@codyswann/lisa 2.310.1 → 2.310.2

package/dist/cli/doctor-readiness-supply-chain-constants.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared identifiers and limits for the dependencies/supply-chain readiness
+ * producer.
+ * @module cli/doctor-readiness-supply-chain-constants
+ */
+/** The dependencies/supply-chain readiness dimension id (readiness-rubric). */
+export declare const DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID = "dependencies-supply-chain";
+/** The ship blocker for an owned surface with no confidence model. */
+export declare const SUPPLY_CHAIN_BLOCKER_ID = "B5";
+/** Most evidence lines carried into a single finding, to keep it readable. */
+export declare const MAX_EVIDENCE_LINES = 12;
+//# sourceMappingURL=doctor-readiness-supply-chain-constants.d.ts.map

package/dist/cli/doctor-readiness-supply-chain-constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-constants.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,sCAAsC,8BACtB,CAAC;AAE9B,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,KAAK,CAAC"}

package/dist/cli/doctor-readiness-supply-chain-constants.js

@@ -0,0 +1,12 @@
+/**
+ * Shared identifiers and limits for the dependencies/supply-chain readiness
+ * producer.
+ * @module cli/doctor-readiness-supply-chain-constants
+ */
+/** The dependencies/supply-chain readiness dimension id (readiness-rubric). */
+export const DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID = "dependencies-supply-chain";
+/** The ship blocker for an owned surface with no confidence model. */
+export const SUPPLY_CHAIN_BLOCKER_ID = "B5";
+/** Most evidence lines carried into a single finding, to keep it readable. */
+export const MAX_EVIDENCE_LINES = 12;
+//# sourceMappingURL=doctor-readiness-supply-chain-constants.js.map

package/dist/cli/doctor-readiness-supply-chain-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-constants.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sCAAsC,GACjD,2BAA2B,CAAC;AAE9B,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC"}

package/dist/cli/doctor-readiness-supply-chain-python-assess.d.ts

@@ -0,0 +1,8 @@
+import type { ReadinessDimensionRecord } from "./doctor-readiness-types.js";
+/**
+ * Assess Python/Poetry dependencies when no JavaScript manifest exists.
+ * @param root - Repository root to assess
+ * @returns The B5 record, or null when no Python manifest exists
+ */
+export declare function assessPythonDependenciesSupplyChainDimension(root: string): Promise<ReadinessDimensionRecord | null>;
+//# sourceMappingURL=doctor-readiness-supply-chain-python-assess.d.ts.map

package/dist/cli/doctor-readiness-supply-chain-python-assess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-python-assess.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-python-assess.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAgG5E;;;;GAIG;AACH,wBAAsB,4CAA4C,CAChE,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAqD1C"}

