@codyswann/lisa 4.27.4 → 4.27.6

package/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh

@@ -407,10 +407,33 @@ fi
 #   - `main` cut 80 releases in 24 hours, median gap 10 minutes. "Behind the
 #     newest Lisa on this disk" is the DEFAULT state of a checkout within
 #     minutes of being cut, through nothing anyone did wrong.
-#   - Across the 27 host checkouts in this fleet, 12 resolve guards at all, and
-#     ALL TWELVE are behind or undateable. None is current. Eight carry no
-#     apply receipt; four are behind by a whole MAJOR (3.23.0, 3.23.1, 3.46.3,
-#     3.54.4 against 4.17.2).
+#   - Measured once across the host checkouts on one fleet: of those that
+#     resolved guards at all, every one was behind or undateable and none was
+#     current, several by a whole MAJOR — while a larger number resolved NO
+#     guard at all.
+#
+# That second reading used to be written here as a set of counts, and that was
+# the wrong place for it. A number in a comment is a measurement, not a monitor:
+# it was true on the day it was taken and nothing re-took it, so the drift after
+# that date was unobserved — which is the same defect the number documents. The
+# counts are therefore not restated here. Re-derive them:
+#
+# Run these FROM A LISA MONOREPO CHECKOUT — the census and the fleet roster are
+# Lisa-monorepo artifacts, and this comment travels into host projects where
+# neither exists. The script wrapper builds `dist/` first, which a fresh clone
+# does not have:
+#
+#   bun run lisa:enforcement-census              # roster on this machine
+#   bun run lisa:enforcement-census -- --redact  # safe to quote publicly
+#
+# In a host project the local half of the same question is `lisa doctor`, which
+# reports what THIS checkout resolves and needs no roster.
+#
+# The census reports and never gates, and it keeps "resolves NO guard" apart
+# from "resolves something old" — different failures, different remedies, and
+# folding them is what made the unenforced checkouts easy to miss
+# (CodySwannGT/lisa#3490). `lisa doctor` carries the same finding for the single
+# checkout it is run in.
 #
 # So no distance threshold rescues it — even the strictest version predicate is
 # permanently true across the fleet. The noise is the REPETITION, not the

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -81,6 +81,20 @@ class TrackingError extends Error {
    * @type {boolean}
    */
   commitRewritable = false;
+
+  /**
+   * Whether this refusal already says everything the operator needs.
+   *
+   * Every other refusal here IS about work-item tracking, so the reporter's
+   * banner and its "mention the ticket" guidance are the right frame for them.
+   * The push-destination refusal is not: nothing about it is fixed by naming a
+   * ticket, and telling someone to do that while their push is landing on a
+   * deploy branch points them away from the one thing that matters. Set where
+   * the refusal is raised, for the same reason `commitRewritable` is — the
+   * reporter cannot tell these apart from the text without guessing.
+   * @type {boolean}
+   */
+  selfExplanatory = false;
 }
 
 /** What `soleWorkItem` is reading when it reads a commit. */
@@ -2171,6 +2185,153 @@ function parsePushLines(input, remote) {
   return commits;
 }
 
