@codyswann/lisa 4.21.5 → 4.21.6

package/dist/cli/doctor-nightly-e2e-guard-evidence.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @file doctor-nightly-e2e-guard-evidence.ts
+ * @description Preclassification evidence pass for one reachable workflow job
+ * @module cli/doctor-nightly-e2e-guard-evidence
+ */
+import { type NightlyGuardWorkflowRecord } from "./doctor-nightly-e2e-guard-contract.js";
+import { type NightlyGuardRunInspection } from "./doctor-nightly-e2e-guard-shell.js";
+/** Evidence gathered before deciding which supported job grammar applies. */
+export interface NightlyGuardJobEvidence {
+    /** YAML-decoded steps retained for per-step environment attribution. */
+    readonly steps: readonly Readonly<Record<string, unknown>>[];
+    /** Comment-stripped POSIX run interpretations for those steps. */
+    readonly analyses: readonly NightlyGuardRunInspection[];
+    /** Workflow/job environment carries recognized bypass semantics. */
+    readonly inheritedEnvironment: boolean;
+    /** At least one step environment carries recognized bypass semantics. */
+    readonly stepEnvironment: boolean;
+    /** Job or step condition carries recognized bypass semantics. */
+    readonly condition: boolean;
+    /** Reusable input mapping carries recognized bypass semantics. */
+    readonly withMapping: boolean;
+    /** Comment-stripped run tokens construct recognized bypass state. */
+    readonly run: boolean;
+    /** At least one supported or refused run contains a Node command. */
+    readonly hasNode: boolean;
+}
+/**
+ * Recognize only operational bypass keys or values with nightly-E2E semantics.
+ * @param levels - YAML mappings at increasing precedence
+ * @returns Whether a mapping participates in this guard's bypass contract
+ */
+export declare const bypassBearingMapping: (...levels: readonly unknown[]) => boolean;
+/**
+ * Conditions are executable evidence only when their value has guard semantics.
+ * @param value - Parsed job/step `if` value
+ * @returns Whether the condition can participate in nightly bypass behavior
+ */
+export declare const conditionalBypass: (value: unknown) => boolean;
+/**
+ * Inspect all executable fields before official/local/direct classification.
+ * @param workflow - Parsed owner of the job and workflow defaults
+ * @param job - Parsed job mapping with runner and step metadata
+ * @returns Evidence shared by every classification branch
+ */
+export declare const inspectNightlyGuardJobEvidence: (workflow: NightlyGuardWorkflowRecord, job: Readonly<Record<string, unknown>>) => NightlyGuardJobEvidence;
+/**
+ * Collapse evidence only after every executable field has been inspected.
+ * @param evidence - Complete preclassification evidence record
+ * @returns Whether any field places the job in the nightly bypass contract
+ */
+export declare const hasAnyNightlyGuardBypassEvidence: (evidence: NightlyGuardJobEvidence) => boolean;
+//# sourceMappingURL=doctor-nightly-e2e-guard-evidence.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-evidence.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,qCAAqC,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC7D,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,oEAAoE;IACpE,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAmBD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,GAAG,QAAQ,SAAS,OAAO,EAAE,KAAG,OAOlE,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,OACY,CAAC;AAYhE;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GACzC,UAAU,0BAA0B,EACpC,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KACrC,uBAmCF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,GAC3C,UAAU,uBAAuB,KAChC,OAKW,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-evidence.js

@@ -0,0 +1,68 @@
+/**
+ * @file doctor-nightly-e2e-guard-evidence.ts
+ * @description Preclassification evidence pass for one reachable workflow job
+ * @module cli/doctor-nightly-e2e-guard-evidence
+ */
+import { nightlyGuardObject, nightlyGuardText, } from "./doctor-nightly-e2e-guard-contract.js";
+import { hasNightlyBypassReference, inspectNightlyGuardRun, isNightlyBypassEnvironmentName, } from "./doctor-nightly-e2e-guard-shell.js";
+const mergedEnvironment = (...levels) => Object.assign({}, ...levels.map(level => nightlyGuardObject(level) ?? {}));
+const literalEnvironment = (environment) => Object.fromEntries(Object.entries(environment).filter((entry) => typeof entry[1] === "string"));
+const bypassKey = (key) => isNightlyBypassEnvironmentName(key) || hasNightlyBypassReference(key);
+/**
+ * Recognize only operational bypass keys or values with nightly-E2E semantics.
+ * @param levels - YAML mappings at increasing precedence
+ * @returns Whether a mapping participates in this guard's bypass contract
+ */
+export const bypassBearingMapping = (...levels) => levels.some(level => Object.entries(nightlyGuardObject(level) ?? {}).some(([key, value]) => bypassKey(key) ||
+    (typeof value === "string" && hasNightlyBypassReference(value))));
+/**
+ * Conditions are executable evidence only when their value has guard semantics.