package/dist/cli/doctor-readiness-supply-chain-python-assess.js

@@ -0,0 +1,137 @@
+/**
+ * Python/Poetry B5 readiness record construction.
+ * @module cli/doctor-readiness-supply-chain-python-assess
+ */
+import { informationalFindings } from "./doctor-readiness-shared.js";
+import { DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID, MAX_EVIDENCE_LINES, SUPPLY_CHAIN_BLOCKER_ID, } from "./doctor-readiness-supply-chain-constants.js";
+import { findPythonAuditGate, findPythonLockfile, isFloatingPythonSpec, readPythonManifest, } from "./doctor-readiness-supply-chain-python.js";
+const PYPROJECT_TOML = "pyproject.toml";
+const POETRY_LOCK = "poetry.lock";
+/**
+ * Build the rubric-shaped B5 finding from evidence lines.
+ * @param violations - Evidence lines
+ * @returns The B5 finding
+ */
+function supplyChainFinding(violations) {
+    const shown = violations.slice(0, MAX_EVIDENCE_LINES);
+    const overflow = violations.length - shown.length;
+    return {
+        blocker: SUPPLY_CHAIN_BLOCKER_ID,
+        invariant_violated: "belief that the owned surface still works rests on a repeatable install " +
+            "and a standing audit, not on hope",
+        evidence: shown.join(" | ") +
+            (overflow > 0
+                ? ` | (+${overflow} further finding(s) of the same kind)`
+                : ""),
+        why_proof_missed: "the test suite proves things about the code in the tree it happened to " +
+            "install, so a tree that drifts — or one carrying a known advisory nobody " +
+            "checks for — still reports green",
+        root_correction: "commit a lockfile, name a version for every dependency spec, and run a " +
+            "dependency audit on every push",
+        machinery_to_remove: [
+            "manual dependency review with no standing lockfile and audit gate",
+        ],
+    };
+}
+/**
+ * Build a stated-reason SKIP record.
+ * @param reason - Why the dimension was not assessed
+ * @returns The SKIP dimension record
+ */
+function skipRecord(reason) {
+    return {
+        id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+        status: "SKIP",
+        findings: [{ reason, skip: true }],
+    };
+}
+/**
+ * Build B5 evidence lines for a Python/Poetry project.
+ * @param specs - Poetry dependency specs under assessment
+ * @param lockfile - Committed lockfile path, or null when absent
+ * @param auditGate - Audit gate path, or null when absent
+ * @returns Evidence lines for B5 violations
+ */
+function pythonSupplyChainViolations(specs, lockfile, auditGate) {
+    if (specs.length === 0) {
+        return [];
+    }
+    return [
+        ...(lockfile === null
+            ? [
+                `\`${PYPROJECT_TOML}\` declares ${specs.length} Poetry dependency ` +
+                    `spec(s) but no \`${POETRY_LOCK}\` is committed — two Poetry ` +
+                    "installs can resolve to different package versions, so what was " +
+                    "validated is not provably what gets installed",
+            ]
+            : []),
+        ...specs
+            .filter(spec => isFloatingPythonSpec(spec.spec))
+            .map(spec => `\`${PYPROJECT_TOML}\` Poetry dependency \`${spec.name}\` names no ` +
+            "version constraint, so Poetry may resolve whatever satisfies the " +
+            "repository today rather than a version any run intentionally chose"),
+        ...(auditGate === null
+            ? [
+                "no Python dependency-audit gate was found anywhere — no " +
+                    "`pip-audit`/`safety check`/`safety scan`/`osv-scanner` step in " +
+                    "`.github/workflows/*.yml`, none in a git hook, and no " +
+                    "`dependabot.yml` pip entry or Python Renovate manager — so a " +
+                    "newly disclosed advisory in this Python tree would never be " +
+                    "noticed by anything",
+            ]
+            : []),
+    ];
+}
+/**
+ * Assess Python/Poetry dependencies when no JavaScript manifest exists.
+ * @param root - Repository root to assess
+ * @returns The B5 record, or null when no Python manifest exists
+ */
+export async function assessPythonDependenciesSupplyChainDimension(root) {
+    const python = await readPythonManifest(root);
+    if (python.kind === "absent") {
+        return null;
+    }
+    if (python.kind === "unassessable") {
+        return skipRecord(python.reason);
+    }
+    if (python.specs.length === 0) {
+        return skipRecord("`pyproject.toml` was found but declares no Poetry dependencies, so " +
+            "this repository owns no Python third-party surface a confidence " +
+            "model could cover; supply-chain confidence is not established either way");
+    }
+    const lockfile = await findPythonLockfile(root);
+    const auditGate = await findPythonAuditGate(root);
+    const violations = pythonSupplyChainViolations(python.specs, lockfile, auditGate);
+    const observations = [
+        ...(lockfile === null ? [] : [`Python lockfile in use: \`${lockfile}\`.`]),
+        ...(auditGate === null
+            ? []
+            : [`Python dependency-audit gate declared in \`${auditGate}\`.`]),
+    ];
+    if (violations.length > 0) {
+        return {
+            id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+            status: "FAIL",
+            findings: [
+                supplyChainFinding(violations),
+                ...informationalFindings(observations),
+            ],
+        };
+    }
+    return {
+        id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+        status: "PASS",
+        findings: [
+            {
+                evidence: `Inspected ${python.specs.length} Poetry dependency spec(s) in ` +
+                    "`pyproject.toml`: each dependency names a constraint, " +
+                    "`poetry.lock` is committed, and a Python dependency-audit gate is " +
+                    "declared.",
+                checked: [SUPPLY_CHAIN_BLOCKER_ID],
+            },
+            ...informationalFindings(observations),
+        ],
+    };
+}
+//# sourceMappingURL=doctor-readiness-supply-chain-python-assess.js.map

