@codyswann/lisa 4.21.5 → 4.22.0

package/dist/cli/doctor-nightly-e2e-guard-remediation.js

@@ -0,0 +1,55 @@
+/**
+ * @file doctor-nightly-e2e-guard-remediation.ts
+ * @description Provenance-aware repair guidance for nightly guard findings
+ * @module cli/doctor-nightly-e2e-guard-remediation
+ */
+import { classifyHostCopy, } from "../core/lisa-owned-provenance.js";
+import { LISA_OWNED_HASH_LEDGER } from "../core/lisa-owned-hash-ledger.js";
+import { NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES } from "../core/nightly-e2e-guard-behavior-certificate.js";
+import { MAX_NIGHTLY_GUARD_FILE_BYTES, NIGHTLY_GUARD_CANONICAL_TARGET, NIGHTLY_GUARD_SHIPPED_TARGET, } from "./doctor-nightly-e2e-guard-contract.js";
+import { readNightlyGuardFile } from "./doctor-nightly-e2e-guard-io.js";
+import { digestNightlyGuardBytes, } from "./doctor-nightly-e2e-guard-proof.js";
+const exactProbe = (target) => `node ${target} --contract-version`;
+const preserveContext = "preserve the workflow/job names and required-check context unless a coordinated ruleset migration is planned";
+const packageUnavailable = (reason) => `repair or reinstall Lisa first: its packaged guard is unreadable or corrupt (${reason}); then run \`lisa apply .\` and \`${exactProbe(NIGHTLY_GUARD_CANONICAL_TARGET)}\``;
+const packageUncertified = (reason) => `upgrade or reinstall Lisa first: its packaged guard is not behavior-certified (${reason}); then run \`lisa apply .\` and \`${exactProbe(NIGHTLY_GUARD_CANONICAL_TARGET)}\``;
+/**
+ * Produce exact repair guidance without collapsing missing, unreadable, stale,
+ * and deliberately modified files into the same destructive instruction.
+ * @param input - Caller, package, provenance, and deadline context
+ * @returns One bounded operator-readable remediation
+ */
+export async function nightlyGuardRemediation(input) {
+    const shipped = await readNightlyGuardFile(input.lisaRoot, NIGHTLY_GUARD_SHIPPED_TARGET, MAX_NIGHTLY_GUARD_FILE_BYTES, input.deadline);
+    if (shipped.state === "missing") {
+        return `upgrade first: install Lisa 2.353.0+ on 2.x or, preferably, the current release; then run \`lisa apply .\` and \`${exactProbe(NIGHTLY_GUARD_CANONICAL_TARGET)}\``;
+    }
+    if (shipped.state === "unavailable") {
+        return packageUnavailable(shipped.reason);
+    }
+    const shippedDigest = digestNightlyGuardBytes(shipped.bytes);
+    const certificates = input.certificates ?? NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES;
+    if (certificates[shippedDigest] === undefined) {
+        return packageUncertified("its exact bytes are absent from this release's nightly guard behavior certificate; a generic ownership hash is insufficient");
+    }
+    const ledger = input.ledger ?? LISA_OWNED_HASH_LEDGER;
+    if (input.caller.target !== NIGHTLY_GUARD_CANONICAL_TARGET) {
+        return `install ${NIGHTLY_GUARD_CANONICAL_TARGET} with \`lisa apply .\`, repoint this job to it, retire ${input.caller.target}, then run \`${exactProbe(NIGHTLY_GUARD_CANONICAL_TARGET)}\`; ${preserveContext}`;
+    }
+    const host = await readNightlyGuardFile(input.projectRoot, NIGHTLY_GUARD_CANONICAL_TARGET, MAX_NIGHTLY_GUARD_FILE_BYTES, input.deadline);
+    if (host.state === "missing") {
+        return `run \`lisa apply .\` to install ${NIGHTLY_GUARD_CANONICAL_TARGET}, then run \`${exactProbe(NIGHTLY_GUARD_CANONICAL_TARGET)}\``;
+    }
+    if (host.state === "unavailable") {
+        return `repair the canonical host path before applying: ${host.reason}; no file was replaced`;
+    }
+    const verdict = classifyHostCopy(NIGHTLY_GUARD_CANONICAL_TARGET, host.bytes, shipped.bytes, ledger);
+    if (verdict.kind === "identical") {
+        return `the failing target is the byte-identical packaged copy; repair, reinstall, or upgrade Lisa, re-run \`lisa apply .\`, then run \`${exactProbe(NIGHTLY_GUARD_CANONICAL_TARGET)}\``;
+    }
+    if (verdict.kind === "provably-stale") {
+        return `this canonical copy is provably stale; run \`lisa apply .\`, then run \`${exactProbe(NIGHTLY_GUARD_CANONICAL_TARGET)}\``;
+    }
+    return `review the preserved modified canonical guard, then take Lisa's exact copy with \`lisa apply . --refresh-templates=${NIGHTLY_GUARD_CANONICAL_TARGET}\` and run \`${exactProbe(NIGHTLY_GUARD_CANONICAL_TARGET)}\``;
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-remediation.js.map

