@codyswann/lisa 4.34.0 → 4.34.2

package/dist/core/nightly-e2e-pull-request-triggers.js

@@ -0,0 +1,331 @@
+/**
+ * The pull-request activity types a nightly-E2E bypass caller must subscribe to.
+ *
+ * ## The defect this exists for (issues #3476, #3485)
+ *
+ * A nightly-E2E waiver needs TWO pieces of evidence, and the guard re-checks
+ * both on every evaluation: the bypass label, and a `Nightly-E2E-Bypass:
+ * <ticket> <reason>` line in the pull-request BODY. The guard reads both live
+ * from the API at gate time, so it would reject a body that no longer carries
+ * the line — if it ran.
+ *
+ * It does not run. The caller subscribes to `labeled`/`unlabeled`, so deleting
+ * the label re-fires the gate. Nothing subscribes to `edited`, so deleting the
+ * BODY line fires nothing, and the previous SUCCESS check-run stands. A
+ * check-run is point-in-time by construction: no event, no re-read. Measured on
+ * a caller repo in the portfolio: a required check stayed green for 49m47s
+ * while vouching for a waiver that was no longer in the pull request, and the
+ * merge landed inside that window.
+ *
+ * **The reading is current; the reading never happened.** That is why a live
+ * API read in the guard — which the guard already does — cannot fix this, and
+ * why the repair has to be a trigger.
+ *
+ * ## Why the caller, and why a migration
+ *
+ * The reusable workflow is `on: workflow_call`, and a reusable workflow cannot
+ * declare pull-request activity types. The trigger list is therefore only
+ * expressible in the CALLER, which ships from `expo/create-only/` and is marked
+ * "this file is YOURS — Lisa will not overwrite it". A template fix reaches new
+ * adoptions only; every already-seeded repository keeps its original trigger
+ * list permanently. So the migration is the only surface that reaches the
+ * installed base, and `doctor` is the only surface that catches a consumer who
+ * later hand-edits the list back.
+ *
+ * All three read this module, so they cannot disagree about what "armed" means.
+ * @module core/nightly-e2e-pull-request-triggers
+ */
+import { loadYaml } from "../utils/yaml.js";
+/**
+ * The activity type whose absence is the defect.
+ *
+ * A pull-request body rewrite raises `edited` and nothing else.
+ */
+export const BODY_CHANGE_ACTIVITY_TYPE = "edited";
+/**
+ * GitHub's implicit `types:` for `pull_request` when the key is omitted.
+ *
+ * Recorded because the omission is NOT a neutral state: the default set does
+ * not include `edited`, so a caller with no `types:` at all is vulnerable in
+ * exactly the same way as one that lists types and leaves `edited` out. Writing
+ * this list explicitly alongside `edited` is behaviour-preserving — it states
+ * what GitHub was already doing and adds the missing one.
+ */
+export const IMPLICIT_PULL_REQUEST_TYPES = [
+    "opened",
+    "synchronize",
+    "reopened",
+];
+/**
+ * Narrow a parsed value to a mapping.
+ * @param value - Parsed YAML value
+ * @returns The mapping, or undefined for any other shape
+ */
+const asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value
+    : undefined;
+/**
+ * Parse YAML without throwing.
+ * @param source - YAML text
+ * @returns The document, or undefined when it cannot be parsed
+ */
+const parseYaml = (source) => {
+    try {
+        return loadYaml(source);
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * Read the `on:` mapping from a parsed workflow.
+ *
+ * YAML 1.1 resolves a bare `on` key to the BOOLEAN true, which is why js-yaml
+ * can hand back `{ true: {...} }` for a workflow every GitHub runner accepts.
+ * Both spellings are read here; treating only the string one as real would make
+ * this silently answer "no pull_request trigger" for ordinary workflows.
+ * @param document - Parsed workflow document
+ * @returns The `on:` mapping, or undefined when there is none
+ */
+const readOnBlock = (document) => {
+    const root = asRecord(document);
+    if (root === undefined)
+        return undefined;
+    return asRecord(root["on"]) ?? asRecord(root[String(true)]);
+};
+/**
+ * Read a `types:` value as a list of strings.
+ *
+ * A single scalar is a legal spelling of a one-element list, so it is widened
+ * rather than rejected.
