npm - @codyswann/lisa - Versions diffs - 2.300.9 → 2.300.11 - Mend

@codyswann/lisa 2.300.9 → 2.300.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (64) hide show

package/dist/cli/doctor-readiness-guardrails.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"doctor-readiness-guardrails.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-guardrails.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EAIpB,MAAM,iCAAiC,CAAC;AAEzC,gFAAgF;AAChF,eAAO,MAAM,gCAAgC,wBAAwB,CAAC;AA+~~NtE~~;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,EAAE,MAAM,EACZ,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,GAC1C,OAAO,CAAC,wBAAwB,CAAC,CA8BnC"}
1	+ {"version":3,"file":"doctor-readiness-guardrails.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-guardrails.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EAIpB,MAAM,iCAAiC,CAAC;AAEzC,gFAAgF;AAChF,eAAO,MAAM,gCAAgC,wBAAwB,CAAC;AA+RtE;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,EAAE,MAAM,EACZ,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,GAC1C,OAAO,CAAC,wBAAwB,CAAC,CA8BnC"}

package/dist/cli/doctor-readiness-guardrails.js CHANGED Viewed

@@ -49,13 +49,20 @@ const PROTECTION_RULES_SKIP_REASON = "Whether a declared `environment:` actually
  * blocker that fires on normal delivery is a blocker nobody will believe.
  */
 const CONSEQUENTIAL_OPS = [
-    /\bterraform\s+(\S+\s+)*apply\b[^\n]*-auto-approve\b/,
     /\bterraform\s+(\S+\s+)*destroy\b/,
     /\bcdk\s+destroy\b/,
     /\bpulumi\s+destroy\b/,
     /\bpulumi\s+up\b[^\n]*--yes\b/,
     /\bserverless\s+remove\b/,
 ];
+/** A Terraform apply command, consequential only when auto-approval is present. */
+const TERRAFORM_APPLY = /\bterraform(?:\s+\S+)*\s+apply\b/;
+/** Terraform's non-interactive approval flag. */
+const TERRAFORM_AUTO_APPROVE = /(^|\s)-auto-approve\b/;
+/** Terraform env vars that inject CLI args into every command. */
+const TERRAFORM_ARGS_AUTO_APPROVE = /\b(tf_cli_args(?:_apply)?|tf_args)\s*[:=][^\n]*-auto-approve\b/;
+/** Separators that end one shell invocation for this conservative scan. */
+const SHELL_INVOCATION_SEPARATOR = /\n|;|&&|\|\|/;
 /**
  * Commands that apply schema migrations, in the ecosystems Lisa templates. The
  * `(?!:)` lookahead keeps the read-only subcommands out: `db:migrate:status`
@@ -78,6 +85,45 @@ const PRODUCTION_MARKERS = [
     /--env(ironment)?[= ]prod/,
     /\bprod(uction)?\.tfvars\b/,
 ];
+/**
+ * Collapse only shell continuation newlines. Ordinary newlines remain command
+ * boundaries so unrelated invocations cannot combine into one Terraform apply.
+ * @param command - Shell command text
+ * @returns Command text with escaped newlines joined
+ */
+function normalizeShellContinuations(command) {
+    return command.replace(/\\\r?\n\s*/g, " ");
+}
+/**
+ * Extract shell invocations that contain `terraform apply`.
+ * @param command - Shell command text
+ * @returns Invocation fragments that include Terraform apply
+ */
+function terraformApplyInvocations(command) {
+    return normalizeShellContinuations(command)
+        .split(SHELL_INVOCATION_SEPARATOR)
+        .map(part => part.trim())
+        .filter(part => TERRAFORM_APPLY.test(part));
+}
+/**
+ * Check whether a Terraform apply invocation targets a saved plan file.
+ * @param invocation - Single shell invocation
+ * @returns True when `apply` has a positional plan-file argument
+ */
+function appliesSavedTerraformPlan(invocation) {
+    const tokens = invocation.split(/\s+/).filter(Boolean);
+    const terraformIndex = tokens.findIndex(token => token === "terraform");
+    if (terraformIndex === -1) {
+        return false;
+    }
+    const applyIndex = tokens.indexOf("apply", terraformIndex + 1);
+    if (applyIndex === -1) {
+        return false;
+    }
+    return tokens
+        .slice(applyIndex + 1)
+        .some(token => token !== "\\" && !token.startsWith("-"));
+}
 /**
  * Whether a command is an irreversible or expensive operation.
