vigiles 13.0.0 → 14.0.0

package/dist/cli.js

@@ -37,6 +37,8 @@ const audit_serve_js_1 = require("./audit-serve.js");
 const audit_report_js_1 = require("./audit-report.js");
 const rule_inventory_js_1 = require("./rule-inventory.js");
 const rule_routing_js_1 = require("./rule-routing.js");
+const instruction_sources_js_1 = require("./instruction-sources.js");
+const rule_catalog_js_1 = require("./core/rule-catalog.js");
 const adoptability_js_1 = require("./adoptability.js");
 const compile_js_1 = require("./core/compile.js");
 const proofs_js_1 = require("./core/proofs.js");
@@ -1513,7 +1515,11 @@ function collectLintConfigText(root) {
  * NO model, NO config execution — safe on any repo. Composition-root. */
 function computeRuleInventory(root, instructionFile) {
     try {
-        const instructionText = readInstructionText(root, instructionFile);
+        // The inventory maps intents → rules; it has no per-file line provenance, so
+        // the concatenated text is fine here (unlike the routing preview below).
+        const instructionText = gatherInstructionFiles(root, instructionFile)
+            .map((f) => f.text)
+            .join("\n");
         if (!instructionText.trim())
             return [];
         return (0, rule_inventory_js_1.buildRuleInventory)(instructionText, collectLintConfigText(root));
@@ -1522,27 +1528,79 @@ function computeRuleInventory(root, instructionFile) {
         return [];
     }
 }
-/** Read EVERY agent instruction file present (not just the harness-native one) —
- * rules are often documented in AGENTS.md even under a claude-code harness. */
-function readInstructionText(root, instructionFile) {
-    let instructionText = "";
-    for (const name of new Set([instructionFile, "CLAUDE.md", "AGENTS.md"])) {
-        const p = (0, node_path_1.resolve)(root, name);
-        if ((0, node_fs_1.existsSync)(p))
-            instructionText += (0, node_fs_1.readFileSync)(p, "utf-8") + "\n";
+/** Gather EVERY agent instruction file present (not just the harness-native one) —
+ * rules are often documented in AGENTS.md even under a claude-code harness — as a
+ * list of {path, text} so each is routed SEPARATELY and keeps its OWN provenance
+ * (concatenating first would corrupt per-file line numbers). Reads the ROOT
+ * instruction files PLUS nested subdirectory-memory (`src/CLAUDE.md`,
+ * `research/CLAUDE.md`, …), skipping fixture/demo/build/test dirs (`isFixturePath`)
+ * so a repo's real memory is read without the test-fixture noise. `.claude/` rule
+ * sources remain a future source. research/rule-compiler-multilang-design.md §0. */
+function gatherInstructionFiles(root, instructionFile) {
+    const raw = [];
+    const collect = (rel) => {
+        const p = (0, node_path_1.resolve)(root, rel);
+        if (!(0, node_fs_1.existsSync)(p))
+            return;
+        raw.push({
+            path: rel,
+            canonical: (0, node_fs_1.realpathSync)(p),
+            text: (0, node_fs_1.readFileSync)(p, "utf-8"),
+        });
+    };
+    // Root instruction files first (stable, deterministic order).
+    for (const name of new Set([instructionFile, "CLAUDE.md", "AGENTS.md"]))
+        collect(name);
+    // Nested subdirectory memory, minus fixture/demo/build/test noise.
+    try {
+        const nested = (0, glob_1.globSync)(["**/CLAUDE.md", "**/AGENTS.md"], {
+            cwd: root,
+            ignore: [...IGNORE_NODE_MODULES, "dist/**", ".git/**"],