+ * @param value - The raw `types:` value
+ * @returns The declared types, or undefined when absent or unreadable
+ */
+const readTypes = (value) => {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === "string")
+        return [value];
+    return Array.isArray(value) && value.every(item => typeof item === "string")
+        ? value
+        : undefined;
+};
+/** The assessment returned whenever no pull-request trigger is readable. */
+const NO_PULL_REQUEST = {
+    armed: false,
+    gap: "pull-request-absent",
+    effectiveTypes: [],
+};
+/**
+ * Decide whether a caller re-evaluates when the pull-request body changes.
+ *
+ * Fails toward "not armed": an unreadable document, a missing `pull_request`
+ * trigger, or a `types:` shape this cannot read all report a gap rather than
+ * claiming the gate is fine. A check that reports "armed" when it means "I
+ * could not tell" is the whole failure mode being repaired here.
+ * @param source - Workflow YAML source
+ * @returns What the trigger list means for body-change re-evaluation
+ */
+export const assessBodyChangeTrigger = (source) => {
+    const onBlock = readOnBlock(parseYaml(source));
+    if (onBlock === undefined || !("pull_request" in onBlock)) {
+        return NO_PULL_REQUEST;
+    }
+    // `pull_request:` with an empty value is a legal shape meaning "the
+    // defaults", so it is the types-absent case rather than an unreadable one.
+    const pullRequest = asRecord(onBlock["pull_request"]);
+    const declared = pullRequest === undefined ? undefined : readTypes(pullRequest["types"]);
+    if (declared === undefined) {
+        return {
+            armed: false,
+            gap: "types-absent",
+            effectiveTypes: IMPLICIT_PULL_REQUEST_TYPES,
+        };
+    }
+    return declared.includes(BODY_CHANGE_ACTIVITY_TYPE)
+        ? { armed: true, effectiveTypes: declared }
+        : { armed: false, gap: "types-omit-edited", effectiveTypes: declared };
+};
+/**
+ * Leading-whitespace width of a line.
+ * @param line - Source line
+ * @returns Number of leading whitespace characters
+ */
+const indentOf = (line) => line.length - line.trimStart().length;
+/**
+ * Whether a line carries no YAML structure.
+ * @param line - Source line
+ * @returns True for blank lines and whole-line comments
+ */
+const isSkippable = (line) => line.trim() === "" || line.trimStart().startsWith("#");
+/**
+ * Replace one line without mutating the original list.
+ * @param lines - Source lines
+ * @param index - Line to replace
+ * @param value - Replacement text
+ * @returns A new list
+ */
+const replaceAt = (lines, index, value) => [
+    ...lines.slice(0, index),
+    value,
+    ...lines.slice(index + 1),
+];
+/**
+ * Insert one line without mutating the original list.
+ * @param lines - Source lines
+ * @param index - Position the new line takes
+ * @param value - Line to insert
+ * @returns A new list
+ */
+const insertAt = (lines, index, value) => [
+    ...lines.slice(0, index),
+    value,
+    ...lines.slice(index),
+];
+/** `types: [a, b]` written inline. */
+const FLOW_TYPES = /^\s*types\s*:\s*\[[^[\]]*\]\s*$/;
+/** `types:` introducing a block sequence. */
+const BLOCK_TYPES = /^\s*types\s*:\s*$/;
+/** A block-sequence item. */
+const SEQUENCE_ITEM = /^\s*-\s/;
+/** The `pull_request:` key, at any depth. */
+const PULL_REQUEST_KEY = /^\s*pull_request\s*:/;
+/**
+ * Index of the `pull_request:` key line, or -1.
+ *
+ * Nested rather than top-level, which is what distinguishes the trigger key
+ * from anything else. A wrong guess cannot produce a wrong file: every rewrite
+ * built on this is verified by re-parsing the result before it is returned.
+ * @param lines - Source lines
+ * @returns Line index, or -1 when there is none
+ */
+const pullRequestKeyIndex = (lines) => lines.findIndex(line => !isSkippable(line) && indentOf(line) > 0 && PULL_REQUEST_KEY.test(line));
+/**
+ * The lines belonging to the block a key introduces.