package/dist/cli/doctor-readiness-supply-chain-python-assess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-python-assess.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-python-assess.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,sCAAsC,EACtC,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GAEnB,MAAM,2CAA2C,CAAC;AAGnD,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,UAA6B;IAE7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,uBAAuB;QAChC,kBAAkB,EAChB,0EAA0E;YAC1E,mCAAmC;QACrC,QAAQ,EACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACjB,CAAC,QAAQ,GAAG,CAAC;gBACX,CAAC,CAAC,QAAQ,QAAQ,uCAAuC;gBACzD,CAAC,CAAC,EAAE,CAAC;QACT,gBAAgB,EACd,yEAAyE;YACzE,2EAA2E;YAC3E,kCAAkC;QACpC,eAAe,EACb,yEAAyE;YACzE,gCAAgC;QAClC,mBAAmB,EAAE;YACnB,mEAAmE;SACpE;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B,CAClC,KAAsC,EACtC,QAAuB,EACvB,SAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,IAAI;YACnB,CAAC,CAAC;gBACE,KAAK,cAAc,eAAe,KAAK,CAAC,MAAM,qBAAqB;oBACjE,oBAAoB,WAAW,+BAA+B;oBAC9D,kEAAkE;oBAClE,+CAA+C;aAClD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,KAAK;aACL,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC/C,GAAG,CACF,IAAI,CAAC,EAAE,CACL,KAAK,cAAc,0BAA0B,IAAI,CAAC,IAAI,cAAc;YACpE,mEAAmE;YACnE,oEAAoE,CACvE;QACH,GAAG,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,CAAC;gBACE,0DAA0D;oBACxD,iEAAiE;oBACjE,wDAAwD;oBACxD,+DAA+D;oBAC/D,8DAA8D;oBAC9D,qBAAqB;aACxB;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAChE,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,UAAU,CACf,qEAAqE;YACnE,kEAAkE;YAClE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,2BAA2B,CAC5C,MAAM,CAAC,KAAK,EACZ,QAAQ,EACR,SAAS,CACV,CAAC;IACF,MAAM,YAAY,GAAG;QACnB,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,6BAA6B,QAAQ,KAAK,CAAC,CAAC;QAC1E,GAAG,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,8CAA8C,SAAS,KAAK,CAAC,CAAC;KACpE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,sCAAsC;YAC1C,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE;gBACR,kBAAkB,CAAC,UAAU,CAAC;gBAC9B,GAAG,qBAAqB,CAAC,YAAY,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,MAAM,CAAC,KAAK,CAAC,MAAM,gCAAgC;oBAChE,wDAAwD;oBACxD,oEAAoE;oBACpE,WAAW;gBACb,OAAO,EAAE,CAAC,uBAAuB,CAAC;aACnC;YACD,GAAG,qBAAqB,CAAC,YAAY,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-supply-chain-python.d.ts

@@ -0,0 +1,38 @@
+/** One Poetry dependency declaration flattened from `pyproject.toml`. */
+export interface PythonDependencySpec {
+    readonly manifestPath: "pyproject.toml";
+    readonly name: string;
+    readonly spec: string | null;
+}
+/** What reading a Python/Poetry manifest established. */
+export type PythonManifestOutcome = {
+    readonly kind: "absent";
+} | {
+    readonly kind: "unassessable";
+    readonly reason: string;
+} | {
+    readonly kind: "ok";
+    readonly manifestPath: "pyproject.toml";
+    readonly specs: readonly PythonDependencySpec[];
+};
+/**
+ * Read the Poetry dependency manifest when no JavaScript manifest exists.
+ * @param root - Repository root
+ * @returns Parsed Poetry specs, or absent when this is not a Poetry project
+ */
+export declare function readPythonManifest(root: string): Promise<PythonManifestOutcome>;
+/**
+ * Find the committed Python/Poetry lockfile.
+ * @param root - Repository root
+ * @returns The lockfile path, or null when none is committed
+ */
+export declare function findPythonLockfile(root: string): Promise<string | null>;
+/**
+ * Find where the repository audits its Python dependency tree.
+ * @param root - Repository root
+ * @returns The repo-relative path of the first Python audit gate found, or null
+ */
+export declare function findPythonAuditGate(root: string): Promise<string | null>;
+/** Check whether a Poetry dependency spec floats. */
+export declare function isFloatingPythonSpec(spec: string | null): boolean;
+//# sourceMappingURL=doctor-readiness-supply-chain-python.d.ts.map

