@codyswann/lisa 2.265.0 → 2.267.0

package/dist/health/read-only-fs.js

@@ -0,0 +1,165 @@
+/** Confined, bounded filesystem reads for deterministic health probes. */
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+const DEFAULT_MAX_BYTES = 512 * 1024;
+const READ_CHUNK_BYTES = 64 * 1024;
+/**
+ * Resolve a project-relative path without permitting traversal.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative path
+ * @returns Confined absolute path
+ */
+export function resolveProjectPath(root, relativePath) {
+    if (path.isAbsolute(relativePath)) {
+        throw new Error("Health path must be project-relative");
+    }
+    const target = path.resolve(root, relativePath);
+    if (target !== root && !target.startsWith(`${root}${path.sep}`)) {
+        throw new Error("Health path escapes project root");
+    }
+    return target;
+}
+/**
+ * Assert that one lstat result is a bounded regular file.
+ * @param stat - File metadata
+ * @param maximumBytes - Maximum allowed size
+ */
+function assertBoundedFile(stat, maximumBytes) {
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error("Unsafe health project file");
+    }
+    if (stat.size > maximumBytes) {
+        throw new Error("Health project file exceeds size limit");
+    }
+}
+/**
+ * Read at most maximum plus one bytes without unbounded stream behavior.
+ * @param handle - Open nonblocking regular-file handle
+ * @param maximumBytes - Maximum allowed payload size
+ * @param offset - Current read offset
+ * @returns Bounded bytes
+ */
+async function readBounded(handle, maximumBytes, offset = 0) {
+    const remaining = maximumBytes + 1 - offset;
+    if (remaining <= 0)
+        return Buffer.alloc(0);
+    const chunk = Buffer.allocUnsafe(Math.min(READ_CHUNK_BYTES, remaining));
+    const { bytesRead } = await handle.read(chunk, 0, chunk.length, offset);
+    if (bytesRead === 0)
+        return Buffer.alloc(0);
+    const current = chunk.subarray(0, bytesRead);
+    const tail = await readBounded(handle, maximumBytes, offset + bytesRead);
+    return Buffer.concat([current, tail], bytesRead + tail.length);
+}
+/**
+ * Read one stable regular file without following a target outside the project.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative path
+ * @param maximumBytes - Maximum permitted file size
+ * @returns File bytes, or undefined when absent
+ */
+export async function readProjectFile(root, relativePath, maximumBytes = DEFAULT_MAX_BYTES) {
+    const target = resolveProjectPath(root, relativePath);
+    try {
+        const before = await lstat(target);
+        assertBoundedFile(before, maximumBytes);
+        const actual = await realpath(target);
+        if (!actual.startsWith(`${root}${path.sep}`)) {
+            throw new Error("Unsafe health project file escapes project root");
+        }
+        const handle = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const opened = await handle.stat();
+            assertBoundedFile(opened, maximumBytes);
+            if (opened.dev !== before.dev || opened.ino !== before.ino) {
+                throw new Error("Health project file changed during read");
+            }
+            const bytes = await readBounded(handle, maximumBytes);
+            if (bytes.length > maximumBytes) {
+                throw new Error("Health project file exceeds size limit");
+            }
+            const after = await handle.stat();
+            if (after.size !== opened.size || bytes.length !== after.size) {
+                throw new Error("Health project file changed during read");
+            }
+            return { bytes, mode: opened.mode };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+/**
+ * Read just the bytes from one confined stable regular file.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative path
+ * @param maximumBytes - Maximum permitted file size
+ * @returns File bytes, or undefined when absent
+ */
+export async function readProjectBytes(root, relativePath, maximumBytes = DEFAULT_MAX_BYTES) {
+    return (await readProjectFile(root, relativePath, maximumBytes))?.bytes;
+}
+/**
+ * Classify a confined path without following symbolic links or accepting
+ * special files such as FIFOs and devices.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative path
+ * @returns Safe path kind
+ */
+export async function projectPathKind(root, relativePath) {
+    const target = resolveProjectPath(root, relativePath);
+    try {
+        const stat = await lstat(target);
+        if (stat.isSymbolicLink())
+            throw new Error("Unsafe health project path");
+        if (!stat.isFile() && !stat.isDirectory()) {
+            throw new Error("Unsafe health project path");
+        }
+        const actual = await realpath(target);