  *
@@ -96,7 +142,13 @@ function isConsequential(command, job, step) {
     if (looksEphemeral(targetEvidence)) {
         return false;
     }
-    return (CONSEQUENTIAL_OPS.some(pattern => pattern.test(command)) ||
+    const terraformApplyInvocationsToAssess = terraformApplyInvocations(command);
+    const terraformAutoApprovedApply = terraformApplyInvocationsToAssess.some(invocation => TERRAFORM_AUTO_APPROVE.test(invocation) ||
+        appliesSavedTerraformPlan(invocation)) ||
+        (terraformApplyInvocationsToAssess.length > 0 &&
+            TERRAFORM_ARGS_AUTO_APPROVE.test(targetEvidence));
+    return (terraformAutoApprovedApply ||
+        CONSEQUENTIAL_OPS.some(pattern => pattern.test(command)) ||
         (MIGRATION_COMMANDS.some(pattern => pattern.test(command)) &&
             PRODUCTION_MARKERS.some(pattern => pattern.test(targetEvidence))));
 }

package/dist/cli/doctor-readiness-guardrails.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"doctor-readiness-guardrails.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EAEd,YAAY,GACb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAIL,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,gFAAgF;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC;AAEtE,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;GAIG;AACH,MAAM,4BAA4B,GAChC,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,8EAA8E;IAC9E,qEAAqE;IACrE,2DAA2D,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,iBAAiB,GAAsB;IAC3C,~~qDAAqD;IACrD,~~kCAAkC;IAClC,mBAAmB;IACnB,sBAAsB;IACtB,8BAA8B;IAC9B,yBAAyB;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,qBAAqB;IACrB,sBAAsB;IACtB,mBAAmB;IACnB,uBAAuB;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,8GAA8G;IAC9G,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,GAAsB,EACtB,IAAwB;IAExB,MAAM,cAAc,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,IAAI,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxD,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAAsB;IACpD,cAAc;IACd,qBAAqB;IACrB,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,QAAwB;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/C,0BAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC3C,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,KAAK,QAAQ,CAAC,IAAI,8CAA8C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACtF,6EAA6E;QAC7E,sEAAsE;QACtE,yDAAyD,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CACvB,SAAyB,EACzB,GAAsB,EACtB,IAAwB;IAExB,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,GAAG,CAAC,EAAE,2DAA2D;QAC1E,+BAA+B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB;QAC7E,6EAA6E;QAC7E,2CAA2C,CAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,OAAO;QACL,OAAO,EAAE,qBAAqB;QAC9B,kBAAkB,EAChB,uEAAuE;YACvE,mBAAmB;QACrB,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;QAC/D,gBAAgB,EACd,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,mDAAmD;QACrD,eAAe,EACb,yEAAyE;YACzE,mEAAmE;YACnE,sEAAsE;QACxE,mBAAmB,EAAE;YACnB,wEAAwE;gBACtE,mDAAmD;SACtD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CACjB,IAAmB,EACnB,SAAiB,EACjB,OAAgB;IAEhB,MAAM,MAAM,GACV,SAAS,KAAK,CAAC;QACb,CAAC,CAAC,4EAA4E;YAC5E,oEAAoE;YACpE,0CAA0C;YAC1C,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,4BAA4B,EAAE;QACvE,CAAC,CAAC,QAAQ,SAAS,kDAAkD;YACnE,6DAA6D;YAC7D,4DAA4D;YAC5D,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,4BAA4B,EAAE,CAAC;IAC5E,OAAO;QACL,EAAE,EAAE,gCAAgC;QACpC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM;gBACN,IAAI,EAAE,IAAI;aACX;YACD,GAAG,qBAAqB,CAAC;gBACvB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,KAAK,CAAC,EAAE,CACN,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,KAAK,0BAA0B;oBACpE,gBAAgB,KAAK,CAAC,OAAO,wCAAwC;oBACrE,mEAAmE;oBACnE,8DAA8D;oBAC9D,4DAA4D;oBAC5D,kCAAkC,CACrC;gBACD,GAAG,IAAI,CAAC,UAAU;aACnB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,IAAY,EACZ,eAA2C;IAE3C,MAAM,SAAS,GACb,eAAe,IAAI,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,eAAe,EAAE;QACpD,kBAAkB,EAAE,iBAAiB;QACrC,cAAc,EAAE,gBAAgB;KACjC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACzC,OAAO,UAAU,CACf,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EACrE,SAAS,CAAC,MAAM,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,gCAAgC;QACpC,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,iBAAiB,CAAC,IAAI,CAAC;YACvB,mEAAmE;YACnE,oEAAoE;YACpE,GAAG,qBAAqB,CAAC;gBACvB,4BAA4B;gBAC5B,GAAG,IAAI,CAAC,UAAU;aACnB,CAAC;SACH;KACF,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"doctor-readiness-guardrails.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EAEd,YAAY,GACb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAIL,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,gFAAgF;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC;AAEtE,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;GAIG;AACH,MAAM,4BAA4B,GAChC,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,8EAA8E;IAC9E,qEAAqE;IACrE,2DAA2D,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,iBAAiB,GAAsB;IAC3C,kCAAkC;IAClC,mBAAmB;IACnB,sBAAsB;IACtB,8BAA8B;IAC9B,yBAAyB;CAC1B,CAAC;AAEF,mFAAmF;AACnF,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,iDAAiD;AACjD,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAEvD,kEAAkE;AAClE,MAAM,2BAA2B,GAC/B,gEAAgE,CAAC;AAEnE,2EAA2E;AAC3E,MAAM,0BAA0B,GAAG,cAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,qBAAqB;IACrB,sBAAsB;IACtB,mBAAmB;IACnB,uBAAuB;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,8GAA8G;IAC9G,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,OAAe;IAClD,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,OAAe;IAChD,OAAO,2BAA2B,CAAC,OAAO,CAAC;SACxC,KAAK,CAAC,0BAA0B,CAAC;SACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,UAAkB;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;IACxE,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM;SACV,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;SACrB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,GAAsB,EACtB,IAAwB;IAExB,MAAM,cAAc,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,IAAI,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,iCAAiC,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,0BAA0B,GAC9B,iCAAiC,CAAC,IAAI,CACpC,UAAU,CAAC,EAAE,CACX,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC;QACvC,yBAAyB,CAAC,UAAU,CAAC,CACxC;QACD,CAAC,iCAAiC,