+/** The `refs/heads/` prefix, spelled once because three parsers below strip it. */
+const HEADS_PREFIX = "refs/heads/";
+
+/**
+ * Deploy branches this push must never reach by inheritance.
+ *
+ * Read from `deploy.branches` in the project config — the same map the rest of
+ * the flow uses to resolve a work item's base branch — plus the remote's own
+ * default branch, because a repository that declares no deploy map still has
+ * exactly one branch that releases. Names are compared after stripping
+ * `refs/heads/`, so a config that spells a branch either way resolves the same.
+ * @param {string} remote Remote being pushed to.
+ * @returns {Set<string>} Protected branch names, possibly empty.
+ */
+function deployBranchNames(remote) {
+  const names = new Set();
+  let config = {};
+  try {
+    config = readConfig();
+  } catch {
+    // An unreadable config must not disable the guard; the remote default
+    // branch below is resolved independently and is the case that matters most.
+    config = {};
+  }
+  const branches = config?.deploy?.branches;
+  if (branches && typeof branches === "object") {
+    for (const value of Object.values(branches)) {
+      if (typeof value === "string" && value.trim()) {
+        names.add(value.trim().replace(HEADS_PREFIX, ""));
+      }
+    }
+  }
+  const defaultRef = remoteDefaultRef(remote);
+  if (defaultRef) {
+    names.add(defaultRef.slice(`refs/remotes/${remote}/`.length));
+  }
+  return names;
+}
+
+/**
+ * The branch a pre-push line is pushing FROM, or null when it is not a branch.
+ *
+ * `HEAD` is deliberately not resolved to the current branch. Git sends `HEAD`
+ * as the local ref when the pusher wrote the destination out in full
+ * (`git push origin HEAD:main`) and for the detached checkouts release
+ * automation runs from — both are statements of intent about the destination,
+ * which is the opposite of the accident this guard exists to catch. Treating
+ * them as unknown keeps them out of scope; see the residual note on
+ * `pushDestinationRefusal`.
+ * @param {string} localRef Local ref field from the pre-push line.
+ * @returns {string|null} Branch name, or null when the line is not a branch push.
+ */
+function pushedBranchName(localRef) {
+  if (!localRef || !localRef.startsWith(HEADS_PREFIX)) return null;
+  const name = localRef.slice(HEADS_PREFIX.length);
+  return name === "" ? null : name;
+}
+
+/**
+ * Refuse a push whose RESOLVED destination is a deploy branch it was not aimed at.
+ *
+ * Git resolves a push's destination from the branch's UPSTREAM, not from the
+ * branch argument, whenever `push.default` is `upstream` or `tracking`. The
+ * flow that creates a working branch with `git checkout -b <branch> origin/main`
+ * sets that branch's upstream to `main`, so the ordinary
+ * `git push -u origin <branch>` resolves to `refs/heads/main` and lands there —
+ * silently, reporting success, with branch protection and every required check
+ * bypassed (CodySwannGT/lisa#3495). Measured in this repository: two commits
+ * reached the default branch that way, every detection control fired correctly
+ * afterwards, and the commits shipped in a published release anyway, because
+ * nothing prevented the original push.
+ *
+ * `push.default` is normalized away by a migration and the prescribed flow no
+ * longer inherits a destination, but neither of those can bind a clone made
+ * before them, a global config, or a habit. This is the backstop, and it reads
+ * the one thing that is not a proxy: the destination git ACTUALLY resolved,
+ * which is exactly what the pre-push stream carries.
+ *
+ * Blocks only the accident's signature — a NAMED local branch resolving onto a
+ * differently-named deploy branch. Two shapes stay allowed, deliberately:
+ * `main -> main` (the legitimate direct push, including a merge landed locally)
+ * and a `HEAD` local ref (see `pushedBranchName`). Deletions never reach here;
+ * the hook's deletion-only guard exits before this runs.
+ * @param {string} input Raw pre-push stdin: `<local ref> <local sha> <remote ref> <remote sha>` per line.
+ * @param {string} remote Remote being pushed to.
+ * @returns {string|null} Refusal message, or null when every line is safe.
+ */
