@codyswann/lisa 4.21.4 → 4.21.6

package/dist/cli/doctor-nightly-e2e-guard-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-scan.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACnC,kCAAkC,EAClC,uBAAuB,EAGvB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,CAAC;AAaF,MAAM,WAAW,GAAG,CAClB,QAAgB,EAChB,MAAc,EACU,EAAE,CAAC,CAAC;IAC5B,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CACpB,IAAY,EACZ,IAAY,EACZ,MAAc,EACuC,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,QAAQ;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAChB,IAAI,EACJ,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAClG,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,KAA0D,EACzB,EAAE,CAAC,OAAO,IAAI,KAAK,CAAC;AAEvD,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAW,EAAE,CACrD,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;IAC1B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,SAAS,IAAI,EAAE,IAAI,SAAS,KAAK,GAAG,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,WAAmB,EACnB,QAA8B;IAE9B,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,WAAW,EACX,uBAAuB,EACvB,QAAQ,CACT,CAAC;IACF,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,SAAS,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,uBAAuB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,wBAAwB,CACpC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACvD,CAAC;IACF,IACE,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,EAAE,CACL,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,mCAAmC;QAC7D,mBAAmB,CAAC,IAAI,CAAC,CAC5B,EACD,CAAC;QACD,OAAO,WAAW,CAChB,uBAAuB,EACvB,mCAAmC,mCAAmC,+BAA+B,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC3C,OAAO,WAAW,CAChB,uBAAuB,EACvB,uBAAuB,uBAAuB,WAAW,CAC1D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,EACpB,KAAa,EACb,UAAkB,EAClB,OAA8C,EAG9C,EAAE;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,uBAAuB,IAAI,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACrC,WAAW,EACX,IAAI,EACJ,4BAA4B,EAC5B,QAAQ,CACT,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACjD,IAAI,SAAS,GAAG,6BAA6B,EAAE,CAAC;YAC9C,OAAO,WAAW,CAAC,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,YAAY,CAAC,MAAM,CAAC;YACzB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC;IAEF,OAAO,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,eAA6C,EAAE;IAE/C,MAAM,QAAQ,GACZ,YAAY,CAAC,QAAQ;QACrB,0BAA0B,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3B,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC;QACnC,CAAC,CAAE,OAAkC,CAAC;AAC1C,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @file doctor-nightly-e2e-guard-shell-lexer.ts
+ * @description Bounded comment-aware lexer for the supported guard run grammar
+ * @module cli/doctor-nightly-e2e-guard-shell-lexer
+ */
+/** How a shell word acquired its bytes. */
+type QuoteKind = "unquoted" | "single" | "double" | "mixed";
+/** One decoded shell word retained by the supported grammar. */
+export interface ShellWord {
+    readonly kind: "word";
+    readonly value: string;
+    readonly quote: QuoteKind;
+    /** Shell expansion or unquoted glob syntax prevents exact byte proof. */
+    readonly dynamic: boolean;
+}
+/** One command separator or unsupported shell operator. */
+interface ShellOperator {
+    readonly kind: "operator";
+    readonly value: string;
+}
+/** Bounded lexical token used only by the static interpreter. */
+export type ShellToken = ShellWord | ShellOperator;
+/** Result of lexing one YAML-decoded run scalar. */
+export interface ShellLexResult {
+    readonly tokens?: readonly ShellToken[];
+    readonly reason?: string;
+}
+/**
+ * Lex shell words/operators while applying POSIX comment boundaries.
+ *
+ * `#` begins a comment only outside quotes at the start of a word. The scan is
+ * bounded by the 1 MiB workflow read and a 64-token grammar ceiling.