CAAC,MAAM,GAAG,CAAC;YAC3C,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACtD,OAAO,CACL,0BAA0B;QAC1B,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxD,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAAsB;IACpD,cAAc;IACd,qBAAqB;IACrB,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,QAAwB;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/C,0BAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC3C,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,KAAK,QAAQ,CAAC,IAAI,8CAA8C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACtF,6EAA6E;QAC7E,sEAAsE;QACtE,yDAAyD,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CACvB,SAAyB,EACzB,GAAsB,EACtB,IAAwB;IAExB,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,GAAG,CAAC,EAAE,2DAA2D;QAC1E,+BAA+B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB;QAC7E,6EAA6E;QAC7E,2CAA2C,CAC5C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,OAAO;QACL,OAAO,EAAE,qBAAqB;QAC9B,kBAAkB,EAChB,uEAAuE;YACvE,mBAAmB;QACrB,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;QAC/D,gBAAgB,EACd,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,mDAAmD;QACrD,eAAe,EACb,yEAAyE;YACzE,mEAAmE;YACnE,sEAAsE;QACxE,mBAAmB,EAAE;YACnB,wEAAwE;gBACtE,mDAAmD;SACtD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CACjB,IAAmB,EACnB,SAAiB,EACjB,OAAgB;IAEhB,MAAM,MAAM,GACV,SAAS,KAAK,CAAC;QACb,CAAC,CAAC,4EAA4E;YAC5E,oEAAoE;YACpE,0CAA0C;YAC1C,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,4BAA4B,EAAE;QACvE,CAAC,CAAC,QAAQ,SAAS,kDAAkD;YACnE,6DAA6D;YAC7D,4DAA4D;YAC5D,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,4BAA4B,EAAE,CAAC;IAC5E,OAAO;QACL,EAAE,EAAE,gCAAgC;QACpC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM;gBACN,IAAI,EAAE,IAAI;aACX;YACD,GAAG,qBAAqB,CAAC;gBACvB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,KAAK,CAAC,EAAE,CACN,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,KAAK,0BAA0B;oBACpE,gBAAgB,KAAK,CAAC,OAAO,wCAAwC;oBACrE,mEAAmE;oBACnE,8DAA8D;oBAC9D,4DAA4D;oBAC5D,kCAAkC,CACrC;gBACD,GAAG,IAAI,CAAC,UAAU;aACnB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,IAAY,EACZ,eAA2C;IAE3C,MAAM,SAAS,GACb,eAAe,IAAI,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,eAAe,EAAE;QACpD,kBAAkB,EAAE,iBAAiB;QACrC,cAAc,EAAE,gBAAgB;KACjC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACzC,OAAO,UAAU,CACf,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EACrE,SAAS,CAAC,MAAM,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,gCAAgC;QACpC,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,iBAAiB,CAAC,IAAI,CAAC;YACvB,mEAAmE;YACnE,oEAAoE;YACpE,GAAG,qBAAqB,CAAC;gBACvB,4BAA4B;gBAC5B,GAAG,IAAI,CAAC,UAAU;aACnB,CAAC;SACH;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-supply-chain-evidence.d.ts ADDED Viewed

@@ -0,0 +1,48 @@
+/**
+ * Evidence builders for the dependencies/supply-chain readiness producer.
+ * @module cli/doctor-readiness-supply-chain-evidence
+ */
+import { type DependencySpec } from "./doctor-readiness-supply-chain-scan.js";
+import type { WorkspaceMembers } from "./doctor-readiness-workspaces.js";
+/** One package manifest B5 inspects. */
+export interface ManifestUnderAssessment {
+    readonly manifestPath: string;
+    readonly manifest: Record<string, unknown>;
+}
+/** Values already read from the repository for dependency-confidence evidence. */
+interface DependencyConfidenceInputs {
+    readonly auditGate: string | null;
+    readonly lockfile: string | null;
+    readonly lockfileInstallGate: string | null;
+    readonly specs: readonly DependencySpec[];
+    readonly workspaces: WorkspaceMembers;
+}
+/**
+ * Collect B5 evidence for install-time execution surfaces.
+ * @param manifests - Manifests under assessment
+ * @returns Evidence lines for install-time execution surfaces
+ */
+export declare function installTimeExecutionViolations(manifests: readonly ManifestUnderAssessment[]): readonly string[];
+/**
+ * Collect B5 violations from dependency specs, lockfiles, and audit gates.
+ * @param inputs - Values already read from the repository
+ * @param inputs.auditGate - Path to the dependency-audit gate, if found
+ * @param inputs.lockfile - Path to the committed lockfile, if found
+ * @param inputs.lockfileInstallGate - Path to the lockfile-enforcing install
+ * @param inputs.specs - Declared dependency specs
+ * @param inputs.workspaces - What resolving the workspace members established
+ * @returns Evidence lines for dependency-confidence violations
+ */
+export declare function dependencyConfidenceViolations({ auditGate, lockfile, lockfileInstallGate, specs, workspaces, }: DependencyConfidenceInputs): readonly string[];
+/**
+ * Collect non-blocking observations from dependency-confidence evidence.
+ * @param inputs - Values already read from the repository
+ * @param inputs.auditGate - Path to the dependency-audit gate, if found
+ * @param inputs.lockfile - Path to the committed lockfile, if found
+ * @param inputs.lockfileInstallGate - Path to the lockfile-enforcing install
+ * @param inputs.specs - Declared dependency specs
+ * @returns Evidence lines for clean dependency-confidence signals
+ */
+export declare function dependencyConfidenceObservations({ auditGate, lockfile, lockfileInstallGate, specs, }: DependencyConfidenceInputs): readonly string[];
+export {};
+//# sourceMappingURL=doctor-readiness-supply-chain-evidence.d.ts.map

package/dist/cli/doctor-readiness-supply-chain-evidence.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"doctor-readiness-supply-chain-evidence.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-evidence.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAUzE,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,kFAAkF;AAClF,UAAU,0BAA0B;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AA0GD;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,SAAS,uBAAuB,EAAE,GAC5C,SAAS,MAAM,EAAE,CAOnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,KAAK,EACL,UAAU,GACX,EAAE,0BAA0B,GAAG,SAAS,MAAM,EAAE,CAkChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,EAC/C,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,KAAK,GACN,EAAE,0BAA0B,GAAG,SAAS,MAAM,EAAE,CAahD"}

package/dist/cli/doctor-readiness-supply-chain-evidence.js ADDED Viewed

@@ -0,0 +1,163 @@
+/**
+ * Evidence builders for the dependencies/supply-chain readiness producer.
