@codyswann/lisa 3.69.6 → 3.70.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (64) hide show
  1. package/all/copy-overwrite/scripts/lisa-gates.mjs +254 -35
  2. package/all/create-only/.github/workflows/continuous-gates.yml +74 -0
  3. package/cdk/create-only/.github/workflows/deploy.yml +41 -1
  4. package/dist/core/lisa-owned-hash-ledger.d.ts.map +1 -1
  5. package/dist/core/lisa-owned-hash-ledger.js +1 -0
  6. package/dist/core/lisa-owned-hash-ledger.js.map +1 -1
  7. package/dist/core/upstream-evidence-manifest.d.ts.map +1 -1
  8. package/dist/core/upstream-evidence-manifest.js +13 -6
  9. package/dist/core/upstream-evidence-manifest.js.map +1 -1
  10. package/expo/create-only/.github/workflows/deploy.yml +42 -1
  11. package/harper-fabric/create-only/.github/workflows/deploy.yml +37 -0
  12. package/nestjs/create-only/.github/workflows/deploy.yml +44 -1
  13. package/package.json +1 -1
  14. package/plugins/lisa/.claude-plugin/plugin.json +1 -1
  15. package/plugins/lisa/.codex-plugin/plugin.json +1 -1
  16. package/plugins/lisa-agy/plugin.json +1 -1
  17. package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
  18. package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
  19. package/plugins/lisa-cdk-agy/plugin.json +1 -1
  20. package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
  21. package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
  22. package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
  23. package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
  24. package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
  25. package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
  26. package/plugins/lisa-expo-agy/plugin.json +1 -1
  27. package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
  28. package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
  29. package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
  30. package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
  31. package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
  32. package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
  33. package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
  34. package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
  35. package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
  36. package/plugins/lisa-nestjs-agy/plugin.json +1 -1
  37. package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
  38. package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
  39. package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
  40. package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
  41. package/plugins/lisa-openclaw-agy/plugin.json +1 -1
  42. package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
  43. package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
  44. package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
  45. package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
  46. package/plugins/lisa-phaser-agy/plugin.json +1 -1
  47. package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
  48. package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
  49. package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
  50. package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
  51. package/plugins/lisa-rails-agy/plugin.json +1 -1
  52. package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
  53. package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
  54. package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
  55. package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
  56. package/plugins/lisa-typescript-agy/plugin.json +1 -1
  57. package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
  58. package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
  59. package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
  60. package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
  61. package/plugins/lisa-wiki-agy/plugin.json +1 -1
  62. package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
  63. package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
  64. package/rails/create-only/.github/workflows/deploy.yml +41 -0
@@ -60,7 +60,7 @@
60
60
  * @module lisa-gates
61
61
  */
62
62
 
63
- import { existsSync, readFileSync } from "node:fs";
63
+ import { existsSync, readdirSync, readFileSync } from "node:fs";
64
64
  import { join } from "node:path";
65
65
 
66