+ * @param source - YAML-decoded run scalar
+ * @returns Tokens or one fail-closed grammar reason
+ */
+export declare function lexNightlyGuardRun(source: string): ShellLexResult;
+export {};
+//# sourceMappingURL=doctor-nightly-e2e-guard-shell-lexer.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-shell-lexer.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-shell-lexer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,2CAA2C;AAC3C,KAAK,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE5D,gEAAgE;AAChE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,2DAA2D;AAC3D,UAAU,aAAa;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAcnD,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA2KD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAoBjE"}

package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.js

@@ -0,0 +1,160 @@
+/**
+ * @file doctor-nightly-e2e-guard-shell-lexer.ts
+ * @description Bounded comment-aware lexer for the supported guard run grammar
+ * @module cli/doctor-nightly-e2e-guard-shell-lexer
+ */
+const MAX_SHELL_TOKENS = 64;
+const QUOTE_CHARACTERS = ["'", '"'];
+const HORIZONTAL_WHITESPACE = [" ", "\t", "\r"];
+const COMMAND_BOUNDARIES = ["\n", ";"];
+const SHELL_OPERATORS = [">", "<", "&", "|", "(", ")"];
+const quoteFor = (mask) => {
+    if (mask === 2)
+        return "single";
+    if (mask === 4)
+        return "double";
+    if (mask === 0 || mask === 1)
+        return "unquoted";
+    return "mixed";
+};
+const withToken = (state, token) => state.tokens.length >= MAX_SHELL_TOKENS
+    ? {
+        ...state,
+        error: `shell token limit ${MAX_SHELL_TOKENS} exceeded`,
+    }
+    : { ...state, tokens: [...state.tokens, token] };
+const flushWord = (state) => state.word.length === 0
+    ? state
+    : withToken({ ...state, word: "", quoteMask: 0, dynamic: false }, {
+        kind: "word",
+        value: state.word,
+        quote: quoteFor(state.quoteMask),
+        dynamic: state.dynamic,
+    });
+const withOperator = (state, value) => withToken(flushWord(state), { kind: "operator", value });
+const withoutQuote = (state) => ({
+    tokens: state.tokens,
+    word: state.word,
+    quoteMask: state.quoteMask,
+    dynamic: state.dynamic,
+    comment: state.comment,
+    skipNext: state.skipNext,
+    ...(state.error ? { error: state.error } : {}),
+});
+const quotedCharacter = (state, source, character, index) => {
+    if ((character === "'" && state.quote === "single") ||
+        (character === '"' && state.quote === "double")) {
+        return withoutQuote(state);
+    }
+    if (character !== "\\" || state.quote !== "double") {
+        return {
+            ...state,
+            word: `${state.word}${character}`,
+            dynamic: state.dynamic ||
+                (state.quote === "double" && ["$", "`"].includes(character)),
+        };
+    }
+    const next = source[index + 1];
+    if (next === undefined) {
+        return { ...state, error: "unterminated shell escape" };
+    }
+    if (next === "\n")
+        return { ...state, skipNext: true };
+    return ["$", "`", '"', "\\"].includes(next)
+        ? { ...state, word: `${state.word}${next}`, skipNext: true }
+        : { ...state, word: `${state.word}\\` };
+};
+const escapedCharacter = (state, source, index) => {
+    const next = source[index + 1];
+    if (next === undefined) {
+        return { ...state, error: "unterminated shell escape" };
+    }
+    if (next === "\n")
+        return { ...state, skipNext: true };
+    return {
+        ...state,
+        word: `${state.word}${next}`,
+        quoteMask: state.quoteMask | 1,
+        skipNext: true,
+    };
+};
+const quotedStart = (state, character) => {
+    const single = character === "'";
+    return {
+        ...state,
+        quote: single ? "single" : "double",
+        quoteMask: state.quoteMask | (single ? 2 : 4),
+    };
+};
+const ordinaryCharacter = (state, character) => ({
+    ...state,
+    word: `${state.word}${character}`,
+    quoteMask: state.quoteMask | 1,
+    dynamic: state.dynamic || ["$", "`", "*", "?", "[", "~", "{"].includes(character),
+});
+const operatorCharacter = (state, source, character, index) => {
+    const doubled = source[index + 1] === character;
+    return {
+        ...withOperator(state, doubled ? `${character}${character}` : character),
+        skipNext: doubled,
+    };
+};
+const unquotedCharacter = (state, source, character, index) => {
+    if (QUOTE_CHARACTERS.includes(character)) {
+        return quotedStart(state, character);
+    }
+    if (character === "\\")
+        return escapedCharacter(state, source, index);
+    if (character === "#" && state.word.length === 0) {
+        return { ...state, comment: true };
+    }
+    if (HORIZONTAL_WHITESPACE.includes(character))
+        return flushWord(state);
+    if (COMMAND_BOUNDARIES.includes(character)) {
+        return withOperator(state, character);
+    }
+    return SHELL_OPERATORS.includes(character)
+        ? operatorCharacter(state, source, character, index)
+        : ordinaryCharacter(state, character);
+};
+const lexCharacter = (state, source, character, index) => {
+    if (state.error)
+        return state;
+    if (state.skipNext)
+        return { ...state, skipNext: false };
+    if (state.comment) {
+        return character === "\n"
+            ? { ...withOperator(state, "\n"), comment: false }
+            : state;
+    }
+    return state.quote
+        ? quotedCharacter(state, source, character, index)
+        : unquotedCharacter(state, source, character, index);
+};
+/**
+ * Lex shell words/operators while applying POSIX comment boundaries.