+        })
+            .filter((rel) => !(0, instruction_sources_js_1.isFixturePath)(rel))
+            .sort();
+        for (const rel of nested)
+            collect(rel);
     }
-    return instructionText;
+    catch {
+        // best-effort — a glob failure just means root-only, never breaks the audit
+    }
+    // Dedup a CLAUDE.md⇄AGENTS.md mirror (symlink or byte-identical sync) to ONE
+    // artifact so its rules aren't double-counted (compose-with-sync-tools).
+    return (0, instruction_sources_js_1.dedupeInstructionFiles)(raw);
 }
 /** The deterministic State-B routing preview for `audit`: segment the instruction
- * file(s) into atomic rules and route each (reuse / hook / semantic / unrouted) —
+ * file(s) into atomic rules and route each (reuse / hook / meta / semantic / unrouted) —
  * NO model, fs-only. `undefined` when there's nothing to segment (kept off the
- * report). Best-effort; a routing failure never breaks the audit. */
+ * report). Best-effort; a routing failure never breaks the audit.
+ *
+ * The DYNAMIC catalog (every rule the repo's ESLint actually has + its enabled
+ * state) sharpens matching — but enumerating it EXECUTES the linter, so it is an
+ * OWN-REPO / CONSENTED capability (audit-side-effect-free): gated on the same
+ * sticky `audit.measure` consent as the other executing checks AND on own-repo
+ * (never a stranger's toolchain). The textual routing is the foreign-safe default;
+ * the catalog only ADDS enabled-state nudges and matches named-but-`/`-broken rules. */
 function computeRuleRouting(root, instructionFile) {
     try {
-        const instructionText = readInstructionText(root, instructionFile);
-        if (!instructionText.trim())
+        const files = gatherInstructionFiles(root, instructionFile);
+        if (files.every((f) => !f.text.trim()))
             return undefined;
-        const routing = (0, rule_routing_js_1.routeRules)(instructionText, instructionFile);
+        // Own-repo + consented → enumerate the live ESLint catalog. NOT gated on the
+        // agent harness: the catalog is a property of the repo's LINTER (its ESLint
+        // config on disk), not of Claude-Code-vs-Codex, so a Codex JS/TS repo gets the
+        // same catalog match + enabled-state (adapter-aware-lint-rules: never gate a
+        // harness-agnostic capability on CC). enumerateEslintCatalog returns null when
+        // no ESLint config resolves (e.g. a pure-Python repo) → undefined, so a non-JS
+        // repo simply falls back to the foreign-safe textual routing regardless.
+        const ownRepo = (0, node_path_1.resolve)(root) === (0, node_path_1.resolve)(process.cwd());
+        const consented = (0, validate_js_1.loadConfig)().audit?.measure === true;
+        const availableRules = ownRepo && consented
+            ? ((0, rule_catalog_js_1.enumerateEslintCatalog)(root) ?? undefined)
+            : undefined;
+        // Route each source SEPARATELY (each rule keeps its own file + line numbers),
+        // then merge — so a CLAUDE.md rule and an AGENTS.md rule carry correct
+        // provenance instead of line numbers offset by a concatenation.
+        const routing = (0, rule_routing_js_1.mergeRoutings)(files.map((f) => (0, rule_routing_js_1.routeRules)(f.text, f.path, { availableRules })));
         return routing.segmented > 0 ? routing : undefined;
     }
     catch {

