@codyswann/lisa 2.286.4 → 2.286.6

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -46,6 +46,24 @@ function git(args, options = {}) {
   return run("git", args, options).stdout.trim();
 }
 
+function curlConfigValue(value) {
+  return `"${String(value)
+    .replace(/\\/g, "\\\\")
+    .replace(/"/g, '\\"')
+    .replace(/\r/g, "\\r")
+    .replace(/\n/g, "\\n")}"`;
+}
+
+function secureCurl(args, entries, options = {}) {
+  const input = `${entries
+    .map(([name, value]) => `${name} = ${curlConfigValue(value)}`)
+    .join("\n")}\n`;
+  return run("curl", ["-fsS", "--config", "-", ...args], {
+    ...options,
+    input,
+  });
+}
+
 function projectRoot() {
   return git(["rev-parse", "--show-toplevel"]);
 }
@@ -536,15 +554,11 @@ function jiraIssue(ref, contract) {
   const credentials = jiraCredentials(contract);
   if (credentials) {
     const url = `${credentials.baseUrl}/rest/api/3/issue/${encodeURIComponent(ref)}?fields=project,status,labels,components,issuetype,subtasks,comment`;
-    const result = run(
-      "curl",
+    const result = secureCurl(
+      [url],
       [
-        "-fsS",
-        "-u",
-        `${credentials.login}:${credentials.token}`,
-        "-H",
-        "Accept: application/json",
-        url,
+        ["user", `${credentials.login}:${credentials.token}`],
+        ["header", "Accept: application/json"],
       ],
       { allowFailure: true }
     );
@@ -680,19 +694,13 @@ function linearIssue(ref, contract) {
   const query =
     "query($id:String!){issue(id:$id){id identifier team{key} state{type} labels{nodes{name}} children{nodes{state{type}}} attachments{nodes{url}} comments{nodes{body}}}}";
   const payload = JSON.stringify({ query, variables: { id: ref } });
-  const result = run(
-    "curl",
+  const result = secureCurl(
+    ["https://api.linear.app/graphql"],
     [
-      "-fsS",
-      "-X",
-      "POST",
-      "-H",
-      "Content-Type: application/json",
-      "-H",
-      `Authorization: ${token}`,
-      "--data-binary",
-      payload,
-      "https://api.linear.app/graphql",
+      ["request", "POST"],
+      ["header", "Content-Type: application/json"],
+      ["header", `Authorization: ${token}`],
+      ["data-binary", payload],
     ],
     { allowFailure: true }
   );
@@ -790,15 +798,11 @@ function assertBacklink(
   const credentials = jiraCredentials(contract);
   if (credentials) {
     const url = `${credentials.baseUrl}/rest/api/3/issue/${encodeURIComponent(ref)}/remotelink`;
-    const result = run(
-      "curl",
+    const result = secureCurl(
+      [url],
       [
-        "-fsS",
-        "-u",
-        `${credentials.login}:${credentials.token}`,
-        "-H",
-        "Accept: application/json",
-        url,
+        ["user", `${credentials.login}:${credentials.token}`],
+        ["header", "Accept: application/json"],
       ],
       { allowFailure: true }
     );
@@ -1092,7 +1096,7 @@ function main() {
 }
 
 try {
-  await main();
+  main();
 } catch (error) {
   const detail = error instanceof Error ? error.message : String(error);
   console.error(

package/dist/cli/doctor-readiness-credentials.d.ts

@@ -10,10 +10,11 @@
  *
  * Four declarations are treated as material over-authority: inherited secrets
  * (`secrets: inherit` hands a called workflow everything), `write-all`/`read-all`
- * blanket permission grants, a job that uses `GITHUB_TOKEN` with no
+ * blanket permission grants, a job that uses the repository token with no
  * `permissions` block at all (so it takes the repository default rather than a
- * stated minimum), and static long-lived AWS keys in a job that could have used
- * OIDC instead. Each is provable from the declaration alone.
+ * stated minimum), and static long-lived deployment credentials in jobs that
+ * should use a scoped or federated credential instead. Each is provable from
+ * the declaration alone.
  *
  * A fifth signal — one secret NAME appearing under several environments — is
  * reported as an *observation*, never a blocker: environment secrets are meant