+ * @param lines - Source lines
+ * @param keyIndex - Index of the key line
+ * @returns The block's lines, in order
+ */
+const blockBody = (lines, keyIndex) => {
+    const owner = indentOf(lines[keyIndex] ?? "");
+    const rest = lines.slice(keyIndex + 1);
+    const end = rest.findIndex(line => !isSkippable(line) && indentOf(line) <= owner);
+    return end === -1 ? rest : rest.slice(0, end);
+};
+/**
+ * Locate the `types:` line belonging to `on.pull_request`.
+ *
+ * Deliberately a line scan rather than a parse-and-re-emit. These files are
+ * consumer-owned and dense with explanatory comments that say WHY each trigger
+ * is present; round-tripping them through a YAML serializer would silently
+ * delete every one of those comments.
+ * @param lines - Source lines
+ * @returns The located declaration, or undefined when the shape is unfamiliar
+ */
+const findPullRequestTypesLine = (lines) => {
+    const keyIndex = pullRequestKeyIndex(lines);
+    if (keyIndex === -1)
+        return undefined;
+    const body = blockBody(lines, keyIndex);
+    const offset = body.findIndex(line => FLOW_TYPES.test(line) || BLOCK_TYPES.test(line));
+    if (offset === -1)
+        return undefined;
+    const index = keyIndex + 1 + offset;
+    return { index, flow: FLOW_TYPES.test(lines[index] ?? "") };
+};
+/**
+ * Add `edited` inside an inline `[...]` list.
+ *
+ * String indexing rather than a regular expression: an unbounded class inside
+ * brackets is the shape that backtracks badly on adversarial input, and this
+ * runs over files Lisa did not write.
+ * @param line - The `types: [...]` line
+ * @returns The line with `edited` appended
+ */
+const appendToFlowList = (line) => {
+    const open = line.indexOf("[");
+    const close = line.indexOf("]", open + 1);
+    if (open === -1 || close === -1)
+        return line;
+    const inner = line.slice(open + 1, close).trimEnd();
+    const extended = inner.trim() === ""
+        ? BODY_CHANGE_ACTIVITY_TYPE
+        : `${inner}, ${BODY_CHANGE_ACTIVITY_TYPE}`;
+    return `${line.slice(0, open + 1)}${extended}${line.slice(close)}`;
+};
+/**
+ * Add `- edited` to a block sequence, matching the style already in use.
+ * @param lines - Source lines
+ * @param located - The `types:` declaration introducing the sequence
+ * @returns The rewritten lines
+ */
+const appendToBlockList = (lines, located) => {
+    const body = blockBody(lines, located.index);
+    const items = body.filter(line => SEQUENCE_ITEM.test(line));
+    const lastOffset = body.reduce((accumulator, line, offset) => SEQUENCE_ITEM.test(line) ? offset : accumulator, -1);
+    const itemIndent = items[0] === undefined
+        ? indentOf(lines[located.index] ?? "") + 2
+        : indentOf(items[0]);
+    return insertAt(lines, located.index + lastOffset + 2, `${" ".repeat(itemIndent)}- ${BODY_CHANGE_ACTIVITY_TYPE}`);
+};
+/**
+ * Write an explicit `types:` under a `pull_request:` that declares none.
+ *
+ * The implicit default omits `edited`, so this case is vulnerable too, and
+ * stating the defaults alongside `edited` is behaviour-preserving rather than a
+ * widening. Only a `pull_request:` that already has a mapping body is extended;
+ * a bare one is left to `doctor`, because inventing a body for it is a guess
+ * about a consumer's intent rather than a repair.
+ * @param lines - Source lines
+ * @returns The rewritten lines, or undefined when no safe insertion exists
+ */
+const insertTypesDeclaration = (lines) => {
+    const keyIndex = pullRequestKeyIndex(lines);
+    if (keyIndex === -1)
+        return undefined;
+    const child = blockBody(lines, keyIndex).find(line => !isSkippable(line));
+    if (child === undefined)
+        return undefined;
+    const declaration = [
+        ...IMPLICIT_PULL_REQUEST_TYPES,
+        BODY_CHANGE_ACTIVITY_TYPE,
+    ];
+    return insertAt(lines, keyIndex + 1, `${" ".repeat(indentOf(child))}types: [${declaration.join(", ")}]`);
+};
+/**
+ * Produce the candidate lines that would arm a caller.
