@codyswann/lisa 2.277.4 → 2.279.0

package/dist/cli/doctor-readiness-release-path.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Release-path assessment for the delivery/authority readiness dimension — ship
+ * blocker B2 (PRD #1739, #1896).
+ *
+ * B2 asks whether the thing that ships equals the thing that was validated. The
+ * question is answered offline, from the workflow files alone, which imposes a
+ * hard discipline: **absence of evidence is not evidence of a bypass.** A
+ * reusable `workflow_call` publish workflow has no validating job of its own
+ * because validation is the caller's obligation; a `workflow_run`-triggered
+ * deploy is gated by the upstream workflow that fired it; a default-branch push
+ * may be gated by branch protection. None of those are visible here, so none of
+ * them may be reported as a violation.
+ *
+ * The rule is therefore: stand B2 only when the bypass is provable from the file
+ * alone — a job that self-builds AND publishes with no validating ancestor, in a
+ * workflow whose trigger makes in-file validation the expected place for it
+ * (a tag push, `workflow_dispatch`, `schedule`, a non-default-branch push, or an
+ * unstated trigger). Everything else that cannot be settled offline returns a
+ * stated-reason SKIP, never a FAIL.
+ * @module cli/doctor-readiness-release-path
+ */
+import type { ParsedWorkflow, ParsedWorkflowJob, ParsedWorkflowStep } from "./doctor-readiness-workflows.js";
+/** The action that promotes the artifact CI already built and validated. */
+export declare const PROMOTION_ACTION = "actions/download-artifact";
+/** What assessing one publishing job established. */
+export type ReleasePathOutcome = 
+/** The bypass is provable from this file alone. */
+{
+    readonly kind: "violation";
+    readonly evidence: string;
+}
+/** The proof, if any, lives somewhere not resolvable offline. */
+ | {
+    readonly kind: "unresolved";
+    readonly reason: string;
+}
+/** Validation provably precedes the publish, or the artifact is promoted. */
+ | {
+    readonly kind: "clean";
+};
+/**
+ * Describe a step for persisted evidence: prefer its `name`, else the first
+ * non-empty line of its `run`, truncated. A raw multi-line `run` would dump a
+ * shell script into `.lisa/readiness.json` and into an operator's face.
+ * @param step - The step to describe
+ * @returns A single-line label, at most {@link MAX_STEP_LABEL} characters
+ */
+export declare function describeStep(step: ParsedWorkflowStep): string;
+/**
+ * Find the first step in a job that ships something.
+ * @param job - The parsed job
+ * @returns The publishing step, or undefined when the job ships nothing
+ */
+export declare function findPublishStep(job: ParsedWorkflowJob): ParsedWorkflowStep | undefined;
+/**
+ * Assess one job's release path against B2.
+ * @param workflow - The workflow declaring the job
+ * @param job - The job to assess
+ * @returns What this job established, or undefined when it ships nothing
+ */
+export declare function assessReleasePath(workflow: ParsedWorkflow, job: ParsedWorkflowJob): ReleasePathOutcome | undefined;
+//# sourceMappingURL=doctor-readiness-release-path.d.ts.map

package/dist/cli/doctor-readiness-release-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-release-path.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-release-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AA+CzC,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAQ5D,qDAAqD;AACrD,MAAM,MAAM,kBAAkB;AAC5B,mDAAmD;AACjD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC3D,iEAAiE;GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC1D,6EAA6E;GAC3E;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE/B;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAW7D;AAqBD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,iBAAiB,GACrB,kBAAkB,GAAG,SAAS,CAEhC;AAsJD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,iBAAiB,GACrB,kBAAkB,GAAG,SAAS,CAyBhC"}

package/dist/cli/doctor-readiness-release-path.js

@@ -0,0 +1,275 @@
+/** Commands that put an artifact in front of users. */
+const PUBLISH_VERBS = [
+    "npm publish",
+    "docker push",
+    "gh release upload",
+    "aws s3 sync",
+    "cdk deploy",
+    "eas submit",
+];
+/**
+ * Commands that actually run a test suite. Deliberately narrow: the invariant B2
+ * protects is "this artifact was *tested*", and a loose substring match (`echo
+ * "test the release notes"`, or a lint step) would manufacture false
+ * reassurance — the wrong direction to err for a gate.
