@codyswann/lisa 2.261.0 → 2.263.0

package/dist/health/strict-validation.d.ts

@@ -0,0 +1,56 @@
+/** Data-property descriptors keyed by a closed string vocabulary. */
+export type StrictDescriptors<TField extends string> = Readonly<Record<TField, PropertyDescriptor>>;
+/**
+ * Require an accessor-free plain object containing exactly the listed fields.
+ * @param value - Untrusted candidate
+ * @param fields - Exact allowed own-string fields
+ * @param label - Operator-readable field label
+ * @returns Data-property descriptors safe to read without invoking accessors
+ */
+export declare function requireStrictRecord<TField extends string>(value: unknown, fields: readonly TField[], label: string): StrictDescriptors<TField>;
+/**
+ * Read a previously validated data-property descriptor.
+ * @param descriptors - Strict descriptor record
+ * @param field - Field to read
+ * @returns Detached descriptor value
+ */
+export declare function readStrictProperty<TField extends string>(descriptors: StrictDescriptors<TField>, field: TField): unknown;
+/**
+ * Require one string from a closed vocabulary.
+ * @param value - Untrusted candidate
+ * @param allowed - Closed string vocabulary
+ * @param field - Operator-readable field label
+ * @returns Validated vocabulary member
+ */
+export declare function requireClosedString<TValue extends string>(value: unknown, allowed: readonly TValue[], field: string): TValue;
+/**
+ * Require a stable, byte-bounded lowercase machine identifier.
+ * @param value - Untrusted identifier candidate
+ * @param field - Operator-readable field label
+ * @param maximumBytes - Maximum UTF-8 byte length
+ * @returns Validated identifier
+ */
+export declare function requireBoundedMachineId(value: unknown, field: string, maximumBytes: number): string;
+/**
+ * Require a canonical UTC timestamp with millisecond precision.
+ * @param value - Untrusted timestamp candidate
+ * @param field - Operator-readable field label
+ * @returns Canonical timestamp
+ */
+export declare function requireCanonicalUtcTimestamp(value: unknown, field: string): string;
+/**
+ * Detect controls and bidirectional formatting characters in operator text.
+ * @param value - Text candidate
+ * @returns Whether unsafe operator-text characters are present
+ */
+export declare function hasUnsafeTextCharacter(value: string): boolean;
+/**
+ * Read a dense, extra-free, accessor-free plain array without invoking values.
+ * @param value - Untrusted candidate
+ * @param minimum - Minimum accepted length
+ * @param maximum - Maximum accepted length
+ * @param label - Operator-readable field label
+ * @returns Data-property values in index order
+ */
+export declare function readStrictDenseArray(value: unknown, minimum: number, maximum: number, label: string): readonly unknown[];
+//# sourceMappingURL=strict-validation.d.ts.map

package/dist/health/strict-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-validation.d.ts","sourceRoot":"","sources":["../../src/health/strict-validation.ts"],"names":[],"mappings":"AAMA,qEAAqE;AACrE,MAAM,MAAM,iBAAiB,CAAC,MAAM,SAAS,MAAM,IAAI,QAAQ,CAC7D,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CACnC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,SAAS,MAAM,EACvD,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,KAAK,EAAE,MAAM,GACZ,iBAAiB,CAAC,MAAM,CAAC,CAiC3B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,SAAS,MAAM,EACtD,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,EACtC,KAAK,EAAE,MAAM,GACZ,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,SAAS,MAAM,EACvD,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,MAAM,GACZ,MAAM,CAKR;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,MAAM,CAUR;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,GACZ,MAAM,CAYR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAU7D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,SAAS,OAAO,EAAE,CAsCpB"}