+function pushDestinationRefusal(input, remote) {
+  const protectedNames = deployBranchNames(remote);
+  if (protectedNames.size === 0) return null;
+  for (const line of input.trim().split(/\r?\n/).filter(Boolean)) {
+    const [localRef, localOid, remoteRef] = line.trim().split(/\s+/);
+    if (!localOid || ZERO_OID.test(localOid)) continue;
+    if (!remoteRef || !remoteRef.startsWith(HEADS_PREFIX)) continue;
+    const destination = remoteRef.slice(HEADS_PREFIX.length);
+    if (!protectedNames.has(destination)) continue;
+    const source = pushedBranchName(localRef);
+    if (source === null || source === destination) continue;
+    return [
+      `Push blocked: "${source}" would land on "${destination}", a deploy branch.`,
+      "",
+      `Git resolved that destination from the branch's upstream, not from the`,
+      `name you pushed. It happens when push.default is "upstream" or`,
+      `"tracking" and the branch was created tracking a deploy branch — the`,
+      `push then reports success while bypassing branch protection and every`,
+      `required check.`,
+      "",
+      "Fix the branch, not this hook:",
+      `  git branch --unset-upstream ${source}`,
+      `  git config --local push.default simple`,
+      `  git push ${remote} ${source}:refs/heads/${source}`,
+      "",
+      `If you genuinely mean to push to "${destination}", check it out and push`,
+      "it, so the destination is what you named rather than what was inherited.",
+    ].join("\n");
+  }
+  return null;
+}
+
+/**
+ * Pre-push destination check, run unconditionally by the hook.
+ *
+ * Separate from `validate-push` on purpose: traceability stands down when a
+ * project declares `gates.traceability`, and a guard that a declaration can
+ * switch off is not a guard against an accident.
+ *
+ * `--refs <file>` names the stream to read instead of stdin. The hook has
+ * already captured the pushed refs to a file — it must, because reading the
+ * stream spends it and the checks after this one need it too — so passing that
+ * path is the direct spelling of what the hook actually holds, rather than
+ * redirecting the file back onto stdin so this can read it as if it had not
+ * been captured. Stdin remains the fallback, so driving the subcommand by hand
+ * with a pipe still works.
+ * @param {readonly string[]} args Command arguments; `args[0]` is the remote name.
+ * @returns {void}
+ */
+function validatePushDestination(args) {
+  const remote = args[0] && !args[0].startsWith("-") ? args[0] : "origin";
+  const refsFile = option(args, "--refs", "LISA_PUSHED_REFS_FILE");
+  const input = readFileSync(refsFile === undefined ? 0 : refsFile, "utf8");
+  const refusal = pushDestinationRefusal(input, remote);
+  if (!refusal) return;
+  const error = new TrackingError(refusal);
+  error.selfExplanatory = true;
+  throw error;
+}
+
 /**
  * The one work item a pull-request BODY names.
  *
@@ -3466,9 +3627,11 @@ function main() {
   if (command === "prepare-commit-msg") return prepareCommitMessage(args);
   if (command === "validate-commit") return validateCommit(args);
   if (command === "validate-push") return validatePush(args);
+  if (command === "validate-push-destination")
+    return validatePushDestination(args);
   if (command === "validate-pr") return validatePr(args);
   throw new TrackingError(
-    "Usage: lisa-work-item.mjs link|current|attach-branch|clear|verify-level|backlink|complete|sweep|prepare-commit-msg|validate-commit|validate-push|validate-pr" +
+    "Usage: lisa-work-item.mjs link|current|attach-branch|clear|verify-level|backlink|complete|sweep|prepare-commit-msg|validate-commit|validate-push|validate-push-destination|validate-pr" +
       "\n(`bind` is accepted as an alias for `link`, but some agent harnesses refuse the token `bind` in a command line.)"
   );
 }
@@ -3489,7 +3652,9 @@ export function runCli() {
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     console.error(
-      `\n❌ Work-item tracking blocked this operation: ${detail}\n\n${GUIDANCE}\n`
+      error?.selfExplanatory === true
+        ? `\n❌ ${detail}\n`
+        : `\n❌ Work-item tracking blocked this operation: ${detail}\n\n${GUIDANCE}\n`
     );
     process.exitCode = 1;
   }