+ */
+const VALIDATING_COMMANDS = [
+    /\b(npm|yarn|pnpm|bun|npx|bunx)\s+(run\s+)?test\b/,
+    /\btest:[\w:-]+/,
+    /\b(vitest|jest|pytest|rspec|phpunit|minitest)\b/,
+    /\b(go|cargo|mvn|gradle|make|dotnet)\s+test\b/,
+];
+/**
+ * Whether a shell command runs a test suite.
+ * @param run - The step's `run` text
+ * @returns True when the command matches a known test invocation
+ */
+function isValidatingCommand(run) {
+    return VALIDATING_COMMANDS.some(pattern => pattern.test(run));
+}
+/** Reusable workflows whose whole purpose is validation. */
+const VALIDATING_WORKFLOW = /(quality|quality-rails|test|ci)\.ya?ml/;
+/** Commands that produce an artifact locally, inside the shipping job. */
+const LOCAL_BUILD_COMMAND = /\b(npm pack|npm run build|yarn build|bun run build|bun run build:\w+|pnpm build|docker build|tsc)\b/;
+/** A publish argument naming a local path rather than a registry coordinate. */
+const LOCAL_PATH_ARGUMENT = /\s\.{0,2}\//;
+/** A publish argument naming a packaged artifact file on disk. */
+const LOCAL_ARTIFACT_FILE = /\.(tgz|tar\.gz|zip|whl)\b/;
+/** The action that promotes the artifact CI already built and validated. */
+export const PROMOTION_ACTION = "actions/download-artifact";
+/** Branch names treated as the repository's default branch. */
+const DEFAULT_BRANCHES = new Set(["main", "master"]);
+/** Longest step description carried into persisted evidence. */
+const MAX_STEP_LABEL = 80;
+/**
+ * Describe a step for persisted evidence: prefer its `name`, else the first
+ * non-empty line of its `run`, truncated. A raw multi-line `run` would dump a
+ * shell script into `.lisa/readiness.json` and into an operator's face.
+ * @param step - The step to describe
+ * @returns A single-line label, at most {@link MAX_STEP_LABEL} characters
+ */
+export function describeStep(step) {
+    const source = step.name.trim() !== ""
+        ? step.name.trim()
+        : (step.run
+            .split("\n")
+            .find(line => line.trim() !== "")
+            ?.trim() ?? "");
+    return source.length > MAX_STEP_LABEL
+        ? `${source.slice(0, MAX_STEP_LABEL).trimEnd()}…`
+        : source;
+}
+/**
+ * A rehearsal flag: the command goes through the motions and ships nothing.
+ */
+const DRY_RUN_FLAG = /--dry[-_]?run\b/;
+/**
+ * Whether a step actually puts an artifact in front of users. A `--dry-run`
+ * invocation names a publish verb but ships nothing, so faulting its release
+ * path would be a finding about something that cannot reach anyone.
+ * @param step - The step to classify
+ * @returns True when the step really publishes
+ */
+function isPublishStep(step) {
+    return (PUBLISH_VERBS.some(verb => step.run.includes(verb)) &&
+        !DRY_RUN_FLAG.test(step.run));
+}
+/**
+ * Find the first step in a job that ships something.
+ * @param job - The parsed job
+ * @returns The publishing step, or undefined when the job ships nothing
+ */
+export function findPublishStep(job) {
+    return job.steps.find(isPublishStep);
+}
+/**
+ * Whether a job proves anything about the artifact.
+ * @param job - The parsed job
+ * @returns True when the job runs a test suite or calls a validating workflow
+ */
+function isValidatingJob(job) {
+    if (job.uses !== "" && VALIDATING_WORKFLOW.test(job.uses)) {
+        return true;
+    }
+    return job.steps.some(step => isValidatingCommand(step.run) ||
+        (step.uses !== "" && VALIDATING_WORKFLOW.test(step.uses)));
+}
+/**
+ * Walk a job's transitive `needs:` closure within its workflow. The `seen` list
+ * makes a `needs:` cycle terminate instead of recursing forever.
