@codyswann/lisa 2.279.2 → 2.280.0

package/dist/cli/doctor-readiness-supply-chain-scan.js

@@ -0,0 +1,316 @@
+/**
+ * Offline supply-chain scanning for the dependencies/supply-chain readiness
+ * producer (B5, PRD #1739, #1896).
+ *
+ * The B5 question — does belief that the owned surface still works rest on more
+ * than hope — is answered from four repository facts: a committed lockfile, the
+ * dependency specs the manifest names, whether anything anywhere audits the
+ * tree, and whether each audit exception carries the decision behind it. This
+ * module gathers those facts; its sibling turns them into the rubric-shaped
+ * dimension record. Splitting them keeps each file inside the repository's
+ * file-size budget and keeps the gathering independently testable.
+ *
+ * Reading is offline and best-effort by construction: an unreadable file
+ * establishes nothing and is passed over, never reported as a violation.
+ * @module cli/doctor-readiness-supply-chain-scan
+ */
+import { readdir } from "node:fs/promises";
+import * as path from "node:path";
+import { isRecord, readFileOrNull } from "./doctor-readiness-shared.js";
+/**
+ * Every lockfile spelling a JavaScript package manager writes. One of these
+ * being committed is what makes two installs resolve to the same tree.
+ */
+export const LOCKFILES = [
+    "bun.lock",
+    "bun.lockb",
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "yarn.lock",
+    "pnpm-lock.yaml",
+];
+/**
+ * Manifest blocks whose specs must name a version. `peerDependencies` is
+ * deliberately excluded: `*` there is the conventional way to say "any host
+ * version works", not a floating install.
+ */
+const VERSIONED_BLOCKS = [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "overrides",
+    "resolutions",
+];
+/**
+ * Specs that resolve to whatever is newest at install time. Deliberately narrow:
+ * a `>=` floor in `overrides` is the recommended way to force a patched
+ * transitive dependency, so treating ranges as floating would fault the very
+ * remediation the audit gate asks for.
+ */
+const FLOATING_SPECS = new Set([
+    "",
+    "*",
+    "x",
+    "X",
+    "*.*",
+    "*.*.*",
+    "latest",
+    "next",
+    "*.x",
+]);
+/**
+ * Protocols that resolve to something inside this repository rather than to a
+ * published version, so there is nothing to pin and nothing to drift.
+ */
+const LOCAL_PROTOCOLS = [
+    "workspace:",
+    "file:",
+    "link:",
+    "portal:",
+];
+/**
+ * Protocols that clone a source tree. Without a ref these resolve to whatever
+ * the default branch holds at install time, which is the drift B5 cares about.
+ * Each alternative ends in `:` or `+` on purpose — a colonless `bitbucket`
+ * alternative would match the ordinary registry package `bitbucket-client`.
+ */
+const GIT_FETCH_PROTOCOL = /^(github:|gitlab:|bitbucket:|git\+|git:)/i;
+/** An `http(s)` spec, which may clone a repository or download an archive. */
+const HTTP_SPEC = /^https?:\/\//i;
+/**
+ * Whether a source-fetch spec is anchored to one revision by a `#<sha|tag>`
+ * suffix. Written without a regex so it cannot backtrack on a hostile spec.
+ * @param spec - The declared spec text
+ * @returns True when a non-empty ref follows a `#`
+ */
+function hasImmutableRef(spec) {
+    const marker = spec.indexOf("#");
+    return marker >= 0 && spec.slice(marker + 1).trim() !== "";
+}
+/**
+ * Whether a spec clones a git repository.
+ *
+ * The distinction this draws is the whole point: `git+https://…/widget.git`
+ * tracks a moving branch tip, but `https://…/widget-1.2.3.tgz` names one built
+ * archive that cannot become something newer tomorrow. Demanding a `#ref` of an
+ * archive URL would fault a repository that is already perfectly pinned.