+ * @module cli/doctor-readiness-supply-chain-evidence
+ */
+import { isFloatingSpec, LOCKFILES, } from "./doctor-readiness-supply-chain-scan.js";
+/** Package lifecycle scripts that execute during dependency installation. */
+const INSTALL_TIME_SCRIPT_NAMES = new Set([
+    "preinstall",
+    "install",
+    "postinstall",
+    "prepare",
+]);
+/**
+ * Render a bounded list for operator-facing evidence.
+ * @param values - Values to render
+ * @returns A comma-separated list
+ */
+function renderList(values) {
+    const shown = values.slice(0, 5);
+    const overflow = values.length - shown.length;
+    return (shown.map(value => `\`${value}\``).join(", ") +
+        (overflow > 0 ? `, and ${overflow} more` : ""));
+}
+/**
+ * Build the evidence line for a manifest with no committed lockfile.
+ * @param specCount - How many specs the manifest declares
+ * @returns One evidence line
+ */
+function lockfileEvidence(specCount) {
+    return (`package manifest(s), starting with \`package.json\`, declare ${specCount} ` +
+        `dependency spec(s) but no lockfile is committed (looked for ` +
+        `${LOCKFILES.join(", ")}) — two installs can resolve to different trees, ` +
+        "so what was validated is not provably what gets installed");
+}
+/**
+ * Whether a floating-looking spec is really a local workspace link.
+ * @param spec - The declared spec
+ * @param workspaces - What resolving the workspace members established
+ * @returns True when the spec links to a workspace member
+ */
+function linksWorkspaceMember(spec, workspaces) {
+    if (!workspaces.declared) {
+        return false;
+    }
+    return (workspaces.names.has(spec.name) ||
+        (workspaces.names.size === 0 && spec.spec.trim() === "*"));
+}
+/**
+ * Build evidence when a manifest declares install-time lifecycle scripts.
+ * @param manifestPath - Repo-relative manifest path
+ * @param manifest - Parsed package manifest
+ * @returns Evidence line when install-time scripts exist
+ */
+function installTimeScriptEvidence(manifestPath, manifest) {
+    const scripts = manifest.scripts;
+    if (scripts === null ||
+        typeof scripts !== "object" ||
+        Array.isArray(scripts)) {
+        return null;
+    }
+    const scriptNames = Object.keys(scripts).filter(name => INSTALL_TIME_SCRIPT_NAMES.has(name));
+    if (scriptNames.length === 0) {
+        return null;
+    }
+    return (`\`${manifestPath}\` declares install-time lifecycle script(s) ` +
+        `${renderList(scriptNames)}, so dependency installation executes project ` +
+        "code before the normal test/audit surface; B5 needs an explicit confidence " +
+        "decision for that install-time execution path");
+}
+/**
+ * Build evidence when Bun trusted dependencies are declared.
+ * @param manifestPath - Repo-relative manifest path
+ * @param manifest - Parsed package manifest
+ * @returns Evidence line when trusted dependencies are declared
+ */
+function trustedDependencyEvidence(manifestPath, manifest) {
+    const trusted = manifest.trustedDependencies;
+    const names = Array.isArray(trusted)
+        ? trusted.filter((entry) => typeof entry === "string")
+        : [];
+    if (names.length === 0) {
+        return null;
+    }
+    return (`\`${manifestPath}\` marks ${renderList(names)} as ` +
+        "`trustedDependencies`, allowing third-party install-time scripts to run; " +
+        "B5 needs a written confidence decision for each trusted package because " +
+        "a clean audit gate alone does not explain that execution authority");
+}
+/**
+ * Collect B5 evidence for install-time execution surfaces.
+ * @param manifests - Manifests under assessment
+ * @returns Evidence lines for install-time execution surfaces
+ */
+export function installTimeExecutionViolations(manifests) {
+    return manifests.flatMap(({ manifestPath, manifest }) => [
+        installTimeScriptEvidence(manifestPath, manifest),
+        trustedDependencyEvidence(manifestPath, manifest),
+    ].flatMap(evidence => (evidence === null ? [] : [evidence])));
+}
+/**
+ * Collect B5 violations from dependency specs, lockfiles, and audit gates.
+ * @param inputs - Values already read from the repository
+ * @param inputs.auditGate - Path to the dependency-audit gate, if found
+ * @param inputs.lockfile - Path to the committed lockfile, if found
+ * @param inputs.lockfileInstallGate - Path to the lockfile-enforcing install
+ * @param inputs.specs - Declared dependency specs
+ * @param inputs.workspaces - What resolving the workspace members established
+ * @returns Evidence lines for dependency-confidence violations
+ */
+export function dependencyConfidenceViolations({ auditGate, lockfile, lockfileInstallGate, specs, workspaces, }) {
+    if (specs.length === 0) {
+        return [];
+    }
+    const floating = specs.filter(spec => isFloatingSpec(spec.spec) && !linksWorkspaceMember(spec, workspaces));
+    return [
+        ...(lockfile === null ? [lockfileEvidence(specs.length)] : []),
+        ...(lockfile !== null && lockfileInstallGate === null
+            ? [
+                `lockfile \`${lockfile}\` is committed, but no CI or hook install ` +
+                    "step was found that enforces it with `npm ci`, " +
+                    "`bun install --frozen-lockfile`, `pnpm install --frozen-lockfile`, " +
+                    "or `yarn install --immutable`; a workflow can silently rewrite " +
+                    "or bypass the tree that was validated",
+            ]
+            : []),
+        ...floating.map(spec => `\`${spec.manifestPath}\` \`${spec.block}.${spec.name}\` is ` +
+            `\`${spec.spec}\`, which resolves to whatever is newest at install ` +
+            "time rather than to a version anything was ever validated against"),
+        ...(auditGate === null
+            ? [
+                "no dependency-audit gate covering the JavaScript tree was found " +
+                    "anywhere — no `npm`/`bun` audit step in `.github/workflows/*.yml`, " +
+                    "none in a git hook, and no `dependabot.yml` npm entry or " +
+                    "`renovate.json` — so a newly disclosed advisory in this tree " +
+                    "would never be noticed by anything",
+            ]
+            : []),
+    ];
+}
+/**
+ * Collect non-blocking observations from dependency-confidence evidence.
