@codyswann/lisa 3.11.9 → 3.13.0

package/all/copy-overwrite/scripts/lisa-command-envelope.mjs

@@ -25,6 +25,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { destructiveDenial } from "./lisa-destructive-guard.mjs";
 import { validateAgainstSchema } from "./lisa-schema-validate.mjs";
 
 /** Pinned envelope schema version. */
@@ -126,6 +127,15 @@ export function validateEnvelope(envelope) {
   if (envelope.mode === "declared-noop" && envelope.status !== "no-op") {
     errors.push('mode "declared-noop" requires status "no-op"');
   }
+  // The production boundary lives here, at the one interface every reset, seed,
+  // and verify adapter must pass through, rather than in each adapter. A
+  // destructive run against a production-resolved (or unresolvable) environment
+  // has no representable success envelope, so it can never exit 0 — reporting
+  // the refusal stays available, which is the only outcome that should be.
+  const denial = destructiveDenial(envelope);
+  if (denial && SUCCESS_STATUSES.includes(envelope.status)) {
+    errors.push(`${denial.code}: ${denial.message}`);
+  }
   return { valid: errors.length === 0, errors };
 }
 

package/all/copy-overwrite/scripts/lisa-destructive-guard.mjs

@@ -0,0 +1,267 @@
+#!/usr/bin/env node
+/**
+ * lisa-destructive-guard — the executable arm of `production-fails-closed`.
+ *
+ * The `reset-seed-coverage` contract already says the right thing: production
+ * is refused "with no override, escape hatch, or environment variable that
+ * changes the answer", `--dry-run` is mandatory before anything destructive,
+ * and a caller-supplied `--stage` is a *request* to be checked against
+ * server-resolved identity rather than the source of truth. Until this module
+ * existed, all three were prose — an agent reading a rule and choosing to stop.
+ * Measured conformance for that rung in this codebase was approximately zero,
+ * including by the agent that authored the rule. For a destructive,
+ * irreversible operation that is the wrong rung, so the decision moves here.
+ *
+ * Three properties make this a control rather than a suggestion:
+ *
+ * 1. **No override exists to be found.** There is no `force` parameter, no
+ *    `allowProduction` field, and no environment-variable read anywhere in this
+ *    file — a test greps the shipped source for the latter, so the claim cannot
+ *    rot. A caller cannot pass the wrong thing because there is no right thing
+ *    to pass. The tests assert the absence structurally, not behaviourally.
+ * 2. **Ambiguity resolves to refusal.** An environment identity that cannot be
+ *    read is treated exactly like production. "I could not tell" must never be
+ *    the cheaper answer than "it is production".
+ * 3. **A dry run is not a pass.** `dryRun: true` does not soften a production
+ *    denial. Enumerating production state is still reaching into production,
+ *    and allowing it would hand every caller a one-flag override.
+ *
+ * What this module deliberately does NOT claim: it cannot verify that the
+ * `environment` an adapter reports is the environment it actually connected to.
+ * An adapter that resolves its stage from a caller-supplied string and reports
+ * `"dev"` while pointed at production defeats every in-process check by
+ * construction. That hole is why the contract says platform enforcement beats
+ * process enforcement, and why the durable answer is a capability that is not
+ * deployed to production at all — see `docs/decisions/`. This module closes the
+ * narrower hole Lisa can close: an honest adapter can no longer report a
+ * successful destructive production run, in any repo, by any path.
+ * @module scripts/lisa-destructive-guard
+ */
+
+/**
+ * Capabilities that mutate persistent state by definition.
+ *
+ * Membership is by capability name because a destructive adapter that fails
+ * before it deletes anything still reports zeroes, and a guard that keyed only
+ * on the counts would wave it through on the attempt that mattered.
+ */
+export const DESTRUCTIVE_CAPABILITIES = Object.freeze([
+  "reset",
+  "reseed",
+  "reset-seed",
+  "seed",
+  "teardown",
+  "truncate",
+  "purge",
+  "drop",
+  "restore",
+  "migrate-down",
+]);
+
+/**
+ * Substring marking an environment segment as production.
+ *
+ * Deliberately a substring rather than an exact match, so `preprod`,
+ * `prod-blue`, and `acme-prod-1` all classify as production. That
+ * over-includes: a genuine pre-production environment is refused too. For a
+ * control over irreversible operations, over-refusal is the correct direction
+ * to be wrong in, and a project that needs the distinction names its
+ * environments so the word does not appear.
+ */
+const PRODUCTION_SUBSTRING = "prod";
+
+/** Whole segments that mark production without containing the substring. */
+const PRODUCTION_SEGMENTS = Object.freeze(["prd", "live"]);
+
+/**
+ * Values that carry no environment identity.
+ *
+ * Each of these is something a resolver returns when it failed, and every one
+ * of them classifies as `unresolved`, which the guard then treats exactly as it
+ * treats production.
+ */
+const UNRESOLVED_SENTINELS = new Set([
+  "",
+  "unknown",
+  "unresolved",
+  "undefined",
+  "null",
+  "n/a",
+  "na",
+  "none",
+  "-",
+]);
+
+/** Flags that explicitly opt out of the mandatory dry run. */
+const EXECUTE_FLAGS = Object.freeze(["--no-dry-run", "--execute"]);
+
+/**
+ * Normalize an environment identity for comparison.
+ * @param {unknown} value - Candidate environment identity
+ * @returns {string} Lowercased, trimmed text, or "" when there is no text
+ */
+function normalize(value) {
+  return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+
+/**
+ * Classify a server-resolved environment identity.
+ *
+ * Returns `unresolved` rather than guessing whenever the value is not text, is
+ * blank, or is one of the sentinels a failed resolver produces. Callers must
+ * treat `unresolved` as production; this function does not make that decision
+ * for them so that the two cases stay separately reportable.
+ * @param {unknown} value - The environment identity to classify
