@codyswann/lisa 4.21.4 → 4.21.6

package/dist/cli/doctor-nightly-e2e-guard-command-files.d.ts

@@ -0,0 +1,19 @@
+/** @file doctor-nightly-e2e-guard-command-files.ts @description Bounded payload-aware interpretation of GitHub command-file writes @module cli/doctor-nightly-e2e-guard-command-files */
+import { type ShellToken } from "./doctor-nightly-e2e-guard-shell-lexer.js";
+declare const GITHUB_COMMAND_FILES: readonly ["GITHUB_ENV", "GITHUB_PATH"];
+/** One statically observed write to a GitHub command file. */
+export interface NightlyGuardCommandFileWrite {
+    /** Command file whose later-step process state can change. */
+    readonly file: (typeof GITHUB_COMMAND_FILES)[number];
+    /** Whether the exact emitted name is proven harmless to guard execution. */
+    readonly safety: "safe" | "unsafe" | "unknown";
+}
+/**
+ * Retain command-file effects without mistaking unrelated assignments for payload.
+ * @param tokens - Comment-stripped bounded shell tokens for one step
+ * @param safeEnvironmentName - Guard-aware predicate for one exact emitted name
+ * @returns Every recognized command-file sink in source order
+ */
+export declare function inspectNightlyGuardCommandFileWrites(tokens: readonly ShellToken[], safeEnvironmentName: (name: string) => boolean): readonly NightlyGuardCommandFileWrite[];
+export {};
+//# sourceMappingURL=doctor-nightly-e2e-guard-command-files.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-command-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-command-files.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-command-files.ts"],"names":[],"mappings":"AAAA,yLAAyL;AACzL,OAAO,EACL,KAAK,UAAU,EAEhB,MAAM,2CAA2C,CAAC;AAGnD,QAAA,MAAM,oBAAoB,wCAAyC,CAAC;AAYpE,8DAA8D;AAC9D,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;CAChD;AA2SD;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAC7C,SAAS,4BAA4B,EAAE,CAMzC"}

package/dist/cli/doctor-nightly-e2e-guard-command-files.js

@@ -0,0 +1,221 @@
+import { isExecutionChangingEnvironmentName as changesExecution } from "./doctor-nightly-e2e-guard-runtime.js";
+const GITHUB_COMMAND_FILES = ["GITHUB_ENV", "GITHUB_PATH"];
+const POSIX_IDENTIFIER = "[A-Za-z_]\\w*";
+const POSIX_ASSIGNMENT = /^([A-Za-z_]\w*)=/u;
+const ENVIRONMENT_TARGET = new RegExp(`^\\$(?:\\{(${POSIX_IDENTIFIER})\\}|(${POSIX_IDENTIFIER}))$`, "u");
+const INDIRECT_ENVIRONMENT_TARGET = new RegExp(`^\\$\\{!(${POSIX_IDENTIFIER})\\}$`, "u");
+const words = (tokens) => tokens.filter((token) => token.kind === "word");
+const commandFileReference = (word) => !word.dynamic || word.quote === "single"
+    ? undefined
+    : GITHUB_COMMAND_FILES.find(file => new RegExp(`\\$(?:\\{[^}\\n]*${file}[^}\\n]*\\}|[A-Z0-9_]*${file}[A-Z0-9_]*)`, "u").test(word.value));
+const exactTargetName = (word) => {
+    if (word.quote === "single")
+        return undefined;
+    const match = ENVIRONMENT_TARGET.exec(word.value);
+    return match?.[1] ?? match?.[2];
+};
+const indirectTargetName = (word) => word.quote === "single"
+    ? undefined
+    : INDIRECT_ENVIRONMENT_TARGET.exec(word.value)?.[1];
+const commandSegment = (tokens, end) => {
+    const boundary = tokens
+        .slice(0, end)
+        .reduce((latest, token, index) => token.kind === "operator" &&
+        (token.value === "\n" || token.value === ";")
+        ? index
+        : latest, -1);
+    return tokens.slice(boundary + 1, end);
+};
+const assignmentName = (word) => word.dynamic || word.quote === "mixed" || /[\n\r\\`$]/u.test(word.value)
+    ? undefined
+    : /^([A-Z][A-Z0-9_]*)=[\x20-\x7e]*$/u.exec(word.value)?.[1];
+const literalPrintfAssignment = (word) => {
+    if (word.dynamic || word.quote !== "single" || !word.value.endsWith("\\n")) {
+        return undefined;
+    }
+    const line = word.value.slice(0, -2);
+    if (/[\\%]/u.test(line))
+        return undefined;
+    return assignmentName({ ...word, value: line });
+};
+const emittedAssignmentName = (tokens) => {
+    if (tokens.some(token => token.kind === "operator"))
+        return undefined;
+    const emitted = words(tokens);
+    const format = emitted[1];
+    const payload = emitted.length === 2 && emitted[0]?.value === "echo"
+        ? emitted[1]
+        : emitted.length === 3 &&
+            emitted[0]?.value === "printf" &&
+            format?.dynamic === false &&
+            format.quote !== "mixed" &&
+            ["%s", "%s\\n"].includes(format.value)
+            ? emitted[2]
+            : undefined;
+    if (payload)
+        return assignmentName(payload);
+    return emitted.length === 2 && emitted[0]?.value === "printf"
+        ? literalPrintfAssignment(emitted[1])
+        : undefined;
+};
+const aliasName = (word) => word.quote === "single" || word.quote === "double"
+    ? undefined
+    : POSIX_ASSIGNMENT.exec(word.value)?.[1];
+const literalCommandFileAssignment = (word) => {
+    if (word.dynamic)
+        return undefined;
+    const name = aliasName(word);
+    if (!name)
+        return undefined;
+    const value = word.value.slice(word.value.indexOf("=") + 1);
+    return GITHUB_COMMAND_FILES.find(file => value === file);
+};
+const aliasBefore = (tokens, targetName, target) => tokens
+    .slice(0, target)
+    .reduce((latest, token) => {
+    if (token.kind !== "word" || aliasName(token) !== targetName) {
+        return latest;
+    }
+    const file = commandFileReference(token);
