@codyswann/lisa 2.290.0 → 2.292.0

package/all/merge/.claude/settings.json

@@ -5,7 +5,7 @@
   },
   "enabledPlugins": {
     "lisa@lisa": true,
-    "safety-net@cc-marketplace": true,
+    "safety-net@cc-marketplace": false,
     "code-simplifier@claude-plugins-official": true,
     "code-review@claude-plugins-official": true,
     "coderabbit@claude-plugins-official": true,

package/cdk/merge/.claude/settings.json

@@ -5,7 +5,7 @@
   },
   "enabledPlugins": {
     "typescript-lsp@claude-plugins-official": true,
-    "safety-net@cc-marketplace": true,
+    "safety-net@cc-marketplace": false,
     "code-simplifier@claude-plugins-official": true,
     "code-review@claude-plugins-official": true,
     "coderabbit@claude-plugins-official": true,

package/dist/core/config-field-validation.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Validate an optional non-empty trimmed string field.
+ * @param value - Untrusted field value
+ * @param source - Config source shown in errors
+ * @param field - Dotted field name
+ * @returns Valid string or undefined
+ */
+export declare function optionalString(value: unknown, source: string, field: string): string | undefined;
+/**
+ * Validate a configurable destination as a safe, relative, non-traversing
+ * Markdown path. Shared by every path-typed config field; the `field` label is
+ * interpolated into each diagnostic so callers get a field-specific message.
+ * @param value - Raw configured path
+ * @param source - Config source for errors
+ * @param field - Config field name used in error messages
+ * @returns Validated project-relative path
+ */
+export declare function validateSafeRelativeMarkdownPath(value: unknown, source: string, field: string): string;
+//# sourceMappingURL=config-field-validation.d.ts.map

package/dist/core/config-field-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-field-validation.d.ts","sourceRoot":"","sources":["../../src/core/config-field-validation.ts"],"names":[],"mappings":"AAuBA;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,MAAM,GAAG,SAAS,CAapB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,MAAM,CA6BR"}

package/dist/core/config-field-validation.js

@@ -0,0 +1,69 @@
+/**
+ * Shared validation for `.lisa.config.json` field values.
+ *
+ * Extracted from `project-config.ts` so path-typed destinations
+ * (`projectRulesFile`, `learnings.file`, …) and string-typed section fields
+ * (`deployStatusSync.*`) funnel through the same hardened checks without
+ * growing the config module.
+ * @module core/config-field-validation
+ */
+import * as path from "node:path";
+/**
+ * Whether a path contains an ASCII control character.
+ * @param value - Configured path
+ * @returns True when any control character is present
+ */
+function containsControlCharacter(value) {
+    return Array.from(value).some(character => {
+        const code = character.charCodeAt(0);
+        return code <= 31 || code === 127;
+    });
+}
+/**
+ * Validate an optional non-empty trimmed string field.
+ * @param value - Untrusted field value
+ * @param source - Config source shown in errors
+ * @param field - Dotted field name
+ * @returns Valid string or undefined
+ */
+export function optionalString(value, source, field) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" ||
+        value.trim() !== value ||
+        value.length === 0 ||
+        containsControlCharacter(value)) {
+        throw new Error(`Invalid ${field} in ${source}: expected a non-empty string`);
+    }
+    return value;
+}
+/**
+ * Validate a configurable destination as a safe, relative, non-traversing
+ * Markdown path. Shared by every path-typed config field; the `field` label is
+ * interpolated into each diagnostic so callers get a field-specific message.
+ * @param value - Raw configured path
+ * @param source - Config source for errors
+ * @param field - Config field name used in error messages
+ * @returns Validated project-relative path
+ */
+export function validateSafeRelativeMarkdownPath(value, source, field) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.trim() !== value ||
+        value.includes("\\") ||
+        containsControlCharacter(value) ||
+        /^[a-z]:/iu.test(value) ||
+        path.posix.isAbsolute(value) ||
+        path.win32.isAbsolute(value)) {
+        throw new Error(`Invalid ${field} in ${source}: expected a safe relative POSIX path`);
+    }
+    const segments = value.split("/");
+    if (segments.some(segment => segment === "" || segment === "." || segment === "..")) {
+        throw new Error(`Invalid ${field} in ${source}: path traversal is not allowed`);
+    }
+    if (path.posix.extname(value).toLowerCase() !== ".md") {
+        throw new Error(`Invalid ${field} in ${source}: expected a Markdown file`);
+    }
+    return value;
+}
+//# sourceMappingURL=config-field-validation.js.map