66
  import { invokedAsScript } from "./lib/invoked-as-script.mjs";
@@ -964,8 +964,8 @@ export const SECONDARY_PROVER_JOBS = Object.freeze(["snyk"]);
964
964
  export const UNGATED_QUALITY_JOBS = Object.freeze({
965
965
  zap_baseline: Object.freeze({
966
966
  reason:
967
- "`runtime-web-vulnerability` names the property, but its legal moments are deploy-only, so there is no declaration a caller can write at pull-request — where this job runs.",
968
- owner: "#2832",
967
+ '`runtime-web-vulnerability` names the property, but its legal moments are deploy-only, so there is no declaration a caller can write at pull-request — where this job runs. #2832 built the deploy-moment runner and did NOT retire this: the gate now has an executor at the moments where it is legal, and this job still has none at the moment where it runs. Adding the row today would be worse than the gap. The job posts `🕷️ OWASP ZAP Baseline`, the gate\'s label is `🕷️ DAST Baseline`, and `contextsFor` derives `🔍 Quality Checks / <label>` — so a required declaration would derive a context nothing ever posts and hold every pull request at "Expected — Waiting for status to be reported", here and in every consumer. Closing the gap renames a live required check, which is a ruleset migration and a ruling, not an edit.',
968
+ owner: "#3022",
969
969
  }),
970
970
  });
971
971
 
@@ -2828,14 +2828,162 @@ export const EXECUTOR_VERDICTS = Object.freeze([
2828
2828
  */
2829
2829
  const BLOCKING_VERDICTS = Object.freeze([ORPHANED, VACUOUS_PROVER]);
2830
2830
 
2831
- /** Moment families whose executor is the generic hook runner. */
2832
- const HOOK_RUNNER_MOMENTS = Object.freeze([
2833
- SESSION_START,
2834
- PRE_TOOL,
2835
- POST_TOOL,
2836
- COMMIT,
2837
- PUSH,
2838
- ]);
2831
+ /** Where a repository declares which moments it runs gates at. */
2832
+ export const MOMENT_EXECUTOR_DIR = ".github/workflows";
2833
+
2834
+ /**
2835
+ * A moment handed to a gate runner, in either spelling a workflow uses.
2836
+ *
2837
+ * `moment: <value>` is how a caller parameterises a reusable workflow, and
2838
+ * `--moment=<value>` is how a shell step invokes `lisa-run-gates.mjs` directly.
2839
+ * Both are the same statement — "this workflow executes gates at this moment" —
2840
+ * and a scan that read only one of them would report a repository as having no
2841
+ * runner while looking straight at one.
2842
+ *
2843
+ * `[ \t]*` rather than `\s*` around the colon, deliberately. A workflow that
2844
+ * DEFINES a `moment:` input writes the key with its value on following lines,
2845
+ * and `\s*` would step over the newline and capture `description` as the
2846
+ * moment. The definition of an input is not the use of one.
2847
+ *
2848
+ * The backtick is excluded from the unquoted form for the same class of reason,
2849
+ * and it was measured rather than anticipated: the header of Lisa's own
2850
+ * `gates.yml` documents the defect it fixes by quoting
2851
+ * ``list --moment=pre-deploy:production``, and the first version of this scan
2852
+ * read that PROSE as a runner and reported the moment executed. A workflow
2853
+ * describing a command is not a workflow running one.
2854
+ */
2855
+ const MOMENT_ARGUMENT =
2856
+ /(?:\bmoment[ \t]*:[ \t]*|--moment=)(?:'([^'\n]+)'|"([^"\n]+)"|([^\s'"#`]+))/g;
2857
+
2858
+ /** A line that is entirely a comment — YAML's and the shell's are both `#`. */
2859
+ const COMMENT_LINE = /^\s*#/;
2860
+
2861
+ /** The answer when nothing has been measured: no moment is executed. */
2862
+ const NOTHING_EXECUTED = Object.freeze({
2863
+ moments: Object.freeze([]),
2864
+ families: Object.freeze([]),
2865
+ });
2866
+
2867
+ /**
2868
+ * Which moments THIS repository actually runs gates at, read off its workflows.
2869
+ *
2870
+ * The registry's `no-runner-for-moment` verdict used to be an ASSERTION: every
2871
+ * declaration in a deploy or continuous family got told "nothing runs gates
2872
+ * here at all yet", because at the time nothing did. That sentence is a fact
2873
+ * about the repository, not about the gate, and hardcoding it has two failure
2874
+ * modes that arrive together. It keeps saying "nothing runs this" after a runner
2875
+ * ships — a control lying in the reassuring direction. And it keeps EXCUSING a
2876
+ * declaration that resolves to no prover, calling it inert-but-fine, at exactly
2877
+ * the moment the runner would have executed it and reported UNPROVABLE.