package/dist/cli/doctor-enforcement-coverage.d.ts

@@ -0,0 +1,14 @@
+/** One doctor check result, structurally identical to `DoctorCheck`. */
+interface CoverageCheck {
+    name: string;
+    status: "ok" | "warn" | "fail";
+    detail: string;
+}
+/**
+ * Report what this checkout resolves.
+ * @param targetPath - Project path
+ * @returns The check result
+ */
+export declare function checkEnforcementCoverage(targetPath: string): Promise<CoverageCheck>;
+export {};
+//# sourceMappingURL=doctor-enforcement-coverage.d.ts.map

package/dist/cli/doctor-enforcement-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-enforcement-coverage.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-enforcement-coverage.ts"],"names":[],"mappings":"AAsCA,wEAAwE;AACxE,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAcD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAsDxB"}

package/dist/cli/doctor-enforcement-coverage.js

@@ -0,0 +1,103 @@
+/**
+ * Doctor check: does THIS checkout resolve enforcement, and of what vintage?
+ *
+ * The dispatcher already answers this to an agent session, once per session.
+ * Nobody had asked it from outside a session, which is why nothing noticed that
+ * most checkouts in a fleet resolve nothing at all (CodySwannGT/lisa#3490).
+ * `lisa doctor` is where an operator asks a checkout what state it is in, so
+ * this is the local half of the census — the half a host project gets, since
+ * the fleet roster the fleet census reads exists only on the machine that
+ * manages the fleet.
+ *
+ * Three findings, kept apart on purpose:
+ *
+ *   - **Resolves nothing.** Not a stale guard — no guard. An agent working here
+ *     is checked by nothing and the session says nothing.
+ *   - **Resolves something old, or undateable.** A stale copy still refuses
+ *     things and names its vintage in every refusal, so it is the quieter half
+ *     of the same question, not the same finding.
+ *   - **Installed behind declared.** This one fails in the affirmative: the
+ *     guards run, every check answers, and every answer is about a version
+ *     nobody is using — which is how a reviewer diffed a branch against
+ *     templates from a version majors behind the one being claimed, and got a
+ *     confident wrong answer.
+ *
+ * Warn, never fail, for the same reason `doctor-apply-freshness` warns: the
+ * remedy is one command, a checkout mid-upgrade is legitimately in this state
+ * for a few minutes, and reddening the exit code trains operators to ignore it.
+ * @module cli/doctor-enforcement-coverage
+ */
+import { getPackageVersion } from "./version.js";
+import { collectCheckoutCoverage } from "../core/enforcement-coverage.js";
+import { isInstallBehindDeclared } from "../core/enforcement-census.js";
+const CHECK_NAME = "Enforcement guards resolve in this checkout?";
+const FLEET_HINT = "Run `node scripts/lisa-enforcement-census.mjs` from the Lisa monorepo to ask the same question of every checkout on the fleet roster.";
+const REPAIR = "npx @codyswann/lisa apply";
+/**
+ * Read this build's own version without throwing when metadata is unreadable.
+ * @returns The version, or null when it cannot be determined
+ */
+function referenceVersion() {
+    try {
+        return getPackageVersion();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Report what this checkout resolves.
+ * @param targetPath - Project path
+ * @returns The check result
+ */
+export async function checkEnforcementCoverage(targetPath) {
+    const coverage = await collectCheckoutCoverage({
+        label: targetPath,
+        checkoutPath: targetPath,
+        reference: referenceVersion(),
+    });
+    if (coverage.resolution === "unreadable") {
+        return {
+            name: CHECK_NAME,
+            status: "warn",
+            detail: `Could not look: ${coverage.unreadableReason ?? "unknown"}. That is not the same as being unprotected, and it is not the same as being covered.`,
+        };
+    }
+    if (coverage.resolution === "none") {
+        return {
+            name: CHECK_NAME,
+            status: "warn",
+            detail: `This checkout resolves NO Lisa enforcement guard. Not a stale guard — none. A tool call here is checked by nothing, and nothing in the session says so. Searched scripts/lisa-hooks/ and plugins/lisa/hooks/. Repair: \`${REPAIR}\`. ${FLEET_HINT}`,
+        };
+    }
+    const notes = [
+        coverage.resolution === "partial"
+            ? `only ${coverage.guards.length - coverage.unresolvedGuards.length} of ${coverage.guards.length} guards resolve (missing: ${coverage.unresolvedGuards.join(", ")})`
+            : null,
+        coverage.vintage === "undateable"
+            ? "the copy in force carries no Lisa manifest beside it, so it cannot be shown current"
+            : null,
+        coverage.vintage === "behind"
+            ? `the copy in force is lisa ${coverage.governing?.version ?? "?"}, behind ${referenceVersion() ?? "the newest known"}`
+            : null,
+        coverage.receipt.present
+            ? null
+            : "no apply receipt records a completed `lisa apply` here",
+        isInstallBehindDeclared(coverage)
+            ? `installed @codyswann/lisa is ${coverage.install.installed ?? "?"} while this project declares ${coverage.install.declared ?? "?"} — every answer read out of node_modules is about a version nobody is running`
+            : null,
+    ].filter((note) => note !== null);
+    if (notes.length === 0) {
+        return {
+            name: CHECK_NAME,
+            status: "ok",
+            detail: `All ${coverage.guards.length} guards resolve from ${coverage.governing?.tree === "host" ? "scripts/lisa-hooks/" : "plugins/lisa/hooks/"} at lisa ${coverage.governing?.version ?? "?"}, with an apply receipt.`,
+        };
+    }
+    return {
+        name: CHECK_NAME,
+        status: "warn",
+        detail: `${notes.join("; ")}. Repair: \`${REPAIR}\`. ${FLEET_HINT}`,
+    };
+}
+//# sourceMappingURL=doctor-enforcement-coverage.js.map