package/dist/core/rule-catalog.d.ts

@@ -0,0 +1,56 @@
+/**
+ * vigiles rule-catalog — the DYNAMIC available-rule catalog.
+ *
+ * Enumerates every lint rule the repo's linter ACTUALLY has — core built-ins PLUS
+ * every installed plugin's rules — so prose can be matched against the LIVE
+ * catalog instead of a static hand-curated map. On this repo one ESLint API call
+ * yields ~702 available rules (292 core + 410 plugin: typescript-eslint / sonarjs
+ * / boundaries), of which ~140 are enabled — vs the old static map's ~23. That
+ * makes an architecture norm enforceable too (`boundaries/dependencies` is in the
+ * catalog), which a static map never captured. See
+ * `research/rule-compiler-multilang-design.md` §0 (the spike this productizes).
+ *
+ * SAFETY — this EXECUTES the linter. Loading ESLint resolves the repo's real
+ * config (which can run plugin/config code), so `enumerateEslintCatalog` is an
+ * OWN-REPO / consented capability, NOT the foreign-safe default. The deterministic
+ * default rule-compile tier stays purely TEXTUAL (it parses config, never loads
+ * it); reach for this only where executing the repo's toolchain is already
+ * consented (own repo, on the user's machine). Mirrors the subprocess pattern of
+ * `discoverEslintRules` in `src/core/generate-types.ts`: ESLint is loaded in a
+ * child `node -e` process at the repo's cwd so it stays out of our process.
+ */
+/** One rule the repo's linter has available, with its enabled state. */
+export interface AvailableRule {
+    /** The rule id: `no-console`, `@typescript-eslint/no-explicit-any`, `boundaries/dependencies`. */
+    id: string;
+    /** The plugin prefix (`@typescript-eslint`, `boundaries`), or null for a core rule. */
+    plugin: string | null;
+    /** Whether the rule is enabled (severity not 0/"off") in the resolved config. */
+    enabled: boolean;
+}
+/** The full available-rule catalog for a repo's linter. */
+export interface RuleCatalog {
+    linter: "eslint";
+    /** Total rules available (core + every installed plugin). */
+    available: number;
+    /** How many of those are enabled in the resolved config. */
+    enabled: number;
+    rules: AvailableRule[];
+}
+/**
+ * Parse the enumeration subprocess's JSON payload into a typed {@link RuleCatalog}.
+ *
+ * Payload shape: `{ core: string[]; enabled: string[]; plugins: Record<prefix, string[]> }`.
+ * Returns null on `"null"` / malformed input / an empty catalog (mirrors
+ * `discoverEslintRules` returning null when nothing is found).
+ */
+export declare function parseEslintCatalog(raw: string): RuleCatalog | null;
+/**
+ * Enumerate the repo's available ESLint rules (core + every installed plugin).
+ *
+ * EXECUTES the repo's ESLint in a child process — an own-repo / consented
+ * capability (see the file header). Returns null if ESLint isn't resolvable, no
+ * config applies, or the subprocess fails.
+ */
+export declare function enumerateEslintCatalog(root: string): RuleCatalog | null;
+//# sourceMappingURL=rule-catalog.d.ts.map

