@codyswann/lisa 2.262.0 → 2.264.0

package/dist/health/strict-validation.d.ts

@@ -0,0 +1,56 @@
+/** Data-property descriptors keyed by a closed string vocabulary. */
+export type StrictDescriptors<TField extends string> = Readonly<Record<TField, PropertyDescriptor>>;
+/**
+ * Require an accessor-free plain object containing exactly the listed fields.
+ * @param value - Untrusted candidate
+ * @param fields - Exact allowed own-string fields
+ * @param label - Operator-readable field label
+ * @returns Data-property descriptors safe to read without invoking accessors
+ */
+export declare function requireStrictRecord<TField extends string>(value: unknown, fields: readonly TField[], label: string): StrictDescriptors<TField>;
+/**
+ * Read a previously validated data-property descriptor.
+ * @param descriptors - Strict descriptor record
+ * @param field - Field to read
+ * @returns Detached descriptor value
+ */
+export declare function readStrictProperty<TField extends string>(descriptors: StrictDescriptors<TField>, field: TField): unknown;
+/**
+ * Require one string from a closed vocabulary.
+ * @param value - Untrusted candidate
+ * @param allowed - Closed string vocabulary
+ * @param field - Operator-readable field label
+ * @returns Validated vocabulary member
+ */
+export declare function requireClosedString<TValue extends string>(value: unknown, allowed: readonly TValue[], field: string): TValue;
+/**
+ * Require a stable, byte-bounded lowercase machine identifier.
+ * @param value - Untrusted identifier candidate
+ * @param field - Operator-readable field label
+ * @param maximumBytes - Maximum UTF-8 byte length
+ * @returns Validated identifier
+ */
+export declare function requireBoundedMachineId(value: unknown, field: string, maximumBytes: number): string;
+/**
+ * Require a canonical UTC timestamp with millisecond precision.
+ * @param value - Untrusted timestamp candidate
+ * @param field - Operator-readable field label
+ * @returns Canonical timestamp
+ */
+export declare function requireCanonicalUtcTimestamp(value: unknown, field: string): string;
+/**
+ * Detect controls and bidirectional formatting characters in operator text.
+ * @param value - Text candidate
+ * @returns Whether unsafe operator-text characters are present
+ */
+export declare function hasUnsafeTextCharacter(value: string): boolean;
+/**
+ * Read a dense, extra-free, accessor-free plain array without invoking values.
+ * @param value - Untrusted candidate
+ * @param minimum - Minimum accepted length
+ * @param maximum - Maximum accepted length
+ * @param label - Operator-readable field label
+ * @returns Data-property values in index order
+ */
+export declare function readStrictDenseArray(value: unknown, minimum: number, maximum: number, label: string): readonly unknown[];
+//# sourceMappingURL=strict-validation.d.ts.map

package/dist/health/strict-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-validation.d.ts","sourceRoot":"","sources":["../../src/health/strict-validation.ts"],"names":[],"mappings":"AAMA,qEAAqE;AACrE,MAAM,MAAM,iBAAiB,CAAC,MAAM,SAAS,MAAM,IAAI,QAAQ,CAC7D,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CACnC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,SAAS,MAAM,EACvD,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,KAAK,EAAE,MAAM,GACZ,iBAAiB,CAAC,MAAM,CAAC,CAiC3B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,SAAS,MAAM,EACtD,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,EACtC,KAAK,EAAE,MAAM,GACZ,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,SAAS,MAAM,EACvD,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,MAAM,GACZ,MAAM,CAKR;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,MAAM,CAUR;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,GACZ,MAAM,CAYR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAU7D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,SAAS,OAAO,EAAE,CAsCpB"}