package/dist/cli/doctor-readiness-supply-chain-python.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-python.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-python.ts"],"names":[],"mappings":"AAsDA,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,yDAAyD;AACzD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1D;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACjD,CAAC;AAmFN;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC,CA2ChC;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE7E;AAyBD;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0BxB;AAED,qDAAqD;AACrD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAEjE"}

package/dist/cli/doctor-readiness-supply-chain-python.js

@@ -0,0 +1,210 @@
+/**
+ * Python/Poetry scanning for the dependencies/supply-chain readiness producer
+ * (B5, PRD #1739, #1896).
+ * @module cli/doctor-readiness-supply-chain-python
+ */
+/* eslint-disable jsdoc/require-param, jsdoc/require-returns -- typed scanner helpers are self-describing */
+import { readdir } from "node:fs/promises";
+import * as path from "node:path";
+import { parse as parseToml } from "smol-toml";
+import { isRecord, readFileOrNull } from "./doctor-readiness-shared.js";
+/** The Poetry project manifest this scanner reads. */
+const PYPROJECT_TOML = "pyproject.toml";
+/** The Poetry lockfile this scanner requires. */
+const POETRY_LOCK = "poetry.lock";
+/** Dependabot ecosystem spelling for Python dependency updates. */
+const PYTHON_ECOSYSTEM_PATTERN = /package-ecosystem:\s*["']?pip\b/i;
+/** Commands and scanners that audit Python dependencies. */
+const PYTHON_AUDIT_GATE_PATTERN = /\b(pip-audit|safety\s+(?:check|scan)|osv-scanner|snyk|trivy|grype)\b/i;
+/** Renovate manager spellings for Python dependencies. */
+const RENOVATE_PYTHON_PATTERN = /\b(poetry|pep621|pip_requirements|pip-compile|pipenv)\b/i;
+/** Poetry spec strings that resolve to whatever is newest. */
+const FLOATING_SPECS = new Set(["", "*", "latest"]);
+/** Files that may declare an audit gate in their text. */
+const GATE_DIRECTORIES = [
+    path.join(".github", "workflows"),
+    ".husky",
+];
+/** Single-file gate declarations checked by text match. */
+const GATE_FILES = [
+    "lefthook.yml",
+    "lefthook.yaml",
+    ".lefthook.yml",
+];
+/** Update bots whose mere presence is a standing confidence model. */
+const UPDATE_BOT_FILES = [
+    path.join(".github", "dependabot.yml"),
+    path.join(".github", "dependabot.yaml"),
+    path.join(".github", "renovate.json"),
+    "renovate.json",
+    ".renovaterc",
+    ".renovaterc.json",
+];
+/** Check whether a repo-relative file can be read. */
+async function fileExists(root, relativePath) {
+    return (await readFileOrNull(root, relativePath)) !== null;
+}
+/** List direct files under a repo-relative directory. */
+async function listDirectory(root, relativeDir) {
+    try {
+        const entries = await readdir(path.join(root, relativeDir), {
+            withFileTypes: true,
+        });
+        return entries
+            .filter(entry => entry.isFile())
+            .map(entry => path.join(relativeDir, entry.name))
+            .sort((a, b) => a.localeCompare(b));
+    }
+    catch {
+        return [];
+    }
+}
+/** Read a nested record by path. */
+function nestedRecord(value, keys) {
+    if (keys.length === 0) {
+        return isRecord(value) ? value : null;
+    }
+    if (!isRecord(value)) {
+        return null;
+    }
+    const [key, ...rest] = keys;
+    return key === undefined ? null : nestedRecord(value[key], rest);
+}
+/** Extract the version-bearing part of a Poetry dependency declaration. */
+function poetrySpec(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (!isRecord(value)) {
+        return null;
+    }
+    if (typeof value.version === "string") {
+        return value.version;
+    }
+    if (typeof value.path === "string" ||
+        typeof value.file === "string" ||
+        typeof value.url === "string") {
+        return "local";
+    }
+    if (typeof value.git === "string") {
+        return typeof value.rev === "string" || typeof value.tag === "string"
+            ? "git-ref"
+            : null;
+    }
+    return null;
+}
+/** Flatten one Poetry dependency table, excluding the Python runtime. */
+function collectPoetrySpecs(table) {
+    if (table === null) {
+        return [];
+    }