+    if (!file)
+        return undefined;
+    const value = token.value.slice(token.value.indexOf("=") + 1);
+    const match = ENVIRONMENT_TARGET.exec(value);
+    return {
+        file,
+        exact: (match?.[1] ?? match?.[2]) === file,
+    };
+}, undefined);
+const priorCommandFile = (tokens, target) => tokens
+    .slice(0, target)
+    .reduce((latest, token) => (token.kind === "word" ? (commandFileReference(token) ?? latest) : latest), undefined);
+const indirectCommandFileBefore = (tokens, targetName, target) => {
+    const prior = tokens.slice(0, target);
+    const assigned = prior.reduce((latest, token) => {
+        if (token.kind !== "word" || aliasName(token) !== targetName) {
+            return latest;
+        }
+        return commandFileReference(token) ?? literalCommandFileAssignment(token);
+    }, undefined);
+    if (assigned)
+        return assigned;
+    return prior.reduce((latest, token) => token.kind === "word"
+        ? (commandFileReference(token) ??
+            literalCommandFileAssignment(token) ??
+            latest)
+        : latest, undefined);
+};
+const redirectBefore = (tokens, target) => {
+    const prior = tokens[target - 1];
+    if (prior?.kind === "operator" &&
+        (prior.value === ">" || prior.value === ">>")) {
+        return target - 1;
+    }
+    const clobber = tokens[target - 2];
+    return clobber?.kind === "operator" &&
+        clobber.value === ">" &&
+        prior?.kind === "operator" &&
+        prior.value === "|"
+        ? target - 2
+        : undefined;
+};
+const supportedTeePrefix = (tokens) => {
+    const command = tokens.at(-1);
+    const assignments = command?.kind === "word" && command.value === "command"
+        ? tokens.slice(0, -1)
+        : tokens;
+    return assignments.every(token => {
+        if (token.kind !== "word")
+            return false;
+        const name = aliasName(token);
+        return name !== undefined && !token.dynamic && !changesExecution(name);
+    });
+};
+const teeCommandStart = (tokens, teeIndex) => {
+    const segment = commandSegment(tokens, teeIndex);
+    const pipe = segment.reduce((latest, token, index) => token.kind === "operator" && token.value === "|" ? index : latest, -1);
+    const prefix = segment.slice(pipe + 1);
+    if (!supportedTeePrefix(prefix))
+        return undefined;
+    return pipe < 0 ? teeIndex : teeIndex - segment.length + pipe;
+};
+const teeSinkBefore = (tokens, target) => {
+    const append = tokens[target - 1];
+    const teeIndex = append?.kind === "word" && append.value === "-a" ? target - 2 : target - 1;
+    const tee = tokens[teeIndex];
+    if (tee?.kind !== "word" || tee.value !== "tee")
+        return undefined;
+    return teeCommandStart(tokens, teeIndex);
+};
+const unresolvedTeeBefore = (tokens, target) => words(commandSegment(tokens, target)).some(word => word.value === "tee");
+const emittedNameForSink = (tokens, target) => {
+    const redirect = redirectBefore(tokens, target);
+    if (redirect !== undefined) {
+        return emittedAssignmentName(commandSegment(tokens, redirect));
+    }
+    const teeSink = teeSinkBefore(tokens, target);
+    return teeSink === undefined
+        ? undefined
+        : emittedAssignmentName(commandSegment(tokens, teeSink));
+};
+const isSinkTarget = (tokens, target) => redirectBefore(tokens, target) !== undefined ||
+    teeSinkBefore(tokens, target) !== undefined;
+const readOnlyReference = (token, command) => aliasName(token) !== undefined || command === "echo";
+const resolvedCommandFileTarget = (tokens, token, index) => {
+    const targetName = exactTargetName(token);
+    const indirectName = indirectTargetName(token);
+    const direct = commandFileReference(token);
+    if (direct)
+        return { file: direct, exact: targetName === direct };
+    const alias = targetName ? aliasBefore(tokens, targetName, index) : undefined;
+    if (alias)
+        return alias;
+    const indirectAlias = indirectName
+        ? indirectCommandFileBefore(tokens, indirectName, index)
+        : undefined;
+    if (indirectAlias)
+        return { file: indirectAlias, exact: false };
+    const indirect = targetName ? priorCommandFile(tokens, index) : undefined;
+    return indirect ? { file: indirect, exact: false } : undefined;
+};
+const writeForToken = (tokens, token, index, safeEnvironmentName) => {
+    const sink = isSinkTarget(tokens, index);
+    const target = resolvedCommandFileTarget(tokens, token, index);
+    if (!target)
+        return undefined;
+    const readOnly = !unresolvedTeeBefore(tokens, index) &&
+        readOnlyReference(token, words(commandSegment(tokens, index))[0]?.value);
+    if (!sink && readOnly)
+        return undefined;
+    if (!sink)
+        return { file: target.file, safety: "unknown" };
+    if (!target.exact)
+        return { file: target.file, safety: "unknown" };
+    if (target.file === "GITHUB_PATH") {
+        return { file: target.file, safety: "unsafe" };
+    }
+    const emittedName = emittedNameForSink(tokens, index);
+    return {
+        file: target.file,
+        safety: emittedName === undefined
+            ? "unknown"
+            : safeEnvironmentName(emittedName)
+                ? "safe"
+                : "unsafe",
+    };
+};
+/**
+ * Retain command-file effects without mistaking unrelated assignments for payload.