+ * @param spec - The declared spec text
+ * @returns True when the spec resolves by cloning a repository
+ */
+function clonesRepository(spec) {
+    const beforeRef = spec.split("#")[0] ?? "";
+    return (GIT_FETCH_PROTOCOL.test(spec) ||
+        (HTTP_SPEC.test(spec) && beforeRef.toLowerCase().endsWith(".git")));
+}
+/**
+ * Whether a dependency spec resolves to whatever is newest at install time
+ * rather than to a version something was validated against.
+ *
+ * Four families are recognized, and the narrowness of each is deliberate — every
+ * over-eager rule here fails a correctly configured repository:
+ *
+ * - **Local protocols** resolve inside the repository and never float.
+ * - **Registry aliases** (`npm:left-pad@latest`) hide the real spec behind the
+ *   alias, so the part after the version separator is re-tested.
+ * - **Repository clones** (`github:acme/widget`, `git+https://…/x.git`) float
+ *   unless anchored to a `#<sha|tag>` revision, because the branch tip moves
+ *   under the install. An archive URL (`…/widget-1.2.3.tgz`) is NOT a clone: it
+ *   names one built artifact and is treated as pinned.
+ * - **Plain ranges** float only when they name no version at all. A `>=` floor
+ *   in `overrides` is the recommended way to force a patched transitive
+ *   dependency, so ranges are otherwise left alone.
+ * @param spec - The declared spec text
+ * @returns True when the spec floats
+ */
+export function isFloatingSpec(spec) {
+    const trimmed = spec.trim();
+    if (LOCAL_PROTOCOLS.some(protocol => trimmed.startsWith(protocol))) {
+        return false;
+    }
+    if (/^npm:/i.test(trimmed)) {
+        const separator = trimmed.lastIndexOf("@");
+        return separator > "npm:".length
+            ? isFloatingSpec(trimmed.slice(separator + 1))
+            : true;
+    }
+    if (clonesRepository(trimmed)) {
+        return !hasImmutableRef(trimmed);
+    }
+    return FLOATING_SPECS.has(trimmed.toLowerCase());
+}
+/**
+ * Commands and actions that actually audit the DEPENDENCY tree. A job merely
+ * titled "Security Scan" is deliberately not enough: a secret scanner proves
+ * nothing about the dependency tree, and counting it would be a false green —
+ * the worst direction to err for a confidence model.
+ */
+const AUDIT_GATE_PATTERN = /\b(npm|bun|yarn|pnpm)\s+audit\b|audit-ci|osv-scanner|dependency-review-action|\bsnyk\b|\btrivy\b|\bgrype\b/i;
+/**
+ * An update bot covering the JavaScript dependency tree. A `dependabot.yml`
+ * that only watches `github-actions` never looks at `package.json`, so its mere
+ * presence is not a confidence model for the dependencies.
+ */
+const JS_ECOSYSTEM_PATTERN = /package-ecosystem:\s*["']?(npm|bun|yarn|pnpm)\b/i;
+/** Files that may declare an audit gate in their text. */
+const GATE_DIRECTORIES = [
+    path.join(".github", "workflows"),
+    ".husky",
+];
+/** Single-file gate declarations checked by text match. */
+const GATE_FILES = [
+    "lefthook.yml",
+    "lefthook.yaml",
+    ".lefthook.yml",
+];
+/** Update bots whose mere presence is a standing confidence model. */
+const UPDATE_BOT_FILES = [
+    path.join(".github", "dependabot.yml"),
+    path.join(".github", "dependabot.yaml"),
+    path.join(".github", "renovate.json"),
+    "renovate.json",
+    ".renovaterc",
+    ".renovaterc.json",
+];
+/**
+ * Whether a repository-relative path exists.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative path
+ * @returns True when the file could be read
+ */
+async function fileExists(root, relativePath) {
+    return (await readFileOrNull(root, relativePath)) !== null;
+}
+/**
+ * List the files directly inside a repository-relative directory.