package/dist/cli/doctor-readiness-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-credentials.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,iCAAiC,CAAC;AA4OzC,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,kBAAkB,CAYpB"}
+{"version":3,"file":"doctor-readiness-credentials.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,iCAAiC,CAAC;AAiQzC,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,kBAAkB,CAYpB"}

package/dist/cli/doctor-readiness-credentials.js

@@ -2,10 +2,28 @@
 const BLANKET_PERMISSIONS = new Set(["write-all", "read-all"]);
 /** Matches every `secrets.NAME` reference inside a job's declared text. */
 const SECRET_REFERENCE = /secrets\.(\w+)/g;
-/** Static AWS credential inputs that OIDC (`id-token: write`) would replace. */
-const STATIC_AWS_KEYS = ["aws-access-key-id", "aws-secret-access-key"];
+/** Static credential names and inputs that keyless or scoped auth should replace. */
+const STATIC_CREDENTIAL_KEYS = [
+    "aws-access-key-id",
+    "aws-secret-access-key",
+    "NPM_TOKEN",
+    "GCP_SERVICE_ACCOUNT_JSON",
+    "GOOGLE_APPLICATION_CREDENTIALS",
+    "AZURE_CREDENTIALS",
+    "ADMIN_PAT",
+    "BOT_ADMIN_PAT",
+    "GH_ADMIN_PAT",
+];
+/** Static cloud credential inputs that OIDC (`id-token: write`) can replace. */
+const OIDC_REPLACEABLE_KEYS = new Set([
+    "aws-access-key-id",
+    "aws-secret-access-key",
+    "GCP_SERVICE_ACCOUNT_JSON",
+    "GOOGLE_APPLICATION_CREDENTIALS",
+    "AZURE_CREDENTIALS",
+]);
 /** Matches a repository-token reference in either of its spellings. */
-const REPOSITORY_TOKEN = /GITHUB_TOKEN|github\.token/;
+const REPOSITORY_TOKEN = /\b(?:GITHUB_TOKEN|GH_TOKEN)\b|github\.token/;
 /**
  * Flatten every string a job declares — step commands, actions, `env`, and
  * `with` — into one searchable blob so a credential reference is found wherever
@@ -71,12 +89,13 @@ function inheritedSecretViolations(where, job) {
  * @returns Evidence lines (empty when permissions are declared)
  */
 function unscopedTokenViolations(where, workflow, job, text) {
-    const unscoped = REPOSITORY_TOKEN.test(text) &&
+    const token = REPOSITORY_TOKEN.exec(text)?.[0];
+    const unscoped = token !== undefined &&
         job.permissions === null &&
         workflow.permissions === null;
     return unscoped
         ? [
-            `${where} uses GITHUB_TOKEN with no \`permissions:\` block at either ` +
+            `${where} uses ${token} with no \`permissions:\` block at either ` +
                 "scope, so it runs with the repository default rather than a stated minimum",
         ]
         : [];
@@ -91,15 +110,14 @@ function unscopedTokenViolations(where, workflow, job, text) {
  * @returns Evidence lines (empty when the job is keyless or already OIDC-enabled)
  */
 function staticKeyViolations(where, workflow, job, text) {
-    const staticKey = STATIC_AWS_KEYS.find(key => text.includes(key));
-    if (staticKey === undefined ||
-        grantsOidc(job.permissions) ||
-        grantsOidc(workflow.permissions)) {
+    const oidcGranted = grantsOidc(job.permissions) || grantsOidc(workflow.permissions);
+    const staticKey = STATIC_CREDENTIAL_KEYS.find(key => text.includes(key) && !(oidcGranted && OIDC_REPLACEABLE_KEYS.has(key)));
+    if (staticKey === undefined) {
         return [];
     }
     return [
         `${where} authenticates with the static long-lived credential ` +
-            `\`${staticKey}\` where keyless OIDC (\`id-token: write\`) would do`,
+            `\`${staticKey}\` instead of a scoped or federated deployment credential`,
     ];
 }
 /**