+ * @param tokens - Comment-stripped bounded shell tokens for one step
+ * @param safeEnvironmentName - Guard-aware predicate for one exact emitted name
+ * @returns Every recognized command-file sink in source order
+ */
+export function inspectNightlyGuardCommandFileWrites(tokens, safeEnvironmentName) {
+    return tokens.flatMap((token, index) => {
+        if (token.kind !== "word")
+            return [];
+        const write = writeForToken(tokens, token, index, safeEnvironmentName);
+        return write ? [write] : [];
+    });
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-command-files.js.map

package/dist/cli/doctor-nightly-e2e-guard-command-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-command-files.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-command-files.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kCAAkC,IAAI,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE/G,MAAM,oBAAoB,GAAG,CAAC,YAAY,EAAE,aAAa,CAAU,CAAC;AACpE,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,IAAI,MAAM,CACnC,cAAc,gBAAgB,SAAS,gBAAgB,KAAK,EAC5D,GAAG,CACJ,CAAC;AACF,MAAM,2BAA2B,GAAG,IAAI,MAAM,CAC5C,YAAY,gBAAgB,OAAO,EACnC,GAAG,CACJ,CAAC;AAUF,MAAM,KAAK,GAAG,CAAC,MAA6B,EAAwB,EAAE,CACpE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAsB,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAEtE,MAAM,oBAAoB,GAAG,CAC3B,IAAe,EACmC,EAAE,CACpD,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;IACtC,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/B,IAAI,MAAM,CACR,oBAAoB,IAAI,yBAAyB,IAAI,aAAa,EAClE,GAAG,CACJ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CACnB,CAAC;AAER,MAAM,eAAe,GAAG,CAAC,IAAe,EAAsB,EAAE;IAC9D,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,IAAe,EAAsB,EAAE,CACjE,IAAI,CAAC,KAAK,KAAK,QAAQ;IACrB,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAExD,MAAM,cAAc,GAAG,CACrB,MAA6B,EAC7B,GAAW,EACY,EAAE;IACzB,MAAM,QAAQ,GAAG,MAAM;SACpB,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACb,MAAM,CACL,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACvB,KAAK,CAAC,IAAI,KAAK,UAAU;QACzB,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC;QAC3C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,EACZ,CAAC,CAAC,CACH,CAAC;IACJ,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,IAAe,EAAsB,EAAE,CAC7D,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IACtE,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAEhE,MAAM,uBAAuB,GAAG,CAAC,IAAe,EAAsB,EAAE;IACtE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,MAA6B,EACT,EAAE;IACtB,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,MAAM;QAClD,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,QAAQ;YAC9B,MAAM,EAAE,OAAO,KAAK,KAAK;YACzB,MAAM,CAAC,KAAK,KAAK,OAAO;YACxB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACZ,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,OAAO;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,QAAQ;QAC3D,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAc,CAAC;QAClD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAUF,MAAM,SAAS,GAAG,CAAC,IAAe,EAAsB,EAAE,CACxD,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;IAChD,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE7C,MAAM,4BAA4B,GAAG,CACnC,IAAe,EACmC,EAAE;IACpD,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AAC3D,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,MAA6B,EAC7B,UAAkB,EAClB,MAAc,EACgB,EAAE,CAChC,MAAM;KACH,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;KAChB,MAAM,CAA+B,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;IACtD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;KAC3C,CAAC;AACJ,CAAC,EAAE,SAAS,CAAC,CAAC;AAElB,MAAM,gBAAgB,GAAG,CACvB,MAA6B,EAC7B,MAAc,EACoC,EAAE,CACpD,MAAM;KACH,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;KAChB,MAAM,CAEL,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;AAEhH,MAAM,yBAAyB,GAAG,CAChC,MAA6B,EAC7B,UAAkB,EAClB,MAAc,EACoC,EAAE;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAE3B,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAClB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC;YAC7D,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,IAAI,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,CACjB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAChB,KAAK,CAAC,IAAI,KAAK,MAAM;QACnB,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC;YAC5B,4BAA4B,CAAC,KAAK,CAAC;YACnC,MAAM,CAAC;QACT,CAAC,CAAC,MAAM,EACZ,SAAS,CACV,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,MAA6B,EAC7B,MAAc,EACM,EAAE;IACtB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,IACE,KAAK,EAAE,IAAI,KAAK,UAAU;QAC1B,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,EAC7C,CAAC;QACD,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,OAAO,EAAE,IAAI,KAAK,UAAU;QACjC,OAAO,CAAC,KAAK,KAAK,GAAG;QACrB,KAAK,EAAE,IAAI,KAAK,UAAU;QAC1B,KAAK,CAAC,KAAK,KAAK,GAAG;QACnB,CAAC,CAAC,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,MAA6B,EAAW,EAAE;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,WAAW,GACf,OAAO,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QACrD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC;IACb,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CACtB,MAA6B,EAC7B,QAAgB,EACI,EAAE;IACtB,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CACzB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACvB,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EACnE,CAAC,CAAC,CACH,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,MAA6B,EAC7B,MAAc,EACM,EAAE;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,QAAQ,GACZ,MAAM,EAAE,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