@codyswann/lisa 2.279.2 → 2.281.0

package/dist/cli/doctor-readiness-shared.js

@@ -0,0 +1,88 @@
+/**
+ * Helpers shared by every readiness producer (PRD #1739, #1896).
+ *
+ * Three things were being re-implemented per producer: reading a repository file
+ * without letting a missing file throw, asking whether a repository path exists,
+ * and wrapping a non-blocking observation as a finding. The last one is the
+ * load-bearing case — an observation finding must carry NO `blocker` key,
+ * because the blocker engine stands a blocker up on any finding that names an id
+ * and carries evidence regardless of the finding's status. One definition means
+ * that rule cannot drift apart across producers.
+ * @module cli/doctor-readiness-shared
+ */
+import { readdir, readFile } from "node:fs/promises";
+import * as path from "node:path";
+/**
+ * Read a repository-relative file, returning null when it cannot be read.
+ *
+ * Reading is best-effort by design: a file that cannot be read establishes
+ * nothing, and a readiness producer must never turn "could not look" into
+ * either a violation or a clean bill of health.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative path (forward slashes)
+ * @returns File contents, or null
+ */
+export async function readFileOrNull(root, relativePath) {
+    try {
+        return await readFile(path.join(root, ...relativePath.split("/")), "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether a repository-relative directory exists.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative directory path
+ * @returns True when the directory could be listed
+ */
+export async function directoryExists(root, relativePath) {
+    try {
+        await readdir(path.join(root, ...relativePath.split("/")));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether a repository-relative path exists, as a file or a directory.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative path
+ * @returns True when something is present at that path
+ */
+export async function pathExists(root, relativePath) {
+    return ((await readFileOrNull(root, relativePath)) !== null ||
+        (await directoryExists(root, relativePath)));
+}
+/**
+ * Strip leading and trailing slashes from a repo-relative path fragment.
+ * Written without a regex quantifier so it cannot backtrack on hostile input.
+ * @param value - The path fragment
+ * @returns The fragment with empty segments removed
+ */
+export function trimSlashes(value) {
+    return value
+        .split("/")
+        .filter(segment => segment !== "")
+        .join("/");
+}
+/**
+ * Whether a value is a plain JSON object.
+ * @param value - Candidate value
+ * @returns True when the value is a non-null, non-array object
+ */
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Wrap non-blocking observations as findings. They deliberately carry no
+ * `blocker` key: naming one would stand a blocker up — and flip the whole
+ * repository to `NOT_READY` — on an observation that was never decidable.
+ * @param notes - Informational lines
+ * @returns Findings, one per note
+ */
+export function informationalFindings(notes) {
+    return notes.map(note => ({ observation: note, blocking: false }));
+}
+//# sourceMappingURL=doctor-readiness-shared.js.map

package/dist/cli/doctor-readiness-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-shared.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,YAAoB;IAEpB,OAAO,CACL,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,KAAK,IAAI;QACnD,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC;SACjC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAwB;IAExB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/cli/doctor-readiness-supply-chain-scan.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Every lockfile spelling a JavaScript package manager writes. One of these
+ * being committed is what makes two installs resolve to the same tree.
+ */
+export declare const LOCKFILES: readonly string[];
+/**
+ * Whether a dependency spec resolves to whatever is newest at install time
+ * rather than to a version something was validated against.
+ *
+ * Four families are recognized, and the narrowness of each is deliberate — every
+ * over-eager rule here fails a correctly configured repository:
+ *
+ * - **Local protocols** resolve inside the repository and never float.
+ * - **Registry aliases** (`npm:left-pad@latest`) hide the real spec behind the
+ *   alias, so the part after the version separator is re-tested.
+ * - **Repository clones** (`github:acme/widget`, `git+https://…/x.git`) float
+ *   unless anchored to a `#<sha|tag>` revision, because the branch tip moves
+ *   under the install. An archive URL (`…/widget-1.2.3.tgz`) is NOT a clone: it
+ *   names one built artifact and is treated as pinned.
+ * - **Plain ranges** float only when they name no version at all. A `>=` floor
+ *   in `overrides` is the recommended way to force a patched transitive
+ *   dependency, so ranges are otherwise left alone.
+ * @param spec - The declared spec text
+ * @returns True when the spec floats
+ */
+export declare function isFloatingSpec(spec: string): boolean;
+/** What reading the manifest established. */
+export type ManifestOutcome = {
+    readonly kind: "ok";
+    readonly manifest: Record<string, unknown>;
+} | {
+    readonly kind: "unassessable";
+    readonly reason: string;
+};
+/**
+ * Read and parse `package.json`, distinguishing "absent" from "unparseable" so
+ * the SKIP reason can say which one happened.
+ * @param root - Repository root
+ * @returns The parsed manifest, or the reason it cannot be assessed
+ */
+export declare function readManifest(root: string): Promise<ManifestOutcome>;
+/** One declared dependency spec, flattened out of the manifest blocks. */
+export interface DependencySpec {
+    readonly block: string;
+    readonly name: string;
+    readonly spec: string;
+}
+/**
+ * Flatten every versioned manifest block into one list of specs.
+ * @param manifest - Parsed `package.json`
+ * @returns Every declared spec across the versioned blocks
+ */
+export declare function collectSpecs(manifest: Record<string, unknown>): readonly DependencySpec[];
+/**
+ * Find the committed lockfile, if any.
+ * @param root - Repository root
+ * @returns The lockfile name, or null when none is committed
+ */
+export declare function findLockfile(root: string): Promise<string | null>;
+/**
+ * Find where the repository audits its dependency tree: a CI job, a git hook, a
+ * lefthook declaration, or an update bot.
+ * @param root - Repository root
+ * @returns The repo-relative path of the first gate found, or null
+ */
+export declare function findAuditGate(root: string): Promise<string | null>;
+//# sourceMappingURL=doctor-readiness-supply-chain-scan.d.ts.map

