlobs: [] },\n    // Ships ARMED, and diff-scoped. A template that restates a `.webpieces/` path ships that path into\n    // every governed repo as instruction, and the paths are per-worktree — so the default has to be the\n    // one that stops the NEXT one, not one a repo has to discover. NEW_AND_MODIFIED_CODE is what makes\n    // that safe: the docs whose subject IS the layout are untouched until somebody edits the line.\n    'no-state-paths-in-templates': { mode: 'NEW_AND_MODIFIED_CODE' },\n    'no-process-exit-outside-main': {},\n    'inject-annotation-not-needed-for-concrete-class': {},\n    'framework-tag': { mode: 'MODIFIED_PROJECTS', knownTypes: ['browser', 'react', 'angular', 'node', 'express'] },\n    'role-tag': { mode: 'MODIFIED_PROJECTS', knownTypes: ['server', 'app', 'designed-lib', 'lib', 'client', 'api-lib'] },\n    'nx-wiring': { mode: 'RUN_EVERY_TIME' },\n    'di-graph': { mode: 'RUN_EVERY_TIME' },\n    'missing-design-annotation': { mode: 'RUN_EVERY_TIME' },\n    'validate-ts-in-src': {\n        mode: 'NEW_AND_MODIFIED_FILES',\n        allowedRootFiles: ['jest.setup.ts'],\n        excludePaths: [...DEFAULT_EXCLUDE_PATHS],\n    },\n    'no-js-files': { mode: 'OFF' },\n    // The five Nx infrastructure validators. They enforced unconditionally before they were wired to\n    // config, so RUN_EVERY_TIME is the only default that keeps existing repos behaving identically on\n    // upgrade. Set \"mode\": \"OFF\" to disable one; the two graph-baseline rules\n    // (validate-architecture-unchanged / validate-no-architecture-cycles) additionally honor\n    // turnOffRuleUntilEpoch — the other three are all-or-nothing (see rule-configs.ts).\n    'validate-architecture-unchanged': { mode: 'RUN_EVERY_TIME' },\n    'validate-no-architecture-cycles': { mode: 'RUN_EVERY_TIME' },\n    'validate-packagejson': { mode: 'RUN_EVERY_TIME' },\n    'validate-versions-locked': { mode: 'RUN_EVERY_TIME' },\n    'validate-eslint-sync': { mode: 'RUN_EVERY_TIME' },\n    // autoReapMergedBranches ships TRUE, and it is also what a fresh config is seeded with.\n    //\n    // It shipped FALSE on the reasoning that an upgrade must never delete branches unattended before a\n    // human opts in. In practice that produced the opposite of safety: nobody opts in, dead branches\n    // pile up, and the pile is what makes a real branch hard to find. The reap is also NOT destructive\n    // in the way the old comment implied — BranchReaper deletes only provably-dead branches (a merged\n    // PR, a squash-merge backup of one, or no commits of their own), spares everything else for a\n    // human, and logs each deletion to the branch-mutation log (BranchMutationLog.branchMutationLogPath,\n    // which is per-worktree) with the pre-delete SHA\n    // and a ready-made `recover=` command. So the worst case is one paste to undo, which a human can\n    // resolve; the previous default's worst case was unbounded accumulation nobody ever cleaned.\n    //\n    // Set it false to keep reaping manual; `pnpm wp-cleanup` works either way.\n    'branch-creation-guard': {\n        mode: 'ON',\n        subBranchNaming: 'feature/<ticket>/<short-description>',\n        autoReapMergedBranches: true,\n    },\n    'pr-lifecycle-guard': { mode: 'ON' },\n    // NOTE: `whole-repo-build-guard` is deliberately ABSENT from this table, and from RULE_SCHEMAS and\n    // HOOK_GUARD_NAMES with it. It is EXPERIMENTAL and OFF by default; the ONLY thing that turns it on\n    // is `experimental.whole-repo-build-guard: true` in the optional machine-local\n    // ~/.webpieces/config.json. Adding it back here would make it a rule every consumer must CONFIGURE\n    // — which is fault Y, i.e. every Bash call blocked on upgrade, which is exactly what it did the\n    // first time. See RETIRED_CONFIG_KEYS.\n    //\n    // branch-state-guard ships ON, INCLUDING its Read-blocking half.\n    //\n    // Its predecessor `read-stale-guard` shipped OFF as a \"phase 1\" staged rollout, on the reasoning\n    // that Read is the highest-blast-radius tool there is and nobody should be armed before verifying\n    // the fail-open paths against their own git layout. Phase 1 is over: this repo has run it ON in\n    // production for releases, and the fail-open paths (branch undeterminable, cache absent, cache for\n    // another branch, offline, dirty tree on main) are each covered by tests. Keeping it OFF now buys\n    // nothing and costs the exact incident the guard exists for — a session spent reading a tree 18\n    // commits behind while the log read \"handled\".\n    //\n    // Nothing is armed behind anyone's back either way: every built-in requires an explicit entry (the\n    // config-sync check blocks until one exists), so a consumer states this mode themselves on upgrade.\n    'branch-state-guard': { mode: 'ON' },\n};\n\nexport const defaultRulesDir: readonly string[] = [];\n"]}

package/src/rule-configs.d.ts

@@ -201,7 +201,6 @@ export declare class NoFileImportCyclesConfig extends BaseRuleConfig {
 }
 export declare class RuntimeArchitectureConfig extends BaseRuleConfig {
     mode?: StructuralMode;
-    allowedCycles?: string[];
     /**
      * Draw a dashed terminal node for every contract a service calls that NOTHING in-repo
      * implements (firestore, gmail, ...) — the vendor systems the runtime graph otherwise stops one

package/src/rule-configs.js

@@ -431,7 +431,12 @@ class RuntimeArchitectureConfig extends BaseRuleConfig {
     // nx-webpieces-rules/src/lib/runtime-graph.ts), so any config still listing them (a hand-maintained
     // enumeration of api libs) now fails the unknown-field check in validateWebpiecesConfig. There is
     // nothing to enumerate — delete the keys.
-    allowedCycles;
+    // NOTE: `allowedCycles` was removed — a runtime cycle is no longer allowable at all. CD deploys
+    // services in dependency order and a cyclic architecture has no such order, so the runtime graph
+    // now THROWS while it is being levelled rather than emitting a flat, unlevellable diagram (see
+    // nx-webpieces-rules/src/lib/runtime-graph-levels.ts). A repo that genuinely cannot break a cycle
+    // yet declares it PER EDGE with a `cutLegacyCycle:<targetService>` nx tag on the CALLING project,
+    // which admits the debt in a place `grep -rn cutLegacyCycle` can enumerate. Delete the key.
     /**
      * Draw a dashed terminal node for every contract a service calls that NOTHING in-repo
      * implements (firestore, gmail, ...) — the vendor systems the runtime graph otherwise stops one
@@ -454,7 +459,6 @@ class RuntimeArchitectureConfig extends BaseRuleConfig {
     externalApiPaths;
     static SCHEMA = {
         mode: new field_def_1.FieldDef('string', exports.STRUCTURAL_MODES),
-        allowedCycles: field_def_1.FieldDef.optional('string[]'),
         showExternalNodes: field_def_1.FieldDef.optional('boolean'),
         externalApiPaths: field_def_1.FieldDef.optional('string[]'),
         ...exports.BASE_RULE_SCHEMA,

package/src/rule-configs.js.map

@@ -1 +1 @@
-{"version":3,"file":"rule-configs.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/rule-configs.ts"],"names":[],"mappings":";;;AAAA,2CAAoD;AAEpD,kFAAkF;AAClF,yFAAyF;AAEzF,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,qDAAqD;AACxC,QAAA,kBAAkB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG3G,QAAA,gBAAgB,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAU,CAAC;AAG9D,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG1G,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG1G,QAAA,mBAAmB,GAAG,CAAC,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,CAAU,CAAC;AAGvG,iGAAiG;AACjG,gGAAgG;AAChG,8EAA8E;AACjE,QAAA,aAAa,GAAG,CAAC,KAAK,EAAE,mBAAmB,CAAU,CAAC;AAGtD,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,CAAU,CAAC;AAGjF,QAAA,sBAAsB,GAAG,CAAC,KAAK,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAGhG,QAAA,yBAAyB,GAAG,CAAC,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG5H,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,uBAAuB,CAAU,CAAC;AAG9D,QAAA,YAAY,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAGnD,uFAAuF;AACvF,2FAA2F;AAC3F,+FAA+F;AAC/F,wDAAwD;AAC3C,QAAA,kBAAkB,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAU,CAAC;AAGjE,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAU,CAAC;AAG5E,gGAAgG;AAChG,kGAAkG;AAClG,gGAAgG;AAChG,uFAAuF;AAC1E,QAAA,gBAAgB,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAU,CAAC;AAGnE,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,oCAAoC;AACpC,oGAAoG;AACpG,sEAAsE;AACtE,2GAA2G;AAC3G,uGAAuG;AACvG,sGAAsG;AACtG,wGAAwG;AACxG,yGAAyG;AACzG,uGAAuG;AACvG,mDAAmD;AACnD,yGAAyG;AACzG,wGAAwG;AACxG,sGAAsG;AACtG,8EAA8E;AAC9E,MAAsB,cAAc;IAChC,0FAA0F;IAC1F,8FAA8F;IAC9F,+CAA+C;IAC/C,IAAI,CAAU;IACd,mGAAmG;IACnG,mEAAmE;IACnE,qBAAqB,CAAU;IAC/B,wBAAwB,CAAiB;CAC5C;AATD,wCASC;AAEY,QAAA,gBAAgB,GAAG;IAC5B,qBAAqB,EAAE,IAAI,oBAAQ,CAAC,QAAQ,CAAC;IAC7C,wBAAwB,EAAE,oBAAQ,CAAC,cAAc,EAAE;CACtD,CAAC;AAEF,MAAa,oBAAqB,SAAQ,cAAc;IAEpD,KAAK,CAAU;IACf,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAsC;QACxD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,0BAAkB,CAAC;QAChD,KAAK,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,oDAWC;AAED,MAAa,kBAAmB,SAAQ,cAAc;IAElD,KAAK,CAAU;IACf,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,KAAK,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,gDAWC;AAED,MAAa,uBAAwB,SAAQ,cAAc;IAEvD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAyC;QAC3D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,0DASC;AAED,MAAa,0BAA2B,SAAQ,cAAc;IAE1D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA4C;QAC9D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,gEASC;AAED,MAAa,kBAAmB,SAAQ,cAAc;IAElD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,gDASC;AAED,MAAa,mBAAoB,SAAQ,cAAc;IAEnD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAqC;QACvD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,kDASC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IACzB,gBAAgB,CAAU;IAC1B,cAAc,CAAY;IAE1B,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7C,GAAG,wBAAgB;KACtB,CAAC;;AAZN,4DAaC;AAED,MAAa,qBAAsB,SAAQ,cAAc;IAErD,cAAc,CAAW;IACzB,UAAU,CAAU;IACpB,eAAe,CAAY;IAC3B,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAuC;QACzD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,8BAAsB,CAAC;QACpD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAdN,sDAeC;AAED,kGAAkG;AAClG,qGAAqG;AACrG,mGAAmG;AACnG,gGAAgG;AAChG,MAAa,mBAAoB,SAAQ,cAAc;IAEnD,aAAa,CAAW;IACxB,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAqC;QACvD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAZN,kDAaC;AAED,MAAa,2BAA4B,SAAQ,cAAc;IAE3D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA6C;QAC/D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,kEASC;AAED,MAAa,uBAAwB,SAAQ,cAAc;IAEvD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAyC;QAC3D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,0DASC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,4DASC;AAED,MAAa,kCAAmC,SAAQ,cAAc;IAElE,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAoD;QACtE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,iCAAyB,CAAC;QACvD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,gFAWC;AAED,mGAAmG;AACnG,sGAAsG;AACtG,sGAAsG;AACtG,MAAa,iBAAkB,SAAQ,cAAc;IAEjD,cAAc,CAAW;IACzB,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAAmC;QACrD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AAVN,8CAWC;AAED,MAAa,sBAAuB,SAAQ,cAAc;IAEtD,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAwC;QAC1D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,wDAWC;AAED,oGAAoG;AACpG,iGAAiG;AACjG,6FAA6F;AAC7F,8FAA8F;AAC9F,MAAa,8BAA+B,SAAQ,cAAc;IAE9D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAgD;QAClE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,wEASC;AAED,qGAAqG;AACrG,6FAA6F;AAC7F,qGAAqG;AACrG,yGAAyG;AACzG,sGAAsG;AACtG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,8FAA8F;AAC9F,MAAa,4BAA6B,SAAQ,cAAc;IAE5D,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAA8C;QAChE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,oEAWC;AAED,kGAAkG;AAClG,uGAAuG;AACvG,sGAAsG;AACtG,sGAAsG;AACtG,uGAAuG;AACvG,oGAAoG;AACpG,wGAAwG;AACxG,oGAAoG;AACpG,wGAAwG;AACxG,qEAAqE;AACrE,MAAa,+CAAgD,SAAQ,cAAc;IAE/E,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAiE;QACnF,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,0GAWC;AAED,qFAAqF;AACrF,kGAAkG;AAClG,iGAAiG;AACjG,mGAAmG;AACnG,iGAAiG;AACjG,sGAAsG;AACtG,MAAa,kBAAmB,SAAQ,cAAc;IAElD,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,qBAAa,CAAC;QAC3C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AARN,gDASC;AAED,8EAA8E;AAC9E,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAClG,0FAA0F;AAC1F,kFAAkF;AAClF,MAAa,aAAc,SAAQ,cAAc;IAE7C,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAA+B;QACjD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,qBAAa,CAAC;QAC3C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AARN,sCASC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAEzD,6FAA6F;IAC7F,6EAA6E;IAC7E,eAAe,CAAU;IACzB,6FAA6F;IAC7F,4FAA4F;IAC5F,YAAY,CAAU;IACtB,kGAAkG;IAClG,+FAA+F;IAC/F,6FAA6F;IAC7F,qFAAqF;IACrF,gBAAgB,CAAU;IAC1B,4FAA4F;IAC5F,+FAA+F;IAC/F,8FAA8F;IAC9F,kFAAkF;IAClF,YAAY,CAAU;IACtB,yFAAyF;IACzF,mGAAmG;IACnG,4CAA4C;IAC5C,+FAA+F;IAC/F,2FAA2F;IAC3F,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,uBAAuB;IACvB,sBAAsB,CAAW;IAEjC,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,0BAAkB,CAAC;QAChD,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,sBAAsB,EAAE,IAAI,oBAAQ,CAAC,SAAS,CAAC;QAC/C,GAAG,wBAAgB;KACtB,CAAC;;AAxCN,8DAyCC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAa,sBAAuB,SAAQ,cAAc;IAGtD,MAAM,CAAU,MAAM,GAAwC;QAC1D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,oBAAY,CAAC;QAC1C,GAAG,wBAAgB;KACtB,CAAC;;AANN,wDAOC;AAED,sGAAsG;AACtG,mFAAmF;AACnF,qGAAqG;AACrG,oDAAoD;AACpD,sGAAsG;AACtG,2FAA2F;AAE3F,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IACzB,eAAe,CAAY;IAC3B,0FAA0F;IAC1F,kGAAkG;IAClG,6FAA6F;IAC7F,kGAAkG;IAClG,8FAA8F;IAC9F,yFAAyF;IACzF,oFAAoF;IACpF,aAAa,CAAY;IAEzB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAnBN,4DAoBC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAEzD,kGAAkG;IAClG,0FAA0F;IAC1F,oGAAoG;IACpG,kGAAkG;IAClG,0CAA0C;IAC1C,aAAa,CAAY;IACzB;;;;;OAKG;IACH,iBAAiB,CAAW;IAC5B;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAY;IAE5B,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5C,iBAAiB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/C,GAAG,wBAAgB;KACtB,CAAC;;AAnCN,8DAoCC;AAED,MAAa,cAAe,SAAQ,cAAc;IAG9C,MAAM,CAAU,MAAM,GAAgC;QAClD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,wCAOC;AAED,MAAa,aAAc,SAAQ,cAAc;IAK7C,MAAM,CAAU,MAAM,GAA+B;QACjD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AARN,sCASC;AAED,MAAa,6BAA8B,SAAQ,cAAc;IAK7D,MAAM,CAAU,MAAM,GAA+C;QACjE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AARN,sEASC;AAED,MAAa,eAAgB,SAAQ,cAAc;IAI/C,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAiC;QACnD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,0CAWC;AAED,8EAA8E;AAC9E,yFAAyF;AACzF,qGAAqG;AACrG,iGAAiG;AACjG,kGAAkG;AAClG,EAAE;AACF,qGAAqG;AACrG,wEAAwE;AACxE,sGAAsG;AACtG,iGAAiG;AACjG,qGAAqG;AACrG,uGAAuG;AACvG,yFAAyF;AACzF,8EAA8E;AAE9E,MAAa,mCAAoC,SAAQ,cAAc;IAGnE,MAAM,CAAU,MAAM,GAAqD;QACvE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,kFAOC;AAED,MAAa,kCAAmC,SAAQ,cAAc;IAGlE,MAAM,CAAU,MAAM,GAAoD;QACtE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,gFAOC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAGzD,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,8DAOC;AAED,MAAa,4BAA6B,SAAQ,cAAc;IAG5D,MAAM,CAAU,MAAM,GAA8C;QAChE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,oEAOC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAGxD,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,4DAOC;AAED,MAAa,qBAAsB,SAAQ,cAAc;IAErD,gBAAgB,CAAY;IAC5B,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAuC;QACzD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,sDAWC","sourcesContent":["import { FieldDef, SchemaShape } from './field-def';\n\n// Mode const arrays — TypeScript union types derived from them, and FieldDef enum\n// values reference the same array. Impossible for the type and runtime check to diverge.\n\n// Single source of truth for rule \"mode\" values. Exported so code-rules (and any other\n// consumer) imports these instead of re-declaring the same unions — a rename here ripples\n// everywhere at compile time. The FieldDef SCHEMA below references the same arrays, so the\n// type and the runtime validation can never diverge.\nexport const METHOD_LIMIT_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type MethodLimitMode = typeof METHOD_LIMIT_MODES[number];\n\nexport const FILE_LIMIT_MODES = ['OFF', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type FileLimitMode = typeof FILE_LIMIT_MODES[number];\n\nexport const RETURN_TYPE_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ReturnTypeMode = typeof RETURN_TYPE_MODES[number];\n\nexport const INLINE_TYPE_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type InlineTypeMode = typeof INLINE_TYPE_MODES[number];\n\nexport const MODIFIED_CODE_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ModifiedCodeMode = typeof MODIFIED_CODE_MODES[number];\n\n// PROJECT-level rules (e.g. framework-tag): the check is neither line- nor file-scoped — it runs\n// for a whole project when ANY file the project owns is touched. `MODIFIED_PROJECTS` names that\n// honestly (nx `affected` already narrows execution to the changed projects).\nexport const PROJECT_MODES = ['OFF', 'MODIFIED_PROJECTS'] as const;\nexport type ProjectMode = typeof PROJECT_MODES[number];\n\nexport const PRISMA_DTOS_MODES = ['OFF', 'MODIFIED_CLASS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type PrismaValidateDtosMode = typeof PRISMA_DTOS_MODES[number];\n\nexport const PRISMA_CONVERTER_MODES = ['OFF', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type PrismaConverterMode = typeof PRISMA_CONVERTER_MODES[number];\n\nexport const DIRECT_API_RESOLVER_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type DirectApiResolverMode = typeof DIRECT_API_RESOLVER_MODES[number];\n\nexport const THROW_CAUSE_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE'] as const;\nexport type ThrowCauseMode = typeof THROW_CAUSE_MODES[number];\n\nexport const ON_OFF_MODES = ['ON', 'OFF'] as const;\nexport type OnOffMode = typeof ON_OFF_MODES[number];\n\n// branch-creation-guard modes. ON_NO_SUBBRANCHES is the strict variant: it hard-blocks\n// creating a branch off any non-main branch (no sub-branch affordance), pointing the agent\n// back to `git checkout main && git pull && git checkout -b <branch>`. Temporarily overridable\n// via the universal turnOffRuleUntilEpoch escape hatch.\nexport const BRANCH_GUARD_MODES = ['ON', 'OFF', 'ON_NO_SUBBRANCHES'] as const;\nexport type BranchGuardMode = typeof BRANCH_GUARD_MODES[number];\n\nexport const VALIDATE_TS_MODES = ['OFF', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ValidateTsMode = typeof VALIDATE_TS_MODES[number];\n\n// Structural / whole-graph rules (import-cycle, runtime-architecture, nx-wiring). They can't be\n// scoped to changed lines/files — a cycle or wiring break can route through a project that wasn't\n// itself edited — so when active they run the FULL check every time (nx-affected already limits\n// them to affected projects externally). RUN_EVERY_TIME replaces the old, vaguer \"ON\".\nexport const STRUCTURAL_MODES = ['OFF', 'RUN_EVERY_TIME'] as const;\nexport type StructuralMode = typeof STRUCTURAL_MODES[number];\n\n// ---------------------------------------------------------------------------\n// Universal escape hatches — EVERY rule supports temporarily disabling itself\n// either while on a named git branch (turnOffRuleWhileOnBranch) or until an\n// epoch passes (turnOffRuleUntilEpoch). They live on a shared base class so the\n// fields (and their schema entries) are declared once instead of repeated per\n// rule. `mode` stays per-rule because its allowed values vary (ON/OFF vs\n// NEW_AND_MODIFIED_CODE vs NEW_AND_MODIFIED_METHODS, etc).\n//\n// BOTH fields are REQUIRED on every rule so both hatches are ALWAYS VISIBLE in the config — an AI\n// editing webpieces.config.json sees them on every rule and cannot miss that a rule can be time-boxed\n// or branch-scoped off. Convention:\n//   turnOffRuleUntilEpoch:    0 = rule active (epoch in the past); a future unix epoch IN SECONDS =\n//                             temporarily disabled until that moment.\n//   turnOffRuleWhileOnBranch: null = always on; a branch name = disabled while that branch is checked out.\n//                             The name is matched EXACTLY (===). Globs/wildcards are NOT supported and\n//                             must not be added: a pattern would switch a rule off on branches nobody\n//                             enumerated. It is also ignored (loudly — shouldSkipRule throws) on a pull\n//                             request from a FORK, where the branch name is the contributor's to choose.\n//                             Required-but-nullable so its \"unset\" state is present-and-visible (null)\n//                             rather than omitted.\n// The earlier spellings of these two fields were RENAMED to the names above and are no longer accepted —\n// the validator rejects them with a \"renamed to X\" hint. RENAMED_FIELD_ALIASES in validate-config.ts is\n// the ONE place in src/ a dead spelling may still be written (see escape-hatch-key-spelling.spec.ts).\n// ---------------------------------------------------------------------------\nexport abstract class BaseRuleConfig {\n    // `mode` is declared here (loosely typed) so the shared AbstractRule base can read it for\n    // on/off. Each concrete *Config narrows it to its own union (e.g. `mode?: ModifiedCodeMode`),\n    // which is an assignable (covariant) override.\n    mode?: string;\n    // TS-optional, but schema-REQUIRED (see BASE_RULE_SCHEMA) — same split as `mode`. Read directly by\n    // AbstractRule.shouldRun, RuleGate, and the code-rules validators.