+ * @param inputs - Values already read from the repository
+ * @param inputs.auditGate - Path to the dependency-audit gate, if found
+ * @param inputs.lockfile - Path to the committed lockfile, if found
+ * @param inputs.lockfileInstallGate - Path to the lockfile-enforcing install
+ * @param inputs.specs - Declared dependency specs
+ * @returns Evidence lines for clean dependency-confidence signals
+ */
+export function dependencyConfidenceObservations({ auditGate, lockfile, lockfileInstallGate, specs, }) {
+    if (specs.length === 0) {
+        return [];
+    }
+    return [
+        ...(lockfile === null ? [] : [`Lockfile in use: \`${lockfile}\`.`]),
+        ...(lockfileInstallGate === null
+            ? []
+            : [`Lockfile-enforcing install declared in \`${lockfileInstallGate}\`.`]),
+        ...(auditGate === null
+            ? []
+            : [`Dependency-audit gate declared in \`${auditGate}\`.`]),
+    ];
+}
+//# sourceMappingURL=doctor-readiness-supply-chain-evidence.js.map

package/dist/cli/doctor-readiness-supply-chain-evidence.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"doctor-readiness-supply-chain-evidence.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-evidence.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAEL,cAAc,EACd,SAAS,GACV,MAAM,yCAAyC,CAAC;AAGjD,6EAA6E;AAC7E,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,YAAY;IACZ,SAAS;IACT,aAAa;IACb,SAAS;CACV,CAAC,CAAC;AAiBH;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAyB;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9C,OAAO,CACL,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7C,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,QAAQ,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO,CACL,gEAAgE,SAAS,GAAG;QAC5E,8DAA8D;QAC9D,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD;QAC1E,2DAA2D,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,IAAoB,EACpB,UAA4B;IAE5B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,YAAoB,EACpB,QAAiC;IAEjC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CACrD,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,CACpC,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,KAAK,YAAY,+CAA+C;QAChE,GAAG,UAAU,CAAC,WAAW,CAAC,gDAAgD;QAC1E,6EAA6E;QAC7E,+CAA+C,CAChD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAChC,YAAoB,EACpB,QAAiC;IAEjC,MAAM,OAAO,GAAG,QAAQ,CAAC,mBAAmB,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAClC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACvE,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,KAAK,YAAY,YAAY,UAAU,CAAC,KAAK,CAAC,MAAM;QACpD,2EAA2E;QAC3E,0EAA0E;QAC1E,oEAAoE,CACrE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAA6C;IAE7C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,CACtD;QACE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,CAAC;QACjD,yBAAyB,CAAC,YAAY,EAAE,QAAQ,CAAC;KAClD,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAAC,EAC7C,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,KAAK,EACL,UAAU,GACiB;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAC3B,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,CAC7E,CAAC;IACF,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,mBAAmB,KAAK,IAAI;YACnD,CAAC,CAAC;gBACE,cAAc,QAAQ,6CAA6C;oBACjE,iDAAiD;oBACjD,qEAAqE;oBACrE,iEAAiE;oBACjE,uCAAuC;aAC1C;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,QAAQ,CAAC,GAAG,CACb,IAAI,CAAC,EAAE,CACL,KAAK,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,QAAQ;YAC7D,KAAK,IAAI,CAAC,IAAI,sDAAsD;YACpE,mEAAmE,CACtE;QACD,GAAG,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,CAAC;gBACE,kEAAkE;oBAChE,qEAAqE;oBACrE,2DAA2D;oBAC3D,+DAA+D;oBAC/D,oCAAoC;aACvC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAAC,EAC/C,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,KAAK,GACsB;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB,QAAQ,KAAK,CAAC,CAAC;QACnE,GAAG,CAAC,mBAAmB,KAAK,IAAI;YAC9B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,4CAA4C,mBAAmB,KAAK,CAAC,CAAC;QAC3E,GAAG,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,uCAAuC,SAAS,KAAK,CAAC,CAAC;KAC7D,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-supply-chain.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"doctor-readiness-supply-chain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"~~AA6CA~~,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,+EAA+E;AAC/E,eAAO,MAAM,sCAAsC,8BACtB,CAAC;~~AAiO9B~~;;;;;;;;GAQG;AACH,wBAAsB,sCAAsC,CAC1D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,CAAC,~~CAmDnC~~"}
1	+ {"version":3,"file":"doctor-readiness-supply-chain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,+EAA+E;AAC/E,eAAO,MAAM,sCAAsC,8BACtB,CAAC;AA8J9B;;;;;;;;GAQG;AACH,wBAAsB,sCAAsC,CAC1D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,CAAC,CA4DnC"}

package/dist/cli/doctor-readiness-supply-chain.js CHANGED Viewed

@@ -29,7 +29,8 @@
  */
 import { informationalFindings } from "./doctor-readiness-shared.js";
 import { auditExceptionViolations } from "./doctor-readiness-audit-allowlist.js";
-import { collectSpecs, findAuditGate, findLockfile, findLockfileInstallGate, isFloatingSpec, LOCKFILES, readManifest, } from "./doctor-readiness-supply-chain-scan.js";
+import { collectSpecs, findAuditGate, findLockfile, findLockfileInstallGate, readManifest, } from "./doctor-readiness-supply-chain-scan.js";
+import { dependencyConfidenceObservations, dependencyConfidenceViolations, installTimeExecutionViolations, } from "./doctor-readiness-supply-chain-evidence.js";
 import { resolveWorkspaceMembers, } from "./doctor-readiness-workspaces.js";
 /** The dependencies/supply-chain readiness dimension id (readiness-rubric). */
 export const DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID = "dependencies-supply-chain";
@@ -37,87 +38,33 @@ export const DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID = "dependencies-supply-chain
 const SUPPLY_CHAIN_BLOCKER_ID = "B5";
 /** Most evidence lines carried into a single finding, to keep it readable. */
 const MAX_EVIDENCE_LINES = 12;
-/**
- * Build the evidence line for a manifest with no committed lockfile.