package/dist/cli/doctor-enforcement-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-enforcement-coverage.js","sourceRoot":"","sources":["../../src/cli/doctor-enforcement-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE,MAAM,UAAU,GAAG,8CAA8C,CAAC;AAClE,MAAM,UAAU,GACd,uIAAuI,CAAC;AAC1I,MAAM,MAAM,GAAG,2BAA2B,CAAC;AAS3C;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;QAC7C,KAAK,EAAE,UAAU;QACjB,YAAY,EAAE,UAAU;QACxB,SAAS,EAAE,gBAAgB,EAAE;KAC9B,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,mBAAmB,QAAQ,CAAC,gBAAgB,IAAI,SAAS,uFAAuF;SACzJ,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,2NAA2N,MAAM,OAAO,UAAU,EAAE;SAC7P,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,QAAQ,CAAC,UAAU,KAAK,SAAS;YAC/B,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,gBAAgB,CAAC,MAAM,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,6BAA6B,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACpK,CAAC,CAAC,IAAI;QACR,QAAQ,CAAC,OAAO,KAAK,YAAY;YAC/B,CAAC,CAAC,qFAAqF;YACvF,CAAC,CAAC,IAAI;QACR,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAC3B,CAAC,CAAC,6BAA6B,QAAQ,CAAC,SAAS,EAAE,OAAO,IAAI,GAAG,YAAY,gBAAgB,EAAE,IAAI,kBAAkB,EAAE;YACvH,CAAC,CAAC,IAAI;QACR,QAAQ,CAAC,OAAO,CAAC,OAAO;YACtB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,wDAAwD;QAC5D,uBAAuB,CAAC,QAAQ,CAAC;YAC/B,CAAC,CAAC,gCAAgC,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,gCAAgC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,+EAA+E;YAClN,CAAC,CAAC,IAAI;KACT,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAElD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,wBAAwB,QAAQ,CAAC,SAAS,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB,YAAY,QAAQ,CAAC,SAAS,EAAE,OAAO,IAAI,GAAG,0BAA0B;SACzN,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,MAAM,OAAO,UAAU,EAAE;KACpE,CAAC;AACJ,CAAC"}

package/dist/cli/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAsBnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAWzD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,mDAAmD;AACnD,KAAK,YAAY,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAO3C,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,sCAAsC;AACtC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,cAAc,EAAE,OAAO,cAAc,CAAC;IACtC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,mBAAmB,EAAE,OAAO,mBAAmB,CAAC;CACjD;AAwBD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,EAChD,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CAyBtB;AA8JD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,aAAa,EACtB,YAAY,GAAE,OAAO,CAAC,kBAAkB,CAAM,GAC7C,OAAO,CAAC,YAAY,CAAC,CAoHvB"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAuBnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAWzD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,mDAAmD;AACnD,KAAK,YAAY,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAO3C,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,sCAAsC;AACtC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,cAAc,EAAE,OAAO,cAAc,CAAC;IACtC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,mBAAmB,EAAE,OAAO,mBAAmB,CAAC;CACjD;AAwBD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,EAChD,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CAyBtB;AA8JD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,aAAa,EACtB,YAAY,GAAE,OAAO,CAAC,kBAAkB,CAAM,GAC7C,OAAO,CAAC,YAAY,CAAC,CA4HvB"}