package/dist/core/config-field-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-field-validation.js","sourceRoot":"","sources":["../../src/core/config-field-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QACxC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,MAAc,EACd,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;QACtB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,wBAAwB,CAAC,KAAK,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,OAAO,MAAM,+BAA+B,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAAc,EACd,MAAc,EACd,KAAa;IAEb,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;QACtB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,wBAAwB,CAAC,KAAK,CAAC;QAC/B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,OAAO,MAAM,uCAAuC,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IACE,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CACjE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,OAAO,MAAM,iCAAiC,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,MAAM,4BAA4B,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/deploy-status-sync.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Deploy-status-sync ladder resolution and config schema (DSS-1).
+ *
+ * Pure, fs-free helpers that turn a parsed `.lisa.config.json` value into the
+ * ordered environment ladder (env → deploy branch → tracker done status) the
+ * deploy-status-sync flows walk, plus the validator for the optional
+ * `deployStatusSync` section. The default done vocabularies live here — and
+ * are consumed by `src/sync/registry.ts` — so the ladder resolver and the
+ * sync registry share one source of truth without a runtime module cycle
+ * (registry → project-config → this module would cycle if this module
+ * imported the registry).
+ * @module core/deploy-status-sync
+ */
+import { type JsonValue } from "../sync/json-path.js";
+/** Tracker vendors whose done vocabulary can bind a deploy ladder. */
+export type Tracker = "jira" | "github" | "linear";
+/** One environment step of the deploy ladder. */
+export interface DeployLadderRung {
+    /** Environment name as configured (e.g. `dev`, `prod`) */
+    readonly env: string;
+    /** Git branch that deploys to this environment */
+    readonly branch: string;
+    /** Tracker status/label a work item earns when deployed here */
+    readonly doneStatus: string;
+}
+/** The resolved promotion ladder, ordered lowest environment first. */
+export interface DeployLadder {
+    /** Ordered rungs (lowest environment first) */
+    readonly rungs: readonly DeployLadderRung[];
+    /** True when the ladder collapsed to a single terminal rung */
+    readonly terminalOnly: boolean;
+}
+/** Optional machine-written `deployStatusSync` section of the config. */
+export interface DeployStatusSyncConfig {
+    /** Provisioning tier chosen at setup time */
+    readonly tier?: string;
+    /** Provisioned tracker artifact ids, keyed by artifact name */
+    readonly provisioned?: Readonly<Record<string, string>>;
+    /** How Linear deploy statuses are represented */
+    readonly linearBinding?: "labels" | "states";
+    /** ISO-8601 UTC timestamp of the last successful verification */
+    readonly verifiedAt?: string;
+}
+/**
+ * Default env-keyed done labels for label-driven trackers (GitHub, Linear).
+ * Mirrored into the sync registry's `github.labels` / `linear.labels`
+ * defaults — keep value-identical with what `lisa sync` populates.
+ */
+export declare const ENV_DONE_LABEL_DEFAULTS: {
+    readonly dev: "status:on-dev";
+    readonly staging: "status:on-stg";
+    readonly production: "status:done";
+};
+/**
+ * Default env-keyed done statuses for JIRA workflows. Mirrored into the sync
+ * registry's `jira.workflow` default — keep value-identical with what
+ * `lisa sync` populates.
+ */
+export declare const JIRA_DONE_STATUS_DEFAULTS: {
+    readonly dev: "On Dev";
+    readonly staging: "On Stg";
+    readonly production: "Done";
+};
+/**
+ * Resolve the deploy promotion ladder for a tracker from parsed config.
+ *
+ * The env universe is the keys of `deploy.branches`, joined with the
+ * tracker's done vocabulary (configured entries win over the default
+ * tables). `prod` ↔ `production` alias as one env iff exactly one spelling
+ * appears across the configured surfaces (branches, done map, order); the
+ * rung reports the configured spelling. Absent or empty `deploy` yields an
+ * empty ladder, never an error.
+ * @param config - Parsed `.lisa.config.json` value
+ * @param tracker - Tracker whose done vocabulary binds the ladder
+ * @param source - Config source shown in errors
+ * @returns The ordered ladder with its terminal-only collapse flag
+ */
+export declare function resolveDeployLadder(config: JsonValue, tracker: Tracker, source: string): DeployLadder;
+/**
+ * Validate the optional `deployStatusSync` config section. Unknown fields
+ * inside the section are ignored in the typed view; the raw JSON round-trip
+ * preserves them.
+ * @param value - Untrusted section value
+ * @param source - Config source shown in errors
+ * @returns Typed section, or undefined when absent
+ */
+export declare function validateDeployStatusSyncConfig(value: unknown, source: string): DeployStatusSyncConfig | undefined;
+//# sourceMappingURL=deploy-status-sync.d.ts.map

