@codyswann/lisa 4.21.5 → 4.22.0

package/dist/cli/doctor-nightly-e2e-guard-deadline.js

@@ -0,0 +1,97 @@
+/**
+ * @file doctor-nightly-e2e-guard-deadline.ts
+ * @description One monotonic deadline shared by guard discovery and proof
+ * @module cli/doctor-nightly-e2e-guard-deadline
+ */
+import { performance } from "node:perf_hooks";
+import { NIGHTLY_GUARD_OPERATION_TIMEOUT_MS } from "./doctor-nightly-e2e-guard-contract.js";
+/** Explicit error used to convert every deadline exhaustion into one finding. */
+export class NightlyGuardDeadlineError extends Error {
+    /** Distinguishes a bounded refusal from arbitrary IO failures. */
+    code = "NIGHTLY_GUARD_DEADLINE";
+    /**
+     * Create the stable operator-facing deadline refusal.
+     * @param reason - Budget whose expiration caused the refusal
+     */
+    constructor(reason = "15 seconds whole-operation deadline exhausted") {
+        super(reason);
+        this.name = "NightlyGuardDeadlineError";
+    }
+}
+/**
+ * Start the deadline before discovery so an expensive scan consumes proof time.
+ * @param now - Injected monotonic clock
+ * @param timeoutMs - Whole-operation budget
+ * @param reason - Exact budget named on expiry
+ * @returns Shared absolute deadline
+ */
+export function createNightlyGuardDeadline(now = () => performance.now(), timeoutMs = NIGHTLY_GUARD_OPERATION_TIMEOUT_MS, reason = "15 seconds whole-operation deadline exhausted") {
+    return { expiresAt: now() + timeoutMs, now, reason };
+}
+/**
+ * Return the non-negative time left in the shared budget.
+ * @param deadline - Shared absolute deadline
+ * @returns Remaining milliseconds, clamped at zero
+ */
+export const nightlyGuardRemaining = (deadline) => Math.max(0, deadline.expiresAt - deadline.now());
+/**
+ * Describe the exact target ceiling without hard-coding the default budget.
+ * @param timeoutMs - Target-specific ceiling in milliseconds
+ * @returns Stable operator-facing deadline reason
+ */
+export function nightlyGuardTargetDeadlineReason(timeoutMs) {
+    const seconds = timeoutMs / 1000;
+    const duration = Number.isInteger(seconds)
+        ? `${seconds} ${seconds === 1 ? "second" : "seconds"}`
+        : `${timeoutMs} milliseconds`;
+    return `${duration} target proof deadline exhausted`;
+}
+/**
+ * Refuse work immediately once the shared deadline has elapsed.
+ * @param deadline - Shared absolute deadline
+ */
+export function assertNightlyGuardDeadline(deadline) {
+    if (nightlyGuardRemaining(deadline) <= 0) {
+        throw new NightlyGuardDeadlineError(deadline.reason);
+    }
+}
+/**
+ * Enforce the remaining wall-clock budget even when an injected collaborator
+ * never resolves. The abandoned operation is read-only and cannot alter the
+ * inspected project after the refusal is returned.
+ * @param deadline - Shared operation deadline
+ * @param operation - Lazy read-only asynchronous work
+ * @returns The operation result before expiry
+ */
+export async function withinNightlyGuardDeadline(deadline, operation) {
+    const remaining = nightlyGuardRemaining(deadline);
+    if (remaining <= 0)
+        throw new NightlyGuardDeadlineError(deadline.reason);
+    return await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new NightlyGuardDeadlineError(deadline.reason)), remaining);
+        operation().then(value => {
+            clearTimeout(timer);
+            resolve(value);
+        }, error => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+/**
+ * Give one target a smaller ceiling without extending the outer deadline.