2878
+ *
2879
+ * So it is measured instead. A repository executes a moment when one of its
2880
+ * workflows names that moment to a gate runner.
2881
+ *
2882
+ * ## Family, when the environment is computed
2883
+ *
2884
+ * A deploy caller writes `moment: pre-deploy:${{ ... }}` — the family is
2885
+ * literal and the environment is a run-time expression. Requiring an exact
2886
+ * match would report "no runner" for every real deploy façade there is, so a
2887
+ * computed environment registers the FAMILY, and any moment in it counts as
2888
+ * executed. A value with no readable family (`moment: ${{ inputs.moment }}`,
2889
+ * which is how a reusable workflow forwards its own input) contributes nothing:
2890
+ * it is plumbing between two workflows, and the caller at the other end is the
2891
+ * one that made a statement about a moment.
2892
+ *
2893
+ * ## An unreadable directory answers "nothing", and that is the honest answer
2894
+ *
2895
+ * A repository with no `.github/workflows` runs no workflows, so no workflow of
2896
+ * its executes any moment. That is not a guess made under uncertainty; it is
2897
+ * the measurement.
2898
+ * @param {object} [options] Inputs.
2899
+ * @param {string} [options.cwd] Repository root.
2900
+ * @param {string} [options.dir] Directory holding the workflows.
2901
+ * @returns {{moments: string[], families: string[]}} Exact moments executed, and families executed at a computed environment.
2902
+ */
2903
+ export function momentsExecutedBy({
2904
+ cwd = process.cwd(),
2905
+ dir = MOMENT_EXECUTOR_DIR,
2906
+ } = {}) {
2907
+ const moments = new Set();
2908
+ const families = new Set();
2909
+ const root = join(cwd, dir);
2910
+ let entries;
2911
+ try {
2912
+ entries = readdirSync(root);
2913
+ } catch {
2914
+ return NOTHING_EXECUTED;
2915
+ }
2916
+ for (const entry of entries) {
2917
+ if (!entry.endsWith(".yml") && !entry.endsWith(".yaml")) continue;
2918
+ let text;
2919
+ try {
2920
+ text = readFileSync(join(root, entry), "utf8");
2921
+ } catch {
2922
+ continue;
2923
+ }
2924
+ for (const value of momentArguments(text)) {
2925
+ recordExecutedMoment(value, moments, families);
2926
+ }
2927
+ }
2928
+ return {
2929
+ moments: [...moments].sort(),
2930
+ families: [...families].sort(),
2931
+ };
2932
+ }
2933
+
2934
+ /**
2935
+ * Every moment argument one workflow file names.
2936
+ * @param {string} text The workflow source.
2937
+ * @returns {string[]} The raw values, unvalidated.
2938
+ */
2939
+ function momentArguments(text) {
2940
+ const found = [];
2941
+ // Line by line, so a whole-line comment can be dropped before it is read.
2942
+ // Both languages in a workflow file — YAML and the shell inside `run:` —
2943
+ // comment with `#`, so one rule covers both, and a header documenting the
2944
+ // very command this scan looks for stops counting as an invocation of it.
2945
+ for (const line of text.split("\n")) {
2946
+ if (COMMENT_LINE.test(line)) continue;
2947
+ for (const match of line.matchAll(MOMENT_ARGUMENT)) {
2948
+ const value = match[1] ?? match[2] ?? match[3];
2949
+ if (value) found.push(value.trim());
2950
+ }
2951
+ }
2952
+ return found;
2953
+ }
2954
+
2955
+ /**
2956
+ * Record one workflow's moment argument against the exact/family sets.
2957
+ * @param {string} value The raw value read from the workflow.
2958
+ * @param {Set<string>} moments Exact moments, mutated in place.
2959
+ * @param {Set<string>} families Families executed at a computed environment.