,GAAG,EAAE,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,MAA6B,EAC7B,MAAc,EACL,EAAE,CACX,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAE3E,MAAM,kBAAkB,GAAG,CACzB,MAA6B,EAC7B,MAAc,EACM,EAAE;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,qBAAqB,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,MAA6B,EAAE,MAAc,EAAW,EAAE,CAC9E,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,SAAS;IAC5C,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,SAAS,CAAC;AAE9C,MAAM,iBAAiB,GAAG,CACxB,KAAgB,EAChB,OAA2B,EAClB,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,CAAC;AAEnE,MAAM,yBAAyB,GAAG,CAChC,MAA6B,EAC7B,KAAgB,EAChB,KAAa,EACiB,EAAE;IAChC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,KAAK,MAAM,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,aAAa,GAAG,YAAY;QAChC,CAAC,CAAC,yBAAyB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;QACxD,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,MAA6B,EAC7B,KAAgB,EAChB,KAAa,EACb,mBAA8C,EACJ,EAAE;IAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,QAAQ,GACZ,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC;QACnC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAI,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACnE,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EACJ,WAAW,KAAK,SAAS;YACvB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC;gBAChC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,QAAQ;KACjB,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAClD,MAA6B,EAC7B,mBAA8C;IAE9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACrC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-contract.d.ts

@@ -0,0 +1,113 @@
+/** Canonical destination installed into host projects. */
+export declare const NIGHTLY_GUARD_CANONICAL_TARGET = "scripts/check-nightly-e2e-health.mjs";
+/** Canonical guard inside an installed Lisa package. */
+export declare const NIGHTLY_GUARD_SHIPPED_TARGET = "typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs";
+/** Workflow inventory root inspected by doctor. */
+export declare const NIGHTLY_GUARD_WORKFLOWS = ".github/workflows";
+/** Maximum workflow files inspected by one doctor run. */
+export declare const MAX_NIGHTLY_GUARD_FILES = 256;
+/** Maximum active root-to-guard call paths inspected by one doctor run. */
+export declare const MAX_NIGHTLY_GUARD_CALLERS = 64;
+/** Maximum distinct scripts proven by one doctor run. */
+export declare const MAX_NIGHTLY_GUARD_TARGETS = 8;
+/** Maximum bytes read from any workflow or target file. */
+export declare const MAX_NIGHTLY_GUARD_FILE_BYTES: number;
+/** Maximum workflow bytes read across discovery. */
+export declare const MAX_NIGHTLY_GUARD_TOTAL_BYTES: number;
+/** Maximum local reusable call depth. */
+export declare const MAX_NIGHTLY_GUARD_LOCAL_DEPTH = 8;
+/** Maximum UTF-8 bytes in one workflow filename attribution identifier. */
+export declare const MAX_NIGHTLY_GUARD_WORKFLOW_ID_BYTES = 255;
+/** Maximum ASCII bytes in one GitHub job mapping identifier. */
+export declare const MAX_NIGHTLY_GUARD_JOB_ID_BYTES = 100;
+/** Maximum bytes retained across all caller-attribution fields. */
+export declare const MAX_NIGHTLY_GUARD_ATTRIBUTION_BYTES: number;
+/** Maximum bytes emitted in this doctor row's human/JSON detail. */
+export declare const MAX_NIGHTLY_GUARD_DETAIL_BYTES: number;
+/** Maximum time allocated to one static target proof. */
+export declare const NIGHTLY_GUARD_TARGET_TIMEOUT_MS = 2000;
+/** Maximum time allocated to discovery, proof, and remediation together. */
+export declare const NIGHTLY_GUARD_OPERATION_TIMEOUT_MS = 15000;
+/** One active root-to-job path and the literal script it executes. */
+export interface NightlyGuardCaller {
+    /** Leaf workflow that contains the executable guard job. */
+    readonly workflow: string;
+    /** Leaf job identifier, which participates in the check context. */
+    readonly job: string;
+    /** Full root-to-leaf attribution retained even for shared reusables. */
+    readonly callPath: string;
+    /** Whether the leaf calls Lisa's endpoint or invokes Node itself. */
+    readonly kind: "official-reusable" | "direct";
+    /** Literal project-relative JavaScript target. */
+    readonly target: string;
+}
+/** One reason discovery could not produce a trustworthy answer. */
+export interface NightlyGuardScanFailure {
+    /** Workflow involved, or the workflow directory for inventory failures. */
+    readonly workflow: string;
+    /** Bounded operator-readable refusal. */
+    readonly reason: string;
+}
+/** Discovery distinguishes an examined zero from unavailable evidence. */
+export type NightlyGuardScanResult = {
+    readonly state: "ok";
+    readonly callers: readonly NightlyGuardCaller[];
+} | {
+    readonly state: "unavailable";
+    readonly failures: readonly NightlyGuardScanFailure[];
+};
+/** Parsed workflow retained with its deterministic display path. */
+export interface NightlyGuardWorkflowRecord {
+    /** Repo-relative path used in findings. */
+    readonly file: string;
+    /** Basename used by supported local reusable references. */
+    readonly name: string;
+    /** Parsed YAML mapping. */
+    readonly document: Readonly<Record<string, unknown>>;
+}
+/** Successful trusted contract evidence or a reason no verdict exists. */
+export type NightlyGuardProbeResult = {
+    readonly state: "compatible";
+    readonly version: string;
+} | {
+    readonly state: "failure";
+    readonly reason: string;
+    readonly version?: string;
+};
+/**
+ * Narrow unknown values to YAML-style mappings.