package/dist/cli/doctor-readiness-supply-chain-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-scan.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-scan.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AACH,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAOtC,CAAC;AAoFF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAepD;AAyCD,6CAA6C;AAC7C,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAsC/D;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA2BzE;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AA4BD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,SAAS,cAAc,EAAE,CAI3B;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOvE;AAkBD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBxE"}

package/dist/cli/doctor-readiness-supply-chain-scan.js

@@ -0,0 +1,316 @@
+/**
+ * Offline supply-chain scanning for the dependencies/supply-chain readiness
+ * producer (B5, PRD #1739, #1896).
+ *
+ * The B5 question — does belief that the owned surface still works rest on more
+ * than hope — is answered from four repository facts: a committed lockfile, the
+ * dependency specs the manifest names, whether anything anywhere audits the
+ * tree, and whether each audit exception carries the decision behind it. This
+ * module gathers those facts; its sibling turns them into the rubric-shaped
+ * dimension record. Splitting them keeps each file inside the repository's
+ * file-size budget and keeps the gathering independently testable.
+ *
+ * Reading is offline and best-effort by construction: an unreadable file
+ * establishes nothing and is passed over, never reported as a violation.
+ * @module cli/doctor-readiness-supply-chain-scan
+ */
+import { readdir } from "node:fs/promises";
+import * as path from "node:path";
+import { isRecord, readFileOrNull } from "./doctor-readiness-shared.js";
+/**
+ * Every lockfile spelling a JavaScript package manager writes. One of these
+ * being committed is what makes two installs resolve to the same tree.
+ */
+export const LOCKFILES = [
+    "bun.lock",
+    "bun.lockb",
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "yarn.lock",
+    "pnpm-lock.yaml",
+];
+/**
+ * Manifest blocks whose specs must name a version. `peerDependencies` is
+ * deliberately excluded: `*` there is the conventional way to say "any host
+ * version works", not a floating install.
+ */
+const VERSIONED_BLOCKS = [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "overrides",
+    "resolutions",
+];
+/**
+ * Specs that resolve to whatever is newest at install time. Deliberately narrow:
+ * a `>=` floor in `overrides` is the recommended way to force a patched
+ * transitive dependency, so treating ranges as floating would fault the very
+ * remediation the audit gate asks for.
+ */
+const FLOATING_SPECS = new Set([
+    "",
+    "*",
+    "x",
+    "X",
+    "*.*",
+    "*.*.*",
+    "latest",
+    "next",
+    "*.x",
+]);
+/**
+ * Protocols that resolve to something inside this repository rather than to a
+ * published version, so there is nothing to pin and nothing to drift.
+ */
+const LOCAL_PROTOCOLS = [
+    "workspace:",
+    "file:",
+    "link:",
+    "portal:",
+];
+/**
+ * Protocols that clone a source tree. Without a ref these resolve to whatever
+ * the default branch holds at install time, which is the drift B5 cares about.
+ * Each alternative ends in `:` or `+` on purpose — a colonless `bitbucket`
+ * alternative would match the ordinary registry package `bitbucket-client`.
+ */
+const GIT_FETCH_PROTOCOL = /^(github:|gitlab:|bitbucket:|git\+|git:)/i;
+/** An `http(s)` spec, which may clone a repository or download an archive. */
+const HTTP_SPEC = /^https?:\/\//i;
+/**
+ * Whether a source-fetch spec is anchored to one revision by a `#<sha|tag>`
+ * suffix. Written without a regex so it cannot backtrack on a hostile spec.
+ * @param spec - The declared spec text
+ * @returns True when a non-empty ref follows a `#`
+ */
+function hasImmutableRef(spec) {
+    const marker = spec.indexOf("#");
+    return marker >= 0 && spec.slice(marker + 1).trim() !== "";
+}
+/**
+ * Whether a spec clones a git repository.
+ *
+ * The distinction this draws is the whole point: `git+https://…/widget.git`
+ * tracks a moving branch tip, but `https://…/widget-1.2.3.tgz` names one built
+ * archive that cannot become something newer tomorrow. Demanding a `#ref` of an