package/dist/core/deploy-status-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-sync.d.ts","sourceRoot":"","sources":["../../src/core/deploy-status-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAG9B,sEAAsE;AACtE,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEnD,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC5C,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,iDAAiD;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7C,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;CAI1B,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,yBAAyB;;;;CAI5B,CAAC;AA8MX;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GACb,YAAY,CAkCd;AA2ED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,GACb,sBAAsB,GAAG,SAAS,CAiBpC"}

package/dist/core/deploy-status-sync.js

@@ -0,0 +1,301 @@
+/**
+ * Deploy-status-sync ladder resolution and config schema (DSS-1).
+ *
+ * Pure, fs-free helpers that turn a parsed `.lisa.config.json` value into the
+ * ordered environment ladder (env → deploy branch → tracker done status) the
+ * deploy-status-sync flows walk, plus the validator for the optional
+ * `deployStatusSync` section. The default done vocabularies live here — and
+ * are consumed by `src/sync/registry.ts` — so the ladder resolver and the
+ * sync registry share one source of truth without a runtime module cycle
+ * (registry → project-config → this module would cycle if this module
+ * imported the registry).
+ * @module core/deploy-status-sync
+ */
+import { getAtPath, isJsonObject, } from "../sync/json-path.js";
+import { optionalString } from "./config-field-validation.js";
+/**
+ * Default env-keyed done labels for label-driven trackers (GitHub, Linear).
+ * Mirrored into the sync registry's `github.labels` / `linear.labels`
+ * defaults — keep value-identical with what `lisa sync` populates.
+ */
+export const ENV_DONE_LABEL_DEFAULTS = {
+    dev: "status:on-dev",
+    staging: "status:on-stg",
+    production: "status:done",
+};
+/**
+ * Default env-keyed done statuses for JIRA workflows. Mirrored into the sync
+ * registry's `jira.workflow` default — keep value-identical with what
+ * `lisa sync` populates.
+ */
+export const JIRA_DONE_STATUS_DEFAULTS = {
+    dev: "On Dev",
+    staging: "On Stg",
+    production: "Done",
+};
+/** Config dot-path of each tracker's env-keyed done vocabulary. */
+const DONE_MAP_PATHS = {
+    github: "github.labels.build.done",
+    linear: "linear.labels.build.done",
+    jira: "jira.workflow.done",
+};
+/** Default done vocabulary per tracker, used when config has no entry. */
+const DONE_DEFAULTS = {
+    github: ENV_DONE_LABEL_DEFAULTS,
+    linear: ENV_DONE_LABEL_DEFAULTS,
+    jira: JIRA_DONE_STATUS_DEFAULTS,
+};
+/** Canonical promotion rank when `deploy.order` is absent (lowest first). */
+const CANONICAL_ENV_RANKS = {
+    dev: 0,
+    staging: 1,
+    production: 2,
+};
+/**
+ * Keep only the string-valued entries of a JSON object record.
+ * @param value - JSON object record
+ * @returns Record of the string-valued entries
+ */
+function stringRecord(value) {
+    return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+/**
+ * Read `deploy.branches` as an env → branch map, ignoring non-string values.
+ * @param config - Parsed config value
+ * @returns Env-to-branch record (empty when the section is absent)
+ */
+function readBranches(config) {
+    const branches = getAtPath(config, "deploy.branches");
+    return isJsonObject(branches) ? stringRecord(branches) : {};
+}
+/**
+ * Read the tracker's configured done vocabulary from config, if any.
+ * @param config - Parsed config value
+ * @param tracker - Tracker whose vocabulary path applies
+ * @returns Configured env-keyed map, terminal string, or neither
+ */
+function readConfiguredDone(config, tracker) {
+    const done = getAtPath(config, DONE_MAP_PATHS[tracker]);
+    if (typeof done === "string")
+        return { terminal: done };
+    if (!isJsonObject(done))
+        return {};
+    return { map: stringRecord(done) };
+}
+/**
+ * Reject a configured done entry whose environment has no deploy branch.
+ * Only explicitly-configured entries can trigger this — default-table
+ * entries are fallbacks and never error.
+ * @param doneMap - Configured env-keyed done map
+ * @param branchEnvs - Environments present in `deploy.branches`
+ * @param source - Config source shown in errors
+ */
+function assertDoneEnvsHaveBranches(doneMap, branchEnvs, source) {
+    for (const [env, status] of Object.entries(doneMap)) {
+        if (!branchEnvs.includes(env)) {