+ * @returns {"production"|"non-production"|"unresolved"} The classification
+ */
+export function classifyEnvironment(value) {
+  const text = normalize(value);
+  if (typeof value !== "string" || UNRESOLVED_SENTINELS.has(text)) {
+    return "unresolved";
+  }
+  const segments = text.split(/[^a-z0-9]+/u).filter(Boolean);
+  if (segments.length === 0) {
+    return "unresolved";
+  }
+  const production = segments.some(
+    segment =>
+      segment.includes(PRODUCTION_SUBSTRING) ||
+      PRODUCTION_SEGMENTS.includes(segment)
+  );
+  return production ? "production" : "non-production";
+}
+
+/**
+ * Whether a run mutates persistent state.
+ *
+ * True when the capability is destructive by name, and also when a run of any
+ * capability reports rows deleted or created — a read-only adapter that mutated
+ * is still a mutation, and the guard should not depend on it being named
+ * honestly.
+ * @param {object} fields - An envelope or envelope-shaped object
+ * @returns {boolean} True when the run is destructive
+ */
+export function isDestructive(fields) {
+  const capability = normalize(fields?.capability);
+  if (DESTRUCTIVE_CAPABILITIES.includes(capability)) {
+    return true;
+  }
+  const summary = fields?.summary ?? {};
+  return Number(summary.deleted) > 0 || Number(summary.created) > 0;
+}
+
+/**
+ * Build the denial for a resolved environment, or null when it is permitted.
+ * @param {unknown} environment - Server-resolved environment identity
+ * @returns {{code: string, message: string}|null} The denial, if any
+ */
+function denyByEnvironment(environment) {
+  const classification = classifyEnvironment(environment);
+  if (classification === "unresolved") {
+    return {
+      code: "unresolved-environment",
+      message:
+        "the server-resolved environment could not be read, which fails closed exactly as production does — resolve the environment from deployment identity before any destructive operation",
+    };
+  }
+  if (classification === "production") {
+    return {
+      code: "production-forbidden",
+      message: `production is refused by the reset-seed contract with no override, and "${normalize(environment)}" classifies as production — a dry run is not an exemption`,
+    };
+  }
+  return null;
+}
+
+/**
+ * The denial implied by an envelope, or null when the envelope is permitted.
+ *
+ * This is the check the command envelope itself applies, so a destructive
+ * production run cannot be *reported* as a success by any adapter in any repo.
+ * @param {object} fields - An envelope or envelope-shaped object
+ * @returns {{code: string, message: string}|null} The denial, if any
+ */
+export function destructiveDenial(fields) {
+  return isDestructive(fields) ? denyByEnvironment(fields?.environment) : null;
+}
+
+/**
+ * Decide whether a destructive invocation may proceed.
+ *
+ * Adapter-time counterpart of {@link destructiveDenial}, adding the two checks
+ * that need the caller's request alongside the resolved identity. The requested
+ * stage is never trusted: it is compared against server-resolved identity, and
+ * a production request is refused even when the resolver disagrees, because the
+ * disagreement itself means one of the two is wrong.
+ * @param {object} request - capability, summary, resolvedEnvironment, requestedStage, dryRun
+ * @returns {{allowed: boolean, denial: ({code: string, message: string}|null)}} The decision
+ */
+export function assertDestructiveAllowed(request) {
+  if (!isDestructive(request)) {
+    return { allowed: true, denial: null };
+  }
+  const resolved = request?.resolvedEnvironment;
+  const environmentDenial = denyByEnvironment(resolved);
+  if (environmentDenial) {
+    return { allowed: false, denial: environmentDenial };
+  }
+  const requested = request?.requestedStage;
+  if (requested === undefined || requested === null) {
+    return { allowed: true, denial: null };
+  }
+  if (classifyEnvironment(requested) === "production") {
+    return {
+      allowed: false,
+      denial: {
+        code: "production-requested",
+        message: `the caller requested "${normalize(requested)}", which classifies as production; a requested stage never authorizes a destructive operation`,
+      },
+    };
+  }
+  if (normalize(requested) !== normalize(resolved)) {
+    return {
+      allowed: false,
+      denial: {
+        code: "stage-mismatch",
+        message: `the caller requested "${normalize(requested)}" but deployment identity resolved to "${normalize(resolved)}"; a stage is a request to be checked, never the source of truth`,
+      },
+    };
+  }
+  return { allowed: true, denial: null };
+}
+
+/**
+ * Read one `--flag value` / `--flag=value` option out of argv.
+ * @param {readonly string[]} argv - Arguments after the script name
+ * @param {string} flag - The long flag to read, including leading dashes
+ * @returns {string|null} The value, or null when the flag is absent or empty
+ */
+function readOption(argv, flag) {
+  const inline = argv.find(entry => entry.startsWith(`${flag}=`));
+  if (inline) {
+    return inline.slice(flag.length + 1) || null;
+  }
+  const index = argv.indexOf(flag);
+  return index === -1 ? null : (argv[index + 1] ?? null);
+}
+
+/**
+ * Parse the arguments every destructive adapter accepts.
+ *
+ * `--dry-run` is the default rather than an opt-in: an adapter that forgets to
+ * parse anything, or is handed arguments it does not understand, enumerates
+ * instead of mutating. Mutating requires an explicit `--no-dry-run` or
+ * `--execute`, and passing `--dry-run` alongside either one keeps the dry run,
+ * so a stray flag can never silently upgrade a rehearsal into a real run.
+ * @param {readonly string[]} argv - Arguments after the script name
+ * @returns {{dryRun: boolean, requestedStage: (string|null), idempotencyKey: (string|null)}} Parsed arguments
+ */
+export function parseDestructiveArgs(argv) {
+  const args = [...(argv ?? [])];
+  const optedOut = EXECUTE_FLAGS.some(flag => args.includes(flag));
+  return {
+    dryRun: args.includes("--dry-run") || !optedOut,
+    requestedStage: readOption(args, "--stage"),
+    idempotencyKey: readOption(args, "--idempotency-key"),
+  };
+}

