@webpieces/rules-config 0.4.731 → 0.4.733

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/rules-config",
-  "version": "0.4.731",
+  "version": "0.4.733",
   "description": "Shared webpieces.config.json loader. Single source of truth for validation rule configuration consumed by @webpieces/ai-hook-rules, @webpieces/code-rules, and @webpieces/nx-webpieces-rules.",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/checklist-override.d.ts

@@ -0,0 +1,106 @@
+/**
+ * The HUMAN's ship-anyway decision for ONE checklist, recorded in its own file beside the verdict:
+ * `.webpieces/pr-review/<feature>/override-<id>.json`. Data-only (per CLAUDE.md).
+ *
+ * WHY IT IS A SEPARATE FILE FROM THE VERDICT. `review-<id>.json` is a REVIEWER's verdict file, and a
+ * coding agent editing a reviewer's verdict is refused by the harness — correctly, and by every route
+ * (heredoc, `sed -i`, a rewrite). While the ship-anyway justification lived inside that same file as an
+ * `override` field, the ONE participant who genuinely hears the human — the coordinating agent — was the
+ * one participant physically unable to record what it heard, and a human had to hand-edit JSON. Meanwhile
+ * the reviewer subagent refuses to write its own override, also correctly. Two acts, two files:
+ *
+ *   review-<id>.json    written by the reviewer subagent, once      — "what I found"
+ *   override-<id>.json  written by the COORDINATING agent           — "the human saw this and said ship it"
+ *
+ * The name says what the file is, so nothing has to infer intent from a field inside a verdict.
+ *
+ * PER-CHECKLIST, AND IT STANDS. There is no time scoping, no branch scoping, no sha scoping and no
+ * re-authorization when a reviewer runs again: an authorization is about a checklist the human decided to
+ * accept, not about a particular wording of a finding. An earlier draft carried a `findingDigest` (a
+ * hash of the reviewer's `output`) meaning to invalidate an override when the finding changed. That was
+ * removed deliberately: `output` is LLM-written prose, so a re-run words the SAME finding differently
+ * almost every time, and the digest would have mismatched on essentially every re-review — delivering
+ * "any re-review ⇒ re-authorize", which is the exact dance this file exists to delete. FRESHNESS IS
+ * CARRIED BY TRANSPARENCY INSTEAD: the dashboard renders 🟠 OVERRIDDEN with the reason, who authorized it
+ * and when, and any new red finding still publishes as its own finding on the PR, so a human reading the
+ * PR sees both and can judge for themselves.
+ */
+export declare class ChecklistOverride {
+    checklistId: string;
+    authorizedBy: string;
+    authorizedAt: string;
+    reason: string;
+    /**
+     * '' = a well-formed authorization. Non-empty = the file exists and parses but cannot be READ as one
+     * (a missing field). Carried as DATA rather than thrown for the same reason `ChecklistResult.problem`
+     * is: the complaint has to be reportable in identical words by every command that reads the file, and
+     * a half-written override must never be silently mistaken for an absent one.
+     */
+    problem: string;
+    constructor(checklistId: string, authorizedBy: string, authorizedAt: string, reason: string, problem?: string);
+}
+/**
+ * Reads `override-<id>.json`, and renders the ready-to-run command that WRITES one.
+ *
+ * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.
+ */
+export declare class ChecklistOverrideService {
+    /** `override-<id>.json` — the ONE place this name is spelled. */
+    overrideFileName(checklistId: string): string;
+    /** Absolute path of the override file, beside review.json and review-<id>.json in the AI-WRITABLE dir. */
+    overridePath(reviewJsonFilePath: string, checklistId: string): string;
+    /**
+     * The human's authorization for one checklist, or `null` when there is NO FILE — the only state that
+     * genuinely means "nobody authorized anything".
+     *
+     * A file that EXISTS always yields a value, carrying any complaint in `problem` — whether a field is
+     * missing or the bytes do not parse at all. `null` for those would collapse "wrote an authorization
+     * wrong" into "the human never authorized anything", and send the reader off to ask for a decision that
+     * was already made. `resolveVerdict` routes a non-empty `problem` to CK_BAD_FORMAT, so the gate still
+     * REFUSES either way; the difference is entirely in whether the writer is told why it did not count.
+     */
+    load(reviewJsonFilePath: string, checklistId: string): ChecklistOverride | null;
+    /**
+     * The value for an override file that EXISTS but cannot be read at all — unparseable bytes, or JSON that
+     * is not an object. Reported rather than discarded, because "you wrote it wrong" and "you never wrote
+     * it" call for opposite next actions and only the reader can tell them apart.
+     */
+    private unreadable;
+    /**
+     * What the dashboard and the PR comment print for an OVERRIDDEN checklist: the human's words plus the
+     * provenance, so a reader never has to take "someone approved this" on trust.
+     */
+    detail(override: ChecklistOverride): string;
+    /**
+     * THE ready-to-run command that records an authorization — printed verbatim by every refusal.
+     *
+     * IT IS PRINTED, NOT DESCRIBED, on purpose. The old refusal said WHAT to write and WHERE but never WHO
+     * MAY, so the reachable path was an agent improvising an in-place edit of a reviewer's verdict file —
+     * which the harness denies, which is how the human ended up hand-editing JSON. An agent copying a
+     * printed command into an obviously AI-writable path is a far cleaner ask, and it is the whole reason
+     * this string exists.
+     *
+     * NOT INDENTED, deliberately: a shell heredoc's closing delimiter must sit at column 0, so indenting
+     * this block to match the surrounding message would produce a command that does not run.
+     */
+    writeCommand(reviewJsonFilePath: string, checklistId: string): string;
+    /**
+     * The paragraph that says WHO may run the command above — the half of this feature that is messaging.
+     *
+     * A reviewer subagent once told a human to run a command that no longer shipped, because the refusal
+     * named a file and a field and never named a writer. All three facts are stated here in one place so
+     * every surface says the same thing.
+     */
+    writerRule(): string;
+    /** Seam: overridden in the spec so the printed command is assertable without a clock. */
+    protected nowIso(): string;
+    private stringField;
+    /**
+     * '' when the authorization can be read. Otherwise the complaint, printed verbatim.
+     *
+     * `reason` and `authorizedBy` are the two fields that make the file mean anything: an override with no
+     * stated reason is an assertion rather than a record, which is the whole thing this file replaced.
+     */
+    private problemFor;
+}
+export declare const checklistOverrideService: ChecklistOverrideService;

package/src/checklist-override.js

@@ -0,0 +1,207 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checklistOverrideService = exports.ChecklistOverrideService = exports.ChecklistOverride = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const inversify_1 = require("inversify");
+const to_error_1 = require("./to-error");
+// The literal the printed command leaves for the human's words. Named so the message, and any test that
+// asserts the command is still a fill-in rather than a pre-filled excuse, agree on one spelling.
+const REASON_FILL_IN = 'REPLACE THIS with the human\'s own words, verbatim';
+/**
+ * The HUMAN's ship-anyway decision for ONE checklist, recorded in its own file beside the verdict:
+ * `.webpieces/pr-review/<feature>/override-<id>.json`. Data-only (per CLAUDE.md).
+ *
+ * WHY IT IS A SEPARATE FILE FROM THE VERDICT. `review-<id>.json` is a REVIEWER's verdict file, and a
+ * coding agent editing a reviewer's verdict is refused by the harness — correctly, and by every route
+ * (heredoc, `sed -i`, a rewrite). While the ship-anyway justification lived inside that same file as an
+ * `override` field, the ONE participant who genuinely hears the human — the coordinating agent — was the
+ * one participant physically unable to record what it heard, and a human had to hand-edit JSON. Meanwhile
+ * the reviewer subagent refuses to write its own override, also correctly. Two acts, two files:
+ *
+ *   review-<id>.json    written by the reviewer subagent, once      — "what I found"
+ *   override-<id>.json  written by the COORDINATING agent           — "the human saw this and said ship it"
+ *
+ * The name says what the file is, so nothing has to infer intent from a field inside a verdict.