+            throw new Error(`Invalid deploy configuration in ${source}: a done status ("${status}") is configured for environment "${env}", but deploy.branches has no "${env}" entry. Add deploy.branches.${env} (the git branch that deploys to ${env}) or remove "${env}" from the done map.`);
+        }
+    }
+}
+/**
+ * Read `deploy.order` as a string array, if present. A non-string entry is a
+ * decision-ready error, never silently dropped — dropping one would silently
+ * change the promotion order.
+ * @param config - Parsed config value
+ * @param source - Config source shown in errors
+ * @returns Ordered env names (lowest first), or undefined when absent
+ */
+function readOrder(config, source) {
+    const order = getAtPath(config, "deploy.order");
+    if (!Array.isArray(order))
+        return undefined;
+    return order.map(entry => {
+        if (typeof entry !== "string") {
+            throw new Error(`Invalid deploy.order in ${source}: every entry must be an environment name string; found ${JSON.stringify(entry)}.`);
+        }
+        return entry;
+    });
+}
+/**
+ * Require `deploy.order` to name exactly the `deploy.branches` env set, with
+ * no duplicate entries — a duplicate would otherwise survive set comparison
+ * and produce duplicate rungs.
+ * @param order - Configured order
+ * @param branchEnvs - Environments present in `deploy.branches` (dupe-free)
+ * @param source - Config source shown in errors
+ */
+function assertOrderMatchesBranches(order, branchEnvs, source) {
+    const orderSet = new Set(order);
+    const matches = orderSet.size === order.length &&
+        orderSet.size === branchEnvs.length &&
+        branchEnvs.every(env => orderSet.has(env));
+    if (!matches) {
+        throw new Error(`Invalid deploy.order in ${source}: its environment names must exactly match the keys of deploy.branches. deploy.order has [${order.join(", ")}]; deploy.branches has [${branchEnvs.join(", ")}].`);
+    }
+}
+/**
+ * Order the configured environments lowest-first. `deploy.order` wins when
+ * present; otherwise the canonical `dev < staging < production` rank applies
+ * and any unrankable custom name (with more than one env) is a
+ * decision-ready error rather than a guess.
+ * @param branchEnvs - Environments present in `deploy.branches`
+ * @param order - Configured `deploy.order`, if any
+ * @param canonical - Alias-aware canonical name resolver
+ * @param source - Config source shown in errors
+ * @returns Environments ordered lowest first
+ */
+function orderEnvironments(branchEnvs, order, canonical, source) {
+    if (order !== undefined) {
+        assertOrderMatchesBranches(order, branchEnvs, source);
+        return order;
+    }
+    if (branchEnvs.length <= 1)
+        return branchEnvs;
+    const ranked = branchEnvs.map(env => {
+        const rank = CANONICAL_ENV_RANKS[canonical(env)];
+        if (rank === undefined) {
+            throw new Error(`Invalid deploy configuration in ${source}: cannot order environment "${env}". Set deploy.order (environments listed lowest first, e.g. ["dev","staging","production"]) so Lisa knows the promotion order.`);
+        }
+        return { env, rank };
+    });
+    return [...ranked].sort((a, b) => a.rank - b.rank).map(entry => entry.env);
+}
+/**
+ * Join ordered environments with their branch and done status. An env whose
+ * done status resolves nowhere (possible only for custom names outside the
+ * default tables) is skipped — a branch-only env is a deploy target without
+ * tracker vocabulary, not an error.
+ * @param orderedEnvs - Environments ordered lowest first
+ * @param branches - Env-to-branch record
+ * @param done - Configured done vocabulary
+ * @param defaults - Tracker default done vocabulary
+ * @param canonical - Alias-aware canonical name resolver
+ * @param terminalEnv - Highest-ranked env of the configured universe
+ * @returns The joined rungs, lowest environment first
+ */
+function buildRungs(orderedEnvs, branches, done, defaults, canonical, terminalEnv) {
+    return orderedEnvs.flatMap(env => {
+        const branch = branches[env];
+        const terminal = env === terminalEnv ? done.terminal : undefined;
+        const doneStatus = done.map?.[env] ?? terminal ?? defaults[canonical(env)];
+        return doneStatus === undefined || branch === undefined
+            ? []
+            : [{ env, branch, doneStatus }];
+    });
+}
+/**
+ * Resolve the deploy promotion ladder for a tracker from parsed config.
+ *
+ * The env universe is the keys of `deploy.branches`, joined with the
+ * tracker's done vocabulary (configured entries win over the default
+ * tables). `prod` ↔ `production` alias as one env iff exactly one spelling
+ * appears across the configured surfaces (branches, done map, order); the