package/all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh

@@ -5,9 +5,22 @@
 # check. See feedback_never_no_verify in user memory.
 #
 # Blocked bypass vectors:
-#   1. the --no-verify long flag (any subcommand, any position, incl. subshells);
+#   1. --no-verify, and any prefix abbreviation git would accept for it;
 #   2. HUSKY=0 / HUSKY_SKIP_HOOKS=... — disables husky-managed git hooks;
-#   3. core.hooksPath pointed at /dev/null or set empty — disables ALL git hooks.
+#   3. core.hooksPath pointed anywhere but an allowlisted in-repo hooks dir;
+#   4. --config-env=core.hooksPath=VAR, in both the one- and two-token spellings;
+#   5. GIT_CONFIG_KEY_<n>=core.hooksPath env-var-style command-scope config.
+#
+# The line below is what lets `lisa apply` tell a downstream copy of this guard
+# that is BEHIND from one that is AHEAD. Byte comparison cannot: both look like
+# "differs from mine", and guessing "behind" is how a fork's stronger guard gets
+# silently replaced by a weaker upstream one. Refresh compares the two declared
+# sets, and refuses to overwrite a copy declaring anything this one does not.
+#
+# Add a name here in the same commit that closes a vector. A hardening that
+# forgets to is invisible to refresh, and shows up as an unexplained diff at
+# review time instead of a named capability.
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as

package/all/create-only/scripts/remote-agent-aws-setup.sh

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 # Installed by Lisa. The authoritative implementation is shipped by the
 # lisa-setup-remote-aws skill and the @codyswann/lisa package.
 