+    return Object.entries(table).flatMap(([name, value]) => name.toLowerCase() === "python"
+        ? []
+        : [{ manifestPath: "pyproject.toml", name, spec: poetrySpec(value) }]);
+}
+/**
+ * Read the Poetry dependency manifest when no JavaScript manifest exists.
+ * @param root - Repository root
+ * @returns Parsed Poetry specs, or absent when this is not a Poetry project
+ */
+export async function readPythonManifest(root) {
+    const source = await readFileOrNull(root, PYPROJECT_TOML);
+    if (source === null) {
+        return { kind: "absent" };
+    }
+    try {
+        const parsed = parseToml(source);
+        const dependencies = nestedRecord(parsed, [
+            "tool",
+            "poetry",
+            "dependencies",
+        ]);
+        const group = nestedRecord(parsed, ["tool", "poetry", "group"]);
+        if (dependencies === null && group === null) {
+            return {
+                kind: "unassessable",
+                reason: "`pyproject.toml` was found, but no Poetry dependency tables were " +
+                    "found; Python supply-chain confidence is not established because " +
+                    "this offline pass only assesses Poetry projects today",
+            };
+        }
+        const groupSpecs = group === null
+            ? []
+            : Object.values(group).flatMap(entry => collectPoetrySpecs(nestedRecord(entry, ["dependencies"])));
+        return {
+            kind: "ok",
+            manifestPath: PYPROJECT_TOML,
+            specs: [...collectPoetrySpecs(dependencies), ...groupSpecs],
+        };
+    }
+    catch (error) {
+        return {
+            kind: "unassessable",
+            reason: "`pyproject.toml` could not be parsed, so Python dependency specs " +
+                `were never read and nothing about them is established: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+/**
+ * Find the committed Python/Poetry lockfile.
+ * @param root - Repository root
+ * @returns The lockfile path, or null when none is committed
+ */
+export async function findPythonLockfile(root) {
+    return (await fileExists(root, POETRY_LOCK)) ? POETRY_LOCK : null;
+}
+/** Check whether an update-bot config watches Python dependencies. */
+function coversPythonTree(botFile, source) {
+    return botFile.includes("dependabot")
+        ? PYTHON_ECOSYSTEM_PATTERN.test(source)
+        : RENOVATE_PYTHON_PATTERN.test(source);
+}
+/** Extract an executable command-shaped line from CI/hook text. */
+function executableCommandCandidate(line) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) {
+        return null;
+    }
+    const commandish = trimmed.startsWith("- ")
+        ? trimmed.slice(2).trim()
+        : trimmed;
+    if (!commandish.toLowerCase().startsWith("run:")) {
+        return commandish;
+    }
+    const command = commandish.slice("run:".length).trim();
+    return command === "|" || command === ">" ? null : command;
+}
+/**
+ * Find where the repository audits its Python dependency tree.
+ * @param root - Repository root
+ * @returns The repo-relative path of the first Python audit gate found, or null
+ */
+export async function findPythonAuditGate(root) {
+    for (const botFile of UPDATE_BOT_FILES) {
+        const source = await readFileOrNull(root, botFile);
+        if (source !== null && coversPythonTree(botFile, source)) {
+            return botFile.split(path.sep).join("/");
+        }
+    }
+    const scanned = [
+        ...(await Promise.all(GATE_DIRECTORIES.map(dir => listDirectory(root, dir)))).flat(),
+        ...GATE_FILES,
+    ];
+    for (const file of scanned) {
+        const source = await readFileOrNull(root, file);
+        if (source !== null &&
+            source.split(/\r?\n/).some(line => {
+                const command = executableCommandCandidate(line);
+                return command !== null && PYTHON_AUDIT_GATE_PATTERN.test(command);
+            })) {
+            return file.split(path.sep).join("/");
+        }
+    }
+    return null;
+}
+/** Check whether a Poetry dependency spec floats. */
+export function isFloatingPythonSpec(spec) {
+    return spec === null || FLOATING_SPECS.has(spec.trim().toLowerCase());
+}
+/* eslint-enable jsdoc/require-param, jsdoc/require-returns -- restore repository documentation defaults */
+//# sourceMappingURL=doctor-readiness-supply-chain-python.js.map