+ * @param value - Parsed YAML value
+ * @returns Mapping values only; arrays and scalars are refused
+ */
+export declare const nightlyGuardObject: (value: unknown) => Readonly<Record<string, unknown>> | undefined;
+/**
+ * Return trimmed YAML strings while refusing coercion.
+ * @param value - Parsed YAML value
+ * @returns Trimmed literal string or an empty sentinel
+ */
+export declare const nightlyGuardText: (value: unknown) => string;
+/**
+ * Sort ASCII identifiers without locale-dependent ordering.
+ * @param values - Identifiers copied before ordering
+ * @returns Deterministically ordered copy
+ */
+export declare const orderNightlyGuardStrings: <T extends string>(values: readonly T[]) => T[];
+/**
+ * Validate the documented GitHub job-id alphabet and Lisa's 100-byte ceiling.
+ * @param jobId - YAML `jobs` mapping key used in check attribution
+ * @returns Whether the identifier can enter a bounded caller path
+ */
+export declare const isNightlyGuardJobId: (jobId: string) => boolean;
+/**
+ * Count retained attribution bytes, including separators between fields.
+ * @param caller - Active caller about to enter doctor output
+ * @returns Exact UTF-8 bytes charged to the aggregate attribution budget
+ */
+export declare const nightlyGuardCallerAttributionBytes: (caller: NightlyGuardCaller) => number;
+/**
+ * Normalize a supported literal target without resolving through the host FS.
+ * @param candidate - Workflow-provided path token
+ * @returns Normalized project-relative path, or undefined for unsupported input
+ */
+export declare function normalizeNightlyGuardTarget(candidate: string): string | undefined;
+//# sourceMappingURL=doctor-nightly-e2e-guard-contract.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-contract.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-contract.ts"],"names":[],"mappings":"AAOA,0DAA0D;AAC1D,eAAO,MAAM,8BAA8B,yCACH,CAAC;AACzC,wDAAwD;AACxD,eAAO,MAAM,4BAA4B,mEACyB,CAAC;AACnE,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAC3D,0DAA0D;AAC1D,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,yDAAyD;AACzD,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,2DAA2D;AAC3D,eAAO,MAAM,4BAA4B,QAAc,CAAC;AACxD,oDAAoD;AACpD,eAAO,MAAM,6BAA6B,QAAkB,CAAC;AAC7D,yCAAyC;AACzC,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAC/C,2EAA2E;AAC3E,eAAO,MAAM,mCAAmC,MAAM,CAAC;AACvD,gEAAgE;AAChE,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,mEAAmE;AACnE,eAAO,MAAM,mCAAmC,QAAW,CAAC;AAC5D,oEAAoE;AACpE,eAAO,MAAM,8BAA8B,QAAW,CAAC;AACvD,yDAAyD;AACzD,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AACrD,4EAA4E;AAC5E,eAAO,MAAM,kCAAkC,QAAS,CAAC;AAEzD,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,QAAQ,CAAC;IAC9C,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,mEAAmE;AACnE,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAA;CAAE,GACzE;IACE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACvD,CAAC;AAEN,oEAAoE;AACpE,MAAM,WAAW,0BAA0B;IACzC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtD;AAED,0EAA0E;AAC1E,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1D;IACE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,OAAO,KACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAGxB,CAAC;AAEhB;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,OAAO,KAAG,MACH,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,CAAC,SAAS,MAAM,EACvD,QAAQ,SAAS,CAAC,EAAE,KACnB,CAAC,EAC2E,CAAC;AAIhF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,KAAG,OAEhC,CAAC;AAErB;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,GAC7C,QAAQ,kBAAkB,KACzB,MAGA,CAAC;AAIJ;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CASpB"}

package/dist/cli/doctor-nightly-e2e-guard-contract.js

@@ -0,0 +1,87 @@
+/**
+ * @file doctor-nightly-e2e-guard-contract.ts
+ * @description Shared bounds and data contracts for active nightly guard proof
+ * @module cli/doctor-nightly-e2e-guard-contract
+ */
+import * as path from "node:path";
+/** Canonical destination installed into host projects. */