+ * @param workflow - The workflow declaring the job
+ * @param job - The job whose ancestors to resolve
+ * @returns Every job the given job transitively depends on
+ */
+function ancestorJobs(workflow, job) {
+    const byId = new Map(workflow.jobs.map(entry => [entry.id, entry]));
+    const walk = (ids, seen) => {
+        const fresh = ids.filter(id => !seen.includes(id));
+        if (fresh.length === 0) {
+            return [];
+        }
+        const jobs = fresh.flatMap(id => {
+            const ancestor = byId.get(id);
+            return ancestor ? [ancestor] : [];
+        });
+        return [
+            ...jobs,
+            ...walk(jobs.flatMap(ancestor => ancestor.needs), [...seen, ...fresh]),
+        ];
+    };
+    return walk(job.needs, []);
+}
+/**
+ * Whether validation provably precedes the publish: either an ancestor job
+ * validated, or a step earlier in this same job did.
+ * @param workflow - The workflow declaring the job
+ * @param job - The publishing job
+ * @param publishStep - The step that ships
+ * @returns True when something was proved before the artifact left
+ */
+function validationPrecedesPublish(workflow, job, publishStep) {
+    if (ancestorJobs(workflow, job).some(isValidatingJob)) {
+        return true;
+    }
+    return job.steps
+        .slice(0, job.steps.indexOf(publishStep))
+        .some(step => isValidatingCommand(step.run));
+}
+/**
+ * Whether the job ships an artifact it produced itself rather than promoting the
+ * one CI built and validated. Downloading the CI artifact only exempts the job
+ * when nothing rebuilds *after* the download — a rebuild past the promotion is
+ * the very bypass B2 exists to catch.
+ * @param job - The publishing job
+ * @param publishStep - The step that ships
+ * @returns True when a self-built artifact is shipped
+ */
+function shipsSelfBuiltArtifact(job, publishStep) {
+    const downloadIndex = job.steps.findIndex(step => step.uses.includes(PROMOTION_ACTION));
+    if (downloadIndex >= 0) {
+        const rebuildsAfterDownload = job.steps
+            .slice(downloadIndex + 1)
+            .some(step => LOCAL_BUILD_COMMAND.test(step.run));
+        if (!rebuildsAfterDownload) {
+            return false;
+        }
+    }
+    return (LOCAL_PATH_ARGUMENT.test(publishStep.run) ||
+        LOCAL_ARTIFACT_FILE.test(publishStep.run) ||
+        job.steps.some(step => LOCAL_BUILD_COMMAND.test(step.run)));
+}
+/**
+ * Decide whether a workflow's trigger makes in-file validation the expected
+ * place for it — the only case where absent validation proves a bypass.
+ * @param workflow - The workflow to classify
+ * @returns The reason validation may live elsewhere, or null when it must be here
+ */
+function offlineUnresolvableTrigger(workflow) {
+    const events = workflow.on.events;
+    if (events.length > 0 && events.every(event => event === "workflow_call")) {
+        return ("it is a reusable `workflow_call` workflow, so validation is the calling " +
+            "workflow's obligation and callers are not resolved offline");
+    }
+    if (events.includes("workflow_run")) {
+        return ("it is triggered by `workflow_run`, so the validating workflow that fired " +
+            "it runs upstream and is not resolved offline");
+    }
+    if (events.includes("release")) {
+        return ("it is triggered by a `release` event, so validation may have run on the " +
+            "commit or tag the release was cut from, which is not visible in this file");
+    }
+    // An unfiltered `on: [push]` is a SUPERSET of a default-branch push, so it
+    // cannot be treated more strictly than the spelling that names the branch.