+ * @param outer - Whole-operation deadline
+ * @param timeoutMs - Target-specific ceiling
+ * @returns Deadline ending at the earlier ceiling
+ */
+export function limitNightlyGuardDeadline(outer, timeoutMs) {
+    const targetExpiresAt = outer.now() + timeoutMs;
+    return {
+        expiresAt: Math.min(outer.expiresAt, targetExpiresAt),
+        now: outer.now,
+        reason: targetExpiresAt < outer.expiresAt
+            ? nightlyGuardTargetDeadlineReason(timeoutMs)
+            : outer.reason,
+    };
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-deadline.js.map

package/dist/cli/doctor-nightly-e2e-guard-deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-deadline.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-deadline.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC;AAE5F,iFAAiF;AACjF,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,kEAAkE;IACzD,IAAI,GAAG,wBAAwB,CAAC;IAEzC;;;OAGG;IACH,YAAY,MAAM,GAAG,+CAA+C;QAClE,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAoB,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAC3C,SAAS,GAAG,kCAAkC,EAC9C,MAAM,GAAG,+CAA+C;IAExD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAA8B,EAAU,EAAE,CAC9E,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAAC,SAAiB;IAChE,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,GAAG,OAAO,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE;QACtD,CAAC,CAAC,GAAG,SAAS,eAAe,CAAC;IAChC,OAAO,GAAG,QAAQ,kCAAkC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAA8B;IAE9B,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAA8B,EAC9B,SAA2B;IAE3B,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,SAAS,IAAI,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,MAAM,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAC5D,SAAS,CACV,CAAC;QACF,SAAS,EAAE,CAAC,IAAI,CACd,KAAK,CAAC,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,KAAK,CAAC,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAA2B,EAC3B,SAAiB;IAEjB,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAChD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC;QACrD,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,MAAM,EACJ,eAAe,GAAG,KAAK,CAAC,SAAS;YAC/B,CAAC,CAAC,gCAAgC,CAAC,SAAS,CAAC;YAC7C,CAAC,CAAC,KAAK,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-evidence.d.ts

@@ -0,0 +1,52 @@
+/**
+ * @file doctor-nightly-e2e-guard-evidence.ts
+ * @description Preclassification evidence pass for one reachable workflow job
+ * @module cli/doctor-nightly-e2e-guard-evidence
+ */
+import { type NightlyGuardWorkflowRecord } from "./doctor-nightly-e2e-guard-contract.js";
+import { type NightlyGuardRunInspection } from "./doctor-nightly-e2e-guard-shell.js";
+/** Evidence gathered before deciding which supported job grammar applies. */
+export interface NightlyGuardJobEvidence {
+    /** YAML-decoded steps retained for per-step environment attribution. */
+    readonly steps: readonly Readonly<Record<string, unknown>>[];
+    /** Comment-stripped POSIX run interpretations for those steps. */
+    readonly analyses: readonly NightlyGuardRunInspection[];
+    /** Workflow/job environment carries recognized bypass semantics. */
+    readonly inheritedEnvironment: boolean;
+    /** At least one step environment carries recognized bypass semantics. */
+    readonly stepEnvironment: boolean;
+    /** Job or step condition carries recognized bypass semantics. */
+    readonly condition: boolean;
+    /** Reusable input mapping carries recognized bypass semantics. */
+    readonly withMapping: boolean;
+    /** Comment-stripped run tokens construct recognized bypass state. */
+    readonly run: boolean;
+    /** At least one supported or refused run contains a Node command. */
+    readonly hasNode: boolean;
+}
+/**
+ * Recognize only operational bypass keys or values with nightly-E2E semantics.
+ * @param levels - YAML mappings at increasing precedence
+ * @returns Whether a mapping participates in this guard's bypass contract
+ */
+export declare const bypassBearingMapping: (...levels: readonly unknown[]) => boolean;
+/**
+ * Conditions are executable evidence only when their value has guard semantics.
+ * @param value - Parsed job/step `if` value
+ * @returns Whether the condition can participate in nightly bypass behavior
+ */
+export declare const conditionalBypass: (value: unknown) => boolean;
+/**
+ * Inspect all executable fields before official/local/direct classification.
+ * @param workflow - Parsed owner of the job and workflow defaults
+ * @param job - Parsed job mapping with runner and step metadata
+ * @returns Evidence shared by every classification branch
+ */
+export declare const inspectNightlyGuardJobEvidence: (workflow: NightlyGuardWorkflowRecord, job: Readonly<Record<string, unknown>>) => NightlyGuardJobEvidence;
+/**
+ * Collapse evidence only after every executable field has been inspected.