+ * rung reports the configured spelling. Absent or empty `deploy` yields an
+ * empty ladder, never an error.
+ * @param config - Parsed `.lisa.config.json` value
+ * @param tracker - Tracker whose done vocabulary binds the ladder
+ * @param source - Config source shown in errors
+ * @returns The ordered ladder with its terminal-only collapse flag
+ */
+export function resolveDeployLadder(config, tracker, source) {
+    const branches = readBranches(config);
+    const branchEnvs = Object.keys(branches);
+    if (branchEnvs.length === 0)
+        return { rungs: [], terminalOnly: false };
+    const done = readConfiguredDone(config, tracker);
+    const order = readOrder(config, source);
+    const union = new Set([
+        ...branchEnvs,
+        ...Object.keys(done.map ?? {}),
+        ...(order ?? []),
+    ]);
+    const soleProdAlias = union.has("prod") && !union.has("production");
+    const canonical = (env) => soleProdAlias && env === "prod" ? "production" : env;
+    if (done.map !== undefined) {
+        assertDoneEnvsHaveBranches(done.map, branchEnvs, source);
+    }
+    const ordered = orderEnvironments(branchEnvs, order, canonical, source);
+    const terminalEnv = ordered.at(-1);
+    const rungs = buildRungs(ordered, branches, done, DONE_DEFAULTS[tracker], canonical, terminalEnv);
+    // terminalOnly guards DSS-2's native closure: a sole surviving LOWER rung
+    // (skip-collapsed ladder) must never be treated as the terminal env.
+    const terminalOnly = rungs.length === 1 &&
+        rungs[0] !== undefined &&
+        rungs[0].env === terminalEnv;
+    return { rungs, terminalOnly };
+}
+/** Strict ISO-8601 UTC timestamp (`Z` suffix, optional milliseconds). */
+const ISO_UTC_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/u;
+/**
+ * Validate the optional provisioned-artifact id map.
+ * @param value - Untrusted field value
+ * @param source - Config source shown in errors
+ * @returns Valid id record or undefined
+ */
+function validateProvisioned(value, source) {
+    if (value === undefined)
+        return undefined;
+    if (!isJsonObject(value)) {
+        throw new Error(`Invalid deployStatusSync.provisioned in ${source}: expected an object`);
+    }
+    return Object.fromEntries(Object.entries(value).flatMap(([key, id]) => {
+        const valid = optionalString(id, source, `deployStatusSync.provisioned.${key}`);
+        return valid === undefined ? [] : [[key, valid]];
+    }));
+}
+/**
+ * Validate the optional Linear binding mode.
+ * @param value - Untrusted field value
+ * @param source - Config source shown in errors
+ * @returns Valid binding or undefined
+ */
+function validateLinearBinding(value, source) {
+    if (value === undefined)
+        return undefined;
+    if (value !== "labels" && value !== "states") {
+        throw new Error(`Invalid deployStatusSync.linearBinding in ${source}: expected "labels" or "states"`);
+    }
+    return value;
+}
+/**
+ * Validate the optional verification timestamp as strict ISO-8601 UTC.
+ * @param value - Untrusted field value
+ * @param source - Config source shown in errors
+ * @returns Valid timestamp or undefined
+ */
+function validateVerifiedAt(value, source) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" ||
+        !ISO_UTC_PATTERN.test(value) ||
+        Number.isNaN(Date.parse(value))) {
+        throw new Error(`Invalid deployStatusSync.verifiedAt in ${source}: expected an ISO-8601 UTC timestamp (e.g. 2026-01-01T00:00:00Z)`);
+    }
+    return value;
+}
+/**
+ * Validate the optional `deployStatusSync` config section. Unknown fields
+ * inside the section are ignored in the typed view; the raw JSON round-trip
+ * preserves them.
+ * @param value - Untrusted section value
+ * @param source - Config source shown in errors
+ * @returns Typed section, or undefined when absent
+ */
+export function validateDeployStatusSyncConfig(value, source) {
+    if (value === undefined)
+        return undefined;
+    if (!isJsonObject(value)) {
+        throw new Error(`Invalid deployStatusSync in ${source}: expected an object`);
+    }
+    const tier = optionalString(value.tier, source, "deployStatusSync.tier");
+    const provisioned = validateProvisioned(value.provisioned, source);
+    const linearBinding = validateLinearBinding(value.linearBinding, source);
+    const verifiedAt = validateVerifiedAt(value.verifiedAt, source);
+    return {
+        ...(tier === undefined ? {} : { tier }),
+        ...(provisioned === undefined ? {} : { provisioned }),
+        ...(linearBinding === undefined ? {} : { linearBinding }),
+        ...(verifiedAt === undefined ? {} : { verifiedAt }),
+    };
+}
+//# sourceMappingURL=deploy-status-sync.js.map