+export const NIGHTLY_GUARD_CANONICAL_TARGET = "scripts/check-nightly-e2e-health.mjs";
+/** Canonical guard inside an installed Lisa package. */
+export const NIGHTLY_GUARD_SHIPPED_TARGET = "typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs";
+/** Workflow inventory root inspected by doctor. */
+export const NIGHTLY_GUARD_WORKFLOWS = ".github/workflows";
+/** Maximum workflow files inspected by one doctor run. */
+export const MAX_NIGHTLY_GUARD_FILES = 256;
+/** Maximum active root-to-guard call paths inspected by one doctor run. */
+export const MAX_NIGHTLY_GUARD_CALLERS = 64;
+/** Maximum distinct scripts proven by one doctor run. */
+export const MAX_NIGHTLY_GUARD_TARGETS = 8;
+/** Maximum bytes read from any workflow or target file. */
+export const MAX_NIGHTLY_GUARD_FILE_BYTES = 1024 * 1024;
+/** Maximum workflow bytes read across discovery. */
+export const MAX_NIGHTLY_GUARD_TOTAL_BYTES = 8 * 1024 * 1024;
+/** Maximum local reusable call depth. */
+export const MAX_NIGHTLY_GUARD_LOCAL_DEPTH = 8;
+/** Maximum UTF-8 bytes in one workflow filename attribution identifier. */
+export const MAX_NIGHTLY_GUARD_WORKFLOW_ID_BYTES = 255;
+/** Maximum ASCII bytes in one GitHub job mapping identifier. */
+export const MAX_NIGHTLY_GUARD_JOB_ID_BYTES = 100;
+/** Maximum bytes retained across all caller-attribution fields. */
+export const MAX_NIGHTLY_GUARD_ATTRIBUTION_BYTES = 3 * 1024;
+/** Maximum bytes emitted in this doctor row's human/JSON detail. */
+export const MAX_NIGHTLY_GUARD_DETAIL_BYTES = 4 * 1024;
+/** Maximum time allocated to one static target proof. */
+export const NIGHTLY_GUARD_TARGET_TIMEOUT_MS = 2_000;
+/** Maximum time allocated to discovery, proof, and remediation together. */
+export const NIGHTLY_GUARD_OPERATION_TIMEOUT_MS = 15_000;
+/**
+ * Narrow unknown values to YAML-style mappings.
+ * @param value - Parsed YAML value
+ * @returns Mapping values only; arrays and scalars are refused
+ */
+export const nightlyGuardObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value
+    : undefined;
+/**
+ * Return trimmed YAML strings while refusing coercion.
+ * @param value - Parsed YAML value
+ * @returns Trimmed literal string or an empty sentinel
+ */
+export const nightlyGuardText = (value) => typeof value === "string" ? value.trim() : "";
+/**
+ * Sort ASCII identifiers without locale-dependent ordering.
+ * @param values - Identifiers copied before ordering
+ * @returns Deterministically ordered copy
+ */
+export const orderNightlyGuardStrings = (values) => [...values].sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+const JOB_ID = /^[A-Za-z_][A-Za-z0-9_-]*$/u;
+/**
+ * Validate the documented GitHub job-id alphabet and Lisa's 100-byte ceiling.
+ * @param jobId - YAML `jobs` mapping key used in check attribution
+ * @returns Whether the identifier can enter a bounded caller path
+ */
+export const isNightlyGuardJobId = (jobId) => Buffer.byteLength(jobId) <= MAX_NIGHTLY_GUARD_JOB_ID_BYTES &&
+    JOB_ID.test(jobId);
+/**
+ * Count retained attribution bytes, including separators between fields.
+ * @param caller - Active caller about to enter doctor output
+ * @returns Exact UTF-8 bytes charged to the aggregate attribution budget
+ */
+export const nightlyGuardCallerAttributionBytes = (caller) => Buffer.byteLength([caller.workflow, caller.job, caller.callPath, caller.target].join("\0"));
+const TARGET = /^(?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_.-]+\.(?:js|mjs|cjs)$/u;
+/**
+ * Normalize a supported literal target without resolving through the host FS.
+ * @param candidate - Workflow-provided path token
+ * @returns Normalized project-relative path, or undefined for unsupported input
+ */
+export function normalizeNightlyGuardTarget(candidate) {
+    const relative = candidate.startsWith("./") ? candidate.slice(2) : candidate;
+    if (!TARGET.test(relative) || path.posix.isAbsolute(relative)) {
+        return undefined;
+    }
+    const segments = relative.split("/");
+    return segments.includes(".") || segments.includes("..")