+ * @param root - Repository root
+ * @param relativeDir - Repo-relative directory
+ * @returns Repo-relative file paths (empty when the directory is absent)
+ */
+async function listDirectory(root, relativeDir) {
+    try {
+        const entries = await readdir(path.join(root, relativeDir), {
+            withFileTypes: true,
+        });
+        return entries
+            .filter(entry => entry.isFile())
+            .map(entry => path.join(relativeDir, entry.name))
+            .sort((a, b) => a.localeCompare(b));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Read and parse `package.json`, distinguishing "absent" from "unparseable" so
+ * the SKIP reason can say which one happened.
+ * @param root - Repository root
+ * @returns The parsed manifest, or the reason it cannot be assessed
+ */
+export async function readManifest(root) {
+    const source = await readFileOrNull(root, "package.json");
+    if (source === null) {
+        return {
+            kind: "unassessable",
+            reason: "no `package.json` was found, so this repository declares no " +
+                "JavaScript dependency surface to build a confidence model for; " +
+                "supply-chain confidence is not established either way",
+        };
+    }
+    try {
+        const parsed = JSON.parse(source);
+        if (!isRecord(parsed)) {
+            throw new Error("manifest is not a JSON object");
+        }
+        return { kind: "ok", manifest: parsed };
+    }
+    catch (error) {
+        return {
+            kind: "unassessable",
+            reason: "`package.json` could not be parsed, so its dependency specs were " +
+                `never read and nothing about them is established: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+/**
+ * Flatten one manifest block into `name → spec` pairs. `overrides` nests, so a
+ * nested map is walked rather than skipped — a floating spec one level down
+ * installs exactly as loosely as one at the top.
+ * @param block - Block name, e.g. `dependencies`
+ * @param value - The block's raw value
+ * @param prefix - Accumulated name path for nested overrides
+ * @returns Flattened specs
+ */
+function flattenBlock(block, value, prefix = "") {
+    if (!isRecord(value)) {
+        return [];
+    }
+    return Object.entries(value).flatMap(([name, spec]) => {
+        const qualified = prefix === "" ? name : `${prefix}.${name}`;
+        if (typeof spec === "string") {
+            return [{ block, name: qualified, spec }];
+        }
+        return flattenBlock(block, spec, qualified);
+    });
+}
+/**
+ * Flatten every versioned manifest block into one list of specs.
+ * @param manifest - Parsed `package.json`
+ * @returns Every declared spec across the versioned blocks
+ */
+export function collectSpecs(manifest) {
+    return VERSIONED_BLOCKS.flatMap(block => flattenBlock(block, manifest[block]));
+}
+/**
+ * Find the committed lockfile, if any.
+ * @param root - Repository root
+ * @returns The lockfile name, or null when none is committed
+ */
+export async function findLockfile(root) {
+    for (const candidate of LOCKFILES) {
+        if (await fileExists(root, candidate)) {
+            return candidate;
+        }
+    }
+    return null;
+}
+/**
+ * Whether an update-bot config actually watches the JavaScript dependency tree.
+ * Dependabot declares an ecosystem per entry, so a config covering only
+ * `github-actions` is not a confidence model for `package.json`. Renovate has no
+ * such per-file declaration and defaults to every manager it detects, so its
+ * presence is taken at face value.
+ * @param botFile - Repo-relative bot config path
+ * @param source - The config's text
+ * @returns True when the bot covers the JavaScript dependencies
+ */
+function coversJavaScriptTree(botFile, source) {
+    return botFile.includes("dependabot")
+        ? JS_ECOSYSTEM_PATTERN.test(source)
+        : true;
+}
+/**
+ * Find where the repository audits its dependency tree: a CI job, a git hook, a
+ * lefthook declaration, or an update bot.