+        if (actual !== root && !actual.startsWith(`${root}${path.sep}`)) {
+            throw new Error("Unsafe health project path escapes project root");
+        }
+        return stat.isDirectory() ? "directory" : "file";
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "missing";
+        throw error;
+    }
+}
+/**
+ * Read strict UTF-8 text from a confined project file.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative path
+ * @param maximumBytes - Maximum permitted file size
+ * @returns Text, or undefined when absent
+ */
+export async function readProjectText(root, relativePath, maximumBytes = DEFAULT_MAX_BYTES) {
+    const bytes = await readProjectBytes(root, relativePath, maximumBytes);
+    return bytes === undefined
+        ? undefined
+        : new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+/**
+ * Read a JSON object without exposing its values in failures.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative JSON path
+ * @returns Parsed object, or undefined when absent
+ */
+export async function readProjectJsonObject(root, relativePath) {
+    const text = await readProjectText(root, relativePath);
+    if (text === undefined)
+        return undefined;
+    const parsed = JSON.parse(text);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("Health project JSON must be an object");
+    }
+    return parsed;
+}
+//# sourceMappingURL=read-only-fs.js.map

package/dist/health/read-only-fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only-fs.js","sourceRoot":"","sources":["../../src/health/read-only-fs.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAmB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AACrC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAWnC;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,YAAoB;IACnE,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAW,EAAE,YAAoB;IAC1D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CACxB,MAAkB,EAClB,YAAoB,EACpB,MAAM,GAAG,CAAC;IAEV,MAAM,SAAS,GAAG,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC;IAC5C,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC;IACxE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,YAAoB,EACpB,YAAY,GAAG,iBAAiB;IAEhC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,MAAM,EACN,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACjE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACnC,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACtD,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,YAAoB,EACpB,YAAY,GAAG,iBAAiB;IAEhC,OAAO,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,YAAoB;IAEpB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,YAAoB,EACpB,YAAY,GAAG,iBAAiB;IAEhC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IACvE,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACvD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAA2C,CAAC;AACrD,CAAC"}

package/dist/health/ruleset-inspection.d.ts

@@ -0,0 +1,57 @@
+import type { ProjectType } from "../core/config.js";
+import type { HealthFinding } from "./contract.js";
+/** Material ruleset fields health compares. */
+export interface HealthRuleset {
+    readonly name: string;
+    readonly target: unknown;
+    readonly enforcement: unknown;
+    readonly conditions: unknown;
+    readonly rules: unknown;
+}
+/**
+ * Injectable structured ruleset reader. Implementations must honor `signal`
+ * and release any owned handles before settling.
+ */
+export type RulesetReader = (owner: string, repo: string, projectRoot: string, timeoutMs: number, signal: AbortSignal) => Promise<readonly HealthRuleset[]>;
+/** Ruleset comparison result containing names only. */
+export interface RulesetDrift {
+    readonly missing: readonly string[];
+    readonly drifted: readonly string[];
+}
+/**
+ * Default fixed-argv detailed GitHub ruleset reader.
+ * @param owner
+ * @param repo
+ * @param projectRoot
+ * @param timeoutMs
+ * @param signal
+ */
+export declare const readGithubRulesets: RulesetReader;
+/**
+ * Read expected material rulesets after the same per-project normalization as apply.
+ * @param lisaRoot - Lisa package root
+ * @param projectRoot - Canonical host root
+ * @param types - Canonically ordered project types
+ * @param config - Safe project config
+ * @returns Expected rulesets sorted by name
+ */
+export declare function expectedRulesets(lisaRoot: string, projectRoot: string, types: readonly ProjectType[], config: Readonly<Record<string, unknown>>): Promise<readonly HealthRuleset[]>;
+/**
+ * Compare expected and observed material ruleset documents.
+ * @param expected
+ * @param actual
+ */
+export declare function compareRulesets(expected: readonly HealthRuleset[], actual: readonly HealthRuleset[]): RulesetDrift;
+/**
+ * Collect and compare detailed material GitHub ruleset state.