+        ? undefined
+        : relative;
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-contract.js.map

package/dist/cli/doctor-nightly-e2e-guard-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-contract.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-contract.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GACzC,sCAAsC,CAAC;AACzC,wDAAwD;AACxD,MAAM,CAAC,MAAM,4BAA4B,GACvC,gEAAgE,CAAC;AACnE,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAC3D,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAC5C,yDAAyD;AACzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAC3C,2DAA2D;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,GAAG,IAAI,CAAC;AACxD,oDAAoD;AACpD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7D,yCAAyC;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAC/C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AACvD,gEAAgE;AAChE,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,mEAAmE;AACnE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,GAAG,IAAI,CAAC;AAC5D,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,GAAG,IAAI,CAAC;AACvD,yDAAyD;AACzD,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AACrD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kCAAkC,GAAG,MAAM,CAAC;AAmDzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,KAAc,EACiC,EAAE,CACjD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAClE,CAAC,CAAE,KAA2C;IAC9C,CAAC,CAAC,SAAS,CAAC;AAEhB;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAU,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,MAAoB,EACf,EAAE,CACP,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,MAAM,MAAM,GAAG,4BAA4B,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAW,EAAE,CAC5D,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,8BAA8B;IAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAErB;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAChD,MAA0B,EAClB,EAAE,CACV,MAAM,CAAC,UAAU,CACf,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzE,CAAC;AAEJ,MAAM,MAAM,GAAG,0DAA0D,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB;IAEjB,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-deadline.d.ts

@@ -0,0 +1,61 @@
+/** Explicit error used to convert every deadline exhaustion into one finding. */
+export declare class NightlyGuardDeadlineError extends Error {
+    /** Distinguishes a bounded refusal from arbitrary IO failures. */
+    readonly code = "NIGHTLY_GUARD_DEADLINE";
+    /**
+     * Create the stable operator-facing deadline refusal.
+     * @param reason - Budget whose expiration caused the refusal
+     */
+    constructor(reason?: string);
+}
+/** Absolute operation budget shared across leaf modules. */
+export interface NightlyGuardDeadline {
+    /** Absolute time from the injected monotonic clock. */
+    readonly expiresAt: number;
+    /** Monotonic clock used by every budget check. */
+    readonly now: () => number;
+    /** Exact budget represented by this absolute expiration. */
+    readonly reason: string;
+}
+/**
+ * Start the deadline before discovery so an expensive scan consumes proof time.
+ * @param now - Injected monotonic clock
+ * @param timeoutMs - Whole-operation budget
+ * @param reason - Exact budget named on expiry
+ * @returns Shared absolute deadline
+ */
+export declare function createNightlyGuardDeadline(now?: () => number, timeoutMs?: number, reason?: string): NightlyGuardDeadline;
+/**
+ * Return the non-negative time left in the shared budget.
+ * @param deadline - Shared absolute deadline
+ * @returns Remaining milliseconds, clamped at zero
+ */
+export declare const nightlyGuardRemaining: (deadline: NightlyGuardDeadline) => number;
+/**
+ * Describe the exact target ceiling without hard-coding the default budget.
+ * @param timeoutMs - Target-specific ceiling in milliseconds
+ * @returns Stable operator-facing deadline reason
+ */
+export declare function nightlyGuardTargetDeadlineReason(timeoutMs: number): string;
+/**
+ * Refuse work immediately once the shared deadline has elapsed.
+ * @param deadline - Shared absolute deadline
+ */
+export declare function assertNightlyGuardDeadline(deadline: NightlyGuardDeadline): void;
+/**
+ * Enforce the remaining wall-clock budget even when an injected collaborator
+ * never resolves. The abandoned operation is read-only and cannot alter the
+ * inspected project after the refusal is returned.
+ * @param deadline - Shared operation deadline
+ * @param operation - Lazy read-only asynchronous work
+ * @returns The operation result before expiry
+ */
+export declare function withinNightlyGuardDeadline<T>(deadline: NightlyGuardDeadline, operation: () => Promise<T>): Promise<T>;
+/**
+ * Give one target a smaller ceiling without extending the outer deadline.
+ * @param outer - Whole-operation deadline
+ * @param timeoutMs - Target-specific ceiling
+ * @returns Deadline ending at the earlier ceiling
+ */
+export declare function limitNightlyGuardDeadline(outer: NightlyGuardDeadline, timeoutMs: number): NightlyGuardDeadline;
+//# sourceMappingURL=doctor-nightly-e2e-guard-deadline.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-deadline.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-deadline.ts"],"names":[],"mappings":"AASA,iFAAiF;AACjF,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,kEAAkE;IAClE,QAAQ,CAAC,IAAI,4BAA4B;IAEzC;;;OAGG;gBACS,MAAM,SAAkD;CAIrE;AAED,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,MAAM,MAAgC,EAC3C,SAAS,SAAqC,EAC9C,MAAM,SAAkD,GACvD,oBAAoB,CAEtB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,UAAU,oBAAoB,KAAG,MACrB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM1E;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,oBAAoB,GAC7B,IAAI,CAIN;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAAC,CAAC,EAChD,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,oBAAoB,EAC3B,SAAS,EAAE,MAAM,GAChB,oBAAoB,CAUtB"}

package/dist/cli/doctor-nightly-e2e-guard-deadline.js

@@ -0,0 +1,97 @@
+/**
+ * @file doctor-nightly-e2e-guard-deadline.ts
+ * @description One monotonic deadline shared by guard discovery and proof
+ * @module cli/doctor-nightly-e2e-guard-deadline
+ */
+import { performance } from "node:perf_hooks";
+import { NIGHTLY_GUARD_OPERATION_TIMEOUT_MS } from "./doctor-nightly-e2e-guard-contract.js";
+/** Explicit error used to convert every deadline exhaustion into one finding. */
+export class NightlyGuardDeadlineError extends Error {
+    /** Distinguishes a bounded refusal from arbitrary IO failures. */
+    code = "NIGHTLY_GUARD_DEADLINE";
+    /**
+     * Create the stable operator-facing deadline refusal.