package/dist/cli/doctor-nightly-e2e-guard-remediation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-remediation.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-remediation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,gBAAgB,GAEjB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,uCAAuC,EAAE,MAAM,mDAAmD,CAAC;AAC5G,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAC;AAE7C,MAAM,UAAU,GAAG,CAAC,MAAc,EAAU,EAAE,CAC5C,QAAQ,MAAM,qBAAqB,CAAC;AACtC,MAAM,eAAe,GACnB,8GAA8G,CAAC;AAkBjH,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAU,EAAE,CACpD,gFAAgF,MAAM,sCAAsC,UAAU,CAAC,8BAA8B,CAAC,IAAI,CAAC;AAC7K,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAU,EAAE,CACpD,kFAAkF,MAAM,sCAAsC,UAAU,CAAC,8BAA8B,CAAC,IAAI,CAAC;AAE/K;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,KAAK,CAAC,QAAQ,EACd,4BAA4B,EAC5B,4BAA4B,EAC5B,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,oHAAoH,UAAU,CAAC,8BAA8B,CAAC,IAAI,CAAC;IAC5K,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,uCAAuC,CAAC;IAChE,IAAI,YAAY,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,kBAAkB,CACvB,6HAA6H,CAC9H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,sBAAsB,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,8BAA8B,EAAE,CAAC;QAC3D,OAAO,WAAW,8BAA8B,0DAA0D,KAAK,CAAC,MAAM,CAAC,MAAM,gBAAgB,UAAU,CAAC,8BAA8B,CAAC,OAAO,eAAe,EAAE,CAAC;IAClN,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACrC,KAAK,CAAC,WAAW,EACjB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,mCAAmC,8BAA8B,gBAAgB,UAAU,CAAC,8BAA8B,CAAC,IAAI,CAAC;IACzI,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACjC,OAAO,mDAAmD,IAAI,CAAC,MAAM,wBAAwB,CAAC;IAChG,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAC9B,8BAA8B,EAC9B,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,KAAK,EACb,MAAM,CACP,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,mIAAmI,UAAU,CAAC,8BAA8B,CAAC,IAAI,CAAC;IAC3L,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO,2EAA2E,UAAU,CAAC,8BAA8B,CAAC,IAAI,CAAC;IACnI,CAAC;IACD,OAAO,sHAAsH,8BAA8B,gBAAgB,UAAU,CAAC,8BAA8B,CAAC,IAAI,CAAC;AAC5N,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-runtime.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @file doctor-nightly-e2e-guard-runtime.ts
+ * @description Proven shell and environment constraints for static guard calls
+ * @module cli/doctor-nightly-e2e-guard-runtime
+ */
+/** Metadata whose exact values decide whether POSIX parsing is sound. */
+export interface NightlyGuardRuntimeContext {
+    /** Highest-precedence workflow/job/step shell declaration, when present. */
+    readonly shell: unknown;
+    /** Job runner label used only when no shell is explicitly declared. */
+    readonly runsOn: unknown;
+    /** Fully merged workflow/job/step environment visible to the command. */
+    readonly environment: Readonly<Record<string, unknown>>;
+}
+/**
+ * Identify environment controls that can replace or alter Node/shell execution.
+ * @param name - Case-sensitive process environment name from YAML or shell
+ * @returns Whether the name can change how the certified bytes are executed
+ */
+export declare const isExecutionChangingEnvironmentName: (name: string) => boolean;
+/**
+ * Refuse an effective environment that can turn exact bytes into false proof.
+ * @param environment - Merged environment after YAML precedence is applied
+ * @returns A bounded refusal naming the first dangerous control, when present
+ */
+export declare const nightlyGuardEnvironmentFailure: (environment: Readonly<Record<string, unknown>>) => string | undefined;
+/**
+ * Require either a finite safe shell template or an exact hosted runner label.
+ * @param run - YAML-decoded command; empty steps need no shell inference
+ * @param context - Effective shell, runner, and merged environment metadata
+ * @returns Why static POSIX execution is unproved, or undefined when proved
+ */
+export declare const nightlyGuardPosixContextFailure: (run: string, context: NightlyGuardRuntimeContext) => string | undefined;
+//# sourceMappingURL=doctor-nightly-e2e-guard-runtime.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-runtime.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-runtime.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmDH,yEAAyE;AACzE,MAAM,WAAW,0BAA0B;IACzC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD;AAED;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,GAAI,MAAM,MAAM,KAAG,OAEM,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,GACzC,aAAa,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAC7C,MAAM,GAAG,SAOX,CAAC;AAKF;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,GAC1C,KAAK,MAAM,EACX,SAAS,0BAA0B,KAClC,MAAM,GAAG,SAeX,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-runtime.js