package/dist/core/deploy-status-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-status-sync.js","sourceRoot":"","sources":["../../src/core/deploy-status-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,SAAS,EACT,YAAY,GAGb,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAmC9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,GAAG,EAAE,eAAe;IACpB,OAAO,EAAE,eAAe;IACxB,UAAU,EAAE,aAAa;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,GAAG,EAAE,QAAQ;IACb,OAAO,EAAE,QAAQ;IACjB,UAAU,EAAE,MAAM;CACV,CAAC;AAEX,mEAAmE;AACnE,MAAM,cAAc,GAAsC;IACxD,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,0BAA0B;IAClC,IAAI,EAAE,oBAAoB;CAC3B,CAAC;AAEF,0EAA0E;AAC1E,MAAM,aAAa,GAEf;IACF,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,uBAAuB;IAC/B,IAAI,EAAE,yBAAyB;CAChC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,mBAAmB,GAAqC;IAC5D,GAAG,EAAE,CAAC;IACN,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,CAAC;CACd,CAAC;AAEF;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1B,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CACnE,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAiB;IACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACtD,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAQD;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,MAAiB,EACjB,OAAgB;IAEhB,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,0BAA0B,CACjC,OAAyC,EACzC,UAA6B,EAC7B,MAAc;IAEd,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,qBAAqB,MAAM,qCAAqC,GAAG,kCAAkC,GAAG,gCAAgC,GAAG,oCAAoC,GAAG,gBAAgB,GAAG,sBAAsB,CACrQ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAChB,MAAiB,EACjB,MAAc;IAEd,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,2DAA2D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CACrH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,0BAA0B,CACjC,KAAwB,EACxB,UAA6B,EAC7B,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAC9B,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM;QACnC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,6FAA6F,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACnM,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CACxB,UAA6B,EAC7B,KAAoC,EACpC,SAAkC,EAClC,MAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,0BAA0B,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,+BAA+B,GAAG,gIAAgI,CAC5M,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,UAAU,CACjB,WAA8B,EAC9B,QAA0C,EAC1C,IAAoB,EACpB,QAA0C,EAC1C,SAAkC,EAClC,WAA+B;IAE/B,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,OAAO,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YACrD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,OAAgB,EAChB,MAAc;IAEd,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;QACpB,GAAG,UAAU;QACb,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE,CACxC,aAAa,IAAI,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;IACvD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,0BAA0B,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CACtB,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,aAAa,CAAC,OAAO,CAAC,EACtB,SAAS,EACT,WAAW,CACZ,CAAC;IACF,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,YAAY,GAChB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACtB,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC;IAC/B,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjC,CAAC;AAED,yEAAyE;AACzE,MAAM,eAAe,GAAG,uDAAuD,CAAC;AAEhF;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,KAAc,EACd,MAAc;IAEd,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,sBAAsB,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,cAAc,CAC1B,EAAE,EACF,MAAM,EACN,gCAAgC,GAAG,EAAE,CACtC,CAAC;QACF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAU,CAAC,CAAC;IAC5D,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,KAAc,EACd,MAAc;IAEd,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,6CAA6C,MAAM,iCAAiC,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,KAAc,EACd,MAAc;IAEd,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,kEAAkE,CACnH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAc,EACd,MAAc;IAEd,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,sBAAsB,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChE,OAAO;QACL,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;QACzD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/dist/core/project-config.d.ts