package/cdk/create-only/.github/workflows/deploy.yml

@@ -1,4 +1,5 @@
-# This file is created by Lisa (create-only — edit freely, Lisa won't overwrite it).
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
 
 name: 🚀 Release and Deploy
 

package/cdk/create-only/vitest.config.local.ts

@@ -1,3 +1,6 @@
+// Seeded by Lisa on first setup — this file is YOURS.
+// Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 /**
  * Vitest Configuration - Project-Local Customizations
  *

package/dist/cli/doctor-lisa-owned-artifacts.d.ts

@@ -1,3 +1,4 @@
+import type { HashLedger } from "../core/lisa-owned-provenance.js";
 /** One doctor check result, structurally identical to `DoctorCheck`. */
 interface ArtifactCheck {
     name: string;
@@ -5,14 +6,22 @@ interface ArtifactCheck {
     detail: string;
 }
 /**
- * Report Lisa-owned enforcement artifacts the project has an outdated copy of.
+ * Report Lisa-owned enforcement artifacts that differ from what Lisa ships.
+ *
+ * Two different findings, deliberately not merged. An *outdated* copy is fixed
+ * by running apply. A *modified* copy is one apply will now refuse to touch, so
+ * telling the operator to run apply would send them round a loop that never
+ * terminates and make the protection look like a bug. Both still warn — a guard
+ * nobody can account for is worth a line either way, and staying silent about a
+ * downstream edit would let a project quietly swap a guard for a stub.
  *
  * Only artifacts the project already has are considered: a missing one means
  * the stack does not apply here, not that something drifted.
  * @param targetPath - Project path to inspect
  * @param lisaRoot - Installed Lisa package root (injected by tests)
+ * @param ledger - Known-good hashes, defaulting to Lisa's shipping history
  * @returns Doctor check result
  */
-export declare function checkLisaOwnedArtifacts(targetPath: string, lisaRoot?: string): Promise<ArtifactCheck>;
+export declare function checkLisaOwnedArtifacts(targetPath: string, lisaRoot?: string, ledger?: HashLedger): Promise<ArtifactCheck>;
 export {};
 //# sourceMappingURL=doctor-lisa-owned-artifacts.d.ts.map

package/dist/cli/doctor-lisa-owned-artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-lisa-owned-artifacts.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-lisa-owned-artifacts.ts"],"names":[],"mappings":"AA0CA,wEAAwE;AACxE,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAkHD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAA0B,GACnC,OAAO,CAAC,aAAa,CAAC,CAiDxB"}
+{"version":3,"file":"doctor-lisa-owned-artifacts.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-lisa-owned-artifacts.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAoBnE,wEAAwE;AACxE,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAkHD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAA0B,EACpC,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,aAAa,CAAC,CA+CxB"}