@@ -0,0 +1,93 @@
+/**
+ * @file doctor-nightly-e2e-guard-runtime.ts
+ * @description Proven shell and environment constraints for static guard calls
+ * @module cli/doctor-nightly-e2e-guard-runtime
+ */
+const EXECUTION_ENVIRONMENT_NAMES = new Set([
+    "BASHOPTS",
+    "BASH_ENV",
+    "CDPATH",
+    "ENV",
+    "GLOBIGNORE",
+    "IFS",
+    "PATH",
+    "POSIXLY_CORRECT",
+    "SHELLOPTS",
+]);
+const EXECUTION_ENVIRONMENT_PREFIXES = [
+    "BASH_FUNC_",
+    "DYLD_",
+    "LD_",
+    "NIX_LD",
+    "NODE_",
+];
+const GITHUB_HOSTED_POSIX_RUNNER = /^(?:ubuntu-(?:latest|24\.04|22\.04|20\.04)|macos-(?:latest|15|14|13))$/u;
+const EXECUTION_PRESERVING_SHELLS = new Set([
+    "bash",
+    "bash {0}",
+    "bash -e {0}",
+    "bash -eo pipefail {0}",
+    "bash --noprofile --norc -eo pipefail {0}",
+    "sh",
+    "sh {0}",
+    "sh -e {0}",
+    "/bin/bash",
+    "/bin/bash {0}",
+    "/bin/bash -e {0}",
+    "/bin/bash -eo pipefail {0}",
+    "/bin/bash --noprofile --norc -eo pipefail {0}",
+    "/usr/bin/bash",
+    "/usr/bin/bash {0}",
+    "/usr/bin/bash -e {0}",
+    "/usr/bin/bash -eo pipefail {0}",
+    "/usr/bin/bash --noprofile --norc -eo pipefail {0}",
+    "/bin/sh",
+    "/bin/sh {0}",
+    "/bin/sh -e {0}",
+    "/usr/bin/sh",
+    "/usr/bin/sh {0}",
+    "/usr/bin/sh -e {0}",
+]);
+/**
+ * Identify environment controls that can replace or alter Node/shell execution.
+ * @param name - Case-sensitive process environment name from YAML or shell
+ * @returns Whether the name can change how the certified bytes are executed
+ */
+export const isExecutionChangingEnvironmentName = (name) => EXECUTION_ENVIRONMENT_NAMES.has(name) ||
+    EXECUTION_ENVIRONMENT_PREFIXES.some(prefix => name.startsWith(prefix));
+/**
+ * Refuse an effective environment that can turn exact bytes into false proof.
+ * @param environment - Merged environment after YAML precedence is applied
+ * @returns A bounded refusal naming the first dangerous control, when present
+ */
+export const nightlyGuardEnvironmentFailure = (environment) => {
+    const unsafe = Object.keys(environment)
+        .sort((left, right) => left.localeCompare(right))
+        .find(isExecutionChangingEnvironmentName);
+    return unsafe
+        ? `${unsafe} environment control can change or replace certified guard execution`
+        : undefined;
+};
+const normalizedShell = (shell) => shell.trim().split(/\s+/u).join(" ");
+/**
+ * Require either a finite safe shell template or an exact hosted runner label.
+ * @param run - YAML-decoded command; empty steps need no shell inference
+ * @param context - Effective shell, runner, and merged environment metadata
+ * @returns Why static POSIX execution is unproved, or undefined when proved
+ */
+export const nightlyGuardPosixContextFailure = (run, context) => {
+    if (run.trim().length === 0)
+        return undefined;
+    if (context.shell !== undefined) {
+        return typeof context.shell === "string" &&
+            EXECUTION_PRESERVING_SHELLS.has(normalizedShell(context.shell))
+            ? undefined
+            : "step shell is unknown, non-POSIX, or not an execution-preserving bash/sh template";
+    }
+    if (typeof context.runsOn !== "string" ||
+        !GITHUB_HOSTED_POSIX_RUNNER.test(context.runsOn)) {
+        return "runner is self-hosted, array-valued, custom, dynamic, or unknown; an explicit supported POSIX shell is required";
+    }
+    return undefined;
+};
+//# sourceMappingURL=doctor-nightly-e2e-guard-runtime.js.map