\n    turnOffRuleUntilEpoch?: number;\n    turnOffRuleWhileOnBranch?: string | null;\n}\n\nexport const BASE_RULE_SCHEMA = {\n    turnOffRuleUntilEpoch: new FieldDef('number'),\n    turnOffRuleWhileOnBranch: FieldDef.nullableString(),\n};\n\nexport class MaxMethodLinesConfig extends BaseRuleConfig {\n    declare mode?: MethodLimitMode;\n    limit?: number;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<MaxMethodLinesConfig> = {\n        mode: new FieldDef('string', METHOD_LIMIT_MODES),\n        limit: FieldDef.optional('number'),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class MaxFileLinesConfig extends BaseRuleConfig {\n    declare mode?: FileLimitMode;\n    limit?: number;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<MaxFileLinesConfig> = {\n        mode: new FieldDef('string', FILE_LIMIT_MODES),\n        limit: FieldDef.optional('number'),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class RequireReturnTypeConfig extends BaseRuleConfig {\n    declare mode?: ReturnTypeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<RequireReturnTypeConfig> = {\n        mode: new FieldDef('string', RETURN_TYPE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoInlineTypeLiteralsConfig extends BaseRuleConfig {\n    declare mode?: InlineTypeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoInlineTypeLiteralsConfig> = {\n        mode: new FieldDef('string', INLINE_TYPE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoAnyUnknownConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoAnyUnknownConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoImplicitAnyConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoImplicitAnyConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class PrismaValidateDtosConfig extends BaseRuleConfig {\n    declare mode?: PrismaValidateDtosMode;\n    disableAllowed?: boolean;\n    prismaSchemaPath?: string;\n    dtoSourcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<PrismaValidateDtosConfig> = {\n        mode: new FieldDef('string', PRISMA_DTOS_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        prismaSchemaPath: FieldDef.optional('string'),\n        dtoSourcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class PrismaConverterConfig extends BaseRuleConfig {\n    declare mode?: PrismaConverterMode;\n    disableAllowed?: boolean;\n    schemaPath?: string;\n    convertersPaths?: string[];\n    enforcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<PrismaConverterConfig> = {\n        mode: new FieldDef('string', PRISMA_CONVERTER_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        schemaPath: FieldDef.optional('string'),\n        convertersPaths: FieldDef.optional('string[]'),\n        enforcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// `allowedPaths` exempts whole file trees whose idioms are destructuring by construction (React /\n// React Native components and hooks — `const [x, setX] = useState()`, destructured props — framework\n// glue), matched with the shared glob/prefix/segment semantics of `isPathExcluded`. It is the ONLY\n// escape when `disableAllowed: false`, since that setting deliberately ignores inline disables.\nexport class NoDestructureConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    allowTopLevel?: boolean;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoDestructureConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        allowTopLevel: FieldDef.optional('boolean'),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoUnmanagedExceptionsConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoUnmanagedExceptionsConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class CatchErrorPatternConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<CatchErrorPatternConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ThrowCauseRequiredConfig extends BaseRuleConfig {\n    declare mode?: ThrowCauseMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<ThrowCauseRequiredConfig> = {\n        mode: new FieldDef('string', THROW_CAUSE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class AngularNoDirectApiInResolverConfig extends BaseRuleConfig {\n    declare mode?: DirectApiResolverMode;\n    disableAllowed?: boolean;\n    enforcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<AngularNoDirectApiInResolverConfig> = {\n        mode: new FieldDef('string', DIRECT_API_RESOLVER_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        enforcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Bans hand-written CSS in Angular sources (styles:/styleUrls:/styleUrl: in @Component, and inline\n// style=/[style.x]/[ngStyle] in templates) so teams style with Tailwind utility classes. `allowGlobs`\n// exempts paths WITHIN the Angular scope (e.g. a vendored Fuse kit copied verbatim with its own CSS).\nexport class NoCustomCssConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowGlobs?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoCustomCssConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowGlobs: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoSymbolDiTokensConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoSymbolDiTokensConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Flags `process.exit(...)` outside a main()/runMain wrapper (and `import { main }`) so a deep exit\n// can't silently kill a reused server/command. Gradual-rollout knobs via the standard base: mode\n// (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch, branch, and\n// disableAllowed for the inline `// webpieces-disable` escape at genuine terminal boundaries.\nexport class NoProcessExitOutsideMainConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoProcessExitOutsideMainConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Flags a function CREATED OUTSIDE A CLASS at module scope: a top-level `function foo()` declaration\n// or a top-level `const foo = () => {}` / `= function(){}`. The point is that webpieces DI +\n// @DocumentDesign only work when behavior lives in injectable classes — a module-scope function is a\n// dead-end the DI graph can't reach. Inline callbacks, nested functions inside methods, and non-function\n// top-level consts (objects, zod schemas, primitives) are NOT flagged. Standard rollout knobs via the\n// base: mode (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch, branch,\n// and disableAllowed for the inline `// webpieces-disable` escape. `allowedPaths` exempts whole file\n// trees that legitimately live outside the class-per-behavior model (e.g. React component/hook files,\n// framework glue), matched with the shared glob/prefix/segment semantics of `isPathExcluded`.\nexport class NoFunctionOutsideClassConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoFunctionOutsideClassConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// inject-annotation-not-needed-for-concrete-class — flags a REDUNDANT `@inject(X)` whose token is\n// textually identical to the parameter's own declared type (`@inject(Foo) private readonly foo: Foo`).\n// In this inversify setup the decorator is pure noise there: reflect-metadata (emitDecoratorMetadata)\n// already resolves a constructor parameter by its class type, so `private readonly foo: Foo` binds on\n// its own (see CLAUDE.md, and the no-symbol-di-tokens rule that pushes the same way). Symbol/interface\n// tokens are NOT flagged because they never equal the type (`@inject(FOO_TOKEN) x: Provider<Foo>`).\n// AI keeps carpet-bombing `@inject`; this fails the build on the redundant form. Standard rollout knobs\n// via the base: mode (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch,\n// branch, and disableAllowed for the inline `// webpieces-disable` escape. `allowedPaths` exempts whole\n// file trees, matched with the shared glob/prefix/segment semantics.\nexport class InjectAnnotationNotNeededForConcreteClassConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<InjectAnnotationNotNeededForConcreteClassConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// framework-tag — every project that a changed source file belongs to must carry >=1\n// `framework:<browser|react|angular|node|express>` nx tag in its project.json. Those tags are the\n// project's \"libType\" — the SET of runtime environments it runs in — and the source of truth for\n// the dependencies.json `framework` field and the `library-types-match-client` rule. Multiple tags\n// are allowed (the env set) and values are validated against the known set (`framework:all` is a\n// hard error). `knownTypes` customizes that set (defaults to browser, react, angular, node, express).\nexport class FrameworkTagConfig extends BaseRuleConfig {\n    declare mode?: ProjectMode;\n    knownTypes?: string[];\n\n    static readonly SCHEMA: SchemaShape<FrameworkTagConfig> = {\n        mode: new FieldDef('string', PROJECT_MODES),\n        knownTypes: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// role-tag — every project that a changed source file belongs to must carry a\n// `role:<server|designed-lib|lib|client>` nx tag in its project.json. That tag is the project's\n// ROLE (orthogonal to `framework` libType) — the source of truth for the dependencies.json `role`\n// field, the `role-dependency` edge rule (apps are never depended upon), and DI-design generation\n// (server→@Controller, designed-lib→@ApiImplementation, lib→none, client→angular design).\n// `knownTypes` customizes the list suggested to the author when a tag is missing.\nexport class RoleTagConfig extends BaseRuleConfig {\n    declare mode?: ProjectMode;\n    knownTypes?: string[];\n\n    static readonly SCHEMA: SchemaShape<RoleTagConfig> = {\n        mode: new FieldDef('string', PROJECT_MODES),\n        knownTypes: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class BranchCreationGuardConfig extends BaseRuleConfig {\n    declare mode?: BranchGuardMode;\n    // Naming pattern for stacked SUB-branches only (branches created off another feature branch,\n    // which require human approval). Never applied to branches created off main.\n    subBranchNaming?: string;\n    // Human-sentence instruction telling the AI how to name a NEW branch off main. Surfaced back\n    // to the agent in the guard's fix hints. May mirror no-edit-on-main.branchNamingConvention.\n    branchFormat?: string;\n    // Hard cap on local feature branches (excluding main). Creating one past the cap is BLOCKED until\n    // already-merged branches are reaped, which is what keeps the branch list from growing without\n    // bound. Branch creation is the gate because it is the only moment cleanup is both cheap and\n    // obviously worth it. See merged-branches.ts for how \"already merged\" is determined.\n    maxLocalBranches?: number;\n    // Hard cap on LINKED worktrees (the primary clone is never counted). A separate budget from\n    // maxLocalBranches: every worktree holds a branch, so if worktree-held branches also spent the\n    // branch budget, five worktrees would leave room for zero branches. Held branches count here;\n    // parked branches count against maxLocalBranches. Enforced at `git worktree add`.\n    maxWorktrees?: number;\n    // Let the detached background refresher DELETE dead branches on its own, instead of only\n    // reporting them. Every candidate is provably dead (a MERGED PR — its own, or the PR of the branch\n    // it snapshots; nothing else qualifies) and\n    // recoverable by the SHA logged to branch-mutations.log — but it is still UNATTENDED deletion,\n    // so this is schema-REQUIRED like `mode` and `turnOffRuleUntilEpoch`. \"Every built-in rule\n    // must be explicitly configured — no silent defaults\" (validate-config.ts) applies with extra\n    // force here: branches disappearing on a preference nobody ever stated is precisely the kind of\n    // default that must not exist. Validation makes each consumer answer the question once.\n    //\n    // TS-optional but schema-required — the same split `mode` uses. Absent at RUNTIME therefore means\n    // the config never passed validation, and the only safe reading of \"nobody has answered\" is: do\n    // not delete anything.\n    autoReapMergedBranches?: boolean;\n\n    static readonly SCHEMA: SchemaShape<BranchCreationGuardConfig> = {\n        mode: new FieldDef('string', BRANCH_GUARD_MODES),\n        subBranchNaming: FieldDef.optional('string'),\n        branchFormat: FieldDef.optional('string'),\n        maxLocalBranches: FieldDef.optional('number'),\n        maxWorktrees: FieldDef.optional('number'),\n        autoReapMergedBranches: new FieldDef('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n/**\n * `pr-lifecycle-guard` — ONE key, ONE policy: *PRs and merges go through the gated flow.*\n *\n * Four CLASSES implement it, and their names are unchanged (they are the operator identity every\n * decision-log line and every deny report carries):\n *\n *   pr-creation-or-push-guard  a manual `git push` / `gh pr create|edit` / a raw pulls API call\n *   merge-in-progress-guard    a PR command while a 3-point merge is half-finished\n *   pr-merge-guard             a bare `gh pr merge`\n *   redirect-how-to-merge-main \"how do I get main into my branch?\" → the documented flow\n *\n * ## Say this out loud: `\"mode\": \"OFF\"` releases the unvalidated-merge gate too\n *\n * Three of the four are pure COMMAND-SHAPE blocks and can never fire spuriously. The fourth,\n * merge-in-progress-guard, is STATE-conditional — it fires only while a 3-point merge is actually in\n * progress, and it is the one state L2 explicitly stands down for. So turning this key OFF to unblock\n * `gh pr merge` ALSO drops the \"you have an unfinished merge\" gate. That is the honest cost of one key\n * per policy, and it is stated here, in guards/L4-pr-lifecycle.md, and in the error path, rather than\n * being papered over with a granular sub-mode (which would be four knobs wearing one key's name).\n *\n * ## The command strings are NOT here\n *\n * `upsertPrCommand` and `mergeCompleteCommand` used to sit on the two guards, and — being read at the\n * point of use — they BEAT `commands.guardHints`, so `guardHintsWhy`'s claim that renaming a gated\n * command there makes \"every guard message follow\" was simply false. They are DELETED, not deprecated.\n * `commands.guardHints.prCreationOrPush` / `.mergeInProgress` is the one place those strings live, and\n * the loader hands the resolved values to the two rules directly. A consumer that still sets the old\n * per-guard field gets a RETIRED_FIELD_HINTS error naming the destination.\n */\nexport class PrLifecycleGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n\n    static readonly SCHEMA: SchemaShape<PrLifecycleGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// NOTE: there is deliberately no `WholeRepoBuildGuardConfig`. That guard has NO webpieces.config.json\n// entry — it is EXPERIMENTAL and OFF by default, and its only switch is the OPT-IN\n// `experimental.whole-repo-build-guard: true` in the optional machine-local ~/.webpieces/config.json\n// (see home-config.ts). The build command it prints\n// is handed to it directly from `commands.pr-gate.buildCommand` by ai-hook-rules' runner. Re-adding a\n// config class here puts the guard back in RULE_SCHEMAS and makes it a fault-Y rule again.\n\nexport class NoFileImportCyclesConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    ignoreTypeOnly?: boolean;\n    excludePackages?: string[];\n    // Raw regex escape hatch for a cycle inside the project being checked — generated code, a\n    // vendored tree, or a deliberate bidirectional domain model — that `excludePackages` cannot reach\n    // (it resolves npm package NAMES, so it only excludes a *sibling* package, never a directory\n    // inside this one). Patterns are handed to madge verbatim and matched against ids RELATIVE TO THE\n    // PROJECT (e.g. \"^src/generated/\", \"^src/modules/(item|category)/\") — NOT workspace-rooted or\n    // absolute, which silently match nothing. The executor warns when a pattern matches zero\n    // traversed files, so a mis-anchored pattern is visible rather than a silent no-op.\n    excludeRegExp?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoFileImportCyclesConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ignoreTypeOnly: FieldDef.optional('boolean'),\n        excludePackages: FieldDef.optional('string[]'),\n        excludeRegExp: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class RuntimeArchitectureConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    // NOTE: `servicePaths` / `apiProjectPaths` were removed — they were never read. The runtime graph\n    // is derived SOLELY from architecture/dependencies.json apiRelations + project roles (see\n    // nx-webpieces-rules/src/lib/runtime-graph.ts), so any config still listing them (a hand-maintained\n    // enumeration of api libs) now fails the unknown-field check in validateWebpiecesConfig. There is\n    // nothing to enumerate — delete the keys.\n    allowedCycles?: string[];\n    /**\n     * Draw a dashed terminal node for every contract a service calls that NOTHING in-repo\n     * implements (firestore, gmail, ...) — the vendor systems the runtime graph otherwise stops one\n     * hop short of. Defaults to true; set false in a repo whose external surface is noisy. Purely a\n     * RENDER switch: levels, cycle detection and runtime-dependencies.json are identical either way.\n     */\n    showExternalNodes?: boolean;\n    /**\n     * Project roots whose exported `*Api` types are contracts for systems OUTSIDE this repo\n     * (firestore, gmail, gcp-storage, ...), e.g. `[\"libraries/apis/external/**\"]`. Globs, matched\n     * against the nx project root.\n     *\n     * Needed because an external contract does NOT look like an in-repo one: it is a plain\n     * `interface` bound to a Symbol token and injected, never an `abstract class` carrying @ApiPath\n     * reached through `createRpcClient`. Without this list the scanner has no way to tell a vendor\n     * seam from any other library, so every call leaving the repo is invisible to the runtime graph.\n     *\n     * Defaults to none, which is correct for a repo with no vendor wrapper libraries.\n     */\n    externalApiPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<RuntimeArchitectureConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        allowedCycles: FieldDef.optional('string[]'),\n        showExternalNodes: FieldDef.optional('boolean'),\n        externalApiPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NxWiringConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<NxWiringConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class DiGraphConfig extends BaseRuleConfig {\n    // Structural: the DI graph is regenerated whole-project on every build (generate +\n    // unchanged gate), so it cannot be scoped to changed lines.\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<DiGraphConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class MissingDesignAnnotationConfig extends BaseRuleConfig {\n    // Structural: enforced per-project by the di-graph-generate executor, which\n    // roots the whole DI design on @DocumentDesign classes — cannot be line-scoped.\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<MissingDesignAnnotationConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoJsFilesConfig extends BaseRuleConfig {\n    // File-tier: NEW_AND_MODIFIED_FILES (active) intercepts a .js/.jsx Write — the file being\n    // written is inherently a new/modified file, so it's already diff-scoped in practice.\n    declare mode?: FileLimitMode;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoJsFilesConfig> = {\n        mode: new FieldDef('string', FILE_LIMIT_MODES),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// ---------------------------------------------------------------------------\n// The five Nx infrastructure validators (architecture-unchanged, no-architecture-cycles,\n// packagejson, versions-locked, eslint-sync). Each is whole-graph / whole-repo by nature (a cycle, a\n// drifted dependencies.json, an unlocked version can be introduced by a file nobody in this diff\n// touched), so the only honest mode set is STRUCTURAL_MODES: RUN_EVERY_TIME (the default) or OFF.\n//\n// All five now honor the universal escape hatches (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch)\n// via shouldSkipRule — the RuleGate is called with honorEpoch:true from\n// every executor. This lets a repo time-box or branch-scope a failing infrastructure check (e.g. hold\n// validate-packagejson off until an upgrade PR lands) with a one-value edit, instead of only the\n// blunt \"mode\": \"OFF\". Originally packagejson/versions-locked/eslint-sync were all-or-nothing on the\n// theory that \"no blessed baseline\" made grandfathering meaningless, but a time-box is a schedule, not\n// a baseline: \"do not enforce this until <epoch>/off <branch>\" is coherent for any rule.\n// ---------------------------------------------------------------------------\n\nexport class ValidateArchitectureUnchangedConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateArchitectureUnchangedConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateNoArchitectureCyclesConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateNoArchitectureCyclesConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidatePackageJsonConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidatePackageJsonConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateVersionsLockedConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateVersionsLockedConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateEslintSyncConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateEslintSyncConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateTsInSrcConfig extends BaseRuleConfig {\n    declare mode?: ValidateTsMode;\n    allowedRootFiles?: string[];\n    excludePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<ValidateTsInSrcConfig> = {\n        mode: new FieldDef('string', VALIDATE_TS_MODES),\n        allowedRootFiles: FieldDef.optional('string[]'),\n        excludePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n"]}