+ * archive URL would fault a repository that is already perfectly pinned.
+ * @param spec - The declared spec text
+ * @returns True when the spec resolves by cloning a repository
+ */
+function clonesRepository(spec) {
+    const beforeRef = spec.split("#")[0] ?? "";
+    return (GIT_FETCH_PROTOCOL.test(spec) ||
+        (HTTP_SPEC.test(spec) && beforeRef.toLowerCase().endsWith(".git")));
+}
+/**
+ * Whether a dependency spec resolves to whatever is newest at install time
+ * rather than to a version something was validated against.
+ *
+ * Four families are recognized, and the narrowness of each is deliberate — every
+ * over-eager rule here fails a correctly configured repository:
+ *
+ * - **Local protocols** resolve inside the repository and never float.
+ * - **Registry aliases** (`npm:left-pad@latest`) hide the real spec behind the
+ *   alias, so the part after the version separator is re-tested.
+ * - **Repository clones** (`github:acme/widget`, `git+https://…/x.git`) float
+ *   unless anchored to a `#<sha|tag>` revision, because the branch tip moves
+ *   under the install. An archive URL (`…/widget-1.2.3.tgz`) is NOT a clone: it
+ *   names one built artifact and is treated as pinned.
+ * - **Plain ranges** float only when they name no version at all. A `>=` floor
+ *   in `overrides` is the recommended way to force a patched transitive
+ *   dependency, so ranges are otherwise left alone.
+ * @param spec - The declared spec text
+ * @returns True when the spec floats
+ */
+export function isFloatingSpec(spec) {
+    const trimmed = spec.trim();
+    if (LOCAL_PROTOCOLS.some(protocol => trimmed.startsWith(protocol))) {
+        return false;
+    }
+    if (/^npm:/i.test(trimmed)) {
+        const separator = trimmed.lastIndexOf("@");
+        return separator > "npm:".length
+            ? isFloatingSpec(trimmed.slice(separator + 1))
+            : true;
+    }
+    if (clonesRepository(trimmed)) {
+        return !hasImmutableRef(trimmed);
+    }
+    return FLOATING_SPECS.has(trimmed.toLowerCase());
+}
+/**
+ * Commands and actions that actually audit the DEPENDENCY tree. A job merely
+ * titled "Security Scan" is deliberately not enough: a secret scanner proves
+ * nothing about the dependency tree, and counting it would be a false green —
+ * the worst direction to err for a confidence model.
+ */
+const AUDIT_GATE_PATTERN = /\b(npm|bun|yarn|pnpm)\s+audit\b|audit-ci|osv-scanner|dependency-review-action|\bsnyk\b|\btrivy\b|\bgrype\b/i;
+/**
+ * An update bot covering the JavaScript dependency tree. A `dependabot.yml`
+ * that only watches `github-actions` never looks at `package.json`, so its mere
+ * presence is not a confidence model for the dependencies.
+ */
+const JS_ECOSYSTEM_PATTERN = /package-ecosystem:\s*["']?(npm|bun|yarn|pnpm)\b/i;
+/** Files that may declare an audit gate in their text. */
+const GATE_DIRECTORIES = [
+    path.join(".github", "workflows"),
+    ".husky",
+];
+/** Single-file gate declarations checked by text match. */
+const GATE_FILES = [
+    "lefthook.yml",
+    "lefthook.yaml",
+    ".lefthook.yml",
+];
+/** Update bots whose mere presence is a standing confidence model. */
+const UPDATE_BOT_FILES = [
+    path.join(".github", "dependabot.yml"),
+    path.join(".github", "dependabot.yaml"),
+    path.join(".github", "renovate.json"),
+    "renovate.json",
+    ".renovaterc",
+    ".renovaterc.json",
+];
+/**
+ * Whether a repository-relative path exists.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative path
+ * @returns True when the file could be read
+ */
+async function fileExists(root, relativePath) {
+    return (await readFileOrNull(root, relativePath)) !== null;
+}
+/**
+ * List the files directly inside a repository-relative directory.
+ * @param root - Repository root
+ * @param relativeDir - Repo-relative directory
+ * @returns Repo-relative file paths (empty when the directory is absent)
+ */
+async function listDirectory(root, relativeDir) {
+    try {
+        const entries = await readdir(path.join(root, relativeDir), {
+            withFileTypes: true,
+        });
+        return entries
+            .filter(entry => entry.isFile())
+            .map(entry => path.join(relativeDir, entry.name))
+            .sort((a, b) => a.localeCompare(b));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Read and parse `package.json`, distinguishing "absent" from "unparseable" so