package/dist/cli/doctor-nightly-e2e-guard-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-runtime.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-runtime.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,UAAU;IACV,UAAU;IACV,QAAQ;IACR,KAAK;IACL,YAAY;IACZ,KAAK;IACL,MAAM;IACN,iBAAiB;IACjB,WAAW;CACZ,CAAC,CAAC;AACH,MAAM,8BAA8B,GAAG;IACrC,YAAY;IACZ,OAAO;IACP,KAAK;IACL,QAAQ;IACR,OAAO;CACR,CAAC;AAEF,MAAM,0BAA0B,GAC9B,yEAAyE,CAAC;AAE5E,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,MAAM;IACN,UAAU;IACV,aAAa;IACb,uBAAuB;IACvB,0CAA0C;IAC1C,IAAI;IACJ,QAAQ;IACR,WAAW;IACX,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,4BAA4B;IAC5B,+CAA+C;IAC/C,eAAe;IACf,mBAAmB;IACnB,sBAAsB;IACtB,gCAAgC;IAChC,mDAAmD;IACnD,SAAS;IACT,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,oBAAoB;CACrB,CAAC,CAAC;AAYH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,IAAY,EAAW,EAAE,CAC1E,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC;IACrC,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,WAA8C,EAC1B,EAAE;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;SACpC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SAChD,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC5C,OAAO,MAAM;QACX,CAAC,CAAC,GAAG,MAAM,sEAAsE;QACjF,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE,CAChD,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,GAAW,EACX,OAAmC,EACf,EAAE;IACtB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACtC,2BAA2B,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,mFAAmF,CAAC;IAC1F,CAAC;IACD,IACE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClC,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAChD,CAAC;QACD,OAAO,iHAAiH,CAAC;IAC3H,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-scan.d.ts

@@ -0,0 +1,17 @@
+import { MAX_NIGHTLY_GUARD_CALLERS, MAX_NIGHTLY_GUARD_FILES, MAX_NIGHTLY_GUARD_TARGETS, type NightlyGuardScanResult } from "./doctor-nightly-e2e-guard-contract.js";
+import { type NightlyGuardDeadline } from "./doctor-nightly-e2e-guard-deadline.js";
+export { MAX_NIGHTLY_GUARD_CALLERS, MAX_NIGHTLY_GUARD_FILES, MAX_NIGHTLY_GUARD_TARGETS, };
+export type { NightlyGuardCaller, NightlyGuardScanFailure, NightlyGuardScanResult, } from "./doctor-nightly-e2e-guard-contract.js";
+/** Optional shared deadline used by the top-level doctor operation. */
+export interface NightlyGuardScanDependencies {
+    /** Deadline started before discovery; standalone scans receive their own. */
+    readonly deadline?: NightlyGuardDeadline;
+}
+/**
+ * Discover every bypass-bearing guard caller reachable from repository events.
+ * @param projectRoot - Project root whose workflow tree is inspected
+ * @param dependencies - Shared deadline when called by doctor
+ * @returns Deterministic callers, or an explicit unavailable refusal
+ */
+export declare function scanNightlyE2eGuardCallers(projectRoot: string, dependencies?: NightlyGuardScanDependencies): Promise<NightlyGuardScanResult>;
+//# sourceMappingURL=doctor-nightly-e2e-guard-scan.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-scan.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-scan.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,yBAAyB,EAEzB,uBAAuB,EACvB,yBAAyB,EAKzB,KAAK,sBAAsB,EAI5B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,CAAC;AACF,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wCAAwC,CAAC;AAEhD,uEAAuE;AACvE,MAAM,WAAW,4BAA4B;IAC3C,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CAC1C;AA6GD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,sBAAsB,CAAC,CAQjC"}