package/dist/core/rule-catalog.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * vigiles rule-catalog — the DYNAMIC available-rule catalog.
+ *
+ * Enumerates every lint rule the repo's linter ACTUALLY has — core built-ins PLUS
+ * every installed plugin's rules — so prose can be matched against the LIVE
+ * catalog instead of a static hand-curated map. On this repo one ESLint API call
+ * yields ~702 available rules (292 core + 410 plugin: typescript-eslint / sonarjs
+ * / boundaries), of which ~140 are enabled — vs the old static map's ~23. That
+ * makes an architecture norm enforceable too (`boundaries/dependencies` is in the
+ * catalog), which a static map never captured. See
+ * `research/rule-compiler-multilang-design.md` §0 (the spike this productizes).
+ *
+ * SAFETY — this EXECUTES the linter. Loading ESLint resolves the repo's real
+ * config (which can run plugin/config code), so `enumerateEslintCatalog` is an
+ * OWN-REPO / consented capability, NOT the foreign-safe default. The deterministic
+ * default rule-compile tier stays purely TEXTUAL (it parses config, never loads
+ * it); reach for this only where executing the repo's toolchain is already
+ * consented (own repo, on the user's machine). Mirrors the subprocess pattern of
+ * `discoverEslintRules` in `src/core/generate-types.ts`: ESLint is loaded in a
+ * child `node -e` process at the repo's cwd so it stays out of our process.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseEslintCatalog = parseEslintCatalog;
+exports.enumerateEslintCatalog = enumerateEslintCatalog;
+const node_path_1 = require("node:path");
+const node_child_process_1 = require("node:child_process");
+// ---------------------------------------------------------------------------
+// Pure parse: subprocess JSON → typed catalog (covered by the unit test)
+// ---------------------------------------------------------------------------
+function isStringArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === "string");
+}
+function parsePlugins(v) {
+    if (typeof v !== "object" || v === null)
+        return {};
+    const out = {};
+    for (const [prefix, rules] of Object.entries(v)) {
+        if (isStringArray(rules))
+            out[prefix] = rules;
+    }
+    return out;
+}
+function buildRules(core, plugins, enabledSet) {
+    const rules = [];
+    for (const id of core) {
+        rules.push({ id, plugin: null, enabled: enabledSet.has(id) });
+    }
+    for (const [prefix, pluginRules] of Object.entries(plugins)) {
+        for (const rule of pluginRules) {
+            const id = `${prefix}/${rule}`;
+            rules.push({ id, plugin: prefix, enabled: enabledSet.has(id) });
+        }
+    }
+    return rules;
+}
+/**
+ * Parse the enumeration subprocess's JSON payload into a typed {@link RuleCatalog}.
+ *
+ * Payload shape: `{ core: string[]; enabled: string[]; plugins: Record<prefix, string[]> }`.
+ * Returns null on `"null"` / malformed input / an empty catalog (mirrors
+ * `discoverEslintRules` returning null when nothing is found).
+ */
+function parseEslintCatalog(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed === "null")
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return null;
+    const obj = parsed;
+    const core = isStringArray(obj.core) ? obj.core : [];
+    const enabledList = isStringArray(obj.enabled) ? obj.enabled : [];
+    const plugins = parsePlugins(obj.plugins);
+    const rules = buildRules(core, plugins, new Set(enabledList));
+    if (rules.length === 0)
+        return null;
+    const enabled = rules.reduce((n, r) => (r.enabled ? n + 1 : n), 0);
+    return { linter: "eslint", available: rules.length, enabled, rules };
+}
+// ---------------------------------------------------------------------------
+// Real-IO seam: run ESLint in a child process at the repo's cwd
+// ---------------------------------------------------------------------------
+/* v8 ignore start -- spawns a `node -e` subprocess that LOADS ESLint in the
+   repo's cwd (the executes-the-linter seam); the pure JSON→typed parse is
+   parseEslintCatalog, covered by the unit test, and the gated integration test
+   drives this real path when eslint resolves. */
+/**
+ * Enumerate the repo's available ESLint rules (core + every installed plugin).
+ *
+ * EXECUTES the repo's ESLint in a child process — an own-repo / consented
+ * capability (see the file header). Returns null if ESLint isn't resolvable, no
+ * config applies, or the subprocess fails.
+ */
+function enumerateEslintCatalog(root) {
+    try {
+        // A `.ts` path under src/ so the repo's flat config applies its TypeScript +
+        // plugin blocks (typescript-eslint / sonarjs / boundaries all scope to
+        // `src/**/*.ts`); the path need not exist — calculateConfigForFile resolves
+        // the config, it does not read the file.
+        const probeFile = (0, node_path_1.resolve)(root, "src/index.ts");
+        const script = `
+      const { loadESLint } = require("eslint");
+      const { builtinRules } = require("eslint/use-at-your-own-risk");
+      (async () => {
+        try {
+          const ESLint = await loadESLint();
+          const eslint = new ESLint({ cwd: ${JSON.stringify(root)} });
+          const cfg = await eslint.calculateConfigForFile(${JSON.stringify(probeFile)});
+          const core = [...builtinRules.keys()];
+          const enabled = Object.entries(cfg.rules || {})
+            .filter(([, v]) => {
+              const sev = Array.isArray(v) ? v[0] : v;
+              return sev !== 0 && sev !== "off";
+            })
+            .map(([k]) => k);
+          const plugins = {};
+          for (const [prefix, plugin] of Object.entries(cfg.plugins || {})) {
+            plugins[prefix] = Object.keys((plugin && plugin.rules) || {});
+          }
+          console.log(JSON.stringify({ core, enabled, plugins }));
+        } catch (e) {
+          console.log("null");
+        }
+      })();
+    `;
+        const output = (0, node_child_process_1.execSync)(`node -e '${script.replace(/'/g, "'\\''")}'`, {
+            encoding: "utf-8",
+            cwd: root,
+            stdio: ["pipe", "pipe", "pipe"],
+            timeout: 15000,
+        });
+        return parseEslintCatalog(output);
+    }
+    catch {
+        return null;
+    }
+}
+/* v8 ignore stop */
+//# sourceMappingURL=rule-catalog.js.map