+    const unfilteredPush = workflow.on.events.includes("push") &&
+        workflow.on.pushBranches.length === 0 &&
+        workflow.on.pushTags.length === 0;
+    const defaultBranchPush = workflow.on.pushBranches.some(branch => DEFAULT_BRANCHES.has(branch));
+    if (unfilteredPush || defaultBranchPush) {
+        return ("it is triggered by a push to the default branch, where branch protection " +
+            "may already require the validating checks — a rule that is not visible " +
+            "in this file");
+    }
+    return null;
+}
+/**
+ * Assess one job's release path against B2.
+ * @param workflow - The workflow declaring the job
+ * @param job - The job to assess
+ * @returns What this job established, or undefined when it ships nothing
+ */
+export function assessReleasePath(workflow, job) {
+    const publishStep = findPublishStep(job);
+    if (!publishStep) {
+        return undefined;
+    }
+    const where = `${workflow.file} job \`${job.id}\` step \`${describeStep(publishStep)}\``;
+    const validated = validationPrecedesPublish(workflow, job, publishStep);
+    if (shipsSelfBuiltArtifact(job, publishStep)) {
+        return validated
+            ? rebuildPastValidation(where)
+            : unvalidatedSelfBuild(where, workflow);
+    }
+    if (validated || promotesValidatedArtifact(job)) {
+        return { kind: "clean" };
+    }
+    // Neither built here nor promoted from CI, and nothing validating precedes it:
+    // the link between what ships and what was validated is simply not observable
+    // in this file. That is unestablished, not clean.
+    return {
+        kind: "unresolved",
+        reason: `${where} neither builds its own artifact nor promotes a CI-built one via ` +
+            `\`${PROMOTION_ACTION}\`, and no validating job precedes it, so what it ` +
+            "ships cannot be tied to anything that was validated",
+    };
+}
+/**
+ * The provable bypass that survives every trigger: the pipeline validated the
+ * source, then the release job rebuilt and shipped its own artifact. Whatever
+ * ran upstream, the bytes that reached users are not the bytes that were
+ * checked — so no trigger exempts this.
+ * @param where - Evidence location label
+ * @returns The violation outcome
+ */
+function rebuildPastValidation(where) {
+    return {
+        kind: "violation",
+        evidence: `${where} rebuilds and ships its own artifact after validation ran — the ` +
+            "pipeline proved things about the source tree, then shipped bytes that " +
+            `were produced afterwards and never validated. Promote the CI-built ` +
+            `artifact via \`${PROMOTION_ACTION}\` instead of repacking at release time`,
+    };
+}
+/**
+ * A self-built, self-shipped artifact with nothing validating in front of it:
+ * a violation when the trigger makes in-file validation the expected place, and
+ * a stated-reason SKIP when the proof could live somewhere not visible offline.
+ * @param where - Evidence location label
+ * @param workflow - The workflow declaring the job
+ * @returns The violation or unresolved outcome
+ */
+function unvalidatedSelfBuild(where, workflow) {
+    const unresolvable = offlineUnresolvableTrigger(workflow);
+    if (unresolvable !== null) {
+        return {
+            kind: "unresolved",
+            reason: `${where} builds and ships its own artifact with no validating job in ` +
+                `its \`needs:\` closure, but ${unresolvable}. Whether what ships equals ` +
+                "what was validated is therefore not established either way",
+        };
+    }
+    return {
+        kind: "violation",
+        evidence: `${where} builds its own artifact and ships it with no validating job in ` +
+            `its \`needs:\` closure and no \`${PROMOTION_ACTION}\` promotion of the ` +
+            "CI-built one — nothing was proved about the bytes that reached users",
+    };
+}
+/**
+ * Whether the job promotes the artifact CI already built and validated.