+ * @param value - Parsed job/step `if` value
+ * @returns Whether the condition can participate in nightly bypass behavior
+ */
+export const conditionalBypass = (value) => typeof value === "string" && hasNightlyBypassReference(value);
+const workflowShell = (workflow) => nightlyGuardObject(nightlyGuardObject(workflow.document.defaults)?.run)
+    ?.shell;
+const jobShell = (job) => nightlyGuardObject(nightlyGuardObject(job.defaults)?.run)?.shell;
+const firstDefined = (...values) => values.find(value => value !== undefined);
+/**
+ * Inspect all executable fields before official/local/direct classification.
+ * @param workflow - Parsed owner of the job and workflow defaults
+ * @param job - Parsed job mapping with runner and step metadata
+ * @returns Evidence shared by every classification branch
+ */
+export const inspectNightlyGuardJobEvidence = (workflow, job) => {
+    const rawSteps = Array.isArray(job.steps) ? job.steps : [];
+    const steps = rawSteps.map(step => nightlyGuardObject(step) ?? {});
+    const inheritedEnvironment = bypassBearingMapping(workflow.document.env, job.env);
+    const analyses = steps.map(step => {
+        const environment = mergedEnvironment(workflow.document.env, job.env, step.env);
+        return inspectNightlyGuardRun(nightlyGuardText(step.run), literalEnvironment(environment), {
+            shell: firstDefined(step.shell, jobShell(job), workflowShell(workflow)),
+            runsOn: job["runs-on"],
+            environment,
+        });
+    });
+    return {
+        steps,
+        analyses,
+        inheritedEnvironment,
+        stepEnvironment: steps.some(step => bypassBearingMapping(step.env)),
+        condition: conditionalBypass(job.if) ||
+            steps.some(step => conditionalBypass(step.if)),
+        withMapping: bypassBearingMapping(job.with),
+        run: analyses.some(analysis => analysis.bypassEvidence),
+        hasNode: analyses.some(analysis => analysis.containsNode),
+    };
+};
+/**
+ * Collapse evidence only after every executable field has been inspected.
+ * @param evidence - Complete preclassification evidence record
+ * @returns Whether any field places the job in the nightly bypass contract
+ */
+export const hasAnyNightlyGuardBypassEvidence = (evidence) => evidence.inheritedEnvironment ||
+    evidence.stepEnvironment ||
+    evidence.condition ||
+    evidence.withMapping ||
+    evidence.run;
+//# sourceMappingURL=doctor-nightly-e2e-guard-evidence.js.map

package/dist/cli/doctor-nightly-e2e-guard-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-evidence.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAEL,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,8BAA8B,GAE/B,MAAM,qCAAqC,CAAC;AAsB7C,MAAM,iBAAiB,GAAG,CACxB,GAAG,MAA0B,EACM,EAAE,CACrC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAE7E,MAAM,kBAAkB,GAAG,CACzB,WAA8C,EACZ,EAAE,CACpC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAChC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CACnE,CACF,CAAC;AAEJ,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE,CACzC,8BAA8B,CAAC,GAAG,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,MAA0B,EAAW,EAAE,CAC7E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAClB,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAClD,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,SAAS,CAAC,GAAG,CAAC;IACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAClE,CACF,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAW,EAAE,CAC3D,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC;AAEhE,MAAM,aAAa,GAAG,CAAC,QAAoC,EAAW,EAAE,CACtE,kBAAkB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC;IACrE,EAAE,KAAK,CAAC;AAEZ,MAAM,QAAQ,GAAG,CAAC,GAAsC,EAAW,EAAE,CACnE,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC;AAEnE,MAAM,YAAY,GAAG,CAAC,GAAG,MAA0B,EAAW,EAAE,CAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,QAAoC,EACpC,GAAsC,EACb,EAAE;IAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,oBAAoB,CAC/C,QAAQ,CAAC,QAAQ,CAAC,GAAG,EACrB,GAAG,CAAC,GAAG,CACR,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAChC,MAAM,WAAW,GAAG,iBAAiB,CACnC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EACrB,GAAG,CAAC,GAAG,EACP,IAAI,CAAC,GAAG,CACT,CAAC;QACF,OAAO,sBAAsB,CAC3B,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAC1B,kBAAkB,CAAC,WAAW,CAAC,EAC/B;YACE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;YACvE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC;YACtB,WAAW;SACZ,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,QAAQ;QACR,oBAAoB;QACpB,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,SAAS,EACP,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC3C,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;KAC1D,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,QAAiC,EACxB,EAAE,CACX,QAAQ,CAAC,oBAAoB;IAC7B,QAAQ,CAAC,eAAe;IACxB,QAAQ,CAAC,SAAS;IAClB,QAAQ,CAAC,WAAW;IACpB,QAAQ,CAAC,GAAG,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-graph.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @file doctor-nightly-e2e-guard-graph.ts
+ * @description Root-preserving traversal of reachable local reusable workflows
+ * @module cli/doctor-nightly-e2e-guard-graph
+ */
+import { type NightlyGuardScanResult, type NightlyGuardWorkflowRecord } from "./doctor-nightly-e2e-guard-contract.js";
+/**
+ * Traverse each root independently so shared reusables retain every active
+ * root-to-job attribution while static target proof remains deduplicated.