package/dist/health/strict-validation.js

@@ -0,0 +1,144 @@
+/** Descriptor-based primitives for validating untrusted structured values. */
+import { isProxy } from "node:util/types";
+const ISO_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
+const MACHINE_ID = /^[a-z0-9]+(?:[._:-][a-z0-9]+)*$/u;
+/**
+ * Require an accessor-free plain object containing exactly the listed fields.
+ * @param value - Untrusted candidate
+ * @param fields - Exact allowed own-string fields
+ * @param label - Operator-readable field label
+ * @returns Data-property descriptors safe to read without invoking accessors
+ */
+export function requireStrictRecord(value, fields, label) {
+    if (value === null ||
+        typeof value !== "object" ||
+        Array.isArray(value) ||
+        isProxy(value)) {
+        throw new Error(`Invalid ${label}: expected a plain object`);
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw new Error(`Invalid ${label}: expected a plain object prototype`);
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const keys = Reflect.ownKeys(descriptors);
+    if (keys.length !== fields.length ||
+        keys.some(key => typeof key !== "string" || !fields.includes(key))) {
+        throw new Error(`Invalid ${label} fields: expected exactly ${fields.join(", ")}`);
+    }
+    fields.forEach(field => {
+        const descriptor = descriptors[field];
+        if (descriptor === undefined || !("value" in descriptor)) {
+            throw new Error(`Invalid ${label}.${field}: accessors are not allowed`);
+        }
+    });
+    return descriptors;
+}
+/**
+ * Read a previously validated data-property descriptor.
+ * @param descriptors - Strict descriptor record
+ * @param field - Field to read
+ * @returns Detached descriptor value
+ */
+export function readStrictProperty(descriptors, field) {
+    return descriptors[field].value;
+}
+/**
+ * Require one string from a closed vocabulary.
+ * @param value - Untrusted candidate
+ * @param allowed - Closed string vocabulary
+ * @param field - Operator-readable field label
+ * @returns Validated vocabulary member
+ */
+export function requireClosedString(value, allowed, field) {
+    if (typeof value !== "string" || !allowed.includes(value)) {
+        throw new Error(`Invalid ${field}: expected ${allowed.join(" or ")}`);
+    }
+    return value;
+}
+/**
+ * Require a stable, byte-bounded lowercase machine identifier.
+ * @param value - Untrusted identifier candidate
+ * @param field - Operator-readable field label
+ * @param maximumBytes - Maximum UTF-8 byte length
+ * @returns Validated identifier
+ */
+export function requireBoundedMachineId(value, field, maximumBytes) {
+    if (typeof value !== "string" ||
+        value.trim() !== value ||
+        !MACHINE_ID.test(value) ||
+        Buffer.byteLength(value, "utf8") > maximumBytes) {
+        throw new Error(`Invalid ${field}: expected a bounded machine identifier`);
+    }
+    return value;
+}
+/**
+ * Require a canonical UTC timestamp with millisecond precision.
+ * @param value - Untrusted timestamp candidate
+ * @param field - Operator-readable field label
+ * @returns Canonical timestamp
+ */
+export function requireCanonicalUtcTimestamp(value, field) {
+    if (typeof value !== "string" ||
+        !ISO_UTC.test(value) ||
+        Number.isNaN(Date.parse(value)) ||
+        new Date(value).toISOString() !== value) {
+        throw new Error(`Invalid ${field}: expected canonical UTC YYYY-MM-DDTHH:mm:ss.sssZ`);
+    }
+    return value;
+}
+/**
+ * Detect controls and bidirectional formatting characters in operator text.
+ * @param value - Text candidate
+ * @returns Whether unsafe operator-text characters are present
+ */
+export function hasUnsafeTextCharacter(value) {
+    return Array.from(value).some(character => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return (codePoint <= 0x1f ||
+            (codePoint >= 0x7f && codePoint <= 0x9f) ||
+            (codePoint >= 0x202a && codePoint <= 0x202e) ||
+            (codePoint >= 0x2066 && codePoint <= 0x2069));
+    });
+}
+/**
+ * Read a dense, extra-free, accessor-free plain array without invoking values.
+ * @param value - Untrusted candidate
+ * @param minimum - Minimum accepted length
+ * @param maximum - Maximum accepted length
+ * @param label - Operator-readable field label
+ * @returns Data-property values in index order
+ */
+export function readStrictDenseArray(value, minimum, maximum, label) {
+    if (isProxy(value) || !Array.isArray(value)) {
+        throw new Error(`Invalid ${label}: expected ${minimum}-${maximum} entries`);
+    }
+    if (Object.getPrototypeOf(value) !== Array.prototype) {
+        throw new Error(`Invalid ${label}: expected a plain array prototype`);
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const length = descriptors.length?.value;
+    if (typeof length !== "number" ||
+        !Number.isSafeInteger(length) ||
+        length < minimum ||
+        length > maximum) {
+        throw new Error(`Invalid ${label}: expected ${minimum}-${maximum} entries`);
+    }
+    const expectedKeys = [
+        ...Array.from({ length }, (_unused, index) => String(index)),
+        "length",
+    ];
+    const keys = Reflect.ownKeys(descriptors);
+    if (keys.length !== expectedKeys.length ||
+        keys.some(key => typeof key !== "string" || !expectedKeys.includes(key))) {
+        throw new Error(`Invalid ${label}: expected a dense extra-free array`);
+    }
+    return Array.from({ length }, (_unused, index) => {
+        const descriptor = descriptors[String(index)];
+        if (descriptor === undefined || !("value" in descriptor)) {
+            throw new Error(`Invalid ${label}[${index}]: accessors are not allowed`);
+        }
+        return descriptor.value;
+    });
+}
+//# sourceMappingURL=strict-validation.js.map