+ *
+ * PER-CHECKLIST, AND IT STANDS. There is no time scoping, no branch scoping, no sha scoping and no
+ * re-authorization when a reviewer runs again: an authorization is about a checklist the human decided to
+ * accept, not about a particular wording of a finding. An earlier draft carried a `findingDigest` (a
+ * hash of the reviewer's `output`) meaning to invalidate an override when the finding changed. That was
+ * removed deliberately: `output` is LLM-written prose, so a re-run words the SAME finding differently
+ * almost every time, and the digest would have mismatched on essentially every re-review — delivering
+ * "any re-review ⇒ re-authorize", which is the exact dance this file exists to delete. FRESHNESS IS
+ * CARRIED BY TRANSPARENCY INSTEAD: the dashboard renders 🟠 OVERRIDDEN with the reason, who authorized it
+ * and when, and any new red finding still publishes as its own finding on the PR, so a human reading the
+ * PR sees both and can judge for themselves.
+ */
+class ChecklistOverride {
+    checklistId; // the checklist this authorizes — never "the PR as a whole"
+    authorizedBy; // WHO decided (e.g. 'human, in-session')
+    authorizedAt; // WHEN, ISO-8601
+    reason; // the human's own words, verbatim — the provenance, not an agent's paraphrase
+    /**
+     * '' = a well-formed authorization. Non-empty = the file exists and parses but cannot be READ as one
+     * (a missing field). Carried as DATA rather than thrown for the same reason `ChecklistResult.problem`
+     * is: the complaint has to be reportable in identical words by every command that reads the file, and
+     * a half-written override must never be silently mistaken for an absent one.
+     */
+    problem;
+    // eslint-disable-next-line @typescript-eslint/max-params
+    constructor(checklistId, authorizedBy, authorizedAt, reason, problem = '') {
+        this.checklistId = checklistId;
+        this.authorizedBy = authorizedBy;
+        this.authorizedAt = authorizedAt;
+        this.reason = reason;
+        this.problem = problem;
+    }
+}
+exports.ChecklistOverride = ChecklistOverride;
+/**
+ * Reads `override-<id>.json`, and renders the ready-to-run command that WRITES one.
+ *
+ * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.
+ */
+let ChecklistOverrideService = class ChecklistOverrideService {
+    /** `override-<id>.json` — the ONE place this name is spelled. */
+    overrideFileName(checklistId) {
+        return `override-${checklistId}.json`;
+    }
+    /** Absolute path of the override file, beside review.json and review-<id>.json in the AI-WRITABLE dir. */
+    overridePath(reviewJsonFilePath, checklistId) {
+        return path.join(path.dirname(reviewJsonFilePath), this.overrideFileName(checklistId));
+    }
+    /**
+     * The human's authorization for one checklist, or `null` when there is NO FILE — the only state that
+     * genuinely means "nobody authorized anything".
+     *
+     * A file that EXISTS always yields a value, carrying any complaint in `problem` — whether a field is
+     * missing or the bytes do not parse at all. `null` for those would collapse "wrote an authorization
+     * wrong" into "the human never authorized anything", and send the reader off to ask for a decision that
+     * was already made. `resolveVerdict` routes a non-empty `problem` to CK_BAD_FORMAT, so the gate still
+     * REFUSES either way; the difference is entirely in whether the writer is told why it did not count.
+     */
+    // webpieces-disable no-any-unknown -- opaque parsed JSON, narrowed field-by-field below
+    load(reviewJsonFilePath, checklistId) {
+        const filePath = this.overridePath(reviewJsonFilePath, checklistId);
+        if (!fs.existsSync(filePath))
+            return null;
+        // webpieces-disable no-unmanaged-exceptions -- chokepoint: an unparseable override reads as absent, never fatal
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            // webpieces-disable no-any-unknown -- parsed JSON is opaque until narrowed below
+            const raw = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+            if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+                return this.unreadable(reviewJsonFilePath, checklistId, 'it is not a JSON object');
+            }
+            const authorizedBy = this.stringField(raw, 'authorizedBy');
+            const authorizedAt = this.stringField(raw, 'authorizedAt');
+            const reason = this.stringField(raw, 'reason');
+            return new ChecklistOverride(checklistId, authorizedBy, authorizedAt, reason, this.problemFor(reviewJsonFilePath, checklistId, authorizedBy, reason));
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            return this.unreadable(reviewJsonFilePath, checklistId, error.message);
+        }
+    }
+    /**
+     * The value for an override file that EXISTS but cannot be read at all — unparseable bytes, or JSON that
+     * is not an object. Reported rather than discarded, because "you wrote it wrong" and "you never wrote
+     * it" call for opposite next actions and only the reader can tell them apart.
+     */
+    unreadable(reviewJsonFilePath, checklistId, why) {
+        const filePath = this.overridePath(reviewJsonFilePath, checklistId);
+        const problem = `The override for checklist "${checklistId}" at ${filePath} cannot be read (${why}), so it `
+            + 'authorizes nothing. The human\'s decision is NOT recorded until this file parses. Rewrite the whole '
+            + `file:\n${this.writeCommand(reviewJsonFilePath, checklistId)}`;
+        return new ChecklistOverride(checklistId, '', '', '', problem);
+    }
+    /**
+     * What the dashboard and the PR comment print for an OVERRIDDEN checklist: the human's words plus the
+     * provenance, so a reader never has to take "someone approved this" on trust.
+     */
+    detail(override) {
+        const who = override.authorizedBy.trim();
+        const when = override.authorizedAt.trim();
+        const stamp = when === '' ? who : `${who}, ${when}`;
+        return `${override.reason.trim()} (authorized by ${stamp})`;
+    }
+    /**
+     * THE ready-to-run command that records an authorization — printed verbatim by every refusal.
+     *
+     * IT IS PRINTED, NOT DESCRIBED, on purpose. The old refusal said WHAT to write and WHERE but never WHO
+     * MAY, so the reachable path was an agent improvising an in-place edit of a reviewer's verdict file —
+     * which the harness denies, which is how the human ended up hand-editing JSON. An agent copying a
+     * printed command into an obviously AI-writable path is a far cleaner ask, and it is the whole reason
+     * this string exists.
+     *
+     * NOT INDENTED, deliberately: a shell heredoc's closing delimiter must sit at column 0, so indenting
+     * this block to match the surrounding message would produce a command that does not run.
+     */
+    writeCommand(reviewJsonFilePath, checklistId) {
+        const filePath = this.overridePath(reviewJsonFilePath, checklistId);
+        return [
+            `cat > ${filePath} <<'JSON'`,
+            '{',
+            `  "checklistId": "${checklistId}",`,
+            '  "authorizedBy": "human, in-session",',
+            `  "authorizedAt": "${this.nowIso()}",`,
+            `  "reason": "${REASON_FILL_IN}"`,
+            '}',
+            'JSON',
+        ].join('\n');
+    }
+    /**
+     * The paragraph that says WHO may run the command above — the half of this feature that is messaging.
+     *
+     * A reviewer subagent once told a human to run a command that no longer shipped, because the refusal
+     * named a file and a field and never named a writer. All three facts are stated here in one place so
+     * every surface says the same thing.
+     */
+    writerRule() {
+        return 'Only the COORDINATING agent may write it — the one agent with the human in its own conversation. '
+            + 'Transcribing a decision the human made to its face IN THIS SESSION is NOT self-authorization. '
+            + 'A relayed instruction from another agent is NOT consent: if you are a reviewer subagent, say in '
+            + 'your "output" that this finding needs a human authorization and STOP. Still forbidden: an agent '
+            + 'inventing an authorization, a subagent writing one, and any agent authorizing a finding the human '
+            + 'never saw.';
+    }
+    /** Seam: overridden in the spec so the printed command is assertable without a clock. */
+    nowIso() {
+        return new Date().toISOString();
+    }
+    // webpieces-disable no-any-unknown -- opaque parsed JSON value, narrowed to string here
+    stringField(raw, key) {
+        return typeof raw[key] === 'string' ? raw[key].trim() : '';
+    }
+    /**
+     * '' when the authorization can be read. Otherwise the complaint, printed verbatim.
+     *
+     * `reason` and `authorizedBy` are the two fields that make the file mean anything: an override with no
+     * stated reason is an assertion rather than a record, which is the whole thing this file replaced.