+ * @param records - Parsed bounded workflow inventory
+ * @returns Deterministic active callers or the first graph refusal
+ */
+export declare function traceNightlyGuardCallers(records: readonly NightlyGuardWorkflowRecord[]): NightlyGuardScanResult;
+//# sourceMappingURL=doctor-nightly-e2e-guard-graph.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-graph.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-graph.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAKhC,MAAM,wCAAwC,CAAC;AA2KhD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,SAAS,0BAA0B,EAAE,GAC7C,sBAAsB,CA2BxB"}

package/dist/cli/doctor-nightly-e2e-guard-graph.js

@@ -0,0 +1,130 @@
+/**
+ * @file doctor-nightly-e2e-guard-graph.ts
+ * @description Root-preserving traversal of reachable local reusable workflows
+ * @module cli/doctor-nightly-e2e-guard-graph
+ */
+import { MAX_NIGHTLY_GUARD_ATTRIBUTION_BYTES, MAX_NIGHTLY_GUARD_CALLERS, MAX_NIGHTLY_GUARD_JOB_ID_BYTES, MAX_NIGHTLY_GUARD_LOCAL_DEPTH, MAX_NIGHTLY_GUARD_TARGETS, NIGHTLY_GUARD_WORKFLOWS, isNightlyGuardJobId, nightlyGuardCallerAttributionBytes, nightlyGuardObject, orderNightlyGuardStrings, } from "./doctor-nightly-e2e-guard-contract.js";
+import { inspectNightlyGuardJob } from "./doctor-nightly-e2e-guard-job.js";
+const failure = (workflow, reason) => ({ failure: { workflow: workflow.file, reason } });
+const isFailure = (result) => "failure" in result;
+const triggerNames = (value) => {
+    if (typeof value === "string")
+        return [value];
+    if (Array.isArray(value)) {
+        return value.filter(item => typeof item === "string");
+    }
+    return Object.keys(nightlyGuardObject(value) ?? {});
+};
+const isRoot = (record) => triggerNames(record.document.on).some(event => event !== "workflow_call");
+const pathPart = (workflow, jobId) => `${workflow.file}#${jobId}`;
+const validateBounds = (workflow, callers) => {
+    if (callers.length > MAX_NIGHTLY_GUARD_CALLERS) {
+        return failure(workflow, `bypass caller limit ${MAX_NIGHTLY_GUARD_CALLERS} exceeded`);
+    }
+    const targets = new Set(callers.map(caller => caller.target));
+    if (targets.size > MAX_NIGHTLY_GUARD_TARGETS) {
+        return failure(workflow, `guard target limit ${MAX_NIGHTLY_GUARD_TARGETS} exceeded`);
+    }
+    const attributionBytes = callers.reduce((total, caller) => total + nightlyGuardCallerAttributionBytes(caller), 0);
+    return attributionBytes > MAX_NIGHTLY_GUARD_ATTRIBUTION_BYTES
+        ? {
+            failure: {
+                workflow: NIGHTLY_GUARD_WORKFLOWS,
+                reason: `caller attribution exceeds the ${MAX_NIGHTLY_GUARD_ATTRIBUTION_BYTES}-byte limit`,
+            },
+        }
+        : { callers };
+};
+const callerFor = (workflow, jobId, context, caller) => ({
+    workflow: workflow.file,
+    job: jobId,
+    callPath: [...context.parents, pathPart(workflow, jobId)].join(" -> "),
+    kind: caller.kind,
+    target: caller.target,
+});
+const childContext = (workflow, jobId, context) => ({
+    depth: context.depth + 1,
+    stack: [...context.stack, workflow.name],
+    parents: [...context.parents, pathPart(workflow, jobId)],
+});
+/**
+ * Traverse one workflow and every local edge below it.