+ * @param lisaRoot - Lisa package root
+ * @param projectRoot - Canonical host root
+ * @param types - Safely detected project types
+ * @param config - Safe project config
+ * @param reader - Structured remote ruleset reader
+ * @param timeoutMs - Remaining shared deadline
+ * @param signal - Shared cancellation signal
+ * @returns GitHub ruleset finding
+ */
+export declare function rulesetFinding(lisaRoot: string, projectRoot: string, types: readonly ProjectType[], config: Readonly<Record<string, unknown>>, reader: RulesetReader, timeoutMs: number, signal: AbortSignal): Promise<HealthFinding>;
+//# sourceMappingURL=ruleset-inspection.d.ts.map

package/dist/health/ruleset-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleset-inspection.d.ts","sourceRoot":"","sources":["../../src/health/ruleset-inspection.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AA0BnD,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;AAEvC,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAgED;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAsChC,CAAC;AAsEF;;;;;;;GAOG;AAEH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CA4BnC;AA4CD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,MAAM,EAAE,SAAS,aAAa,EAAE,GAC/B,YAAY,CAiCd;AAuBD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAwCxB"}

package/dist/health/ruleset-inspection.js

@@ -0,0 +1,315 @@
+/** Structured, bounded GitHub ruleset collection and canonical comparison. */
+/* eslint-disable jsdoc/require-param-description, jsdoc/require-returns, max-lines -- structured collection and normalization stay colocated */
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { listFilesRecursive } from "../utils/file-operations.js";
+import { deterministicFinding, namedReason } from "./finding-utils.js";
+import { projectPathKind } from "./read-only-fs.js";
+const GH_TIMEOUT_MS = 15_000;
+const MAX_GH_OUTPUT_BYTES = 256 * 1024;
+const MAX_RULESETS = 32;
+const ACTIONS_INTEGRATION_ID = 15_368;
+const REPOSITORY_PART = /^[A-Za-z0-9_.-]{1,100}$/u;
+const RULESET_CHECK = "github.rulesets";
+const WARN = "warn";
+/**
+ * Return a sorted copy without mutating caller-owned input.
+ * @param items - Caller-owned items
+ * @param compare - Stable comparator
+ */
+function sortedCopy(items, compare) {
+    const copy = [...items];
+    // eslint-disable-next-line functional/immutable-data -- only the detached copy is sorted
+    return copy.sort(compare);
+}
+/**
+ * Run one fixed-argv bounded gh JSON read.
+ * @param argv
+ * @param cwd
+ * @param timeoutMs
+ * @param signal
+ */
+function readGhJson(argv, cwd, timeoutMs, signal) {
+    return new Promise((resolve, reject) => {
+        execFile(
+        // eslint-disable-next-line sonarjs/no-os-command-from-path -- fixed user-installed gh executable
+        "gh", [...argv], {
+            cwd,
+            encoding: "utf8",
+            maxBuffer: MAX_GH_OUTPUT_BYTES,
+            signal,
+            killSignal: "SIGKILL",
+            timeout: Math.max(1, Math.min(timeoutMs, GH_TIMEOUT_MS)),
+        }, (error, stdout) => {
+            if (error !== null) {
+                reject(error);
+                return;
+            }
+            try {
+                resolve(JSON.parse(stdout));
+            }
+            catch (parseError) {
+                reject(parseError);
+            }
+        });
+    });
+}
+/**
+ * Validate and project one detailed GitHub ruleset response.
+ * @param candidate
+ */
+function projectRuleset(candidate) {
+    if (candidate === null || typeof candidate !== "object") {
+        throw new Error("Ruleset detail was not an object");
+    }
+    const name = Reflect.get(candidate, "name");
+    if (typeof name !== "string" || name.trim().length === 0) {
+        throw new Error("Ruleset detail omitted its name");
+    }
+    return {
+        name,
+        target: Reflect.get(candidate, "target"),
+        enforcement: Reflect.get(candidate, "enforcement"),
+        conditions: Reflect.get(candidate, "conditions"),
+        rules: Reflect.get(candidate, "rules"),
+    };
+}
+/**
+ * Default fixed-argv detailed GitHub ruleset reader.