+{"version":3,"file":"rule-configs.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/rule-configs.ts"],"names":[],"mappings":";;;AAAA,2CAAoD;AAEpD,kFAAkF;AAClF,yFAAyF;AAEzF,uFAAuF;AACvF,0FAA0F;AAC1F,2FAA2F;AAC3F,qDAAqD;AACxC,QAAA,kBAAkB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG3G,QAAA,gBAAgB,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAU,CAAC;AAG9D,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG1G,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG1G,QAAA,mBAAmB,GAAG,CAAC,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,CAAU,CAAC;AAGvG,iGAAiG;AACjG,gGAAgG;AAChG,8EAA8E;AACjE,QAAA,aAAa,GAAG,CAAC,KAAK,EAAE,mBAAmB,CAAU,CAAC;AAGtD,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,gBAAgB,EAAE,wBAAwB,CAAU,CAAC;AAGjF,QAAA,sBAAsB,GAAG,CAAC,KAAK,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAGhG,QAAA,yBAAyB,GAAG,CAAC,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,wBAAwB,CAAU,CAAC;AAG5H,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,uBAAuB,CAAU,CAAC;AAG9D,QAAA,YAAY,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAGnD,uFAAuF;AACvF,2FAA2F;AAC3F,+FAA+F;AAC/F,wDAAwD;AAC3C,QAAA,kBAAkB,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAU,CAAC;AAGjE,QAAA,iBAAiB,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAU,CAAC;AAG5E,gGAAgG;AAChG,kGAAkG;AAClG,gGAAgG;AAChG,uFAAuF;AAC1E,QAAA,gBAAgB,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAU,CAAC;AAGnE,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,yEAAyE;AACzE,2DAA2D;AAC3D,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,oCAAoC;AACpC,oGAAoG;AACpG,sEAAsE;AACtE,2GAA2G;AAC3G,uGAAuG;AACvG,sGAAsG;AACtG,wGAAwG;AACxG,yGAAyG;AACzG,uGAAuG;AACvG,mDAAmD;AACnD,yGAAyG;AACzG,wGAAwG;AACxG,sGAAsG;AACtG,8EAA8E;AAC9E,MAAsB,cAAc;IAChC,0FAA0F;IAC1F,8FAA8F;IAC9F,+CAA+C;IAC/C,IAAI,CAAU;IACd,mGAAmG;IACnG,mEAAmE;IACnE,qBAAqB,CAAU;IAC/B,wBAAwB,CAAiB;CAC5C;AATD,wCASC;AAEY,QAAA,gBAAgB,GAAG;IAC5B,qBAAqB,EAAE,IAAI,oBAAQ,CAAC,QAAQ,CAAC;IAC7C,wBAAwB,EAAE,oBAAQ,CAAC,cAAc,EAAE;CACtD,CAAC;AAEF,MAAa,oBAAqB,SAAQ,cAAc;IAEpD,KAAK,CAAU;IACf,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAsC;QACxD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,0BAAkB,CAAC;QAChD,KAAK,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,oDAWC;AAED,MAAa,kBAAmB,SAAQ,cAAc;IAElD,KAAK,CAAU;IACf,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,KAAK,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClC,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,gDAWC;AAED,MAAa,uBAAwB,SAAQ,cAAc;IAEvD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAyC;QAC3D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,0DASC;AAED,MAAa,0BAA2B,SAAQ,cAAc;IAE1D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA4C;QAC9D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,gEASC;AAED,MAAa,kBAAmB,SAAQ,cAAc;IAElD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,gDASC;AAED,MAAa,mBAAoB,SAAQ,cAAc;IAEnD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAqC;QACvD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,kDASC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IACzB,gBAAgB,CAAU;IAC1B,cAAc,CAAY;IAE1B,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC7C,GAAG,wBAAgB;KACtB,CAAC;;AAZN,4DAaC;AAED,MAAa,qBAAsB,SAAQ,cAAc;IAErD,cAAc,CAAW;IACzB,UAAU,CAAU;IACpB,eAAe,CAAY;IAC3B,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAuC;QACzD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,8BAAsB,CAAC;QACpD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAdN,sDAeC;AAED,kGAAkG;AAClG,qGAAqG;AACrG,mGAAmG;AACnG,gGAAgG;AAChG,MAAa,mBAAoB,SAAQ,cAAc;IAEnD,aAAa,CAAW;IACxB,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAqC;QACvD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAZN,kDAaC;AAED,MAAa,2BAA4B,SAAQ,cAAc;IAE3D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA6C;QAC/D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,kEASC;AAED,MAAa,uBAAwB,SAAQ,cAAc;IAEvD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAyC;QAC3D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,0DASC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,4DASC;AAED,MAAa,kCAAmC,SAAQ,cAAc;IAElE,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAoD;QACtE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,iCAAyB,CAAC;QACvD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,gFAWC;AAED,mGAAmG;AACnG,sGAAsG;AACtG,sGAAsG;AACtG,MAAa,iBAAkB,SAAQ,cAAc;IAEjD,cAAc,CAAW;IACzB,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAAmC;QACrD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AAVN,8CAWC;AAED,MAAa,sBAAuB,SAAQ,cAAc;IAEtD,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAwC;QAC1D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,wDAWC;AAED,oGAAoG;AACpG,iGAAiG;AACjG,6FAA6F;AAC7F,8FAA8F;AAC9F,MAAa,8BAA+B,SAAQ,cAAc;IAE9D,cAAc,CAAW;IAEzB,MAAM,CAAU,MAAM,GAAgD;QAClE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AARN,wEASC;AAED,qGAAqG;AACrG,6FAA6F;AAC7F,qGAAqG;AACrG,yGAAyG;AACzG,sGAAsG;AACtG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,8FAA8F;AAC9F,MAAa,4BAA6B,SAAQ,cAAc;IAE5D,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAA8C;QAChE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,oEAWC;AAED,kGAAkG;AAClG,uGAAuG;AACvG,sGAAsG;AACtG,sGAAsG;AACtG,uGAAuG;AACvG,oGAAoG;AACpG,wGAAwG;AACxG,oGAAoG;AACpG,wGAAwG;AACxG,qEAAqE;AACrE,MAAa,+CAAgD,SAAQ,cAAc;IAE/E,cAAc,CAAW;IACzB,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAiE;QACnF,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAmB,CAAC;QACjD,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,0GAWC;AAED,qFAAqF;AACrF,kGAAkG;AAClG,iGAAiG;AACjG,mGAAmG;AACnG,iGAAiG;AACjG,sGAAsG;AACtG,MAAa,kBAAmB,SAAQ,cAAc;IAElD,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAAoC;QACtD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,qBAAa,CAAC;QAC3C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AARN,gDASC;AAED,8EAA8E;AAC9E,gGAAgG;AAChG,kGAAkG;AAClG,kGAAkG;AAClG,0FAA0F;AAC1F,kFAAkF;AAClF,MAAa,aAAc,SAAQ,cAAc;IAE7C,UAAU,CAAY;IAEtB,MAAM,CAAU,MAAM,GAA+B;QACjD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,qBAAa,CAAC;QAC3C,UAAU,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzC,GAAG,wBAAgB;KACtB,CAAC;;AARN,sCASC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAEzD,6FAA6F;IAC7F,6EAA6E;IAC7E,eAAe,CAAU;IACzB,6FAA6F;IAC7F,4FAA4F;IAC5F,YAAY,CAAU;IACtB,kGAAkG;IAClG,+FAA+F;IAC/F,6FAA6F;IAC7F,qFAAqF;IACrF,gBAAgB,CAAU;IAC1B,4FAA4F;IAC5F,+FAA+F;IAC/F,8FAA8F;IAC9F,kFAAkF;IAClF,YAAY,CAAU;IACtB,yFAAyF;IACzF,mGAAmG;IACnG,4CAA4C;IAC5C,+FAA+F;IAC/F,2FAA2F;IAC3F,8FAA8F;IAC9F,gGAAgG;IAChG,wFAAwF;IACxF,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,uBAAuB;IACvB,sBAAsB,CAAW;IAEjC,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,0BAAkB,CAAC;QAChD,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzC,sBAAsB,EAAE,IAAI,oBAAQ,CAAC,SAAS,CAAC;QAC/C,GAAG,wBAAgB;KACtB,CAAC;;AAxCN,8DAyCC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAa,sBAAuB,SAAQ,cAAc;IAGtD,MAAM,CAAU,MAAM,GAAwC;QAC1D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,oBAAY,CAAC;QAC1C,GAAG,wBAAgB;KACtB,CAAC;;AANN,wDAOC;AAED,sGAAsG;AACtG,mFAAmF;AACnF,qGAAqG;AACrG,oDAAoD;AACpD,sGAAsG;AACtG,2FAA2F;AAE3F,MAAa,wBAAyB,SAAQ,cAAc;IAExD,cAAc,CAAW;IACzB,eAAe,CAAY;IAC3B,0FAA0F;IAC1F,kGAAkG;IAClG,6FAA6F;IAC7F,kGAAkG;IAClG,8FAA8F;IAC9F,yFAAyF;IACzF,oFAAoF;IACpF,aAAa,CAAY;IAEzB,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,cAAc,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,eAAe,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,aAAa,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5C,GAAG,wBAAgB;KACtB,CAAC;;AAnBN,4DAoBC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAEzD,kGAAkG;IAClG,0FAA0F;IAC1F,oGAAoG;IACpG,kGAAkG;IAClG,0CAA0C;IAC1C,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,kGAAkG;IAClG,4FAA4F;IAC5F;;;;;OAKG;IACH,iBAAiB,CAAW;IAC5B;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAY;IAE5B,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,iBAAiB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/C,GAAG,wBAAgB;KACtB,CAAC;;AAvCN,8DAwCC;AAED,MAAa,cAAe,SAAQ,cAAc;IAG9C,MAAM,CAAU,MAAM,GAAgC;QAClD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,wCAOC;AAED,MAAa,aAAc,SAAQ,cAAc;IAK7C,MAAM,CAAU,MAAM,GAA+B;QACjD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AARN,sCASC;AAED,MAAa,6BAA8B,SAAQ,cAAc;IAK7D,MAAM,CAAU,MAAM,GAA+C;QACjE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AARN,sEASC;AAED,MAAa,eAAgB,SAAQ,cAAc;IAI/C,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAiC;QACnD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,0CAWC;AAED,8EAA8E;AAC9E,yFAAyF;AACzF,qGAAqG;AACrG,iGAAiG;AACjG,kGAAkG;AAClG,EAAE;AACF,qGAAqG;AACrG,wEAAwE;AACxE,sGAAsG;AACtG,iGAAiG;AACjG,qGAAqG;AACrG,uGAAuG;AACvG,yFAAyF;AACzF,8EAA8E;AAE9E,MAAa,mCAAoC,SAAQ,cAAc;IAGnE,MAAM,CAAU,MAAM,GAAqD;QACvE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,kFAOC;AAED,MAAa,kCAAmC,SAAQ,cAAc;IAGlE,MAAM,CAAU,MAAM,GAAoD;QACtE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,gFAOC;AAED,MAAa,yBAA0B,SAAQ,cAAc;IAGzD,MAAM,CAAU,MAAM,GAA2C;QAC7D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,8DAOC;AAED,MAAa,4BAA6B,SAAQ,cAAc;IAG5D,MAAM,CAAU,MAAM,GAA8C;QAChE,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,oEAOC;AAED,MAAa,wBAAyB,SAAQ,cAAc;IAGxD,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,wBAAgB,CAAC;QAC9C,GAAG,wBAAgB;KACtB,CAAC;;AANN,4DAOC;AAED,MAAa,qBAAsB,SAAQ,cAAc;IAErD,gBAAgB,CAAY;IAC5B,YAAY,CAAY;IAExB,MAAM,CAAU,MAAM,GAAuC;QACzD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,yBAAiB,CAAC;QAC/C,gBAAgB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC/C,YAAY,EAAE,oBAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC3C,GAAG,wBAAgB;KACtB,CAAC;;AAVN,sDAWC","sourcesContent":["import { FieldDef, SchemaShape } from './field-def';\n\n// Mode const arrays — TypeScript union types derived from them, and FieldDef enum\n// values reference the same array. Impossible for the type and runtime check to diverge.\n\n// Single source of truth for rule \"mode\" values. Exported so code-rules (and any other\n// consumer) imports these instead of re-declaring the same unions — a rename here ripples\n// everywhere at compile time. The FieldDef SCHEMA below references the same arrays, so the\n// type and the runtime validation can never diverge.\nexport const METHOD_LIMIT_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type MethodLimitMode = typeof METHOD_LIMIT_MODES[number];\n\nexport const FILE_LIMIT_MODES = ['OFF', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type FileLimitMode = typeof FILE_LIMIT_MODES[number];\n\nexport const RETURN_TYPE_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ReturnTypeMode = typeof RETURN_TYPE_MODES[number];\n\nexport const INLINE_TYPE_MODES = ['OFF', 'NEW_METHODS', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type InlineTypeMode = typeof INLINE_TYPE_MODES[number];\n\nexport const MODIFIED_CODE_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ModifiedCodeMode = typeof MODIFIED_CODE_MODES[number];\n\n// PROJECT-level rules (e.g. framework-tag): the check is neither line- nor file-scoped — it runs\n// for a whole project when ANY file the project owns is touched. `MODIFIED_PROJECTS` names that\n// honestly (nx `affected` already narrows execution to the changed projects).\nexport const PROJECT_MODES = ['OFF', 'MODIFIED_PROJECTS'] as const;\nexport type ProjectMode = typeof PROJECT_MODES[number];\n\nexport const PRISMA_DTOS_MODES = ['OFF', 'MODIFIED_CLASS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type PrismaValidateDtosMode = typeof PRISMA_DTOS_MODES[number];\n\nexport const PRISMA_CONVERTER_MODES = ['OFF', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type PrismaConverterMode = typeof PRISMA_CONVERTER_MODES[number];\n\nexport const DIRECT_API_RESOLVER_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE', 'NEW_AND_MODIFIED_METHODS', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type DirectApiResolverMode = typeof DIRECT_API_RESOLVER_MODES[number];\n\nexport const THROW_CAUSE_MODES = ['OFF', 'NEW_AND_MODIFIED_CODE'] as const;\nexport type ThrowCauseMode = typeof THROW_CAUSE_MODES[number];\n\nexport const ON_OFF_MODES = ['ON', 'OFF'] as const;\nexport type OnOffMode = typeof ON_OFF_MODES[number];\n\n// branch-creation-guard modes. ON_NO_SUBBRANCHES is the strict variant: it hard-blocks\n// creating a branch off any non-main branch (no sub-branch affordance), pointing the agent\n// back to `git checkout main && git pull && git checkout -b <branch>`. Temporarily overridable\n// via the universal turnOffRuleUntilEpoch escape hatch.\nexport const BRANCH_GUARD_MODES = ['ON', 'OFF', 'ON_NO_SUBBRANCHES'] as const;\nexport type BranchGuardMode = typeof BRANCH_GUARD_MODES[number];\n\nexport const VALIDATE_TS_MODES = ['OFF', 'NEW_AND_MODIFIED_FILES'] as const;\nexport type ValidateTsMode = typeof VALIDATE_TS_MODES[number];\n\n// Structural / whole-graph rules (import-cycle, runtime-architecture, nx-wiring). They can't be\n// scoped to changed lines/files — a cycle or wiring break can route through a project that wasn't\n// itself edited — so when active they run the FULL check every time (nx-affected already limits\n// them to affected projects externally). RUN_EVERY_TIME replaces the old, vaguer \"ON\".\nexport const STRUCTURAL_MODES = ['OFF', 'RUN_EVERY_TIME'] as const;\nexport type StructuralMode = typeof STRUCTURAL_MODES[number];\n\n// ---------------------------------------------------------------------------\n// Universal escape hatches — EVERY rule supports temporarily disabling itself\n// either while on a named git branch (turnOffRuleWhileOnBranch) or until an\n// epoch passes (turnOffRuleUntilEpoch). They live on a shared base class so the\n// fields (and their schema entries) are declared once instead of repeated per\n// rule. `mode` stays per-rule because its allowed values vary (ON/OFF vs\n// NEW_AND_MODIFIED_CODE vs NEW_AND_MODIFIED_METHODS, etc).\n//\n// BOTH fields are REQUIRED on every rule so both hatches are ALWAYS VISIBLE in the config — an AI\n// editing webpieces.config.json sees them on every rule and cannot miss that a rule can be time-boxed\n// or branch-scoped off. Convention:\n//   turnOffRuleUntilEpoch:    0 = rule active (epoch in the past); a future unix epoch IN SECONDS =\n//                             temporarily disabled until that moment.\n//   turnOffRuleWhileOnBranch: null = always on; a branch name = disabled while that branch is checked out.\n//                             The name is matched EXACTLY (===). Globs/wildcards are NOT supported and\n//                             must not be added: a pattern would switch a rule off on branches nobody\n//                             enumerated. It is also ignored (loudly — shouldSkipRule throws) on a pull\n//                             request from a FORK, where the branch name is the contributor's to choose.\n//                             Required-but-nullable so its \"unset\" state is present-and-visible (null)\n//                             rather than omitted.\n// The earlier spellings of these two fields were RENAMED to the names above and are no longer accepted —\n// the validator rejects them with a \"renamed to X\" hint. RENAMED_FIELD_ALIASES in validate-config.ts is\n// the ONE place in src/ a dead spelling may still be written (see escape-hatch-key-spelling.spec.ts).\n// ---------------------------------------------------------------------------\nexport abstract class BaseRuleConfig {\n    // `mode` is declared here (loosely typed) so the shared AbstractRule base can read it for\n    // on/off. Each concrete *Config narrows it to its own union (e.g. `mode?: ModifiedCodeMode`),\n    // which is an assignable (covariant) override.\n    mode?: string;\n    // TS-optional, but schema-REQUIRED (see BASE_RULE_SCHEMA) — same split as `mode`. Read directly by\n    // AbstractRule.shouldRun, RuleGate, and the code-rules validators.\n    turnOffRuleUntilEpoch?: number;\n    turnOffRuleWhileOnBranch?: string | null;\n}\n\nexport const BASE_RULE_SCHEMA = {\n    turnOffRuleUntilEpoch: new FieldDef('number'),\n    turnOffRuleWhileOnBranch: FieldDef.nullableString(),\n};\n\nexport class MaxMethodLinesConfig extends BaseRuleConfig {\n    declare mode?: MethodLimitMode;\n    limit?: number;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<MaxMethodLinesConfig> = {\n        mode: new FieldDef('string', METHOD_LIMIT_MODES),\n        limit: FieldDef.optional('number'),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class MaxFileLinesConfig extends BaseRuleConfig {\n    declare mode?: FileLimitMode;\n    limit?: number;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<MaxFileLinesConfig> = {\n        mode: new FieldDef('string', FILE_LIMIT_MODES),\n        limit: FieldDef.optional('number'),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class RequireReturnTypeConfig extends BaseRuleConfig {\n    declare mode?: ReturnTypeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<RequireReturnTypeConfig> = {\n        mode: new FieldDef('string', RETURN_TYPE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoInlineTypeLiteralsConfig extends BaseRuleConfig {\n    declare mode?: InlineTypeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoInlineTypeLiteralsConfig> = {\n        mode: new FieldDef('string', INLINE_TYPE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoAnyUnknownConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoAnyUnknownConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoImplicitAnyConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoImplicitAnyConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class PrismaValidateDtosConfig extends BaseRuleConfig {\n    declare mode?: PrismaValidateDtosMode;\n    disableAllowed?: boolean;\n    prismaSchemaPath?: string;\n    dtoSourcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<PrismaValidateDtosConfig> = {\n        mode: new FieldDef('string', PRISMA_DTOS_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        prismaSchemaPath: FieldDef.optional('string'),\n        dtoSourcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class PrismaConverterConfig extends BaseRuleConfig {\n    declare mode?: PrismaConverterMode;\n    disableAllowed?: boolean;\n    schemaPath?: string;\n    convertersPaths?: string[];\n    enforcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<PrismaConverterConfig> = {\n        mode: new FieldDef('string', PRISMA_CONVERTER_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        schemaPath: FieldDef.optional('string'),\n        convertersPaths: FieldDef.optional('string[]'),\n        enforcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// `allowedPaths` exempts whole file trees whose idioms are destructuring by construction (React /\n// React Native components and hooks — `const [x, setX] = useState()`, destructured props — framework\n// glue), matched with the shared glob/prefix/segment semantics of `isPathExcluded`. It is the ONLY\n// escape when `disableAllowed: false`, since that setting deliberately ignores inline disables.\nexport class NoDestructureConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    allowTopLevel?: boolean;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoDestructureConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        allowTopLevel: FieldDef.optional('boolean'),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoUnmanagedExceptionsConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoUnmanagedExceptionsConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class CatchErrorPatternConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<CatchErrorPatternConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ThrowCauseRequiredConfig extends BaseRuleConfig {\n    declare mode?: ThrowCauseMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<ThrowCauseRequiredConfig> = {\n        mode: new FieldDef('string', THROW_CAUSE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class AngularNoDirectApiInResolverConfig extends BaseRuleConfig {\n    declare mode?: DirectApiResolverMode;\n    disableAllowed?: boolean;\n    enforcePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<AngularNoDirectApiInResolverConfig> = {\n        mode: new FieldDef('string', DIRECT_API_RESOLVER_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        enforcePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Bans hand-written CSS in Angular sources (styles:/styleUrls:/styleUrl: in @Component, and inline\n// style=/[style.x]/[ngStyle] in templates) so teams style with Tailwind utility classes. `allowGlobs`\n// exempts paths WITHIN the Angular scope (e.g. a vendored Fuse kit copied verbatim with its own CSS).\nexport class NoCustomCssConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowGlobs?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoCustomCssConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowGlobs: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoSymbolDiTokensConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoSymbolDiTokensConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Flags `process.exit(...)` outside a main()/runMain wrapper (and `import { main }`) so a deep exit\n// can't silently kill a reused server/command. Gradual-rollout knobs via the standard base: mode\n// (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch, branch, and\n// disableAllowed for the inline `// webpieces-disable` escape at genuine terminal boundaries.\nexport class NoProcessExitOutsideMainConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n\n    static readonly SCHEMA: SchemaShape<NoProcessExitOutsideMainConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Flags a function CREATED OUTSIDE A CLASS at module scope: a top-level `function foo()` declaration\n// or a top-level `const foo = () => {}` / `= function(){}`. The point is that webpieces DI +\n// @DocumentDesign only work when behavior lives in injectable classes — a module-scope function is a\n// dead-end the DI graph can't reach. Inline callbacks, nested functions inside methods, and non-function\n// top-level consts (objects, zod schemas, primitives) are NOT flagged. Standard rollout knobs via the\n// base: mode (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch, branch,\n// and disableAllowed for the inline `// webpieces-disable` escape. `allowedPaths` exempts whole file\n// trees that legitimately live outside the class-per-behavior model (e.g. React component/hook files,\n// framework glue), matched with the shared glob/prefix/segment semantics of `isPathExcluded`.\nexport class NoFunctionOutsideClassConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoFunctionOutsideClassConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// inject-annotation-not-needed-for-concrete-class — flags a REDUNDANT `@inject(X)` whose token is\n// textually identical to the parameter's own declared type (`@inject(Foo) private readonly foo: Foo`).\n// In this inversify setup the decorator is pure noise there: reflect-metadata (emitDecoratorMetadata)\n// already resolves a constructor parameter by its class type, so `private readonly foo: Foo` binds on\n// its own (see CLAUDE.md, and the no-symbol-di-tokens rule that pushes the same way). Symbol/interface\n// tokens are NOT flagged because they never equal the type (`@inject(FOO_TOKEN) x: Provider<Foo>`).\n// AI keeps carpet-bombing `@inject`; this fails the build on the redundant form. Standard rollout knobs\n// via the base: mode (OFF | NEW_AND_MODIFIED_CODE | NEW_AND_MODIFIED_FILES), turnOffRuleUntilEpoch,\n// branch, and disableAllowed for the inline `// webpieces-disable` escape. `allowedPaths` exempts whole\n// file trees, matched with the shared glob/prefix/segment semantics.