+ *
+ * `#` begins a comment only outside quotes at the start of a word. The scan is
+ * bounded by the 1 MiB workflow read and a 64-token grammar ceiling.
+ * @param source - YAML-decoded run scalar
+ * @returns Tokens or one fail-closed grammar reason
+ */
+export function lexNightlyGuardRun(source) {
+    const scanned = source
+        .split("")
+        .reduce((state, character, index) => lexCharacter(state, source, character, index), {
+        tokens: [],
+        word: "",
+        quoteMask: 0,
+        dynamic: false,
+        comment: false,
+        skipNext: false,
+    });
+    const completed = flushWord(scanned);
+    if (completed.error)
+        return { reason: completed.error };
+    return completed.quote
+        ? { reason: "unterminated shell quote" }
+        : { tokens: completed.tokens };
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-shell-lexer.js.map

package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-shell-lexer.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-shell-lexer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACpC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAChD,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACvC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAyCvD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAa,EAAE;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,KAAsB,EACtB,KAAiB,EACA,EAAE,CACnB,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,gBAAgB;IACrC,CAAC,CAAC;QACE,GAAG,KAAK;QACR,KAAK,EAAE,qBAAqB,gBAAgB,WAAW;KACxD;IACH,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;AAErD,MAAM,SAAS,GAAG,CAAC,KAAsB,EAAmB,EAAE,CAC5D,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;IACrB,CAAC,CAAC,KAAK;IACP,CAAC,CAAC,SAAS,CACP,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EACpD;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CACF,CAAC;AAER,MAAM,YAAY,GAAG,CAAC,KAAsB,EAAE,KAAa,EAAmB,EAAE,CAC9E,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAE3D,MAAM,YAAY,GAAG,CAAC,KAAsB,EAAmB,EAAE,CAAC,CAAC;IACjE,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,SAAS,EAAE,KAAK,CAAC,SAAS;IAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CACtB,KAAsB,EACtB,MAAc,EACd,SAAiB,EACjB,KAAa,EACI,EAAE;IACnB,IACE,CAAC,SAAS,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC/C,CAAC,SAAS,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,EAC/C,CAAC;QACD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO;YACL,GAAG,KAAK;YACR,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,SAAS,EAAE;YACjC,OAAO,EACL,KAAK,CAAC,OAAO;gBACb,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;SAC/D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC5D,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,KAAsB,EACtB,MAAc,EACd,KAAa,EACI,EAAE;IACnB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvD,OAAO;QACL,GAAG,KAAK;QACR,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC;QAC9B,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,KAAsB,EACtB,SAAiB,EACA,EAAE;IACnB,MAAM,MAAM,GAAG,SAAS,KAAK,GAAG,CAAC;IACjC,OAAO;QACL,GAAG,KAAK;QACR,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC9C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,KAAsB,EACtB,SAAiB,EACA,EAAE,CAAC,CAAC;IACrB,GAAG,KAAK;IACR,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,SAAS,EAAE;IACjC,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC;IAC9B,OAAO,EACL,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;CAC3E,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CACxB,KAAsB,EACtB,MAAc,EACd,SAAiB,EACjB,KAAa,EACI,EAAE;IACnB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC;IAChD,OAAO;QACL,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,KAAsB,EACtB,MAAc,EACd,SAAiB,EACjB,KAAa,EACI,EAAE;IACnB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,SAAS,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC;QACpD,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,KAAsB,EACtB,MAAc,EACd,SAAiB,EACjB,KAAa,EACI,EAAE;IACnB,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,SAAS,KAAK,IAAI;YACvB,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;YAClD,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,KAAK;QAChB,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC;QAClD,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,OAAO,GAAG,MAAM;SACnB,KAAK,CAAC,EAAE,CAAC;SACT,MAAM,CACL,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAC1B,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAC/C;QACE,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,EAAE;QACR,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK;KAChB,CACF,CAAC;IACJ,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IACxD,OAAO,SAAS,CAAC,KAAK;QACpB,CAAC,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE;QACxC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;AACnC,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-shell.d.ts