+ * @param evidence - Complete preclassification evidence record
+ * @returns Whether any field places the job in the nightly bypass contract
+ */
+export declare const hasAnyNightlyGuardBypassEvidence: (evidence: NightlyGuardJobEvidence) => boolean;
+//# sourceMappingURL=doctor-nightly-e2e-guard-evidence.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-evidence.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,qCAAqC,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC7D,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,oEAAoE;IACpE,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAmBD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,GAAG,QAAQ,SAAS,OAAO,EAAE,KAAG,OAOlE,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,OACY,CAAC;AAYhE;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GACzC,UAAU,0BAA0B,EACpC,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KACrC,uBAmCF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,GAC3C,UAAU,uBAAuB,KAChC,OAKW,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-evidence.js

@@ -0,0 +1,68 @@
+/**
+ * @file doctor-nightly-e2e-guard-evidence.ts
+ * @description Preclassification evidence pass for one reachable workflow job
+ * @module cli/doctor-nightly-e2e-guard-evidence
+ */
+import { nightlyGuardObject, nightlyGuardText, } from "./doctor-nightly-e2e-guard-contract.js";
+import { hasNightlyBypassReference, inspectNightlyGuardRun, isNightlyBypassEnvironmentName, } from "./doctor-nightly-e2e-guard-shell.js";
+const mergedEnvironment = (...levels) => Object.assign({}, ...levels.map(level => nightlyGuardObject(level) ?? {}));
+const literalEnvironment = (environment) => Object.fromEntries(Object.entries(environment).filter((entry) => typeof entry[1] === "string"));
+const bypassKey = (key) => isNightlyBypassEnvironmentName(key) || hasNightlyBypassReference(key);
+/**
+ * Recognize only operational bypass keys or values with nightly-E2E semantics.
+ * @param levels - YAML mappings at increasing precedence
+ * @returns Whether a mapping participates in this guard's bypass contract
+ */
+export const bypassBearingMapping = (...levels) => levels.some(level => Object.entries(nightlyGuardObject(level) ?? {}).some(([key, value]) => bypassKey(key) ||
+    (typeof value === "string" && hasNightlyBypassReference(value))));
+/**
+ * Conditions are executable evidence only when their value has guard semantics.
+ * @param value - Parsed job/step `if` value
+ * @returns Whether the condition can participate in nightly bypass behavior
+ */
+export const conditionalBypass = (value) => typeof value === "string" && hasNightlyBypassReference(value);
+const workflowShell = (workflow) => nightlyGuardObject(nightlyGuardObject(workflow.document.defaults)?.run)
+    ?.shell;
+const jobShell = (job) => nightlyGuardObject(nightlyGuardObject(job.defaults)?.run)?.shell;
+const firstDefined = (...values) => values.find(value => value !== undefined);
+/**
+ * Inspect all executable fields before official/local/direct classification.
+ * @param workflow - Parsed owner of the job and workflow defaults
+ * @param job - Parsed job mapping with runner and step metadata
+ * @returns Evidence shared by every classification branch
+ */
+export const inspectNightlyGuardJobEvidence = (workflow, job) => {
+    const rawSteps = Array.isArray(job.steps) ? job.steps : [];
+    const steps = rawSteps.map(step => nightlyGuardObject(step) ?? {});
+    const inheritedEnvironment = bypassBearingMapping(workflow.document.env, job.env);
+    const analyses = steps.map(step => {
+        const environment = mergedEnvironment(workflow.document.env, job.env, step.env);
+        return inspectNightlyGuardRun(nightlyGuardText(step.run), literalEnvironment(environment), {
+            shell: firstDefined(step.shell, jobShell(job), workflowShell(workflow)),
+            runsOn: job["runs-on"],
+            environment,
+        });
+    });
+    return {
+        steps,
+        analyses,
+        inheritedEnvironment,
+        stepEnvironment: steps.some(step => bypassBearingMapping(step.env)),
+        condition: conditionalBypass(job.if) ||
+            steps.some(step => conditionalBypass(step.if)),
+        withMapping: bypassBearingMapping(job.with),
+        run: analyses.some(analysis => analysis.bypassEvidence),
+        hasNode: analyses.some(analysis => analysis.containsNode),
+    };
+};
+/**
+ * Collapse evidence only after every executable field has been inspected.