package/dist/cli/doctor.js

@@ -7,6 +7,7 @@ import { migrateInstructionFiles } from "../core/instruction-files-migration.js"
 import { probeKaneReadiness } from "../core/kane-cli.js";
 import { probeSonarReadiness } from "../core/sonar-integration.js";
 import { checkApplyFreshness, checkYamlRuntime, } from "./doctor-apply-freshness.js";
+import { checkEnforcementCoverage } from "./doctor-enforcement-coverage.js";
 import { checkLockfileReconciliation } from "./doctor-reconciliation.js";
 import { checkKaneProvider } from "./doctor-kane.js";
 import { checkLearningsLedger } from "./doctor-learnings-ledger.js";
@@ -247,6 +248,14 @@ export async function runDoctor(targetPath, options, dependencies = {}) {
         // consumers it never did, and the only symptom was a frozen-lockfile
         // failure in CI hours later (CodySwannGT/lisa#2750).
         await checkLockfileReconciliation(resolvedTarget),
+        // Third in the same run of questions, and the one nothing was asking. The
+        // two above ask whether apply ran and whether its lockfile repair landed;
+        // this asks whether the guards that apply writes actually RESOLVE here, and
+        // of what vintage. A checkout resolving none of them produces no output at
+        // all from inside a session, so "protected by an old policy" and "not
+        // protected" are indistinguishable there — which is how most of a fleet
+        // came to resolve nothing without anyone noticing (CodySwannGT/lisa#3490).
+        await checkEnforcementCoverage(resolvedTarget),
         checkYamlRuntime(),
         await checkProjectConfig(resolvedTarget),
         // Immediately after the config check, because it repairs the same file and