package/dist/cli/doctor-lisa-owned-artifacts.js

@@ -20,6 +20,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import * as fse from "fs-extra";
 import { PROJECT_TYPE_ORDER } from "../core/config.js";
+import { classifyHostCopy, mayRefreshLisaOwned, } from "../core/lisa-owned-provenance.js";
 import { isLisaOwnedTemplate } from "../core/lisa-owned-templates.js";
 import { isLisaSourceRepo } from "../core/self-apply.js";
 import { listFilesRecursive } from "../utils/file-operations.js";
@@ -112,15 +113,23 @@ function reExportsShippedTemplate(installed, installedPath, sources) {
     return [...installed.toString("utf8").matchAll(RELATIVE_SPECIFIER)].some(match => shipped.has(path.resolve(directory, match[1] ?? "")));
 }
 /**
- * Report Lisa-owned enforcement artifacts the project has an outdated copy of.
+ * Report Lisa-owned enforcement artifacts that differ from what Lisa ships.
+ *
+ * Two different findings, deliberately not merged. An *outdated* copy is fixed
+ * by running apply. A *modified* copy is one apply will now refuse to touch, so
+ * telling the operator to run apply would send them round a loop that never
+ * terminates and make the protection look like a bug. Both still warn — a guard
+ * nobody can account for is worth a line either way, and staying silent about a
+ * downstream edit would let a project quietly swap a guard for a stub.
  *
  * Only artifacts the project already has are considered: a missing one means
  * the stack does not apply here, not that something drifted.
  * @param targetPath - Project path to inspect
  * @param lisaRoot - Installed Lisa package root (injected by tests)
+ * @param ledger - Known-good hashes, defaulting to Lisa's shipping history
  * @returns Doctor check result
  */
-export async function checkLisaOwnedArtifacts(targetPath, lisaRoot = defaultLisaRoot()) {
+export async function checkLisaOwnedArtifacts(targetPath, lisaRoot = defaultLisaRoot(), ledger) {
     const shipped = await shippedArtifacts(lisaRoot);
     if (shipped.size === 0) {
         return {
@@ -145,24 +154,60 @@ export async function checkLisaOwnedArtifacts(targetPath, lisaRoot = defaultLisa
             return undefined;
         if (await matchesAnyShipped(installed, sources))
             return undefined;
-        return selfHost &&
-            reExportsShippedTemplate(installed, installedPath, sources)
-            ? undefined
-            : destination;
+        if (selfHost &&
+            reExportsShippedTemplate(installed, installedPath, sources))
+            return undefined;
+        const outdated = await isProvablyStale(installed, destination, sources, ledger);
+        return [destination, outdated ? "stale" : "modified"];
     }));
-    const stale = results
-        .filter((item) => item !== undefined)
+    return summarise(results.filter((item) => item !== undefined));
+}
+/**
+ * Turn the per-artifact findings into one doctor line.
+ * @param findings - Destination paths paired with what was found
+ * @returns Doctor check result
+ */
+function summarise(findings) {
+    const pick = (wanted) => findings
+        .filter(([, finding]) => finding === wanted)
+        .map(([destination]) => destination)
         .sort((left, right) => left.localeCompare(right));
-    return stale.length === 0
-        ? {
+    const stale = pick("stale");
+    const modified = pick("modified");
+    if (stale.length === 0 && modified.length === 0) {
+        return {
             name: CHECK_NAME,
             status: "ok",
             detail: "Enforcement guards match the installed Lisa version",
-        }
-        : {
-            name: CHECK_NAME,
-            status: "warn",
-            detail: `Outdated Lisa-owned guards (run \`npx lisa apply .\` to refresh): ${stale.join(", ")}`,
         };
+    }
+    const parts = [
+        stale.length > 0
+            ? `Outdated Lisa-owned guards (run \`npx lisa apply .\` to refresh): ${stale.join(", ")}`
+            : "",
+        modified.length > 0
+            ? `Lisa-owned guards edited in this project, so apply will keep yours rather than overwrite them: ${modified.join(", ")}`
+            : "",
+    ].filter(part => part.length > 0);
+    return { name: CHECK_NAME, status: "warn", detail: parts.join(". ") };
+}
+/**
+ * Whether a differing installed guard is genuinely behind Lisa's.
+ *
+ * Doctor and apply have to agree, or the operator gets contradictory
+ * instructions: doctor telling somebody to run `lisa apply .` to fix a file
+ * apply will then deliberately refuse to touch is a loop with no exit, and it
+ * reads as a broken tool rather than as the protection it is. So a copy apply
+ * would preserve is not reported here either — it is not outdated, and calling
+ * it outdated invites the operator to discard their own hardening.
+ * @param installed - Bytes currently installed in the project
+ * @param destination - Repo-relative destination path
+ * @param sources - Absolute paths of the shipped variants
+ * @param ledger - Known-good hashes, defaulting to Lisa's shipping history
+ * @returns True when every shipped variant considers the installed copy stale
+ */
+async function isProvablyStale(installed, destination, sources, ledger) {
+    const shipped = await Promise.all(sources.map(async (source) => readFile(source)));
+    return shipped.every(candidate => mayRefreshLisaOwned(classifyHostCopy(destination, installed, candidate, ledger)));
 }
 //# sourceMappingURL=doctor-lisa-owned-artifacts.js.map