\nexport class InjectAnnotationNotNeededForConcreteClassConfig extends BaseRuleConfig {\n    declare mode?: ModifiedCodeMode;\n    disableAllowed?: boolean;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<InjectAnnotationNotNeededForConcreteClassConfig> = {\n        mode: new FieldDef('string', MODIFIED_CODE_MODES),\n        disableAllowed: FieldDef.optional('boolean'),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// framework-tag — every project that a changed source file belongs to must carry >=1\n// `framework:<browser|react|angular|node|express>` nx tag in its project.json. Those tags are the\n// project's \"libType\" — the SET of runtime environments it runs in — and the source of truth for\n// the dependencies.json `framework` field and the `library-types-match-client` rule. Multiple tags\n// are allowed (the env set) and values are validated against the known set (`framework:all` is a\n// hard error). `knownTypes` customizes that set (defaults to browser, react, angular, node, express).\nexport class FrameworkTagConfig extends BaseRuleConfig {\n    declare mode?: ProjectMode;\n    knownTypes?: string[];\n\n    static readonly SCHEMA: SchemaShape<FrameworkTagConfig> = {\n        mode: new FieldDef('string', PROJECT_MODES),\n        knownTypes: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// role-tag — every project that a changed source file belongs to must carry a\n// `role:<server|designed-lib|lib|client>` nx tag in its project.json. That tag is the project's\n// ROLE (orthogonal to `framework` libType) — the source of truth for the dependencies.json `role`\n// field, the `role-dependency` edge rule (apps are never depended upon), and DI-design generation\n// (server→@Controller, designed-lib→@ApiImplementation, lib→none, client→angular design).\n// `knownTypes` customizes the list suggested to the author when a tag is missing.\nexport class RoleTagConfig extends BaseRuleConfig {\n    declare mode?: ProjectMode;\n    knownTypes?: string[];\n\n    static readonly SCHEMA: SchemaShape<RoleTagConfig> = {\n        mode: new FieldDef('string', PROJECT_MODES),\n        knownTypes: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class BranchCreationGuardConfig extends BaseRuleConfig {\n    declare mode?: BranchGuardMode;\n    // Naming pattern for stacked SUB-branches only (branches created off another feature branch,\n    // which require human approval). Never applied to branches created off main.\n    subBranchNaming?: string;\n    // Human-sentence instruction telling the AI how to name a NEW branch off main. Surfaced back\n    // to the agent in the guard's fix hints. May mirror no-edit-on-main.branchNamingConvention.\n    branchFormat?: string;\n    // Hard cap on local feature branches (excluding main). Creating one past the cap is BLOCKED until\n    // already-merged branches are reaped, which is what keeps the branch list from growing without\n    // bound. Branch creation is the gate because it is the only moment cleanup is both cheap and\n    // obviously worth it. See merged-branches.ts for how \"already merged\" is determined.\n    maxLocalBranches?: number;\n    // Hard cap on LINKED worktrees (the primary clone is never counted). A separate budget from\n    // maxLocalBranches: every worktree holds a branch, so if worktree-held branches also spent the\n    // branch budget, five worktrees would leave room for zero branches. Held branches count here;\n    // parked branches count against maxLocalBranches. Enforced at `git worktree add`.\n    maxWorktrees?: number;\n    // Let the detached background refresher DELETE dead branches on its own, instead of only\n    // reporting them. Every candidate is provably dead (a MERGED PR — its own, or the PR of the branch\n    // it snapshots; nothing else qualifies) and\n    // recoverable by the SHA logged to branch-mutations.log — but it is still UNATTENDED deletion,\n    // so this is schema-REQUIRED like `mode` and `turnOffRuleUntilEpoch`. \"Every built-in rule\n    // must be explicitly configured — no silent defaults\" (validate-config.ts) applies with extra\n    // force here: branches disappearing on a preference nobody ever stated is precisely the kind of\n    // default that must not exist. Validation makes each consumer answer the question once.\n    //\n    // TS-optional but schema-required — the same split `mode` uses. Absent at RUNTIME therefore means\n    // the config never passed validation, and the only safe reading of \"nobody has answered\" is: do\n    // not delete anything.\n    autoReapMergedBranches?: boolean;\n\n    static readonly SCHEMA: SchemaShape<BranchCreationGuardConfig> = {\n        mode: new FieldDef('string', BRANCH_GUARD_MODES),\n        subBranchNaming: FieldDef.optional('string'),\n        branchFormat: FieldDef.optional('string'),\n        maxLocalBranches: FieldDef.optional('number'),\n        maxWorktrees: FieldDef.optional('number'),\n        autoReapMergedBranches: new FieldDef('boolean'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n/**\n * `pr-lifecycle-guard` — ONE key, ONE policy: *PRs and merges go through the gated flow.*\n *\n * Four CLASSES implement it, and their names are unchanged (they are the operator identity every\n * decision-log line and every deny report carries):\n *\n *   pr-creation-or-push-guard  a manual `git push` / `gh pr create|edit` / a raw pulls API call\n *   merge-in-progress-guard    a PR command while a 3-point merge is half-finished\n *   pr-merge-guard             a bare `gh pr merge`\n *   redirect-how-to-merge-main \"how do I get main into my branch?\" → the documented flow\n *\n * ## Say this out loud: `\"mode\": \"OFF\"` releases the unvalidated-merge gate too\n *\n * Three of the four are pure COMMAND-SHAPE blocks and can never fire spuriously. The fourth,\n * merge-in-progress-guard, is STATE-conditional — it fires only while a 3-point merge is actually in\n * progress, and it is the one state L2 explicitly stands down for. So turning this key OFF to unblock\n * `gh pr merge` ALSO drops the \"you have an unfinished merge\" gate. That is the honest cost of one key\n * per policy, and it is stated here, in guards/L4-pr-lifecycle.md, and in the error path, rather than\n * being papered over with a granular sub-mode (which would be four knobs wearing one key's name).\n *\n * ## The command strings are NOT here\n *\n * `upsertPrCommand` and `mergeCompleteCommand` used to sit on the two guards, and — being read at the\n * point of use — they BEAT `commands.guardHints`, so `guardHintsWhy`'s claim that renaming a gated\n * command there makes \"every guard message follow\" was simply false. They are DELETED, not deprecated.\n * `commands.guardHints.prCreationOrPush` / `.mergeInProgress` is the one place those strings live, and\n * the loader hands the resolved values to the two rules directly. A consumer that still sets the old\n * per-guard field gets a RETIRED_FIELD_HINTS error naming the destination.\n */\nexport class PrLifecycleGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n\n    static readonly SCHEMA: SchemaShape<PrLifecycleGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// NOTE: there is deliberately no `WholeRepoBuildGuardConfig`. That guard has NO webpieces.config.json\n// entry — it is EXPERIMENTAL and OFF by default, and its only switch is the OPT-IN\n// `experimental.whole-repo-build-guard: true` in the optional machine-local ~/.webpieces/config.json\n// (see home-config.ts). The build command it prints\n// is handed to it directly from `commands.pr-gate.buildCommand` by ai-hook-rules' runner. Re-adding a\n// config class here puts the guard back in RULE_SCHEMAS and makes it a fault-Y rule again.\n\nexport class NoFileImportCyclesConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    ignoreTypeOnly?: boolean;\n    excludePackages?: string[];\n    // Raw regex escape hatch for a cycle inside the project being checked — generated code, a\n    // vendored tree, or a deliberate bidirectional domain model — that `excludePackages` cannot reach\n    // (it resolves npm package NAMES, so it only excludes a *sibling* package, never a directory\n    // inside this one). Patterns are handed to madge verbatim and matched against ids RELATIVE TO THE\n    // PROJECT (e.g. \"^src/generated/\", \"^src/modules/(item|category)/\") — NOT workspace-rooted or\n    // absolute, which silently match nothing. The executor warns when a pattern matches zero\n    // traversed files, so a mis-anchored pattern is visible rather than a silent no-op.\n    excludeRegExp?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoFileImportCyclesConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ignoreTypeOnly: FieldDef.optional('boolean'),\n        excludePackages: FieldDef.optional('string[]'),\n        excludeRegExp: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class RuntimeArchitectureConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n    // NOTE: `servicePaths` / `apiProjectPaths` were removed — they were never read. The runtime graph\n    // is derived SOLELY from architecture/dependencies.json apiRelations + project roles (see\n    // nx-webpieces-rules/src/lib/runtime-graph.ts), so any config still listing them (a hand-maintained\n    // enumeration of api libs) now fails the unknown-field check in validateWebpiecesConfig. There is\n    // nothing to enumerate — delete the keys.\n    // NOTE: `allowedCycles` was removed — a runtime cycle is no longer allowable at all. CD deploys\n    // services in dependency order and a cyclic architecture has no such order, so the runtime graph\n    // now THROWS while it is being levelled rather than emitting a flat, unlevellable diagram (see\n    // nx-webpieces-rules/src/lib/runtime-graph-levels.ts). A repo that genuinely cannot break a cycle\n    // yet declares it PER EDGE with a `cutLegacyCycle:<targetService>` nx tag on the CALLING project,\n    // which admits the debt in a place `grep -rn cutLegacyCycle` can enumerate. Delete the key.\n    /**\n     * Draw a dashed terminal node for every contract a service calls that NOTHING in-repo\n     * implements (firestore, gmail, ...) — the vendor systems the runtime graph otherwise stops one\n     * hop short of. Defaults to true; set false in a repo whose external surface is noisy. Purely a\n     * RENDER switch: levels, cycle detection and runtime-dependencies.json are identical either way.\n     */\n    showExternalNodes?: boolean;\n    /**\n     * Project roots whose exported `*Api` types are contracts for systems OUTSIDE this repo\n     * (firestore, gmail, gcp-storage, ...), e.g. `[\"libraries/apis/external/**\"]`. Globs, matched\n     * against the nx project root.\n     *\n     * Needed because an external contract does NOT look like an in-repo one: it is a plain\n     * `interface` bound to a Symbol token and injected, never an `abstract class` carrying @ApiPath\n     * reached through `createRpcClient`. Without this list the scanner has no way to tell a vendor\n     * seam from any other library, so every call leaving the repo is invisible to the runtime graph.\n     *\n     * Defaults to none, which is correct for a repo with no vendor wrapper libraries.\n     */\n    externalApiPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<RuntimeArchitectureConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        showExternalNodes: FieldDef.optional('boolean'),\n        externalApiPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NxWiringConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<NxWiringConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class DiGraphConfig extends BaseRuleConfig {\n    // Structural: the DI graph is regenerated whole-project on every build (generate +\n    // unchanged gate), so it cannot be scoped to changed lines.\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<DiGraphConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class MissingDesignAnnotationConfig extends BaseRuleConfig {\n    // Structural: enforced per-project by the di-graph-generate executor, which\n    // roots the whole DI design on @DocumentDesign classes — cannot be line-scoped.\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<MissingDesignAnnotationConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class NoJsFilesConfig extends BaseRuleConfig {\n    // File-tier: NEW_AND_MODIFIED_FILES (active) intercepts a .js/.jsx Write — the file being\n    // written is inherently a new/modified file, so it's already diff-scoped in practice.\n    declare mode?: FileLimitMode;\n    allowedPaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<NoJsFilesConfig> = {\n        mode: new FieldDef('string', FILE_LIMIT_MODES),\n        allowedPaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// ---------------------------------------------------------------------------\n// The five Nx infrastructure validators (architecture-unchanged, no-architecture-cycles,\n// packagejson, versions-locked, eslint-sync). Each is whole-graph / whole-repo by nature (a cycle, a\n// drifted dependencies.json, an unlocked version can be introduced by a file nobody in this diff\n// touched), so the only honest mode set is STRUCTURAL_MODES: RUN_EVERY_TIME (the default) or OFF.\n//\n// All five now honor the universal escape hatches (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch)\n// via shouldSkipRule — the RuleGate is called with honorEpoch:true from\n// every executor. This lets a repo time-box or branch-scope a failing infrastructure check (e.g. hold\n// validate-packagejson off until an upgrade PR lands) with a one-value edit, instead of only the\n// blunt \"mode\": \"OFF\". Originally packagejson/versions-locked/eslint-sync were all-or-nothing on the\n// theory that \"no blessed baseline\" made grandfathering meaningless, but a time-box is a schedule, not\n// a baseline: \"do not enforce this until <epoch>/off <branch>\" is coherent for any rule.\n// ---------------------------------------------------------------------------\n\nexport class ValidateArchitectureUnchangedConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateArchitectureUnchangedConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateNoArchitectureCyclesConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateNoArchitectureCyclesConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidatePackageJsonConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidatePackageJsonConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateVersionsLockedConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateVersionsLockedConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateEslintSyncConfig extends BaseRuleConfig {\n    declare mode?: StructuralMode;\n\n    static readonly SCHEMA: SchemaShape<ValidateEslintSyncConfig> = {\n        mode: new FieldDef('string', STRUCTURAL_MODES),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\nexport class ValidateTsInSrcConfig extends BaseRuleConfig {\n    declare mode?: ValidateTsMode;\n    allowedRootFiles?: string[];\n    excludePaths?: string[];\n\n    static readonly SCHEMA: SchemaShape<ValidateTsInSrcConfig> = {\n        mode: new FieldDef('string', VALIDATE_TS_MODES),\n        allowedRootFiles: FieldDef.optional('string[]'),\n        excludePaths: FieldDef.optional('string[]'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n"]}

package/src/validate-config.js

@@ -150,6 +150,11 @@ const RETIRED_FIELD_HINTS = {
     'runtime-architecture.apiProjectPaths': 'This field was removed — it was never read. The runtime graph is derived automatically from ' +
         'architecture/dependencies.json, so there is NO list of api libs to maintain. Delete it (do not ' +
         'enumerate api libs and do not replace it with a glob).',
+    'runtime-architecture.allowedCycles': 'This field was removed — a runtime cycle is not allowable at all any more. Levelling now FAILS ' +
+        'on any cycle, because CD deploys services in dependency order and a cycle has no such order. ' +
+        'Delete the key. If a cycle genuinely cannot be broken yet, declare it PER EDGE with a ' +
+        '`cutLegacyCycle:<targetService>` nx tag on the CALLING project, which admits the debt where ' +
+        '`grep -rn cutLegacyCycle` can enumerate it — there is no config key for it.',
     // The two per-guard command strings, deleted as SECOND SPELLINGS of commands.guardHints. They were
     // read at the point of use, so they BEAT the commands section — which made guardHintsWhy's promise
     // ("rename a gated command here and every guard message follows") false for any repo that set them.

package/src/validate-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/validate-config.ts"],"names":[],"mappings":";;;AAuOA,0DA8CC;AAmFD,sDAoEC;AA2BD,oDAmBC;AA+FD,8DAuBC;AAUD,4DAuBC;AA9mBD,wGAAwG;AACxG,kFAAkF;AAClF,+DAAiE;AACjE,yCAAyD;AACzD,iDAA4D;AAC5D,6CAAqE;AACrE,iDAAqD;AACrD,6EAAuJ;AAK9I,0GALA,sDAAyB,OAKA;AAJlC,+DAAsF;AACtF,2CAAoD;AAIpD,yFAAyF;AACzF,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AACrB,2CAA6F;AAApF,iHAAA,mBAAmB,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AACtE,6DAA2D;AAC3D,yCAAqC;AAErC;;;;;;;;;;GAUG;AACU,QAAA,uBAAuB,GAAG,CAAC,CAAC;AAEzC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAErC;;;;;;GAMG;AACH,wHAAwH;AACxH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,+BAAuB,GAAG,eAAe,CAAC;IAC3F,IAAI,KAAK,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CACH,GAAG,KAAK,6BAA6B,KAAK,OAAO,OAAO,uCAAuC;QAC/F,GAAG,+BAAuB,yEAAyE;QACnG,oFAAoF;QACpF,6BAA6B,QAAQ,KAAK,OAAO,8CAA8C;QAC/F,kGAAkG;QAClG,iGAAiG;QACjG,SAAS,CACZ,CAAC;AACN,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY;IAC1C,oGAAoG;IACpG,oGAAoG;IACpG,IAAI,GAAG,KAAK,uBAAuB;QAAE,OAAO,8DAA8D,CAAC;IAC3G,IAAI,GAAG,KAAK,0BAA0B;QAAE,OAAO,gHAAgH,CAAC;IAChK,OAAO,GAAG,CAAC,UAAU;QACjB,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;QACnC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB;YAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAG,CAAC,CAAC,UAAU;gBACtC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAE,CAAC,CAAC,WAAW;oBACvC,CAAC,CAAC,YAAY,CAAC;AACvB,CAAC;AAED,yGAAyG;AACzG,SAAS,UAAU,CAAC,MAAgC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;IAC/C,iGAAiG;IACjG,8FAA8F;IAC9F,MAAM,WAAW,GAAG,IAAA,mCAAsB,EAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,IAAA,0BAAa,EAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,CACH,2CAA2C,WAAW,mCAAmC;QACzF,4FAA4F;QAC5F,4CAA4C,MAAM,EAAE,CACvD,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,MAAgC;IAC1E,+EAA+E;IAC/E,oGAAoG;IACpG,yGAAyG;IACzG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,GACH,IAAI,QAAQ,qEAAqE,OAAO,aAAa;QACrG,mDAAmD;QACnD,MAAM,QAAQ,SAAS,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAE5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,GAAG;YACC,sEAAsE;gBACtE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACtC,OAAO,CACH,IAAI,QAAQ,iFAAiF;QAC7F,iGAAiG;QACjG,eAAe,QAAQ,4CAA4C,iCAAqB,QAAQ;QAChG,mGAAmG;QACnG,6FAA6F;QAC7F,mGAAmG;QACnG,sFAAsF;QACtF,IAAI,QAAQ,oFAAoF;QAChG,mGAAmG;QACnG,mGAAmG;QACnG,6DAA6D,CAChE,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,wGAAwG;AACxG,iGAAiG;AACjG,MAAM,mBAAmB,GAA2B;IAChD,mCAAmC,EAC/B,8FAA8F;QAC9F,2EAA2E;IAC/E,sCAAsC,EAClC,8FAA8F;QAC9F,iGAAiG;QACjG,wDAAwD;IAC5D,mGAAmG;IACnG,mGAAmG;IACnG,oGAAoG;IACpG,2FAA2F;IAC3F,oCAAoC,EAChC,4FAA4F;QAC5F,kGAAkG;QAClG,WAAW;IACf,yCAAyC,EACrC,4FAA4F;QAC5F,iGAAiG;QACjG,WAAW;CAClB,CAAC;AAEF,+FAA+F;AAC/F,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,qBAAqB,GAA2B;IAClD,wBAAwB,EAAE,uBAAuB;IACjD,uBAAuB,EAAE,0BAA0B;CACtD,CAAC;AAGF,mEAAmE;AACnE,8GAA8G;AAC9G,SAAS,iBAAiB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;IACpE,OAAO,GAAG,KAAK,mBAAmB,MAAM,0BAA0B,MAAM,0GAA0G,CAAC;AACvL,CAAC;AAED;;;;;;GAMG;AACH,0GAA0G;AAC1G,wHAAwH;AACxH,SAAS,WAAW,CAAC,QAAgB,EAAE,KAA8B,EAAE,MAAgC;IACnG,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,SAAS,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,QAAQ,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBAChE,SAAS;YACb,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,oBAAoB,GAAG,qBAAqB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YACjH,SAAS;QACb,CAAC;QACD,8FAA8F;QAC9F,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ;YAAE,SAAS;QAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,aAAa,QAAQ,CAAC,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,QAAQ,KAAK,mCAAmC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxH,CAAC;aAAM,IAAI,GAAG,KAAK,uBAAuB,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,QAAQ,GAAG,EAAE,KAAe,CAAC,CAAC;YACjE,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,4GAA4G;AAC5G,SAAgB,uBAAuB,CACnC,QAAiD,EACjD,oBAA6B,KAAK;IAElC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,2BAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,2FAA2F;YAC3F,yFAAyF;YACzF,2FAA2F;YAC3F,iCAAiC;YACjC,MAAM,OAAO,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,IAAA,qCAAe,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtC,SAAS;YACb,CAAC;YACD,mFAAmF;YACnF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,CAAC,iBAAiB;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChE,SAAS;QACb,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,kFAAkF;QAClF,2EAA2E;QAC3E,0FAA0F;QAC1F,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,6BAA6B,GAAG,UAAU,GAAG,KAAK,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,mEAAmE;IACnE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,2BAAY,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAC7C,6FAA6F;AAC7F,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAEtD,iGAAiG;AACjG,kGAAkG;AAClG,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAChB,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;IACtD,8FAA8F;IAC9F,+FAA+F;IAC/F,kGAAkG;IAClG,oEAAoE;IACpE,+FAA+F;IAC/F,2GAA2G;IAC3G,mGAAmG;IACnG,uEAAuE,CAC9E,CAAC;AAEF,gGAAgG;AAChG,6FAA6F;AAC7F,SAAS,aAAa;IAClB,OAAO,CACH,kBAAkB;QAClB,qBAAqB;QACrB,0IAA0I;QAC1I,kBAAkB;QAClB,8GAA8G;QAC9G,UAAU;QACV,4FAA4F;QAC5F,qHAAqH;QACrH,SAAS;QACT,KAAK,CACR,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,kCAAkC;AAClC,uGAAuG;AACvG,8GAA8G;AAC9G,SAAS,oBAAoB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,oFAAoF,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAa,EAAE,KAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,mBAAmB,KAAK,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,0FAA0F;IAC1F,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,0BAA0B,CAAC,CAAC;IACnG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS;QAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oGAAoG,CAAC,CAAC;SACzI,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK;QAClE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oFAAoF,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS;QACjE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,wEAAwE,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,8GAA8G;AAC9G,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,QAAiB;IACrE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,yFAAyF;gBACzF,8CAA8C,aAAa,EAAE,EAAE;SAClE,CAAC;IACN,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