package/dist/health/strict-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-validation.js","sourceRoot":"","sources":["../../src/health/strict-validation.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,OAAO,GAAG,gDAAgD,CAAC;AACjE,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAOtD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,MAAyB,EACzB,KAAa;IAEb,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,EACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAGzD,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,IACE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAa,CAAC,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACrB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,KAAK,6BAA6B,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,WAAwC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAsC,EACtC,KAAa;IAEb,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,KAAgB,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,OAA0B,EAC1B,KAAa;IAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,cAAc,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAe,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,KAAa,EACb,YAAoB;IAEpB,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;QACtB,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACvB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,yCAAyC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAc,EACd,KAAa;IAEb,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,mDAAmD,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QACxC,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,CACL,SAAS,IAAI,IAAI;YACjB,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC;YACxC,CAAC,SAAS,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,CAAC;YAC5C,CAAC,SAAS,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,CAAC,CAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,OAAe,EACf,OAAe,EACf,KAAa;IAEb,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,cAAc,OAAO,IAAI,OAAO,UAAU,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,oCAAoC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAGzD,CAAC;IACF,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,KAAgB,CAAC;IACpD,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAC7B,MAAM,GAAG,OAAO;QAChB,MAAM,GAAG,OAAO,EAChB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,cAAc,OAAO,IAAI,OAAO,UAAU,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,YAAY,GAAG;QACnB,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,QAAQ;KACT,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,IACE,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,KAAK,8BAA8B,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,UAAU,CAAC,KAAgB,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sync/config-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-sync.d.ts","sourceRoot":"","sources":["../../src/sync/config-sync.ts"],"names":[],"mappings":"AAqCA,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GACtB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,CAAC;AAEtB,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxE,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAiQD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CA0CrB"}
+{"version":3,"file":"config-sync.d.ts","sourceRoot":"","sources":["../../src/sync/config-sync.ts"],"names":[],"mappings":"AAqCA,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GACtB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,CAAC;AAEtB,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxE,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAmRD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CA0CrB"}

package/dist/sync/config-sync.js

@@ -81,14 +81,15 @@ function withAction(state, committed, action) {
  */
 function populateMissing(state, entry, artifactValue) {
     if (artifactValue !== undefined) {
-        const absorbed = fillMissing(artifactValue, entry.defaultValue);
+        const absorbed = validateEntryValue(entry, fillMissing(artifactValue, entry.defaultValue));
         return withAction(state, setAtPath(state.committed, entry.key, absorbed), {
             key: entry.key,
             kind: "absorbed-artifact",
             detail: `value absorbed from ${entry.artifacts?.[0]?.file ?? "artifact"}`,
         });
     }
-    const committed = recordPopulation(setAtPath(state.committed, entry.key, entry.defaultValue), entry.key, entry.defaultValue);
+    const defaultValue = validateEntryValue(entry, entry.defaultValue);
+    const committed = recordPopulation(setAtPath(state.committed, entry.key, defaultValue), entry.key, defaultValue);
     return withAction(state, committed, {
         key: entry.key,
         kind: "populated-default",
@@ -109,10 +110,11 @@ function populateEntry(state, entry, merged, local, artifactValue) {
     const mergedAfterMigration = stateAfterMigration === state
         ? merged
         : deepMerge(stateAfterMigration.committed, local);
-    const configValue = getAtPath(mergedAfterMigration, entry.key);
-    if (configValue === undefined) {
+    const rawConfigValue = getAtPath(mergedAfterMigration, entry.key);
+    if (rawConfigValue === undefined) {
         return populateMissing(stateAfterMigration, entry, artifactValue);
     }
+    const configValue = validateEntryValue(entry, rawConfigValue);
     const committedValue = getAtPath(stateAfterMigration.committed, entry.key);
     const localValue = getAtPath(local, entry.key);
     const recorded = recordedPopulation(stateAfterMigration.committed, entry.key);
@@ -167,6 +169,7 @@ async function syncArtifacts(state, entry, destDir, local) {
     if (effective === undefined) {
         return state;
     }
+    const validatedEffective = validateEntryValue(entry, effective);
     return bindings.reduce(async (statePromise, binding) => {
         const current = await statePromise;
         const filePath = path.join(destDir, binding.file);
@@ -176,10 +179,10 @@ async function syncArtifacts(state, entry, destDir, local) {
             return current;
         }
         const fileObject = isJsonObject(parsed) ? parsed : {};
-        if (jsonEquals(getAtPath(fileObject, binding.pointer), effective)) {
+        if (jsonEquals(getAtPath(fileObject, binding.pointer), validatedEffective)) {
             return current;
         }
-        const updated = setAtPath(fileObject, binding.pointer, effective);
+        const updated = setAtPath(fileObject, binding.pointer, validatedEffective);
         const writes = new Map([
             ...current.artifactWrites,
             [binding.file, updated],
@@ -198,6 +201,15 @@ async function syncArtifacts(state, entry, destDir, local) {
         };
     }, Promise.resolve(state));
 }
+/**
+ * Apply an entry's optional executable value contract.
+ * @param entry - Registry entry owning the value
+ * @param value - Untrusted effective value
+ * @returns Validated or unchanged JSON value
+ */
+function validateEntryValue(entry, value) {
+    return entry.validate?.(value) ?? value;
+}
 /**
  * Report required keys that are missing from the merged config.
  * @param merged - Merged config view