package/dist/cli/doctor-readiness-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-credentials.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-credentials.ts"],"names":[],"mappings":"AAgCA,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,gFAAgF;AAChF,MAAM,eAAe,GAAG,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;AAEvE,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAQtD;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,GAAsB;IACrC,OAAO,GAAG,CAAC,KAAK;SACb,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACnD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC3B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,WAA0B;IAC5C,OAAO,CACL,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,IAAI;QACpB,WAAW,CAAC,UAAU,CAAC,KAAK,OAAO,CACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,KAAa,EACb,WAA0B;IAE1B,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,GAAG,KAAK,4BAA4B,WAAW,qBAAqB;gBAClE,yEAAyE;SAC5E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,KAAa,EACb,GAAsB;IAEtB,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAC9B,CAAC,CAAC;YACE,GAAG,KAAK,8DAA8D;gBACpE,8DAA8D;SACjE;QACH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAC9B,KAAa,EACb,QAAwB,EACxB,GAAsB,EACtB,IAAY;IAEZ,MAAM,QAAQ,GACZ,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,GAAG,CAAC,WAAW,KAAK,IAAI;QACxB,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC;IAChC,OAAO,QAAQ;QACb,CAAC,CAAC;YACE,GAAG,KAAK,8DAA8D;gBACpE,4EAA4E;SAC/E;QACH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,KAAa,EACb,QAAwB,EACxB,GAAsB,EACtB,IAAY;IAEZ,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IACE,SAAS,KAAK,SAAS;QACvB,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC;QAC3B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAChC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,GAAG,KAAK,uDAAuD;YAC7D,KAAK,SAAS,sDAAsD;KACvE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,QAAwB,EACxB,GAAsB;IAEtB,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO;QACL,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC;QACjD,GAAG,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC;QACxC,GAAG,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC;QACtD,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,SAAoC;IAEpC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,IAAI;SACR,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;SACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAChC,GAAsB;IAEtB,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;SACzD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,yEAAyE;QACzE,6EAA6E;SAC5E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAC9B,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAwB;IAC5C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,wBAAwB,CAC/B,SAAoC;IAEpC,MAAM,KAAK,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACnE,MAAM,YAAY,GAAG,YAAY,CAC/B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAC3E,CAAC;QACF,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC;YAC5B,CAAC,CAAC;gBACE,iBAAiB,MAAM,oBAAoB,YAAY,CAAC,MAAM,GAAG;oBAC/D,4BAA4B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;oBACpE,mEAAmE;oBACnE,gEAAgE;oBAChE,+DAA+D;aAClE;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAoC;IAEpC,OAAO;QACL,UAAU,EAAE;YACV,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAC9B,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,CAC5D;YACD,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAC9B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CACrE;SACF;QACD,aAAa,EAAE,wBAAwB,CAAC,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"doctor-readiness-credentials.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-credentials.ts"],"names":[],"mappings":"AAiCA,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,qFAAqF;AACrF,MAAM,sBAAsB,GAAG;IAC7B,mBAAmB;IACnB,uBAAuB;IACvB,WAAW;IACX,0BAA0B;IAC1B,gCAAgC;IAChC,mBAAmB;IACnB,WAAW;IACX,eAAe;IACf,cAAc;CACf,CAAC;AAEF,gFAAgF;AAChF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,mBAAmB;IACnB,uBAAuB;IACvB,0BAA0B;IAC1B,gCAAgC;IAChC,mBAAmB;CACpB,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAQvE;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,GAAsB;IACrC,OAAO,GAAG,CAAC,KAAK;SACb,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACnD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC3B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,WAA0B;IAC5C,OAAO,CACL,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,IAAI;QACpB,WAAW,CAAC,UAAU,CAAC,KAAK,OAAO,CACpC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,KAAa,EACb,WAA0B;IAE1B,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,GAAG,KAAK,4BAA4B,WAAW,qBAAqB;gBAClE,yEAAyE;SAC5E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,KAAa,