package/dist/health/strict-validation.js

@@ -0,0 +1,144 @@
+/** Descriptor-based primitives for validating untrusted structured values. */
+import { isProxy } from "node:util/types";
+const ISO_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
+const MACHINE_ID = /^[a-z0-9]+(?:[._:-][a-z0-9]+)*$/u;
+/**
+ * Require an accessor-free plain object containing exactly the listed fields.
+ * @param value - Untrusted candidate
+ * @param fields - Exact allowed own-string fields
+ * @param label - Operator-readable field label
+ * @returns Data-property descriptors safe to read without invoking accessors
+ */
+export function requireStrictRecord(value, fields, label) {
+    if (value === null ||
+        typeof value !== "object" ||
+        Array.isArray(value) ||
+        isProxy(value)) {
+        throw new Error(`Invalid ${label}: expected a plain object`);
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw new Error(`Invalid ${label}: expected a plain object prototype`);
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const keys = Reflect.ownKeys(descriptors);
+    if (keys.length !== fields.length ||
+        keys.some(key => typeof key !== "string" || !fields.includes(key))) {
+        throw new Error(`Invalid ${label} fields: expected exactly ${fields.join(", ")}`);
+    }
+    fields.forEach(field => {
+        const descriptor = descriptors[field];
+        if (descriptor === undefined || !("value" in descriptor)) {
+            throw new Error(`Invalid ${label}.${field}: accessors are not allowed`);
+        }
+    });
+    return descriptors;
+}
+/**
+ * Read a previously validated data-property descriptor.
+ * @param descriptors - Strict descriptor record
+ * @param field - Field to read
+ * @returns Detached descriptor value
+ */
+export function readStrictProperty(descriptors, field) {
+    return descriptors[field].value;
+}
+/**
+ * Require one string from a closed vocabulary.
+ * @param value - Untrusted candidate
+ * @param allowed - Closed string vocabulary
+ * @param field - Operator-readable field label
+ * @returns Validated vocabulary member
+ */
+export function requireClosedString(value, allowed, field) {
+    if (typeof value !== "string" || !allowed.includes(value)) {
+        throw new Error(`Invalid ${field}: expected ${allowed.join(" or ")}`);
+    }
+    return value;
+}
+/**
+ * Require a stable, byte-bounded lowercase machine identifier.
+ * @param value - Untrusted identifier candidate
+ * @param field - Operator-readable field label
+ * @param maximumBytes - Maximum UTF-8 byte length
+ * @returns Validated identifier
+ */
+export function requireBoundedMachineId(value, field, maximumBytes) {
+    if (typeof value !== "string" ||
+        value.trim() !== value ||
+        !MACHINE_ID.test(value) ||
+        Buffer.byteLength(value, "utf8") > maximumBytes) {
+        throw new Error(`Invalid ${field}: expected a bounded machine identifier`);
+    }
+    return value;
+}
+/**
+ * Require a canonical UTC timestamp with millisecond precision.
+ * @param value - Untrusted timestamp candidate
+ * @param field - Operator-readable field label
+ * @returns Canonical timestamp
+ */
+export function requireCanonicalUtcTimestamp(value, field) {
+    if (typeof value !== "string" ||
+        !ISO_UTC.test(value) ||
+        Number.isNaN(Date.parse(value)) ||
+        new Date(value).toISOString() !== value) {
+        throw new Error(`Invalid ${field}: expected canonical UTC YYYY-MM-DDTHH:mm:ss.sssZ`);
+    }
+    return value;
+}
+/**
+ * Detect controls and bidirectional formatting characters in operator text.
+ * @param value - Text candidate
+ * @returns Whether unsafe operator-text characters are present
+ */
+export function hasUnsafeTextCharacter(value) {
+    return Array.from(value).some(character => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return (codePoint <= 0x1f ||
+            (codePoint >= 0x7f && codePoint <= 0x9f) ||
+            (codePoint >= 0x202a && codePoint <= 0x202e) ||
+            (codePoint >= 0x2066 && codePoint <= 0x2069));
+    });
+}
+/**
+ * Read a dense, extra-free, accessor-free plain array without invoking values.
+ * @param value - Untrusted candidate
+ * @param minimum - Minimum accepted length
+ * @param maximum - Maximum accepted length
+ * @param label - Operator-readable field label
+ * @returns Data-property values in index order
+ */
+export function readStrictDenseArray(value, minimum, maximum, label) {
+    if (isProxy(value) || !Array.isArray(value)) {
+        throw new Error(`Invalid ${label}: expected ${minimum}-${maximum} entries`);
+    }
+    if (Object.getPrototypeOf(value) !== Array.prototype) {
+        throw new Error(`Invalid ${label}: expected a plain array prototype`);
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const length = descriptors.length?.value;
+    if (typeof length !== "number" ||
+        !Number.isSafeInteger(length) ||
+        length < minimum ||
+        length > maximum) {
+        throw new Error(`Invalid ${label}: expected ${minimum}-${maximum} entries`);
+    }
+    const expectedKeys = [
+        ...Array.from({ length }, (_unused, index) => String(index)),
+        "length",
+    ];
+    const keys = Reflect.ownKeys(descriptors);
+    if (keys.length !== expectedKeys.length ||
+        keys.some(key => typeof key !== "string" || !expectedKeys.includes(key))) {
+        throw new Error(`Invalid ${label}: expected a dense extra-free array`);
+    }
+    return Array.from({ length }, (_unused, index) => {
+        const descriptor = descriptors[String(index)];
+        if (descriptor === undefined || !("value" in descriptor)) {
+            throw new Error(`Invalid ${label}[${index}]: accessors are not allowed`);
+        }
+        return descriptor.value;
+    });
+}
+//# sourceMappingURL=strict-validation.js.map

package/dist/health/strict-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-validation.js","sourceRoot":"","sources":["../../src/health/strict-validation.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,OAAO,GAAG,gDAAgD,CAAC;AACjE,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAOtD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,MAAyB,EACzB,KAAa;IAEb,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,EACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAGzD,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,IACE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAa,CAAC,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACrB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,KAAK,6BAA6B,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,WAAwC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAsC,EACtC,KAAa;IAEb,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,KAAgB,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,OAA0B,EAC1B,KAAa;IAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAe,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,cAAc,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAe,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,KAAa,EACb,YAAoB;IAEpB,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;QACtB,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACvB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,yCAAyC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAc,EACd,KAAa;IAEb,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,mDAAmD,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QACxC,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,CACL,SAAS,IAAI,IAAI;YACjB,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC;YACxC,CAAC,SAAS,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,CAAC;YAC5C,CAAC,SAAS,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,CAAC,CAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,OAAe,EACf,OAAe,EACf,KAAa;IAEb,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,cAAc,OAAO,IAAI,OAAO,UAAU,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,oCAAoC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAGzD,CAAC;IACF,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,KAAgB,CAAC;IACpD,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAC7B,MAAM,GAAG,OAAO;QAChB,MAAM,GAAG,OAAO,EAChB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,cAAc,OAAO,IAAI,OAAO,UAAU,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,YAAY,GAAG;QACnB,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,QAAQ;KACT,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,IACE,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,KAAK,8BAA8B,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,UAAU,CAAC,KAAgB,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sync/config-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-sync.d.ts","sourceRoot":"","sources":["../../src/sync/config-sync.ts"],"names":[],"mappings":"AAqCA,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GACtB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,CAAC;AAEtB,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxE,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAiQD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CA0CrB"}
+{"version":3,"file":"config-sync.d.ts","sourceRoot":"","sources":["../../src/sync/config-sync.ts"],"names":[],"mappings":"AAqCA,+DAA+D;AAC/D,MAAM,MAAM,cAAc,GACtB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,CAAC;AAEtB,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,8BAA8B;AAC9B,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxE,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAmRD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CA0CrB"}