package/dist/cli/doctor-lisa-owned-artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-lisa-owned-artifacts.js","sourceRoot":"","sources":["../../src/cli/doctor-lisa-owned-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,MAAM,UAAU,GAAG,qCAAqC,CAAC;AACzD,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAYlE;;;GAGG;AACH,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,IAAY;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;SACzC,GAAG,CACF,MAAM,CAAC,EAAE,CACP;QACE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1D,MAAM;KACE,CACb;SACA,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAgB;IAEhB,MAAM,OAAO,GAAG,CACd,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,KAAK,EAAE,GAAG,kBAAkB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAC9C,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC/B,CACF,CACF,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,IAAI,GAAG,CACZ,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,WAAW;QACX,OAAO;aACJ,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,WAAW,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC;KAC/B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,SAAiB,EACjB,OAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC9C,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,wBAAwB,CAC/B,SAAiB,EACjB,aAAqB,EACrB,OAA0B;IAE1B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CACtE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAkB,EAClB,WAAmB,eAAe,EAAE;IAEpC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,QAAQ,CAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EACpC,MAAM,CACP,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClB,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACvD,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE;QAChD,IAAI,iBAAiB,CAAC,WAAW,EAAE,cAAc,CAAC;YAAE,OAAO,SAAS,CAAC;QACrE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,MAAM,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAClE,OAAO,QAAQ;YACb,wBAAwB,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC;YAC3D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC;IAClB,CAAC,CAAC,CACH,CAAC;IACF,MAAM,KAAK,GAAG,OAAO;SAClB,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACpD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC;YACE,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,qDAAqD;SAC9D;QACH,CAAC,CAAC;YACE,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,qEAAqE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChG,CAAC;AACR,CAAC"}
+{"version":3,"file":"doctor-lisa-owned-artifacts.js","sourceRoot":"","sources":["../../src/cli/doctor-lisa-owned-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,MAAM,UAAU,GAAG,qCAAqC,CAAC;AACzD,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAYlE;;;GAGG;AACH,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,IAAY;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO,CAAC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;SACzC,GAAG,CACF,MAAM,CAAC,EAAE,CACP;QACE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1D,MAAM;KACE,CACb;SACA,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAgB;IAEhB,MAAM,OAAO,GAAG,CACd,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,KAAK,EAAE,GAAG,kBAAkB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAC9C,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC/B,CACF,CACF,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,IAAI,GAAG,CACZ,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,WAAW;QACX,OAAO;aACJ,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,WAAW,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC;KAC/B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,SAAiB,EACjB,OAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC9C,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,wBAAwB,CAC/B,SAAiB,EACjB,aAAqB,EACrB,OAA0B;IAE1B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CACtE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAkB,EAClB,WAAmB,eAAe,EAAE,EACpC,MAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,QAAQ,CAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EACpC,MAAM,CACP,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClB,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACvD,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE;QAChD,IAAI,iBAAiB,CAAC,WAAW,EAAE,cAAc,CAAC;YAAE,OAAO,SAAS,CAAC;QACrE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,MAAM,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAClE,IACE,QAAQ;YACR,wBAAwB,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC;YAE3D,OAAO,SAAS,CAAC;QACnB,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,SAAS,EACT,WAAW,EACX,OAAO,EACP,MAAM,CACP,CAAC;QACF,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAU,CAAC;IACjE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,SAAS,CACd,OAAO,CAAC,MAAM,CACZ,CAAC,IAAI,EAAsC,EAAE,CAAC,IAAI,KAAK,SAAS,CACjE,CACF,CAAC;AACJ,CAAC;AAKD;;;;GAIG;AACH,SAAS,SAAS,CAChB,QAAiD;IAEjD,MAAM,IAAI,GAAG,CAAC,MAAe,EAAY,EAAE,CACzC,QAAQ;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,MAAM,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;SACnC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,KAAK,CAAC,MAAM,GAAG,CAAC;YACd,CAAC,CAAC,qEAAqE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACzF,CAAC,CAAC,EAAE;QACN,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,kGAAkG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACzH,CAAC,CAAC,EAAE;KACP,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,WAAmB,EACnB,OAA0B,EAC1B,MAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC9C,CAAC;IACF,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAC/B,mBAAmB,CACjB,gBAAgB,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAC5D,CACF,CAAC;AACJ,CAAC"}