2960
+ */
2961
+ function recordExecutedMoment(value, moments, families) {
2962
+ if (MOMENTS.includes(value)) {
2963
+ moments.add(value);
2964
+ return;
2965
+ }
2966
+ const separator = value.indexOf(":");
2967
+ if (separator === -1) return;
2968
+ const family = value.slice(0, separator);
2969
+ const environment = value.slice(separator + 1);
2970
+ if (!MOMENT_FAMILIES.includes(family) || environment === "") return;
2971
+ // `${{ ... }}` and `$VAR` both mean "decided at run time". The family is
2972
+ // still a statement, and it is the only one available.
2973
+ if (environment.includes("$")) families.add(family);
2974
+ else moments.add(`${family}:${environment}`);
2975
+ }
2976
+
2977
+ /**
2978
+ * Whether the measured inventory covers one declared moment.
2979
+ * @param {{moments?: string[], families?: string[]}} executed The inventory.
2980
+ * @param {string} moment The declared moment.
2981
+ * @returns {boolean} Whether something in the repository runs gates there.
2982
+ */
2983
+ function executesMoment(executed, moment) {
2984
+ const { moments = [], families = [] } = executed ?? {};
2985
+ return moments.includes(moment) || families.includes(momentFamily(moment));
2986
+ }
2839
2987
 
2840
2988
  /**
2841
2989
  * Gates whose only prover reports findings and cannot fail.
@@ -2893,15 +3041,44 @@ function declaredLevel(entry) {
2893
3041
  }
2894
3042
 
2895
3043
  /**
2896
- * The task one gate resolves to, honouring a `run:` override.
2897
- * @param {string} gate Gate id.
2898
- * @param {object} block The gate's own block from the config.
2899
- * @returns {string|undefined} The task name.
3044
+ * The task one declaration resolves to, by the SAME order `resolveMoment` uses.
3045
+ *
3046
+ * It has to be the same order or the classifier judges a command the runner
3047
+ * would never issue. The five sources, narrowest first: the moment entry's own
3048
+ * `run:`, the gate block's `run:`, the `shippedAs` alias when the registry
3049
+ * default is absent and the alias is present, the moment family's `taskAt`
3050
+ * default, and finally the plain registry `task`.
3051
+ *
3052
+ * The alias matters most here and is the easiest to omit. `security:dast` is the
3053
+ * registry name for a dynamic scan and NO stack ships a script under it; two
3054
+ * stacks ship `security:zap`, and the runner substitutes it. A classifier that
3055
+ * looked only at `task` would call every real DAST declaration an orphan and
3056
+ * refuse a configuration that works.
3057
+ * @param {object} options Inputs.
3058
+ * @param {string} options.gate Gate id.
3059
+ * @param {object} options.block The gate's own block from the config.
3060
+ * @param {string} options.moment The declared moment.
3061
+ * @param {Record<string, string>} options.scripts The project's package scripts.
3062
+ * @returns {string|null|undefined} The task the runner would run.
2900
3063
  */
2901
- function declaredTask(gate, block) {
2902
- const override =
2903
- block !== null && typeof block === "object" ? block.run : undefined;
2904
- return typeof override === "string" ? override : REGISTRY[gate]?.task;
3064
+ function resolvedTaskFor({ gate, block, moment, scripts }) {
3065
+ const definition = REGISTRY[gate];
3066
+ const entry = block?.[moment];
3067
+ const entryRun =
3068
+ entry !== null && typeof entry === "object" && typeof entry.run === "string"
3069
+ ? entry.run
3070
+ : null;
3071
+ const blockRun = typeof block?.run === "string" ? block.run : null;
3072
+ const declared = entryRun ?? blockRun;
3073
+ const registryTask =
3074
+ definition?.taskAt?.[momentFamily(moment)] ?? definition?.task ?? null;
3075
+ const alias = aliasFor({
3076
+ declared,
3077
+ registryTask,
3078
+ shippedAs: definition?.shippedAs ?? null,
3079
+ scripts,
3080
+ });
3081
+ return declared ?? alias?.to ?? registryTask;
2905
3082
  }
2906
3083
 
2907
3084
  /**
@@ -2938,6 +3115,7 @@ export function classifyDeclaredExecutors({
2938
3115
  gates,
2939
3116
  scripts,
2940
3117
  outsideFacade = PROVED_OUTSIDE_FACADE,
3118
+ executedMoments = NOTHING_EXECUTED,
2941
3119
  }) {
2942
3120
  const findings = [];
2943
3121
  for (const [gate, block] of Object.entries(gates ?? {})) {
@@ -2961,6 +3139,7 @@ export function classifyDeclaredExecutors({
2961
3139
  level,
2962
3140
  scripts,
2963
3141
  outsideFacade,
3142
+ executedMoments,
2964
3143
  });
2965
3144
  if (finding !== null) findings.push(finding);
2966
3145
  }
@@ -2977,9 +3156,18 @@ export function classifyDeclaredExecutors({
2977
3156
  * @param {string} options.level Declared level.