package/dist/cli/doctor-nightly-e2e-guard-scan.js

@@ -0,0 +1,86 @@
+/**
+ * @file doctor-nightly-e2e-guard-scan.ts
+ * @description Bounded executable-YAML discovery for nightly bypass callers
+ * @module cli/doctor-nightly-e2e-guard-scan
+ */
+import { loadYaml } from "../utils/yaml.js";
+import { MAX_NIGHTLY_GUARD_CALLERS, MAX_NIGHTLY_GUARD_FILE_BYTES, MAX_NIGHTLY_GUARD_FILES, MAX_NIGHTLY_GUARD_TARGETS, MAX_NIGHTLY_GUARD_TOTAL_BYTES, MAX_NIGHTLY_GUARD_WORKFLOW_ID_BYTES, NIGHTLY_GUARD_OPERATION_TIMEOUT_MS, NIGHTLY_GUARD_WORKFLOWS, nightlyGuardObject, orderNightlyGuardStrings, } from "./doctor-nightly-e2e-guard-contract.js";
+import { createNightlyGuardDeadline, } from "./doctor-nightly-e2e-guard-deadline.js";
+import { traceNightlyGuardCallers } from "./doctor-nightly-e2e-guard-graph.js";
+import { readNightlyGuardDirectory, readNightlyGuardFile, } from "./doctor-nightly-e2e-guard-io.js";
+export { MAX_NIGHTLY_GUARD_CALLERS, MAX_NIGHTLY_GUARD_FILES, MAX_NIGHTLY_GUARD_TARGETS, };
+const unavailable = (workflow, reason) => ({
+    state: "unavailable",
+    failures: [{ workflow, reason }],
+});
+const parseWorkflow = (file, name, source) => {
+    try {
+        const document = nightlyGuardObject(loadYaml(source.toString("utf8")));
+        return document
+            ? { file, name, document }
+            : unavailable(file, "workflow YAML root is not a mapping");
+    }
+    catch (error) {
+        return unavailable(file, `workflow is unreadable or malformed (${error instanceof Error ? error.message : String(error)})`);
+    }
+};
+const isScanResult = (value) => "state" in value;
+const hasControlCharacter = (value) => [...value].some(character => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    return codePoint <= 31 || codePoint === 127;
+});
+/**
+ * Read the bounded workflow inventory without following path components.
+ * @param projectRoot - Project containment root
+ * @param deadline - Whole-operation deadline already started by doctor
+ * @returns Parsed inventory or an explicit availability refusal
+ */
+async function readWorkflowRecords(projectRoot, deadline) {
+    const directory = await readNightlyGuardDirectory(projectRoot, NIGHTLY_GUARD_WORKFLOWS, deadline);
+    if (directory.state === "missing")
+        return [];
+    if (directory.state === "unavailable") {
+        return unavailable(NIGHTLY_GUARD_WORKFLOWS, directory.reason);
+    }
+    const names = orderNightlyGuardStrings(directory.names.filter(name => /\.ya?ml$/u.test(name)));
+    if (names.some(name => Buffer.byteLength(name) > MAX_NIGHTLY_GUARD_WORKFLOW_ID_BYTES ||
+        hasControlCharacter(name))) {
+        return unavailable(NIGHTLY_GUARD_WORKFLOWS, `workflow identifier exceeds the ${MAX_NIGHTLY_GUARD_WORKFLOW_ID_BYTES}-byte/control-character limit`);
+    }
+    if (names.length > MAX_NIGHTLY_GUARD_FILES) {
+        return unavailable(NIGHTLY_GUARD_WORKFLOWS, `workflow file limit ${MAX_NIGHTLY_GUARD_FILES} exceeded`);
+    }
+    const readNext = async (index, totalBytes, records) => {
+        const name = names[index];
+        if (name === undefined)
+            return records;
+        const file = `${NIGHTLY_GUARD_WORKFLOWS}/${name}`;
+        const read = await readNightlyGuardFile(projectRoot, file, MAX_NIGHTLY_GUARD_FILE_BYTES, deadline);
+        if (read.state !== "ok")
+            return unavailable(file, read.reason);
+        const nextTotal = totalBytes + read.bytes.length;
+        if (nextTotal > MAX_NIGHTLY_GUARD_TOTAL_BYTES) {
+            return unavailable(file, "workflow scan exceeds the 8 MiB total limit");
+        }
+        const parsed = parseWorkflow(file, name, read.bytes);
+        return isScanResult(parsed)
+            ? parsed
+            : await readNext(index + 1, nextTotal, [...records, parsed]);
+    };
+    return await readNext(0, 0, []);
+}
+/**
+ * Discover every bypass-bearing guard caller reachable from repository events.
+ * @param projectRoot - Project root whose workflow tree is inspected
+ * @param dependencies - Shared deadline when called by doctor
+ * @returns Deterministic callers, or an explicit unavailable refusal
+ */
+export async function scanNightlyE2eGuardCallers(projectRoot, dependencies = {}) {
+    const deadline = dependencies.deadline ??
+        createNightlyGuardDeadline(undefined, NIGHTLY_GUARD_OPERATION_TIMEOUT_MS);
+    const records = await readWorkflowRecords(projectRoot, deadline);
+    return Array.isArray(records)
+        ? traceNightlyGuardCallers(records)
+        : records;
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-scan.js.map