+ * @param job - The publishing job
+ * @returns True when a download-artifact step is present
+ */
+function promotesValidatedArtifact(job) {
+    return job.steps.some(step => step.uses.includes(PROMOTION_ACTION));
+}
+//# sourceMappingURL=doctor-readiness-release-path.js.map

package/dist/cli/doctor-readiness-release-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-release-path.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-release-path.ts"],"names":[],"mappings":"AA2BA,uDAAuD;AACvD,MAAM,aAAa,GAAG;IACpB,aAAa;IACb,aAAa;IACb,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,YAAY;CACb,CAAC;AAEF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAsB;IAC7C,kDAAkD;IAClD,gBAAgB;IAChB,iDAAiD;IACjD,8CAA8C;CAC/C,CAAC;AAEF;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,wCAAwC,CAAC;AAErE,0EAA0E;AAC1E,MAAM,mBAAmB,GACvB,qGAAqG,CAAC;AAExG,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAE1C,kEAAkE;AAClE,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAExD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,+DAA+D;AAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD,gEAAgE;AAChE,MAAM,cAAc,GAAG,EAAE,CAAC;AAW1B;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAwB;IACnD,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QACrB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAClB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG;aACN,KAAK,CAAC,IAAI,CAAC;aACX,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACjC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,MAAM,GAAG,cAAc;QACnC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG;QACjD,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAEvC;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAwB;IAC7C,OAAO,CACL,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAsB;IAEtB,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAsB;IAC7C,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CACnB,IAAI,CAAC,EAAE,CACL,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,QAAwB,EACxB,GAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,CACX,GAAsB,EACtB,IAAuB,EACO,EAAE;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO;YACL,GAAG,IAAI;YACP,GAAG,IAAI,CACL,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EACxC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CACpB;SACF,CAAC;IACJ,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB,CAChC,QAAwB,EACxB,GAAsB,EACtB,WAA+B;IAE/B,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,KAAK;SACb,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SACxC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAC7B,GAAsB,EACtB,WAA+B;IAE/B,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC/C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACrC,CAAC;IACF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,qBAAqB,GAAG,GAAG,CAAC,KAAK;aACpC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,CACL,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QACzC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QACzC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,QAAwB;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,eAAe,CAAC,EAAE,CAAC;QAC1E,OAAO,CACL,0EAA0E;YAC1E,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,OAAO,CACL,2EAA2E;YAC3E,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,CACL,0EAA0E;YAC1E,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,cAAc,GAClB,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QACrC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IACpC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAC/D,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAC7B,CAAC;IACF,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;QACxC,OAAO,CACL,2EAA2E;YAC3E,yEAAyE;YACzE,cAAc,CACf,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAwB,EACxB,GAAsB;IAEtB,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,aAAa,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC;IACzF,MAAM,SAAS,GAAG,yBAAyB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACxE,IAAI,sBAAsB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7C,OAAO,SAAS;YACd,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC;YAC9B,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,SAAS,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,+EAA+E;IAC/E,8EAA8E;IAC9E,kDAAkD;IAClD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EACJ,GAAG,KAAK,mEAAmE;YAC3E,KAAK,gBAAgB,oDAAoD;YACzE,qDAAqD;KACxD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ,EACN,GAAG,KAAK,kEAAkE;YAC1E,wEAAwE;YACxE,qEAAqE;YACrE,kBAAkB,gBAAgB,yCAAyC;KAC9E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,KAAa,EACb,QAAwB;IAExB,MAAM,YAAY,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EACJ,GAAG,KAAK,+DAA+D;gBACvE,+BAA+B,YAAY,8BAA8B;gBACzE,4DAA4D;SAC/D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ,EACN,GAAG,KAAK,kEAAkE;YAC1E,mCAAmC,gBAAgB,sBAAsB;YACzE,sEAAsE;KACzE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,GAAsB;IACvD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/cli/doctor-readiness-types.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The shared readiness record vocabulary (PRD #1739, #1896).
+ *
+ * Every readiness producer — the journey wiring, the delivery/authority
+ * producers, and the collector's own reasoned-SKIP fallback — returns the same
+ * per-dimension record. Defining that shape once here is what keeps the
+ * collector able to dispatch to any producer by dimension id: a second, drifting
+ * copy of this type would make one producer's record silently incompatible with
+ * the report the collector persists.