EACb,GAAsB;IAEtB,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAC9B,CAAC,CAAC;YACE,GAAG,KAAK,8DAA8D;gBACpE,8DAA8D;SACjE;QACH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAC9B,KAAa,EACb,QAAwB,EACxB,GAAsB,EACtB,IAAY;IAEZ,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,QAAQ,GACZ,KAAK,KAAK,SAAS;QACnB,GAAG,CAAC,WAAW,KAAK,IAAI;QACxB,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC;IAChC,OAAO,QAAQ;QACb,CAAC,CAAC;YACE,GAAG,KAAK,SAAS,KAAK,4CAA4C;gBAChE,4EAA4E;SAC/E;QACH,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,KAAa,EACb,QAAwB,EACxB,GAAsB,EACtB,IAAY;IAEZ,MAAM,WAAW,GACf,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAC3C,GAAG,CAAC,EAAE,CACJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACzE,CAAC;IACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,GAAG,KAAK,uDAAuD;YAC7D,KAAK,SAAS,2DAA2D;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,QAAwB,EACxB,GAAsB;IAEtB,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO;QACL,GAAG,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC;QACjD,GAAG,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC;QACxC,GAAG,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC;QACtD,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,SAAoC;IAEpC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,IAAI;SACR,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;SACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAChC,GAAsB;IAEtB,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;SACzD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,yEAAyE;QACzE,6EAA6E;SAC5E,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAC9B,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAwB;IAC5C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,wBAAwB,CAC/B,SAAoC;IAEpC,MAAM,KAAK,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACnE,MAAM,YAAY,GAAG,YAAY,CAC/B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAC3E,CAAC;QACF,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC;YAC5B,CAAC,CAAC;gBACE,iBAAiB,MAAM,oBAAoB,YAAY,CAAC,MAAM,GAAG;oBAC/D,4BAA4B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;oBACpE,mEAAmE;oBACnE,gEAAgE;oBAChE,+DAA+D;aAClE;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAoC;IAEpC,OAAO;QACL,UAAU,EAAE;YACV,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAC9B,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,CAC5D;YACD,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAC9B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CACrE;SACF;QACD,aAAa,EAAE,wBAAwB,CAAC,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAshEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAutMjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAshEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAytMjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -2,7 +2,7 @@
 /** Generated by scripts/generate-upstream-evidence-manifest.mjs. Do not edit. */
 export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-contents/gitignore": "06b56376465d5421db55d0b04958bbc79fdbf33b42f0559fe5ef6875ced1160f",
-    "all/copy-overwrite/scripts/lisa-work-item.mjs": "f88f69d44693084428f44e3f2b80afecda08c7ee8747588f40277fdc9396fd8f",
+    "all/copy-overwrite/scripts/lisa-work-item.mjs": "4c263fef48c03b3b6c623ea8a6cd55505bfaf28197e5072226ea35f9f3d26885",
     "all/create-only/.claude/rules/PROJECT_RULES.md": "6e1c7923ad2a15356babc60c97e7f97be728d790af285b6a7cd7d1b4d39cd97f",
     "all/create-only/.lisaignore": "3c9827e7e98daa46510b5357cd6dd9406da1821e64cc46d2eea9f311cd6d06b9",
     "all/create-only/scripts/remote-agent-aws-setup.sh": "7677908a345891810d2104ba8b2fd1a8318bb29c408fb5ce0110d57beef9b556",
@@ -6653,6 +6653,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/doctor-readiness-capabilities.test.ts": true,
     "tests/unit/cli/doctor-readiness-context-precision.test.ts": true,
     "tests/unit/cli/doctor-readiness-context.test.ts": true,
+    "tests/unit/cli/doctor-readiness-credentials-round2.test.ts": true,
     "tests/unit/cli/doctor-readiness-delivery-artifact.test.ts": true,
     "tests/unit/cli/doctor-readiness-delivery-triggers.test.ts": true,
     "tests/unit/cli/doctor-readiness-delivery.test.ts": true,
@@ -6829,6 +6830,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/hooks/verification-failure-mode-fixtures.test.ts": true,
     "tests/unit/hooks/work-item-wiring.test.ts": true,
     "tests/unit/hooks/worktree-create.test.ts": true,
+    "tests/unit/migrations/ensure-audit-ignore-local-exclusions-esbuild.test.ts": true,
     "tests/unit/migrations/ensure-audit-ignore-local-exclusions.test.ts": true,
     "tests/unit/migrations/ensure-jest-rn-mock-accessibility-manager.test.ts": true,
     "tests/unit/migrations/ensure-lisa-postinstall.test.ts": true,