package/dist/cli/doctor-readiness-supply-chain-python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-python.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-python.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,4GAA4G;AAC5G,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAExE,sDAAsD;AACtD,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,iDAAiD;AACjD,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAEpE,4DAA4D;AAC5D,MAAM,yBAAyB,GAC7B,uEAAuE,CAAC;AAE1E,0DAA0D;AAC1D,MAAM,uBAAuB,GAC3B,0DAA0D,CAAC;AAE7D,8DAA8D;AAC9D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEzE,0DAA0D;AAC1D,MAAM,gBAAgB,GAAsB;IAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;IACjC,QAAQ;CACT,CAAC;AAEF,2DAA2D;AAC3D,MAAM,UAAU,GAAsB;IACpC,cAAc;IACd,eAAe;IACf,eAAe;CAChB,CAAC;AAEF,sEAAsE;AACtE,MAAM,gBAAgB,GAAsB;IAC1C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;IACrC,eAAe;IACf,aAAa;IACb,kBAAkB;CACnB,CAAC;AAmBF,sDAAsD;AACtD,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,YAAoB;IAEpB,OAAO,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED,yDAAyD;AACzD,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE;YAC1D,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,OAAO;aACX,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aAC/B,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oCAAoC;AACpC,SAAS,YAAY,CACnB,KAAc,EACd,IAAuB;IAEvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,IACE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAC7B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YACnE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,SAAS,kBAAkB,CACzB,KAAqC;IAErC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CACrD,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CACxE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,EAAE;YACxC,MAAM;YACN,QAAQ;YACR,cAAc;SACf,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,IAAI,YAAY,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO;gBACL,IAAI,EAAE,cAAc;gBACpB,MAAM,EACJ,mEAAmE;oBACnE,mEAAmE;oBACnE,uDAAuD;aAC1D,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GACd,KAAK,KAAK,IAAI;YACZ,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CACnC,kBAAkB,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAC1D,CAAC;QACR,OAAO;YACL,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,cAAc;YAC5B,KAAK,EAAE,CAAC,GAAG,kBAAkB,CAAC,YAAY,CAAC,EAAE,GAAG,UAAU,CAAC;SAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EACJ,mEAAmE;gBACnE,0DACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;SACL,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,OAAO,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,OAAe,EAAE,MAAc;IACvD,OAAO,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QACnC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,mEAAmE;AACnE,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACzB,CAAC,CAAC,OAAO,CAAC;IACZ,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY;IAEZ,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,IAAI,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG;QACd,GAAG,CACD,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CACzE,CAAC,IAAI,EAAE;QACR,GAAG,UAAU;KACd,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,IACE,MAAM,KAAK,IAAI;YACf,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChC,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;gBACjD,OAAO,OAAO,KAAK,IAAI,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrE,CAAC,CAAC,EACF,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,OAAO,IAAI,KAAK,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,2GAA2G"}

package/dist/cli/doctor-readiness-supply-chain-ruby-assess.d.ts

@@ -0,0 +1,8 @@
+import type { ReadinessDimensionRecord } from "./doctor-readiness-types.js";
+/**
+ * Assess Ruby/Bundler dependencies when no JavaScript manifest exists.
+ * @param root - Repository root to assess
+ * @returns The B5 record, or null when no Ruby manifest exists
+ */
+export declare function assessRubyDependenciesSupplyChainDimension(root: string): Promise<ReadinessDimensionRecord | null>;
+//# sourceMappingURL=doctor-readiness-supply-chain-ruby-assess.d.ts.map

package/dist/cli/doctor-readiness-supply-chain-ruby-assess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-ruby-assess.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-ruby-assess.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAsF5E;;;;GAIG;AACH,wBAAsB,0CAA0C,CAC9D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAgD1C"}