package/dist/sync/config-sync.js

@@ -81,14 +81,15 @@ function withAction(state, committed, action) {
  */
 function populateMissing(state, entry, artifactValue) {
     if (artifactValue !== undefined) {
-        const absorbed = fillMissing(artifactValue, entry.defaultValue);
+        const absorbed = validateEntryValue(entry, fillMissing(artifactValue, entry.defaultValue));
         return withAction(state, setAtPath(state.committed, entry.key, absorbed), {
             key: entry.key,
             kind: "absorbed-artifact",
             detail: `value absorbed from ${entry.artifacts?.[0]?.file ?? "artifact"}`,
         });
     }
-    const committed = recordPopulation(setAtPath(state.committed, entry.key, entry.defaultValue), entry.key, entry.defaultValue);
+    const defaultValue = validateEntryValue(entry, entry.defaultValue);
+    const committed = recordPopulation(setAtPath(state.committed, entry.key, defaultValue), entry.key, defaultValue);
     return withAction(state, committed, {
         key: entry.key,
         kind: "populated-default",
@@ -109,10 +110,11 @@ function populateEntry(state, entry, merged, local, artifactValue) {
     const mergedAfterMigration = stateAfterMigration === state
         ? merged
         : deepMerge(stateAfterMigration.committed, local);
-    const configValue = getAtPath(mergedAfterMigration, entry.key);
-    if (configValue === undefined) {
+    const rawConfigValue = getAtPath(mergedAfterMigration, entry.key);
+    if (rawConfigValue === undefined) {
         return populateMissing(stateAfterMigration, entry, artifactValue);
     }
+    const configValue = validateEntryValue(entry, rawConfigValue);
     const committedValue = getAtPath(stateAfterMigration.committed, entry.key);
     const localValue = getAtPath(local, entry.key);
     const recorded = recordedPopulation(stateAfterMigration.committed, entry.key);
@@ -167,6 +169,7 @@ async function syncArtifacts(state, entry, destDir, local) {
     if (effective === undefined) {
         return state;
     }
+    const validatedEffective = validateEntryValue(entry, effective);
     return bindings.reduce(async (statePromise, binding) => {
         const current = await statePromise;
         const filePath = path.join(destDir, binding.file);
@@ -176,10 +179,10 @@ async function syncArtifacts(state, entry, destDir, local) {
             return current;
         }
         const fileObject = isJsonObject(parsed) ? parsed : {};
-        if (jsonEquals(getAtPath(fileObject, binding.pointer), effective)) {
+        if (jsonEquals(getAtPath(fileObject, binding.pointer), validatedEffective)) {
             return current;
         }
-        const updated = setAtPath(fileObject, binding.pointer, effective);
+        const updated = setAtPath(fileObject, binding.pointer, validatedEffective);
         const writes = new Map([
             ...current.artifactWrites,
             [binding.file, updated],
@@ -198,6 +201,15 @@ async function syncArtifacts(state, entry, destDir, local) {
         };
     }, Promise.resolve(state));
 }
+/**
+ * Apply an entry's optional executable value contract.
+ * @param entry - Registry entry owning the value
+ * @param value - Untrusted effective value
+ * @returns Validated or unchanged JSON value
+ */
+function validateEntryValue(entry, value) {
+    return entry.validate?.(value) ?? value;
+}
 /**
  * Report required keys that are missing from the merged config.
  * @param merged - Merged config view