+ * the SKIP reason can say which one happened.
+ * @param root - Repository root
+ * @returns The parsed manifest, or the reason it cannot be assessed
+ */
+export async function readManifest(root) {
+    const source = await readFileOrNull(root, "package.json");
+    if (source === null) {
+        return {
+            kind: "unassessable",
+            reason: "no `package.json` was found, so this repository declares no " +
+                "JavaScript dependency surface to build a confidence model for; " +
+                "supply-chain confidence is not established either way",
+        };
+    }
+    try {
+        const parsed = JSON.parse(source);
+        if (!isRecord(parsed)) {
+            throw new Error("manifest is not a JSON object");
+        }
+        return { kind: "ok", manifest: parsed };
+    }
+    catch (error) {
+        return {
+            kind: "unassessable",
+            reason: "`package.json` could not be parsed, so its dependency specs were " +
+                `never read and nothing about them is established: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+/**
+ * Flatten one manifest block into `name → spec` pairs. `overrides` nests, so a
+ * nested map is walked rather than skipped — a floating spec one level down
+ * installs exactly as loosely as one at the top.
+ * @param block - Block name, e.g. `dependencies`
+ * @param value - The block's raw value
+ * @param prefix - Accumulated name path for nested overrides
+ * @returns Flattened specs
+ */
+function flattenBlock(block, value, prefix = "") {
+    if (!isRecord(value)) {
+        return [];
+    }
+    return Object.entries(value).flatMap(([name, spec]) => {
+        const qualified = prefix === "" ? name : `${prefix}.${name}`;
+        if (typeof spec === "string") {
+            return [{ block, name: qualified, spec }];
+        }
+        return flattenBlock(block, spec, qualified);
+    });
+}
+/**
+ * Flatten every versioned manifest block into one list of specs.
+ * @param manifest - Parsed `package.json`
+ * @returns Every declared spec across the versioned blocks
+ */
+export function collectSpecs(manifest) {
+    return VERSIONED_BLOCKS.flatMap(block => flattenBlock(block, manifest[block]));
+}
+/**
+ * Find the committed lockfile, if any.
+ * @param root - Repository root
+ * @returns The lockfile name, or null when none is committed
+ */
+export async function findLockfile(root) {
+    for (const candidate of LOCKFILES) {
+        if (await fileExists(root, candidate)) {
+            return candidate;
+        }
+    }
+    return null;
+}
+/**
+ * Whether an update-bot config actually watches the JavaScript dependency tree.
+ * Dependabot declares an ecosystem per entry, so a config covering only
+ * `github-actions` is not a confidence model for `package.json`. Renovate has no
+ * such per-file declaration and defaults to every manager it detects, so its
+ * presence is taken at face value.
+ * @param botFile - Repo-relative bot config path
+ * @param source - The config's text
+ * @returns True when the bot covers the JavaScript dependencies
+ */
+function coversJavaScriptTree(botFile, source) {
+    return botFile.includes("dependabot")
+        ? JS_ECOSYSTEM_PATTERN.test(source)
+        : true;
+}
+/**
+ * Find where the repository audits its dependency tree: a CI job, a git hook, a
+ * lefthook declaration, or an update bot.
+ * @param root - Repository root
+ * @returns The repo-relative path of the first gate found, or null
+ */
+export async function findAuditGate(root) {
+    for (const botFile of UPDATE_BOT_FILES) {
+        const source = await readFileOrNull(root, botFile);
+        if (source !== null && coversJavaScriptTree(botFile, source)) {
+            return botFile.split(path.sep).join("/");
+        }
+    }
+    const scanned = [
+        ...(await Promise.all(GATE_DIRECTORIES.map(dir => listDirectory(root, dir)))).flat(),
+        ...GATE_FILES,
+    ];
+    for (const file of scanned) {
+        const source = await readFileOrNull(root, file);
+        if (source !== null && AUDIT_GATE_PATTERN.test(source)) {
+            return file.split(path.sep).join("/");
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=doctor-readiness-supply-chain-scan.js.map