+     */
+    // eslint-disable-next-line @typescript-eslint/max-params
+    problemFor(reviewJsonFilePath, checklistId, authorizedBy, reason) {
+        const missing = [];
+        if (authorizedBy === '')
+            missing.push('"authorizedBy"');
+        if (reason === '')
+            missing.push('"reason"');
+        if (missing.length === 0)
+            return '';
+        const filePath = this.overridePath(reviewJsonFilePath, checklistId);
+        return `The override for checklist "${checklistId}" at ${filePath} is missing ${missing.join(' and ')}. `
+            + 'An authorization with no stated reason and no named authorizer is an assertion, not a record — '
+            + 'it does not authorize anything. Rewrite the whole file:\n'
+            + this.writeCommand(reviewJsonFilePath, checklistId);
+    }
+};
+exports.ChecklistOverrideService = ChecklistOverrideService;
+exports.ChecklistOverrideService = ChecklistOverrideService = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton)
+], ChecklistOverrideService);
+// Module-level instance, mirroring `dotWebpieces`: the defaulted constructor parameter of
+// ReviewJsonService, so `new ReviewJsonService()` keeps working while DI still injects by type.
+exports.checklistOverrideService = new ChecklistOverrideService();
+//# sourceMappingURL=checklist-override.js.map

package/src/checklist-override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checklist-override.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/checklist-override.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAC7B,yCAA2D;AAC3D,yCAAqC;AAErC,wGAAwG;AACxG,iGAAiG;AACjG,MAAM,cAAc,GAAG,oDAAoD,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAa,iBAAiB;IAC1B,WAAW,CAAS,CAAG,4DAA4D;IACnF,YAAY,CAAS,CAAE,yCAAyC;IAChE,YAAY,CAAS,CAAE,iBAAiB;IACxC,MAAM,CAAS,CAAQ,8EAA8E;IACrG;;;;;OAKG;IACH,OAAO,CAAS;IAEhB,yDAAyD;IACzD,YAAY,WAAmB,EAAE,YAAoB,EAAE,YAAoB,EAAE,MAAc,EAAE,OAAO,GAAG,EAAE;QACrG,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3B,CAAC;CACJ;AArBD,8CAqBC;AAED;;;;GAIG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACjC,iEAAiE;IACjE,gBAAgB,CAAC,WAAmB;QAChC,OAAO,YAAY,WAAW,OAAO,CAAC;IAC1C,CAAC;IAED,0GAA0G;IAC1G,YAAY,CAAC,kBAA0B,EAAE,WAAmB;QACxD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;;;OASG;IACH,wFAAwF;IACxF,IAAI,CAAC,kBAA0B,EAAE,WAAmB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,gHAAgH;QAChH,8DAA8D;QAC9D,IAAI,CAAC;YACD,iFAAiF;YACjF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA4B,CAAC;YACrF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChE,OAAO,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC/C,OAAO,IAAI,iBAAiB,CACxB,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAC/C,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CACzE,CAAC;QACN,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,kBAA0B,EAAE,WAAmB,EAAE,GAAW;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,+BAA+B,WAAW,QAAQ,QAAQ,oBAAoB,GAAG,WAAW;cACtG,sGAAsG;cACtG,UAAU,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,iBAAiB,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,QAA2B;QAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,KAAK,GAAG,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,kBAA0B,EAAE,WAAmB;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;QACpE,OAAO;YACH,SAAS,QAAQ,WAAW;YAC5B,GAAG;YACH,qBAAqB,WAAW,IAAI;YACpC,wCAAwC;YACxC,sBAAsB,IAAI,CAAC,MAAM,EAAE,IAAI;YACvC,gBAAgB,cAAc,GAAG;YACjC,GAAG;YACH,MAAM;SACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,UAAU;QACN,OAAO,mGAAmG;cACpG,gGAAgG;cAChG,kGAAkG;cAClG,kGAAkG;cAClG,oGAAoG;cACpG,YAAY,CAAC;IACvB,CAAC;IAED,yFAAyF;IAC/E,MAAM;QACZ,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IAED,wFAAwF;IAChF,WAAW,CAAC,GAA4B,EAAE,GAAW;QACzD,OAAO,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,GAAG,CAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED;;;;;OAKG;IACH,yDAAyD;IACjD,UAAU,CAAC,kBAA0B,EAAE,WAAmB,EAAE,YAAoB,EAAE,MAAc;QACpG,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;QACpE,OAAO,+BAA+B,WAAW,QAAQ,QAAQ,eAAe,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;cACnG,iGAAiG;cACjG,2DAA2D;cAC3D,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAC7D,CAAC;CACJ,CAAA;AA5IY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,wBAAwB,CA4IpC;AAED,0FAA0F;AAC1F,gGAAgG;AACnF,QAAA,wBAAwB,GAAG,IAAI,wBAAwB,EAAE,CAAC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { toError } from './to-error';\n\n// The literal the printed command leaves for the human's words. Named so the message, and any test that\n// asserts the command is still a fill-in rather than a pre-filled excuse, agree on one spelling.\nconst REASON_FILL_IN = 'REPLACE THIS with the human\\'s own words, verbatim';\n\n/**\n * The HUMAN's ship-anyway decision for ONE checklist, recorded in its own file beside the verdict:\n * `.webpieces/pr-review/<feature>/override-<id>.json`. Data-only (per CLAUDE.md).\n *\n * WHY IT IS A SEPARATE FILE FROM THE VERDICT. `review-<id>.json` is a REVIEWER's verdict file, and a\n * coding agent editing a reviewer's verdict is refused by the harness — correctly, and by every route\n * (heredoc, `sed -i`, a rewrite). While the ship-anyway justification lived inside that same file as an\n * `override` field, the ONE participant who genuinely hears the human — the coordinating agent — was the\n * one participant physically unable to record what it heard, and a human had to hand-edit JSON. Meanwhile\n * the reviewer subagent refuses to write its own override, also correctly. Two acts, two files:\n *\n *   review-<id>.json    written by the reviewer subagent, once      — \"what I found\"\n *   override-<id>.json  written by the COORDINATING agent           — \"the human saw this and said ship it\"\n *\n * The name says what the file is, so nothing has to infer intent from a field inside a verdict.\n *\n * PER-CHECKLIST, AND IT STANDS. There is no time scoping, no branch scoping, no sha scoping and no\n * re-authorization when a reviewer runs again: an authorization is about a checklist the human decided to\n * accept, not about a particular wording of a finding. An earlier draft carried a `findingDigest` (a\n * hash of the reviewer's `output`) meaning to invalidate an override when the finding changed. That was\n * removed deliberately: `output` is LLM-written prose, so a re-run words the SAME finding differently\n * almost every time, and the digest would have mismatched on essentially every re-review — delivering\n * \"any re-review ⇒ re-authorize\", which is the exact dance this file exists to delete. FRESHNESS IS\n * CARRIED BY TRANSPARENCY INSTEAD: the dashboard renders 🟠 OVERRIDDEN with the reason, who authorized it\n * and when, and any new red finding still publishes as its own finding on the PR, so a human reading the\n * PR sees both and can judge for themselves.\n */\nexport class ChecklistOverride {\n    checklistId: string;   // the checklist this authorizes — never \"the PR as a whole\"\n    authorizedBy: string;  // WHO decided (e.g. 'human, in-session')\n    authorizedAt: string;  // WHEN, ISO-8601\n    reason: string;        // the human's own words, verbatim — the provenance, not an agent's paraphrase\n    /**\n     * '' = a well-formed authorization. Non-empty = the file exists and parses but cannot be READ as one\n     * (a missing field). Carried as DATA rather than thrown for the same reason `ChecklistResult.problem`\n     * is: the complaint has to be reportable in identical words by every command that reads the file, and\n     * a half-written override must never be silently mistaken for an absent one.\n     */\n    problem: string;\n\n    // eslint-disable-next-line @typescript-eslint/max-params\n    constructor(checklistId: string, authorizedBy: string, authorizedAt: string, reason: string, problem = '') {\n        this.checklistId = checklistId;\n        this.authorizedBy = authorizedBy;\n        this.authorizedAt = authorizedAt;\n        this.reason = reason;\n        this.problem = problem;\n    }\n}\n\n/**\n * Reads `override-<id>.json`, and renders the ready-to-run command that WRITES one.\n *\n * `@injectable(bindingScopeValues.Singleton)` so it is injected by type and drawn in the DI design.