2978
3157
  * @param {Record<string, string>|null|undefined} options.scripts Project scripts.
2979
3158
  * @param {Record<string, string>} options.outsideFacade Gates proved outside the façade.
3159
+ * @param {{moments?: string[], families?: string[]}} options.executedMoments Moments this repository actually runs gates at.
2980
3160
  * @returns {{gate: string, moment: string, level: string, verdict: string, detail: string}|null} The finding.
2981
3161
  */
2982
- function verdictFor({ gate, block, moment, level, scripts, outsideFacade }) {
3162
+ function verdictFor({
3163
+ gate,
3164
+ block,
3165
+ moment,
3166
+ level,
3167
+ scripts,
3168
+ outsideFacade,
3169
+ executedMoments,
3170
+ }) {
2983
3171
  const make = (verdict, detail) => ({ gate, moment, level, verdict, detail });
2984
3172
  if (level === "required" && Object.hasOwn(ADVISORY_PROVERS, gate)) {
2985
3173
  return make(VACUOUS_PROVER, ADVISORY_PROVERS[gate]);
@@ -2993,17 +3181,6 @@ function verdictFor({ gate, block, moment, level, scripts, outsideFacade }) {
2993
3181
  );
2994
3182
  }
2995
3183
  const family = momentFamily(moment);
2996
- if (HOOK_RUNNER_MOMENTS.includes(family)) {
2997
- if (scripts === null || scripts === undefined) return null;
2998
- const task = declaredTask(gate, block);
2999
- if (task !== undefined && Object.hasOwn(scripts, task)) return null;
3000
- return make(
3001
- ORPHANED,
3002
- `gates."${gate}"."${moment}" resolves to the task "${task}", and this ` +
3003
- `project has no such script. The hook runner would find nothing to ` +
3004
- `run, so the level in front of it describes nothing.`
3005
- );
3006
- }
3007
3184
  if (family === PULL_REQUEST) {
3008
3185
  if (Object.values(QUALITY_JOB_GATES).includes(gate)) return null;
3009
3186
  return make(
@@ -3015,10 +3192,44 @@ function verdictFor({ gate, block, moment, level, scripts, outsideFacade }) {
3015
3192
  `reported" indefinitely.`
3016
3193
  );
3017
3194
  }
3195
+ // The deploy and continuous families have a generic runner the same way the
3196
+ // hooks do — `lisa-run-gates.mjs --moment=<moment>` — but unlike a hook,
3197
+ // which every repository installs, the CALLER is a workflow this repository
3198
+ // either has or does not. So the question is asked of the repository rather
3199
+ // than answered from a table: is there a workflow that hands this moment to
3200
+ // the runner?