+ * @param evidence - Complete preclassification evidence record
+ * @returns Whether any field places the job in the nightly bypass contract
+ */
+export const hasAnyNightlyGuardBypassEvidence = (evidence) => evidence.inheritedEnvironment ||
+    evidence.stepEnvironment ||
+    evidence.condition ||
+    evidence.withMapping ||
+    evidence.run;
+//# sourceMappingURL=doctor-nightly-e2e-guard-evidence.js.map

package/dist/cli/doctor-nightly-e2e-guard-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-evidence.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-evidence.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAEL,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,8BAA8B,GAE/B,MAAM,qCAAqC,CAAC;AAsB7C,MAAM,iBAAiB,GAAG,CACxB,GAAG,MAA0B,EACM,EAAE,CACrC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAE7E,MAAM,kBAAkB,GAAG,CACzB,WAA8C,EACZ,EAAE,CACpC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAChC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CACnE,CACF,CAAC;AAEJ,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE,CACzC,8BAA8B,CAAC,GAAG,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,MAA0B,EAAW,EAAE,CAC7E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAClB,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAClD,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,SAAS,CAAC,GAAG,CAAC;IACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAClE,CACF,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAW,EAAE,CAC3D,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC;AAEhE,MAAM,aAAa,GAAG,CAAC,QAAoC,EAAW,EAAE,CACtE,kBAAkB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC;IACrE,EAAE,KAAK,CAAC;AAEZ,MAAM,QAAQ,GAAG,CAAC,GAAsC,EAAW,EAAE,CACnE,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC;AAEnE,MAAM,YAAY,GAAG,CAAC,GAAG,MAA0B,EAAW,EAAE,CAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,QAAoC,EACpC,GAAsC,EACb,EAAE;IAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,oBAAoB,CAC/C,QAAQ,CAAC,QAAQ,CAAC,GAAG,EACrB,GAAG,CAAC,GAAG,CACR,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAChC,MAAM,WAAW,GAAG,iBAAiB,CACnC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EACrB,GAAG,CAAC,GAAG,EACP,IAAI,CAAC,GAAG,CACT,CAAC;QACF,OAAO,sBAAsB,CAC3B,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAC1B,kBAAkB,CAAC,WAAW,CAAC,EAC/B;YACE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;YACvE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC;YACtB,WAAW;SACZ,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,QAAQ;QACR,oBAAoB;QACpB,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,SAAS,EACP,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC3C,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;KAC1D,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,QAAiC,EACxB,EAAE,CACX,QAAQ,CAAC,oBAAoB;IAC7B,QAAQ,CAAC,eAAe;IACxB,QAAQ,CAAC,SAAS;IAClB,QAAQ,CAAC,WAAW;IACpB,QAAQ,CAAC,GAAG,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-graph.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @file doctor-nightly-e2e-guard-graph.ts
+ * @description Root-preserving traversal of reachable local reusable workflows
+ * @module cli/doctor-nightly-e2e-guard-graph
+ */
+import { type NightlyGuardScanResult, type NightlyGuardWorkflowRecord } from "./doctor-nightly-e2e-guard-contract.js";
+/**
+ * Traverse each root independently so shared reusables retain every active
+ * root-to-job attribution while static target proof remains deduplicated.