+ * @param root - Repository root
+ * @returns The repo-relative path of the first gate found, or null
+ */
+export async function findAuditGate(root) {
+    for (const botFile of UPDATE_BOT_FILES) {
+        const source = await readFileOrNull(root, botFile);
+        if (source !== null && coversJavaScriptTree(botFile, source)) {
+            return botFile.split(path.sep).join("/");
+        }
+    }
+    const scanned = [
+        ...(await Promise.all(GATE_DIRECTORIES.map(dir => listDirectory(root, dir)))).flat(),
+        ...GATE_FILES,
+    ];
+    for (const file of scanned) {
+        const source = await readFileOrNull(root, file);
+        if (source !== null && AUDIT_GATE_PATTERN.test(source)) {
+            return file.split(path.sep).join("/");
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=doctor-readiness-supply-chain-scan.js.map

package/dist/cli/doctor-readiness-supply-chain-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-scan.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAsB;IAC1C,UAAU;IACV,WAAW;IACX,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,gBAAgB;CACjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAAsB;IAC1C,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,WAAW;IACX,aAAa;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,EAAE;IACF,GAAG;IACH,GAAG;IACH,GAAG;IACH,KAAK;IACL,OAAO;IACP,QAAQ;IACR,MAAM;IACN,KAAK;CACN,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAsB;IACzC,YAAY;IACZ,OAAO;IACP,OAAO;IACP,SAAS;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,2CAA2C,CAAC;AAEvE,8EAA8E;AAC9E,MAAM,SAAS,GAAG,eAAe,CAAC;AAElC;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,CACL,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7B,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,SAAS,GAAG,MAAM,CAAC,MAAM;YAC9B,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GACtB,6GAA6G,CAAC;AAEhH;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAEhF,0DAA0D;AAC1D,MAAM,gBAAgB,GAAsB;IAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;IACjC,QAAQ;CACT,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,GAAsB;IACpC,cAAc;IACd,eAAe;IACf,eAAe;CAChB,CAAC;AAEF,sEAAsE;AACtE,MAAM,gBAAgB,GAAsB;IAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;IACrC,eAAe;IACf,aAAa;IACb,kBAAkB;CACnB,CAAC;AAOF;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,YAAoB;IAEpB,OAAO,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;YAC1D,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,OAAO;aACX,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aAC/B,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EACJ,8DAA8D;gBAC9D,iEAAiE;gBACjE,uDAAuD;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EACJ,mEAAmE;gBACnE,qDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;SACL,CAAC;IACJ,CAAC;AACH,CAAC;AASD;;;;;;;;GAQG;AACH,SAAS,YAAY,CACnB,KAAa,EACb,KAAc,EACd,MAAM,GAAG,EAAE;IAEX,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QAC7D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAiC;IAEjC,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CACtC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,IAAI,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,OAAe,EAAE,MAAc;IAC3D,OAAO,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QACnC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,CACD,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CACzE,CAAC,IAAI,EAAE;QACR,GAAG,UAAU;KACd,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/doctor-readiness-supply-chain.d.ts

@@ -0,0 +1,14 @@
+import type { ReadinessDimensionRecord } from "./doctor-readiness-types.js";
+/** The dependencies/supply-chain readiness dimension id (readiness-rubric). */
+export declare const DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID = "dependencies-supply-chain";
+/**
+ * Assess the dependencies/supply-chain dimension: B5, "an owned compatibility or
+ * security surface has no confidence model". Offline by construction — it reads
+ * only the repository's manifest, lockfiles, CI declarations, git hooks, and
+ * audit allowlists, and degrades to a stated-reason SKIP wherever those files
+ * cannot settle the question.
+ * @param root - Project root to assess
+ * @returns The dependencies/supply-chain dimension record
+ */
+export declare function assessDependenciesSupplyChainDimension(root: string): Promise<ReadinessDimensionRecord>;
+//# sourceMappingURL=doctor-readiness-supply-chain.d.ts.map

package/dist/cli/doctor-readiness-supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,+EAA+E;AAC/E,eAAO,MAAM,sCAAsC,8BACtB,CAAC;AAsL9B;;;;;;;;GAQG;AACH,wBAAsB,sCAAsC,CAC1D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,CAAC,CA8CnC"}

package/dist/cli/doctor-readiness-supply-chain.js

@@ -0,0 +1,231 @@
+/**
+ * The dependencies/supply-chain readiness producer — ship blocker B5
+ * (PRD #1739, #1896).