+ * @module cli/doctor-readiness-types
+ */
+/** Per-dimension status, mirroring the shared doctor `DOCTOR_STATUSES`. */
+export type ReadinessStatus = "PASS" | "WARN" | "FAIL" | "SKIP";
+/** A persisted per-dimension record inside `.lisa/readiness.json`. */
+export interface ReadinessDimensionRecord {
+    readonly id: string;
+    readonly status: ReadinessStatus;
+    /**
+     * Findings are intentionally untyped: they are persisted as JSON and read
+     * back by the blocker engine, which coerces them itself. Producers may attach
+     * extra rubric fields without a schema bump.
+     */
+    readonly findings: readonly unknown[];
+}
+//# sourceMappingURL=doctor-readiness-types.d.ts.map

package/dist/cli/doctor-readiness-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-types.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhE,sEAAsE;AACtE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;CACvC"}

package/dist/cli/doctor-readiness-types.js

@@ -0,0 +1,13 @@
+/**
+ * The shared readiness record vocabulary (PRD #1739, #1896).
+ *
+ * Every readiness producer — the journey wiring, the delivery/authority
+ * producers, and the collector's own reasoned-SKIP fallback — returns the same
+ * per-dimension record. Defining that shape once here is what keeps the
+ * collector able to dispatch to any producer by dimension id: a second, drifting
+ * copy of this type would make one producer's record silently incompatible with
+ * the report the collector persists.
+ * @module cli/doctor-readiness-types
+ */
+export {};
+//# sourceMappingURL=doctor-readiness-types.js.map

package/dist/cli/doctor-readiness-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-types.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/cli/doctor-readiness-workflows.d.ts

@@ -0,0 +1,64 @@
+/**
+ * A `permissions`/`secrets` declaration: GitHub allows either a map of scopes
+ * or a bare scalar (`write-all`, `read-all`, `inherit`); `null` means the block
+ * was not declared at all, which is itself load-bearing evidence.
+ */
+export type WorkflowBlock = Record<string, unknown> | string | null;
+/**
+ * A workflow's `on:` trigger block, normalized across its three legal spellings
+ * (scalar, list, map). The trigger is load-bearing for readiness: it decides
+ * whether the *absence* of an in-file validating job proves a bypass or merely
+ * means the proof lives somewhere this parser cannot see.
+ */
+export interface ParsedWorkflowTrigger {
+    /** Declared event names, e.g. `push`, `workflow_call`, `workflow_run`. */
+    readonly events: readonly string[];
+    /** Branch filters on a `push` trigger (empty when unfiltered or absent). */
+    readonly pushBranches: readonly string[];
+    /** Tag filters on a `push` trigger (empty when unfiltered or absent). */
+    readonly pushTags: readonly string[];
+}
+/** One step inside a parsed workflow job. */
+export interface ParsedWorkflowStep {
+    readonly name: string;
+    /** The shell command the step runs, or `""` for an action step. */
+    readonly run: string;
+    /** The action the step uses, or `""` for a `run` step. */
+    readonly uses: string;
+    /** Raw serialized `env` + `with` text, used for credential evidence. */
+    readonly inputs: string;
+}
+/** One job inside a parsed workflow. */
+export interface ParsedWorkflowJob {
+    readonly id: string;
+    /** Repo-relative path of the workflow file declaring this job. */
+    readonly workflow: string;
+    readonly needs: readonly string[];
+    readonly steps: readonly ParsedWorkflowStep[];
+    /** The reusable workflow this job calls, or `""` when it runs steps. */
+    readonly uses: string;
+    /** Job-level `permissions`: a map, a scalar such as `write-all`, or null. */
+    readonly permissions: WorkflowBlock;
+    /** Job-level `secrets`: a map, the scalar `inherit`, or null. */
+    readonly secrets: WorkflowBlock;
+    /** Declared deployment environments (a scalar or list, normalized). */
+    readonly environment: readonly string[];
+}
+/** One parsed `.github/workflows/*.yml` file. */
+export interface ParsedWorkflow {
+    /** Repo-relative path, always with forward slashes. */
+    readonly file: string;
+    readonly name: string;
+    /** Workflow-level `permissions`: a map, a scalar, or null. */
+    readonly permissions: WorkflowBlock;
+    /** The normalized `on:` trigger block. */
+    readonly on: ParsedWorkflowTrigger;
+    readonly jobs: readonly ParsedWorkflowJob[];
+}
+/**
+ * Read and parse every `.github/workflows/*.yml` file in a repository, offline.