@@ -1,4 +1,5 @@
 import { type Harness } from "./config.js";
+import { type DeployStatusSyncConfig } from "./deploy-status-sync.js";
 import { type VerificationConfig } from "./project-config-kane.js";
 export type { BrowserVerificationConfig, KaneBrowserConfig, VerificationConfig, } from "./project-config-kane.js";
 /** Filename of the per-project config, relative to the destination root */
@@ -40,6 +41,8 @@ export interface ProjectConfig {
     readonly learnings?: LearningsConfig;
     /** Optional empirical verification provider configuration. */
     readonly verification?: VerificationConfig;
+    /** Optional machine-written deploy-status-sync provisioning record. */
+    readonly deployStatusSync?: DeployStatusSyncConfig;
 }
 /**
  * Resolve the validated project-rules path from config or its default.

package/dist/core/project-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-config.d.ts","sourceRoot":"","sources":["../../src/core/project-config.ts"],"names":[],"mappings":"AAYA,OAAO,EAML,KAAK,OAAO,EACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,2EAA2E;AAC3E,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAE3D,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,mCAAmC,CAAC;AAE3E,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,QAG1C,CAAC;AAgCF,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAKrE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAQzE;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,aAAa,GACpB,MAAM,CAKR;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC,CAQxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC,GAAG,OAAO,CAQV;AA6BD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,aAAa,EAAE,aAAa,GAC3B,OAAO,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,MAAM,GACjB,aAAa,CAoBf;AA+KD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAK1D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAGnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAAC,CAWtE"}
+{"version":3,"file":"project-config.d.ts","sourceRoot":"","sources":["../../src/core/project-config.ts"],"names":[],"mappings":"AAYA,OAAO,EAML,KAAK,OAAO,EACb,MAAM,aAAa,CAAC;AAErB,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,2EAA2E;AAC3E,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAE3D,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,mCAAmC,CAAC;AAE3E,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,QAG1C,CAAC;AAgCF,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAKrE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAQzE;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,aAAa,GACpB,MAAM,CAKR;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC,CAQxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC,GAAG,OAAO,CAQV;AA6BD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,aAAa,EAAE,aAAa,GAC3B,OAAO,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,MAAM,GACjB,aAAa,CAyBf;AAuHD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAK1D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAGnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAAC,CAWtE"}