+     * @param reason - Budget whose expiration caused the refusal
+     */
+    constructor(reason = "15 seconds whole-operation deadline exhausted") {
+        super(reason);
+        this.name = "NightlyGuardDeadlineError";
+    }
+}
+/**
+ * Start the deadline before discovery so an expensive scan consumes proof time.
+ * @param now - Injected monotonic clock
+ * @param timeoutMs - Whole-operation budget
+ * @param reason - Exact budget named on expiry
+ * @returns Shared absolute deadline
+ */
+export function createNightlyGuardDeadline(now = () => performance.now(), timeoutMs = NIGHTLY_GUARD_OPERATION_TIMEOUT_MS, reason = "15 seconds whole-operation deadline exhausted") {
+    return { expiresAt: now() + timeoutMs, now, reason };
+}
+/**
+ * Return the non-negative time left in the shared budget.
+ * @param deadline - Shared absolute deadline
+ * @returns Remaining milliseconds, clamped at zero
+ */
+export const nightlyGuardRemaining = (deadline) => Math.max(0, deadline.expiresAt - deadline.now());
+/**
+ * Describe the exact target ceiling without hard-coding the default budget.
+ * @param timeoutMs - Target-specific ceiling in milliseconds
+ * @returns Stable operator-facing deadline reason
+ */
+export function nightlyGuardTargetDeadlineReason(timeoutMs) {
+    const seconds = timeoutMs / 1000;
+    const duration = Number.isInteger(seconds)
+        ? `${seconds} ${seconds === 1 ? "second" : "seconds"}`
+        : `${timeoutMs} milliseconds`;
+    return `${duration} target proof deadline exhausted`;
+}
+/**
+ * Refuse work immediately once the shared deadline has elapsed.
+ * @param deadline - Shared absolute deadline
+ */
+export function assertNightlyGuardDeadline(deadline) {
+    if (nightlyGuardRemaining(deadline) <= 0) {
+        throw new NightlyGuardDeadlineError(deadline.reason);
+    }
+}
+/**
+ * Enforce the remaining wall-clock budget even when an injected collaborator
+ * never resolves. The abandoned operation is read-only and cannot alter the
+ * inspected project after the refusal is returned.
+ * @param deadline - Shared operation deadline
+ * @param operation - Lazy read-only asynchronous work
+ * @returns The operation result before expiry
+ */
+export async function withinNightlyGuardDeadline(deadline, operation) {
+    const remaining = nightlyGuardRemaining(deadline);
+    if (remaining <= 0)
+        throw new NightlyGuardDeadlineError(deadline.reason);
+    return await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new NightlyGuardDeadlineError(deadline.reason)), remaining);
+        operation().then(value => {
+            clearTimeout(timer);
+            resolve(value);
+        }, error => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+/**
+ * Give one target a smaller ceiling without extending the outer deadline.
+ * @param outer - Whole-operation deadline
+ * @param timeoutMs - Target-specific ceiling
+ * @returns Deadline ending at the earlier ceiling
+ */
+export function limitNightlyGuardDeadline(outer, timeoutMs) {
+    const targetExpiresAt = outer.now() + timeoutMs;
+    return {
+        expiresAt: Math.min(outer.expiresAt, targetExpiresAt),
+        now: outer.now,
+        reason: targetExpiresAt < outer.expiresAt
+            ? nightlyGuardTargetDeadlineReason(timeoutMs)
+            : outer.reason,
+    };
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-deadline.js.map

package/dist/cli/doctor-nightly-e2e-guard-deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-deadline.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-deadline.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AAE5F,iFAAiF;AACjF,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,kEAAkE;IACzD,IAAI,GAAG,wBAAwB,CAAC;IAEzC;;;OAGG;IACH,YAAY,MAAM,GAAG,+CAA+C;QAClE,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAoB,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAC3C,SAAS,GAAG,kCAAkC,EAC9C,MAAM,GAAG,+CAA+C;IAExD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAA8B,EAAU,EAAE,CAC9E,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAAC,SAAiB;IAChE,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,GAAG,OAAO,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE;QACtD,CAAC,CAAC,GAAG,SAAS,eAAe,CAAC;IAChC,OAAO,GAAG,QAAQ,kCAAkC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAA8B;IAE9B,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAA8B,EAC9B,SAA2B;IAE3B,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,MAAM,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAC5D,SAAS,CACV,CAAC;QACF,SAAS,EAAE,CAAC,IAAI,CACd,KAAK,CAAC,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,KAAK,CAAC,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAA2B,EAC3B,SAAiB;IAEjB,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAChD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC;QACrD,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,MAAM,EACJ,eAAe,GAAG,KAAK,CAAC,SAAS;YAC/B,CAAC,CAAC,gCAAgC,CAAC,SAAS,CAAC;YAC7C,CAAC,CAAC,KAAK,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC"}