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class ChecklistOverrideService {\n    /** `override-<id>.json` — the ONE place this name is spelled. */\n    overrideFileName(checklistId: string): string {\n        return `override-${checklistId}.json`;\n    }\n\n    /** Absolute path of the override file, beside review.json and review-<id>.json in the AI-WRITABLE dir. */\n    overridePath(reviewJsonFilePath: string, checklistId: string): string {\n        return path.join(path.dirname(reviewJsonFilePath), this.overrideFileName(checklistId));\n    }\n\n    /**\n     * The human's authorization for one checklist, or `null` when there is NO FILE — the only state that\n     * genuinely means \"nobody authorized anything\".\n     *\n     * A file that EXISTS always yields a value, carrying any complaint in `problem` — whether a field is\n     * missing or the bytes do not parse at all. `null` for those would collapse \"wrote an authorization\n     * wrong\" into \"the human never authorized anything\", and send the reader off to ask for a decision that\n     * was already made. `resolveVerdict` routes a non-empty `problem` to CK_BAD_FORMAT, so the gate still\n     * REFUSES either way; the difference is entirely in whether the writer is told why it did not count.\n     */\n    // webpieces-disable no-any-unknown -- opaque parsed JSON, narrowed field-by-field below\n    load(reviewJsonFilePath: string, checklistId: string): ChecklistOverride | null {\n        const filePath = this.overridePath(reviewJsonFilePath, checklistId);\n        if (!fs.existsSync(filePath)) return null;\n        // webpieces-disable no-unmanaged-exceptions -- chokepoint: an unparseable override reads as absent, never fatal\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            // webpieces-disable no-any-unknown -- parsed JSON is opaque until narrowed below\n            const raw = JSON.parse(fs.readFileSync(filePath, 'utf8')) as Record<string, unknown>;\n            if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {\n                return this.unreadable(reviewJsonFilePath, checklistId, 'it is not a JSON object');\n            }\n            const authorizedBy = this.stringField(raw, 'authorizedBy');\n            const authorizedAt = this.stringField(raw, 'authorizedAt');\n            const reason = this.stringField(raw, 'reason');\n            return new ChecklistOverride(\n                checklistId, authorizedBy, authorizedAt, reason,\n                this.problemFor(reviewJsonFilePath, checklistId, authorizedBy, reason),\n            );\n        } catch (err: unknown) {\n            const error = toError(err);\n            return this.unreadable(reviewJsonFilePath, checklistId, error.message);\n        }\n    }\n\n    /**\n     * The value for an override file that EXISTS but cannot be read at all — unparseable bytes, or JSON that\n     * is not an object. Reported rather than discarded, because \"you wrote it wrong\" and \"you never wrote\n     * it\" call for opposite next actions and only the reader can tell them apart.\n     */\n    private unreadable(reviewJsonFilePath: string, checklistId: string, why: string): ChecklistOverride {\n        const filePath = this.overridePath(reviewJsonFilePath, checklistId);\n        const problem = `The override for checklist \"${checklistId}\" at ${filePath} cannot be read (${why}), so it `\n            + 'authorizes nothing. The human\\'s decision is NOT recorded until this file parses. Rewrite the whole '\n            + `file:\\n${this.writeCommand(reviewJsonFilePath, checklistId)}`;\n        return new ChecklistOverride(checklistId, '', '', '', problem);\n    }\n\n    /**\n     * What the dashboard and the PR comment print for an OVERRIDDEN checklist: the human's words plus the\n     * provenance, so a reader never has to take \"someone approved this\" on trust.\n     */\n    detail(override: ChecklistOverride): string {\n        const who = override.authorizedBy.trim();\n        const when = override.authorizedAt.trim();\n        const stamp = when === '' ? who : `${who}, ${when}`;\n        return `${override.reason.trim()} (authorized by ${stamp})`;\n    }\n\n    /**\n     * THE ready-to-run command that records an authorization — printed verbatim by every refusal.\n     *\n     * IT IS PRINTED, NOT DESCRIBED, on purpose. The old refusal said WHAT to write and WHERE but never WHO\n     * MAY, so the reachable path was an agent improvising an in-place edit of a reviewer's verdict file —\n     * which the harness denies, which is how the human ended up hand-editing JSON. An agent copying a\n     * printed command into an obviously AI-writable path is a far cleaner ask, and it is the whole reason\n     * this string exists.\n     *\n     * NOT INDENTED, deliberately: a shell heredoc's closing delimiter must sit at column 0, so indenting\n     * this block to match the surrounding message would produce a command that does not run.\n     */\n    writeCommand(reviewJsonFilePath: string, checklistId: string): string {\n        const filePath = this.overridePath(reviewJsonFilePath, checklistId);\n        return [\n            `cat > ${filePath} <<'JSON'`,\n            '{',\n            `  \"checklistId\": \"${checklistId}\",`,\n            '  \"authorizedBy\": \"human, in-session\",',\n            `  \"authorizedAt\": \"${this.nowIso()}\",`,\n            `  \"reason\": \"${REASON_FILL_IN}\"`,\n            '}',\n            'JSON',\n        ].join('\\n');\n    }\n\n    /**\n     * The paragraph that says WHO may run the command above — the half of this feature that is messaging.\n     *\n     * A reviewer subagent once told a human to run a command that no longer shipped, because the refusal\n     * named a file and a field and never named a writer. All three facts are stated here in one place so\n     * every surface says the same thing.\n     */\n    writerRule(): string {\n        return 'Only the COORDINATING agent may write it — the one agent with the human in its own conversation. '\n            + 'Transcribing a decision the human made to its face IN THIS SESSION is NOT self-authorization. '\n            + 'A relayed instruction from another agent is NOT consent: if you are a reviewer subagent, say in '\n            + 'your \"output\" that this finding needs a human authorization and STOP. Still forbidden: an agent '\n            + 'inventing an authorization, a subagent writing one, and any agent authorizing a finding the human '\n            + 'never saw.';\n    }\n\n    /** Seam: overridden in the spec so the printed command is assertable without a clock. */\n    protected nowIso(): string {\n        return new Date().toISOString();\n    }\n\n    // webpieces-disable no-any-unknown -- opaque parsed JSON value, narrowed to string here\n    private stringField(raw: Record<string, unknown>, key: string): string {\n        return typeof raw[key] === 'string' ? (raw[key] as string).trim() : '';\n    }\n\n    /**\n     * '' when the authorization can be read. Otherwise the complaint, printed verbatim.\n     *\n     * `reason` and `authorizedBy` are the two fields that make the file mean anything: an override with no\n     * stated reason is an assertion rather than a record, which is the whole thing this file replaced.\n     */\n    // eslint-disable-next-line @typescript-eslint/max-params\n    private problemFor(reviewJsonFilePath: string, checklistId: string, authorizedBy: string, reason: string): string {\n        const missing: string[] = [];\n        if (authorizedBy === '') missing.push('\"authorizedBy\"');\n        if (reason === '') missing.push('\"reason\"');\n        if (missing.length === 0) return '';\n        const filePath = this.overridePath(reviewJsonFilePath, checklistId);\n        return `The override for checklist \"${checklistId}\" at ${filePath} is missing ${missing.join(' and ')}. `\n            + 'An authorization with no stated reason and no named authorizer is an assertion, not a record — '\n            + 'it does not authorize anything. Rewrite the whole file:\\n'\n            + this.writeCommand(reviewJsonFilePath, checklistId);\n    }\n}\n\n// Module-level instance, mirroring `dotWebpieces`: the defaulted constructor parameter of\n// ReviewJsonService, so `new ReviewJsonService()` keeps working while DI still injects by type.\nexport const checklistOverrideService = new ChecklistOverrideService();\n"]}

package/src/exclude-paths.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isPathExcluded = isPathExcluded;
 exports.matchesAnyGlob = matchesAnyGlob;
-const minimatch_1 = require("minimatch");
+// Interop-resolved (issue #747) — NEVER `import { minimatch } from 'minimatch'` here; that named
+// export does not exist on minimatch v3, which is what a hoisted-linker consumer can resolve to.