+ * @param root - Repository root
+ * @returns Parsed workflows in stable file-name order (empty when there are none)
+ */
+export declare function parseRepositoryWorkflows(root: string): Promise<readonly ParsedWorkflow[]>;
+//# sourceMappingURL=doctor-readiness-workflows.d.ts.map

package/dist/cli/doctor-readiness-workflows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-workflows.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-workflows.ts"],"names":[],"mappings":"AAwBA;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC9C,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;IACpC,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;IACpC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,EAAE,qBAAqB,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC7C;AA0LD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAQpC"}

package/dist/cli/doctor-readiness-workflows.js

@@ -0,0 +1,198 @@
+/**
+ * Offline GitHub Actions workflow parser for the readiness producers
+ * (PRD #1739, #1896).
+ *
+ * The delivery/authority readiness questions — does the thing that ships equal
+ * the thing that was validated, and does the shipping credential carry only the
+ * authority it needs — are answered from what the repository's CI *declares*,
+ * not from what a live API reports. Parsing is therefore deliberately offline by
+ * construction: nothing in this module reaches the network, so `lisa doctor
+ * --offline --readiness` needs no flag threading to stay honest.
+ *
+ * Reading is best-effort by design. A workflow file that cannot be parsed is
+ * skipped rather than aborting the readiness run, because one malformed YAML
+ * file must not turn the whole report into an error the operator cannot act on.
+ * @module cli/doctor-readiness-workflows
+ */
+import { readdir, readFile } from "node:fs/promises";
+import * as path from "node:path";
+import yaml from "js-yaml";
+import { isJsonObject } from "../sync/json-path.js";
+/** The workflows directory every GitHub repository declares its CI in. */
+const WORKFLOWS_DIR = path.join(".github", "workflows");
+/**
+ * Normalize a YAML scalar-or-list into a list of trimmed strings.
+ * @param value - Candidate YAML value
+ * @returns Normalized string list (empty when unreadable)
+ */
+function asStringList(value) {
+    if (typeof value === "string") {
+        return value.trim() === "" ? [] : [value.trim()];
+    }
+    if (Array.isArray(value)) {
+        return value
+            .filter((entry) => typeof entry === "string")
+            .map(entry => entry.trim())
+            .filter(entry => entry !== "");
+    }
+    return [];
+}
+/**
+ * Normalize a `permissions`/`secrets` block, which GitHub allows as either a
+ * map or a bare scalar (`write-all`, `read-all`, `inherit`).
+ * @param value - Candidate YAML value
+ * @returns The map, the scalar string, or null when absent
+ */
+function asBlock(value) {
+    if (typeof value === "string") {
+        return value.trim();
+    }
+    return isJsonObject(value) ? value : null;
+}
+/**
+ * Normalize a job's `environment`, which may be a scalar name, a list, or a
+ * `{ name, url }` map.
+ * @param value - Candidate YAML value
+ * @returns Declared environment names
+ */
+function asEnvironments(value) {
+    if (isJsonObject(value)) {
+        return typeof value.name === "string" ? [value.name.trim()] : [];
+    }
+    return asStringList(value);
+}
+/**
+ * Normalize the `on:` block, which GitHub accepts as a scalar (`on: push`), a
+ * list (`on: [push, workflow_dispatch]`), or a map with per-event filters.
+ * @param value - Candidate YAML `on` value
+ * @returns The normalized trigger (all fields empty when absent or unreadable)
+ */
+function parseTrigger(value) {
+    if (!isJsonObject(value)) {
+        return { events: asStringList(value), pushBranches: [], pushTags: [] };
+    }
+    const push = value.push;
+    const filters = isJsonObject(push) ? push : undefined;
+    return {
+        events: Object.keys(value),
+        pushBranches: asStringList(filters?.branches),
+        pushTags: asStringList(filters?.tags),
+    };
+}
+/**
+ * Serialize a step's `env` and `with` blocks to searchable text so credential
+ * evidence can quote the offending line without a second traversal.