- * @param specCount - How many specs the manifest declares
- * @returns One evidence line
- */
-function lockfileEvidence(specCount) {
-    return (`package manifest(s), starting with \`package.json\`, declare ${specCount} ` +
-        `dependency spec(s) but no lockfile is committed (looked for ` +
-        `${LOCKFILES.join(", ")}) — two installs can resolve to different trees, ` +
-        "so what was validated is not provably what gets installed");
-}
-/**
- * Whether a floating-looking spec is really a link to a package in this
- * repository. `"@acme/utils": "*"` against a workspace member resolves to the
- * local package, which is the workspace idiom rather than a floating install —
- * so faulting it would fail every correctly configured monorepo.
- *
- * When workspaces are declared but no member name could be resolved (an
- * unreadable child manifest, an unsupported glob), a bare `*` is exempted
- * anyway: the repository has told us it links locally, and absence of proof is
- * not proof of a violation.
- * @param spec - The declared spec
- * @param workspaces - What resolving the workspace members established
- * @returns True when the spec links to a workspace member
- */
-function linksWorkspaceMember(spec, workspaces) {
-    if (!workspaces.declared) {
-        return false;
-    }
-    return (workspaces.names.has(spec.name) ||
-        (workspaces.names.size === 0 && spec.spec.trim() === "*"));
-}
 /**
  * Assess a repository's dependency confidence model.
  * @param root - Repository root
  * @param specs - Declared dependency specs
+ * @param manifests - Parsed package manifests under assessment
  * @param workspaces - What resolving the workspace members established
  * @returns Evidence lines for violations, and non-blocking observations
  */
-async function collectFindings(root, specs, workspaces) {
+async function collectFindings(root, specs, manifests, workspaces) {
     const lockfile = await findLockfile(root);
     const lockfileInstallGate = lockfile === null ? null : await findLockfileInstallGate(root);
     const auditGate = await findAuditGate(root);
-    const floating = specs.filter(spec => isFloatingSpec(spec.spec) && !linksWorkspaceMember(spec, workspaces));
+    const inputs = {
+        auditGate,
+        lockfile,
+        lockfileInstallGate,
+        specs,
+        workspaces,
+    };
     return {
         violations: [
-            ...(lockfile === null ? [lockfileEvidence(specs.length)] : []),
-            ...(lockfile !== null && lockfileInstallGate === null
-                ? [
-                    `lockfile \`${lockfile}\` is committed, but no CI or hook install ` +
-                        "step was found that enforces it with `npm ci`, " +
-                        "`bun install --frozen-lockfile`, `pnpm install --frozen-lockfile`, " +
-                        "or `yarn install --immutable`; a workflow can silently rewrite " +
-                        "or bypass the tree that was validated",
-                ]
-                : []),
-            ...floating.map(spec => `\`${spec.manifestPath}\` \`${spec.block}.${spec.name}\` is ` +
-                `\`${spec.spec}\`, ` +
-                "which resolves to whatever is newest at install time rather than to " +
-                "a version anything was ever validated against"),
-            ...(auditGate === null
-                ? [
-                    "no dependency-audit gate covering the JavaScript tree was found " +
-                        "anywhere — no `npm`/`bun` audit step in `.github/workflows/*.yml`, " +
-                        "none in a git hook, and no `dependabot.yml` npm entry or " +
-                        "`renovate.json` — so a newly disclosed advisory in this tree " +
-                        "would never be noticed by anything",
-                ]
-                : []),
+            ...dependencyConfidenceViolations(inputs),
+            ...installTimeExecutionViolations(manifests),
             ...(await auditExceptionViolations(root)),
         ],
         observations: [
-            ...(lockfile === null ? [] : [`Lockfile in use: \`${lockfile}\`.`]),
-            ...(lockfileInstallGate === null
-                ? []
-                : [
-                    `Lockfile-enforcing install declared in \`${lockfileInstallGate}\`.`,
-                ]),
-            ...(auditGate === null
-                ? []
-                : [`Dependency-audit gate declared in \`${auditGate}\`.`]),
+            ...dependencyConfidenceObservations(inputs),
             ...(workspaces.declared ? [workspaceObservation(workspaces)] : []),
         ],
     };
@@ -232,16 +179,24 @@ export async function assessDependenciesSupplyChainDimension(root) {
         return skipRecord(outcome.reason);
     }
     const workspaces = await resolveWorkspaceMembers(root, outcome.manifest);
+    const manifests = [
+        { manifestPath: "package.json", manifest: outcome.manifest },
+        ...workspaces.members.map(member => ({
+            manifestPath: member.manifestPath,
+            manifest: member.manifest,
+        })),
+    ];
     const specs = [
         ...collectSpecs(outcome.manifest),