package/dist/sync/config-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-sync.js","sourceRoot":"","sources":["../../src/sync/config-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,WAAW,EACX,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,GAGV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,aAAa,GAEd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AA2C5E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAAkB,EAAE,SAAiB;IAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,MAAkB,EAClB,YAA2C;IAE3C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,OAAe,EACf,KAAoB;IAEpB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,KAAgB,EAChB,SAAqB,EACrB,MAAkB;IAElB,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,KAAgB,EAChB,KAAoB,EACpB,aAAoC;IAEpC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAChE,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE;YACxE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,uBAAuB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,UAAU,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EACzD,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CACnB,CAAC;IACF,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,+CAA+C;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,KAAgB,EAChB,KAAoB,EACpB,MAAkB,EAClB,KAAiB,EACjB,aAAoC;IAEpC,MAAM,mBAAmB,GAAG,oCAAoC,CAC9D,KAAK,EACL,KAAK,CAAC,GAAG,CACV,CAAC;IACF,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,KAAK;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAE,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAgB,CAAC;IACtE,MAAM,WAAW,GAAG,SAAS,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,eAAe,CAAC,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,cAAc,GAAG,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,MAAM,cAAc,GAClB,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;IACnE,IACE,QAAQ,KAAK,SAAS;QACtB,UAAU,CAAC,cAAc,EAAE,QAAQ,CAAC;QACpC,CAAC,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC;QAC/C,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,EAChD,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EACvE,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,OAAO,UAAU,CAAC,mBAAmB,EAAE,SAAS,EAAE;YAChD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,6DAA6D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,iBAAiB,GAAG,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,iBAAiB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;IACpE,MAAM,QAAQ,GAAG,iBAAiB;QAChC,CAAC,CAAC,sBAAsB,CACpB,WAAW,EACX,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CACpB;QACH,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IACvB,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,UAAU,CACf,mBAAmB,EACnB,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,EAC3D;YACE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,uCAAuC;SAChD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAC1B,KAAgB,EAChB,KAAoB,EACpB,OAAe,EACf,KAAiB;IAEjB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAqB,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE;QACzE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,cAAc,CAAU,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC;QACpE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IAAI,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAClE,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;YACrB,GAAG,OAAO,CAAC,cAAc;YACzB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU;SACjC,CAAC,CAAC;QACH,OAAO;YACL,GAAG,OAAO;YACV,cAAc,EAAE,MAAM;YACtB,OAAO,EAAE;gBACP,GAAG,OAAO,CAAC,OAAO;gBAClB;oBACE,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,sBAAsB;iBAC9C;aACF;SACF,CAAC;IACJ,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,MAAkB;IAElB,OAAO,aAAa,CAAC,MAAM,CACzB,QAAQ,CAAC,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;QACzC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,CAChD,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,UAAuB,EAAE;IAEzB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,MAAM,cAAc,CAAU,aAAa,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAU,SAAS,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAErD,MAAM,OAAO,GAAc;QACzB,SAAS;QACT,OAAO,EAAE,EAAE;QACX,cAAc,EAAE,IAAI,GAAG,EAAE;KAC1B,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,MAAM,CAC3C,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;QACjC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAe,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,aAAa,CAC7B,KAAK,EACL,KAAK,EACL,MAAM,EACN,KAAK,EACL,aAAa,CACd,CAAC;QACF,OAAO,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC,EACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACzB,CAAC;IAEF,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAe,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,eAAe,EAAE,mBAAmB,CAAC,WAAW,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI;KAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,iBAA6B,EAC7B,KAAgB;IAEhB,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CACjE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAC7C,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config-sync.js","sourceRoot":"","sources":["../../src/sync/config-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,WAAW,EACX,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,GAGV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,aAAa,GAEd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AA2C5E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAAkB,EAAE,SAAiB;IAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,OAAO,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,MAAkB,EAClB,YAA2C;IAE3C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,OAAe,EACf,KAAoB;IAEpB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,KAAgB,EAChB,SAAqB,EACrB,MAAkB;IAElB,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,KAAgB,EAChB,KAAoB,EACpB,aAAoC;IAEpC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,kBAAkB,CACjC,KAAK,EACL,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAC/C,CAAC;QACF,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE;YACxE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,uBAAuB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,UAAU,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,EACnD,KAAK,CAAC,GAAG,EACT,YAAY,CACb,CAAC;IACF,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,+CAA+C;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,KAAgB,EAChB,KAAoB,EACpB,MAAkB,EAClB,KAAiB,EACjB,aAAoC;IAEpC,MAAM,mBAAmB,GAAG,oCAAoC,CAC9D,KAAK,EACL,KAAK,CAAC,GAAG,CACV,CAAC;IACF,MAAM,oBAAoB,GACxB,mBAAmB,KAAK,KAAK;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAE,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAgB,CAAC;IACtE,MAAM,cAAc,GAAG,SAAS,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,eAAe,CAAC,mBAAmB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,MAAM,cAAc,GAClB,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;IACnE,IACE,QAAQ,KAAK,SAAS;QACtB,UAAU,CAAC,cAAc,EAAE,QAAQ,CAAC;QACpC,CAAC,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC;QAC/C,CAAC,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,EAChD,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAChC,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EACvE,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,YAAY,CACnB,CAAC;QACF,OAAO,UAAU,CAAC,mBAAmB,EAAE,SAAS,EAAE;YAChD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,6DAA6D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,iBAAiB,GAAG,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,iBAAiB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;IACpE,MAAM,QAAQ,GAAG,iBAAiB;QAChC,CAAC,CAAC,sBAAsB,CACpB,WAAW,EACX,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CACpB;QACH,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IACvB,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,UAAU,CACf,mBAAmB,EACnB,SAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,EAC3D;YACE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,uCAAuC;SAChD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAC1B,KAAgB,EAChB,KAAoB,EACpB,OAAe,EACf,KAAiB;IAEjB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,QAAQ,CAAC,MAAM,CAAqB,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE;QACzE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,cAAc,CAAU,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC;QACpE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,IACE,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,EACtE,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;YACrB,GAAG,OAAO,CAAC,cAAc;YACzB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU;SACjC,CAAC,CAAC;QACH,OAAO;YACL,GAAG,OAAO;YACV,cAAc,EAAE,MAAM;YACtB,OAAO,EAAE;gBACP,GAAG,OAAO,CAAC,OAAO;gBAClB;oBACE,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,sBAAsB;iBAC9C;aACF;SACF,CAAC;IACJ,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAoB,EAAE,KAAgB;IAChE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,MAAkB;IAElB,OAAO,aAAa,CAAC,MAAM,CACzB,QAAQ,CAAC,EAAE,CACT,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;QACzC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,CAChD,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,UAAuB,EAAE;IAEzB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,MAAM,cAAc,CAAU,aAAa,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAU,SAAS,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAErD,MAAM,OAAO,GAAc;QACzB,SAAS;QACT,OAAO,EAAE,EAAE;QACX,cAAc,EAAE,IAAI,GAAG,EAAE;KAC1B,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,MAAM,CAC3C,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;QACjC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAe,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,aAAa,CAC7B,KAAK,EACL,KAAK,EACL,MAAM,EACN,KAAK,EACL,aAAa,CACd,CAAC;QACF,OAAO,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC,EACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACzB,CAAC;IAEF,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAe,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,eAAe,EAAE,mBAAmB,CAAC,WAAW,CAAC;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI;KAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,iBAA6B,EAC7B,KAAgB;IAEhB,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CACjE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAC7C,CACF,CAAC;AACJ,CAAC"}

package/dist/sync/registry.d.ts

@@ -17,6 +17,8 @@ export interface SyncedSetting {
     readonly key: string;
     /** Built-in default used when neither config nor artifact has a value */
     readonly defaultValue: JsonValue;
+    /** Optional executable validator for human/config supplied values. */
+    readonly validate?: (value: unknown) => JsonValue;
     /**
      * Internal relative-path mappings for deprecated keys that remain readable.
      * Sync uses these to avoid filling a new default beside a human-owned alias.