package/dist/sync/config-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-sync.js","sourceRoot":"","sources":["../../src/sync/config-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,WAAW,EACX,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,GAGV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,aAAa,GAEd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AA2C5E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAAkB,EAAE,SAAiB;IAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,MAAkB,EAClB,YAA2C;IAE3C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,OAAe,EACf,KAAoB;IAEpB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,KAAgB,EAChB,SAAqB,EACrB,MAAkB;IAElB,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,KAAgB,EAChB,KAAoB,EACpB,aAAoC;IAEpC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE;YACxE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,uBAAuB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,UAAU,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EACzD,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,+CAA+C;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,KAAgB,EAChB,KAAoB,EACpB,MAAkB,EAClB,KAAiB,EACjB,aAAoC;IAEpC,MAAM,mBAAmB,GAAG,oCAAoC,CAC9D,KAAK,EACL,KAAK,CAAC,GAAG,CACV,CAAC;IACF,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,KAAK;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAE,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAgB,CAAC;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,eAAe,CAAC,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,cAAc,GAAG,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,MAAM,cAAc,GAClB,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;IACnE,IACE,QAAQ,KAAK,SAAS;QACtB,UAAU,CAAC,cAAc,EAAE,QAAQ,CAAC;QACpC,CAAC,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC;QAC/C,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,EAChD,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EACvE,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,OAAO,UAAU,CAAC,mBAAmB,EAAE,SAAS,EAAE;YAChD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,6DAA6D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,iBAAiB,GAAG,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,iBAAiB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;IACpE,MAAM,QAAQ,GAAG,iBAAiB;QAChC,CAAC,CAAC,sBAAsB,CACpB,WAAW,EACX,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CACpB;QACH,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IACvB,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,UAAU,CACf,mBAAmB,EACnB,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,EAC3D;YACE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,uCAAuC;SAChD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAC1B,KAAgB,EAChB,KAAoB,EACpB,OAAe,EACf,KAAiB;IAEjB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAqB,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE;QACzE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,cAAc,CAAU,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC;QACpE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IAAI,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAClE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;YACrB,GAAG,OAAO,CAAC,cAAc;YACzB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU;SACjC,CAAC,CAAC;QACH,OAAO;YACL,GAAG,OAAO;YACV,cAAc,EAAE,MAAM;YACtB,OAAO,EAAE;gBACP,GAAG,OAAO,CAAC,OAAO;gBAClB;oBACE,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,sBAAsB;iBAC9C;aACF;SACF,CAAC;IACJ,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,MAAkB;IAElB,OAAO,aAAa,CAAC,MAAM,CACzB,QAAQ,CAAC,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;QACzC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,CAChD,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,UAAuB,EAAE;IAEzB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,MAAM,cAAc,CAAU,aAAa,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAU,SAAS,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAErD,MAAM,OAAO,GAAc;QACzB,SAAS;QACT,OAAO,EAAE,EAAE;QACX,cAAc,EAAE,IAAI,GAAG,EAAE;KAC1B,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,MAAM,CAC3C,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;QACjC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAe,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,aAAa,CAC7B,KAAK,EACL,KAAK,EACL,MAAM,EACN,KAAK,EACL,aAAa,CACd,CAAC;QACF,OAAO,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC,EACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACzB,CAAC;IAEF,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAe,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,eAAe,EAAE,mBAAmB,CAAC,WAAW,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI;KAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,iBAA6B,EAC7B,KAAgB;IAEhB,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CACjE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAC7C,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config-sync.js","sourceRoot":"","sources":["../../src/sync/config-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,WAAW,EACX,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,GAGV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,aAAa,GAEd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AA2C5E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAAkB,EAAE,SAAiB;IAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,MAAkB,EAClB,YAA2C;IAE3C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,OAAe,EACf,KAAoB;IAEpB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,KAAgB,EAChB,SAAqB,EACrB,MAAkB;IAElB,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,KAAgB,EAChB,KAAoB,EACpB,aAAoC;IAEpC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,kBAAkB,CACjC,KAAK,EACL,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAC/C,CAAC;QACF,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE;YACxE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,uBAAuB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,UAAU,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,EACnD,KAAK,CAAC,GAAG,EACT,YAAY,CACb,CAAC;IACF,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,+CAA+C;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,KAAgB,EAChB,KAAoB,EACpB,MAAkB,EAClB,KAAiB,EACjB,aAAoC;IAEpC,MAAM,mBAAmB,GAAG,oCAAoC,CAC9D,KAAK,EACL,KAAK,CAAC,GAAG,CACV,CAAC;IACF,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,KAAK;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAE,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAgB,CAAC;IACtE,MAAM,cAAc,GAAG,SAAS,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,eAAe,CAAC,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,MAAM,cAAc,GAClB,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;IACnE,IACE,QAAQ,KAAK,SAAS;QACtB,UAAU,CAAC,cAAc,EAAE,QAAQ,CAAC;QACpC,CAAC,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC;QAC/C,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,EAChD,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EACvE,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,OAAO,UAAU,CAAC,mBAAmB,EAAE,SAAS,EAAE;YAChD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,6DAA6D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,iBAAiB,GAAG,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,iBAAiB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;IACpE,MAAM,QAAQ,GAAG,iBAAiB;QAChC,CAAC,CAAC,sBAAsB,CACpB,WAAW,EACX,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CACpB;QACH,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IACvB,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,UAAU,CACf,mBAAmB,EACnB,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,EAC3D;YACE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,uCAAuC;SAChD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAC1B,KAAgB,EAChB,KAAoB,EACpB,OAAe,EACf,KAAiB;IAEjB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,QAAQ,CAAC,MAAM,CAAqB,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE;QACzE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,cAAc,CAAU,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC;QACpE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IACE,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,EACtE,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;YACrB,GAAG,OAAO,CAAC,cAAc;YACzB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU;SACjC,CAAC,CAAC;QACH,OAAO;YACL,GAAG,OAAO;YACV,cAAc,EAAE,MAAM;YACtB,OAAO,EAAE;gBACP,GAAG,OAAO,CAAC,OAAO;gBAClB;oBACE,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,sBAAsB;iBAC9C;aACF;SACF,CAAC;IACJ,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAoB,EAAE,KAAgB;IAChE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,MAAkB;IAElB,OAAO,aAAa,CAAC,MAAM,CACzB,QAAQ,CAAC,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;QACzC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,CAChD,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,UAAuB,EAAE;IAEzB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,MAAM,cAAc,CAAU,aAAa,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAU,SAAS,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAErD,MAAM,OAAO,GAAc;QACzB,SAAS;QACT,OAAO,EAAE,EAAE;QACX,cAAc,EAAE,IAAI,GAAG,EAAE;KAC1B,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,MAAM,CAC3C,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;QACjC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAe,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,aAAa,CAC7B,KAAK,EACL,KAAK,EACL,MAAM,EACN,KAAK,EACL,aAAa,CACd,CAAC;QACF,OAAO,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC,EACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACzB,CAAC;IAEF,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAe,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,eAAe,EAAE,mBAAmB,CAAC,WAAW,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI;KAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,iBAA6B,EAC7B,KAAgB;IAEhB,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CACjE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAC7C,CACF,CAAC;AACJ,CAAC"}