package/dist/core/config.d.ts

@@ -158,8 +158,26 @@ export interface FileOperationResult {
      * let template changes — including fixes to the enforcement guards —
      * go undelivered while the summary read exactly like a clean no-op.
      */
-     | "stale" | "overwritten" | "appended" | "merged" | "created";
+     | "stale"
+    /**
+     * A Lisa-owned artifact whose installed copy could not be proved to be
+     * behind Lisa's, so it was preserved rather than overwritten.
+     *
+     * Emphatically not "stale" — that word says the file is out of date, and
+     * here the likeliest reason it differs is that it is *ahead*. Filing the two
+     * under one label would reproduce the original defect in the reporting: an
+     * operator reading "out of date" about a guard they deliberately hardened
+     * would fix the wrong thing.
+     */
+     | "host-ahead" | "overwritten" | "appended" | "merged" | "created";
     readonly linesAdded?: number;
+    /**
+     * Operator-readable explanation of a non-obvious outcome, shown verbatim.
+     *
+     * Carries the "why" for `host-ahead`, where the path alone tells an operator
+     * nothing actionable and the whole point is to say what would have been lost.
+     */
+    readonly note?: string;
 }
 /**
  * Counters for operation summary
@@ -169,6 +187,8 @@ export interface OperationCounters {
     skipped: number;
     /** Managed files left out of date because this apply could not overwrite them. */
     stale: number;
+    /** Lisa-owned artifacts preserved because the installed copy may be ahead. */
+    hostAhead: number;
     overwritten: number;
     appended: number;
     merged: number;

package/dist/core/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,eAAe,GACf,aAAa,GACb,OAAO,GACP,cAAc,GACd,cAAc,CAAC;AAEnB;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,MAAM,GACN,QAAQ,GACR,KAAK,GACL,eAAe,GACf,QAAQ,GACR,aAAa,GACb,OAAO,CAAC;AAEZ;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC,CAU/B,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,WAAW,EAS3C,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAOzC,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,OAAO,GACf,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,KAAK,GACL,SAAS,GACT,UAAU,GACV,OAAO,CAAC;AAEZ;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,OAAO,EAQnC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE7D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAGpD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEpE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,UAAU,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,SAAS,GACf,OAAO,CAGT;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,OAAkB,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAE/B,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAE7C,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB;AAC1B,gCAAgC;AAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE;AAC1B,4DAA4D;GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,gBAAgB,GAAG,SAAS,GACpC,OAAO,CAUT;AAgBD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EACX,QAAQ,GACR,SAAS;IACX;;;;;;;;OAQG;OACD,OAAO,GACP,aAAa,GACb,UAAU,GACV,QAAQ,GACR,SAAS,CAAC;IACd,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,SAAS,WAAW,EAAE,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,iBAAiB,CAazD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,eAAe,GACf,aAAa,GACb,OAAO,GACP,cAAc,GACd,cAAc,CAAC;AAEnB;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,MAAM,GACN,QAAQ,GACR,KAAK,GACL,eAAe,GACf,QAAQ,GACR,aAAa,GACb,OAAO,CAAC;AAEZ;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC,CAU/B,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,WAAW,EAS3C,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAOzC,CAAC;AAEX;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,OAAO,GACf,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,KAAK,GACL,SAAS,GACT,UAAU,GACV,OAAO,CAAC;AAEZ;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,OAAO,EAQnC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE7D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAGpD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEpE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,UAAU,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,SAAS,GACf,OAAO,CAGT;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,OAAkB,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAE/B,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAE7C,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB;AAC1B,gCAAgC;AAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE;AAC1B,4DAA4D;GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,gBAAgB,GAAG,SAAS,GACpC,OAAO,CAUT;AAgBD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,UAAU,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EACX,QAAQ,GACR,SAAS;IACX;;;;;;;;OAQG;OACD,OAAO;IACT;;;;;;;;;OASG;OACD,YAAY,GACZ,aAAa,GACb,UAAU,GACV,QAAQ,GACR,SAAS,CAAC;IACd,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,SAAS,WAAW,EAAE,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,iBAAiB,CAczD"}

package/dist/core/config.js

@@ -139,6 +139,7 @@ export function createInitialCounters() {
         copied: 0,
         skipped: 0,
         stale: 0,
+        hostAhead: 0,
         overwritten: 0,
         appended: 0,
         merged: 0,