@@ -0,0 +1,40 @@
+import { type NightlyGuardCommandFileWrite } from "./doctor-nightly-e2e-guard-command-files.js";
+import { type NightlyGuardRuntimeContext } from "./doctor-nightly-e2e-guard-runtime.js";
+/** Supported interpretation of one `run` scalar. */
+export interface NightlyGuardRunInspection {
+    /** Literal target or an environment-resolution refusal. */
+    readonly target?: string;
+    /** Any Node token whose command did not fit the supported grammar. */
+    readonly reason?: string;
+    /** The command is the non-gating contract/report operation. */
+    readonly reportingOnly: boolean;
+    /** A Node command occurred after comment removal. */
+    readonly containsNode: boolean;
+    /** Executable shell construction of bypass state. */
+    readonly bypassWiring?: "inline environment" | "GITHUB_ENV";
+    /** Comment-stripped executable evidence that this step controls bypass. */
+    readonly bypassEvidence: boolean;
+    /** Ordered command-file effects retained for later guard-step attribution. */
+    readonly commandFileWrites?: readonly NightlyGuardCommandFileWrite[];
+}
+/**
+ * Compare bypass vocabulary independently of label case and punctuation.
+ * @param value - Executable expression or literal environment value
+ * @returns Whether the normalized text can denote nightly bypass state
+ */
+export declare const hasNightlyBypassReference: (value: string) => boolean;
+/**
+ * Match the exact environment names implemented by the shipped guard.
+ * @param value - YAML or shell environment name
+ * @returns Whether the name is part of the bounded-waiver contract
+ */
+export declare const isNightlyBypassEnvironmentName: (value: string) => boolean;
+/**
+ * Interpret the supported Node grammar after bounded comment-aware lexing.
+ * @param run - YAML-decoded shell scalar
+ * @param env - Literal YAML environment levels available to this step
+ * @param context - Runner and effective shell metadata proving POSIX semantics
+ * @returns Static target/reporting/refusal and bypass-wiring evidence
+ */
+export declare function inspectNightlyGuardRun(run: string, env: Readonly<Record<string, string>>, context: NightlyGuardRuntimeContext): NightlyGuardRunInspection;
+//# sourceMappingURL=doctor-nightly-e2e-guard-shell.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-shell.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-shell.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,6CAA6C,CAAC;AAMrD,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,uCAAuC,CAAC;AAc/C,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,GAAG,YAAY,CAAC;IAC5D,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACtE;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,OAAO,MAAM,KAAG,OAiBzD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,GAAI,OAAO,MAAM,KAAG,OACM,CAAC;AAqMtE;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,OAAO,EAAE,0BAA0B,GAClC,yBAAyB,CA6B3B"}

package/dist/cli/doctor-nightly-e2e-guard-shell.js

@@ -0,0 +1,201 @@
+/**
+ * @file doctor-nightly-e2e-guard-shell.ts
+ * @description Static interpreter for the intentionally small guard run grammar
+ * @module cli/doctor-nightly-e2e-guard-shell
+ */
+import { normalizeNightlyGuardTarget } from "./doctor-nightly-e2e-guard-contract.js";
+import { inspectNightlyGuardCommandFileWrites, } from "./doctor-nightly-e2e-guard-command-files.js";
+import { lexNightlyGuardRun, } from "./doctor-nightly-e2e-guard-shell-lexer.js";
+import { isExecutionChangingEnvironmentName, nightlyGuardEnvironmentFailure, nightlyGuardPosixContextFailure, } from "./doctor-nightly-e2e-guard-runtime.js";
+const ENVIRONMENT_NAME = /^[A-Z][A-Z0-9_]*$/u;
+const ENVIRONMENT_TARGET = /^\$(?:\{([A-Z][A-Z0-9_]*)\}|([A-Z][A-Z0-9_]*))$/u;
+const BYPASS_ENVIRONMENT_NAMES = new Set([
+    "GATE_BYPASS",
+    "NIGHTLY_BYPASS",
+    "NIGHTLY_BYPASS_LABEL",
+    "NIGHTLY_BYPASS_MAX_HOURS",
+    "NIGHTLY_BYPASS_REASON_PATTERN",
+]);
+const EXACT_BYPASS_REFERENCE = /(?:^|[^A-Z0-9_])(?:GATE_BYPASS|NIGHTLY_BYPASS)(?=$|[^A-Z0-9_])/iu;
+/**
+ * Compare bypass vocabulary independently of label case and punctuation.