+ * @param records - Parsed bounded workflow inventory
+ * @returns Deterministic active callers or the first graph refusal
+ */
+export declare function traceNightlyGuardCallers(records: readonly NightlyGuardWorkflowRecord[]): NightlyGuardScanResult;
+//# sourceMappingURL=doctor-nightly-e2e-guard-graph.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-graph.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-graph.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EASL,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAKhC,MAAM,wCAAwC,CAAC;AA2KhD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,SAAS,0BAA0B,EAAE,GAC7C,sBAAsB,CA2BxB"}

package/dist/cli/doctor-nightly-e2e-guard-graph.js

@@ -0,0 +1,130 @@
+/**
+ * @file doctor-nightly-e2e-guard-graph.ts
+ * @description Root-preserving traversal of reachable local reusable workflows
+ * @module cli/doctor-nightly-e2e-guard-graph
+ */
+import { MAX_NIGHTLY_GUARD_ATTRIBUTION_BYTES, MAX_NIGHTLY_GUARD_CALLERS, MAX_NIGHTLY_GUARD_JOB_ID_BYTES, MAX_NIGHTLY_GUARD_LOCAL_DEPTH, MAX_NIGHTLY_GUARD_TARGETS, NIGHTLY_GUARD_WORKFLOWS, isNightlyGuardJobId, nightlyGuardCallerAttributionBytes, nightlyGuardObject, orderNightlyGuardStrings, } from "./doctor-nightly-e2e-guard-contract.js";
+import { inspectNightlyGuardJob } from "./doctor-nightly-e2e-guard-job.js";
+const failure = (workflow, reason) => ({ failure: { workflow: workflow.file, reason } });
+const isFailure = (result) => "failure" in result;
+const triggerNames = (value) => {
+    if (typeof value === "string")
+        return [value];
+    if (Array.isArray(value)) {
+        return value.filter(item => typeof item === "string");
+    }
+    return Object.keys(nightlyGuardObject(value) ?? {});
+};
+const isRoot = (record) => triggerNames(record.document.on).some(event => event !== "workflow_call");
+const pathPart = (workflow, jobId) => `${workflow.file}#${jobId}`;
+const validateBounds = (workflow, callers) => {
+    if (callers.length > MAX_NIGHTLY_GUARD_CALLERS) {
+        return failure(workflow, `bypass caller limit ${MAX_NIGHTLY_GUARD_CALLERS} exceeded`);
+    }
+    const targets = new Set(callers.map(caller => caller.target));
+    if (targets.size > MAX_NIGHTLY_GUARD_TARGETS) {
+        return failure(workflow, `guard target limit ${MAX_NIGHTLY_GUARD_TARGETS} exceeded`);
+    }
+    const attributionBytes = callers.reduce((total, caller) => total + nightlyGuardCallerAttributionBytes(caller), 0);
+    return attributionBytes > MAX_NIGHTLY_GUARD_ATTRIBUTION_BYTES
+        ? {
+            failure: {
+                workflow: NIGHTLY_GUARD_WORKFLOWS,
+                reason: `caller attribution exceeds the ${MAX_NIGHTLY_GUARD_ATTRIBUTION_BYTES}-byte limit`,
+            },
+        }
+        : { callers };
+};
+const callerFor = (workflow, jobId, context, caller) => ({
+    workflow: workflow.file,
+    job: jobId,
+    callPath: [...context.parents, pathPart(workflow, jobId)].join(" -> "),
+    kind: caller.kind,
+    target: caller.target,
+});
+const childContext = (workflow, jobId, context) => ({
+    depth: context.depth + 1,
+    stack: [...context.stack, workflow.name],
+    parents: [...context.parents, pathPart(workflow, jobId)],
+});
+/**
+ * Traverse one workflow and every local edge below it.