+ * @param owner
+ * @param repo
+ * @param projectRoot
+ * @param timeoutMs
+ * @param signal
+ */
+export const readGithubRulesets = async (owner, repo, projectRoot, timeoutMs, signal) => {
+    const listed = await readGhJson(["api", "-X", "GET", `repos/${owner}/${repo}/rulesets`], projectRoot, timeoutMs, signal);
+    if (!Array.isArray(listed) || listed.length > MAX_RULESETS) {
+        throw new Error("Ruleset list exceeded its bounded contract");
+    }
+    const details = await Promise.all(listed.map(async (entry) => {
+        if (entry === null || typeof entry !== "object") {
+            throw new Error("Ruleset list entry was not an object");
+        }
+        const id = Reflect.get(entry, "id");
+        if (!Number.isSafeInteger(id)) {
+            throw new Error("Ruleset list entry omitted its id");
+        }
+        return projectRuleset(await readGhJson(["api", "-X", "GET", `repos/${owner}/${repo}/rulesets/${String(id)}`], projectRoot, timeoutMs, signal));
+    }));
+    return sortedCopy(details, (left, right) => left.name.localeCompare(right.name));
+};
+/**
+ * Read configured required-check opt-outs without exposing their values.
+ * @param config
+ */
+function droppedChecks(config) {
+    const github = config.github;
+    const rulesets = github !== null && typeof github === "object" && !Array.isArray(github)
+        ? Reflect.get(github, "rulesets")
+        : undefined;
+    const dropped = rulesets !== null &&
+        typeof rulesets === "object" &&
+        !Array.isArray(rulesets)
+        ? Reflect.get(rulesets, "dropRequiredChecks")
+        : undefined;
+    return new Set(Array.isArray(dropped)
+        ? dropped.filter(item => typeof item === "string")
+        : []);
+}
+/**
+ * Apply workflow and configured required-check normalization used by apply.
+ * @param rules
+ * @param hasWorkflows
+ * @param dropped
+ */
+function normalizeExpectedRules(rules, hasWorkflows, dropped) {
+    if (!Array.isArray(rules))
+        return rules;
+    return rules.flatMap(rule => {
+        if (rule === null ||
+            typeof rule !== "object" ||
+            Reflect.get(rule, "type") !== "required_status_checks") {
+            return [rule];
+        }
+        const parameters = Reflect.get(rule, "parameters");
+        if (parameters === null || typeof parameters !== "object")
+            return [rule];
+        const checks = Reflect.get(parameters, "required_status_checks");
+        if (!Array.isArray(checks))
+            return [rule];
+        const retained = checks.filter(check => {
+            if (check === null || typeof check !== "object")
+                return true;
+            const integration = Reflect.get(check, "integration_id");
+            const context = Reflect.get(check, "context");
+            return ((hasWorkflows || integration !== ACTIONS_INTEGRATION_ID) &&
+                (typeof context !== "string" || !dropped.has(context)));
+        });
+        if (retained.length === 0)
+            return [];
+        return [
+            {
+                ...rule,
+                parameters: { ...parameters, required_status_checks: retained },
+            },
+        ];
+    });
+}
+/**
+ * Read expected material rulesets after the same per-project normalization as apply.
+ * @param lisaRoot - Lisa package root
+ * @param projectRoot - Canonical host root
+ * @param types - Canonically ordered project types
+ * @param config - Safe project config
+ * @returns Expected rulesets sorted by name
+ */
+// eslint-disable-next-line sonarjs/cognitive-complexity -- normalization mirrors the apply contract explicitly
+export async function expectedRulesets(lisaRoot, projectRoot, types, config) {
+    const hasWorkflows = (await projectPathKind(projectRoot, path.join(".github", "workflows"))) ===
+        "directory";
+    const dropped = droppedChecks(config);
+    const byName = new Map();
+    for (const type of ["all", ...types]) {
+        const directory = path.join(lisaRoot, type, "github-rulesets");
+        try {
+            for (const file of await listFilesRecursive(directory)) {
+                const parsed = JSON.parse(await readFile(file, "utf8"));
+                const projected = projectRuleset(parsed);
+                const normalized = {
+                    ...projected,
+                    rules: normalizeExpectedRules(projected.rules, hasWorkflows, dropped),
+                };
+                if (!Array.isArray(normalized.rules) || normalized.rules.length > 0) {
+                    // eslint-disable-next-line functional/immutable-data -- most-specific stack wins in the bounded plan
+                    byName.set(normalized.name, normalized);
+                }
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    return [...byName.values()].sort((left, right) => left.name.localeCompare(right.name));
+}
+/**
+ * Canonicalize semantically unordered JSON objects and arrays.