package/dist/sync/registry.d.ts

@@ -17,6 +17,8 @@ export interface SyncedSetting {
     readonly key: string;
     /** Built-in default used when neither config nor artifact has a value */
     readonly defaultValue: JsonValue;
+    /** Optional executable validator for human/config supplied values. */
+    readonly validate?: (value: unknown) => JsonValue;
     /**
      * Internal relative-path mappings for deprecated keys that remain readable.
      * Sync uses these to avoid filling a new default beside a human-owned alias.

package/dist/sync/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAoCD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,aAAa,EAoJjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EA0C/C,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAoCD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,aAAa,EA0JjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EA0C/C,CAAC"}

package/dist/sync/registry.js

@@ -11,6 +11,7 @@
  * @module sync/registry
  */
 import { DEFAULT_PROJECT_RULES_FILE } from "../core/project-config.js";
+import { validateHealthSchedule } from "../health/contract.js";
 const WHEN_TRACKER_JIRA = "tracker=jira";
 const WHEN_TRACKER_GITHUB = "tracker=github";
 const WHEN_SOURCE_GITHUB = "source=github";
@@ -58,6 +59,12 @@ export const SYNC_REGISTRY = [
         defaultValue: DEFAULT_PROJECT_RULES_FILE,
         description: "Hand-authored project rules file (independent of the ledger)",
     },
+    {
+        key: "health.schedule",
+        defaultValue: "off",
+        validate: validateHealthSchedule,
+        description: "Health-check schedule (off, daily, or weekly)",
+    },
     {
         key: "quality.testCoverage",
         defaultValue: COVERAGE_DEFAULTS,