+ * @param workflow - Current parsed workflow
+ * @param byName - Bounded inventory keyed by basename
+ * @param context - Root-path recursion state
+ * @returns Callers below this workflow or an explicit graph refusal
+ */
+const walkWorkflow = (workflow, byName, context) => {
+    if (context.stack.includes(workflow.name)) {
+        return failure(workflow, `reachable local workflow cycle: ${[...context.stack, workflow.name].join(" -> ")}`);
+    }
+    const jobs = nightlyGuardObject(workflow.document.jobs) ?? {};
+    const jobIds = orderNightlyGuardStrings(Object.keys(jobs));
+    const walkJobs = (index, accumulated) => {
+        const jobId = jobIds[index];
+        if (jobId === undefined)
+            return validateBounds(workflow, accumulated);
+        if (!isNightlyGuardJobId(jobId)) {
+            return failure(workflow, `job identifier exceeds the ${MAX_NIGHTLY_GUARD_JOB_ID_BYTES}-byte GitHub identifier limit or uses unsupported characters`);
+        }
+        const job = nightlyGuardObject(jobs[jobId]);
+        if (!job)
+            return walkJobs(index + 1, accumulated);
+        const inspection = inspectNightlyGuardJob(workflow, jobId, job);
+        if (inspection.failure)
+            return { failure: inspection.failure };
+        const own = inspection.caller
+            ? [callerFor(workflow, jobId, context, inspection.caller)]
+            : [];
+        if (!inspection.local)
+            return walkJobs(index + 1, [...accumulated, ...own]);
+        const child = byName.get(inspection.local);
+        if (!child) {
+            return failure(workflow, `${jobId}: local reusable ${inspection.local} is missing or unresolved`);
+        }
+        if (context.depth >= MAX_NIGHTLY_GUARD_LOCAL_DEPTH) {
+            return failure(workflow, `reachable local workflow depth exceeds ${MAX_NIGHTLY_GUARD_LOCAL_DEPTH}`);
+        }
+        const nested = walkWorkflow(child, byName, childContext(workflow, jobId, context));
+        return isFailure(nested)
+            ? nested
+            : walkJobs(index + 1, [...accumulated, ...own, ...nested.callers]);
+    };
+    return walkJobs(0, []);
+};
+/**
+ * Traverse each root independently so shared reusables retain every active
+ * root-to-job attribution while static target proof remains deduplicated.
+ * @param records - Parsed bounded workflow inventory
+ * @returns Deterministic active callers or the first graph refusal
+ */
+export function traceNightlyGuardCallers(records) {
+    const byName = new Map(records.map(record => [record.name, record]));
+    const roots = records.filter(isRoot);
+    const walkRoots = (index, accumulated) => {
+        const root = roots[index];
+        if (root === undefined)
+            return validateBounds(records[0] ?? emptyRecord, accumulated);
+        const result = walkWorkflow(root, byName, {
+            depth: 0,
+            stack: [],
+            parents: [],
+        });
+        return isFailure(result)
+            ? result
+            : walkRoots(index + 1, [...accumulated, ...result.callers]);
+    };
+    const result = walkRoots(0, []);
+    if (isFailure(result)) {
+        return { state: "unavailable", failures: [result.failure] };
+    }
+    const callers = [...result.callers].sort((left, right) => left.callPath < right.callPath ? -1 : left.callPath > right.callPath ? 1 : 0);
+    return { state: "ok", callers };
+}
+/** Synthetic owner for bounds when an inventory contains no records. */
+const emptyRecord = {
+    file: ".github/workflows",
+    name: "",
+    document: {},
+};
+//# sourceMappingURL=doctor-nightly-e2e-guard-graph.js.map

package/dist/cli/doctor-nightly-e2e-guard-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-graph.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-graph.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,mCAAmC,EACnC,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,yBAAyB,EACzB,uBAAuB,EAKvB,mBAAmB,EACnB,kCAAkC,EAClC,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAuB3E,MAAM,OAAO,GAAG,CACd,QAAoC,EACpC,MAAc,EACG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAEzE,MAAM,SAAS,GAAG,CAChB,MAAuB,EACkC,EAAE,CAC3D,SAAS,IAAI,MAAM,CAAC;AAEtB,MAAM,YAAY,GAAG,CAAC,KAAc,EAAqB,EAAE;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,MAAkC,EAAW,EAAE,CAC7D,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC;AAE5E,MAAM,QAAQ,GAAG,CACf,QAAoC,EACpC,KAAa,EACL,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;AAEzC,MAAM,cAAc,GAAG,CACrB,QAAoC,EACpC,OAAsC,EACrB,EAAE;IACnB,IAAI,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAC/C,OAAO,OAAO,CACZ,QAAQ,EACR,uBAAuB,yBAAyB,WAAW,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