+ * @param workflow - Current parsed workflow
+ * @param byName - Bounded inventory keyed by basename
+ * @param context - Root-path recursion state
+ * @returns Callers below this workflow or an explicit graph refusal
+ */
+const walkWorkflow = (workflow, byName, context) => {
+    if (context.stack.includes(workflow.name)) {
+        return failure(workflow, `reachable local workflow cycle: ${[...context.stack, workflow.name].join(" -> ")}`);
+    }
+    const jobs = nightlyGuardObject(workflow.document.jobs) ?? {};
+    const jobIds = orderNightlyGuardStrings(Object.keys(jobs));
+    const walkJobs = (index, accumulated) => {
+        const jobId = jobIds[index];
+        if (jobId === undefined)
+            return validateBounds(workflow, accumulated);
+        if (!isNightlyGuardJobId(jobId)) {
+            return failure(workflow, `job identifier exceeds the ${MAX_NIGHTLY_GUARD_JOB_ID_BYTES}-byte GitHub identifier limit or uses unsupported characters`);
+        }
+        const job = nightlyGuardObject(jobs[jobId]);
+        if (!job)
+            return walkJobs(index + 1, accumulated);
+        const inspection = inspectNightlyGuardJob(workflow, jobId, job);
+        if (inspection.failure)
+            return { failure: inspection.failure };
+        const own = inspection.caller
+            ? [callerFor(workflow, jobId, context, inspection.caller)]
+            : [];
+        if (!inspection.local)
+            return walkJobs(index + 1, [...accumulated, ...own]);
+        const child = byName.get(inspection.local);
+        if (!child) {
+            return failure(workflow, `${jobId}: local reusable ${inspection.local} is missing or unresolved`);
+        }
+        if (context.depth >= MAX_NIGHTLY_GUARD_LOCAL_DEPTH) {
+            return failure(workflow, `reachable local workflow depth exceeds ${MAX_NIGHTLY_GUARD_LOCAL_DEPTH}`);
+        }
+        const nested = walkWorkflow(child, byName, childContext(workflow, jobId, context));
+        return isFailure(nested)
+            ? nested
+            : walkJobs(index + 1, [...accumulated, ...own, ...nested.callers]);
+    };
+    return walkJobs(0, []);
+};
+/**
+ * Traverse each root independently so shared reusables retain every active
+ * root-to-job attribution while static target proof remains deduplicated.
+ * @param records - Parsed bounded workflow inventory
+ * @returns Deterministic active callers or the first graph refusal
+ */
+export function traceNightlyGuardCallers(records) {
+    const byName = new Map(records.map(record => [record.name, record]));
+    const roots = records.filter(isRoot);
+    const walkRoots = (index, accumulated) => {
+        const root = roots[index];
+        if (root === undefined)
+            return validateBounds(records[0] ?? emptyRecord, accumulated);
+        const result = walkWorkflow(root, byName, {
+            depth: 0,
+            stack: [],
+            parents: [],
+        });
+        return isFailure(result)
+            ? result
+            : walkRoots(index + 1, [...accumulated, ...result.callers]);
+    };
+    const result = walkRoots(0, []);
+    if (isFailure(result)) {
+        return { state: "unavailable", failures: [result.failure] };
+    }
+    const callers = [...result.callers].sort((left, right) => left.callPath < right.callPath ? -1 : left.callPath > right.callPath ? 1 : 0);
+    return { state: "ok", callers };
+}
+/** Synthetic owner for bounds when an inventory contains no records. */
+const emptyRecord = {
+    file: ".github/workflows",
+    name: "",
+    document: {},
+};
+//# sourceMappingURL=doctor-nightly-e2e-guard-graph.js.map

package/dist/cli/doctor-nightly-e2e-guard-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-graph.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-graph.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,mCAAmC,EACnC,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,yBAAyB,EACzB,uBAAuB,EAKvB,mBAAmB,EACnB,kCAAkC,EAClC,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAuB3E,MAAM,OAAO,GAAG,CACd,QAAoC,EACpC,MAAc,EACG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAEzE,MAAM,SAAS,GAAG,CAChB,MAAuB,EACkC,EAAE,CAC3D,SAAS,IAAI,MAAM,CAAC;AAEtB,MAAM,YAAY,GAAG,CAAC,KAAc,EAAqB,EAAE;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,MAAkC,EAAW,EAAE,CAC7D,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC;AAE5E,MAAM,QAAQ,GAAG,CACf,QAAoC,EACpC,KAAa,EACL,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;AAEzC,MAAM,cAAc,GAAG,CACrB,QAAoC,EACpC,OAAsC,EACrB,EAAE;IACnB,IAAI,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAC/C,OAAO,OAAO,CACZ,QAAQ,EACR,uBAAuB,yBAAyB,WAAW,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;QAC7C,OAAO,OAAO,CACZ,QAAQ,EACR,sBAAsB,yBAAyB,WAAW,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,kCAAkC,CAAC,MAAM,CAAC,EACrE,CAAC,CACF,CAAC;IACF,OAAO,gBAAgB,GAAG,mCAAmC;QAC3D,CAAC,CAAC;YACE,OAAO,EAAE;gBACP,QAAQ,EAAE,uBAAuB;gBACjC,MAAM,EAAE,kCAAkC,mCAAmC,aAAa;aAC3F;SACF;QACH,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,QAAoC,EACpC,KAAa,EACb,OAAyB,EACzB,MAAwE,EACpD,EAAE,CAAC,CAAC;IACxB,QAAQ,EAAE,QAAQ,CAAC,IAAI;IACvB,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IACtE,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CACnB,QAAoC,EACpC,KAAa,EACb,OAAyB,EACP,EAAE,CAAC,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC;IACxB,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;IACxC