package/dist/sync/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAiDvE,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAE3C,MAAM,iBAAiB,GAAc;IACnC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;CACnE,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE;QACJ,GAAG,EAAE,eAAe;QACpB,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,aAAa;KAC1B;CACO,CAAC;AAEX,MAAM,kBAAkB,GAAc;IACpC,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,qBAAqB;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAA6B;IACrD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,0BAA0B;QACxC,WAAW,EAAE,8DAA8D;KAC5E;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,iBAAiB;QAC/B,SAAS,EAAE;YACT,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/C,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,EAAE;SAC9C;QACD,WAAW,EAAE,4DAA4D;KAC1E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE;QACrE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzD,WAAW,EACT,2EAA2E;KAC9E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE;YACZ,mBAAmB,EAAE,EAAE;YACvB,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,EAAE;SACxB;QACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5D,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;QAC/C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxD,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,oCAAoC;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjE,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE;QACxD,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,qEAAqE;QACrE,mEAAmE;QACnE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;QAC7B,WAAW,EACT,wEAAwE;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE;YACZ,aAAa,EAAE,EAAE;YACjB,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,EAAE;YAChB,wEAAwE;YACxE,oEAAoE;YACpE,UAAU,EAAE;gBACV,YAAY,EAAE,CAAC;gBACf,wBAAwB,EAAE,CAAC;gBAC3B,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC;aAChB;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,+BAA+B;aAC5C;YACD;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,6BAA6B;aAC1C;SACF;QACD,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE;SAC/D;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;QAC9C,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE;QACtE,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,GAAG,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,EAAE;YAChE,GAAG,EAAE,kBAAkB;SACxB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,wDAAwD;KACtE;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;SACrB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,GAAG;QACjB,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,gCAAgC;KAC9C;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,oCAAoC,EAAE;IACnE;QACE,GAAG,EAAE,cAAc;QACnB,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,SAAS,EAAE,kBAAkB;KAC9B;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,YAAY,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACtD,SAAS,EAAE,uBAAuB;KACnC;IACD;QACE,GAAG,EAAE,YAAY;QACjB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,YAAY,EAAE,CAAC,mBAAmB,CAAC;QACnC,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,oBAAoB;KAChC;CACF,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAmD/D,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAE3C,MAAM,iBAAiB,GAAc;IACnC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;CACnE,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE;QACJ,GAAG,EAAE,eAAe;QACpB,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,aAAa;KAC1B;CACO,CAAC;AAEX,MAAM,kBAAkB,GAAc;IACpC,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,qBAAqB;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAA6B;IACrD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,0BAA0B;QACxC,WAAW,EAAE,8DAA8D;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,sBAAsB;QAChC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,iBAAiB;QAC/B,SAAS,EAAE;YACT,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/C,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,EAAE;SAC9C;QACD,WAAW,EAAE,4DAA4D;KAC1E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE;QACrE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzD,WAAW,EACT,2EAA2E;KAC9E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE;YACZ,mBAAmB,EAAE,EAAE;YACvB,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,EAAE;SACxB;QACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5D,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;QAC/C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxD,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,oCAAoC;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjE,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE;QACxD,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,qEAAqE;QACrE,mEAAmE;QACnE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;QAC7B,WAAW,EACT,wEAAwE;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE;YACZ,aAAa,EAAE,EAAE;YACjB,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,EAAE;YAChB,wEAAwE;YACxE,oEAAoE;YACpE,UAAU,EAAE;gBACV,YAAY,EAAE,CAAC;gBACf,wBAAwB,EAAE,CAAC;gBAC3B,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC;aAChB;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,+BAA+B;aAC5C;YACD;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,6BAA6B;aAC1C;SACF;QACD,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE;SAC/D;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;QAC9C,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE;QACtE,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,GAAG,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,EAAE;YAChE,GAAG,EAAE,kBAAkB;SACxB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,wDAAwD;KACtE;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;SACrB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,GAAG;QACjB,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,gCAAgC;KAC9C;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,oCAAoC,EAAE;IACnE;QACE,GAAG,EAAE,cAAc;QACnB,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,SAAS,EAAE,kBAAkB;KAC9B;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,YAAY,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACtD,SAAS,EAAE,uBAAuB;KACnC;IACD;QACE,GAAG,EAAE,YAAY;QACjB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,YAAY,EAAE,CAAC,mBAAmB,CAAC;QACnC,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,oBAAoB;KAChC;CACF,CAAC"}