;QAC7C,OAAO,OAAO,CACZ,QAAQ,EACR,sBAAsB,yBAAyB,WAAW,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,kCAAkC,CAAC,MAAM,CAAC,EACrE,CAAC,CACF,CAAC;IACF,OAAO,gBAAgB,GAAG,mCAAmC;QAC3D,CAAC,CAAC;YACE,OAAO,EAAE;gBACP,QAAQ,EAAE,uBAAuB;gBACjC,MAAM,EAAE,kCAAkC,mCAAmC,aAAa;aAC3F;SACF;QACH,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,QAAoC,EACpC,KAAa,EACb,OAAyB,EACzB,MAAwE,EACpD,EAAE,CAAC,CAAC;IACxB,QAAQ,EAAE,QAAQ,CAAC,IAAI;IACvB,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IACtE,IAAI,EAAE,MAAM,CAAC,IAAI;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM;CACtB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CACnB,QAAoC,EACpC,KAAa,EACb,OAAyB,EACP,EAAE,CAAC,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC;IACxB,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;IACxC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;CACzD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CACnB,QAAoC,EACpC,MAAuD,EACvD,OAAyB,EACR,EAAE;IACnB,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO,OAAO,CACZ,QAAQ,EACR,mCAAmC,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,CACf,KAAa,EACb,WAA0C,EACzB,EAAE;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACtE,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CACZ,QAAQ,EACR,8BAA8B,8BAA8B,8DAA8D,CAC3H,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM;YAC3B,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CACZ,QAAQ,EACR,GAAG,KAAK,oBAAoB,UAAU,CAAC,KAAK,2BAA2B,CACxE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,IAAI,6BAA6B,EAAE,CAAC;YACnD,OAAO,OAAO,CACZ,QAAQ,EACR,0CAA0C,6BAA6B,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,MAAM,EACN,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CACvC,CAAC;QACF,OAAO,SAAS,CAAC,MAAM,CAAC;YACtB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;IAEF,OAAO,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA8C;IAE9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,CAChB,KAAa,EACb,WAA0C,EACzB,EAAE;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS;YACpB,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE;YACxC,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC;YACtB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACvD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC7E,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,MAAM,WAAW,GAA+B;IAC9C,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,EAAE;CACb,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-io.d.ts

@@ -0,0 +1,41 @@
+import { type NightlyGuardDeadline } from "./doctor-nightly-e2e-guard-deadline.js";
+/** Successful bytes or the precise availability class of a safe read. */
+export type NightlyGuardReadResult = {
+    readonly state: "ok";
+    readonly bytes: Buffer;
+} | {
+    readonly state: "missing";
+    readonly reason: string;
+} | {
+    readonly state: "unavailable";
+    readonly reason: string;
+};
+/** Deterministic directory entries or an explicit availability refusal. */
+export type NightlyGuardDirectoryResult = {
+    readonly state: "ok";
+    readonly names: readonly string[];
+} | {
+    readonly state: "missing";
+    readonly reason: string;
+} | {
+    readonly state: "unavailable";
+    readonly reason: string;
+};
+/**
+ * Read one regular file without following any path component.
+ * @param projectRoot - Containment root
+ * @param relativePath - Project-relative path
+ * @param maxBytes - Hard byte ceiling
+ * @param deadline - Shared deadline
+ * @returns Bounded bytes or a precise availability class
+ */
+export declare function readNightlyGuardFile(projectRoot: string, relativePath: string, maxBytes: number, deadline: NightlyGuardDeadline): Promise<NightlyGuardReadResult>;
+/**
+ * List a directory only when every component and its identity remain safe.
+ * @param projectRoot - Containment root
+ * @param relativePath - Project-relative directory
+ * @param deadline - Shared deadline
+ * @returns Directory entries or an availability refusal
+ */
+export declare function readNightlyGuardDirectory(projectRoot: string, relativePath: string, deadline: NightlyGuardDeadline): Promise<NightlyGuardDirectoryResult>;
+//# sourceMappingURL=doctor-nightly-e2e-guard-io.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-io.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-io.ts"],"names":[],"mappings":"AASA,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,wCAAwC,CAAC;AAEhD,yEAAyE;AACzE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,MAAM,2BAA2B,GACnC;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwM/D;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CA6DjC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,2BAA2B,CAAC,CA+BtC"}