+ *
+ * Dimension 6 of the `readiness-rubric` asks whether belief that the owned
+ * surface still works rests on more than hope. Four things, read offline from
+ * the repository's own files, decide that: the dependency tree resolves to the
+ * same versions twice (a lockfile), the manifest names versions rather than
+ * "whatever is newest" (no floating specs), something somewhere actually audits
+ * the tree (a CI scan, a git hook, or an update bot), and every audit exception
+ * carries the decision that made it acceptable.
+ *
+ * Two disciplines are load-bearing rather than stylistic:
+ *
+ * 1. **A finding names a `blocker` id ONLY on an actual violation.** The blocker
+ *    engine stands a blocker up on any finding that names an id and carries
+ *    evidence, regardless of the finding's status — so a clean repository's PASS
+ *    finding must carry no `blocker` key, or a healthy repository reports
+ *    NOT_READY.
+ * The scanning half — reading the manifest, the lockfile, the audit gates, and
+ * the audit allowlists — lives in `doctor-readiness-supply-chain-scan`; this
+ * module turns what it found into the rubric-shaped dimension record.
+ *
+ * 2. **Never manufacture RED or GREEN from absence.** A repository with no
+ *    manifest, an unparseable manifest, or no declared dependencies owns no
+ *    dependency surface this producer can speak to, so it renders a
+ *    stated-reason SKIP — never a violation, and never a false-green PASS.
+ * @module cli/doctor-readiness-supply-chain
+ */
+import { informationalFindings } from "./doctor-readiness-shared.js";
+import { auditExceptionViolations } from "./doctor-readiness-audit-allowlist.js";
+import { collectSpecs, findAuditGate, findLockfile, isFloatingSpec, LOCKFILES, readManifest, } from "./doctor-readiness-supply-chain-scan.js";
+import { resolveWorkspaceMembers, } from "./doctor-readiness-workspaces.js";
+/** The dependencies/supply-chain readiness dimension id (readiness-rubric). */
+export const DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID = "dependencies-supply-chain";
+/** The ship blocker for an owned surface with no confidence model. */
+const SUPPLY_CHAIN_BLOCKER_ID = "B5";
+/** Most evidence lines carried into a single finding, to keep it readable. */
+const MAX_EVIDENCE_LINES = 12;
+/**
+ * Build the evidence line for a manifest with no committed lockfile.
+ * @param specCount - How many specs the manifest declares
+ * @returns One evidence line
+ */
+function lockfileEvidence(specCount) {
+    return (`\`package.json\` declares ${specCount} dependency spec(s) but no lockfile ` +
+        `is committed (looked for ${LOCKFILES.join(", ")}) — two installs can ` +
+        "resolve to different trees, so what was validated is not provably what " +
+        "gets installed");
+}
+/**
+ * Whether a floating-looking spec is really a link to a package in this
+ * repository. `"@acme/utils": "*"` against a workspace member resolves to the
+ * local package, which is the workspace idiom rather than a floating install —
+ * so faulting it would fail every correctly configured monorepo.
+ *
+ * When workspaces are declared but no member name could be resolved (an
+ * unreadable child manifest, an unsupported glob), a bare `*` is exempted
+ * anyway: the repository has told us it links locally, and absence of proof is
+ * not proof of a violation.
+ * @param spec - The declared spec
+ * @param workspaces - What resolving the workspace members established
+ * @returns True when the spec links to a workspace member
+ */
+function linksWorkspaceMember(spec, workspaces) {
+    if (!workspaces.declared) {
+        return false;
+    }
+    return (workspaces.names.has(spec.name) ||
+        (workspaces.names.size === 0 && spec.spec.trim() === "*"));
+}
+/**
+ * Assess a repository's dependency confidence model.