package/package.json

@@ -36,7 +36,8 @@
     "check:upstream-evidence-manifest": "node scripts/generate-upstream-evidence-manifest.mjs --check",
     "refresh:upstream-public-commits": "node scripts/generate-upstream-evidence-manifest.mjs --refresh-public-commits",
     "check:rules-pairing": "bash scripts/check-rules-pairing.sh",
-    "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json"
+    "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
+    "verify:health-contract": "bun run build:dist && node scripts/verify-health-contract-built.mjs"
   },
   "engines": {
     "npm": "please-use-bun",
@@ -105,12 +106,13 @@
     "form-data": ">=4.0.6"
   },
   "name": "@codyswann/lisa",
-  "version": "2.261.0",
+  "version": "2.263.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
     ".": "./dist/index.js",
     "./learnings": "./dist/core/learnings.js",
+    "./health": "./dist/health/index.js",
     "./eslint": "./dist/configs/eslint/index.js",
     "./eslint/base": "./dist/configs/eslint/base.js",
     "./eslint/typescript": "./dist/configs/eslint/typescript.js",

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.261.0",
+  "version": "2.263.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.261.0",
+  "version": "2.263.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-implement/SKILL.md

@@ -228,22 +228,52 @@ Before shutting down the team, execute the Verify flow:
 
 1. Run quality gates: lint, typecheck, tests — all must pass. These are prerequisites, NOT verification.
 2. `verification-specialist`: verify locally by running the actual system and observing results (empirical proof that the change works). This is the real verification step. For UI-surface bugs, the proof must observe the UI surface with browser/device automation against the target environment whenever such a harness exists; unit-level or API-only proof cannot satisfy the empirical verification contract for a UI-surface defect.
-2a. **Record the verification verdict** — the independent, machine-readable proof that gates completion. The `verification-specialist` writes `${CLAUDE_PROJECT_DIR:-.}/.lisa/verification-status.json` with one entry per acceptance criterion, each carrying the proof command's observed evidence:
+2a. **Record the verification verdict** — the independent, machine-readable proof that gates completion. The `verification-specialist` writes `${CLAUDE_PROJECT_DIR:-.}/.lisa/verification-status.json` in **schema v2**, which binds every claim to the *boundary* it asserts and to the evidence *kinds* that reach that boundary, per the `claim-evidence-mapping` rule:
 
     ```json
     {
+      "schema_version": 2,
       "plan": "<plan-name>",
-      "status": "pass | fail | blocked | in_progress",
+      "artifact": {
+        "repository": "<owner/repo>", "base_sha": "<sha>", "head_sha": "<sha of what will ship>",
+        "build_id": "<build/run id>", "environment": "<where it was observed>", "observed_at": "<ISO8601 UTC>"
+      },
+      "claims": [
+        {
+          "claim_id": "AC-1",
+          "statement": "<the claim, in the operator's language>",
+          "boundary": "code-unit | browser | http-api | cli | data | deploy-health | performance | standards-compat",
+          "required_for_gate": true,
+          "required_evidence_kinds": ["<kinds that reach this boundary, e.g. screenshot, recording>"],
+          "status": "established | not-established",
+          "evidence_refs": ["EV-1"],
+          "not_established": ["<what this claim does NOT cover>"]
+        }
+      ],
+      "evidence": [
+        {
+          "evidence_id": "EV-1",
+          "kind": "screenshot | recording | http-transcript | cli-output | log-snippet | db-query-output | perf-trace | test-run-log | deploy-log | state-dump",
+          "locator": "evidence/<ticket>/<file>", "sha256": "<hash>",
+          "captured_at": "<ISO8601 UTC>", "artifact_head_sha": "<sha the artifact was captured at>"
+        }
+      ],
+      "not_established_reviewed": true,
       "criteria": [
         { "task": "<task id or title>", "criterion": "<the completion condition>", "status": "pass | fail | blocked", "evidence": "<the proof command run and the observed result; for a blocked criterion, the blocker diagnosis (e.g. the missing access and the probe that must pass)>" }
       ],
+      "status": "pass | fail | blocked | in_progress",
       "updated_at": "<ISO8601 UTC>"
     }
     ```
 