         ...workspaces.members.flatMap(member => collectSpecs(member.manifest, member.manifestPath)),
     ];
-    if (specs.length === 0) {
+    const installTimeViolations = installTimeExecutionViolations(manifests);
+    if (specs.length === 0 && installTimeViolations.length === 0) {
         return skipRecord("No resolved package manifest declares dependencies, so this repository " +
             "owns no third-party surface a confidence model could cover; " +
             "supply-chain confidence is not established either way");
     }
-    const { violations, observations } = await collectFindings(root, specs, workspaces);
+    const { violations, observations } = await collectFindings(root, specs, manifests, workspaces);
     if (violations.length > 0) {
         return {
             id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,

package/dist/cli/doctor-readiness-supply-chain.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"doctor-readiness-supply-chain.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EACL,YAAY,EAEZ,aAAa,EACb,YAAY,EACZ,uBAAuB,EACvB,~~cAAc,EACd,SAAS,EACT,~~YAAY,GACb,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAG1C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sCAAsC,GACjD,2BAA2B,CAAC;AAE9B,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B~~;;;;GAIG~~;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO,CACL,gEAAgE,SAAS,GAAG;QAC5E,8DAA8D;QAC9D,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD;QAC1E,2DAA2D,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,oBAAoB,CAC3B,IAAoB,EACpB,UAA4B;IAE5B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,KAAK,~~CAAC;IACf,CAAC;IACD,OAAO,CACL,~~UAAU,~~CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,~~eAAe,CAC5B,IAAY,EACZ,KAAgC,EAChC,UAA4B;IAK5B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,mBAAmB,GACvB,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,~~QAAQ~~,GAAG,~~KAAK~~,~~CAAC~~,~~MAAM~~,~~CAC3B~~,~~IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,~~UAAU,CAAC~~,CAC7E,CAAC~~;IACF,OAAO;QACL,UAAU,EAAE;YACV,GAAG,~~CAAC~~,~~QAAQ,KAAK,IAAI,~~CAAC,~~CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,~~MAAM,CAAC~~,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC~~;~~YAC9D~~,GAAG,~~CAAC~~,~~QAAQ,KAAK,IAAI,IAAI,mBAAmB,KAAK,IAAI;gBACnD,~~CAAC,CAAC;oBACE,cAAc,QAAQ,6CAA6C;wBACjE,iDAAiD;wBACjD,qEAAqE;wBACrE,iEAAiE;wBACjE,uCAAuC;iBAC1C;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,QAAQ,CAAC,GAAG,CACb,IAAI,CAAC,EAAE,CACL,KAAK,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,QAAQ;gBAC7D,KAAK,IAAI,CAAC,IAAI,MAAM;gBACpB,sEAAsE;gBACtE,+CAA+C,CAClD;YACD,GAAG,CAAC,SAAS,~~KAAK,IAAI;gBACpB,~~CAAC~~,CAAC~~;~~oBACE~~,~~kEAAkE;wBAChE,qEAAqE;wBACrE,2DAA2D;wBAC3D,+DAA+D;wBAC/D,oCAAoC;iBACvC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,~~GAAG,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC1C;QACD,YAAY,EAAE;YACZ,GAAG,~~CAAC~~,~~QAAQ,KAAK,IAAI,~~CAAC,~~CAAC~~,CAAC~~,EAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB,QAAQ,KAAK,CAAC,CAAC~~;~~YACnE~~,GAAG,CAAC,mBAAmB,KAAK,IAAI;gBAC9B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,4CAA4C,mBAAmB,KAAK;iBACrE,CAAC;YACN,GAAG,CAAC,SAAS,KAAK,IAAI;gBACpB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,uCAAuC,SAAS,KAAK,CAAC,CAAC;YAC5D,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,UAA4B;IACxD,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QAC9B,CAAC,CAAC,+BAA+B,UAAU,CAAC,KAAK,CAAC,IAAI,kBAAkB;YACpE,6DAA6D;QACjE,CAAC,CAAC,uEAAuE;YACrE,gEAAgE;YAChE,yEAAyE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,UAA6B;IAE7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,uBAAuB;QAChC,kBAAkB,EAChB,0EAA0E;YAC1E,mCAAmC;QACrC,QAAQ,EACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACjB,CAAC,QAAQ,GAAG,CAAC;gBACX,CAAC,CAAC,QAAQ,QAAQ,uCAAuC;gBACzD,CAAC,CAAC,EAAE,CAAC;QACT,gBAAgB,EACd,yEAAyE;YACzE,2EAA2E;YAC3E,kCAAkC;QACpC,eAAe,EACb,qEAAqE;YACrE,sEAAsE;YACtE,8CAA8C;QAChD,mBAAmB,EAAE;YACnB,0EAA0E;gBACxE,yCAAyC;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAgC;IAC9D,OAAO,IAAI,GAAG,CACZ,KAAK;SACF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC9B,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,YAAY,KAAK,cAAc,CAAC,CAC3D,CAAC,IAAI,CAAC;AACT,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,KAAgC;IAC7D,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,cAAc,KAAK,CAAC;QACzB,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,iCAAiC,cAAc,mBAAmB;YAChE,aAAa,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,UAA4B;IAC3D,OAAO,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QACvD,CAAC,CAAC,oEAAoE;YAClE,kEAAkE;QACtE,CAAC,CAAC,uDAAuD,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG;QACZ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACrC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CACnD;KACF,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;~~QACvB~~,OAAO,UAAU,CACf,yEAAyE;YACvE,8DAA8D;YAC9D,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,eAAe,CACxD,IAAI,EACJ,KAAK,EACL,UAAU,CACX,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,sCAAsC;YAC1C,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE;gBACR,kBAAkB,CAAC,UAAU,CAAC;gBAC9B,GAAG,qBAAqB,CAAC,YAAY,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,KAAK,CAAC,MAAM,yBAAyB;oBAClD,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI;oBACnC,GAAG,uBAAuB,CAAC,UAAU,CAAC,MAAM;oBAC5C,8DAA8D;oBAC9D,gEAAgE;oBAChE,6BAA6B;gBAC/B,OAAO,EAAE,CAAC,uBAAuB,CAAC;aACnC;YACD,GAAG,qBAAqB,CAAC,YAAY,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"doctor-readiness-supply-chain.