package/dist/core/project-config.js

@@ -11,6 +11,8 @@ import * as fse from "fs-extra";
 import { readFile, writeFile } from "node:fs/promises";
 import * as path from "node:path";
 import { ACCEPTED_HARNESS_INPUTS, DEFAULT_HARNESS, HARNESS_ALIASES, HARNESS_VALUES, LEGACY_HARNESS_ALIASES, } from "./config.js";
+import { validateSafeRelativeMarkdownPath } from "./config-field-validation.js";
+import { validateDeployStatusSyncConfig, } from "./deploy-status-sync.js";
 import { validateVerificationConfig, } from "./project-config-kane.js";
 /** Filename of the per-project config, relative to the destination root */
 export const PROJECT_CONFIG_FILENAME = ".lisa.config.json";
@@ -215,11 +217,13 @@ export function validateProjectConfig(parsed, configPath) {
         : validateProjectRulesFile(obj.projectRulesFile, configPath);
     const learnings = validateLearningsConfig(obj.learnings, configPath);
     const verification = validateVerificationConfig(obj.verification, configPath);
+    const deployStatusSync = validateDeployStatusSyncConfig(obj.deployStatusSync, configPath);
     return {
         ...(harness === undefined ? {} : { harness }),
         ...(projectRulesFile === undefined ? {} : { projectRulesFile }),
         ...(learnings === undefined ? {} : { learnings }),
         ...(verification === undefined ? {} : { verification }),
+        ...(deployStatusSync === undefined ? {} : { deployStatusSync }),
     };
 }
 /**
@@ -244,35 +248,6 @@ function validateOptionalHarness(value, configPath) {
     const allowed = ACCEPTED_HARNESS_INPUTS.join(" | ");
     throw new Error(`Invalid harness in ${configPath}: expected ${allowed}, got ${JSON.stringify(value)}`);
 }
-/**
- * Validate a configurable destination as a safe, relative, non-traversing
- * Markdown path. Shared by every path-typed config field; the `field` label is
- * interpolated into each diagnostic so callers get a field-specific message.
- * @param value - Raw configured path
- * @param source - Config source for errors
- * @param field - Config field name used in error messages
- * @returns Validated project-relative path
- */
-function validateSafeRelativeMarkdownPath(value, source, field) {
-    if (typeof value !== "string" ||
-        value.length === 0 ||
-        value.trim() !== value ||
-        value.includes("\\") ||
-        containsControlCharacter(value) ||
-        /^[a-z]:/iu.test(value) ||
-        path.posix.isAbsolute(value) ||
-        path.win32.isAbsolute(value)) {
-        throw new Error(`Invalid ${field} in ${source}: expected a safe relative POSIX path`);
-    }
-    const segments = value.split("/");
-    if (segments.some(segment => segment === "" || segment === "." || segment === "..")) {
-        throw new Error(`Invalid ${field} in ${source}: path traversal is not allowed`);
-    }
-    if (path.posix.extname(value).toLowerCase() !== ".md") {
-        throw new Error(`Invalid ${field} in ${source}: expected a Markdown file`);
-    }
-    return value;
-}
 /**
  * Validate the configurable rules destination as a safe Markdown path, and
  * reject the reserved learnings filename so a rules file can never collide with
@@ -335,17 +310,6 @@ function validateLearningsConfig(value, source) {
     }
     return { file: validateLearningsFile(file, source) };
 }
-/**
- * Whether a path contains an ASCII control character.
- * @param value - Configured path
- * @returns True when any control character is present
- */
-function containsControlCharacter(value) {
-    return Array.from(value).some(character => {
-        const code = character.charCodeAt(0);
-        return code <= 31 || code === 127;
-    });
-}
 /**
  * Narrow an unknown value to the Harness type
  * @param value - Untrusted value to test