+ * @param value
+ */
+function canonical(value) {
+    if (Array.isArray(value)) {
+        return value
+            .map(canonical)
+            .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+    }
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => [key, canonical(item)]));
+    }
+    return value;
+}
+/**
+ * Remove read-only defaults GitHub may add to otherwise equivalent rules.
+ * This projection is applied symmetrically so authored non-default values
+ * remain material.
+ * @param value
+ */
+function withoutGithubDefaults(value) {
+    if (Array.isArray(value))
+        return value.map(withoutGithubDefaults);
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).flatMap(([key, item]) => key === "required_reviewers" && Array.isArray(item) && item.length === 0
+            ? []
+            : [[key, withoutGithubDefaults(item)]]));
+    }
+    return value;
+}
+/**
+ * Compare expected and observed material ruleset documents.
+ * @param expected
+ * @param actual
+ */
+export function compareRulesets(expected, actual) {
+    const observed = new Map(actual.map(item => [item.name, item]));
+    const missing = expected
+        .filter(item => !observed.has(item.name))
+        .map(item => item.name);
+    const drifted = expected.flatMap(item => {
+        const present = observed.get(item.name);
+        if (present === undefined)
+            return [];
+        const expectedMaterial = canonical(withoutGithubDefaults({
+            target: item.target,
+            enforcement: item.enforcement,
+            conditions: item.conditions,
+            rules: item.rules,
+        }));
+        const actualMaterial = canonical(withoutGithubDefaults({
+            target: present.target,
+            enforcement: present.enforcement,
+            conditions: present.conditions,
+            rules: present.rules,
+        }));
+        if (JSON.stringify(expectedMaterial) !== JSON.stringify(actualMaterial)) {
+            return [item.name];
+        }
+        return [];
+    });
+    return {
+        missing: sortedCopy(missing, (left, right) => left.localeCompare(right)),
+        drifted: sortedCopy(drifted, (left, right) => left.localeCompare(right)),
+    };
+}
+/**
+ * Extract a safe GitHub target without reporting configured values.
+ * @param config
+ */
+function githubTarget(config) {
+    const github = config.github;
+    if (github === null || typeof github !== "object" || Array.isArray(github)) {
+        return undefined;
+    }
+    const owner = Reflect.get(github, "org");
+    const repo = Reflect.get(github, "repo");
+    return typeof owner === "string" &&
+        typeof repo === "string" &&
+        REPOSITORY_PART.test(owner) &&
+        REPOSITORY_PART.test(repo)
+        ? { owner, repo }
+        : undefined;
+}
+/**
+ * Collect and compare detailed material GitHub ruleset state.
+ * @param lisaRoot - Lisa package root
+ * @param projectRoot - Canonical host root
+ * @param types - Safely detected project types
+ * @param config - Safe project config
+ * @param reader - Structured remote ruleset reader
+ * @param timeoutMs - Remaining shared deadline
+ * @param signal - Shared cancellation signal
+ * @returns GitHub ruleset finding
+ */
+export async function rulesetFinding(lisaRoot, projectRoot, types, config, reader, timeoutMs, signal) {
+    const target = githubTarget(config);
+    if (target === undefined) {
+        return deterministicFinding("github.rulesets", "warn", "GitHub rulesets are unavailable without a configured repository.");
+    }
+    const actual = await reader(target.owner, target.repo, projectRoot, timeoutMs, signal).catch(() => undefined);
+    if (actual === undefined) {
+        return deterministicFinding(RULESET_CHECK, WARN, "GitHub rulesets could not be observed within the deterministic deadline.");
+    }
+    const expected = await expectedRulesets(lisaRoot, projectRoot, types, config);
+    const drift = compareRulesets(expected, actual);
+    const names = [
+        ...drift.missing.map(name => `${name} missing`),
+        ...drift.drifted.map(name => `${name} drifted`),
+    ];
+    return names.length === 0
+        ? deterministicFinding(RULESET_CHECK, "pass", "Required GitHub rulesets are active and materially current.")