package/dist/sync/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAoCD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,aAAa,EAoJjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EA0C/C,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAoCD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,aAAa,EA0JjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EA0C/C,CAAC"}

package/dist/sync/registry.js

@@ -11,6 +11,7 @@
  * @module sync/registry
  */
 import { DEFAULT_PROJECT_RULES_FILE } from "../core/project-config.js";
+import { validateHealthSchedule } from "../health/contract.js";
 const WHEN_TRACKER_JIRA = "tracker=jira";
 const WHEN_TRACKER_GITHUB = "tracker=github";
 const WHEN_SOURCE_GITHUB = "source=github";
@@ -58,6 +59,12 @@ export const SYNC_REGISTRY = [
         defaultValue: DEFAULT_PROJECT_RULES_FILE,
         description: "Hand-authored project rules file (independent of the ledger)",
     },
+    {
+        key: "health.schedule",
+        defaultValue: "off",
+        validate: validateHealthSchedule,
+        description: "Health-check schedule (off, daily, or weekly)",
+    },
     {
         key: "quality.testCoverage",
         defaultValue: COVERAGE_DEFAULTS,

package/dist/sync/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAiDvE,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAE3C,MAAM,iBAAiB,GAAc;IACnC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;CACnE,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE;QACJ,GAAG,EAAE,eAAe;QACpB,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,aAAa;KAC1B;CACO,CAAC;AAEX,MAAM,kBAAkB,GAAc;IACpC,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,qBAAqB;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAA6B;IACrD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,0BAA0B;QACxC,WAAW,EAAE,8DAA8D;KAC5E;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,iBAAiB;QAC/B,SAAS,EAAE;YACT,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/C,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,EAAE;SAC9C;QACD,WAAW,EAAE,4DAA4D;KAC1E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE;QACrE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzD,WAAW,EACT,2EAA2E;KAC9E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE;YACZ,mBAAmB,EAAE,EAAE;YACvB,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,EAAE;SACxB;QACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5D,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;QAC/C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxD,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,oCAAoC;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjE,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE;QACxD,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,qEAAqE;QACrE,mEAAmE;QACnE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;QAC7B,WAAW,EACT,wEAAwE;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE;YACZ,aAAa,EAAE,EAAE;YACjB,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,EAAE;YAChB,wEAAwE;YACxE,oEAAoE;YACpE,UAAU,EAAE;gBACV,YAAY,EAAE,CAAC;gBACf,wBAAwB,EAAE,CAAC;gBAC3B,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC;aAChB;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,+BAA+B;aAC5C;YACD;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,6BAA6B;aAC1C;SACF;QACD,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE;SAC/D;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;QAC9C,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE;QACtE,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,GAAG,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,EAAE;YAChE,GAAG,EAAE,kBAAkB;SACxB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,wDAAwD;KACtE;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;SACrB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,GAAG;QACjB,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,gCAAgC;KAC9C;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,oCAAoC,EAAE;IACnE;QACE,GAAG,EAAE,cAAc;QACnB,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,SAAS,EAAE,kBAAkB;KAC9B;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,YAAY,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACtD,SAAS,EAAE,uBAAuB;KACnC;IACD;QACE,GAAG,EAAE,YAAY;QACjB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,YAAY,EAAE,CAAC,mBAAmB,CAAC;QACnC,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,oBAAoB;KAChC;CACF,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAmD/D,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAE3C,MAAM,iBAAiB,GAAc;IACnC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;CACnE,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE;QACJ,GAAG,EAAE,eAAe;QACpB,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,aAAa;KAC1B;CACO,CAAC;AAEX,MAAM,kBAAkB,GAAc;IACpC,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,qBAAqB;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAA6B;IACrD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,0BAA0B;QACxC,WAAW,EAAE,8DAA8D;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,sBAAsB;QAChC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,iBAAiB;QAC/B,SAAS,EAAE;YACT,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/C,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,EAAE;SAC9C;QACD,WAAW,EAAE,4DAA4D;KAC1E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE;QACrE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzD,WAAW,EACT,2EAA2E;KAC9E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE;YACZ,mBAAmB,EAAE,EAAE;YACvB,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,EAAE;SACxB;QACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5D,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;QAC/C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxD,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,oCAAoC;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjE,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE;QACxD,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,qEAAqE;QACrE,mEAAmE;QACnE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;QAC7B,WAAW,EACT,wEAAwE;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE;YACZ,aAAa,EAAE,EAAE;YACjB,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,EAAE;YAChB,wEAAwE;YACxE,oEAAoE;YACpE,UAAU,EAAE;gBACV,YAAY,EAAE,CAAC;gBACf,wBAAwB,EAAE,CAAC;gBAC3B,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC;aAChB;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,+BAA+B;aAC5C;YACD;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,6BAA6B;aAC1C;SACF;QACD,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE;SAC/D;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;QAC9C,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE;QACtE,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,GAAG,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,EAAE;YAChE,GAAG,EAAE,kBAAkB;SACxB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,wDAAwD;KACtE;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;SACrB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,GAAG;QACjB,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,gCAAgC;KAC9C;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,oCAAoC,EAAE;IACnE;QACE,GAAG,EAAE,cAAc;QACnB,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,SAAS,EAAE,kBAAkB;KAC9B;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,YAAY,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACtD,SAAS,EAAE,uBAAuB;KACnC;IACD;QACE,GAAG,EAAE,YAAY;QACjB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,YAAY,EAAE,CAAC,mBAAmB,CAAC;QACnC,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,oBAAoB;KAChC;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,oBAAoB;KAChC;CACF,CAAC"}

package/package.json

@@ -36,7 +36,8 @@
     "check:upstream-evidence-manifest": "node scripts/generate-upstream-evidence-manifest.mjs --check",
     "refresh:upstream-public-commits": "node scripts/generate-upstream-evidence-manifest.mjs --refresh-public-commits",
     "check:rules-pairing": "bash scripts/check-rules-pairing.sh",
-    "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json"
+    "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
+    "verify:health-contract": "bun run build:dist && node scripts/verify-health-contract-built.mjs"
   },
   "engines": {
     "npm": "please-use-bun",
@@ -105,12 +106,13 @@
     "form-data": ">=4.0.6"
   },
   "name": "@codyswann/lisa",
-  "version": "2.262.0",
+  "version": "2.264.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
     ".": "./dist/index.js",
     "./learnings": "./dist/core/learnings.js",
+    "./health": "./dist/health/index.js",
     "./eslint": "./dist/configs/eslint/index.js",
     "./eslint/base": "./dist/configs/eslint/base.js",
     "./eslint/typescript": "./dist/configs/eslint/typescript.js",