3201
+ if (
3202
+ MOMENT_FAMILIES.includes(family) &&
3203
+ !executesMoment(executedMoments, moment)
3204
+ ) {
3205
+ return make(
3206
+ NO_RUNNER_FOR_MOMENT,
3207
+ `nothing in this repository runs gates at "${moment}": no workflow ` +
3208
+ `under ${MOMENT_EXECUTOR_DIR} hands that moment to Lisa's gate ` +
3209
+ `runner. The declaration is read, validated and listed, and then ` +
3210
+ `never executed — inert rather than wrong. Add a caller for Lisa's ` +
3211
+ `gates.yml at this moment (the shipped deploy.yml and ` +
3212
+ `continuous-gates.yml templates do exactly that), or declare it ` +
3213
+ `"off" to put on record that you meant it not to run.`
3214
+ );
3215
+ }
3216
+ // Everything remaining is executed by the generic runner: a hook at its
3217
+ // moment, or a workflow at a deploy or scheduled one. Both resolve a task and
3218
+ // run it, so both need a task that exists.
3219
+ if (scripts === null || scripts === undefined) return null;
3220
+ const task = resolvedTaskFor({ gate, block, moment, scripts });
3221
+ if (
3222
+ task !== undefined &&
3223
+ task !== null &&
3224
+ Object.hasOwn(scripts ?? {}, task)
3225
+ ) {
3226
+ return null;
3227
+ }
3018
3228
  return make(
3019
- NO_RUNNER_FOR_MOMENT,
3020
- `nothing runs gates at "${moment}" at all yet, so this declaration is ` +
3021
- `inert rather than wrong. A different defect, tracked separately.`
3229
+ ORPHANED,
3230
+ `gates."${gate}"."${moment}" resolves to the task "${task}", and this ` +
3231
+ `project has no such script. The gate runner would find nothing to ` +
3232
+ `run, so the level in front of it describes nothing.`
3022
3233
  );
3023
3234
  }
3024
3235
 
@@ -3877,7 +4088,15 @@ function main() {
3877
4088
  // suppress "configuration is valid" for every project that ever runs this,
3878
4089
  // which turns the verdict into noise and trains an operator to ignore both.
3879
4090
  reportUngoverned(gates);
3880
- const executors = classifyDeclaredExecutors({ gates, scripts });
4091
+ // MEASURED, not assumed. Whether a deploy or continuous declaration has
4092
+ // anything able to run it is a fact about THIS repository's workflows, and
4093
+ // the answer changed the day a deploy façade shipped. Reading it here means
4094
+ // the report cannot go stale in the reassuring direction.
4095
+ const executors = classifyDeclaredExecutors({
4096
+ gates,
4097
+ scripts,
4098
+ executedMoments: momentsExecutedBy(),
4099
+ });
3881
4100
  // BLOCKING, and this is the change #2843 called "the substantive work".
3882
4101
  // The classifier existed as a vitest suite reading THIS repository's own
3883
4102
  // config — so the check existed for Lisa and did not exist for anyone Lisa
@@ -0,0 +1,74 @@
1
+ ---
2
+ # Seeded by Lisa on first setup — this file is YOURS.
3
+ # Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
4
+ #
5
+ # The `continuous:<environment>` moment, on a schedule.
6
+ #
7
+ # Every other gate moment blocks a DIFF — the commit, the push, the merge, the
8
+ # deploy. A continuous gate has no diff to block: it runs against a stable
9
+ # target, and by the time it fails, whatever it covered merged hours ago. What it
10
+ # establishes is whether that target is HEALTHY, and the enforcement point is
11
+ # promotion out of it — a red `continuous:staging` means staging is not
12
+ # promotable, which a `pre-deploy:production` gate can require.
13
+ #
14
+ # The clearest case is a CVE: one published today makes yesterday's green wrong
15
+ # with no change to trigger a re-scan. A per-change gate cannot catch that,
16
+ # because there is no change. Only a scheduled run can.