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;CACzD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CACnB,QAAoC,EACpC,MAAuD,EACvD,OAAyB,EACR,EAAE;IACnB,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO,OAAO,CACZ,QAAQ,EACR,mCAAmC,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,CACf,KAAa,EACb,WAA0C,EACzB,EAAE;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACtE,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CACZ,QAAQ,EACR,8BAA8B,8BAA8B,8DAA8D,CAC3H,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM;YAC3B,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CACZ,QAAQ,EACR,GAAG,KAAK,oBAAoB,UAAU,CAAC,KAAK,2BAA2B,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,IAAI,6BAA6B,EAAE,CAAC;YACnD,OAAO,OAAO,CACZ,QAAQ,EACR,0CAA0C,6BAA6B,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,MAAM,EACN,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CACvC,CAAC;QACF,OAAO,SAAS,CAAC,MAAM,CAAC;YACtB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;IAEF,OAAO,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA8C;IAE9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,CAChB,KAAa,EACb,WAA0C,EACzB,EAAE;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS;YACpB,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE;YACxC,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC;YACtB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACvD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC7E,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,MAAM,WAAW,GAA+B;IAC9C,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,EAAE;CACb,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-io.d.ts

@@ -0,0 +1,41 @@
+import { type NightlyGuardDeadline } from "./doctor-nightly-e2e-guard-deadline.js";
+/** Successful bytes or the precise availability class of a safe read. */
+export type NightlyGuardReadResult = {
+    readonly state: "ok";
+    readonly bytes: Buffer;
+} | {
+    readonly state: "missing";
+    readonly reason: string;
+} | {
+    readonly state: "unavailable";
+    readonly reason: string;
+};
+/** Deterministic directory entries or an explicit availability refusal. */
+export type NightlyGuardDirectoryResult = {
+    readonly state: "ok";
+    readonly names: readonly string[];
+} | {
+    readonly state: "missing";
+    readonly reason: string;
+} | {
+    readonly state: "unavailable";
+    readonly reason: string;
+};
+/**
+ * Read one regular file without following any path component.
+ * @param projectRoot - Containment root
+ * @param relativePath - Project-relative path
+ * @param maxBytes - Hard byte ceiling
+ * @param deadline - Shared deadline
+ * @returns Bounded bytes or a precise availability class
+ */
+export declare function readNightlyGuardFile(projectRoot: string, relativePath: string, maxBytes: number, deadline: NightlyGuardDeadline): Promise<NightlyGuardReadResult>;
+/**
+ * List a directory only when every component and its identity remain safe.
+ * @param projectRoot - Containment root
+ * @param relativePath - Project-relative directory
+ * @param deadline - Shared deadline
+ * @returns Directory entries or an availability refusal
+ */
+export declare function readNightlyGuardDirectory(projectRoot: string, relativePath: string, deadline: NightlyGuardDeadline): Promise<NightlyGuardDirectoryResult>;
+//# sourceMappingURL=doctor-nightly-e2e-guard-io.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-io.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-io.ts"],"names":[],"mappings":"AASA,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,wCAAwC,CAAC;AAEhD,yEAAyE;AACzE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,MAAM,2BAA2B,GACnC;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwM/D;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CA6DjC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,2BAA2B,CAAC,CA+BtC"}

package/dist/cli/doctor-nightly-e2e-guard-io.js

@@ -0,0 +1,239 @@
+/**
+ * @file doctor-nightly-e2e-guard-io.ts
+ * @description Bounded no-follow reads for hostile workflow and target paths
+ * @module cli/doctor-nightly-e2e-guard-io
+ */
+import { constants } from "node:fs";
+import { lstat, open, readdir, realpath } from "node:fs/promises";
+import * as path from "node:path";
+import { NightlyGuardDeadlineError, nightlyGuardRemaining, withinNightlyGuardDeadline, } from "./doctor-nightly-e2e-guard-deadline.js";
+const errorCode = (error) => error.code;
+const displayError = (error) => error instanceof Error ? error.message : String(error);
+const rethrowDeadline = (error) => {
+    if (error instanceof NightlyGuardDeadlineError)
+        throw error;
+};
+const identity = (stats) => ({
+    device: stats.dev,
+    inode: stats.ino,
+});
+const sameIdentity = (left, right) => left.device === right.device && left.inode === right.inode;
+const byteLimit = (bytes) => bytes === 1024 * 1024 ? "1 MiB" : `${bytes} byte`;
+const safeParts = (relativePath) => {
+    if (path.isAbsolute(relativePath))
+        return undefined;
+    const parts = relativePath.split(/[\\/]/u);
+    return parts.length > 0 &&
+        parts.every(part => part !== "" && part !== "." && part !== "..")
+        ? parts
+        : undefined;
+};
+const unavailable = (reason) => ({
+    state: "unavailable",
+    reason,
+});
+/**
+ * Walk every project-relative component with lstat, rejecting symlinks before
+ * any directory or file operation can follow them.