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.262.0",
+  "version": "2.264.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.262.0",
+  "version": "2.264.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-github-evidence/SKILL.md

@@ -24,6 +24,16 @@ Upload captured evidence and generated templates to the GitHub PR description an
   - `comment.md` — GitHub markdown body for both the issue comment and the PR description's `## Evidence` section.
   - (Optional) `comment.txt` — kept for parity with the JIRA path; not used here.
 
+## Comment-body preflight (required)
+
+Before posting or updating anything, check the evidence body (`comment.md`, and `comment.txt` where this skill uses it):
+
+- It contains a `## Not established` heading. That heading is **never omitted and never blank** — when nothing is outstanding it still renders `None outstanding — reviewed`; otherwise it names, in plain operator language, what the verification did not prove.
+- The accompanying verdict carries `not_established_reviewed: true` (the list may be empty; the flag may never be omitted).
+- It contains a `## Artifact identity` heading carrying **values, not placeholders** — the repository, the `head_sha` the verification observed, the `environment`, and per artifact its `sha256` digest and `captured_at`. **Refuse to post** a body whose identity heading is absent or unpopulated, or whose recorded `artifact_head_sha` disagrees with the verdict's `artifact.head_sha` — report the evidence id and **both SHAs**. Definition: the `claim-evidence-mapping` rule.
+
+If either is missing, **refuse to post**: stop and report the missing Not-established review to the caller instead of publishing. Composing the body is `lisa-tracker-evidence`'s job (see its UI Evidence Checklist); this skill only refuses to publish one that omits the section. The section is defined by the `claim-evidence-mapping` rule and generalizes `lisa-improve-harness`'s required, never-empty `Known limits` field.
+
 ## Workflow
 
 1. **Resolve refs**

package/plugins/lisa/.codex-plugin/skills/lisa-jira-evidence/SKILL.md

@@ -42,6 +42,16 @@ Upload captured evidence and generated templates to GitHub PR description and JI
   - `comment.txt` — JIRA wiki markup (generated by `generate-templates.py`)
   - `comment.md` — GitHub markdown (generated by `generate-templates.py`)
 