+        : deterministicFinding(RULESET_CHECK, "fail", namedReason("GitHub ruleset drift", names));
+}
+/* eslint-enable jsdoc/require-param-description, jsdoc/require-returns, max-lines -- restore repository defaults */
+//# sourceMappingURL=ruleset-inspection.js.map

package/dist/health/ruleset-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleset-inspection.js","sourceRoot":"","sources":["../../src/health/ruleset-inspection.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gJAAgJ;AAChJ,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AACvC,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,IAAI,GAAG,MAAM,CAAC;AAEpB;;;;GAIG;AACH,SAAS,UAAU,CACjB,KAAmB,EACnB,OAAsC;IAEtC,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACxB,yFAAyF;IACzF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AA6BD;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,IAAuB,EACvB,GAAW,EACX,SAAiB,EACjB,MAAmB;IAEnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ;QACN,iGAAiG;QACjG,IAAI,EACJ,CAAC,GAAG,IAAI,CAAC,EACT;YACE,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,mBAAmB;YAC9B,MAAM;YACN,UAAU,EAAE,SAAS;YACrB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;SACzD,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,UAAU,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,SAAkB;IACxC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC;QACxC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC;QAClD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC;QAChD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAkB,KAAK,EACpD,KAAK,EACL,IAAI,EACJ,WAAW,EACX,SAAS,EACT,MAAM,EACN,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,KAAK,IAAI,IAAI,WAAW,CAAC,EACvD,WAAW,EACX,SAAS,EACT,MAAM,CACP,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;QACvB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,cAAc,CACnB,MAAM,UAAU,CACd,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,KAAK,IAAI,IAAI,aAAa,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EACrE,WAAW,EACX,SAAS,EACT,MAAM,CACP,CACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,OAAO,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACzC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CACpC,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,SAAS,aAAa,CACpB,MAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,QAAQ,GACZ,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC;QACjC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GACX,QAAQ,KAAK,IAAI;QACjB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,IAAI,GAAG,CACZ,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClD,CAAC,CAAC,EAAE,CACP,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,KAAc,EACd,YAAqB,EACrB,OAA4B;IAE5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC1B,IACE,IAAI,KAAK,IAAI;YACb,OAAO,IAAI,KAAK,QAAQ;YACxB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,wBAAwB,EACtD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC9C,OAAO,CACL,CAAC,YAAY,IAAI,WAAW,KAAK,sBAAsB,CAAC;gBACxD,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CACvD,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,OAAO;YACL;gBACE,GAAG,IAAI;gBACP,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,sBAAsB,EAAE,QAAQ,EAAE;aAChE;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,WAAmB,EACnB,KAA6B,EAC7B,MAAyC;IAEzC,MAAM,YAAY,GAChB,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QACvE,WAAW,CAAC;IACd,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,MAAM,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;gBACnE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,UAAU,GAAG;oBACjB,GAAG,SAAS;oBACZ,KAAK,EAAE,sBAAsB,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC;iBACtE,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpE,qGAAqG;oBACrG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,GAAG,CAAC,SAAS,CAAC;aACd,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;IACN,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAC5C,GAAG,KAAK,oBAAoB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YACtE,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CACzC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkC,EAClC,MAAgC;IAEhC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,QAAQ;SACrB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACxC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,gBAAgB,GAAG,SAAS,CAChC,qBAAqB,CAAC;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CACH,CAAC;QACF,MAAM,cAAc,GAAG,SAAS,CAC9B,qBAAqB,CAAC;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CACH,CAAC;QACF,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACxE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,MAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,KAAK,QAAQ;QACxB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;QACjB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,WAAmB,EACnB,KAA6B,EAC7B,MAAyC,EACzC,MAAqB,EACrB,SAAiB,EACjB,MAAmB;IAEnB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CACzB,iBAAiB,EACjB,MAAM,EACN,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,IAAI,EACX,WAAW,EACX,SAAS,EACT,MAAM,CACP,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CACzB,aAAa,EACb,IAAI,EACJ,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,UAAU,CAAC;QAC/C,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,UAAU,CAAC;KAChD,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,oBAAoB,CAClB,aAAa,EACb,MAAM,EACN,6DAA6D,CAC9D;QACH,CAAC,CAAC,oBAAoB,CAClB,aAAa,EACb,MAAM,EACN,WAAW,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAC3C,CAAC;AACR,CAAC;AACD,oHAAoH"}

package/dist/health/template-inspection.d.ts

@@ -0,0 +1,67 @@
+import { type ProjectType } from "../core/config.js";
+import { DEFAULT_PROJECT_LEARNINGS_FILE } from "../core/project-config.js";
+declare const MANAGED = "managed";
+declare const HOOKS = "hooks";
+declare const WORKFLOWS = "workflows";
+/** Template categories reported by separate deterministic findings. */
+export type ManagedTemplateCategory = typeof MANAGED | typeof HOOKS | typeof WORKFLOWS;
+/** Stale or unresolvable reusable-workflow inputs. */
+export interface WorkflowInputInspection {
+    readonly stale: readonly string[];
+    readonly unknown: readonly string[];
+}
+/** Safely-detected project shape reused by health probes. */
+export interface HealthProjectShape {
+    readonly types: readonly ProjectType[];
+    readonly packageJson: Readonly<Record<string, unknown>> | undefined;
+}
+/**
+ * Detect project types using only confined, bounded project reads.