package/dist/cli/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAKnD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AACjE,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAmDpE;;;;GAIG;AACH,SAAS,sBAAsB;IAC7B,mHAAmH;IACnH,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC;AAED,MAAM,oBAAoB,GAAuB;IAC/C,SAAS,EAAE,KAAK;IAChB,GAAG,EAAE,sBAAsB,EAAE;IAC7B,cAAc;IACd,WAAW,EAAE,IAAI,CAAC,EAAE;QAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC;IACD,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACtC,kBAAkB;IAClB,mBAAmB;CACpB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAgD,EAChD,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,uCAAuC;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,aAAa,MAAM,CAAC,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE;SAClE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;YACnB,CAAC,CAAC,aAAa,MAAM,CAAC,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE;YAC3D,CAAC,CAAC,6BAA6B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;KAC9E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IAClD,MAAM,WAAW,GAAG,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;SACjE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;SAChD,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAEhD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,uDAAuD;SAChE,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,2BAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;aACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAAwB,EACxB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,+CAA+C;SACxD,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GACf,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,WAAW,GAA4B,WAAW;QACtD,CAAC,CAAC;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,sBAAsB,EAAE,YAAY;aACrC;SACF;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;QAC1C,MAAM,aAAa,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CACnC,gCAAgC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,EAC/D,WAAW,CACZ,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,GAAG,aAAa,SAAS,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpD,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;YAClE,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC9B,OAAO,GAAG,aAAa,eAAe,CAAC;YACzC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,aAAa,cAAc,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAE3E,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAC7C,MAAM,EACJ,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,OAAO;QACL,mBAAmB;QACnB,yBAAyB;QACzB,kBAAkB;QAClB,kBAAkB;KACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IACrD,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,mCAAmC;SAC5C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,MAAM,CAAC,OAAO;gBACpB,CAAC,CAAC,aAAa,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC1C,CAAC,CAAC,qEAAqE;SAC1E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,0CACN,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;SACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,UAA8B,EAC9B,OAAsB,EACtB,eAA4C,EAAE;IAE9C,MAAM,IAAI,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG;QACb,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;QAClD,4EAA4E;QAC5E,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,mBAAmB,CAAC,cAAc,CAAC;QACzC,oEAAoE;QACpE,yEAAyE;QACzE,sEAAsE;QACtE,qEAAqE;QACrE,qDAAqD;QACrD,MAAM,2BAA2B,CAAC,cAAc,CAAC;QACjD,gBAAgB,EAAE;QAClB,MAAM,kBAAkB,CAAC,cAAc,CAAC;QACxC,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,qCAAqC;QACrC,MAAM,qBAAqB,CAAC,cAAc,CAAC;QAC3C,mEAAmE;QACnE,yEAAyE;QACzE,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,qBAAqB,CAAC,cAAc,CAAC;QAC3C,MAAM,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC;QAC7C,MAAM,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC;QAC9C,MAAM,4BAA4B,CAAC,cAAc,CAAC;QAClD,MAAM,uBAAuB,CAAC,cAAc,CAAC;QAC7C,MAAM,yBAAyB,CAAC,cAAc,CAAC;QAC/C,qEAAqE;QACrE,2EAA2E;QAC3E,wEAAwE;QACxE,4DAA4D;QAC5D,2BAA2B;QAC3B,MAAM,sBAAsB,CAAC,cAAc,CAAC;QAC5C,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,oBAAoB,CAAC,cAAc,CAAC;QAC1C,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,oBAAoB,CAAC,cAAc,CAAC;QAC1C,MAAM,iBAAiB,CAAC,cAAc,CAAC;QACvC,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,iEAAiE;QACjE,2BAA2B;QAC3B,MAAM,2BAA2B,CAAC,cAAc,CAAC;QACjD,MAAM,gBAAgB,CAAC,cAAc,CAAC;QACtC,MAAM,qBAAqB,CAAC,cAAc,CAAC;QAC3C,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,eAAe;QACf,MAAM,oBAAoB,CAAC,cAAc,CAAC;QAC1C,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,iBAAiB,CAAC,cAAc,CAAC;QACvC,uEAAuE;QACvE,iEAAiE;QACjE,uEAAuE;QACvE,uEAAuE;QACvE,oDAAoD;QACpD,2BAA2B;QAC3B,MAAM,4BAA4B,CAAC,cAAc,CAAC;QAClD,MAAM,gBAAgB,CAAC,cAAc,CAAC;QACtC,uBAAuB,CAAC,cAAc,CAAC;QACvC,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,gCAAgC;QAChC,qEAAqE;QACrE,4EAA4E;QAC5E,MAAM,0BAA0B,CAAC,cAAc,CAAC;QAChD,oEAAoE;QACpE,2EAA2E;QAC3E,yEAAyE;QACzE,wCAAwC;QACxC,MAAM,mBAAmB,CAAC,cAAc,CAAC;QACzC,MAAM,oBAAoB,CAAC,cAAc,CAAC;QAC1C,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,uBAAuB,CAAC,cAAc,CAAC;QAC7C,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;QACxD,SAAS,CAAC,cAAc,CAAC;QACzB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI;YAC5B,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,cAAc,CAAC,CAAC;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,MAAM,EACN,cAAc,EACd,OAAO,EACP,IAAI,CAAC,KAAK,CACX,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAKnD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AACjE,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAmDpE;;;;GAIG;AACH,SAAS,sBAAsB;IAC7B,mHAAmH;IACnH,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC;AAED,MAAM,oBAAoB,GAAuB;IAC/C,SAAS,EAAE,KAAK;IAChB,GAAG,EAAE,sBAAsB,EAAE;IAC7B,cAAc;IACd,WAAW,EAAE,IAAI,CAAC,EAAE;QAClB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC;IACD,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACtC,kBAAkB;IAClB,mBAAmB;CACpB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAgD,EAChD,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,uCAAuC;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,aAAa,MAAM,CAAC,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE;SAClE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