+    Rules for v2: a claim is established **only** by evidence whose `kind` reaches its `boundary` — a unit `test-run-log` reaches only `code-unit` and can never establish a `browser`, `http-api`, or `deploy-health` claim. `not_established_reviewed` must always be present (the `not_established` list may be empty, but the flag may never be omitted). `artifact.head_sha` names what will ship, and each evidence entry's `artifact_head_sha` must match it. The legacy `criteria[]` array is retained and still read, but under v2 it is **display-only** — it can never establish a v2 claim.
+
+    **v1 is still accepted during the compatibility window.** A verdict that omits `schema_version` (or sets it to `1`) carries only `plan` / `status` / `criteria[]` / `updated_at` and is judged exactly as before: terminal `status` plus no failing criterion plus freshness. Write v2 for new work; nothing in flight breaks.
+
     Set `status: "pass"` only when every criterion is `pass` with real evidence (output from running the system, not a claim). The verdict must be judged by an agent that did NOT implement the change (the `verification-specialist`), never self-certified by the implementer. This is runtime scratch — it is gitignored and MUST NOT be committed (treat it like the secrets exclusion in the commit step).
 
-    On Claude, the `enforce-verification-gate.sh` Stop hook reads this file and **will not let the flow stop** until it shows a terminal, all-`pass` verdict — carrying over the non-bypassable completion gate of the `/goal` primitive, but checked deterministically against real evidence rather than by a transcript-only evaluator model. If you must stop before completion, write the verdict with `status: "blocked"` and the reason — marking each criterion whose proof is blocked as `status: "blocked"` with the blocker diagnosis as its `evidence`, while unaffected criteria keep their real `pass`/`fail` result — that records the outcome and releases the gate instead of leaving it to spin. But a `blocked` verdict is a last resort, not a shortcut around fillable work: **first resolve every gap you can resolve yourself.** If the work item is thin — missing its Validation Journey, acceptance criteria, or other derivable detail — enrich it: derive the missing detail from the ticket context and the codebase, write it back, and proceed. Do **not** block on a gap you could have filled. Only a blocker that survives that attempt is real, and it is one of two kinds:
+    On Claude, the `enforce-verification-gate.sh` Stop hook reads this file — both v1 and v2 — and **will not let the flow stop** until it shows a terminal, all-`pass` verdict. The v2 claim/evidence checks are **advisory-first**: a boundary or identity violation is reported to stderr but does not block until `verification.gate.enforceBoundaries` is set to `true` in `.lisa.config.json` (default `false`, promoted via the threshold ratchet). Treat an advisory warning as a defect to fix now, not a warning to ignore — it becomes blocking on the ratchet. The gate — carrying over the non-bypassable completion gate of the `/goal` primitive, but checked deterministically against real evidence rather than by a transcript-only evaluator model. If you must stop before completion, write the verdict with `status: "blocked"` and the reason — marking each criterion whose proof is blocked as `status: "blocked"` with the blocker diagnosis as its `evidence`, while unaffected criteria keep their real `pass`/`fail` result — that records the outcome and releases the gate instead of leaving it to spin. But a `blocked` verdict is a last resort, not a shortcut around fillable work: **first resolve every gap you can resolve yourself.** If the work item is thin — missing its Validation Journey, acceptance criteria, or other derivable detail — enrich it: derive the missing detail from the ticket context and the codebase, write it back, and proceed. Do **not** block on a gap you could have filled. Only a blocker that survives that attempt is real, and it is one of two kinds:
 
     - **Actionable blocker** — an unresolved dependency or fixable technical gap that some team or repository could build (a missing or changed schema field, an unbuilt sibling work item, a required upstream fix), **including cross-repo dependencies**. Before writing the blocked verdict you MUST (1) file a build-ready fix/dependency ticket capturing the diagnosis — in the dependency's own repository/tracker when it is cross-repo (e.g. a `[<repo>] …` ticket in the shared project, or the sibling tracker) — and (2) link the current work item to it as `is blocked by`. Only then write the verdict. This is the same discipline as the regression-spec blocker and the remote-verification-fail exits above, and it is what makes the block machine-recoverable: `repair-intake` re-dispatches a blocked item once its linked `is blocked by` dependency closes, but it cannot act on a prose-only comment. Recommending the ticket "as a human follow-up" without filing and linking it is **not** a permitted exit.
     - **Human-only blocker** — an input the agent genuinely cannot obtain or produce no matter what it does: credentials, secrets, or **tool access** it does not have (AWS/CloudWatch, Figma, Jam, Sentry, SonarCloud, a database, a protected deploy target, …), or a product/design decision only a human can make. For missing tool access, follow the `tool-access-gate` rule's break-out protocol: post the "Access Needed" comment naming the exact credential/role/env var to grant and the probe that must pass — never work around the gap by substituting weaker verification, mocking the inaccessible system, or narrowing scope. Record the blocked verdict, mark it `human_needed` (the marker `repair-intake` recognizes, so it won't churn re-dispatching it), and surface or reassign to a human; do **not** fabricate a build-ready ticket, because there is no build-ready work.