package/dist/cli/doctor-readiness-supply-chain-ruby-assess.js

@@ -0,0 +1,128 @@
+/**
+ * Ruby/Bundler B5 readiness record construction.
+ * @module cli/doctor-readiness-supply-chain-ruby-assess
+ */
+import { informationalFindings } from "./doctor-readiness-shared.js";
+import { DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID, SUPPLY_CHAIN_BLOCKER_ID, } from "./doctor-readiness-supply-chain-constants.js";
+import { findRubyAuditGate, findRubyLockfile, readRubyManifest, } from "./doctor-readiness-supply-chain-ruby.js";
+/**
+ * Build the rubric-shaped B5 finding from evidence lines.
+ * @param violations - Evidence lines
+ * @returns The B5 finding
+ */
+function supplyChainFinding(violations) {
+    return {
+        blocker: SUPPLY_CHAIN_BLOCKER_ID,
+        invariant_violated: "belief that the owned surface still works rests on a repeatable install " +
+            "and a standing audit, not on hope",
+        evidence: violations.join(" | "),
+        why_proof_missed: "the test suite proves things about the code in the tree it happened to " +
+            "install, so a tree that drifts — or one carrying a known advisory nobody " +
+            "checks for — still reports green",
+        root_correction: "commit a lockfile, name a version for every dependency spec, and run a " +
+            "dependency audit on every push",
+        machinery_to_remove: [
+            "manual dependency review with no standing lockfile and audit gate",
+        ],
+    };
+}
+/**
+ * Build a stated-reason SKIP record.
+ * @param reason - Why the dimension was not assessed
+ * @returns The SKIP dimension record
+ */
+function skipRecord(reason) {
+    return {
+        id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+        status: "SKIP",
+        findings: [{ reason, skip: true }],
+    };
+}
+/**
+ * Build B5 evidence lines for a Ruby/Bundler project.
+ * @param specs - Ruby dependency specs under assessment
+ * @param lockfile - Committed lockfile path, or null when absent
+ * @param auditGate - Audit gate path, or null when absent
+ * @returns Evidence lines for B5 violations
+ */
+function rubySupplyChainViolations(specs, lockfile, auditGate) {
+    if (specs.length === 0) {
+        return [];
+    }
+    return [
+        ...(lockfile === null
+            ? [
+                `\`Gemfile\` declares ${specs.length} gem dependency spec(s) but ` +
+                    "no `Gemfile.lock` is committed — two Bundler installs can " +
+                    "resolve to different gem versions, so what was validated is not " +
+                    "provably what gets installed",
+            ]
+            : []),
+        ...specs
+            .filter(spec => spec.spec === null)
+            .map(spec => `\`Gemfile\` gem \`${spec.name}\` names no version constraint, so ` +
+            "Bundler may resolve whatever satisfies the repository today rather " +
+            "than a version any run intentionally chose"),
+        ...(auditGate === null
+            ? [
+                "no Ruby dependency-audit gate was found anywhere — no `bundle " +
+                    "audit`/`bundler-audit` step in `.github/workflows/*.yml`, none " +
+                    "in a git hook, and no `dependabot.yml` bundler entry or " +
+                    "`renovate.json` — so a newly disclosed advisory in this gem tree " +
+                    "would never be noticed by anything",
+            ]
+            : []),
+    ];
+}
+/**
+ * Assess Ruby/Bundler dependencies when no JavaScript manifest exists.
+ * @param root - Repository root to assess
+ * @returns The B5 record, or null when no Ruby manifest exists
+ */
+export async function assessRubyDependenciesSupplyChainDimension(root) {
+    const ruby = await readRubyManifest(root);
+    if (ruby.kind === "absent") {
+        return null;
+    }
+    if (ruby.kind === "unassessable") {
+        return skipRecord(ruby.reason);
+    }
+    if (ruby.specs.length === 0) {
+        return skipRecord("`Gemfile` was found but declares no gem dependencies, so this " +
+            "repository owns no Ruby third-party surface a confidence model could " +
+            "cover; supply-chain confidence is not established either way");
+    }
+    const lockfile = await findRubyLockfile(root);
+    const auditGate = await findRubyAuditGate(root);
+    const violations = rubySupplyChainViolations(ruby.specs, lockfile, auditGate);
+    const observations = [
+        ...(lockfile === null ? [] : [`Ruby lockfile in use: \`${lockfile}\`.`]),
+        ...(auditGate === null
+            ? []
+            : [`Ruby dependency-audit gate declared in \`${auditGate}\`.`]),
+    ];
+    if (violations.length > 0) {
+        return {
+            id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+            status: "FAIL",
+            findings: [
+                supplyChainFinding(violations),
+                ...informationalFindings(observations),
+            ],
+        };
+    }
+    return {
+        id: DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID,
+        status: "PASS",
+        findings: [
+            {
+                evidence: `Inspected ${ruby.specs.length} gem dependency spec(s) in ` +
+                    "`Gemfile`: each gem names a constraint, `Gemfile.lock` is " +
+                    "committed, and a Ruby dependency-audit gate is declared.",
+                checked: [SUPPLY_CHAIN_BLOCKER_ID],
+            },
+            ...informationalFindings(observations),
+        ],
+    };
+}
+//# sourceMappingURL=doctor-readiness-supply-chain-ruby-assess.js.map