+## Comment-body preflight (required)
+
+Before posting or updating anything, check the evidence body (`comment.md`, and `comment.txt` where this skill uses it):
+
+- It contains a `## Not established` heading. That heading is **never omitted and never blank** — when nothing is outstanding it still renders `None outstanding — reviewed`; otherwise it names, in plain operator language, what the verification did not prove.
+- The accompanying verdict carries `not_established_reviewed: true` (the list may be empty; the flag may never be omitted).
+- It contains a `## Artifact identity` heading carrying **values, not placeholders** — the repository, the `head_sha` the verification observed, the `environment`, and per artifact its `sha256` digest and `captured_at`. **Refuse to post** a body whose identity heading is absent or unpopulated, or whose recorded `artifact_head_sha` disagrees with the verdict's `artifact.head_sha` — report the evidence id and **both SHAs**. Definition: the `claim-evidence-mapping` rule.
+
+If either is missing, **refuse to post**: stop and report the missing Not-established review to the caller instead of publishing. Composing the body is `lisa-tracker-evidence`'s job (see its UI Evidence Checklist); this skill only refuses to publish one that omits the section. The section is defined by the `claim-evidence-mapping` rule and generalizes `lisa-improve-harness`'s required, never-empty `Known limits` field.
+
 ## Usage
 
 ```bash

package/plugins/lisa/.codex-plugin/skills/lisa-linear-evidence/SKILL.md

@@ -41,6 +41,16 @@ The caller must produce:
 
 If any of these are missing, stop and report.
 
+## Comment-body preflight (required)
+
+Before posting or updating anything, check the evidence body (`comment.md`, and `comment.txt` where this skill uses it):
+
+- It contains a `## Not established` heading. That heading is **never omitted and never blank** — when nothing is outstanding it still renders `None outstanding — reviewed`; otherwise it names, in plain operator language, what the verification did not prove.
+- The accompanying verdict carries `not_established_reviewed: true` (the list may be empty; the flag may never be omitted).
+- It contains a `## Artifact identity` heading carrying **values, not placeholders** — the repository, the `head_sha` the verification observed, the `environment`, and per artifact its `sha256` digest and `captured_at`. **Refuse to post** a body whose identity heading is absent or unpopulated, or whose recorded `artifact_head_sha` disagrees with the verdict's `artifact.head_sha` — report the evidence id and **both SHAs**. Definition: the `claim-evidence-mapping` rule.
+
+If either is missing, **refuse to post**: stop and report the missing Not-established review to the caller instead of publishing. Composing the body is `lisa-tracker-evidence`'s job (see its UI Evidence Checklist); this skill only refuses to publish one that omits the section. The section is defined by the `claim-evidence-mapping` rule and generalizes `lisa-improve-harness`'s required, never-empty `Known limits` field.
+
 ## Phase 1 — Resolve Linear Issue
 
 1. Parse the identifier from `$ARGUMENTS`.

package/plugins/lisa/.codex-plugin/skills/lisa-tracker-evidence/SKILL.md

@@ -28,6 +28,10 @@ See the `config-resolution` rule for configuration and dispatch table.
 - Never post evidence to a different ticket than the one named — `$ARGUMENTS` is the source of truth.
 - Never invent a verify-specific usage footer. Evidence artifact usage must flow through `lisa-usage-accounting`, preserve the canonical `## Lisa Usage` section, and surface `source: unavailable` explicitly when the runtime cannot provide trustworthy numbers.
 - **Evidence-manifest gate (leaf work units).** Before dispatching to a vendor skill that transitions the ticket, confirm `EVIDENCE_DIR` contains a non-empty artifact **of the declared type** for every typed `[EVIDENCE: <artifact-type>: <name>]` marker declared in the ticket's Validation Journey — a `screenshot` marker needs an actual image, an `http-transcript` marker needs the request + response text, a `perf-trace` marker needs measured numbers; a prose claim satisfies nothing. If any declared marker has no captured artifact, an empty one, or one whose content/extension does not match its declared type, stop and report the offending markers by name instead of posting — a leaf work unit (Bug / Task / Sub-task / Improvement) may not advance to its review/Done state with an unsatisfied manifest (see the "Per-Work-Unit Evidence Contract" in the `verification` rule). Epics / Stories / Spikes, and leaf units without a Validation Journey, are exempt.
+- **Claim↔boundary binding (S14 upgrade).** Satisfying the manifest by *type* is not enough: each `[EVIDENCE: <artifact-type>: <name>]` marker is also cited for a **claim**, and the marker's artifact type must **reach the boundary that claim declares** per the `claim-evidence-mapping` rule's taxonomy. A `browser` claim (user-visible UI behavior) is reached by `screenshot` / `recording` and never by a unit `test-run-log`; an `http-api` claim needs an `http-transcript`; a `deploy-health` claim needs a `deploy-log` and no pre-deploy artifact. On a mismatch, report the offending marker **by name** together with the claim, its boundary, and the **required evidence kinds** for that boundary — e.g. `[EVIDENCE: test-run-log: unit-suite] cited for claim AC-2 [boundary browser] — required evidence kinds: screenshot, recording`. Swapping in a marker of a reaching kind with a real captured artifact satisfies the gate. **Advisory-first:** until `verification.gate.enforceBoundaries` is `true` in `.lisa.config.json` (the same ratchet flag the Stop-hook gate reads, default `false`), a boundary mismatch is reported to the operator but does not block the post; once ratcheted on it refuses the post exactly like a missing or wrong-type artifact. Missing/empty/wrong-type artifacts keep refusing the post regardless of the flag.
+- **The "Not established" section is required.** Before posting, confirm `evidence/comment.md` (and `comment.txt` where the vendor uses it) contains a `## Not established` heading and that the verdict carries `not_established_reviewed: true`. The heading is **never omitted and never blank**: with nothing outstanding it still renders `None outstanding — reviewed`; otherwise it lists, in plain operator language, each thing the verification did not prove — boundaries not exercised, environments not tested, behavior consciously out of scope. A comment with no such heading, a heading with nothing under it, or a verdict whose `not_established_reviewed` flag is absent is **refused**: stop and report the missing Not-established review instead of posting. (The list may be empty; the flag may never be omitted.) Definition and exemplars live in the `claim-evidence-mapping` rule; this generalizes `lisa-improve-harness`'s required, never-empty `Known limits` field.
+- **Artifact identity is required, with values (S14 extension).** Before posting, confirm the comment body carries a `## Artifact identity` heading populated with **values, not placeholders**: the `repository`, the `head_sha` the verification observed, the `environment`, and for each committed artifact its `sha256` digest and `captured_at`. Then check both identity failures. **`artifact_mismatch`** — an evidence entry whose recorded `artifact_head_sha` differs from the verdict's `artifact.head_sha`: refuse the post and report the offending evidence id together with **both SHAs** (the one the artifact was captured at and the one the verdict claims), e.g. `EV-2 captured at 4f1c9ab but artifact.head_sha is 9de0c31`. **`evidence_digest_mismatch`** — recompute the `sha256` of each committed evidence file on read; if the bytes no longer match the recorded digest (or the file is absent), stop and report the evidence id by name. Never summarize either as "verification failed" — name the field, the ids, and both SHAs so a non-engineer can read it at the gate. **Advisory-first:** until `verification.gate.enforceBoundaries` is `true` in `.lisa.config.json`, an identity failure is reported to the operator but does not block the post; once ratcheted on it refuses the post exactly like a missing artifact. Definition: the `claim-evidence-mapping` rule.