+ * @param step - The raw step object
+ * @returns Flattened `key: value` text, one pair per line
+ */
+function serializeStepInputs(step) {
+    return ["env", "with"]
+        .flatMap(key => {
+        const block = step[key];
+        return isJsonObject(block) ? Object.entries(block) : [];
+    })
+        .map(([name, value]) => `${name}: ${typeof value === "string" ? value : String(value)}`)
+        .join("\n");
+}
+/**
+ * Parse one job's `steps` list.
+ * @param value - Candidate YAML `steps` value
+ * @returns Normalized steps
+ */
+function parseSteps(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter(isJsonObject).map(step => ({
+        name: typeof step.name === "string" ? step.name : "",
+        run: typeof step.run === "string" ? step.run.trim() : "",
+        uses: typeof step.uses === "string" ? step.uses.trim() : "",
+        inputs: serializeStepInputs(step),
+    }));
+}
+/**
+ * Parse the `jobs` map of one workflow document.
+ * @param document - Parsed workflow root
+ * @param file - Repo-relative workflow path (stamped on each job)
+ * @returns Normalized jobs, in declaration order
+ */
+function parseJobs(document, file) {
+    const jobs = document.jobs;
+    if (!isJsonObject(jobs)) {
+        return [];
+    }
+    return Object.entries(jobs).flatMap(([id, raw]) => {
+        if (!isJsonObject(raw)) {
+            return [];
+        }
+        const job = raw;
+        return [
+            {
+                id,
+                workflow: file,
+                needs: asStringList(job.needs),
+                steps: parseSteps(job.steps),
+                uses: typeof job.uses === "string" ? job.uses.trim() : "",
+                permissions: asBlock(job.permissions),
+                secrets: asBlock(job.secrets),
+                environment: asEnvironments(job.environment),
+            },
+        ];
+    });
+}
+/**
+ * List the workflow files a repository declares, in stable name order.
+ * @param root - Repository root
+ * @returns Workflow file names, or an empty list when the directory is absent
+ */
+async function listWorkflowFiles(root) {
+    try {
+        const entries = await readdir(path.join(root, WORKFLOWS_DIR));
+        return entries
+            .filter(entry => entry.endsWith(".yml") || entry.endsWith(".yaml"))
+            .sort((a, b) => a.localeCompare(b));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Parse one workflow file, returning null when it cannot be read or parsed.
+ * @param root - Repository root
+ * @param fileName - Workflow file name
+ * @returns The parsed workflow, or null
+ */
+async function parseOneWorkflow(root, fileName) {
+    const file = `${WORKFLOWS_DIR.split(path.sep).join("/")}/${fileName}`;
+    try {
+        const source = await readFile(path.join(root, WORKFLOWS_DIR, fileName), "utf8");
+        const document = yaml.load(source);
+        if (!isJsonObject(document)) {
+            return null;
+        }
+        const record = document;
+        return {
+            file,
+            name: typeof record.name === "string" ? record.name : fileName,
+            permissions: asBlock(record.permissions),
+            on: parseTrigger(record.on),
+            jobs: parseJobs(record, file),
+        };
+    }
+    catch {
+        // A malformed workflow is skipped, never fatal: one bad file must not turn
+        // the readiness report into an error the operator cannot act on.
+        return null;
+    }
+}
+/**
+ * Read and parse every `.github/workflows/*.yml` file in a repository, offline.
+ * @param root - Repository root
+ * @returns Parsed workflows in stable file-name order (empty when there are none)
+ */
+export async function parseRepositoryWorkflows(root) {
+    const fileNames = await listWorkflowFiles(root);
+    const parsed = await Promise.all(fileNames.map(async (fileName) => await parseOneWorkflow(root, fileName)));
+    return parsed.filter((workflow) => workflow !== null);
+}
+//# sourceMappingURL=doctor-readiness-workflows.js.map