+ * @param value - Executable expression or literal environment value
+ * @returns Whether the normalized text can denote nightly bypass state
+ */
+export const hasNightlyBypassReference = (value) => {
+    const terms = value
+        .toLowerCase()
+        .split(/[^a-z0-9]+/u)
+        .filter(Boolean);
+    const candidates = value
+        .split(/['"`()$,{}[\]]+/u)
+        .map(candidate => candidate.toLowerCase().replace(/[^a-z0-9]/gu, ""));
+    const constructedExpression = /\$\{\{[\s\S]*\}\}/u.test(value) &&
+        ["nightly", "e2e", "bypass"].every(term => terms.includes(term)) &&
+        !terms.includes("cache");
+    return (EXACT_BYPASS_REFERENCE.test(value) ||
+        candidates.includes("nightlye2ebypass") ||
+        constructedExpression);
+};
+/**
+ * Match the exact environment names implemented by the shipped guard.
+ * @param value - YAML or shell environment name
+ * @returns Whether the name is part of the bounded-waiver contract
+ */
+export const isNightlyBypassEnvironmentName = (value) => ENVIRONMENT_NAME.test(value) && BYPASS_ENVIRONMENT_NAMES.has(value);
+const words = (tokens) => tokens.filter((token) => token.kind === "word");
+const actualEnvironmentTarget = (word) => word.quote === "single"
+    ? undefined
+    : ENVIRONMENT_TARGET.exec(word.value)?.[0];
+const environmentName = (word) => {
+    const match = ENVIRONMENT_TARGET.exec(word.value);
+    return match?.[1] ?? match?.[2];
+};
+const targetFromWord = (word, env) => {
+    if (word.quote === "single" && ENVIRONMENT_TARGET.test(word.value)) {
+        return {
+            reason: "single-quoted environment target is a literal shell string and cannot resolve a guard",
+        };
+    }
+    const variable = actualEnvironmentTarget(word);
+    const candidate = variable ? env[environmentName(word) ?? ""] : word.value;
+    if (candidate === undefined) {
+        return {
+            reason: "could not resolve the Node target from one unquoted or double-quoted literal environment level",
+        };
+    }
+    const target = normalizeNightlyGuardTarget(candidate);
+    return target
+        ? { target }
+        : {
+            reason: "Node target must be one literal contained relative ASCII .js/.mjs/.cjs path; expressions, substitutions, absolute/escaping paths, and multiple commands are unsupported",
+        };
+};
+const bypassAssignment = (word) => {
+    const equals = word.value.indexOf("=");
+    if (equals <= 0)
+        return false;
+    const name = word.value.slice(0, equals);
+    return isNightlyBypassEnvironmentName(name);
+};
+const safeEnvironmentFileName = (name) => !isNightlyBypassEnvironmentName(name) &&
+    !hasNightlyBypassReference(name) &&
+    !isExecutionChangingEnvironmentName(name);
+const runMetadata = (tokens) => {
+    const commandWords = words(tokens);
+    const node = commandWords.findIndex(word => word.value === "node");
+    const containsNode = node >= 0;
+    const fileWrites = inspectNightlyGuardCommandFileWrites(tokens, safeEnvironmentFileName);
+    const bypassEvidence = commandWords.some(word => bypassAssignment(word) || hasNightlyBypassReference(word.value));
+    const normalizedRun = commandWords.map(word => word.value).join(" ");
+    const inlineEnvironment = containsNode &&
+        (commandWords.slice(0, node).some(bypassAssignment) ||