+ * @param projectRoot - Canonical host project root
+ * @returns Safe project shape
+ */
+export declare function detectHealthProjectShape(projectRoot: string): Promise<HealthProjectShape>;
+/**
+ * Backward-compatible type-only detector surface.
+ * @param projectRoot
+ */
+export declare function detectHealthProjectTypes(projectRoot: string): Promise<readonly ProjectType[]>;
+/**
+ * Inspect one category using Lisa's shared ownership and pure comparators.
+ * @param lisaRoot - Lisa package root
+ * @param projectRoot - Canonical host root
+ * @param types - Canonically ordered types
+ * @param category - Health category
+ * @param config - Safe project config
+ * @returns Sorted project-relative drift paths
+ */
+export declare function inspectManagedTemplates(lisaRoot: string, projectRoot: string, types: readonly ProjectType[], category: ManagedTemplateCategory, config?: Readonly<Record<string, unknown>>): Promise<readonly string[]>;
+/**
+ * Require applicable create-only workflow presence while preserving bytes.
+ * @param lisaRoot - Lisa package root
+ * @param projectRoot - Canonical host root
+ * @param types - Canonically ordered types
+ * @param config - Safe project config
+ * @returns Missing workflow paths
+ */
+export declare function inspectCreateOnlyWorkflows(lisaRoot: string, projectRoot: string, types: readonly ProjectType[], config?: Readonly<Record<string, unknown>>): Promise<readonly string[]>;
+/**
+ * Inspect applicable create-only workflow caller inputs against shipped contracts.
+ * @param lisaRoot - Lisa package root
+ * @param projectRoot - Canonical host root
+ * @param types - Canonically ordered types
+ * @param config - Safe project config
+ * @returns Stale and unknown caller descriptions
+ */
+export declare function inspectWorkflowInputs(lisaRoot: string, projectRoot: string, types: readonly ProjectType[], config?: Readonly<Record<string, unknown>>): Promise<WorkflowInputInspection>;
+/**
+ * Inspect package.json through the exact pure package-lisa planner.
+ * @param lisaRoot - Lisa package root
+ * @param projectRoot - Canonical host root
+ * @param types - Safely detected project types
+ * @param packageJson - Safely captured package document
+ * @returns Whether package.json conforms
+ */
+export declare function packageJsonConforms(lisaRoot: string, projectRoot: string, types?: readonly ProjectType[], packageJson?: Readonly<Record<string, unknown>>): Promise<boolean>;
+export { DEFAULT_PROJECT_LEARNINGS_FILE };
+//# sourceMappingURL=template-inspection.d.ts.map

package/dist/health/template-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-inspection.d.ts","sourceRoot":"","sources":["../../src/health/template-inspection.ts"],"names":[],"mappings":"AAMA,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,8BAA8B,EAI/B,MAAM,2BAA2B,CAAC;AAyBnC,QAAA,MAAM,OAAO,YAAY,CAAC;AAC1B,QAAA,MAAM,KAAK,UAAU,CAAC;AACtB,QAAA,MAAM,SAAS,cAAc,CAAC;AAc9B,uEAAuE;AACvE,MAAM,MAAM,uBAAuB,GAC/B,OAAO,OAAO,GACd,OAAO,KAAK,GACZ,OAAO,SAAS,CAAC;AAiBrB,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACrE;AAiFD;;;;GAIG;AAEH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAuD7B;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAEjC;AA4RD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,QAAQ,EAAE,uBAAuB,EACjC,MAAM,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,GAC7C,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAyB5B;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,GAC7C,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAkB5B;AAED;;;;;;;GAOG;AAEH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,GAC7C,OAAO,CAAC,uBAAuB,CAAC,CAuDlC;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,EAC9B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC9C,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC"}