+ * @param root - Repository root
+ * @param specs - Declared dependency specs
+ * @param workspaces - What resolving the workspace members established
+ * @returns Evidence lines for violations, and non-blocking observations
+ */
+async function collectFindings(root, specs, workspaces) {
+    const lockfile = await findLockfile(root);
+    const auditGate = await findAuditGate(root);
+    const floating = specs.filter(spec => isFloatingSpec(spec.spec) && !linksWorkspaceMember(spec, workspaces));
+    return {
+        violations: [
+            ...(lockfile === null ? [lockfileEvidence(specs.length)] : []),
+            ...floating.map(spec => `\`package.json\` \`${spec.block}.${spec.name}\` is \`${spec.spec}\`, ` +
+                "which resolves to whatever is newest at install time rather than to " +
+                "a version anything was ever validated against"),
+            ...(auditGate === null
+                ? [
+                    "no dependency-audit gate covering the JavaScript tree was found " +
+                        "anywhere — no `npm`/`bun` audit step in `.github/workflows/*.yml`, " +
+                        "none in a git hook, and no `dependabot.yml` npm entry or " +
+                        "`renovate.json` — so a newly disclosed advisory in this tree " +
+                        "would never be noticed by anything",
+                ]
+                : []),
+            ...(await auditExceptionViolations(root)),
+        ],
+        observations: [
+            ...(lockfile === null ? [] : [`Lockfile in use: \`${lockfile}\`.`]),
+            ...(auditGate === null
+                ? []
+                : [`Dependency-audit gate declared in \`${auditGate}\`.`]),
+            ...(workspaces.declared ? [workspaceObservation(workspaces)] : []),
+        ],
+    };
+}
+/**
+ * State what the workspace exemption actually did.
+ *
+ * The two cases must not be described in the same words. When member manifests
+ * resolved, named packages were exempted because they provably link locally.
+ * When none resolved, a bare `*` was exempted on the strength of the
+ * `workspaces` declaration alone — a deliberate refusal to manufacture a
+ * violation from absence, but NOT a resolved link, and reporting it as
+ * "0 package name(s) were exempted" would describe the opposite of what
+ * happened.
+ * @param workspaces - What resolving the workspace members established
+ * @returns One operator-language observation
+ */
+function workspaceObservation(workspaces) {
+    return workspaces.names.size > 0
+        ? `Workspaces are declared, so ${workspaces.names.size} locally linked ` +
+            "package name(s) were exempted from the floating-spec check."
+        : "Workspaces are declared but no member manifests resolved offline, so " +
+            "bare `*` specs were treated as workspace links rather than as " +
+            "floating installs. Whether they really link locally is not established.";
+}
+/**
+ * Build the rubric-shaped B5 finding from its evidence lines.
+ * @param violations - Evidence lines
+ * @returns The B5 finding
+ */
+function supplyChainFinding(violations) {
+    const shown = violations.slice(0, MAX_EVIDENCE_LINES);
+    const overflow = violations.length - shown.length;
+    return {
+        blocker: SUPPLY_CHAIN_BLOCKER_ID,
+        invariant_violated: "belief that the owned surface still works rests on a repeatable install " +
+            "and a standing audit, not on hope",
+        evidence: shown.join(" | ") +
+            (overflow > 0
+                ? ` | (+${overflow} further finding(s) of the same kind)`
+                : ""),
+        why_proof_missed: "the test suite proves things about the code in the tree it happened to " +
+            "install, so a tree that drifts — or one carrying a known advisory nobody " +
+            "checks for — still reports green",
+        root_correction: "commit a lockfile, name a version for every dependency spec, run a " +
+            "dependency audit on every push, and record the decision behind each " +
+            "audit exception next to the exception itself",
+        machinery_to_remove: [
+            "audit exceptions kept alive with no written decision, which cost review " +
+                "attention every cycle and prove nothing",
+        ],
+    };
+}
+/**
+ * Describe what the spec check established, without overstating the bare-`*`
+ * workspace fallback as a resolved link.