+const minimatch_interop_1 = require("./minimatch-interop");
 /**
  * Holistic exclusion check shared by validate-ts-in-src (Layer 1 + Layer 2)
  * and the file-location AI-hook rule, so the two implementations can never
@@ -27,9 +29,9 @@ function isPathExcluded(relPath, excludePaths) {
     for (const pattern of excludePaths) {
         if (segments.includes(pattern))
             return true;
-        if ((0, minimatch_1.minimatch)(norm, pattern))
+        if ((0, minimatch_interop_1.minimatch)(norm, pattern))
             return true;
-        if ((0, minimatch_1.minimatch)(norm, `${pattern}/**`))
+        if ((0, minimatch_interop_1.minimatch)(norm, `${pattern}/**`))
             return true;
     }
     return false;
@@ -64,9 +66,9 @@ function isPathExcluded(relPath, excludePaths) {
 function matchesAnyGlob(relPath, patterns) {
     const norm = relPath.replace(/\\/g, '/');
     for (const pattern of patterns) {
-        if ((0, minimatch_1.minimatch)(norm, pattern, { dot: true }))
+        if ((0, minimatch_interop_1.minimatch)(norm, pattern, { dot: true }))
             return true;
-        if ((0, minimatch_1.minimatch)(norm, `${pattern}/**`, { dot: true }))
+        if ((0, minimatch_interop_1.minimatch)(norm, `${pattern}/**`, { dot: true }))
             return true;
     }
     return false;

package/src/exclude-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"exclude-paths.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/exclude-paths.ts"],"names":[],"mappings":";;AAoBA,wCASC;AA6BD,wCAOC;AAjED,yCAAsC;AAEtC;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,cAAc,CAAC,OAAe,EAAE,YAA+B;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,IAAA,qBAAS,EAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,IAAA,qBAAS,EAAC,IAAI,EAAE,GAAG,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,sGAAsG;AACtG,SAAgB,cAAc,CAAC,OAAe,EAAE,QAA2B;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAA,qBAAS,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,IAAA,qBAAS,EAAC,IAAI,EAAE,GAAG,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC","sourcesContent":["import { minimatch } from 'minimatch';\n\n/**\n * Holistic exclusion check shared by validate-ts-in-src (Layer 1 + Layer 2)\n * and the file-location AI-hook rule, so the two implementations can never\n * drift apart again.\n *\n * `relPath` is a workspace-relative path (e.g.\n * \"libraries/foo/codegen.ts\"). An entry in `excludePaths` matches when ANY\n * of the following hold:\n *\n *   1. Bare directory/segment name appearing anywhere in the path. This is\n *      the historical behavior and keeps entries like \"node_modules\",\n *      \"dist\", \"scripts\", \"architecture\" working at any depth.\n *   2. A glob matched against the full relative path, e.g. \"**\\/*.d.ts\" or\n *      \"**\\/codegen.ts\".\n *   3. A directory-prefix glob, e.g. \"libraries/apis\" -> \"libraries/apis/**\".\n *\n * Paths are normalized to forward slashes so Windows backslashes match too.\n */\nexport function isPathExcluded(relPath: string, excludePaths: readonly string[]): boolean {\n    const norm = relPath.replace(/\\\\/g, '/');\n    const segments = norm.split('/');\n    for (const pattern of excludePaths) {\n        if (segments.includes(pattern)) return true;\n        if (minimatch(norm, pattern)) return true;\n        if (minimatch(norm, `${pattern}/**`)) return true;\n    }\n    return false;\n}\n\n/**\n * Does `relPath` match any of `patterns`, as a glob or as a directory prefix?\n *\n * The strict sibling of {@link isPathExcluded}: it drops rule 1 (bare segment name matching anywhere\n * in the path), which is right for an opt-out exclusion list but wrong for anything that CLASSIFIES\n * a path — a pattern like \"external\" would otherwise claim every path containing that segment at any\n * depth. Used for config lists that positively identify a set of projects (e.g.\n * `runtime-architecture.externalApiPaths`).\n *\n * Paths are normalized to forward slashes so Windows backslashes match too. Empty `patterns` matches\n * nothing, so an unconfigured list is inert rather than universal.\n *\n * DOTFILE PATHS COUNT (`{ dot: true }`). minimatch's default hides any path segment starting with `.`\n * from a wildcard, so `**` does not match `.github/workflows/deploy.yml` and `.claude/**` does not match\n * `.claude/agents/x.md`. For a repo-path classifier that default is simply wrong: `.github/`, `.claude/`\n * and `.webpieces/` are ordinary, frequently-changed directories here, and a pattern author writing\n * `**` means all of it. Shell-style dot-hiding protects against globbing up `.` and `..`, which is not a\n * hazard any caller here has.\n *\n * The three consumers are named here on purpose, because the widening is silent for them:\n * `build-artifact-gate` (stale generated artifacts), `api-scanner.externalApiPaths` (project\n * classification) and `no-custom-css-scope.allowGlobs` (an EXEMPTION list, so wider = more exempt).\n * None configures a dot-path today, and for all three \"the pattern author meant the whole subtree\" is\n * the reading they already assume — but a future dot-path entry now matches where it silently did not,\n * and that is a deliberate decision recorded here rather than an accident.\n */\n// webpieces-disable no-function-outside-class -- pure path predicate, sibling of isPathExcluded above\nexport function matchesAnyGlob(relPath: string, patterns: readonly string[]): boolean {\n    const norm = relPath.replace(/\\\\/g, '/');\n    for (const pattern of patterns) {\n        if (minimatch(norm, pattern, { dot: true })) return true;\n        if (minimatch(norm, `${pattern}/**`, { dot: true })) return true;\n    }\n    return false;\n}\n"]}
+{"version":3,"file":"exclude-paths.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/exclude-paths.ts"],"names":[],"mappings":";;AAsBA,wCASC;AA6BD,wCAOC;AAnED,iGAAiG;AACjG,iGAAiG;AACjG,2DAAgD;AAEhD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,cAAc,CAAC,OAAe,EAAE,YAA+B;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,IAAA,6BAAS,EAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,IAAA,6BAAS,EAAC,IAAI,EAAE,GAAG,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,sGAAsG;AACtG,SAAgB,cAAc,CAAC,OAAe,EAAE,QAA2B;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAA,6BAAS,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,IAAA,6BAAS,EAAC,IAAI,EAAE,GAAG,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC","sourcesContent":["// Interop-resolved (issue #747) — NEVER `import { minimatch } from 'minimatch'` here; that named\n// export does not exist on minimatch v3, which is what a hoisted-linker consumer can resolve to.\nimport { minimatch } from './minimatch-interop';\n\n/**\n * Holistic exclusion check shared by validate-ts-in-src (Layer 1 + Layer 2)\n * and the file-location AI-hook rule, so the two implementations can never\n * drift apart again.\n *\n * `relPath` is a workspace-relative path (e.g.\n * \"libraries/foo/codegen.ts\"). An entry in `excludePaths` matches when ANY\n * of the following hold:\n *\n *   1. Bare directory/segment name appearing anywhere in the path. This is\n *      the historical behavior and keeps entries like \"node_modules\",\n *      \"dist\", \"scripts\", \"architecture\" working at any depth.