+            (commandWords[0]?.value === "env" &&
+                hasNightlyBypassReference(normalizedRun)));
+    const bypassWiring = fileWrites.some(write => write.file === "GITHUB_ENV" && write.safety !== "safe")
+        ? "GITHUB_ENV"
+        : inlineEnvironment
+            ? "inline environment"
+            : undefined;
+    return {
+        commandWords,
+        node,
+        containsNode,
+        bypassEvidence,
+        ...(bypassWiring ? { bypassWiring } : {}),
+        ...(fileWrites.length > 0 ? { commandFileWrites: fileWrites } : {}),
+    };
+};
+const resultBase = (metadata) => ({
+    reportingOnly: false,
+    containsNode: metadata.containsNode,
+    bypassEvidence: metadata.bypassEvidence,
+    ...(metadata.bypassWiring ? { bypassWiring: metadata.bypassWiring } : {}),
+    ...(metadata.commandFileWrites
+        ? { commandFileWrites: metadata.commandFileWrites }
+        : {}),
+});
+const commandGroups = (tokens) => tokens
+    .reduce((groups, token) => {
+    if (token.kind === "operator" &&
+        (token.value === "\n" || token.value === ";")) {
+        return groups.at(-1)?.length === 0 ? groups : [...groups, []];
+    }
+    const prior = groups.slice(0, -1);
+    const last = groups.at(-1) ?? [];
+    return [...prior, [...last, token]];
+}, [[]])
+    .filter(group => group.length > 0);
+const unsupportedCommandShape = (tokens) => tokens.some(token => token.kind === "operator" && token.value !== "\n" && token.value !== ";") || commandGroups(tokens).length !== 1;
+const nodePrefixFailure = (commandWords, node) => {
+    const prefix = commandWords.slice(0, node);
+    if (prefix.length === 0 ||
+        (prefix.length === 1 && prefix[0]?.value === "env")) {
+        return undefined;
+    }
+    const assignments = prefix.filter(word => word.value.includes("="));
+    const dangerous = assignments.find(word => isExecutionChangingEnvironmentName(word.value.slice(0, word.value.indexOf("="))));
+    if (dangerous) {
+        return `${dangerous.value.slice(0, dangerous.value.indexOf("="))} pre-node assignment is unsafe`;
+    }
+    return assignments.length > 0
+        ? "pre-node environment assignments are unsupported because they can change certified handler behavior"
+        : "Node command does not match the supported literal grammar";
+};
+const inspectNodeCommand = (metadata, env, environmentFailure) => {
+    const base = resultBase(metadata);
+    const afterNode = metadata.commandWords.slice(metadata.node + 1);
+    const prefixFailure = nodePrefixFailure(metadata.commandWords, metadata.node);
+    const refusal = environmentFailure ?? prefixFailure;
+    if (refusal || (afterNode.length !== 1 && afterNode.length !== 2)) {
+        return {
+            ...base,
+            reason: refusal ?? "Node command does not match the supported literal grammar",
+        };
+    }
+    const option = afterNode[1]?.value;
+    if (option === "--contract-version" || option === "--report-issues") {
+        return { ...base, reportingOnly: true };
+    }
+    if (afterNode.length !== 1) {
+        return { ...base, reason: "Node target has unsupported arguments" };
+    }
+    return {
+        ...base,
+        ...targetFromWord(afterNode[0], env),
+    };
+};
+/**
+ * Interpret the supported Node grammar after bounded comment-aware lexing.