package/dist/eval.d.ts

@@ -755,7 +755,19 @@ export interface EvalDriver {
      */
     readonly harness?: string;
 }
-/** The default (Claude Code) eval driver: real `claude` + stream-json parsing. */
+/**
+ * The default (Claude Code) eval driver: real `claude` + stream-json parsing.
+ *
+ * This lives at the COMPOSITION ROOT (`src/eval.ts`) on purpose, not in
+ * `src/adapters/claude-code/` — it is NOT a boundary leak. Claude Code is the
+ * wired DEFAULT (`measureTriggerRate`/`runEval` fall back to it), so `eval.ts`
+ * must reference it directly; wiring the default is precisely a composition
+ * root's job. `codexEvalDriver` lives in its adapter dir instead because Codex
+ * is caller-INJECTED (never a default), so `eval.ts` never imports it. Relocating
+ * this into the adapter would make `eval.ts → adapters/claude-code → eval.ts` a
+ * circular import (the shared `EvalDriver`/`ModelOutputParser` types live here).
+ * The asymmetry reflects default-vs-injected, not a hexagonal violation.
+ */
 export declare const claudeEvalDriver: EvalDriver;
 /**
  * Package loose `<skillsDir>/<name>/SKILL.md` skills into a throwaway plugin dir

package/dist/eval.js

@@ -1240,7 +1240,19 @@ function formatEvalReport(report) {
     }
     return lines.join("\n");
 }
-/** The default (Claude Code) eval driver: real `claude` + stream-json parsing. */
+/**
+ * The default (Claude Code) eval driver: real `claude` + stream-json parsing.
+ *
+ * This lives at the COMPOSITION ROOT (`src/eval.ts`) on purpose, not in
+ * `src/adapters/claude-code/` — it is NOT a boundary leak. Claude Code is the
+ * wired DEFAULT (`measureTriggerRate`/`runEval` fall back to it), so `eval.ts`
+ * must reference it directly; wiring the default is precisely a composition
+ * root's job. `codexEvalDriver` lives in its adapter dir instead because Codex
+ * is caller-INJECTED (never a default), so `eval.ts` never imports it. Relocating
+ * this into the adapter would make `eval.ts → adapters/claude-code → eval.ts` a
+ * circular import (the shared `EvalDriver`/`ModelOutputParser` types live here).
+ * The asymmetry reflects default-vs-injected, not a hexagonal violation.
+ */
 exports.claudeEvalDriver = {
     runner: spawnAgent,
     parse: parseClaudeRun,

package/dist/instruction-sources.d.ts

@@ -0,0 +1,39 @@
+/**
+ * instruction-sources.ts — the pure policy for WHICH instruction files the audit
+ * rule-routing preview reads.
+ *
+ * A repo's real subdirectory memory (`src/CLAUDE.md`, `research/CLAUDE.md`, a
+ * nested `AGENTS.md`) IS worth routing; a fixture/demo/build/test CLAUDE.md is
+ * NOISE that would flood the preview. `isFixturePath` is the precision-first
+ * discriminator (over-skip a legit `sample-service` before flooding with fixture
+ * rules). Pure + unit-tested; the fs discovery/glue lives in cli.ts
+ * (`gatherInstructionFiles`). See research/rule-compiler-multilang-design.md §0.
+ */
+/** One instruction file gathered from disk, with its canonical (symlink-resolved)
+ * path so a mirror can be detected. */
+export interface RawInstructionFile {
+    /** The repo-relative path (kept for provenance). */
+    readonly path: string;
+    /** The realpath (symlink-resolved) — a symlinked mirror shares this. */
+    readonly canonical: string;
+    readonly text: string;
+}
+/**
+ * Dedup instruction files so a `CLAUDE.md`⇄`AGENTS.md` MIRROR is routed ONCE, not
+ * double-counted (compose-with-sync-tools: a symlinked or byte-identical synced
+ * mirror is ONE logical artifact). Dedups by BOTH the canonical path (a symlink)
+ * AND the content hash (a byte-identical sync) — relative-path dedup alone caught
+ * neither. First occurrence wins (callers pass root files first). Pure.
+ */
+export declare function dedupeInstructionFiles(files: readonly RawInstructionFile[]): {
+    path: string;
+    text: string;
+}[];
+/**
+ * Is this (repo-relative) instruction-file path fixture/demo/build/test noise?
+ * True when any DIRECTORY segment (never the filename) is a build/deps/test dir
+ * OR starts with a demo/example/sample/fixture/bench/mock/scratch/tmp prefix.
+ * Conventional + general (not vigiles-specific), precision over recall.
+ */
+export declare function isFixturePath(relPath: string): boolean;
+//# sourceMappingURL=instruction-sources.d.ts.map