package/dist/cli/doctor-nightly-e2e-guard-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-scan.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-scan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACnC,kCAAkC,EAClC,uBAAuB,EAGvB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EACL,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,CAAC;AAaF,MAAM,WAAW,GAAG,CAClB,QAAgB,EAChB,MAAc,EACU,EAAE,CAAC,CAAC;IAC5B,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CACpB,IAAY,EACZ,IAAY,EACZ,MAAc,EACuC,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,QAAQ;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAChB,IAAI,EACJ,wCAAwC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAClG,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,KAA0D,EACzB,EAAE,CAAC,OAAO,IAAI,KAAK,CAAC;AAEvD,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAW,EAAE,CACrD,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;IAC1B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,SAAS,IAAI,EAAE,IAAI,SAAS,KAAK,GAAG,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,WAAmB,EACnB,QAA8B;IAE9B,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,WAAW,EACX,uBAAuB,EACvB,QAAQ,CACT,CAAC;IACF,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,SAAS,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,uBAAuB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,wBAAwB,CACpC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACvD,CAAC;IACF,IACE,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,EAAE,CACL,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,mCAAmC;QAC7D,mBAAmB,CAAC,IAAI,CAAC,CAC5B,EACD,CAAC;QACD,OAAO,WAAW,CAChB,uBAAuB,EACvB,mCAAmC,mCAAmC,+BAA+B,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC3C,OAAO,WAAW,CAChB,uBAAuB,EACvB,uBAAuB,uBAAuB,WAAW,CAC1D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,EACpB,KAAa,EACb,UAAkB,EAClB,OAA8C,EAG9C,EAAE;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,uBAAuB,IAAI,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACrC,WAAW,EACX,IAAI,EACJ,4BAA4B,EAC5B,QAAQ,CACT,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACjD,IAAI,SAAS,GAAG,6BAA6B,EAAE,CAAC;YAC9C,OAAO,WAAW,CAAC,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,YAAY,CAAC,MAAM,CAAC;YACzB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC;IAEF,OAAO,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,eAA6C,EAAE;IAE/C,MAAM,QAAQ,GACZ,YAAY,CAAC,QAAQ;QACrB,0BAA0B,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3B,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC;QACnC,CAAC,CAAE,OAAkC,CAAC;AAC1C,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @file doctor-nightly-e2e-guard-shell-lexer.ts
+ * @description Bounded comment-aware lexer for the supported guard run grammar
+ * @module cli/doctor-nightly-e2e-guard-shell-lexer
+ */
+/** How a shell word acquired its bytes. */
+type QuoteKind = "unquoted" | "single" | "double" | "mixed";
+/** One decoded shell word retained by the supported grammar. */
+export interface ShellWord {
+    readonly kind: "word";
+    readonly value: string;
+    readonly quote: QuoteKind;
+    /** Shell expansion or unquoted glob syntax prevents exact byte proof. */
+    readonly dynamic: boolean;
+}
+/** One command separator or unsupported shell operator. */
+interface ShellOperator {
+    readonly kind: "operator";
+    readonly value: string;
+}
+/** Bounded lexical token used only by the static interpreter. */
+export type ShellToken = ShellWord | ShellOperator;
+/** Result of lexing one YAML-decoded run scalar. */
+export interface ShellLexResult {
+    readonly tokens?: readonly ShellToken[];
+    readonly reason?: string;
+}
+/**
+ * Lex shell words/operators while applying POSIX comment boundaries.
+ *
+ * `#` begins a comment only outside quotes at the start of a word. The scan is
+ * bounded by the 1 MiB workflow read and a 64-token grammar ceiling.
+ * @param source - YAML-decoded run scalar
+ * @returns Tokens or one fail-closed grammar reason
+ */
+export declare function lexNightlyGuardRun(source: string): ShellLexResult;
+export {};
+//# sourceMappingURL=doctor-nightly-e2e-guard-shell-lexer.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-shell-lexer.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-shell-lexer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,2CAA2C;AAC3C,KAAK,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE5D,gEAAgE;AAChE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,2DAA2D;AAC3D,UAAU,aAAa;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAcnD,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA2KD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAoBjE"}