+ * @param workspaces - What resolving the workspace members established
+ * @returns One clause for the PASS evidence
+ */
+function describeSpecCleanliness(workspaces) {
+    return workspaces.declared && workspaces.names.size === 0
+        ? "every one names a version, except bare `*` specs exempted because " +
+            "workspaces are declared but no member manifests resolved offline"
+        : "every one names a version or links a workspace member";
+}
+/**
+ * Build the stated-reason SKIP for a repository with no assessable manifest.
+ * @param reason - Why the dimension was not assessed
+ * @returns The SKIP dimension record
+ */
+function skipRecord(reason) {
+    return {
+        id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+        status: "SKIP",
+        findings: [{ reason, skip: true }],
+    };
+}
+/**
+ * Assess the dependencies/supply-chain dimension: B5, "an owned compatibility or
+ * security surface has no confidence model". Offline by construction — it reads
+ * only the repository's manifest, lockfiles, CI declarations, git hooks, and
+ * audit allowlists, and degrades to a stated-reason SKIP wherever those files
+ * cannot settle the question.
+ * @param root - Project root to assess
+ * @returns The dependencies/supply-chain dimension record
+ */
+export async function assessDependenciesSupplyChainDimension(root) {
+    const outcome = await readManifest(root);
+    if (outcome.kind === "unassessable") {
+        return skipRecord(outcome.reason);
+    }
+    const specs = collectSpecs(outcome.manifest);
+    if (specs.length === 0) {
+        return skipRecord("`package.json` declares no dependencies, so this repository owns no " +
+            "third-party surface a confidence model could cover; supply-chain " +
+            "confidence is not established either way");
+    }
+    const workspaces = await resolveWorkspaceMembers(root, outcome.manifest);
+    const { violations, observations } = await collectFindings(root, specs, workspaces);
+    if (violations.length > 0) {
+        return {
+            id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+            status: "FAIL",
+            findings: [
+                supplyChainFinding(violations),
+                ...informationalFindings(observations),
+            ],
+        };
+    }
+    return {
+        id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+        status: "PASS",
+        findings: [
+            {
+                evidence: `Inspected ${specs.length} dependency spec(s) in the root ` +
+                    `\`package.json\`: ${describeSpecCleanliness(workspaces)}, a ` +
+                    "lockfile is committed, a dependency-audit gate covering the " +
+                    "JavaScript tree is declared, and every active audit exception " +
+                    "carries a written decision. Workspace child manifests are not " +
+                    "walked, so this speaks only to the root manifest.",
+                checked: [SUPPLY_CHAIN_BLOCKER_ID],
+            },
+            ...informationalFindings(observations),
+        ],
+    };
+}
+//# sourceMappingURL=doctor-readiness-supply-chain.js.map

package/dist/cli/doctor-readiness-supply-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EACL,YAAY,EAEZ,aAAa,EACb,YAAY,EACZ,cAAc,EACd,SAAS,EACT,YAAY,GACb,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAG1C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sCAAsC,GACjD,2BAA2B,CAAC;AAE9B,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO,CACL,6BAA6B,SAAS,sCAAsC;QAC5E,4BAA4B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB;QACvE,yEAAyE;QACzE,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,oBAAoB,CAC3B,IAAoB,EACpB,UAA4B;IAE5B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,KAAgC,EAChC,