+ * @param run - YAML-decoded shell scalar
+ * @param env - Literal YAML environment levels available to this step
+ * @param context - Runner and effective shell metadata proving POSIX semantics
+ * @returns Static target/reporting/refusal and bypass-wiring evidence
+ */
+export function inspectNightlyGuardRun(run, env, context) {
+    const lexical = lexNightlyGuardRun(run);
+    if (!lexical.tokens) {
+        return {
+            reportingOnly: false,
+            containsNode: /(?:^|[ \t])node(?:[ \t]|$)/u.test(run),
+            bypassEvidence: hasNightlyBypassReference(run),
+            ...(lexical.reason ? { reason: lexical.reason } : {}),
+        };
+    }
+    const tokens = lexical.tokens;
+    const metadata = runMetadata(tokens);
+    const contextFailure = nightlyGuardPosixContextFailure(run, context);
+    if (contextFailure) {
+        return { ...resultBase(metadata), reason: contextFailure };
+    }
+    if (!metadata.containsNode)
+        return resultBase(metadata);
+    if (unsupportedCommandShape(tokens)) {
+        return {
+            ...resultBase(metadata),
+            reason: "multiple commands, pipelines, and shell operators are unsupported",
+        };
+    }
+    return inspectNodeCommand(metadata, env, nightlyGuardEnvironmentFailure(context.environment));
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-shell.js.map

package/dist/cli/doctor-nightly-e2e-guard-shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-shell.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-shell.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EACL,oCAAoC,GAErC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,kBAAkB,GAGnB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,kCAAkC,EAClC,8BAA8B,EAC9B,+BAA+B,GAEhC,MAAM,uCAAuC,CAAC;AAE/C,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAC9C,MAAM,kBAAkB,GAAG,kDAAkD,CAAC;AAC9E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,aAAa;IACb,gBAAgB;IAChB,sBAAsB;IACtB,0BAA0B;IAC1B,+BAA+B;CAChC,CAAC,CAAC;AACH,MAAM,sBAAsB,GAC1B,kEAAkE,CAAC;AAoBrE;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAa,EAAW,EAAE;IAClE,MAAM,KAAK,GAAG,KAAK;SAChB,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,KAAK;SACrB,KAAK,CAAC,kBAAkB,CAAC;SACzB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,qBAAqB,GACzB,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,CACL,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACvC,qBAAqB,CACtB,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,KAAa,EAAW,EAAE,CACvE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAEtE,MAAM,KAAK,GAAG,CAAC,MAA6B,EAAwB,EAAE,CACpE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAsB,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AAEtE,MAAM,uBAAuB,GAAG,CAAC,IAAe,EAAsB,EAAE,CACtE,IAAI,CAAC,KAAK,KAAK,QAAQ;IACrB,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE/C,MAAM,eAAe,GAAG,CAAC,IAAe,EAAsB,EAAE;IAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,IAAe,EACf,GAAqC,EACmB,EAAE;IAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,MAAM,EACJ,uFAAuF;SAC1F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IAC3E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EACJ,gGAAgG;SACnG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM;QACX,CAAC,CAAC,EAAE,MAAM,EAAE;QACZ,CAAC,CAAC;YACE,MAAM,EACJ,yKAAyK;SAC5K,CAAC;AACR,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,IAAe,EAAW,EAAE;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,8BAA8B,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAW,EAAE,CACxD,CAAC,8BAA8B,CAAC,IAAI,CAAC;IACrC,CAAC,yBAAyB,CAAC,IAAI,CAAC;IAChC,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC;AAY5C,MAAM,WAAW,GAAG,CAAC,MAA6B,EAAe,EAAE;IACjE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,oCAAoC,CACrD,MAAM,EACN,uBAAuB,CACxB,CAAC;IACF,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CACtC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CACxE,CAAC;IACF,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,iBAAiB,GACrB,YAAY;QACZ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACjD,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK;gBAC/B,yBAAyB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAClC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAChE;QACC,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,iBAAiB;YACjB,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,YAAY;QACZ,IAAI;QACJ,YAAY;QACZ,cAAc;QACd,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CACjB,QAAqB,EAQrB,EAAE,CAAC,CAAC;IACJ,aAAa,EAAE,KAAK;IACpB,YAAY,EAAE,QAAQ,CAAC,YAAY;IACnC,cAAc,EAAE,QAAQ,CAAC,cAAc;IACvC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,GAAG,CAAC,QAAQ,CAAC,iBAAiB;QAC5B,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE;QACnD,CAAC,CAAC,EAAE,CAAC;CACR,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CACpB,MAA6B,EACO,EAAE,CACtC,MAAM;KACH,MAAM,CACL,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;IAChB,IACE,KAAK,CAAC,IAAI,KAAK,UAAU;QACzB,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,EAC7C,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC,EACD,CAAC,EAAE,CAAC,CACL;KACA,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAEvC,MAAM,uBAAuB,GAAG,CAAC,MAA6B,EAAW,EAAE,CACzE,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAC3E,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAE1C,MAAM,iBAAiB,GAAG,CACxB,YAAkC,EAClC,IAAY,EACQ,EAAE;IACtB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3C,IACE,MAAM,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC,EACnD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxC,kCAAkC,CAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAC7C,CACF,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,gCAAgC,CAAC;IACnG,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,qGAAqG;QACvG,CAAC,CAAC,2DAA2D,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,QAAqB,EACrB,GAAqC,EACrC,kBAAsC,EACX,EAAE;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,kBAAkB,IAAI,aAAa,CAAC;IACpD,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EACJ,OAAO,IAAI,2DAA2D;SACzE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACnC,IAAI,MAAM,KAAK,oBAAoB,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACtE,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,CAAc,EAAE,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,GAAqC,EACrC,OAAmC;IAEnC,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;YACrD,cAAc,EAAE,yBAAyB,CAAC,GAAG,CAAC;YAC9C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,+BAA+B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,YAAY;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,GAAG,UAAU,CAAC,QAAQ,CAAC;YACvB,MAAM,EACJ,mEAAmE;SACtE,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CACvB,QAAQ,EACR,GAAG,EACH,8BAA8B,CAAC,OAAO,CAAC,WAAW,CAAC,CACpD,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard.d.ts

@@ -0,0 +1,36 @@
+import type { HashLedger } from "../core/lisa-owned-provenance.js";
+import type { DoctorCheck } from "./doctor.js";
+import { type NightlyGuardProbeResult, type NightlyGuardScanResult } from "./doctor-nightly-e2e-guard-contract.js";
+import { proveNightlyE2eGuardTarget, type NightlyGuardBehaviorCertificates, type NightlyGuardProofDependencies } from "./doctor-nightly-e2e-guard-proof.js";
+import { type NightlyGuardScanDependencies } from "./doctor-nightly-e2e-guard-scan.js";
+/** Stable doctor row name shared by human and JSON output. */
+export declare const NIGHTLY_GUARD_CHECK_NAME = "Nightly E2E bypass guard bounded?";
+/** Injected read-only collaborators for deterministic deadline/provenance tests. */
+export interface NightlyGuardDependencies {
+    /** Installed Lisa root, for package-copy remediation classification. */
+    readonly lisaRoot?: string;
+    /** Known shipped hashes, injectable for provenance bite controls. */
+    readonly ledger?: HashLedger;
+    /** Exact behavior certificates, injectable for package fixture tests. */
+    readonly certificates?: NightlyGuardBehaviorCertificates;
+    /** Monotonic clock started before discovery. */
+    readonly now?: () => number;
+    /** Discovery seam used to prove the outer deadline includes scanning. */
+    readonly scanImpl?: (projectRoot: string, dependencies?: NightlyGuardScanDependencies) => Promise<NightlyGuardScanResult>;
+    /** Static target proof seam used to prove target deduplication. */
+    readonly probeImpl?: (projectRoot: string, target: string, dependencies?: NightlyGuardProofDependencies) => Promise<NightlyGuardProbeResult>;
+    /** Target ceiling override used only by deterministic tests. */
+    readonly timeoutMs?: number;
+}
+/**
+ * Report whether every active bypass-bearing nightly caller runs a trusted,
+ * compatible major-1 guard without evaluating any target bytes.
+ * @param projectRoot - Project root to inspect without mutation
+ * @param dependencies - Optional read-only collaborators for tests
+ * @returns Existing `DoctorCheck` shape used by both renderers and exit logic
+ */
+export declare function checkNightlyE2eGuard(projectRoot: string, dependencies?: NightlyGuardDependencies): Promise<DoctorCheck>;
+/** Backward-compatible name for direct callers of the former executable probe. */
+export declare const probeNightlyE2eGuardTarget: typeof proveNightlyE2eGuardTarget;
+export type { NightlyGuardProbeResult } from "./doctor-nightly-e2e-guard-contract.js";
+//# sourceMappingURL=doctor-nightly-e2e-guard.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC5B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EACL,0BAA0B,EAC1B,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EACnC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,oCAAoC,CAAC;AAE5C,8DAA8D;AAC9D,eAAO,MAAM,wBAAwB,sCAAsC,CAAC;AAqB5E,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,YAAY,CAAC,EAAE,gCAAgC,CAAC;IACzD,gDAAgD;IAChD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,4BAA4B,KACxC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrC,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,6BAA6B,KACzC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AA4MD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,wBAA6B,GAC1C,OAAO,CAAC,WAAW,CAAC,CAsBtB;AAED,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,mCAA6B,CAAC;AACrE,YAAY,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC"}