package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.js

@@ -0,0 +1,160 @@
+/**
+ * @file doctor-nightly-e2e-guard-shell-lexer.ts
+ * @description Bounded comment-aware lexer for the supported guard run grammar
+ * @module cli/doctor-nightly-e2e-guard-shell-lexer
+ */
+const MAX_SHELL_TOKENS = 64;
+const QUOTE_CHARACTERS = ["'", '"'];
+const HORIZONTAL_WHITESPACE = [" ", "\t", "\r"];
+const COMMAND_BOUNDARIES = ["\n", ";"];
+const SHELL_OPERATORS = [">", "<", "&", "|", "(", ")"];
+const quoteFor = (mask) => {
+    if (mask === 2)
+        return "single";
+    if (mask === 4)
+        return "double";
+    if (mask === 0 || mask === 1)
+        return "unquoted";
+    return "mixed";
+};
+const withToken = (state, token) => state.tokens.length >= MAX_SHELL_TOKENS
+    ? {
+        ...state,
+        error: `shell token limit ${MAX_SHELL_TOKENS} exceeded`,
+    }
+    : { ...state, tokens: [...state.tokens, token] };
+const flushWord = (state) => state.word.length === 0
+    ? state
+    : withToken({ ...state, word: "", quoteMask: 0, dynamic: false }, {
+        kind: "word",
+        value: state.word,
+        quote: quoteFor(state.quoteMask),
+        dynamic: state.dynamic,
+    });
+const withOperator = (state, value) => withToken(flushWord(state), { kind: "operator", value });
+const withoutQuote = (state) => ({
+    tokens: state.tokens,
+    word: state.word,
+    quoteMask: state.quoteMask,
+    dynamic: state.dynamic,
+    comment: state.comment,
+    skipNext: state.skipNext,
+    ...(state.error ? { error: state.error } : {}),
+});
+const quotedCharacter = (state, source, character, index) => {
+    if ((character === "'" && state.quote === "single") ||
+        (character === '"' && state.quote === "double")) {
+        return withoutQuote(state);
+    }
+    if (character !== "\\" || state.quote !== "double") {
+        return {
+            ...state,
+            word: `${state.word}${character}`,
+            dynamic: state.dynamic ||
+                (state.quote === "double" && ["$", "`"].includes(character)),
+        };
+    }
+    const next = source[index + 1];
+    if (next === undefined) {
+        return { ...state, error: "unterminated shell escape" };
+    }
+    if (next === "\n")
+        return { ...state, skipNext: true };
+    return ["$", "`", '"', "\\"].includes(next)
+        ? { ...state, word: `${state.word}${next}`, skipNext: true }
+        : { ...state, word: `${state.word}\\` };
+};
+const escapedCharacter = (state, source, index) => {
+    const next = source[index + 1];
+    if (next === undefined) {
+        return { ...state, error: "unterminated shell escape" };
+    }
+    if (next === "\n")
+        return { ...state, skipNext: true };
+    return {
+        ...state,
+        word: `${state.word}${next}`,
+        quoteMask: state.quoteMask | 1,
+        skipNext: true,
+    };
+};
+const quotedStart = (state, character) => {
+    const single = character === "'";
+    return {
+        ...state,
+        quote: single ? "single" : "double",
+        quoteMask: state.quoteMask | (single ? 2 : 4),
+    };
+};
+const ordinaryCharacter = (state, character) => ({
+    ...state,
+    word: `${state.word}${character}`,
+    quoteMask: state.quoteMask | 1,
+    dynamic: state.dynamic || ["$", "`", "*", "?", "[", "~", "{"].includes(character),
+});
+const operatorCharacter = (state, source, character, index) => {
+    const doubled = source[index + 1] === character;
+    return {
+        ...withOperator(state, doubled ? `${character}${character}` : character),
+        skipNext: doubled,
+    };
+};
+const unquotedCharacter = (state, source, character, index) => {
+    if (QUOTE_CHARACTERS.includes(character)) {
+        return quotedStart(state, character);
+    }
+    if (character === "\\")
+        return escapedCharacter(state, source, index);
+    if (character === "#" && state.word.length === 0) {
+        return { ...state, comment: true };
+    }
+    if (HORIZONTAL_WHITESPACE.includes(character))
+        return flushWord(state);
+    if (COMMAND_BOUNDARIES.includes(character)) {
+        return withOperator(state, character);
+    }
+    return SHELL_OPERATORS.includes(character)
+        ? operatorCharacter(state, source, character, index)
+        : ordinaryCharacter(state, character);
+};
+const lexCharacter = (state, source, character, index) => {
+    if (state.error)
+        return state;
+    if (state.skipNext)
+        return { ...state, skipNext: false };
+    if (state.comment) {
+        return character === "\n"
+            ? { ...withOperator(state, "\n"), comment: false }
+            : state;
+    }
+    return state.quote
+        ? quotedCharacter(state, source, character, index)
+        : unquotedCharacter(state, source, character, index);
+};
+/**
+ * Lex shell words/operators while applying POSIX comment boundaries.
+ *
+ * `#` begins a comment only outside quotes at the start of a word. The scan is
+ * bounded by the 1 MiB workflow read and a 64-token grammar ceiling.
+ * @param source - YAML-decoded run scalar
+ * @returns Tokens or one fail-closed grammar reason
+ */
+export function lexNightlyGuardRun(source) {
+    const scanned = source
+        .split("")
+        .reduce((state, character, index) => lexCharacter(state, source, character, index), {
+        tokens: [],
+        word: "",
+        quoteMask: 0,
+        dynamic: false,
+        comment: false,
+        skipNext: false,
+    });
+    const completed = flushWord(scanned);
+    if (completed.error)
+        return { reason: completed.error };
+    return completed.quote
+        ? { reason: "unterminated shell quote" }
+        : { tokens: completed.tokens };
+}
+//# sourceMappingURL=doctor-nightly-e2e-guard-shell-lexer.js.map