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EACL,YAAY,EAEZ,aAAa,EACb,YAAY,EACZ,uBAAuB,EACvB,YAAY,GACb,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAE/B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAG1C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sCAAsC,GACjD,2BAA2B,CAAC;AAE9B,sEAAsE;AACtE,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,KAAgC,EAChC,SAA6C,EAC7C,UAA4B;IAK5B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,mBAAmB,GACvB,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG;QACb,SAAS;QACT,QAAQ;QACR,mBAAmB;QACnB,KAAK;QACL,UAAU;KACX,CAAC;IACF,OAAO;QACL,UAAU,EAAE;YACV,GAAG,8BAA8B,CAAC,MAAM,CAAC;YACzC,GAAG,8BAA8B,CAAC,SAAS,CAAC;YAC5C,GAAG,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;SAC1C;QACD,YAAY,EAAE;YACZ,GAAG,gCAAgC,CAAC,MAAM,CAAC;YAC3C,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,UAA4B;IACxD,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QAC9B,CAAC,CAAC,+BAA+B,UAAU,CAAC,KAAK,CAAC,IAAI,kBAAkB;YACpE,6DAA6D;QACjE,CAAC,CAAC,uEAAuE;YACrE,gEAAgE;YAChE,yEAAyE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,UAA6B;IAE7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,uBAAuB;QAChC,kBAAkB,EAChB,0EAA0E;YAC1E,mCAAmC;QACrC,QAAQ,EACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACjB,CAAC,QAAQ,GAAG,CAAC;gBACX,CAAC,CAAC,QAAQ,QAAQ,uCAAuC;gBACzD,CAAC,CAAC,EAAE,CAAC;QACT,gBAAgB,EACd,yEAAyE;YACzE,2EAA2E;YAC3E,kCAAkC;QACpC,eAAe,EACb,qEAAqE;YACrE,sEAAsE;YACtE,8CAA8C;QAChD,mBAAmB,EAAE;YACnB,0EAA0E;gBACxE,yCAAyC;SAC5C;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAgC;IAC9D,OAAO,IAAI,GAAG,CACZ,KAAK;SACF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC9B,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,YAAY,KAAK,cAAc,CAAC,CAC3D,CAAC,IAAI,CAAC;AACT,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,KAAgC;IAC7D,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,cAAc,KAAK,CAAC;QACzB,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,iCAAiC,cAAc,mBAAmB;YAChE,aAAa,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,UAA4B;IAC3D,OAAO,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QACvD,CAAC,CAAC,oEAAoE;YAClE,kEAAkE;QACtE,CAAC,CAAC,uDAAuD,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACpC,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG;QAChB,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC5D,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACrC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CACnD;KACF,CAAC;IACF,MAAM,qBAAqB,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,UAAU,CACf,yEAAyE;YACvE,8DAA8D;YAC9D,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,eAAe,CACxD,IAAI,EACJ,KAAK,EACL,SAAS,EACT,UAAU,CACX,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,sCAAsC;YAC1C,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE;gBACR,kBAAkB,CAAC,UAAU,CAAC;gBAC9B,GAAG,qBAAqB,CAAC,YAAY,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,KAAK,CAAC,MAAM,yBAAyB;oBAClD,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI;oBACnC,GAAG,uBAAuB,CAAC,UAAU,CAAC,MAAM;oBAC5C,8DAA8D;oBAC9D,gEAAgE;oBAChE,6BAA6B;gBAC/B,OAAO,EAAE,CAAC,uBAAuB,CAAC;aACnC;YACD,GAAG,qBAAqB,CAAC,YAAY,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkiEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,~~CA6yMjE~~,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
1	+ {"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkiEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAgzMjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js CHANGED Viewed

@@ -6343,6 +6343,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/doctor-readiness-operations.ts": true,
     "src/cli/doctor-readiness-release-path.ts": true,
     "src/cli/doctor-readiness-shared.ts": true,
+    "src/cli/doctor-readiness-supply-chain-evidence.ts": true,
     "src/cli/doctor-readiness-supply-chain-scan.ts": true,
     "src/cli/doctor-readiness-supply-chain.ts": true,
     "src/cli/doctor-readiness-types.ts": true,
@@ -6724,10 +6725,12 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/doctor-readiness-domain-negatives.test.ts": true,
     "tests/unit/cli/doctor-readiness-domain.test.ts": true,
     "tests/unit/cli/doctor-readiness-guardrails-ephemeral.test.ts": true,
+    "tests/unit/cli/doctor-readiness-guardrails-terraform.test.ts": true,
     "tests/unit/cli/doctor-readiness-guardrails.test.ts": true,
     "tests/unit/cli/doctor-readiness-journey.test.ts": true,
     "tests/unit/cli/doctor-readiness-supply-chain-exceptions.test.ts": true,
     "tests/unit/cli/doctor-readiness-supply-chain-install-gate.test.ts": true,
+    "tests/unit/cli/doctor-readiness-supply-chain-install-scripts.test.ts": true,
     "tests/unit/cli/doctor-readiness-supply-chain-precision.test.ts": true,
     "tests/unit/cli/doctor-readiness-supply-chain-workspaces.test.ts": true,
     "tests/unit/cli/doctor-readiness-supply-chain.test.ts": true,