;YACnB,CAAC,CAAC,aAAa,MAAM,CAAC,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE;YAC3D,CAAC,CAAC,6BAA6B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;KAC9E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IAClD,MAAM,WAAW,GAAG,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;SACjE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;SAChD,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAEhD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,uDAAuD;SAChE,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,2BAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;aACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAAwB,EACxB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,+CAA+C;SACxD,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GACf,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,WAAW,GAA4B,WAAW;QACtD,CAAC,CAAC;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,6BAA6B;gBACrC,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,sBAAsB,EAAE,YAAY;aACrC;SACF;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;QAC1C,MAAM,aAAa,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CACnC,gCAAgC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,EAC/D,WAAW,CACZ,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,GAAG,aAAa,SAAS,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpD,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;YAClE,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC9B,OAAO,GAAG,aAAa,eAAe,CAAC;YACzC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,aAAa,cAAc,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAE3E,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAC7C,MAAM,EACJ,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,OAAO;QACL,mBAAmB;QACnB,yBAAyB;QACzB,kBAAkB;QAClB,kBAAkB;KACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB,CAAC,UAAkB;IACrD,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,mCAAmC;SAC5C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,MAAM,CAAC,OAAO;gBACpB,CAAC,CAAC,aAAa,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC1C,CAAC,CAAC,qEAAqE;SAC1E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,0CACN,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;SACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,UAA8B,EAC9B,OAAsB,EACtB,eAA4C,EAAE;IAE9C,MAAM,IAAI,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,YAAY,EAAE,CAAC;IAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG;QACb,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;QAClD,4EAA4E;QAC5E,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,mBAAmB,CAAC,cAAc,CAAC;QACzC,oEAAoE;QACpE,yEAAyE;QACzE,sEAAsE;QACtE,qEAAqE;QACrE,qDAAqD;QACrD,MAAM,2BAA2B,CAAC,cAAc,CAAC;QACjD,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,2EAA2E;QAC3E,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,wBAAwB,CAAC,cAAc,CAAC;QAC9C,gBAAgB,EAAE;QAClB,MAAM,kBAAkB,CAAC,cAAc,CAAC;QACxC,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,qCAAqC;QACrC,MAAM,qBAAqB,CAAC,cAAc,CAAC;QAC3C,mEAAmE;QACnE,yEAAyE;QACzE,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,qBAAqB,CAAC,cAAc,CAAC;QAC3C,MAAM,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC;QAC7C,MAAM,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC;QAC9C,MAAM,4BAA4B,CAAC,cAAc,CAAC;QAClD,MAAM,uBAAuB,CAAC,cAAc,CAAC;QAC7C,MAAM,yBAAyB,CAAC,cAAc,CAAC;QAC/C,qEAAqE;QACrE,2EAA2E;QAC3E,wEAAwE;QACxE,4DAA4D;QAC5D,2BAA2B;QAC3B,MAAM,sBAAsB,CAAC,cAAc,CAAC;QAC5C,2EAA2E;QAC3E,sEAAsE;QACtE,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,oBAAoB,CAAC,cAAc,CAAC;QAC1C,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,oBAAoB,CAAC,cAAc,CAAC;QAC1C,MAAM,iBAAiB,CAAC,cAAc,CAAC;QACvC,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,iEAAiE;QACjE,2BAA2B;QAC3B,MAAM,2BAA2B,CAAC,cAAc,CAAC;QACjD,MAAM,gBAAgB,CAAC,cAAc,CAAC;QACtC,MAAM,qBAAqB,CAAC,cAAc,CAAC;QAC3C,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,eAAe;QACf,MAAM,oBAAoB,CAAC,cAAc,CAAC;QAC1C,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,iBAAiB,CAAC,cAAc,CAAC;QACvC,uEAAuE;QACvE,iEAAiE;QACjE,uEAAuE;QACvE,uEAAuE;QACvE,oDAAoD;QACpD,2BAA2B;QAC3B,MAAM,4BAA4B,CAAC,cAAc,CAAC;QAClD,MAAM,gBAAgB,CAAC,cAAc,CAAC;QACtC,uBAAuB,CAAC,cAAc,CAAC;QACvC,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,gCAAgC;QAChC,qEAAqE;QACrE,4EAA4E;QAC5E,MAAM,0BAA0B,CAAC,cAAc,CAAC;QAChD,oEAAoE;QACpE,2EAA2E;QAC3E,yEAAyE;QACzE,wCAAwC;QACxC,MAAM,mBAAmB,CAAC,cAAc,CAAC;QACzC,MAAM,oBAAoB,CAAC,cAAc,CAAC;QAC1C,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,uBAAuB,CAAC,cAAc,CAAC;QAC7C,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;QACxD,SAAS,CAAC,cAAc,CAAC;QACzB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,IAAI;YAC5B,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,cAAc,CAAC,CAAC;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,MAAM,EACN,cAAc,EACd,OAAO,EACP,IAAI,CAAC,KAAK,CACX,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/enforcement-census-report.d.ts

@@ -0,0 +1,19 @@
+import type { FleetCensus } from "./enforcement-census.js";
+/**
+ * Replace every real path in a census with a stable anonymous label.
+ *
+ * The paths this census reads name real local checkouts, and they embed client
+ * and product names that must never reach a public issue, PR, or commit. The
+ * counts and the per-checkout rows survive redaction intact, so a fleet finding
+ * loses nothing by being quoted safely.
+ * @param census - A measured fleet
+ * @returns The same fleet with paths replaced by derived labels
+ */
+export declare function redactCensus(census: FleetCensus): FleetCensus;
+/**
+ * Render the whole census for a terminal.
+ * @param census - A measured fleet
+ * @returns The report
+ */
+export declare function renderFleetCensusReport(census: FleetCensus): string;
+//# sourceMappingURL=enforcement-census-report.d.ts.map

package/dist/core/enforcement-census-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement-census-report.d.ts","sourceRoot":"","sources":["../../src/core/enforcement-census-report.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAiB3D;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CA6B7D;AAyJD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAgBnE"}