+ * @param projectRoot - Logical project containment root
+ * @param relativePath - Validated relative path
+ * @param deadline - Shared whole-operation deadline
+ * @returns Final component identity or an exact refusal
+ */
+async function inspectComponents(projectRoot, relativePath, deadline) {
+    const parts = safeParts(relativePath);
+    if (!parts)
+        return unavailable("path escapes the project root");
+    const inspect = async (index) => {
+        const current = path.join(projectRoot, ...parts.slice(0, index + 1));
+        if (nightlyGuardRemaining(deadline) <= 0) {
+            throw new NightlyGuardDeadlineError(deadline.reason);
+        }
+        const inspected = await withinNightlyGuardDeadline(deadline, () => lstat(current)).catch(error => {
+            rethrowDeadline(error);
+            const code = errorCode(error);
+            return code === "ENOENT"
+                ? { state: "missing", reason: `${relativePath} is missing` }
+                : unavailable(`${relativePath} is unreadable (${code ?? displayError(error)})`);
+        });
+        if ("state" in inspected)
+            return inspected;
+        const stats = inspected;
+        if (stats.isSymbolicLink()) {
+            return unavailable(`${parts.slice(0, index + 1).join("/")} is a symlink`);
+        }
+        if (index < parts.length - 1 && !stats.isDirectory()) {
+            return unavailable(`${parts.slice(0, index + 1).join("/")} is not a directory`);
+        }
+        return index === parts.length - 1
+            ? { state: "ok", final: stats }
+            : await inspect(index + 1);
+    };
+    return await inspect(0);
+}
+const isContained = (root, target) => {
+    const relative = path.relative(root, target);
+    return (relative !== "" &&
+        relative !== ".." &&
+        !relative.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(relative));
+};
+/**
+ * Verify the opened inode is still the contained, non-symlink path immediately
+ * before its bytes become proof evidence.
+ * @param projectRoot - Logical containment root
+ * @param relativePath - Path whose components are rechecked
+ * @param opened - Inode identity captured from the file descriptor
+ * @param deadline - Shared deadline
+ * @returns Reverified component result
+ */
+async function verifyIdentity(projectRoot, relativePath, opened, deadline) {
+    const inspected = await inspectComponents(projectRoot, relativePath, deadline);
+    if (inspected.state !== "ok")
+        return inspected;
+    if (!sameIdentity(opened, identity(inspected.final))) {
+        return unavailable(`${relativePath} changed identity while it was read`);
+    }
+    try {
+        const [physicalRoot, physicalTarget] = await withinNightlyGuardDeadline(deadline, () => Promise.all([
+            realpath(projectRoot),
+            realpath(path.join(projectRoot, relativePath)),
+        ]));
+        return isContained(physicalRoot, physicalTarget)
+            ? inspected
+            : unavailable(`${relativePath} is not contained by the project root`);
+    }
+    catch (error) {
+        rethrowDeadline(error);
+        return unavailable(`${relativePath} containment is unreadable (${errorCode(error) ?? displayError(error)})`);
+    }
+}
+/**
+ * Read at most `maxBytes + 1` through an already no-follow file descriptor.
+ * @param handle - Open no-follow file descriptor
+ * @param maxBytes - Hard content ceiling
+ * @param deadline - Shared deadline
+ * @returns Bounded bytes, including one overflow sentinel byte when present
+ */
+async function readBounded(handle, maxBytes, deadline) {
+    const buffer = Buffer.alloc(maxBytes + 1);
+    const readAt = async (offset) => {
+        if (offset >= buffer.length)
+            return offset;
+        if (nightlyGuardRemaining(deadline) <= 0) {
+            throw new NightlyGuardDeadlineError(deadline.reason);
+        }
+        const { bytesRead } = await withinNightlyGuardDeadline(deadline, () => handle.read(buffer, offset, buffer.length - offset, offset));
+        return bytesRead === 0 ? offset : await readAt(offset + bytesRead);
+    };
+    const used = await readAt(0);
+    return buffer.subarray(0, used);
+}
+const openNightlyGuardFile = async (projectRoot, relativePath, deadline) => await withinNightlyGuardDeadline(deadline, () => open(path.join(projectRoot, relativePath), constants.O_RDONLY | constants.O_NOFOLLOW)).then(handle => ({ state: "ok", handle }), error => {
+    rethrowDeadline(error);
+    const code = errorCode(error);
+    return code === "ENOENT"
+        ? { state: "missing", reason: `${relativePath} is missing` }
+        : {
+            state: "unavailable",
+            reason: `${relativePath} is unreadable (${code ?? displayError(error)})`,
+        };
+});
+/**
+ * Read one regular file without following any path component.