,4CAA4C,aAAa,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,4DAA4D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAiC,CAAC,EAAE,CAAC;QAC7G,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC;IAED,iGAAiG;IACjG,8FAA8F;IAC9F,oDAAoD;IACpD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACP,0FAA0F;gBAC1F,oGAAoG,CACvG,CAAC;QACN,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,iDAAiD,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAwC,CAAC,EAAE,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,EAAE,CAAC,mBAAmB,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,IAAI,OAAO,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnE,sGAAsG;IACtG,sFAAsF;IACtF,IAAI,YAAY,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,sDAAyB,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE5F,qGAAqG;IACrG,oGAAoG;IACpG,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,0KAA0K,CAAC,CAAC;QAC5L,CAAC;IACL,CAAC;IAED,wFAAwF;IACxF,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,kDAAqB,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEtE,6FAA6F;IAC7F,IAAI,WAAW,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,qDAAwB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,wDAA2B,EAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,qGAAqG;IACrG,IAAI,mBAAmB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;IAC3H,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB;IACxB,OAAO,qCAAqC,CAAC;AACjD,CAAC;AAED,gFAAgF;AAChF,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,KAAc,EAAE,GAAW;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,mBAAmB,GAAG,uDAAuD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,6FAA6F;AAC7F,SAAgB,oBAAoB,CAAC,OAAgB;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,kFAAkF;gBAClF,2DAA2D,mBAAmB,EAAE,EAAE;SACrF,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChF,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,mGAAmG;IACnG,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAA,kCAAY,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACxD,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,IAAA,qCAAe,EAAC,OAAO,CAAC,SAAS,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,8EAA8E;AAC9E,kGAAkG;AAClG,sGAAsG;AACtG,yGAAyG;AACzG,8EAA8E;AAE9E,SAAS,iBAAiB;IACtB,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,wCAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,OAAe;IAC/B,8DAA8D;IAC9D,IAAI,CAAC;QACD,kFAAkF;QAClF,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,SAAS,CAAC;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACzB,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,+GAA+G;AAC/G,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,uBAAuB,KAAK,kHAAkH,CAAC,CAAC;IAC5J,CAAC;IACD,+FAA+F;IAC/F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,+EAA+E,CAAC,CAAC;IAE7H,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oDAAoD,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACJ,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,aAAa,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,0CAA0C,CAAC,CAAC;IAElF,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,kCAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAuC,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,yBAAyB,kCAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElG,qGAAqG;IACrG,mGAAmG;IACnG,kGAAkG;IAClG,mFAAmF;IACnF,IAAI,OAAO,CAAC,CAAC,uBAAuB,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oGAAoG,CAAC,CAAC;IAC5I,CAAC;SAAM,CAAC;QACJ,MAAM,QAAQ,GAAG,aAAa,CAAC,iBAAiB,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACrF,IAAI,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,0BAA0B,CAAC,KAAK,QAAQ,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,+IAA+I,CAAC,CAAC;IAEvL,iEAAiE;IACjE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,mDAAmD,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,iEAAiE,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC7E,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oCAAoC,CAAC,CAAC;IAE5E,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,SAAgB,yBAAyB,CAAC,OAAgB;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,6FAA6F;gBAC7F,uGAAuG,iBAAiB,EAAE,EAAE;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,wEAAwE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,0FAA0F;QAC1F,MAAM,IAAI,GAAI,OAAO,CAAC,CAAC,CAAoC,EAAE,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,0CAA0C,CAAC,CAAC;YACvH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,4EAA4E;AAC5E,SAAgB,wBAAwB,CACpC,YAAqD,EACrD,iBAA0D;IAE1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAA,sBAAW,EAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,yBAAyB,8CAAwB,sCAAsC;gBAC/F,UAAU,CACb,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,2FAA2F;QAC3F,IAAI,CAAC,IAAA,sBAAW,EAAC,IAAI,CAAC,IAAI,2BAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,wBAAwB,8CAAwB,sCAAsC;gBAC9F,UAAU,CACb,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { FieldDef } from './field-def';\n// Imported, never re-typed: the banner offers the bulk migrator only for errors it actually covers, and\n// this marker is how it recognizes a placement error. See config-error-banner.ts.\nimport { SECTION_PLACEMENT_MARKER } from './config-error-banner';\nimport { sectionForRule, isHookGuard } from './sections';\nimport { RULE_SCHEMAS, allRuleNames } from './rule-schemas';\nimport { recommendedSeedModeFor, isGradualMode } from './seed-entry';\nimport { MODIFIED_CODE_MODES } from './rule-configs';\nimport { validateChecklistsSection, validateDevDeploySection, validateLandPrSection, validateNoGateSaltRationale } from './pr-gate-section-validators';\nimport { retiredEntry, retiredKeyError, retiredRuleFor } from './retired-config-keys';\nimport { PRUNE_UNKNOWN_COMMAND } from './constants';\n\n// Re-exported so the isolated validate-checklist-docs target keeps importing it from here.\nexport { validateChecklistsSection };\n// Re-exported from their new homes: this module was the historical entry point for both.\nexport { allRuleNames } from './rule-schemas';\nexport { recommendedSeedMode, recommendedSeedModeFor, seedEntryForRule } from './seed-entry';\nimport { DEFAULT_MATCH_RULES } from './match-rules-config';\nimport { toError } from './to-error';\n\n/**\n * The longest a `turnOffRuleUntilEpoch` may reach into the future: ONE WEEK. Poke it again next week to\n * extend — that weekly re-set IS the intended workflow, not a workaround: it is what makes a rule that is\n * off on purpose stay a decision somebody keeps making, instead of one nobody remembers.\n *\n * DELIBERATELY ASYMMETRIC with turnOffRuleWhileOnBranch, which has NO cap and must not get one. The epoch\n * hatch is REPO-WIDE while it lasts, so a long window shelters every unrelated change that lands inside it\n * (a fleet repo was found with max-file-lines/max-method-lines switched off until 2026-10-01 — 43 days\n * out, six times this cap). The branch hatch fires only on ONE exact branch name — a big refactor\n * legitimately runs 35+ days, and capping that would only interrupt the one branch that opted in.\n */\nexport const MAX_TURN_OFF_EPOCH_DAYS = 7;\n\nconst SECONDS_PER_DAY = 24 * 60 * 60;\n\n/**\n * Reject a `turnOffRuleUntilEpoch` more than MAX_TURN_OFF_EPOCH_DAYS into the future.\n *\n * A PAST epoch is always valid: it is inert (it skips nothing), and every existing config is full of them.\n * The BOUNDARY is inclusive — exactly MAX_TURN_OFF_EPOCH_DAYS out is accepted, only strictly beyond it is\n * refused — so a config written as \"now + 7 days\" is never rejected by the second it took to save.\n */\n// webpieces-disable no-function-outside-class -- module-scope validator helper, matching every other check in this file\nfunction epochCapError(label: string, value: number): string | null {\n    const maxEpoch = Math.floor(Date.now() / 1000) + MAX_TURN_OFF_EPOCH_DAYS * SECONDS_PER_DAY;\n    if (value <= maxEpoch) return null;\n    const daysOut = Math.round((value - Date.now() / 1000) / SECONDS_PER_DAY);\n    const maxDate = new Date(maxEpoch * 1000).toISOString().split('T')[0];\n    return (\n        `${label} \"turnOffRuleUntilEpoch\": ${value} is ${daysOut} days in the future — the maximum is ` +\n        `${MAX_TURN_OFF_EPOCH_DAYS} days. A rule switched off for longer than that is off for work nobody ` +\n        `had in mind when it was written, because this hatch is REPO-WIDE while it lasts.\\n` +\n        `  CURE: set it to at most ${maxEpoch} (${maxDate}), then re-set it WEEKLY for as long as you ` +\n        `still need it — that renewal is the intended workflow, not a workaround. If the rule is off for ` +\n        `ONE branch's work, use \"turnOffRuleWhileOnBranch\": \"<exact branch name>\" instead; that one has ` +\n        `no cap.`\n    );\n}\n\nfunction valueHint(def: FieldDef, key?: string): string {\n    // The two universal escape hatches, REQUIRED on every rule so they're always visible. Spell out the\n    // \"off\" value so a fresh config seeds them in the active/no-op state (0 / null), not a placeholder.\n    if (key === 'turnOffRuleUntilEpoch') return '0  (0 = active; future unix-epoch seconds = temporarily off)';\n    if (key === 'turnOffRuleWhileOnBranch') return 'null  (null = always on; an EXACT branch name — no globs — disables the rule while that branch is checked out)';\n    return def.enumValues\n        ? `\"${def.enumValues.join(' | ')}\"`\n        : def.type === 'string[]' ? '[\"<string>\", ...]'\n        : def.type === 'number'   ? '<number>'\n        : def.type === 'boolean'  ? '<boolean>'\n        : '\"<string>\"';\n}\n\n/** A rollout hint for the copy-paste snippet: recommend the narrowest gradual mode the rule supports. */\nfunction rolloutTip(schema: Record<string, FieldDef>): string {\n    const modes = schema['mode']?.enumValues ?? [];\n    // Same source of truth as the seeder; only a GRADUAL recommendation gets the rollout prose, so a\n    // rule whose recommendation falls through to ON/RUN_EVERY_TIME/OFF prints no tip (as before).\n    const recommended = recommendedSeedModeFor(modes);\n    if (!isGradualMode(recommended)) return '';\n    const optOut = modes.includes('OFF') ? ' Set \"mode\": \"OFF\" to opt out entirely.' : '';\n    return (\n        `\\n\\n💡 Recommended: start with \"mode\": \"${recommended}\" — it enforces only on what you ` +\n        `actually change, so the rule rolls out gradually (existing code stays grandfathered until ` +\n        `you next touch that project/file/method).${optOut}`\n    );\n}\n\nfunction missingRuleSnippet(ruleName: string, schema: Record<string, FieldDef>): string {\n    // Required fields go in the copy-paste entry. The two universal escape hatches\n    // (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch) are now REQUIRED, so they land in that block —\n    // which is the whole point: every seeded rule shows both hatches. Optional fields are listed separately.\n    const fields = Object.keys(schema);\n    const required = fields.filter(f => !schema[f].optional);\n    const optional = fields.filter(f => schema[f].optional);\n\n    const requiredLines = required.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n    const section = sectionForRule(ruleName);\n    let out =\n        `[${ruleName}] Not configured in webpieces.config.json. Add this entry to the \"${section}\" section\\n` +\n        `(choose values appropriate for your project):\\n\\n` +\n        `  \"${ruleName}\": {\\n${requiredLines.join(',\\n')}\\n  }`;\n\n    if (optional.length > 0) {\n        const optionalLines = optional.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n        out +=\n            `\\n\\nOptional fields you may add to this rule (omit if not needed):\\n` +\n            `${optionalLines.join(',\\n')}`;\n    }\n    out += rolloutTip(schema);\n    return out;\n}\n\n/**\n * A config key under rules/hookGuards that the RUNNING validator has no schema for (and no rulesDir is set\n * to supply custom rules). THE FALLBACK: it fires for any name the table in retired-config-keys.ts does not\n * know, which very much includes RETIRED names on a tree whose validator predates the retirement — the\n * ordinary linked-worktree layout, where the worktree is on one release and the parent checkout that\n * supplies the hook's resolution is on an older one. So this text has to be useful with NO table entry.\n *\n * DELETION LEADS, and it is not a hedge. A key the running validator has no schema for controls nothing:\n * every code path that would read it is keyed off the schema. Leaving it is dead config that reads as live\n * config, and for a retired key deleting it is the entire fix.\n *\n * This message used to lead with `pnpm install` instead, on the theory that the key might be valid and the\n * validator merely stale. Two things are wrong with that. First, it CONTRADICTED the banner this error is\n * printed inside, which states outright that `pnpm install` cannot help — one output, two opposite orders.\n * Second, the premise is already handled upstream: the shim's version-drift guard compares the pin against\n * the installed version and denies every tool call BEFORE exec'ing this validator, with its own message and\n * its own cure. If this text is on screen, that guard found no drift. The pin therefore appears here only as\n * a secondary note, so a valid-but-newer key is never dropped without the reader being told the case exists.\n */\nfunction unknownRuleError(ruleName: string): string {\n    return (\n        `[${ruleName}] Unknown rule — the running @webpieces validator has no schema for it, and no ` +\n        `\"rulesDir\" is configured to supply custom rules. A key no validator knows controls NOTHING, so ` +\n        `DELETE the \"${ruleName}\" key from webpieces.config.json — run \\`${PRUNE_UNKNOWN_COMMAND}\\` to ` +\n        `strip it (and every other unknown key) mechanically. It may be RETIRED: a newer release can move ` +\n        `a setting out of this file entirely, in which case deleting the key here is the WHOLE fix. ` +\n        `MACHINE-LOCAL settings in particular now live in ~/.webpieces/config.json under \"experimental\" — ` +\n        `an optional file tracked by no repo, whose absence is the default behaviour — so if ` +\n        `\"${ruleName}\" is one of those, delete it here and set it there. Secondary, and rare: a key is ` +\n        `valid-but-unlearned when package.json pins an @webpieces OLDER than this config was written for, ` +\n        `and the version-drift guard reports THAT separately with its own cure (bump the pin) before this ` +\n        `validator ever runs — so it is not what you are looking at.`\n    );\n}\n\n// Fields we DELETED from a rule's schema, keyed by \"<rule>.<field>\". The generic unknown-field error\n// (\"Unknown field ... Valid fields: [...]\") is correct but doesn't say WHY the field vanished, so an AI\n// might re-add it. These hints explain the removal so the only action left is to delete the key.\nconst RETIRED_FIELD_HINTS: Record<string, string> = {\n    'runtime-architecture.servicePaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json (apiRelations + project roles). Delete it.',\n    'runtime-architecture.apiProjectPaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json, so there is NO list of api libs to maintain. Delete it (do not ' +\n        'enumerate api libs and do not replace it with a glob).',\n    // The two per-guard command strings, deleted as SECOND SPELLINGS of commands.guardHints. They were\n    // read at the point of use, so they BEAT the commands section — which made guardHintsWhy's promise\n    // (\"rename a gated command here and every guard message follows\") false for any repo that set them.\n    // Keyed on the new policy key, since that is the entry a consumer's field now sits inside.\n    'pr-lifecycle-guard.upsertPrCommand':\n        'This field was removed. The command the push/PR-creation block prints lives in ONE place: ' +\n        '\"commands\": { \"guardHints\": { \"prCreationOrPush\": <value> } }. Move your value there and delete ' +\n        'this key.',\n    'pr-lifecycle-guard.mergeCompleteCommand':\n        'This field was removed. The command the unfinished-merge block prints lives in ONE place: ' +\n        '\"commands\": { \"guardHints\": { \"mergeInProgress\": <value> } }. Move your value there and delete ' +\n        'this key.',\n};\n\n// Universal field renames (apply to EVERY rule/guard AND every match-rule, unlike the per-rule\n// RETIRED_FIELD_HINTS). When an entry still uses the old escape-hatch name, the generic unknown-field\n// error is replaced with a precise \"renamed to X — rename it\" instruction so the fix is mechanical.\nconst RENAMED_FIELD_ALIASES: Record<string, string> = {\n    ignoreModifiedUntilEpoch: 'turnOffRuleUntilEpoch',\n    ignoreRuleWhileOnBranch: 'turnOffRuleWhileOnBranch',\n};\n\n\n// The renamed-field message shared by keyed rules and match-rules.\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction renamedFieldError(scope: string, oldKey: string, newKey: string): string {\n    return `${scope} Unknown field \"${oldKey}\" — it was renamed to \"${newKey}\". Rename it (the value carries over unchanged; for the branch hatch, use null when there is no branch).`;\n}\n\n/**\n * Field-level errors for ONE configured rule entry: unknown/renamed/retired keys, type and enum\n * mismatches, and the two-week cap on turnOffRuleUntilEpoch.\n *\n * Extracted out of validateWebpiecesConfig purely so that function stays inside max-method-lines; it is\n * the same checks in the same order.\n */\n// webpieces-disable no-any-unknown -- one config entry as opaque JSON; every field is typed-checked below\n// webpieces-disable no-function-outside-class -- module-scope validator helper, matching every other check in this file\nfunction fieldErrors(ruleName: string, entry: Record<string, unknown>, schema: Record<string, FieldDef>): string[] {\n    const errors: string[] = [];\n    for (const [key, value] of Object.entries(entry)) {\n        const fieldDef = schema[key];\n        if (!fieldDef) {\n            const renamedTo = RENAMED_FIELD_ALIASES[key];\n            if (renamedTo) {\n                errors.push(renamedFieldError(`[${ruleName}]`, key, renamedTo));\n                continue;\n            }\n            const retiredHint = RETIRED_FIELD_HINTS[`${ruleName}.${key}`];\n            const suffix = retiredHint ? ` ${retiredHint}` : '';\n            errors.push(`[${ruleName}] Unknown field \"${key}\". Valid fields: [${Object.keys(schema).join(', ')}].${suffix}`);\n            continue;\n        }\n        // A nullable field (e.g. turnOffRuleWhileOnBranch) accepts JSON null in addition to its type.\n        if (value === null && fieldDef.nullable) continue;\n        if (fieldDef.type === 'string[]') {\n            if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))\n                errors.push(`[${ruleName}] \"${key}\" must be string[], got ${typeof value}.`);\n        } else if (typeof value !== fieldDef.type) {\n            errors.push(`[${ruleName}] \"${key}\" must be ${fieldDef.type}, got ${typeof value}.`);\n        } else if (fieldDef.enumValues && !fieldDef.enumValues.includes(value as string)) {\n            errors.push(`[${ruleName}] \"${key}\" = \"${value}\" is not valid. Must be one of: ${fieldDef.enumValues.join(', ')}.`);\n        } else if (key === 'turnOffRuleUntilEpoch') {\n            const capError = epochCapError(`[${ruleName}]`, value as number);\n            if (capError) errors.push(capError);\n        }\n    }\n    return errors;\n}\n\n// webpieces-disable no-any-unknown -- rawRules values are opaque JSON; each field is validated individually\nexport function validateWebpiecesConfig(\n    rawRules: Record<string, Record<string, unknown>>,\n    hasCustomRulesDir: boolean = false,\n): string[] {\n    const errors: string[] = [];\n\n    // Check field-level correctness for rules that are present\n    for (const [ruleName, entry] of Object.entries(rawRules)) {\n        const schema = RULE_SCHEMAS[ruleName];\n        if (!schema) {\n            // A name we KNOW is retired beats the generic unknown-rule message, because only the table\n            // knows WHERE the setting went — a rename carries its value over, and a bare \"delete it\"\n            // would throw that value away. It fires even when a rulesDir is set, because a custom rule\n            // must not reuse a retired name.\n            const retired = retiredRuleFor(ruleName);\n            if (retired) {\n                errors.push(retiredKeyError(retired));\n                continue;\n            }\n            // No built-in schema. With no rulesDir there are no custom rules, so this key is a\n            // dead/typo'd entry — tell the AI to remove it (a removed rule like no-shell-substitution\n            // lingers here otherwise). With a rulesDir it may be a legitimate custom rule → skip.\n            if (!hasCustomRulesDir) errors.push(unknownRuleError(ruleName));\n            continue;\n        }\n        errors.push(...fieldErrors(ruleName, entry, schema));\n        // Required fields must actually be present. Until now the loop above only checked\n        // fields that WERE present, so an entry like `{}` (or one missing `mode` /\n        // `turnOffRuleUntilEpoch`) slipped through. Every non-optional schema field is mandatory.\n        for (const [key, fieldDef] of Object.entries(schema)) {\n            if (!fieldDef.optional && !(key in entry)) {\n                errors.push(`[${ruleName}] Missing required field \"${key}\". Add ${key}: ${valueHint(fieldDef, key)}.`);\n            }\n        }\n    }\n\n    // Every built-in rule must be explicitly configured — no silent defaults.\n    // When a new rule is added to the framework, this check surfaces it immediately\n    // with a ready-to-copy snippet so AI can configure it in one pass.\n    for (const [ruleName, schema] of Object.entries(RULE_SCHEMAS)) {\n        if (!(ruleName in rawRules)) {\n            errors.push(missingRuleSnippet(ruleName, schema));\n        }\n    }\n\n    return errors;\n}\n\nconst PR_GATE_MODES = ['ON', 'OFF'] as const;\n// Optional — omitted means DETECT. Kept inline (like prGateExample) to avoid a load-config ↔\n// pr-gate-config import cycle; the canonical list + semantics live in pr-gate-config.ts.\nconst PR_GATE_MERGE_MODES = ['AUTO', 'NONE'] as const;\n\n// Spelled out because the choice is a POLICY decision with a consequence the chooser cannot see:\n// only the AUTO path can put the compact risk/flags body in main's history, because a UI merge is\n// composed from the repo's squash_merge_commit_title/message settings, which the tooling pins.\nconst MERGE_MODE_HELP = (\n        `Must be one of: ${PR_GATE_MERGE_MODES.join(', ')}.