\n *   2. A glob matched against the full relative path, e.g. \"**\\/*.d.ts\" or\n *      \"**\\/codegen.ts\".\n *   3. A directory-prefix glob, e.g. \"libraries/apis\" -> \"libraries/apis/**\".\n *\n * Paths are normalized to forward slashes so Windows backslashes match too.\n */\nexport function isPathExcluded(relPath: string, excludePaths: readonly string[]): boolean {\n    const norm = relPath.replace(/\\\\/g, '/');\n    const segments = norm.split('/');\n    for (const pattern of excludePaths) {\n        if (segments.includes(pattern)) return true;\n        if (minimatch(norm, pattern)) return true;\n        if (minimatch(norm, `${pattern}/**`)) return true;\n    }\n    return false;\n}\n\n/**\n * Does `relPath` match any of `patterns`, as a glob or as a directory prefix?\n *\n * The strict sibling of {@link isPathExcluded}: it drops rule 1 (bare segment name matching anywhere\n * in the path), which is right for an opt-out exclusion list but wrong for anything that CLASSIFIES\n * a path — a pattern like \"external\" would otherwise claim every path containing that segment at any\n * depth. Used for config lists that positively identify a set of projects (e.g.\n * `runtime-architecture.externalApiPaths`).\n *\n * Paths are normalized to forward slashes so Windows backslashes match too. Empty `patterns` matches\n * nothing, so an unconfigured list is inert rather than universal.\n *\n * DOTFILE PATHS COUNT (`{ dot: true }`). minimatch's default hides any path segment starting with `.`\n * from a wildcard, so `**` does not match `.github/workflows/deploy.yml` and `.claude/**` does not match\n * `.claude/agents/x.md`. For a repo-path classifier that default is simply wrong: `.github/`, `.claude/`\n * and `.webpieces/` are ordinary, frequently-changed directories here, and a pattern author writing\n * `**` means all of it. Shell-style dot-hiding protects against globbing up `.` and `..`, which is not a\n * hazard any caller here has.\n *\n * The three consumers are named here on purpose, because the widening is silent for them:\n * `build-artifact-gate` (stale generated artifacts), `api-scanner.externalApiPaths` (project\n * classification) and `no-custom-css-scope.allowGlobs` (an EXEMPTION list, so wider = more exempt).\n * None configures a dot-path today, and for all three \"the pattern author meant the whole subtree\" is\n * the reading they already assume — but a future dot-path entry now matches where it silently did not,\n * and that is a deliberate decision recorded here rather than an accident.\n */\n// webpieces-disable no-function-outside-class -- pure path predicate, sibling of isPathExcluded above\nexport function matchesAnyGlob(relPath: string, patterns: readonly string[]): boolean {\n    const norm = relPath.replace(/\\\\/g, '/');\n    for (const pattern of patterns) {\n        if (minimatch(norm, pattern, { dot: true })) return true;\n        if (minimatch(norm, `${pattern}/**`, { dot: true })) return true;\n    }\n    return false;\n}\n"]}

package/src/index.d.ts

@@ -68,7 +68,7 @@ export { ReviewerInstructionsService, ReviewerBriefing, BriefedFile, ContextEntr
 export { GateTokenService, computeGateToken, gateTokenMarker, extractGateToken, verifyGateToken, } from './gate-token';
 export { SubagentProvenanceService, ReviewerEvidence, ReviewerContext, TranscriptScan, ProvenanceResult, PROVENANCE_OK, PROVENANCE_MISSING, PROVENANCE_SKIPPED, } from './subagent-provenance';
 export { ReviewProvenanceService, ReviewProvenance, ReviewerTranscript, ReviewerPaths, OfferedContext, ProvenanceWriteRequest, DEFAULT_RETENTION_DAYS, } from './review-provenance';
-export { ReviewJson, PrContext, ChecklistResult, ChecklistVerdict, CK_PASS, CK_WARN, CK_OVERRIDDEN, CK_FAIL, CK_MISSING, CK_BAD_FORMAT, VERDICT_GREEN, VERDICT_YELLOW, VERDICT_RED, VERDICT_STATUSES, RequiredChecklist, ChecklistReviewContext, ReviewJsonService, prDirFor, reviewJsonPath, reviewJsonSchemaHint, } from './review-json';
+export { ReviewJson, PrContext, ChecklistResult, ChecklistVerdict, ChecklistOverride, ChecklistOverrideService, checklistOverrideService, CK_PASS, CK_WARN, CK_OVERRIDDEN, CK_FAIL, CK_MISSING, CK_BAD_FORMAT, VERDICT_GREEN, VERDICT_YELLOW, VERDICT_RED, VERDICT_STATUSES, RequiredChecklist, ChecklistReviewContext, ReviewJsonService, prDirFor, reviewJsonPath, reviewJsonSchemaHint, } from './review-json';
 export { MainSyncStatus, MainSyncStatusFile, MainSyncFileStore, PullRequestIndex, MAIN_SYNC_STATUS_VERSION, } from './main-sync-file';
 export { MainSyncLock, MainSyncStatusService, DEFAULT_HANG_TIMEOUT_MINUTES, mainSyncStatusPath, mainSyncLockPath, readMainSyncStatus, readMainSyncStatusFile, writeMainSyncStatus, writeMainSyncStatusFile, computeAllMainSyncStatuses, readMainSyncLock, writeMainSyncLock, isLockStale, isRefreshInProgress, tryAcquireMainSyncLock, inProcessLock, finishedLock, computeMainSyncStatus, stampCleanMainSyncStatus, squashRecoverySteps, } from './main-sync-status';
 export { MergedBranch, DeletableBranch, DeletableWorktree, MergedBranchesCache, MergedBranchesService, CacheFreshness, CACHE_STALE_AFTER_MS, CLASSIFICATION_MERGED_PR, CLASSIFICATION_BACKUP_OF_MERGED, CLASSIFICATION_BACKUP_OF_LIVE, CLASSIFICATION_NO_COMMITS, CLASSIFICATION_SUPERSEDED, CLASSIFICATION_CONTENT_IN_MAIN, CLASSIFICATION_NEVER_PROPOSED, CLASSIFICATION_IN_USE, CLASSIFICATION_PRUNABLE, CLASSIFICATION_LOCKED, CLASSIFICATION_CURRENT, CLASSIFICATION_DETACHED, ADJUDICATED_CLASSIFICATIONS, } from './merged-branches';
@@ -82,3 +82,4 @@ export { ReapedWorktree, WorktreeReapResult, WorktreeReaper, } from './worktree-
 export type { MutationVerb, MutationPhase } from './branch-mutation-log';
 export { BranchMutationEvent, BranchMutationLog, branchMutationLogPath, logBranchMutation, } from './branch-mutation-log';
 export { CommandsConfig, buildCommandsConfig, DEFAULT_UPSERT_PR_COMMAND, DEFAULT_MERGE_COMPLETE_COMMAND, } from './commands-config';
+export { StaleBinRemoval, StaleBinSweeper, staleBinSweeper, } from './stale-bin-sweep';

package/src/index.js

@@ -5,9 +5,9 @@ exports.ConfigPruner = exports.retiredRuleFor = exports.retiredKeyErrorsIn = exp
 exports.BRANCH_STATE_GUARD_KEY = exports.HOOK_GUARD_NAMES = exports.schemaFieldNames = exports.DEFAULT_MATCH_RULES = exports.renderMatchRuleMessage = exports.compileMatchRulePatterns = exports.isMatchRuleAllowedPath = exports.findMatchRuleViolations = exports.MatchRuleViolation = exports.MatchRuleConfig = exports.OrphanSweepReport = exports.OrphanDirSweeper = exports.TRASH_RETENTION_DAYS = exports.TRASH_MANIFEST_FILE = exports.TRASH_STATE_DIR = exports.OrphanSweepManifest = exports.OrphanSweepResult = exports.FailedOrphan = exports.ArchivedOrphan = exports.OrphanDirArchiver = exports.OrphanCandidate = exports.OrphanDirScanner = exports.MAX_ROW_BYTES = exports.BUILDS_LOG_GENERATIONS = exports.MAX_BUILDS_LOG_BYTES = exports.BUILD_DONE_FAIL = exports.BUILD_DONE_SUCCESS = exports.BUILD_START = exports.BUILDS_LOCK_FILE = exports.BUILDS_LOG_FILE = exports.RunningBuild = exports.BuildTicket = exports.BuildsLog = exports.DOCUMENTATION_KEYS = exports.HOME_KEY_AI_DOC = exports.HOME_KEY_DOC = exports.DEFAULT_MAX_CONCURRENT_BUILDS = exports.HOME_KEY_MAX_CONCURRENT_BUILDS = exports.HOME_KEY_WHOLE_REPO_BUILD_GUARD = exports.HOME_KEY_ORPHAN_DIR_SWEEP = exports.HOME_EXPERIMENTAL_SECTION = exports.HOME_CONFIG_FILE = exports.HOME_CONFIG_DIR = exports.RETIRED_HOME_CONFIG_KEYS = exports.RetiredHomeConfigKey = exports.HomeConfigService = exports.HomeConfig = exports.validateChecklistDocs = exports.PrunedKey = exports.PruneResult = void 0;