package/dist/cli/doctor-readiness-supply-chain-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-scan.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAsB;IAC1C,UAAU;IACV,WAAW;IACX,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,gBAAgB;CACjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAAsB;IAC1C,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,WAAW;IACX,aAAa;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,EAAE;IACF,GAAG;IACH,GAAG;IACH,GAAG;IACH,KAAK;IACL,OAAO;IACP,QAAQ;IACR,MAAM;IACN,KAAK;CACN,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,eAAe,GAAsB;IACzC,YAAY;IACZ,OAAO;IACP,OAAO;IACP,SAAS;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,2CAA2C,CAAC;AAEvE,8EAA8E;AAC9E,MAAM,SAAS,GAAG,eAAe,CAAC;AAElC;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,CACL,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7B,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,SAAS,GAAG,MAAM,CAAC,MAAM;YAC9B,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GACtB,6GAA6G,CAAC;AAEhH;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAEhF,0DAA0D;AAC1D,MAAM,gBAAgB,GAAsB;IAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;IACjC,QAAQ;CACT,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,GAAsB;IACpC,cAAc;IACd,eAAe;IACf,eAAe;CAChB,CAAC;AAEF,sEAAsE;AACtE,MAAM,gBAAgB,GAAsB;IAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;IACrC,eAAe;IACf,aAAa;IACb,kBAAkB;CACnB,CAAC;AAOF;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,YAAoB;IAEpB,OAAO,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;YAC1D,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,OAAO;aACX,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aAC/B,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EACJ,8DAA8D;gBAC9D,iEAAiE;gBACjE,uDAAuD;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EACJ,mEAAmE;gBACnE,qDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;SACL,CAAC;IACJ,CAAC;AACH,CAAC;AASD;;;;;;;;GAQG;AACH,SAAS,YAAY,CACnB,KAAa,EACb,KAAc,EACd,MAAM,GAAG,EAAE;IAEX,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QAC7D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAiC;IAEjC,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CACtC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,IAAI,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,OAAe,EAAE,MAAc;IAC3D,OAAO,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QACnC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,IAAI,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,CACD,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CACzE,CAAC,IAAI,EAAE;QACR,GAAG,UAAU;KACd,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/doctor-readiness-supply-chain.d.ts

@@ -0,0 +1,14 @@
+import type { ReadinessDimensionRecord } from "./doctor-readiness-types.js";
+/** The dependencies/supply-chain readiness dimension id (readiness-rubric). */
+export declare const DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID = "dependencies-supply-chain";
+/**
+ * Assess the dependencies/supply-chain dimension: B5, "an owned compatibility or
+ * security surface has no confidence model". Offline by construction — it reads
+ * only the repository's manifest, lockfiles, CI declarations, git hooks, and
+ * audit allowlists, and degrades to a stated-reason SKIP wherever those files
+ * cannot settle the question.
+ * @param root - Project root to assess
+ * @returns The dependencies/supply-chain dimension record
+ */
+export declare function assessDependenciesSupplyChainDimension(root: string): Promise<ReadinessDimensionRecord>;
+//# sourceMappingURL=doctor-readiness-supply-chain.d.ts.map

package/dist/cli/doctor-readiness-supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,+EAA+E;AAC/E,eAAO,MAAM,sCAAsC,8BACtB,CAAC;AAsL9B;;;;;;;;GAQG;AACH,wBAAsB,sCAAsC,CAC1D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,CAAC,CA8CnC"}