\\n` +\n        `  \"AUTO\" — wp-finish-upsert-pr lands the PR: it squash-merges when mergeable, else enables\\n` +\n        `           GitHub auto-merge, both with an explicit --subject/--body-file so main's history\\n` +\n        `           gets the PR title + the compact risk/flags body. Needs allow_auto_merge on the repo\\n` +\n        `           (gh api repos/{owner}/{repo} --jq .allow_auto_merge).\\n` +\n        `  \"NONE\" — wp-finish-upsert-pr only opens/updates the PR; a human merges it, and that still\\n` +\n        `           lands the compact body: the PR DESCRIPTION *is* that body, and stage \\u2462 keeps the repo's\\n` +\n        `           squash_merge_commit_title/message pinned to PR_TITLE/PR_BODY so a UI merge copies it\\n` +\n        `           verbatim (SquashSettingsEnforcer). Nothing to set by hand.`\n);\n\n// Copy-paste example for the top-level `pr-gate` block (sibling of `rules`). Kept inline rather\n// than imported from pr-gate-config.ts to avoid a load-config ↔ pr-gate-config import cycle.\nfunction prGateExample(): string {\n    return (\n        `  \"pr-gate\": {\\n` +\n        `    \"mode\": \"ON\",\\n` +\n        `    \"buildCommand\": \"<command CI runs to validate a PR, e.g. pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)>\",\\n` +\n        `    \"gates\": [\\n` +\n        `      { \"name\": \"API Changed\", \"patterns\": [\"libraries/apis/**\", \"**/*Api.ts\"], \"warningColor\": \"yellow\" }\\n` +\n        `    ],\\n` +\n        `    \"checklists\": [   // OPTIONAL — per-area review, one distinct reviewer subagent each\\n` +\n        `      { \"subagent\": \"db-migration-reviewer\", \"doc\": \".claude/review/db-migrations.md\", \"patterns\": [\"**/*.sql\"] }\\n` +\n        `    ]\\n` +\n        `  }`\n    );\n}\n\n// The `gates` array: dashboard-only warning flags. Extracted from validatePrGateSection to keep that\n// method inside the length limit.\n// webpieces-disable no-any-unknown -- `value` is the opaque consumer `gates` value until narrowed here\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction validateGatesSection(value: unknown): string[] {\n    if (!Array.isArray(value)) {\n        return [`[pr-gate] \"gates\" must be an array of { name, patterns, warningColor, disabled? }.`];\n    }\n    const errors: string[] = [];\n    for (let i = 0; i < value.length; i += 1) {\n        errors.push(...validateGate(value[i], i));\n    }\n    return errors;\n}\n\n// webpieces-disable no-any-unknown -- one gate entry from opaque consumer JSON, validated field-by-field\nfunction validateGate(gate: unknown, index: number): string[] {\n    if (typeof gate !== 'object' || gate === null) {\n        return [`[pr-gate] gates[${index}] must be an object { name, patterns, warningColor, disabled? }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque gate object from consumer JSON\n    const g = gate as Record<string, unknown>;\n    const errors: string[] = [];\n    if (typeof g['name'] !== 'string') errors.push(`[pr-gate] gates[${index}].name must be a string.`);\n    if (!Array.isArray(g['patterns']) || !g['patterns'].every(p => typeof p === 'string'))\n        errors.push(`[pr-gate] gates[${index}].patterns must be string[].`);\n    if (g['warningColor'] === undefined)\n        errors.push(`[pr-gate] gates[${index}].warningColor is required — set it to \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    else if (g['warningColor'] !== 'yellow' && g['warningColor'] !== 'red')\n        errors.push(`[pr-gate] gates[${index}].warningColor must be \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    if (g['disabled'] !== undefined && typeof g['disabled'] !== 'boolean')\n        errors.push(`[pr-gate] gates[${index}].disabled must be a boolean (example/inactive gate kept in the file).`);\n    return errors;\n}\n\n/**\n * Validate the top-level `pr-gate` section. It is REQUIRED (a client that opts out sets mode \"OFF\").\n * `buildCommand` is required unless mode is \"OFF\". Returns human-readable, copy-paste-friendly errors\n * — never throws. The pr-gate block lives outside the FieldDef-driven `rules` schema because its\n * nested `gates`/`checklists` arrays can't be expressed there, so they get structural validation here.\n * `repoRoot` (when known) lets the `checklists[].docs` existence check run.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validatePrGateSection(section: unknown, repoRoot?: string): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[pr-gate] Not configured in webpieces.config.json. Add this block under the \"commands\" ` +\n            `section (set \"mode\": \"OFF\" to opt out):\\n\\n${prGateExample()}`,\n        ];\n    }\n    if (typeof section !== 'object' || Array.isArray(section)) {\n        return [`[pr-gate] Must be an object. Example:\\n\\n${prGateExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque pr-gate section from consumer JSON\n    const s = section as Record<string, unknown>;\n    const errors: string[] = [];\n\n    if (!('mode' in s)) {\n        errors.push(`[pr-gate] Missing required field \"mode\". Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    } else if (typeof s['mode'] !== 'string' || !PR_GATE_MODES.includes(s['mode'] as typeof PR_GATE_MODES[number])) {\n        errors.push(`[pr-gate] \"mode\" = \"${String(s['mode'])}\" is not valid. Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    }\n\n    // buildCommand and mergeMode are both required whenever the gate is active (mode !== OFF). There\n    // is deliberately NO default for mergeMode: whether the tooling may land your PRs is a policy\n    // decision, and either guess is wrong for somebody.\n    if (s['mode'] !== 'OFF') {\n        const cmd = s['buildCommand'];\n        if (typeof cmd !== 'string' || cmd.trim() === '') {\n            errors.push(\n                `[pr-gate] Missing required field \"buildCommand\" — the command CI runs to validate a PR. ` +\n                `Add e.g. \"buildCommand\": \"pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)\".`,\n            );\n        }\n        const mm = s['mergeMode'];\n        if (!('mergeMode' in s)) {\n            errors.push(`[pr-gate] Missing required field \"mergeMode\". ${MERGE_MODE_HELP}`);\n        } else if (typeof mm !== 'string' || !PR_GATE_MERGE_MODES.includes(mm as typeof PR_GATE_MERGE_MODES[number])) {\n            errors.push(`[pr-gate] \"mergeMode\" = \"${String(mm)}\" is not valid. ${MERGE_MODE_HELP}`);\n        }\n    }\n\n    if ('gates' in s) errors.push(...validateGatesSection(s['gates']));\n\n    // Optional extension point: company review checklists, as an ARRAY right here in the config. Absent ⇒\n    // none. The removed { doc } manifest shape is rejected with the exact migration edit.\n    if ('checklists' in s) errors.push(...validateChecklistsSection(s['checklists'], repoRoot));\n\n    // Optional server-token salt. Absent ⇒ no token minted, CI enforcement is a no-op. Present ⇒ must be\n    // a non-empty string (an empty salt would mint a token anyone can forge from a known-empty secret).\n    if ('gateSalt' in s) {\n        const salt = s['gateSalt'];\n        if (typeof salt !== 'string' || salt.trim() === '') {\n            errors.push(`[pr-gate] \"gateSalt\" must be a non-empty string — it is the shared secret the gate token is HMAC'd with. Omit the key entirely to disable server-side token enforcement.`);\n        }\n    }\n\n    // Optional: what happens to the LOCAL branch once its PR lands. Absent ⇒ \"archive-tag\".\n    if ('landPr' in s) errors.push(...validateLandPrSection(s['landPr']));\n\n    // Optional: where wp-push-dev publishes the disposable copy. Absent ⇒ \"dev-include\" / \"dev\".\n    if ('devDeploy' in s) errors.push(...validateDevDeploySection(s['devDeploy']));\n\n    errors.push(...validateNoGateSaltRationale(s));\n\n    // Optional: publish reviewer output as a PR comment (defaults true). Must be a boolean when present.\n    if ('checklistComments' in s && typeof s['checklistComments'] !== 'boolean') {\n        errors.push(`[pr-gate] \"checklistComments\" must be a boolean (defaults to true; set false to keep the PR body-only).`);\n    }\n\n    return errors;\n}\n\nfunction excludePathsExample(): string {\n    return '\"excludePaths\": [\"repositories/**\"]';\n}\n\n// A glob list: must be a string[] (may be empty). `key` names it for the error.\n// webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed here\nfunction validateExcludeList(value: unknown, key: string): string[] {\n    if (!(Array.isArray(value) && value.every(p => typeof p === 'string'))) {\n        return [`[excludePaths] \"${key}\" must be a string[] of glob paths (use [] for none).`];\n    }\n    return [];\n}\n\n/**\n * Validate the REQUIRED top-level `excludePaths` block: ONE glob list suppressing hook enforcement per\n * file path, for code-style rules and file-scoped guards alike. Required so every client upgrading is\n * forced to declare it (as [] to keep today's behavior, or with real paths). Returns copy-paste\n * friendly errors and never throws — same contract as validatePrGateSection.\n *\n * The two-list object form `{ \"rules\": [...], \"guards\": [...] }` is RETIRED, not tolerated. It used to be\n * accepted and silently unioned, which is why this repo's own config sat on the dead shape for releases: an\n * accepted shape is never migrated. Rejecting it cannot wedge a consumer — editing webpieces.config.json is\n * always permitted, even while it is invalid. See retired-config-keys.ts.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateExcludePaths(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[excludePaths] Not configured in webpieces.config.json. Add this REQUIRED block ` +\n            `(use an empty array to keep enforcing everywhere):\\n\\n  ${excludePathsExample()}`,\n        ];\n    }\n    if (Array.isArray(section)) return validateExcludeList(section, 'excludePaths');\n    if (typeof section !== 'object') {\n        return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque excludePaths section from consumer JSON\n    const s = section as Record<string, unknown>;\n    // The retired two-list object. One table row owns the message for either key present.\n    const retired = retiredEntry('rules', '[excludePaths]');\n    if (retired && (s['rules'] !== undefined || s['guards'] !== undefined)) {\n        return [`${retiredKeyError(retired)}\\n\\n  ${excludePathsExample()}`];\n    }\n    return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n}\n\n// ---------------------------------------------------------------------------\n// match-rules — a new top-level ARRAY section (parallel to pr-gate/excludePaths). Each entry is a\n// client-authored content guard (raw-regex patterns + message + scoping). Validated structurally here\n// the same way pr-gate's `gates` are, because an array of objects can't be expressed in FieldDef schema.\n// ---------------------------------------------------------------------------\n\nfunction matchRulesExample(): string {\n    return `\"match-rules\": ${JSON.stringify(DEFAULT_MATCH_RULES, null, 4)}`;\n}\n\n// webpieces-disable no-any-unknown -- generic type guard over an opaque JSON value\nfunction isStringArray(value: unknown): value is string[] {\n    return Array.isArray(value) && value.every(v => typeof v === 'string');\n}\n\n// Compile a pattern to validate it; returns the error message, or undefined when it compiles.\nfunction regexError(pattern: string): string | undefined {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Constructed only to validate the syntax; the object is intentionally discarded.\n        void new RegExp(pattern);\n        return undefined;\n    } catch (err: unknown) {\n        const error = toError(err);\n        return error.message;\n    }\n}\n\n// One entry of the match-rules array, validated field-by-field (see validateGate for the pattern).\n// webpieces-disable no-any-unknown -- one match-rule entry from opaque consumer JSON, validated field-by-field\nfunction validateMatchRule(entry: unknown, index: number): string[] {\n    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {\n        return [`[match-rules] entry[${index}] must be an object { name, patterns, mainMessage, mode, turnOffRuleUntilEpoch, turnOffRuleWhileOnBranch, ... }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque match-rule entry from consumer JSON\n    const e = entry as Record<string, unknown>;\n    const label = typeof e['name'] === 'string' ? `\"${e['name']}\"` : `entry[${index}]`;\n    const errors: string[] = [];\n\n    if (typeof e['name'] !== 'string' || e['name'].trim() === '')\n        errors.push(`[match-rules] entry[${index}].name must be a non-empty string (it is the disable token and report label).`);\n\n    if (!isStringArray(e['patterns']) || e['patterns'].length === 0) {\n        errors.push(`[match-rules] ${label}.patterns must be a non-empty string[] of regexes.`);\n    } else {\n        e['patterns'].forEach((p: string, pi: number) => {\n            const rxErr = regexError(p);\n            if (rxErr) errors.push(`[match-rules] ${label}.patterns[${pi}] is not a valid regex: ${rxErr}`);\n        });\n    }\n\n    if (typeof e['mainMessage'] !== 'string' || e['mainMessage'].trim() === '')\n        errors.push(`[match-rules] ${label}.mainMessage must be a non-empty string.`);\n\n    if (typeof e['mode'] !== 'string' || !MODIFIED_CODE_MODES.includes(e['mode'] as typeof MODIFIED_CODE_MODES[number]))\n        errors.push(`[match-rules] ${label}.mode must be one of: ${MODIFIED_CODE_MODES.join(', ')}.`);\n\n    // Both escape hatches are REQUIRED on every match-rule too (same as keyed rules), so they are always\n    // visible. turnOffRuleUntilEpoch: number (0 = active; a future unix-epoch in seconds = temporarily\n    // off). turnOffRuleWhileOnBranch: string | null (null = always on; an EXACT branch name — matched\n    // with ===, never as a glob — disables the rule while that branch is checked out).\n    if (typeof e['turnOffRuleUntilEpoch'] !== 'number') {\n        errors.push(`[match-rules] ${label}.turnOffRuleUntilEpoch must be a number (0 = active; future unix-epoch seconds = temporarily off).`);\n    } else {\n        const capError = epochCapError(`[match-rules] ${label}`, e['turnOffRuleUntilEpoch']);\n        if (capError) errors.push(capError);\n    }\n    if (!(e['turnOffRuleWhileOnBranch'] === null || typeof e['turnOffRuleWhileOnBranch'] === 'string'))\n        errors.push(`[match-rules] ${label}.turnOffRuleWhileOnBranch must be a string or null (null = no branch / always on; a string is an EXACT branch name, globs are not supported).`);\n\n    // The old escape-hatch names were renamed — flag them precisely.\n    for (const oldKey of Object.keys(RENAMED_FIELD_ALIASES)) {\n        if (oldKey in e) errors.push(renamedFieldError(`[match-rules] ${label}`, oldKey, RENAMED_FIELD_ALIASES[oldKey]));\n    }\n\n    if (e['options'] !== undefined && !isStringArray(e['options']))\n        errors.push(`[match-rules] ${label}.options must be a string[] (omit if not needed).`);\n    if (e['allowedPaths'] !== undefined && !isStringArray(e['allowedPaths']))\n        errors.push(`[match-rules] ${label}.allowedPaths must be a string[] of globs (omit if not needed).`);\n    if (e['disableAllowed'] !== undefined && typeof e['disableAllowed'] !== 'boolean')\n        errors.push(`[match-rules] ${label}.disableAllowed must be a boolean.`);\n\n    return errors;\n}\n\n/**\n * Validate the REQUIRED top-level `match-rules` array (client-authored content guards). MISSING →\n * one error printing the ready-to-paste `no-fetch` example (add at least this; more can follow).\n * Present-but-`[]` → allowed (a conscious opt-out, matching pr-gate mode:OFF / excludePaths []).\n * Otherwise every entry is validated field-by-field (each regex compile-checked) plus name\n * uniqueness. Copy-paste-friendly errors; never throws — same contract as validatePrGateSection.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateMatchRulesSection(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[match-rules] Not configured in webpieces.config.json. Add this REQUIRED top-level array — ` +\n            `seed it with the no-fetch guard below (you can add more entries: no-moment, no-lodash-chain, …):\\n\\n${matchRulesExample()}`,\n        ];\n    }\n    if (!Array.isArray(section)) {\n        return [`[match-rules] Must be an array of content-guard objects. Example:\\n\\n${matchRulesExample()}`];\n    }\n\n    const errors: string[] = [];\n    const seen = new Set<string>();\n    for (let i = 0; i < section.length; i += 1) {\n        errors.push(...validateMatchRule(section[i], i));\n        // webpieces-disable no-any-unknown -- reading the name off an opaque entry only to dedupe\n        const name = (section[i] as Record<string, unknown> | null)?.['name'];\n        if (typeof name === 'string') {\n            if (seen.has(name)) errors.push(`[match-rules] duplicate entry name \"${name}\" — each match-rule name must be unique.`);\n            seen.add(name);\n        }\n    }\n    return errors;\n}\n\n/**\n * Enforce that each built-in lives in its correct section: code rules under `rules`, bash guards\n * under `hookGuards`. A guard left in `rules` (or a rule placed in `hookGuards`) is reported with a\n * \"move it\" message so the split stays clean. Unknown/custom names are ignored (they may be custom\n * rules from rulesDir). Presence (\"every built-in must be configured\") is checked separately by\n * validateWebpiecesConfig against the merged map.\n */\n// webpieces-disable no-any-unknown -- section maps are opaque consumer JSON\nexport function validateSectionPlacement(\n    rulesSection: Record<string, Record<string, unknown>>,\n    hookGuardsSection: Record<string, Record<string, unknown>>,\n): string[] {\n    const errors: string[] = [];\n    for (const name of Object.keys(rulesSection)) {\n        if (isHookGuard(name)) {\n            errors.push(\n                `[${name}] is a hook guard and ${SECTION_PLACEMENT_MARKER} \"hookGuards\" section, not \"rules\". ` +\n                `Move it.`,\n            );\n        }\n    }\n    for (const name of Object.keys(hookGuardsSection)) {\n        // Only flag KNOWN code rules misplaced into hookGuards; unknown names may be custom rules.\n        if (!isHookGuard(name) && RULE_SCHEMAS[name]) {\n            errors.push(\n                `[${name}] is a code rule and ${SECTION_PLACEMENT_MARKER} \"rules\" section, not \"hookGuards\". ` +\n                `Move it.`,\n            );\n        }\n    }\n    return errors;\n}\n"]}
+{"version":3,"file":"validate-config.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/validate-config.ts"],"names":[],"mappings":";;;AA6OA,0DA8CC;AAmFD,sDAoEC;AA2BD,oDAmBC;AA+FD,8DAuBC;AAUD,4DAuBC;AApnBD,wGAAwG;AACxG,kFAAkF;AAClF,+DAAiE;AACjE,yCAAyD;AACzD,iDAA4D;AAC5D,6CAAqE;AACrE,iDAAqD;AACrD,6EAAuJ;AAK9I,0GALA,sDAAyB,OAKA;AAJlC,+DAAsF;AACtF,2CAAoD;AAIpD,yFAAyF;AACzF,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AACrB,2CAA6F;AAApF,iHAAA,mBAAmB,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AACtE,6DAA2D;AAC3D,yCAAqC;AAErC;;;;;;;;;;GAUG;AACU,QAAA,uBAAuB,GAAG,CAAC,CAAC;AAEzC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAErC;;;;;;GAMG;AACH,wHAAwH;AACxH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,+BAAuB,GAAG,eAAe,CAAC;IAC3F,IAAI,KAAK,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CACH,GAAG,KAAK,6BAA6B,KAAK,OAAO,OAAO,uCAAuC;QAC/F,GAAG,+BAAuB,yEAAyE;QACnG,oFAAoF;QACpF,6BAA6B,QAAQ,KAAK,OAAO,8CAA8C;QAC/F,kGAAkG;QAClG,iGAAiG;QACjG,SAAS,CACZ,CAAC;AACN,CAAC;AAED,SAAS,SAAS,CAAC,GAAa,EAAE,GAAY;IAC1C,oGAAoG;IACpG,oGAAoG;IACpG,IAAI,GAAG,KAAK,uBAAuB;QAAE,OAAO,8DAA8D,CAAC;IAC3G,IAAI,GAAG,KAAK,0BAA0B;QAAE,OAAO,gHAAgH,CAAC;IAChK,OAAO,GAAG,CAAC,UAAU;QACjB,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;QACnC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB;YAC/C,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAG,CAAC,CAAC,UAAU;gBACtC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAE,CAAC,CAAC,WAAW;oBACvC,CAAC,CAAC,YAAY,CAAC;AACvB,CAAC;AAED,yGAAyG;AACzG,SAAS,UAAU,CAAC,MAAgC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;IAC/C,iGAAiG;IACjG,8FAA8F;IAC9F,MAAM,WAAW,GAAG,IAAA,mCAAsB,EAAC,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,IAAA,0BAAa,EAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,CACH,2CAA2C,WAAW,mCAAmC;QACzF,4FAA4F;QAC5F,4CAA4C,MAAM,EAAE,CACvD,CAAC;AACN,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,MAAgC;IAC1E,+EAA+E;IAC/E,oGAAoG;IACpG,yGAAyG;IACzG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,GACH,IAAI,QAAQ,qEAAqE,OAAO,aAAa;QACrG,mDAAmD;QACnD,MAAM,QAAQ,SAAS,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAE5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,GAAG;YACC,sEAAsE;gBACtE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACtC,OAAO,CACH,IAAI,QAAQ,iFAAiF;QAC7F,iGAAiG;QACjG,eAAe,QAAQ,4CAA4C,iCAAqB,QAAQ;QAChG,mGAAmG;QACnG,6FAA6F;QAC7F,mGAAmG;QACnG,sFAAsF;QACtF,IAAI,QAAQ,oFAAoF;QAChG,mGAAmG;QACnG,mGAAmG;QACnG,6DAA6D,CAChE,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,wGAAwG;AACxG,iGAAiG;AACjG,MAAM,mBAAmB,GAA2B;IAChD,mCAAmC,EAC/B,8FAA8F;QAC9F,2EAA2E;IAC/E,sCAAsC,EAClC,8FAA8F;QAC9F,iGAAiG;QACjG,wDAAwD;IAC5D,oCAAoC,EAChC,iGAAiG;QACjG,+FAA+F;QAC/F,wFAAwF;QACxF,8FAA8F;QAC9F,6EAA6E;IACjF,mGAAmG;IACnG,mGAAmG;IACnG,oGAAoG;IACpG,2FAA2F;IAC3F,oCAAoC,EAChC,4FAA4F;QAC5F,kGAAkG;QAClG,WAAW;IACf,yCAAyC,EACrC,4FAA4F;QAC5F,iGAAiG;QACjG,WAAW;CAClB,CAAC;AAEF,+FAA+F;AAC/F,sGAAsG;AACtG,oGAAoG;AACpG,MAAM,qBAAqB,GAA2B;IAClD,wBAAwB,EAAE,uBAAuB;IACjD,uBAAuB,EAAE,0BAA0B;CACtD,CAAC;AAGF,mEAAmE;AACnE,8GAA8G;AAC9G,SAAS,iBAAiB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;IACpE,OAAO,GAAG,KAAK,mBAAmB,MAAM,0BAA0B,MAAM,0GAA0G,CAAC;AACvL,CAAC;AAED;;;;;;GAMG;AACH,0GAA0G;AAC1G,wHAAwH;AACxH,SAAS,WAAW,CAAC,QAAgB,EAAE,KAA8B,EAAE,MAAgC;IACnG,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,SAAS,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,QAAQ,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;gBAChE,SAAS;YACb,CAAC;YACD,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,oBAAoB,GAAG,qBAAqB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;YACjH,SAAS;QACb,CAAC;QACD,8FAA8F;QAC9F,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ;YAAE,SAAS;QAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,2BAA2B,OAAO,KAAK,GAAG,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,aAAa,QAAQ,CAAC,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,GAAG,QAAQ,KAAK,mCAAmC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxH,CAAC;aAAM,IAAI,GAAG,KAAK,uBAAuB,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,QAAQ,GAAG,EAAE,KAAe,CAAC,CAAC;YACjE,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,4GAA4G;AAC5G,SAAgB,uBAAuB,CACnC,QAAiD,EACjD,oBAA6B,KAAK;IAElC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,2DAA2D;IAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,2BAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,2FAA2F;YAC3F,yFAAyF;YACzF,2FAA2F;YAC3F,iCAAiC;YACjC,MAAM,OAAO,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,IAAA,qCAAe,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtC,SAAS;YACb,CAAC;YACD,mFAAmF;YACnF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,CAAC,iBAAiB;gBAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChE,SAAS;QACb,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,kFAAkF;QAClF,2EAA2E;QAC3E,0FAA0F;QAC1F,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,6BAA6B,GAAG,UAAU,GAAG,KAAK,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3G,CAAC;QACL,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,gFAAgF;IAChF,mEAAmE;IACnE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,2BAAY,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;AAC7C,6FAA6F;AAC7F,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAEtD,iGAAiG;AACjG,kGAAkG;AAClG,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAChB,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;IACtD,8FAA8F;IAC9F,+FAA+F;IAC/F,kGAAkG;IAClG,oEAAoE;IACpE,+FAA+F;IAC/F,2GAA2G;IAC3G,mGAAmG;IACnG,uEAAuE,CAC9E,CAAC;AAEF,gGAAgG;AAChG,6FAA6F;AAC7F,SAAS,aAAa;IAClB,OAAO,CACH,kBAAkB;QAClB,qBAAqB;QACrB,0IAA0I;QAC1I,kBAAkB;QAClB,8GAA8G;QAC9G,UAAU;QACV,4FAA4F;QAC5F,qHAAqH;QACrH,SAAS;QACT,KAAK,CACR,CAAC;AACN,CAAC;AAED,qGAAqG;AACrG,kCAAkC;AAClC,uGAAuG;AACvG,8GAA8G;AAC9G,SAAS,oBAAoB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,oFAAoF,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAa,EAAE,KAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,mBAAmB,KAAK,kEAAkE,CAAC,CAAC;IACxG,CAAC;IACD,0FAA0F;IAC1F,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,0BAA0B,CAAC,CAAC;IACnG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS;QAC/B,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oGAAoG,CAAC,CAAC;SACzI,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,KAAK;QAClE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,oFAAoF,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS;QACjE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,wEAAwE,CAAC,CAAC;IAClH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,8GAA8G;AAC9G,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,QAAiB;IACrE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,yFAAyF;gBACzF,8CAA8C,aAAa,EAAE,EAAE;SAClE,CAAC;IACN,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,4CAA4C,aAAa,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,4DAA4D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAiC,CAAC,EAAE,CAAC;QAC7G,MAAM,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mCAAmC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC;IAED,iGAAiG;IACjG,8FAA8F;IAC9F,oDAAoD;IACpD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACP,0FAA0F;gBAC1F,oGAAoG,CACvG,CAAC;QACN,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,iDAAiD,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAwC,CAAC,EAAE,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,EAAE,CAAC,mBAAmB,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,IAAI,OAAO,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnE,sGAAsG;IACtG,sFAAsF;IACtF,IAAI,YAAY,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,sDAAyB,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE5F,qGAAqG;IACrG,oGAAoG;IACpG,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,0KAA0K,CAAC,CAAC;QAC5L,CAAC;IACL,CAAC;IAED,wFAAwF;IACxF,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,kDAAqB,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEtE,6FAA6F;IAC7F,IAAI,WAAW,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,qDAAwB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAE/E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,wDAA2B,EAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,qGAAqG;IACrG,IAAI,mBAAmB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;IAC3H,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB;IACxB,OAAO,qCAAqC,CAAC;AACjD,CAAC;AAED,gFAAgF;AAChF,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,KAAc,EAAE,GAAW;IACpD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,mBAAmB,GAAG,uDAAuD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,6FAA6F;AAC7F,SAAgB,oBAAoB,CAAC,OAAgB;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,kFAAkF;gBAClF,2DAA2D,mBAAmB,EAAE,EAAE;SACrF,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAChF,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,mGAAmG;IACnG,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,sFAAsF;IACtF,MAAM,OAAO,GAAG,IAAA,kCAAY,EAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACxD,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,IAAA,qCAAe,EAAC,OAAO,CAAC,SAAS,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,kEAAkE,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,8EAA8E;AAC9E,kGAAkG;AAClG,sGAAsG;AACtG,yGAAyG;AACzG,8EAA8E;AAE9E,SAAS,iBAAiB;IACtB,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,wCAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,OAAe;IAC/B,8DAA8D;IAC9D,IAAI,CAAC;QACD,kFAAkF;QAClF,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,SAAS,CAAC;IACrB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACzB,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,+GAA+G;AAC/G,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,uBAAuB,KAAK,kHAAkH,CAAC,CAAC;IAC5J,CAAC;IACD,+FAA+F;IAC/F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC;IACnF,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,+EAA+E,CAAC,CAAC;IAE7H,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oDAAoD,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACJ,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,aAAa,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACP,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QACtE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,0CAA0C,CAAC,CAAC;IAElF,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,kCAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAuC,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,yBAAyB,kCAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElG,qGAAqG;IACrG,mGAAmG;IACnG,kGAAkG;IAClG,mFAAmF;IACnF,IAAI,OAAO,CAAC,CAAC,uBAAuB,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oGAAoG,CAAC,CAAC;IAC5I,CAAC;SAAM,CAAC;QACJ,MAAM,QAAQ,GAAG,aAAa,CAAC,iBAAiB,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACrF,IAAI,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,0BAA0B,CAAC,KAAK,QAAQ,CAAC;QAC9F,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,+IAA+I,CAAC,CAAC;IAEvL,iEAAiE;IACjE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,KAAK,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,mDAAmD,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,iEAAiE,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC7E,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,oCAAoC,CAAC,CAAC;IAE5E,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,6FAA6F;AAC7F,SAAgB,yBAAyB,CAAC,OAAgB;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACH,6FAA6F;gBAC7F,uGAAuG,iBAAiB,EAAE,EAAE;SAC/H,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,wEAAwE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,0FAA0F;QAC1F,MAAM,IAAI,GAAI,OAAO,CAAC,CAAC,CAAoC,EAAE,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,0CAA0C,CAAC,CAAC;YACvH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,4EAA4E;AAC5E,SAAgB,wBAAwB,CACpC,YAAqD,EACrD,iBAA0D;IAE1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAA,sBAAW,EAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,yBAAyB,8CAAwB,sCAAsC;gBAC/F,UAAU,CACb,CAAC;QACN,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,2FAA2F;QAC3F,IAAI,CAAC,IAAA,sBAAW,EAAC,IAAI,CAAC,IAAI,2BAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACP,IAAI,IAAI,wBAAwB,8CAAwB,sCAAsC;gBAC9F,UAAU,CACb,CAAC;QACN,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { FieldDef } from './field-def';\n// Imported, never re-typed: the banner offers the bulk migrator only for errors it actually covers, and\n// this marker is how it recognizes a placement error. See config-error-banner.ts.\nimport { SECTION_PLACEMENT_MARKER } from './config-error-banner';\nimport { sectionForRule, isHookGuard } from './sections';\nimport { RULE_SCHEMAS, allRuleNames } from './rule-schemas';\nimport { recommendedSeedModeFor, isGradualMode } from './seed-entry';\nimport { MODIFIED_CODE_MODES } from './rule-configs';\nimport { validateChecklistsSection, validateDevDeploySection, validateLandPrSection, validateNoGateSaltRationale } from './pr-gate-section-validators';\nimport { retiredEntry, retiredKeyError, retiredRuleFor } from './retired-config-keys';\nimport { PRUNE_UNKNOWN_COMMAND } from './constants';\n\n// Re-exported so the isolated validate-checklist-docs target keeps importing it from here.\nexport { validateChecklistsSection };\n// Re-exported from their new homes: this module was the historical entry point for both.\nexport { allRuleNames } from './rule-schemas';\nexport { recommendedSeedMode, recommendedSeedModeFor, seedEntryForRule } from './seed-entry';\nimport { DEFAULT_MATCH_RULES } from './match-rules-config';\nimport { toError } from './to-error';\n\n/**\n * The longest a `turnOffRuleUntilEpoch` may reach into the future: ONE WEEK. Poke it again next week to\n * extend — that weekly re-set IS the intended workflow, not a workaround: it is what makes a rule that is\n * off on purpose stay a decision somebody keeps making, instead of one nobody remembers.\n *\n * DELIBERATELY ASYMMETRIC with turnOffRuleWhileOnBranch, which has NO cap and must not get one. The epoch\n * hatch is REPO-WIDE while it lasts, so a long window shelters every unrelated change that lands inside it\n * (a fleet repo was found with max-file-lines/max-method-lines switched off until 2026-10-01 — 43 days\n * out, six times this cap). The branch hatch fires only on ONE exact branch name — a big refactor\n * legitimately runs 35+ days, and capping that would only interrupt the one branch that opted in.\n */\nexport const MAX_TURN_OFF_EPOCH_DAYS = 7;\n\nconst SECONDS_PER_DAY = 24 * 60 * 60;\n\n/**\n * Reject a `turnOffRuleUntilEpoch` more than MAX_TURN_OFF_EPOCH_DAYS into the future.\n *\n * A PAST epoch is always valid: it is inert (it skips nothing), and every existing config is full of them.\n * The BOUNDARY is inclusive — exactly MAX_TURN_OFF_EPOCH_DAYS out is accepted, only strictly beyond it is\n * refused — so a config written as \"now + 7 days\" is never rejected by the second it took to save.\n */\n// webpieces-disable no-function-outside-class -- module-scope validator helper, matching every other check in this file\nfunction epochCapError(label: string, value: number): string | null {\n    const maxEpoch = Math.floor(Date.now() / 1000) + MAX_TURN_OFF_EPOCH_DAYS * SECONDS_PER_DAY;\n    if (value <= maxEpoch) return null;\n    const daysOut = Math.round((value - Date.now() / 1000) / SECONDS_PER_DAY);\n    const maxDate = new Date(maxEpoch * 1000).toISOString().split('T')[0];\n    return (\n        `${label} \"turnOffRuleUntilEpoch\": ${value} is ${daysOut} days in the future — the maximum is ` +\n        `${MAX_TURN_OFF_EPOCH_DAYS} days. A rule switched off for longer than that is off for work nobody ` +\n        `had in mind when it was written, because this hatch is REPO-WIDE while it lasts.\\n` +\n        `  CURE: set it to at most ${maxEpoch} (${maxDate}), then re-set it WEEKLY for as long as you ` +\n        `still need it — that renewal is the intended workflow, not a workaround. If the rule is off for ` +\n        `ONE branch's work, use \"turnOffRuleWhileOnBranch\": \"<exact branch name>\" instead; that one has ` +\n        `no cap.`\n    );\n}\n\nfunction valueHint(def: FieldDef, key?: string): string {\n    // The two universal escape hatches, REQUIRED on every rule so they're always visible. Spell out the\n    // \"off\" value so a fresh config seeds them in the active/no-op state (0 / null), not a placeholder.\n    if (key === 'turnOffRuleUntilEpoch') return '0  (0 = active; future unix-epoch seconds = temporarily off)';\n    if (key === 'turnOffRuleWhileOnBranch') return 'null  (null = always on; an EXACT branch name — no globs — disables the rule while that branch is checked out)';\n    return def.enumValues\n        ? `\"${def.enumValues.join(' | ')}\"`\n        : def.type === 'string[]' ? '[\"<string>\", ...]'\n        : def.type === 'number'   ? '<number>'\n        : def.type === 'boolean'  ? '<boolean>'\n        : '\"<string>\"';\n}\n\n/** A rollout hint for the copy-paste snippet: recommend the narrowest gradual mode the rule supports. */\nfunction rolloutTip(schema: Record<string, FieldDef>): string {\n    const modes = schema['mode']?.enumValues ?? [];\n    // Same source of truth as the seeder; only a GRADUAL recommendation gets the rollout prose, so a\n    // rule whose recommendation falls through to ON/RUN_EVERY_TIME/OFF prints no tip (as before).\n    const recommended = recommendedSeedModeFor(modes);\n    if (!isGradualMode(recommended)) return '';\n    const optOut = modes.includes('OFF') ? ' Set \"mode\": \"OFF\" to opt out entirely.' : '';\n    return (\n        `\\n\\n💡 Recommended: start with \"mode\": \"${recommended}\" — it enforces only on what you ` +\n        `actually change, so the rule rolls out gradually (existing code stays grandfathered until ` +\n        `you next touch that project/file/method).${optOut}`\n    );\n}\n\nfunction missingRuleSnippet(ruleName: string, schema: Record<string, FieldDef>): string {\n    // Required fields go in the copy-paste entry. The two universal escape hatches\n    // (turnOffRuleUntilEpoch / turnOffRuleWhileOnBranch) are now REQUIRED, so they land in that block —\n    // which is the whole point: every seeded rule shows both hatches. Optional fields are listed separately.\n    const fields = Object.keys(schema);\n    const required = fields.filter(f => !schema[f].optional);\n    const optional = fields.filter(f => schema[f].optional);\n\n    const requiredLines = required.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n    const section = sectionForRule(ruleName);\n    let out =\n        `[${ruleName}] Not configured in webpieces.config.json. Add this entry to the \"${section}\" section\\n` +\n        `(choose values appropriate for your project):\\n\\n` +\n        `  \"${ruleName}\": {\\n${requiredLines.join(',\\n')}\\n  }`;\n\n    if (optional.length > 0) {\n        const optionalLines = optional.map(f => `    \"${f}\": ${valueHint(schema[f], f)}`);\n        out +=\n            `\\n\\nOptional fields you may add to this rule (omit if not needed):\\n` +\n            `${optionalLines.join(',\\n')}`;\n    }\n    out += rolloutTip(schema);\n    return out;\n}\n\n/**\n * A config key under rules/hookGuards that the RUNNING validator has no schema for (and no rulesDir is set\n * to supply custom rules). THE FALLBACK: it fires for any name the table in retired-config-keys.ts does not\n * know, which very much includes RETIRED names on a tree whose validator predates the retirement — the\n * ordinary linked-worktree layout, where the worktree is on one release and the parent checkout that\n * supplies the hook's resolution is on an older one. So this text has to be useful with NO table entry.\n *\n * DELETION LEADS, and it is not a hedge. A key the running validator has no schema for controls nothing:\n * every code path that would read it is keyed off the schema. Leaving it is dead config that reads as live\n * config, and for a retired key deleting it is the entire fix.\n *\n * This message used to lead with `pnpm install` instead, on the theory that the key might be valid and the\n * validator merely stale. Two things are wrong with that. First, it CONTRADICTED the banner this error is\n * printed inside, which states outright that `pnpm install` cannot help — one output, two opposite orders.\n * Second, the premise is already handled upstream: the shim's version-drift guard compares the pin against\n * the installed version and denies every tool call BEFORE exec'ing this validator, with its own message and\n * its own cure. If this text is on screen, that guard found no drift. The pin therefore appears here only as\n * a secondary note, so a valid-but-newer key is never dropped without the reader being told the case exists.\n */\nfunction unknownRuleError(ruleName: string): string {\n    return (\n        `[${ruleName}] Unknown rule — the running @webpieces validator has no schema for it, and no ` +\n        `\"rulesDir\" is configured to supply custom rules. A key no validator knows controls NOTHING, so ` +\n        `DELETE the \"${ruleName}\" key from webpieces.config.json — run \\`${PRUNE_UNKNOWN_COMMAND}\\` to ` +\n        `strip it (and every other unknown key) mechanically. It may be RETIRED: a newer release can move ` +\n        `a setting out of this file entirely, in which case deleting the key here is the WHOLE fix. ` +\n        `MACHINE-LOCAL settings in particular now live in ~/.webpieces/config.json under \"experimental\" — ` +\n        `an optional file tracked by no repo, whose absence is the default behaviour — so if ` +\n        `\"${ruleName}\" is one of those, delete it here and set it there. Secondary, and rare: a key is ` +\n        `valid-but-unlearned when package.json pins an @webpieces OLDER than this config was written for, ` +\n        `and the version-drift guard reports THAT separately with its own cure (bump the pin) before this ` +\n        `validator ever runs — so it is not what you are looking at.`\n    );\n}\n\n// Fields we DELETED from a rule's schema, keyed by \"<rule>.<field>\". The generic unknown-field error\n// (\"Unknown field ... Valid fields: [...]\") is correct but doesn't say WHY the field vanished, so an AI\n// might re-add it. These hints explain the removal so the only action left is to delete the key.\nconst RETIRED_FIELD_HINTS: Record<string, string> = {\n    'runtime-architecture.servicePaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json (apiRelations + project roles). Delete it.',\n    'runtime-architecture.apiProjectPaths':\n        'This field was removed — it was never read. The runtime graph is derived automatically from ' +\n        'architecture/dependencies.json, so there is NO list of api libs to maintain. Delete it (do not ' +\n        'enumerate api libs and do not replace it with a glob).',\n    'runtime-architecture.allowedCycles':\n        'This field was removed — a runtime cycle is not allowable at all any more. Levelling now FAILS ' +\n        'on any cycle, because CD deploys services in dependency order and a cycle has no such order. ' +\n        'Delete the key. If a cycle genuinely cannot be broken yet, declare it PER EDGE with a ' +\n        '`cutLegacyCycle:<targetService>` nx tag on the CALLING project, which admits the debt where ' +\n        '`grep -rn cutLegacyCycle` can enumerate it — there is no config key for it.',\n    // The two per-guard command strings, deleted as SECOND SPELLINGS of commands.guardHints. They were\n    // read at the point of use, so they BEAT the commands section — which made guardHintsWhy's promise\n    // (\"rename a gated command here and every guard message follows\") false for any repo that set them.\n    // Keyed on the new policy key, since that is the entry a consumer's field now sits inside.\n    'pr-lifecycle-guard.upsertPrCommand':\n        'This field was removed. The command the push/PR-creation block prints lives in ONE place: ' +\n        '\"commands\": { \"guardHints\": { \"prCreationOrPush\": <value> } }. Move your value there and delete ' +\n        'this key.',\n    'pr-lifecycle-guard.mergeCompleteCommand':\n        'This field was removed. The command the unfinished-merge block prints lives in ONE place: ' +\n        '\"commands\": { \"guardHints\": { \"mergeInProgress\": <value> } }. Move your value there and delete ' +\n        'this key.',\n};\n\n// Universal field renames (apply to EVERY rule/guard AND every match-rule, unlike the per-rule\n// RETIRED_FIELD_HINTS). When an entry still uses the old escape-hatch name, the generic unknown-field\n// error is replaced with a precise \"renamed to X — rename it\" instruction so the fix is mechanical.\nconst RENAMED_FIELD_ALIASES: Record<string, string> = {\n    ignoreModifiedUntilEpoch: 'turnOffRuleUntilEpoch',\n    ignoreRuleWhileOnBranch: 'turnOffRuleWhileOnBranch',\n};\n\n\n// The renamed-field message shared by keyed rules and match-rules.\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction renamedFieldError(scope: string, oldKey: string, newKey: string): string {\n    return `${scope} Unknown field \"${oldKey}\" — it was renamed to \"${newKey}\". Rename it (the value carries over unchanged; for the branch hatch, use null when there is no branch).`;\n}\n\n/**\n * Field-level errors for ONE configured rule entry: unknown/renamed/retired keys, type and enum\n * mismatches, and the two-week cap on turnOffRuleUntilEpoch.\n *\n * Extracted out of validateWebpiecesConfig purely so that function stays inside max-method-lines; it is\n * the same checks in the same order.\n */\n// webpieces-disable no-any-unknown -- one config entry as opaque JSON; every field is typed-checked below\n// webpieces-disable no-function-outside-class -- module-scope validator helper, matching every other check in this file\nfunction fieldErrors(ruleName: string, entry: Record<string, unknown>, schema: Record<string, FieldDef>): string[] {\n    const errors: string[] = [];\n    for (const [key, value] of Object.entries(entry)) {\n        const fieldDef = schema[key];\n        if (!fieldDef) {\n            const renamedTo = RENAMED_FIELD_ALIASES[key];\n            if (renamedTo) {\n                errors.push(renamedFieldError(`[${ruleName}]`, key, renamedTo));\n                continue;\n            }\n            const retiredHint = RETIRED_FIELD_HINTS[`${ruleName}.${key}`];\n            const suffix = retiredHint ? ` ${retiredHint}` : '';\n            errors.push(`[${ruleName}] Unknown field \"${key}\". Valid fields: [${Object.keys(schema).join(', ')}].${suffix}`);\n            continue;\n        }\n        // A nullable field (e.g. turnOffRuleWhileOnBranch) accepts JSON null in addition to its type.\n        if (value === null && fieldDef.nullable) continue;\n        if (fieldDef.type === 'string[]') {\n            if (!Array.isArray(value) || !value.every(v => typeof v === 'string'))\n                errors.push(`[${ruleName}] \"${key}\" must be string[], got ${typeof value}.`);\n        } else if (typeof value !