+ * @param projectRoot - Containment root
+ * @param relativePath - Project-relative path
+ * @param maxBytes - Hard byte ceiling
+ * @param deadline - Shared deadline
+ * @returns Bounded bytes or a precise availability class
+ */
+export async function readNightlyGuardFile(projectRoot, relativePath, maxBytes, deadline) {
+    const inspected = await inspectComponents(projectRoot, relativePath, deadline);
+    if (inspected.state !== "ok")
+        return inspected;
+    if (!inspected.final.isFile()) {
+        return {
+            state: "unavailable",
+            reason: `${relativePath} is not a regular file`,
+        };
+    }
+    if (inspected.final.size > maxBytes) {
+        return {
+            state: "unavailable",
+            reason: `${relativePath} exceeds the ${byteLimit(maxBytes)} file limit`,
+        };
+    }
+    const opened = await openNightlyGuardFile(projectRoot, relativePath, deadline);
+    if (opened.state !== "ok")
+        return opened;
+    const handle = opened.handle;
+    try {
+        const stats = await withinNightlyGuardDeadline(deadline, () => handle.stat());
+        if (!stats.isFile()) {
+            return {
+                state: "unavailable",
+                reason: `${relativePath} is not a regular file`,
+            };
+        }
+        const bytes = await readBounded(handle, maxBytes, deadline);
+        if (bytes.length > maxBytes) {
+            return {
+                state: "unavailable",
+                reason: `${relativePath} exceeds the ${byteLimit(maxBytes)} file limit`,
+            };
+        }
+        const verified = await verifyIdentity(projectRoot, relativePath, identity(stats), deadline);
+        return verified.state === "ok" ? { state: "ok", bytes } : verified;
+    }
+    catch (error) {
+        rethrowDeadline(error);
+        return {
+            state: "unavailable",
+            reason: `${relativePath} is unreadable (${errorCode(error) ?? displayError(error)})`,
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * List a directory only when every component and its identity remain safe.
+ * @param projectRoot - Containment root
+ * @param relativePath - Project-relative directory
+ * @param deadline - Shared deadline
+ * @returns Directory entries or an availability refusal
+ */
+export async function readNightlyGuardDirectory(projectRoot, relativePath, deadline) {
+    const before = await inspectComponents(projectRoot, relativePath, deadline);
+    if (before.state !== "ok")
+        return before;
+    if (!before.final.isDirectory()) {
+        return {
+            state: "unavailable",
+            reason: `${relativePath} is not a directory`,
+        };
+    }
+    try {
+        const names = await withinNightlyGuardDeadline(deadline, () => readdir(path.join(projectRoot, relativePath)));
+        const after = await inspectComponents(projectRoot, relativePath, deadline);
+        if (after.state !== "ok")
+            return after;
+        return sameIdentity(identity(before.final), identity(after.final))
+            ? { state: "ok", names }
+            : {
+                state: "unavailable",
+                reason: `${relativePath} changed identity while it was listed`,
+            };
+    }
+    catch (error) {
+        rethrowDeadline(error);
+        const code = errorCode(error);
+        return code === "ENOENT"
+            ? { state: "missing", reason: `${relativePath} is missing` }
+            : {
+                state: "unavailable",
+                reason: `${relativePath} is unreadable (${code ?? displayError(error)})`,
+            };
+    }
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-io.js.map

package/dist/cli/doctor-nightly-e2e-guard-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-io.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EAErB,0BAA0B,GAC3B,MAAM,wCAAwC,CAAC;AA0BhD,MAAM,SAAS,GAAG,CAAC,KAAc,EAAsB,EAAE,CACtD,KAA+B,CAAC,IAAI,CAAC;AACxC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE,CAC9C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,MAAM,eAAe,GAAG,CAAC,KAAc,EAAQ,EAAE;IAC/C,IAAI,KAAK,YAAY,yBAAyB;QAAE,MAAM,KAAK,CAAC;AAC9D,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,KAAY,EAAgB,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,KAAK,CAAC,GAAG;IACjB,KAAK,EAAE,KAAK,CAAC,GAAG;CACjB,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAE,KAAmB,EAAW,EAAE,CACxE,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;AAC7D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAC1C,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC;AAEpD,MAAM,SAAS,GAAG,CAAC,YAAoB,EAAiC,EAAE;IACxE,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QACrB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAmB,EAAE,CAAC,CAAC;IACxD,KAAK,EAAE,aAAa;IACpB,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAC9B,WAAmB,EACnB,YAAoB,EACpB,QAA8B;IAE9B,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEhE,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAA4B,EAAE;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,SAAS,GAA4B,MAAM,0BAA0B,CACzE,QAAQ,EACR,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CACrB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YACd,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,IAAI,KAAK,QAAQ;gBACtB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,aAAa,EAAE;gBAC5D,CAAC,CAAC,WAAW,CACT,GAAG,YAAY,mBAAmB,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CACjE,CAAC;QACR,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,KAAK,GAAG,SAAS,CAAC;QACxB,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,OAAO,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACrD,OAAO,WAAW,CAChB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;YAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