17
+ #
18
+ # ## Nothing runs until you declare something
19
+ #
20
+ # This workflow runs exactly what the `gates` block of `.lisa.config.json`
21
+ # declares at `continuous:<environment>`, and nothing else. Out of the box that
22
+ # is nothing, and the run says so rather than reporting a green that implies a
23
+ # proof. To use it, declare a gate at this moment:
24
+ #
25
+ # ```json
26
+ # "gates": {
27
+ # "dependency-vulnerability": { "continuous:production": "required" },
28
+ # "runtime-web-vulnerability": { "continuous:production": "required" }
29
+ # }
30
+ # ```
31
+ #
32
+ # Eleven of Lisa's gates are legal here; `lisa-gates.mjs list
33
+ # --moment=continuous:production` prints the ones this project can use, and
34
+ # `validate` tells you when a declaration resolves to no prover.
35
+ #
36
+ # ## Customise the environment and the cadence
37
+ #
38
+ # `ENVIRONMENT` below is the suffix of the moment, so it must match what you
39
+ # write in `.lisa.config.json`. Change the cron to suit — a load profile nightly
40
+ # and a dependency scan hourly are two workflows, not one, and splitting them is
41
+ # cheaper than running the expensive one twelve times a day.
42
+ name: 🌙 Continuous Gates
43
+
44
+ on:
45
+ schedule:
46
+ # 07:00 UTC daily.
47
+ - cron: '0 7 * * *'
48
+ workflow_dispatch:
49
+ inputs:
50
+ environment:
51
+ description: 'Environment whose continuous gates to run.'
52
+ required: false
53
+ default: 'production'
54
+ type: string
55
+
56
+ permissions:
57
+ contents: read
58
+
59
+ # One run per environment. A second scheduled run arriving while the first is
60
+ # still going would prove the same property about the same target twice, and the
61
+ # provers here — a DAST scan, a load profile — are the ones that mind.
62
+ concurrency:
63
+ group: continuous-gates-${{ inputs.environment || 'production' }}
64
+ cancel-in-progress: false
65
+
66
+ jobs:
67
+ continuous:
68
+ name: 🌙 Continuous Gates
69
+ uses: CodySwannGT/lisa/.github/workflows/gates.yml@main
70
+ with:
71
+ moment: continuous:${{ inputs.environment || 'production' }}
72
+ node_version: '22.21.1'
73
+ package_manager: 'npm'
74
+ secrets: inherit
@@ -64,11 +64,36 @@ jobs:
64
64
  echo "approval_environment=$APPROVAL_ENV" >> $GITHUB_OUTPUT
65
65
  echo "require_approval=$REQUIRE" >> $GITHUB_OUTPUT
66
66
 
67
+ # ── Pre-deploy gates ──────────────────────────────────────────────────────
68
+ # Resolves `pre-deploy:<environment>` from the `gates` block of
69
+ # .lisa.config.json and runs whatever is declared there, BEFORE the release.
70
+ #
71
+ # This is what makes a declaration like
72
+ #
73
+ # "runtime-web-vulnerability": { "pre-deploy:production": "required" }
74
+ #
75
+ # mean something. A required gate that fails — or that resolves to no prover at
76
+ # all, which is UNPROVABLE rather than passing — stops the workflow here, so
77
+ # the release is never cut. A gate job running BESIDE the deploy would go red
78
+ # after the tag and the artefacts had already shipped, which is a report.
79
+ #
80
+ # A project that declares nothing at this moment gets a green job that ran no
81
+ # gates and says so, and the deploy behaves exactly as it did before.