== fieldDef.type) {\n            errors.push(`[${ruleName}] \"${key}\" must be ${fieldDef.type}, got ${typeof value}.`);\n        } else if (fieldDef.enumValues && !fieldDef.enumValues.includes(value as string)) {\n            errors.push(`[${ruleName}] \"${key}\" = \"${value}\" is not valid. Must be one of: ${fieldDef.enumValues.join(', ')}.`);\n        } else if (key === 'turnOffRuleUntilEpoch') {\n            const capError = epochCapError(`[${ruleName}]`, value as number);\n            if (capError) errors.push(capError);\n        }\n    }\n    return errors;\n}\n\n// webpieces-disable no-any-unknown -- rawRules values are opaque JSON; each field is validated individually\nexport function validateWebpiecesConfig(\n    rawRules: Record<string, Record<string, unknown>>,\n    hasCustomRulesDir: boolean = false,\n): string[] {\n    const errors: string[] = [];\n\n    // Check field-level correctness for rules that are present\n    for (const [ruleName, entry] of Object.entries(rawRules)) {\n        const schema = RULE_SCHEMAS[ruleName];\n        if (!schema) {\n            // A name we KNOW is retired beats the generic unknown-rule message, because only the table\n            // knows WHERE the setting went — a rename carries its value over, and a bare \"delete it\"\n            // would throw that value away. It fires even when a rulesDir is set, because a custom rule\n            // must not reuse a retired name.\n            const retired = retiredRuleFor(ruleName);\n            if (retired) {\n                errors.push(retiredKeyError(retired));\n                continue;\n            }\n            // No built-in schema. With no rulesDir there are no custom rules, so this key is a\n            // dead/typo'd entry — tell the AI to remove it (a removed rule like no-shell-substitution\n            // lingers here otherwise). With a rulesDir it may be a legitimate custom rule → skip.\n            if (!hasCustomRulesDir) errors.push(unknownRuleError(ruleName));\n            continue;\n        }\n        errors.push(...fieldErrors(ruleName, entry, schema));\n        // Required fields must actually be present. Until now the loop above only checked\n        // fields that WERE present, so an entry like `{}` (or one missing `mode` /\n        // `turnOffRuleUntilEpoch`) slipped through. Every non-optional schema field is mandatory.\n        for (const [key, fieldDef] of Object.entries(schema)) {\n            if (!fieldDef.optional && !(key in entry)) {\n                errors.push(`[${ruleName}] Missing required field \"${key}\". Add ${key}: ${valueHint(fieldDef, key)}.`);\n            }\n        }\n    }\n\n    // Every built-in rule must be explicitly configured — no silent defaults.\n    // When a new rule is added to the framework, this check surfaces it immediately\n    // with a ready-to-copy snippet so AI can configure it in one pass.\n    for (const [ruleName, schema] of Object.entries(RULE_SCHEMAS)) {\n        if (!(ruleName in rawRules)) {\n            errors.push(missingRuleSnippet(ruleName, schema));\n        }\n    }\n\n    return errors;\n}\n\nconst PR_GATE_MODES = ['ON', 'OFF'] as const;\n// Optional — omitted means DETECT. Kept inline (like prGateExample) to avoid a load-config ↔\n// pr-gate-config import cycle; the canonical list + semantics live in pr-gate-config.ts.\nconst PR_GATE_MERGE_MODES = ['AUTO', 'NONE'] as const;\n\n// Spelled out because the choice is a POLICY decision with a consequence the chooser cannot see:\n// only the AUTO path can put the compact risk/flags body in main's history, because a UI merge is\n// composed from the repo's squash_merge_commit_title/message settings, which the tooling pins.\nconst MERGE_MODE_HELP = (\n        `Must be one of: ${PR_GATE_MERGE_MODES.join(', ')}.\\n` +\n        `  \"AUTO\" — wp-finish-upsert-pr lands the PR: it squash-merges when mergeable, else enables\\n` +\n        `           GitHub auto-merge, both with an explicit --subject/--body-file so main's history\\n` +\n        `           gets the PR title + the compact risk/flags body. Needs allow_auto_merge on the repo\\n` +\n        `           (gh api repos/{owner}/{repo} --jq .allow_auto_merge).\\n` +\n        `  \"NONE\" — wp-finish-upsert-pr only opens/updates the PR; a human merges it, and that still\\n` +\n        `           lands the compact body: the PR DESCRIPTION *is* that body, and stage \\u2462 keeps the repo's\\n` +\n        `           squash_merge_commit_title/message pinned to PR_TITLE/PR_BODY so a UI merge copies it\\n` +\n        `           verbatim (SquashSettingsEnforcer). Nothing to set by hand.`\n);\n\n// Copy-paste example for the top-level `pr-gate` block (sibling of `rules`). Kept inline rather\n// than imported from pr-gate-config.ts to avoid a load-config ↔ pr-gate-config import cycle.\nfunction prGateExample(): string {\n    return (\n        `  \"pr-gate\": {\\n` +\n        `    \"mode\": \"ON\",\\n` +\n        `    \"buildCommand\": \"<command CI runs to validate a PR, e.g. pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)>\",\\n` +\n        `    \"gates\": [\\n` +\n        `      { \"name\": \"API Changed\", \"patterns\": [\"libraries/apis/**\", \"**/*Api.ts\"], \"warningColor\": \"yellow\" }\\n` +\n        `    ],\\n` +\n        `    \"checklists\": [   // OPTIONAL — per-area review, one distinct reviewer subagent each\\n` +\n        `      { \"subagent\": \"db-migration-reviewer\", \"doc\": \".claude/review/db-migrations.md\", \"patterns\": [\"**/*.sql\"] }\\n` +\n        `    ]\\n` +\n        `  }`\n    );\n}\n\n// The `gates` array: dashboard-only warning flags. Extracted from validatePrGateSection to keep that\n// method inside the length limit.\n// webpieces-disable no-any-unknown -- `value` is the opaque consumer `gates` value until narrowed here\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nfunction validateGatesSection(value: unknown): string[] {\n    if (!Array.isArray(value)) {\n        return [`[pr-gate] \"gates\" must be an array of { name, patterns, warningColor, disabled? }.`];\n    }\n    const errors: string[] = [];\n    for (let i = 0; i < value.length; i += 1) {\n        errors.push(...validateGate(value[i], i));\n    }\n    return errors;\n}\n\n// webpieces-disable no-any-unknown -- one gate entry from opaque consumer JSON, validated field-by-field\nfunction validateGate(gate: unknown, index: number): string[] {\n    if (typeof gate !== 'object' || gate === null) {\n        return [`[pr-gate] gates[${index}] must be an object { name, patterns, warningColor, disabled? }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque gate object from consumer JSON\n    const g = gate as Record<string, unknown>;\n    const errors: string[] = [];\n    if (typeof g['name'] !== 'string') errors.push(`[pr-gate] gates[${index}].name must be a string.`);\n    if (!Array.isArray(g['patterns']) || !g['patterns'].every(p => typeof p === 'string'))\n        errors.push(`[pr-gate] gates[${index}].patterns must be string[].`);\n    if (g['warningColor'] === undefined)\n        errors.push(`[pr-gate] gates[${index}].warningColor is required — set it to \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    else if (g['warningColor'] !== 'yellow' && g['warningColor'] !== 'red')\n        errors.push(`[pr-gate] gates[${index}].warningColor must be \"yellow\" or \"red\" (green is implicit when nothing matches).`);\n    if (g['disabled'] !== undefined && typeof g['disabled'] !== 'boolean')\n        errors.push(`[pr-gate] gates[${index}].disabled must be a boolean (example/inactive gate kept in the file).`);\n    return errors;\n}\n\n/**\n * Validate the top-level `pr-gate` section. It is REQUIRED (a client that opts out sets mode \"OFF\").\n * `buildCommand` is required unless mode is \"OFF\". Returns human-readable, copy-paste-friendly errors\n * — never throws. The pr-gate block lives outside the FieldDef-driven `rules` schema because its\n * nested `gates`/`checklists` arrays can't be expressed there, so they get structural validation here.\n * `repoRoot` (when known) lets the `checklists[].docs` existence check run.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\n// webpieces-disable no-function-outside-class -- module-level config validator, matches the rest of this file\nexport function validatePrGateSection(section: unknown, repoRoot?: string): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[pr-gate] Not configured in webpieces.config.json. Add this block under the \"commands\" ` +\n            `section (set \"mode\": \"OFF\" to opt out):\\n\\n${prGateExample()}`,\n        ];\n    }\n    if (typeof section !== 'object' || Array.isArray(section)) {\n        return [`[pr-gate] Must be an object. Example:\\n\\n${prGateExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque pr-gate section from consumer JSON\n    const s = section as Record<string, unknown>;\n    const errors: string[] = [];\n\n    if (!('mode' in s)) {\n        errors.push(`[pr-gate] Missing required field \"mode\". Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    } else if (typeof s['mode'] !== 'string' || !PR_GATE_MODES.includes(s['mode'] as typeof PR_GATE_MODES[number])) {\n        errors.push(`[pr-gate] \"mode\" = \"${String(s['mode'])}\" is not valid. Must be one of: ${PR_GATE_MODES.join(', ')}.`);\n    }\n\n    // buildCommand and mergeMode are both required whenever the gate is active (mode !== OFF). There\n    // is deliberately NO default for mergeMode: whether the tooling may land your PRs is a policy\n    // decision, and either guess is wrong for somebody.\n    if (s['mode'] !== 'OFF') {\n        const cmd = s['buildCommand'];\n        if (typeof cmd !== 'string' || cmd.trim() === '') {\n            errors.push(\n                `[pr-gate] Missing required field \"buildCommand\" — the command CI runs to validate a PR. ` +\n                `Add e.g. \"buildCommand\": \"pnpm nx affected --target=ci --base=$(git merge-base origin/main HEAD)\".`,\n            );\n        }\n        const mm = s['mergeMode'];\n        if (!('mergeMode' in s)) {\n            errors.push(`[pr-gate] Missing required field \"mergeMode\". ${MERGE_MODE_HELP}`);\n        } else if (typeof mm !== 'string' || !PR_GATE_MERGE_MODES.includes(mm as typeof PR_GATE_MERGE_MODES[number])) {\n            errors.push(`[pr-gate] \"mergeMode\" = \"${String(mm)}\" is not valid. ${MERGE_MODE_HELP}`);\n        }\n    }\n\n    if ('gates' in s) errors.push(...validateGatesSection(s['gates']));\n\n    // Optional extension point: company review checklists, as an ARRAY right here in the config. Absent ⇒\n    // none. The removed { doc } manifest shape is rejected with the exact migration edit.\n    if ('checklists' in s) errors.push(...validateChecklistsSection(s['checklists'], repoRoot));\n\n    // Optional server-token salt. Absent ⇒ no token minted, CI enforcement is a no-op. Present ⇒ must be\n    // a non-empty string (an empty salt would mint a token anyone can forge from a known-empty secret).\n    if ('gateSalt' in s) {\n        const salt = s['gateSalt'];\n        if (typeof salt !== 'string' || salt.trim() === '') {\n            errors.push(`[pr-gate] \"gateSalt\" must be a non-empty string — it is the shared secret the gate token is HMAC'd with. Omit the key entirely to disable server-side token enforcement.`);\n        }\n    }\n\n    // Optional: what happens to the LOCAL branch once its PR lands. Absent ⇒ \"archive-tag\".\n    if ('landPr' in s) errors.push(...validateLandPrSection(s['landPr']));\n\n    // Optional: where wp-push-dev publishes the disposable copy. Absent ⇒ \"dev-include\" / \"dev\".\n    if ('devDeploy' in s) errors.push(...validateDevDeploySection(s['devDeploy']));\n\n    errors.push(...validateNoGateSaltRationale(s));\n\n    // Optional: publish reviewer output as a PR comment (defaults true). Must be a boolean when present.\n    if ('checklistComments' in s && typeof s['checklistComments'] !== 'boolean') {\n        errors.push(`[pr-gate] \"checklistComments\" must be a boolean (defaults to true; set false to keep the PR body-only).`);\n    }\n\n    return errors;\n}\n\nfunction excludePathsExample(): string {\n    return '\"excludePaths\": [\"repositories/**\"]';\n}\n\n// A glob list: must be a string[] (may be empty). `key` names it for the error.\n// webpieces-disable no-any-unknown -- `value` is opaque consumer JSON until narrowed here\nfunction validateExcludeList(value: unknown, key: string): string[] {\n    if (!(Array.isArray(value) && value.every(p => typeof p === 'string'))) {\n        return [`[excludePaths] \"${key}\" must be a string[] of glob paths (use [] for none).`];\n    }\n    return [];\n}\n\n/**\n * Validate the REQUIRED top-level `excludePaths` block: ONE glob list suppressing hook enforcement per\n * file path, for code-style rules and file-scoped guards alike. Required so every client upgrading is\n * forced to declare it (as [] to keep today's behavior, or with real paths). Returns copy-paste\n * friendly errors and never throws — same contract as validatePrGateSection.\n *\n * The two-list object form `{ \"rules\": [...], \"guards\": [...] }` is RETIRED, not tolerated. It used to be\n * accepted and silently unioned, which is why this repo's own config sat on the dead shape for releases: an\n * accepted shape is never migrated. Rejecting it cannot wedge a consumer — editing webpieces.config.json is\n * always permitted, even while it is invalid. See retired-config-keys.ts.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateExcludePaths(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[excludePaths] Not configured in webpieces.config.json. Add this REQUIRED block ` +\n            `(use an empty array to keep enforcing everywhere):\\n\\n  ${excludePathsExample()}`,\n        ];\n    }\n    if (Array.isArray(section)) return validateExcludeList(section, 'excludePaths');\n    if (typeof section !== 'object') {\n        return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing the opaque excludePaths section from consumer JSON\n    const s = section as Record<string, unknown>;\n    // The retired two-list object. One table row owns the message for either key present.\n    const retired = retiredEntry('rules', '[excludePaths]');\n    if (retired && (s['rules'] !== undefined || s['guards'] !== undefined)) {\n        return [`${retiredKeyError(retired)}\\n\\n  ${excludePathsExample()}`];\n    }\n    return [`[excludePaths] Must be a string[] of glob paths. Example:\\n\\n  ${excludePathsExample()}`];\n}\n\n// ---------------------------------------------------------------------------\n// match-rules — a new top-level ARRAY section (parallel to pr-gate/excludePaths). Each entry is a\n// client-authored content guard (raw-regex patterns + message + scoping). Validated structurally here\n// the same way pr-gate's `gates` are, because an array of objects can't be expressed in FieldDef schema.\n// ---------------------------------------------------------------------------\n\nfunction matchRulesExample(): string {\n    return `\"match-rules\": ${JSON.stringify(DEFAULT_MATCH_RULES, null, 4)}`;\n}\n\n// webpieces-disable no-any-unknown -- generic type guard over an opaque JSON value\nfunction isStringArray(value: unknown): value is string[] {\n    return Array.isArray(value) && value.every(v => typeof v === 'string');\n}\n\n// Compile a pattern to validate it; returns the error message, or undefined when it compiles.\nfunction regexError(pattern: string): string | undefined {\n    // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n    try {\n        // Constructed only to validate the syntax; the object is intentionally discarded.\n        void new RegExp(pattern);\n        return undefined;\n    } catch (err: unknown) {\n        const error = toError(err);\n        return error.message;\n    }\n}\n\n// One entry of the match-rules array, validated field-by-field (see validateGate for the pattern).\n// webpieces-disable no-any-unknown -- one match-rule entry from opaque consumer JSON, validated field-by-field\nfunction validateMatchRule(entry: unknown, index: number): string[] {\n    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {\n        return [`[match-rules] entry[${index}] must be an object { name, patterns, mainMessage, mode, turnOffRuleUntilEpoch, turnOffRuleWhileOnBranch, ... }.`];\n    }\n    // webpieces-disable no-any-unknown -- narrowing one opaque match-rule entry from consumer JSON\n    const e = entry as Record<string, unknown>;\n    const label = typeof e['name'] === 'string' ? `\"${e['name']}\"` : `entry[${index}]`;\n    const errors: string[] = [];\n\n    if (typeof e['name'] !== 'string' || e['name'].trim() === '')\n        errors.push(`[match-rules] entry[${index}].name must be a non-empty string (it is the disable token and report label).`);\n\n    if (!isStringArray(e['patterns']) || e['patterns'].length === 0) {\n        errors.push(`[match-rules] ${label}.patterns must be a non-empty string[] of regexes.`);\n    } else {\n        e['patterns'].forEach((p: string, pi: number) => {\n            const rxErr = regexError(p);\n            if (rxErr) errors.push(`[match-rules] ${label}.patterns[${pi}] is not a valid regex: ${rxErr}`);\n        });\n    }\n\n    if (typeof e['mainMessage'] !== 'string' || e['mainMessage'].trim() === '')\n        errors.push(`[match-rules] ${label}.mainMessage must be a non-empty string.`);\n\n    if (typeof e['mode'] !== 'string' || !MODIFIED_CODE_MODES.includes(e['mode'] as typeof MODIFIED_CODE_MODES[number]))\n        errors.push(`[match-rules] ${label}.mode must be one of: ${MODIFIED_CODE_MODES.join(', ')}.`);\n\n    // Both escape hatches are REQUIRED on every match-rule too (same as keyed rules), so they are always\n    // visible. turnOffRuleUntilEpoch: number (0 = active; a future unix-epoch in seconds = temporarily\n    // off). turnOffRuleWhileOnBranch: string | null (null = always on; an EXACT branch name — matched\n    // with ===, never as a glob — disables the rule while that branch is checked out).\n    if (typeof e['turnOffRuleUntilEpoch'] !== 'number') {\n        errors.push(`[match-rules] ${label}.turnOffRuleUntilEpoch must be a number (0 = active; future unix-epoch seconds = temporarily off).`);\n    } else {\n        const capError = epochCapError(`[match-rules] ${label}`, e['turnOffRuleUntilEpoch']);\n        if (capError) errors.push(capError);\n    }\n    if (!(e['turnOffRuleWhileOnBranch'] === null || typeof e['turnOffRuleWhileOnBranch'] === 'string'))\n        errors.push(`[match-rules] ${label}.turnOffRuleWhileOnBranch must be a string or null (null = no branch / always on; a string is an EXACT branch name, globs are not supported).`);\n\n    // The old escape-hatch names were renamed — flag them precisely.\n    for (const oldKey of Object.keys(RENAMED_FIELD_ALIASES)) {\n        if (oldKey in e) errors.push(renamedFieldError(`[match-rules] ${label}`, oldKey, RENAMED_FIELD_ALIASES[oldKey]));\n    }\n\n    if (e['options'] !== undefined && !isStringArray(e['options']))\n        errors.push(`[match-rules] ${label}.options must be a string[] (omit if not needed).`);\n    if (e['allowedPaths'] !== undefined && !isStringArray(e['allowedPaths']))\n        errors.push(`[match-rules] ${label}.allowedPaths must be a string[] of globs (omit if not needed).`);\n    if (e['disableAllowed'] !== undefined && typeof e['disableAllowed'] !== 'boolean')\n        errors.push(`[match-rules] ${label}.disableAllowed must be a boolean.`);\n\n    return errors;\n}\n\n/**\n * Validate the REQUIRED top-level `match-rules` array (client-authored content guards). MISSING →\n * one error printing the ready-to-paste `no-fetch` example (add at least this; more can follow).\n * Present-but-`[]` → allowed (a conscious opt-out, matching pr-gate mode:OFF / excludePaths []).\n * Otherwise every entry is validated field-by-field (each regex compile-checked) plus name\n * uniqueness. Copy-paste-friendly errors; never throws — same contract as validatePrGateSection.\n */\n// webpieces-disable no-any-unknown -- `section` is opaque consumer JSON until narrowed below\nexport function validateMatchRulesSection(section: unknown): string[] {\n    if (section === undefined || section === null) {\n        return [\n            `[match-rules] Not configured in webpieces.config.json. Add this REQUIRED top-level array — ` +\n            `seed it with the no-fetch guard below (you can add more entries: no-moment, no-lodash-chain, …):\\n\\n${matchRulesExample()}`,\n        ];\n    }\n    if (!Array.isArray(section)) {\n        return [`[match-rules] Must be an array of content-guard objects. Example:\\n\\n${matchRulesExample()}`];\n    }\n\n    const errors: string[] = [];\n    const seen = new Set<string>();\n    for (let i = 0; i < section.length; i += 1) {\n        errors.push(...validateMatchRule(section[i], i));\n        // webpieces-disable no-any-unknown -- reading the name off an opaque entry only to dedupe\n        const name = (section[i] as Record<string, unknown> | null)?.['name'];\n        if (typeof name === 'string') {\n            if (seen.has(name)) errors.push(`[match-rules] duplicate entry name \"${name}\" — each match-rule name must be unique.`);\n            seen.add(name);\n        }\n    }\n    return errors;\n}\n\n/**\n * Enforce that each built-in lives in its correct section: code rules under `rules`, bash guards\n * under `hookGuards`. A guard left in `rules` (or a rule placed in `hookGuards`) is reported with a\n * \"move it\" message so the split stays clean. Unknown/custom names are ignored (they may be custom\n * rules from rulesDir). Presence (\"every built-in must be configured\") is checked separately by\n * validateWebpiecesConfig against the merged map.\n */\n// webpieces-disable no-any-unknown -- section maps are opaque consumer JSON\nexport function validateSectionPlacement(\n    rulesSection: Record<string, Record<string, unknown>>,\n    hookGuardsSection: Record<string, Record<string, unknown>>,\n): string[] {\n    const errors: string[] = [];\n    for (const name of Object.keys(rulesSection)) {\n        if (isHookGuard(name)) {\n            errors.push(\n                `[${name}] is a hook guard and ${SECTION_PLACEMENT_MARKER} \"hookGuards\" section, not \"rules\". ` +\n                `Move it.`,\n            );\n        }\n    }\n    for (const name of Object.keys(hookGuardsSection)) {\n        // Only flag KNOWN code rules misplaced into hookGuards; unknown names may be custom rules.\n        if (!isHookGuard(name) && RULE_SCHEMAS[name]) {\n            errors.push(\n                `[${name}] is a code rule and ${SECTION_PLACEMENT_MARKER} \"rules\" section, not \"hookGuards\". ` +\n                `Move it.`,\n            );\n        }\n    }\n    return errors;\n}\n"]}