package/dist/cli/doctor-readiness-supply-chain-ruby-assess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-supply-chain-ruby-assess.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain-ruby-assess.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EACL,sCAAsC,EACtC,uBAAuB,GACxB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,yCAAyC,CAAC;AAGjD;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,UAA6B;IAE7B,OAAO;QACL,OAAO,EAAE,uBAAuB;QAChC,kBAAkB,EAChB,0EAA0E;YAC1E,mCAAmC;QACrC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,gBAAgB,EACd,yEAAyE;YACzE,2EAA2E;YAC3E,kCAAkC;QACpC,eAAe,EACb,yEAAyE;YACzE,gCAAgC;QAClC,mBAAmB,EAAE;YACnB,mEAAmE;SACpE;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,KAAoC,EACpC,QAAuB,EACvB,SAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,IAAI;YACnB,CAAC,CAAC;gBACE,wBAAwB,KAAK,CAAC,MAAM,8BAA8B;oBAChE,4DAA4D;oBAC5D,kEAAkE;oBAClE,8BAA8B;aACjC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,KAAK;aACL,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;aAClC,GAAG,CACF,IAAI,CAAC,EAAE,CACL,qBAAqB,IAAI,CAAC,IAAI,qCAAqC;YACnE,qEAAqE;YACrE,4CAA4C,CAC/C;QACH,GAAG,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,CAAC;gBACE,gEAAgE;oBAC9D,iEAAiE;oBACjE,0DAA0D;oBAC1D,mEAAmE;oBACnE,oCAAoC;aACvC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0CAA0C,CAC9D,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,UAAU,CACf,gEAAgE;YAC9D,uEAAuE;YACvE,8DAA8D,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG;QACnB,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,2BAA2B,QAAQ,KAAK,CAAC,CAAC;QACxE,GAAG,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,4CAA4C,SAAS,KAAK,CAAC,CAAC;KAClE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,sCAAsC;YAC1C,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE;gBACR,kBAAkB,CAAC,UAAU,CAAC;gBAC9B,GAAG,qBAAqB,CAAC,YAAY,CAAC;aACvC;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,QAAQ,EACN,aAAa,IAAI,CAAC,KAAK,CAAC,MAAM,6BAA6B;oBAC3D,4DAA4D;oBAC5D,0DAA0D;gBAC5D,OAAO,EAAE,CAAC,uBAAuB,CAAC;aACnC;YACD,GAAG,qBAAqB,CAAC,YAAY,CAAC;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-supply-chain.d.ts

@@ -1,6 +1,5 @@
 import type { ReadinessDimensionRecord } from "./doctor-readiness-types.js";
-/** The dependencies/supply-chain readiness dimension id (readiness-rubric). */
-export declare const DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID = "dependencies-supply-chain";
+export { DEPENDENCIES_SUPPLY_CHAIN_DIMENSION_ID } from "./doctor-readiness-supply-chain-constants.js";
 /**
  * Assess the dependencies/supply-chain dimension: B5, "an owned compatibility or
  * security surface has no confidence model". Offline by construction — it reads

package/dist/cli/doctor-readiness-supply-chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-supply-chain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AAuDA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,+EAA+E;AAC/E,eAAO,MAAM,sCAAsC,8BACtB,CAAC;AAmQ9B;;;;;;;;GAQG;AACH,wBAAsB,sCAAsC,CAC1D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,CAAC,CAgEnC"}
+{"version":3,"file":"doctor-readiness-supply-chain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-supply-chain.ts"],"names":[],"mappings":"AAwDA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AAwJtG;;;;;;;;GAQG;AACH,wBAAsB,sCAAsC,CAC1D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,CAAC,CAqEnC"}