82
+ pre_deploy_gates:
83
+ name: 🚦 Pre-Deploy Gates
84
+ uses: CodySwannGT/lisa/.github/workflows/gates.yml@main
85
+ needs: [determine_environment]
86
+ with:
87
+ moment: pre-deploy:${{ needs.determine_environment.outputs.environment }}
88
+ node_version: '22.21.1'
89
+ package_manager: 'npm'
90
+ secrets: inherit
91
+
67
92
  release:
68
93
  name: 📦 Release
69
94
  # Reference to the quality checks workflow
70
95
  uses: CodySwannGT/lisa/.github/workflows/release.yml@main
71
- needs: [determine_environment]
96
+ needs: [determine_environment, pre_deploy_gates]
72
97
  permissions:
73
98
  contents: write
74
99
  pull-requests: read
@@ -91,4 +116,19 @@ jobs:
91
116
  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
92
117
  SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
93
118
  SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
119
+
120
+ # ── Post-deploy gates ─────────────────────────────────────────────────────
121
+ # Proves a property of what is now live. A red here does not un-ship the
122
+ # release; it names the gate that does not hold so an operator can act on it,
123
+ # which is the difference between a post-deploy gate and a post-deploy log.
124
+ post_deploy_gates:
125
+ name: 🚦 Post-Deploy Gates
126
+ uses: CodySwannGT/lisa/.github/workflows/gates.yml@main
127
+ needs: [determine_environment, release]
128
+ if: ${{ always() && !cancelled() && needs.release.result == 'success' }}
129
+ with:
130
+ moment: post-deploy:${{ needs.determine_environment.outputs.environment }}
131
+ node_version: '22.21.1'
132
+ package_manager: 'npm'
133
+ secrets: inherit
94
134
  # Trigger staging deployment after CDK trust fix
@@ -1 +1 @@
1
- {"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAuiBjC,CAAC"}
1
+ {"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAwiBjC,CAAC"}
@@ -329,6 +329,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
329
329
  "96077d0bbcf53ccc6b1baadef319cb9fa9979413bcff418ecea5abd136ff3491",
330
330
  "984c34add3cffa3733e8852126e59aab08d34495205d8a3dde9108d8aaa87fbf",
331
331
  "98652623c7451d05e48239e1678ad7977a323eaf7ff5ca4b4f3bbc0798396859",
332
+ "9bf572a37c359ded2ae1d50c66be4bda06f33646703bfb2bda42e81f46b3fe5d",
332
333
  "a5dad9842c65c0949f5f3890fb61a1c26fb2b5bac8616e9242ae3a144c095787",
333
334
  "a755c64ed82aec1e1af096c93e51541548d8ad9eafb361469dbe4fc9b1205a61",
334
335
  "a8af7e575c086970a50cb389a159946ce1755318035ca2baecd1486f2c5b7dbc",
@@ -1 +1 @@
1
- {"version":3,"file":"lisa-owned-hash-ledger.js","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAE/B,MAAM,CAAC,MAAM,CAAC;IAChB,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC;QACvC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oCAAoC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,2CAA2C,EAAE,MAAM,CAAC,MAAM,CAAC;QACzD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oCAAoC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oCAAoC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,iDAAiD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;KACnE,CAAC;IACF,2BAA2B,EAAE,MAAM,CAAC,MAAM,CAAC;QACzC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,8BAA8B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,kCAAkC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sDAAsD,EAAE,MAAM,CAAC,MAAM,CAAC;QACpE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;CACH,CAAC,CAAC;AACH,sEAAsE"}
1
+ {"version":3,"file":"lisa-owned-hash-ledger.js","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAE/B,MAAM,CAAC,MAAM,CAAC;IAChB,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC;QACvC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oCAAoC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,2CAA2C,EAAE,MAAM,CAAC,MAAM,CAAC;QACzD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oCAAoC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oCAAoC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,iDAAiD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;KACnE,CAAC;IACF,2BAA2B,EAAE,MAAM,CAAC,MAAM,CAAC;QACzC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,8BAA8B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,kCAAkC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sDAAsD,EAAE,MAAM,CAAC,MAAM,CAAC;QACpE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;CACH,CAAC,CAAC;AACH,sEAAsE"}
@@ -1 +1 @@
1
- {"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA03EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAsgPjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
1
+ {"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA43EpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA4gPjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}