package/dist/core/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAwBA;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAE/B;IACF,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,YAAY;IACjB,eAAe,EAAE,YAAY;IAC7B,MAAM,EAAE,YAAY;IACpB,aAAa,EAAE,YAAY;IAC3B,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,SAAS;CACR,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,YAAY;IACZ,aAAa;IACb,eAAe;IACf,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;CACC,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B;IACtD,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,OAAO;IACP,cAAc;IACd,cAAc;CACN,CAAC;AAyBX;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAuB;IAChD,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,KAAK;IACL,SAAS;IACT,UAAU;IACV,OAAO;CACC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,GAAG,EAAE,OAAO;CACb,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,GAAG,cAAc;IACjB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsC;IACvE,IAAI,EAAE,OAAO;CACd,CAAC;AASF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,KAAgB;IAEhB,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAY,QAAQ,CAAC;AAsDjD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,OAAqC;IAErC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxC,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC9B,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAChF,CAAC;AAuED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,CAAC;QACR,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;KACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAwBA;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAE/B;IACF,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,YAAY;IACjB,eAAe,EAAE,YAAY;IAC7B,MAAM,EAAE,YAAY;IACpB,aAAa,EAAE,YAAY;IAC3B,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,SAAS;CACR,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,YAAY;IACZ,aAAa;IACb,eAAe;IACf,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,KAAK;IACL,OAAO;CACC,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B;IACtD,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,OAAO;IACP,cAAc;IACd,cAAc;CACN,CAAC;AAyBX;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAuB;IAChD,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,KAAK;IACL,SAAS;IACT,UAAU;IACV,OAAO;CACC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,GAAG,EAAE,OAAO;CACb,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,GAAG,cAAc;IACjB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;CAChC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsC;IACvE,IAAI,EAAE,OAAO;CACd,CAAC;AASF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,KAAgB;IAEhB,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,OAAO,KAAK,KAAK,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAY,QAAQ,CAAC;AAsDjD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,OAAqC;IAErC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxC,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC9B,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAChF,CAAC;AA2FD;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,CAAC;QACZ,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;KACrB,CAAC;AACJ,CAAC"}

package/dist/core/guard-capabilities.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The capability marker a Lisa-owned guard uses to declare what it defends
+ * against, so refresh can compare two copies by *what they stop* rather than by
+ * bytes.
+ *
+ * A byte comparison answers "are these the same?" and nothing else. It cannot
+ * answer the only question refresh actually needs answered — "is the host's copy
+ * behind mine, or ahead of it?" — and guessing "behind" is how a host's stronger
+ * guard gets silently replaced by a weaker upstream one.
+ *
+ * The marker is one comment line in the guard's header:
+ *
+ * ```
+ * # lisa-guard-capabilities: no-verify-abbrev, hookspath-allowlist, config-env
+ * ```
+ *
+ * Deliberately a *set*, not a version number. A monotonic `lisa-guard-version: N`
+ * is easier to compare but lies the moment two hosts harden different vectors
+ * independently — which is exactly what happened: `propswapllc/frontend` closed
+ * the `GIT_CONFIG_KEY_<n>` bypass while `tunnl-infrastructure` closed a different
+ * one. Both would have bumped to the same number and one would have silently
+ * won. Two sets stay two sets, and set difference names precisely what each copy
+ * has that the other does not.
+ *
+ * Only the header window is scanned. A guard whose *body* greps for the marker
+ * string, or a test fixture that quotes one, must not be read as declaring it.
+ * @module core/guard-capabilities
+ */
+/** A guard's declared capability set, normalised for comparison. */
+export type CapabilitySet = ReadonlySet<string>;
+/**
+ * Read the capabilities a guard's header declares.
+ *
+ * Absence is not an error and not a failure signal — it means the artifact has
+ * not been enrolled, and every caller treats that as "no declaration made"
+ * rather than "declares nothing dangerous". That is what lets the marker roll
+ * out one guard at a time with no flag day.
+ * Scanned line by line with plain string operations rather than a regular
+ * expression. A header is untrusted input — it arrives from whatever repository
+ * the "host" copy came from — and a linear scan cannot be made to backtrack.
+ * @param bytes - Full contents of the guard file
+ * @returns The declared capabilities, lower-cased and de-duplicated
+ */
+export declare function readGuardCapabilities(bytes: Buffer): CapabilitySet;
+/**
+ * The capabilities the host declares that Lisa's copy does not.
+ *
+ * A non-empty result is the whole signal: the host copy defends something
+ * upstream does not, so overwriting it removes protection. This is set
+ * *difference*, not a strict-superset test, on purpose — a host that hardened
+ * vector A while upstream hardened vector B is not a superset of upstream, yet
+ * overwriting it still deletes A. Asking only "is the host a superset?" would
+ * clobber precisely the divergent-hardening case the set representation exists
+ * to handle.
+ * @param host - Capabilities declared by the installed copy
+ * @param lisa - Capabilities declared by the packaged copy
+ * @returns Capabilities present on the host and absent upstream, sorted
+ */
+export declare function capabilitiesOnlyOnHost(host: CapabilitySet, lisa: CapabilitySet): readonly string[];
+//# sourceMappingURL=guard-capabilities.d.ts.map