+- **Merge-race reconciliation (at completion, not at post).** The evidence's pinned `head_sha` is reconciled against the merged head using the ancestry + deploy-run definition of "what shipped" that `lisa-drive-pr-to-merge` already owns — cite that skill, never re-implement or restate its checks here. Pre-merge evidence counts for the merge commit only when its head is a parent of the merge, ancestry alone never justifies reporting shipped, and on a mismatch verification re-runs against the merged head before completion is declared.
 - **Evidence references are not manifest entries.** Extract obligations using the exact `[EVIDENCE:` prefix (and the legacy local `[SCREENSHOT:` form). Exclude both the canonical `[EVIDENCE-REF: <work-item-ref> | <artifact-type>: <kebab-case-name>]` and the Lisa 2.223.0 legacy alias `[EVIDENCE-REF: <tracker-ref>: <artifact-type>: <kebab-case-name>]` from artifact lookup, missing-artifact reporting, and duplicate-name checks: either belongs to another work item and cannot satisfy this item's S14 gate. A runtime-changing leaf with references but no local claiming marker must be rejected before dispatch.
 
 ## UI Evidence Checklist (when work is UI-visible)
@@ -47,8 +51,11 @@ The checklist is tracker-agnostic — the same shape works on JIRA, GitHub Issue
 5. **"What this shows" section.** Tailor to ticket type:
    - **Bug repro:** state plainly whether the bug reproduces or not, and the most likely 1–2 reasons their retest still failed (different env, native app vs. web, stuck backend row, etc.).
    - **Feature/UX completion:** state plainly which acceptance criteria each screenshot covers, and call out any deferred or out-of-scope surface explicitly so QA/PM doesn't have to infer.
-6. **"What would help me confirm" (bug) / "How to QA" (feature) section.** Concrete actionable retest steps with the exact selection criteria (e.g., "pick a record whose Status column shows `—`, not `Processing` or `Pending Review`").
-7. **Explicit invitation to be corrected.** End with a line like *"If any of the steps I listed are different from what you expected / actually did, please tell me explicitly which step I got wrong."* Non-optional — small differences (which record, which device, exact tap order, expected behavior) change everything, and naming the door open short-circuits ticket bounce-loops.
-8. **Workflow transition** is the vendor skill's job, not yours — it'll move the ticket per the configured tracker (JIRA: Reassign to reporter for bug repro / move to the configured review status when one exists, otherwise leave it in `claimed`; GitHub: direct `claimed` → configured `done` after a successful build; Linear: equivalent state). You don't transition manually.
+6. **"Artifact identity" and "Not established" sections (both required).** Right after "What this shows":
+   - `## Artifact identity` — what the evidence was collected against, as **values, not placeholders**: the repository, the `head_sha` the verification observed, the `environment`, and per artifact its `sha256` digest and `captured_at`. A heading rendered with `<unknown>` in place of a SHA is not identity.
+   - `## Not established` — **never omitted, never blank.** List in plain language what this verification did *not* prove: boundaries not exercised (e.g. "the persisted order row was never queried"), environments not tested (e.g. "checked on desktop Chrome only — not mobile Safari"), and behavior consciously out of scope (e.g. "refunds were not touched or tested"). Name the specific thing, not a category. With nothing outstanding, the heading still renders a single line: `None outstanding — reviewed`. Never state a quality check as proof of behavior — "unit tests pass" belongs here as a limit, not above as evidence.
+7. **"What would help me confirm" (bug) / "How to QA" (feature) section.** Concrete actionable retest steps with the exact selection criteria (e.g., "pick a record whose Status column shows `—`, not `Processing` or `Pending Review`").
+8. **Explicit invitation to be corrected.** End with a line like *"If any of the steps I listed are different from what you expected / actually did, please tell me explicitly which step I got wrong."* Non-optional — small differences (which record, which device, exact tap order, expected behavior) change everything, and naming the door open short-circuits ticket bounce-loops.
+9. **Workflow transition** is the vendor skill's job, not yours — it'll move the ticket per the configured tracker (JIRA: Reassign to reporter for bug repro / move to the configured review status when one exists, otherwise leave it in `claimed`; GitHub: direct `claimed` → configured `done` after a successful build; Linear: equivalent state). You don't transition manually.
 
 **Why this format:** It (a) gives the reporter a frame-by-frame they can compare against, (b) avoids the JIRA image-collapse failure mode while still working everywhere else, (c) names the most plausible discrepancies up front so the loop short-circuits, (d) explicitly opens the door to being corrected so tickets don't bounce on assumed alignment. The same mechanics that resolve a stuck bug ticket also give QA an unambiguous handoff for a freshly-built feature.

package/plugins/lisa/rules/eager/claim-evidence-mapping.md

@@ -37,9 +37,29 @@ rule 5).
 A claim carries three fields — `claim_id`, `boundary`, and `required_evidence_kinds` — named here so
 every downstream surface uses one spelling. This ticket only writes the contract down; the schema and
 gate that make these fields executable ship with **BCE-2 (#1836)** — do not assume that surface is
-present in this branch. A claim with no reaching evidence is **Not established** (defined fully in
-**BCE-3 (#1837)**), an artifact's identity is pinned in **BCE-4 (#1838)**, and the conservative
-security-bucket default is set in **BCE-5 (#1839)** — each named here, defined there.
+present in this branch. The conservative security-bucket default is set in **BCE-5 (#1839)** — named
+here, defined there.
+
+## Artifact identity (pinned, never assumed)
+
+A claim applies only to the artifact its evidence was collected against. Every verdict pins
+`artifact.head_sha` — the commit the run observed — and every evidence entry pins the
+`artifact_head_sha` in force when it was captured, its `sha256` content digest, and `captured_at`.
+Evidence collected on a pre-merge head is valid for the merge commit **only** when that head is a
+parent of the merge, per the ancestry + deploy-run definition of "what shipped" that
+`lisa-drive-pr-to-merge` already owns — cite it, never write a second one. A mismatched SHA or a
+recomputed digest that disagrees fails loudly, naming both SHAs / the evidence id, and verification
+re-runs against the merged head before completion is declared. Full definition: the reference body.
+
+## Not established (required, never omitted)
+
+A claim with no reaching evidence is **Not established**, and every report says so out loud. Each
+evidence comment and verdict carries a `Not established` section listing what was *not* proved —
+boundaries not exercised, environments not tested, behavior consciously out of scope. It is never
+omitted and never blank: with nothing outstanding it still renders `None outstanding — reviewed`, and
+`not_established_reviewed` attests the list was reviewed even when the list itself is empty. This
+generalizes the required, never-empty `Known limits` field of `lisa-improve-harness`. Full definition
+and operator-voice exemplars: the reference body.
 
 ## No behavior change; degrade, never block