,OAAO,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,MAAc,EAAW,EAAE;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,QAAQ,KAAK,IAAI;QACjB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC3B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAC3B,WAAmB,EACnB,YAAoB,EACpB,MAAoB,EACpB,QAA8B;IAE9B,MAAM,SAAS,GAAG,MAAM,iBAAiB,CACvC,WAAW,EACX,YAAY,EACZ,QAAQ,CACT,CAAC;IACF,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,WAAW,CAAC,GAAG,YAAY,qCAAqC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,GAAG,MAAM,0BAA0B,CACrE,QAAQ,EACR,GAAG,EAAE,CACH,OAAO,CAAC,GAAG,CAAC;YACV,QAAQ,CAAC,WAAW,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;SAC/C,CAAC,CACL,CAAC;QACF,OAAO,WAAW,CAAC,YAAY,EAAE,cAAc,CAAC;YAC9C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,GAAG,YAAY,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,WAAW,CAChB,GAAG,YAAY,+BAA+B,SAAS,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CACxB,MAAwC,EACxC,QAAgB,EAChB,QAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;QACvD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAC3C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,CACpE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAC5D,CAAC;QACF,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrE,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,oBAAoB,GAAG,KAAK,EAChC,WAAmB,EACnB,YAAoB,EACpB,QAA8B,EAC9B,EAAE,CACF,MAAM,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC9C,IAAI,CACF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EACpC,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAC1C,CACF,CAAC,IAAI,CACJ,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAa,EAAE,MAAM,EAAE,CAAC,EAC5C,KAAK,CAAC,EAAE;IACN,eAAe,CAAC,KAAK,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAkB,EAAE,MAAM,EAAE,GAAG,YAAY,aAAa,EAAE;QACrE,CAAC,CAAC;YACE,KAAK,EAAE,aAAsB;YAC7B,MAAM,EAAE,GAAG,YAAY,mBAAmB,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG;SACzE,CAAC;AACR,CAAC,CACF,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,YAAoB,EACpB,QAAgB,EAChB,QAA8B;IAE9B,MAAM,SAAS,GAAG,MAAM,iBAAiB,CACvC,WAAW,EACX,YAAY,EACZ,QAAQ,CACT,CAAC;IACF,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,GAAG,YAAY,wBAAwB;SAChD,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,GAAG,YAAY,gBAAgB,SAAS,CAAC,QAAQ,CAAC,aAAa;SACxE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,WAAW,EACX,YAAY,EACZ,QAAQ,CACT,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC5D,MAAM,CAAC,IAAI,EAAE,CACd,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,GAAG,YAAY,wBAAwB;aAChD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC5B,OAAO;gBACL,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,GAAG,YAAY,gBAAgB,SAAS,CAAC,QAAQ,CAAC,aAAa;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,WAAW,EACX,YAAY,EACZ,QAAQ,CAAC,KAAK,CAAC,EACf,QAAQ,CACT,CAAC;QACF,OAAO,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,GAAG,YAAY,mBAAmB,SAAS,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG;SACrF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAmB,EACnB,YAAoB,EACpB,QAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,GAAG,YAAY,qBAAqB;SAC7C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAC9C,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;YACxB,CAAC,CAAC;gBACE,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,GAAG,YAAY,uCAAuC;aAC/D,CAAC;IACR,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,aAAa,EAAE;YAC5D,CAAC,CAAC;gBACE,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,GAAG,YAAY,mBAAmB,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG;aACzE,CAAC;IACR,CAAC;AACH,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-job.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @file doctor-nightly-e2e-guard-job.ts
+ * @description Executable-field parsing for one reachable workflow job
+ * @module cli/doctor-nightly-e2e-guard-job
+ */
+import { type NightlyGuardScanFailure, type NightlyGuardWorkflowRecord } from "./doctor-nightly-e2e-guard-contract.js";
+/** Supported active target resolved from one job. */
+export interface NightlyGuardJobCaller {
+    /** Direct Node invocation or Lisa's exact official reusable endpoint. */
+    readonly kind: "official-reusable" | "direct";
+    /** Literal normalized target path. */
+    readonly target: string;
+}
+/** Executable interpretation of one reachable job. */
+export interface NightlyGuardJobInspection {
+    /** Guard caller when this job directly invokes one. */
+    readonly caller?: NightlyGuardJobCaller;
+    /** Local reusable basename when this job calls one. */
+    readonly local?: string;
+    /** Fail-closed ambiguity or unsupported syntax. */
+    readonly failure?: NightlyGuardScanFailure;
+}
+/**
+ * Interpret one reachable executable job without scanning prose or comments.
+ * @param workflow - Parsed workflow containing the job
+ * @param jobId - Stable job mapping key
+ * @param job - Parsed job mapping
+ * @returns Direct caller, local edge, or an explicit refusal
+ */
+export declare function inspectNightlyGuardJob(workflow: NightlyGuardWorkflowRecord, jobId: string, job: Readonly<Record<string, unknown>>): NightlyGuardJobInspection;
+//# sourceMappingURL=doctor-nightly-e2e-guard-job.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-job.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-job.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAIhC,MAAM,wCAAwC,CAAC;AAchD,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,QAAQ,CAAC;IAC9C,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sDAAsD;AACtD,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IACxC,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;CAC5C;AA4MD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,0BAA0B,EACpC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACrC,yBAAyB,CAmB3B"}