UAA4B;IAK5B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAC3B,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,CAC7E,CAAC;IACF,OAAO;QACL,UAAU,EAAE;YACV,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,QAAQ,CAAC,GAAG,CACb,IAAI,CAAC,EAAE,CACL,sBAAsB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,MAAM;gBACvE,sEAAsE;gBACtE,+CAA+C,CAClD;YACD,GAAG,CAAC,SAAS,KAAK,IAAI;gBACpB,CAAC,CAAC;oBACE,kEAAkE;wBAChE,qEAAqE;wBACrE,2DAA2D;wBAC3D,+DAA+D;wBAC/D,oCAAoC;iBACvC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC1C;QACD,YAAY,EAAE;YACZ,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB,QAAQ,KAAK,CAAC,CAAC;YACnE,GAAG,CAAC,SAAS,KAAK,IAAI;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,uCAAuC,SAAS,KAAK,CAAC,CAAC;YAC5D,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,UAA4B;IACxD,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QAC9B,CAAC,CAAC,+BAA+B,UAAU,CAAC,KAAK,CAAC,IAAI,kBAAkB;YACpE,6DAA6D;QACjE,CAAC,CAAC,uEAAuE;YACrE,gEAAgE;YAChE,yEAAyE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,UAA6B;IAE7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,uBAAuB;QAChC,kBAAkB,EAChB,0EAA0E;YAC1E,mCAAmC;QACrC,QAAQ,EACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACjB,CAAC,QAAQ,GAAG,CAAC;gBACX,CAAC,CAAC,QAAQ,QAAQ,uCAAuC;gBACzD,CAAC,CAAC,EAAE,CAAC;QACT,gBAAgB,EACd,yEAAyE;YACzE,2EAA2E;YAC3E,kCAAkC;QACpC,eAAe,EACb,qEAAqE;YACrE,sEAAsE;YACtE,8CAA8C;QAChD,mBAAmB,EAAE;YACnB,0EAA0E;gBACxE,yCAAyC;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,UAA4B;IAC3D,OAAO,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QACvD,CAAC,CAAC,oEAAoE;YAClE,kEAAkE;QACtE,CAAC,CAAC,uDAAuD,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,UAAU,CACf,sEAAsE;YACpE,mEAAmE;YACnE,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,eAAe,CACxD,IAAI,EACJ,KAAK,EACL,UAAU,CACX,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,sCAAsC;YAC1C,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE;gBACR,kBAAkB,CAAC,UAAU,CAAC;gBAC9B,GAAG,qBAAqB,CAAC,YAAY,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,KAAK,CAAC,MAAM,kCAAkC;oBAC3D,qBAAqB,uBAAuB,CAAC,UAAU,CAAC,MAAM;oBAC9D,8DAA8D;oBAC9D,gEAAgE;oBAChE,gEAAgE;oBAChE,mDAAmD;gBACrD,OAAO,EAAE,CAAC,uBAAuB,CAAC;aACnC;YACD,GAAG,qBAAqB,CAAC,YAAY,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-workspaces.d.ts

@@ -0,0 +1,22 @@
+/** What resolving the repository's workspace members established. */
+export interface WorkspaceMembers {
+    /** Whether the repository declares workspaces at all. */
+    readonly declared: boolean;
+    /** Names of the local packages the workspaces resolve to. */
+    readonly names: ReadonlySet<string>;
+}
+/**
+ * Resolve the local package names a repository's workspace globs expand to.
+ *
+ * This exists because `"@acme/utils": "*"` against a workspace member is the
+ * workspace-link idiom, not a floating install: it resolves to the package in
+ * this repository. Faulting it would fail every correctly configured monorepo.
+ * Glob support is deliberately shallow (a single trailing `*`), and an
+ * unresolvable glob simply contributes no names — absence never manufactures a
+ * violation.
+ * @param root - Repository root
+ * @param manifest - Parsed root `package.json`
+ * @returns Whether workspaces are declared, and the member names resolved
+ */
+export declare function resolveWorkspaceMembers(root: string, manifest: Record<string, unknown>): Promise<WorkspaceMembers>;
+//# sourceMappingURL=doctor-readiness-workspaces.d.ts.map

package/dist/cli/doctor-readiness-workspaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-workspaces.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-workspaces.ts"],"names":[],"mappings":"AAwBA,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACrC;AA6BD;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAwB3B"}