The cross-AI hard rules that bind every agent on every surface are NOT duplicated here. They live
in exactly one file: docs/cross-ai-rules.md in the web-jam-tools repository, which normally
sits alongside this repository — ../web-jam-tools/docs/cross-ai-rules.md, and on Josh's laptop
/home/joshua/WebJamApps/web-jam-tools/docs/cross-ai-rules.md.
Read that file before acting. If you cannot find it, STOP and say so — do not proceed without the rules and do not reconstruct them from memory or from this file.
- No
any:@typescript-eslint/no-explicit-anyis set to'error'. Do not disable this rule or use: anyoras any. - Shared Domain Types: Centralized types for socket connections, streams, payloads, and domain objects live in
src/types/index.ts. - Mongoose Generic Facade: Model facades extend
Facade<T>defined insrc/lib/facade.ts. When typing generic model methods, use double type assertions (e.g.(await ... as unknown) as T[]) to satisfy Mongoose generic method signatures without usingany. - SocketCluster Mocks: When mocking
AGServerorIClientin tests, cast stub objects usingas unknown as socketClusterServer.AGServeroras unknown as IClient. Ensurereceiver.next()mocks return{ value?: T; done?: boolean }.
- Snyk Failures & Resolution via
npm audit fix: PR checks may report failure onsecurity/snykdue to transitive dependency vulnerabilities. Runningnpm audit fixupdatespackage-lock.jsonwith non-breaking patches to resolve these vulnerabilities. Always run local tests afterwards to verify the test suite remains 100% green before committing and pushingpackage-lock.jsonto the PR branch.
- Runtime: Node.js v24.18.1
- Node Engine Version Bumps: When bumping Node.js in
package.jsonengines.node, runnpm install --package-lock-only --ignore-scripts(ornpm install --ignore-scripts) to updatepackage-lock.jsonroot engine definition without waiting onpostinstallscripts so both files are committed together.