 exports.AngularNoDirectApiInResolverConfig = exports.ThrowCauseRequiredConfig = exports.CatchErrorPatternConfig = exports.NoUnmanagedExceptionsConfig = exports.NoDestructureConfig = exports.PrismaConverterConfig = exports.PrismaValidateDtosConfig = exports.NoImplicitAnyConfig = exports.NoAnyUnknownConfig = exports.NoInlineTypeLiteralsConfig = exports.RequireReturnTypeConfig = exports.MaxFileLinesConfig = exports.MaxMethodLinesConfig = exports.WP_FINISH_PUSH_DEV = exports.WP_PUSH_DEV = exports.WP_FINISH_UPSERT_PR = exports.WP_START_UPSERT_PR = exports.WP_FINISH_UPDATE = exports.WP_START_UPDATE = exports.SyncFlowGuidance = exports.WebpiecesRulesConfig = exports.PRUNE_UNKNOWN_COMMAND = exports.PUSH_DEV_STATE_FILE = exports.MERGE_EXPLANATION_FILE = exports.MERGE_IN_PROGRESS_FILE = exports.PR_REVIEW_DIR = exports.MERGE_INFO_DIR = exports.WEBPIECES_TMP_DIR = exports.hasDisable = exports.RULE_NAMES = exports.WEBPIECES_DISABLE = exports.AbstractRule = exports.ChangedFilesOptions = exports.DiffRange = exports.DiffScope = exports.isNewOrModified = exports.hasChangesInRange = exports.findNewMethodSignaturesInDiff = exports.getChangedLineNumbers = exports.getFileDiff = exports.getChangedFiles = exports.resolveBase = exports.detectBase = exports.SkipRuleResult = exports.getCurrentBranch = exports.shouldSkipRule = exports.FieldDef = exports.sectionForRule = exports.isHookGuard = exports.PR_LIFECYCLE_GUARD_KEY = void 0;
 exports.defaultPrGateConfig = exports.defaultGates = exports.ReviewContextEntry = exports.DEFAULT_DEV_BRANCH = exports.DEFAULT_DEV_BRANCH_NAMESPACE = exports.DevDeployConfig = exports.LandPrConfig = exports.DEFAULT_BUILD_COMMAND = exports.PrGateConfig = exports.GateDefinition = exports.BranchStateGuardConfig = exports.DEFAULT_BANNED_STATE_PATH_PREFIXES = exports.DEFAULT_TEMPLATE_DIRS = exports.NoStatePathsInTemplatesConfig = exports.CLIENT_CREATION_SEVERITIES = exports.NoClientCreationOutsideServerOrClientConfig = exports.VALIDATE_TS_MODES = exports.STRUCTURAL_MODES = exports.ON_OFF_MODES = exports.THROW_CAUSE_MODES = exports.DIRECT_API_RESOLVER_MODES = exports.PRISMA_CONVERTER_MODES = exports.PRISMA_DTOS_MODES = exports.PROJECT_MODES = exports.MODIFIED_CODE_MODES = exports.INLINE_TYPE_MODES = exports.RETURN_TYPE_MODES = exports.FILE_LIMIT_MODES = exports.METHOD_LIMIT_MODES = exports.BaseRuleConfig = exports.ValidateEslintSyncConfig = exports.ValidateVersionsLockedConfig = exports.ValidatePackageJsonConfig = exports.ValidateNoArchitectureCyclesConfig = exports.ValidateArchitectureUnchangedConfig = exports.ValidateTsInSrcConfig = exports.NoJsFilesConfig = exports.DiGraphConfig = exports.NxWiringConfig = exports.RuntimeArchitectureConfig = exports.NoFileImportCyclesConfig = exports.PrLifecycleGuardConfig = exports.BranchCreationGuardConfig = exports.RoleTagConfig = exports.FrameworkTagConfig = exports.InjectAnnotationNotNeededForConcreteClassConfig = exports.NoFunctionOutsideClassConfig = exports.NoProcessExitOutsideMainConfig = exports.NoCustomCssConfig = exports.NoSymbolDiTokensConfig = void 0;
-exports.CK_BAD_FORMAT = exports.CK_MISSING = exports.CK_FAIL = exports.CK_OVERRIDDEN = exports.CK_WARN = exports.CK_PASS = exports.ChecklistVerdict = exports.ChecklistResult = exports.PrContext = exports.ReviewJson = exports.DEFAULT_RETENTION_DAYS = exports.ProvenanceWriteRequest = exports.OfferedContext = exports.ReviewerPaths = exports.ReviewerTranscript = exports.ReviewProvenance = exports.ReviewProvenanceService = exports.PROVENANCE_SKIPPED = exports.PROVENANCE_MISSING = exports.PROVENANCE_OK = exports.ProvenanceResult = exports.TranscriptScan = exports.ReviewerContext = exports.ReviewerEvidence = exports.SubagentProvenanceService = exports.verifyGateToken = exports.extractGateToken = exports.gateTokenMarker = exports.computeGateToken = exports.GateTokenService = exports.ALL_DIFF_ONE_READ_LINES = exports.READ_TRUNCATION_LINES = exports.ContextEntry = exports.BriefedFile = exports.ReviewerBriefing = exports.ReviewerInstructionsService = exports.ChecklistInstructionsService = exports.ChecklistValidator = exports.formatFileList = exports.normalizeChecklistDoc = exports.toChecklist = exports.ChecklistDefinition = exports.MERGE_MODES = exports.MERGE_MODE_NONE = exports.MERGE_MODE_AUTO = exports.buildDevDeployConfig = exports.buildLandPrConfig = exports.buildPrGateConfig = exports.defaultDevDeployConfig = exports.defaultLandPrConfig = void 0;
-exports.CLASSIFICATION_IN_USE = exports.CLASSIFICATION_NEVER_PROPOSED = exports.CLASSIFICATION_CONTENT_IN_MAIN = exports.CLASSIFICATION_SUPERSEDED = exports.CLASSIFICATION_NO_COMMITS = exports.CLASSIFICATION_BACKUP_OF_LIVE = exports.CLASSIFICATION_BACKUP_OF_MERGED = exports.CLASSIFICATION_MERGED_PR = exports.CACHE_STALE_AFTER_MS = exports.CacheFreshness = exports.MergedBranchesService = exports.MergedBranchesCache = exports.DeletableWorktree = exports.DeletableBranch = exports.MergedBranch = exports.squashRecoverySteps = exports.stampCleanMainSyncStatus = exports.computeMainSyncStatus = exports.finishedLock = exports.inProcessLock = exports.tryAcquireMainSyncLock = exports.isRefreshInProgress = exports.isLockStale = exports.writeMainSyncLock = exports.readMainSyncLock = exports.computeAllMainSyncStatuses = exports.writeMainSyncStatusFile = exports.writeMainSyncStatus = exports.readMainSyncStatusFile = exports.readMainSyncStatus = exports.mainSyncLockPath = exports.mainSyncStatusPath = exports.DEFAULT_HANG_TIMEOUT_MINUTES = exports.MainSyncStatusService = exports.MainSyncLock = exports.MAIN_SYNC_STATUS_VERSION = exports.PullRequestIndex = exports.MainSyncFileStore = exports.MainSyncStatusFile = exports.MainSyncStatus = exports.reviewJsonSchemaHint = exports.reviewJsonPath = exports.prDirFor = exports.ReviewJsonService = exports.ChecklistReviewContext = exports.RequiredChecklist = exports.VERDICT_STATUSES = exports.VERDICT_RED = exports.VERDICT_YELLOW = exports.VERDICT_GREEN = void 0;
-exports.DEFAULT_MERGE_COMPLETE_COMMAND = exports.DEFAULT_UPSERT_PR_COMMAND = exports.buildCommandsConfig = exports.CommandsConfig = exports.logBranchMutation = exports.branchMutationLogPath = exports.BranchMutationLog = exports.BranchMutationEvent = exports.WorktreeReaper = exports.WorktreeReapResult = exports.ReapedWorktree = exports.BranchReaper = exports.ReapResult = exports.ReapedBranch = exports.HarnessAgentActivityReader = exports.AgentActivity = exports.AGENT_TRANSCRIPT_QUIET_MS = exports.AGENT_ACTIVITY_UNKNOWN = exports.AGENT_ACTIVITY_RETURNED = exports.AGENT_ACTIVITY_LIVE = exports.WorktreeLockVerdicts = exports.LockEvidence = exports.LockDecision = exports.LOCK_LIVENESS_UNVERIFIABLE = exports.HARNESS_NOT_CONSULTED = exports.AgentWorktreeLockReader = exports.AgentWorktreeLock = exports.WorktreeService = exports.WorktreeWorkInFlight = exports.Worktree = exports.BRANCH_RETENTION_KEEP = exports.BRANCH_RETENTION_ARCHIVE_TAG = exports.BRANCH_RETENTION_DELETE = exports.BRANCH_RETENTIONS = exports.ARCHIVE_TAG_PREFIX = exports.ArchiveResult = exports.BranchArchiver = exports.ADJUDICATED_CLASSIFICATIONS = exports.CLASSIFICATION_DETACHED = exports.CLASSIFICATION_CURRENT = exports.CLASSIFICATION_LOCKED = exports.CLASSIFICATION_PRUNABLE = void 0;