package/dist/instruction-sources.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * instruction-sources.ts — the pure policy for WHICH instruction files the audit
+ * rule-routing preview reads.
+ *
+ * A repo's real subdirectory memory (`src/CLAUDE.md`, `research/CLAUDE.md`, a
+ * nested `AGENTS.md`) IS worth routing; a fixture/demo/build/test CLAUDE.md is
+ * NOISE that would flood the preview. `isFixturePath` is the precision-first
+ * discriminator (over-skip a legit `sample-service` before flooding with fixture
+ * rules). Pure + unit-tested; the fs discovery/glue lives in cli.ts
+ * (`gatherInstructionFiles`). See research/rule-compiler-multilang-design.md §0.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dedupeInstructionFiles = dedupeInstructionFiles;
+exports.isFixturePath = isFixturePath;
+const hash_js_1 = require("./core/hash.js");
+/**
+ * Dedup instruction files so a `CLAUDE.md`⇄`AGENTS.md` MIRROR is routed ONCE, not
+ * double-counted (compose-with-sync-tools: a symlinked or byte-identical synced
+ * mirror is ONE logical artifact). Dedups by BOTH the canonical path (a symlink)
+ * AND the content hash (a byte-identical sync) — relative-path dedup alone caught
+ * neither. First occurrence wins (callers pass root files first). Pure.
+ */
+function dedupeInstructionFiles(files) {
+    const seenReal = new Set();
+    const seenHash = new Set();
+    const out = [];
+    for (const f of files) {
+        if (seenReal.has(f.canonical))
+            continue; // symlinked mirror
+        const hash = (0, hash_js_1.sha256short)(f.text);
+        if (seenHash.has(hash))
+            continue; // byte-identical synced mirror
+        seenReal.add(f.canonical);
+        seenHash.add(hash);
+        out.push({ path: f.path, text: f.text });
+    }
+    return out;
+}
+/** Directory segments that are unambiguously build / deps / test noise. */
+const FIXTURE_DIR_EXACT = new Set([
+    "node_modules",
+    "dist",
+    "build",
+    "out",
+    "coverage",
+    ".git",
+    ".next",
+    ".cache",
+    "test",
+    "tests",
+    "__tests__",
+    "__fixtures__",
+    "__mocks__",
+    "vendor",
+    "third_party",
+]);
+/** Directory-name PREFIXES that mark a fixture / demo / sample / scratch dir.
+ * Case-INSENSITIVE so `Examples/`, `Demo/` are skipped too. */
+const FIXTURE_DIR_PREFIX = /^(?:demo|example|sample|fixture|bench|benchmark|mock|stub|scratch|tmp|\.tmp)/i;
+/**
+ * Is this (repo-relative) instruction-file path fixture/demo/build/test noise?
+ * True when any DIRECTORY segment (never the filename) is a build/deps/test dir
+ * OR starts with a demo/example/sample/fixture/bench/mock/scratch/tmp prefix.
+ * Conventional + general (not vigiles-specific), precision over recall.
+ */
+function isFixturePath(relPath) {
+    const segs = relPath.split(/[/\\]/).slice(0, -1); // directories only
+    return segs.some((s) => FIXTURE_DIR_EXACT.has(s.toLowerCase()) || FIXTURE_DIR_PREFIX.test(s));
+}
+//# sourceMappingURL=instruction-sources.js.map

package/dist/rule-inventory.d.ts

@@ -84,6 +84,12 @@ export interface RuleInventoryOptions {
  * non-`[\w/@.-]` character on each side (so `no-console` matches in
  * `` `no-console` `` and `enforce no-console;` but `no-console-x` does not,
  * and prose containing the substring elsewhere never trips it).
+ *
+ * The TRAILING boundary is a lookahead, not a consuming class, so a keyword at
+ * SENTENCE END ("No wildcard imports.") matches: a `.` is allowed unless it
+ * CONTINUES a code token (`.log` in `console.log`), which still blocks a partial
+ * match. `(?![\w/@-])` rejects a word/`/`/`@`/`-` continuation; `(?!\.[\w/@-])`
+ * rejects a dotted continuation but permits a trailing sentence `.`.
  */
 export declare function matchesWholeToken(text: string, keyword: string): boolean;
 export declare function buildRuleInventory(instructionText: string, configText: string, options?: RuleInventoryOptions): RuleInventoryItem[];