package/dist/cli/doctor-nightly-e2e-guard-shell-lexer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-shell-lexer.js","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-shell-lexer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACpC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAChD,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACvC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAyCvD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAa,EAAE;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,KAAsB,EACtB,KAAiB,EACA,EAAE,CACnB,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,gBAAgB;IACrC,CAAC,CAAC;QACE,GAAG,KAAK;QACR,KAAK,EAAE,qBAAqB,gBAAgB,WAAW;KACxD;IACH,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;AAErD,MAAM,SAAS,GAAG,CAAC,KAAsB,EAAmB,EAAE,CAC5D,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;IACrB,CAAC,CAAC,KAAK;IACP,CAAC,CAAC,SAAS,CACP,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EACpD;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CACF,CAAC;AAER,MAAM,YAAY,GAAG,CAAC,KAAsB,EAAE,KAAa,EAAmB,EAAE,CAC9E,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAE3D,MAAM,YAAY,GAAG,CAAC,KAAsB,EAAmB,EAAE,CAAC,CAAC;IACjE,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,SAAS,EAAE,KAAK,CAAC,SAAS;IAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CACtB,KAAsB,EACtB,MAAc,EACd,SAAiB,EACjB,KAAa,EACI,EAAE;IACnB,IACE,CAAC,SAAS,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC/C,CAAC,SAAS,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,EAC/C,CAAC;QACD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO;YACL,GAAG,KAAK;YACR,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,SAAS,EAAE;YACjC,OAAO,EACL,KAAK,CAAC,OAAO;gBACb,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;SAC/D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC5D,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,KAAsB,EACtB,MAAc,EACd,KAAa,EACI,EAAE;IACnB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvD,OAAO;QACL,GAAG,KAAK;QACR,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC;QAC9B,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAClB,KAAsB,EACtB,SAAiB,EACA,EAAE;IACnB,MAAM,MAAM,GAAG,SAAS,KAAK,GAAG,CAAC;IACjC,OAAO;QACL,GAAG,KAAK;QACR,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC9C,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,KAAsB,EACtB,SAAiB,EACA,EAAE,CAAC,CAAC;IACrB,GAAG,KAAK;IACR,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,SAAS,EAAE;IACjC,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC;IAC9B,OAAO,EACL,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;CAC3E,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CACxB,KAAsB,EACtB,MAAc,EACd,SAAiB,EACjB,KAAa,EACI,EAAE;IACnB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC;IAChD,OAAO;QACL,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,KAAsB,EACtB,MAAc,EACd,SAAiB,EACjB,KAAa,EACI,EAAE;IACnB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,SAAS,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC;QACpD,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,KAAsB,EACtB,MAAc,EACd,SAAiB,EACjB,KAAa,EACI,EAAE;IACnB,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,SAAS,KAAK,IAAI;YACvB,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;YAClD,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,KAAK;QAChB,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC;QAClD,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,OAAO,GAAG,MAAM;SACnB,KAAK,CAAC,EAAE,CAAC;SACT,MAAM,CACL,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAC1B,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,EAC/C;QACE,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,EAAE;QACR,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK;KAChB,CACF,CAAC;IACJ,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IACxD,OAAO,SAAS,CAAC,KAAK;QACpB,CAAC,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE;QACxC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;AACnC,CAAC"}

package/dist/cli/doctor-nightly-e2e-guard-shell.d.ts

@@ -0,0 +1,40 @@
+import { type NightlyGuardCommandFileWrite } from "./doctor-nightly-e2e-guard-command-files.js";
+import { type NightlyGuardRuntimeContext } from "./doctor-nightly-e2e-guard-runtime.js";
+/** Supported interpretation of one `run` scalar. */
+export interface NightlyGuardRunInspection {
+    /** Literal target or an environment-resolution refusal. */
+    readonly target?: string;
+    /** Any Node token whose command did not fit the supported grammar. */
+    readonly reason?: string;
+    /** The command is the non-gating contract/report operation. */
+    readonly reportingOnly: boolean;
+    /** A Node command occurred after comment removal. */
+    readonly containsNode: boolean;
+    /** Executable shell construction of bypass state. */
+    readonly bypassWiring?: "inline environment" | "GITHUB_ENV";
+    /** Comment-stripped executable evidence that this step controls bypass. */
+    readonly bypassEvidence: boolean;
+    /** Ordered command-file effects retained for later guard-step attribution. */
+    readonly commandFileWrites?: readonly NightlyGuardCommandFileWrite[];
+}
+/**
+ * Compare bypass vocabulary independently of label case and punctuation.
+ * @param value - Executable expression or literal environment value
+ * @returns Whether the normalized text can denote nightly bypass state
+ */
+export declare const hasNightlyBypassReference: (value: string) => boolean;
+/**
+ * Match the exact environment names implemented by the shipped guard.
+ * @param value - YAML or shell environment name
+ * @returns Whether the name is part of the bounded-waiver contract
+ */
+export declare const isNightlyBypassEnvironmentName: (value: string) => boolean;
+/**
+ * Interpret the supported Node grammar after bounded comment-aware lexing.
+ * @param run - YAML-decoded shell scalar
+ * @param env - Literal YAML environment levels available to this step
+ * @param context - Runner and effective shell metadata proving POSIX semantics
+ * @returns Static target/reporting/refusal and bypass-wiring evidence
+ */
+export declare function inspectNightlyGuardRun(run: string, env: Readonly<Record<string, string>>, context: NightlyGuardRuntimeContext): NightlyGuardRunInspection;
+//# sourceMappingURL=doctor-nightly-e2e-guard-shell.d.ts.map

package/dist/cli/doctor-nightly-e2e-guard-shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-nightly-e2e-guard-shell.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-nightly-e2e-guard-shell.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,6CAA6C,CAAC;AAMrD,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,uCAAuC,CAAC;AAc/C,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,GAAG,YAAY,CAAC;IAC5D,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACtE;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,OAAO,MAAM,KAAG,OAiBzD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,GAAI,OAAO,MAAM,KAAG,OACM,CAAC;AAqMtE;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,OAAO,EAAE,0BAA0B,GAClC,yBAAyB,CA6B3B"}