+exports.CK_OVERRIDDEN = exports.CK_WARN = exports.CK_PASS = exports.checklistOverrideService = exports.ChecklistOverrideService = exports.ChecklistOverride = exports.ChecklistVerdict = exports.ChecklistResult = exports.PrContext = exports.ReviewJson = exports.DEFAULT_RETENTION_DAYS = exports.ProvenanceWriteRequest = exports.OfferedContext = exports.ReviewerPaths = exports.ReviewerTranscript = exports.ReviewProvenance = exports.ReviewProvenanceService = exports.PROVENANCE_SKIPPED = exports.PROVENANCE_MISSING = exports.PROVENANCE_OK = exports.ProvenanceResult = exports.TranscriptScan = exports.ReviewerContext = exports.ReviewerEvidence = exports.SubagentProvenanceService = exports.verifyGateToken = exports.extractGateToken = exports.gateTokenMarker = exports.computeGateToken = exports.GateTokenService = exports.ALL_DIFF_ONE_READ_LINES = exports.READ_TRUNCATION_LINES = exports.ContextEntry = exports.BriefedFile = exports.ReviewerBriefing = exports.ReviewerInstructionsService = exports.ChecklistInstructionsService = exports.ChecklistValidator = exports.formatFileList = exports.normalizeChecklistDoc = exports.toChecklist = exports.ChecklistDefinition = exports.MERGE_MODES = exports.MERGE_MODE_NONE = exports.MERGE_MODE_AUTO = exports.buildDevDeployConfig = exports.buildLandPrConfig = exports.buildPrGateConfig = exports.defaultDevDeployConfig = exports.defaultLandPrConfig = void 0;
+exports.CLASSIFICATION_SUPERSEDED = exports.CLASSIFICATION_NO_COMMITS = exports.CLASSIFICATION_BACKUP_OF_LIVE = exports.CLASSIFICATION_BACKUP_OF_MERGED = exports.CLASSIFICATION_MERGED_PR = exports.CACHE_STALE_AFTER_MS = exports.CacheFreshness = exports.MergedBranchesService = exports.MergedBranchesCache = exports.DeletableWorktree = exports.DeletableBranch = exports.MergedBranch = exports.squashRecoverySteps = exports.stampCleanMainSyncStatus = exports.computeMainSyncStatus = exports.finishedLock = exports.inProcessLock = exports.tryAcquireMainSyncLock = exports.isRefreshInProgress = exports.isLockStale = exports.writeMainSyncLock = exports.readMainSyncLock = exports.computeAllMainSyncStatuses = exports.writeMainSyncStatusFile = exports.writeMainSyncStatus = exports.readMainSyncStatusFile = exports.readMainSyncStatus = exports.mainSyncLockPath = exports.mainSyncStatusPath = exports.DEFAULT_HANG_TIMEOUT_MINUTES = exports.MainSyncStatusService = exports.MainSyncLock = exports.MAIN_SYNC_STATUS_VERSION = exports.PullRequestIndex = exports.MainSyncFileStore = exports.MainSyncStatusFile = exports.MainSyncStatus = exports.reviewJsonSchemaHint = exports.reviewJsonPath = exports.prDirFor = exports.ReviewJsonService = exports.ChecklistReviewContext = exports.RequiredChecklist = exports.VERDICT_STATUSES = exports.VERDICT_RED = exports.VERDICT_YELLOW = exports.VERDICT_GREEN = exports.CK_BAD_FORMAT = exports.CK_MISSING = exports.CK_FAIL = void 0;
+exports.staleBinSweeper = exports.StaleBinSweeper = exports.StaleBinRemoval = exports.DEFAULT_MERGE_COMPLETE_COMMAND = exports.DEFAULT_UPSERT_PR_COMMAND = exports.buildCommandsConfig = exports.CommandsConfig = exports.logBranchMutation = exports.branchMutationLogPath = exports.BranchMutationLog = exports.BranchMutationEvent = exports.WorktreeReaper = exports.WorktreeReapResult = exports.ReapedWorktree = exports.BranchReaper = exports.ReapResult = exports.ReapedBranch = exports.HarnessAgentActivityReader = exports.AgentActivity = exports.AGENT_TRANSCRIPT_QUIET_MS = exports.AGENT_ACTIVITY_UNKNOWN = exports.AGENT_ACTIVITY_RETURNED = exports.AGENT_ACTIVITY_LIVE = exports.WorktreeLockVerdicts = exports.LockEvidence = exports.LockDecision = exports.LOCK_LIVENESS_UNVERIFIABLE = exports.HARNESS_NOT_CONSULTED = exports.AgentWorktreeLockReader = exports.AgentWorktreeLock = exports.WorktreeService = exports.WorktreeWorkInFlight = exports.Worktree = exports.BRANCH_RETENTION_KEEP = exports.BRANCH_RETENTION_ARCHIVE_TAG = exports.BRANCH_RETENTION_DELETE = exports.BRANCH_RETENTIONS = exports.ARCHIVE_TAG_PREFIX = exports.ArchiveResult = exports.BranchArchiver = exports.ADJUDICATED_CLASSIFICATIONS = exports.CLASSIFICATION_DETACHED = exports.CLASSIFICATION_CURRENT = exports.CLASSIFICATION_LOCKED = exports.CLASSIFICATION_PRUNABLE = exports.CLASSIFICATION_IN_USE = exports.CLASSIFICATION_NEVER_PROPOSED = exports.CLASSIFICATION_CONTENT_IN_MAIN = void 0;
 var types_1 = require("./types");
 Object.defineProperty(exports, "ResolvedConfig", { enumerable: true, get: function () { return types_1.ResolvedConfig; } });
 Object.defineProperty(exports, "ResolvedRuleConfig", { enumerable: true, get: function () { return types_1.ResolvedRuleConfig; } });
@@ -412,6 +412,9 @@ Object.defineProperty(exports, "ReviewJson", { enumerable: true, get: function (
 Object.defineProperty(exports, "PrContext", { enumerable: true, get: function () { return review_json_1.PrContext; } });
 Object.defineProperty(exports, "ChecklistResult", { enumerable: true, get: function () { return review_json_1.ChecklistResult; } });
 Object.defineProperty(exports, "ChecklistVerdict", { enumerable: true, get: function () { return review_json_1.ChecklistVerdict; } });
+Object.defineProperty(exports, "ChecklistOverride", { enumerable: true, get: function () { return review_json_1.ChecklistOverride; } });
+Object.defineProperty(exports, "ChecklistOverrideService", { enumerable: true, get: function () { return review_json_1.ChecklistOverrideService; } });
+Object.defineProperty(exports, "checklistOverrideService", { enumerable: true, get: function () { return review_json_1.checklistOverrideService; } });
 Object.defineProperty(exports, "CK_PASS", { enumerable: true, get: function () { return review_json_1.CK_PASS; } });
 Object.defineProperty(exports, "CK_WARN", { enumerable: true, get: function () { return review_json_1.CK_WARN; } });
 Object.defineProperty(exports, "CK_OVERRIDDEN", { enumerable: true, get: function () { return review_json_1.CK_OVERRIDDEN; } });
@@ -522,4 +525,8 @@ Object.defineProperty(exports, "CommandsConfig", { enumerable: true, get: functi
 Object.defineProperty(exports, "buildCommandsConfig", { enumerable: true, get: function () { return commands_config_1.buildCommandsConfig; } });
 Object.defineProperty(exports, "DEFAULT_UPSERT_PR_COMMAND", { enumerable: true, get: function () { return commands_config_1.DEFAULT_UPSERT_PR_COMMAND; } });
 Object.defineProperty(exports, "DEFAULT_MERGE_COMPLETE_COMMAND", { enumerable: true, get: function () { return commands_config_1.DEFAULT_MERGE_COMPLETE_COMMAND; } });
+var stale_bin_sweep_1 = require("./stale-bin-sweep");
+Object.defineProperty(exports, "StaleBinRemoval", { enumerable: true, get: function () { return stale_bin_sweep_1.StaleBinRemoval; } });
+Object.defineProperty(exports, "StaleBinSweeper", { enumerable: true, get: function () { return stale_bin_sweep_1.StaleBinSweeper; } });
+Object.defineProperty(exports, "staleBinSweeper", { enumerable: true, get: function () { return stale_bin_sweep_1.staleBinSweeper; } });
 //# sourceMappingURL=index.js.map