+ * @param lines - Source lines
+ * @returns The rewritten lines, or undefined when no safe edit exists
+ */
+const armedLines = (lines) => {
+    const located = findPullRequestTypesLine(lines);
+    if (located === undefined)
+        return insertTypesDeclaration(lines);
+    return located.flow
+        ? replaceAt(lines, located.index, appendToFlowList(lines[located.index] ?? ""))
+        : appendToBlockList(lines, located);
+};
+/**
+ * Add `edited` to a caller's pull-request trigger list, in place and in style.
+ *
+ * Idempotent, and fails SAFE in both directions: a caller that is already armed
+ * is returned untouched, and a shape this cannot confidently edit is also
+ * returned untouched rather than guessed at. Every rewrite is verified by
+ * re-parsing the result and confirming the gate is now armed — if the surgical
+ * edit did not achieve that, the original source is returned and `doctor`
+ * reports the caller for a human instead. Writing a broken workflow into a
+ * consumer repository would take their gate from half-armed to not running at
+ * all, which is strictly worse than the defect.
+ * @param source - Workflow YAML source
+ * @returns The armed source, or the original when no safe edit exists
+ */
+export const ensureBodyChangeTrigger = (source) => {
+    if (assessBodyChangeTrigger(source).armed)
+        return source;
+    const rewritten = armedLines(source.split("\n"));
+    if (rewritten === undefined)
+        return source;
+    const candidate = rewritten.join("\n");
+    return assessBodyChangeTrigger(candidate).armed ? candidate : source;
+};
+//# sourceMappingURL=nightly-e2e-pull-request-triggers.js.map

package/dist/core/nightly-e2e-pull-request-triggers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nightly-e2e-pull-request-triggers.js","sourceRoot":"","sources":["../../src/core/nightly-e2e-pull-request-triggers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,QAAQ;IACR,aAAa;IACb,UAAU;CACX,CAAC;AAkBF;;;;GAIG;AACH,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAuC,EAAE,CACvE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAClE,CAAC,CAAE,KAAiC;IACpC,CAAC,CAAC,SAAS,CAAC;AAEhB;;;;GAIG;AACH,MAAM,SAAS,GAAG,CAAC,MAAc,EAAW,EAAE;IAC5C,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,GAAG,CAClB,QAAiB,EACoB,EAAE;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,CAAC,KAAc,EAAiC,EAAE;IAClE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC1E,CAAC,CAAE,KAA2B;QAC9B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,eAAe,GAAsB;IACzC,KAAK,EAAE,KAAK;IACZ,GAAG,EAAE,qBAAqB;IAC1B,cAAc,EAAE,EAAE;CACnB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAqB,EAAE;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,IAAI,OAAO,CAAC,EAAE,CAAC;QAC1D,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,oEAAoE;IACpE,2EAA2E;IAC3E,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GACZ,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,cAAc;YACnB,cAAc,EAAE,2BAA2B;SAC5C,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACjD,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE;QAC3C,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,mBAAmB,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AAC3E,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CACxC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;AAExC;;;;GAIG;AACH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAC5C,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,CAChB,KAAwB,EACxB,KAAa,EACb,KAAa,EACM,EAAE,CAAC;IACtB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;IACxB,KAAK;IACL,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;CAC1B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,QAAQ,GAAG,CACf,KAAwB,EACxB,KAAa,EACb,KAAa,EACM,EAAE,CAAC;IACtB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;IACxB,KAAK;IACL,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;CACtB,CAAC;AAUF,sCAAsC;AACtC,MAAM,UAAU,GAAG,iCAAiC,CAAC;AACrD,6CAA6C;AAC7C,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,6BAA6B;AAC7B,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAG,CAAC,KAAwB,EAAU,EAAE,CAC/D,KAAK,CAAC,SAAS,CACb,IAAI,CAAC,EAAE,CACL,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1E,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,SAAS,GAAG,CAChB,KAAwB,EACxB,QAAgB,EACG,EAAE;IACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CACxB,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CACtD,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAG,CAC/B,KAAwB,EACD,EAAE;IACzB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;IACF,IAAI,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC;IACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAU,EAAE;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IACpD,MAAM,QAAQ,GACZ,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QACjB,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,GAAG,KAAK,KAAK,yBAAyB,EAAE,CAAC;IAC/C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACrE,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CACxB,KAAwB,EACxB,OAAkB,EACC,EAAE;IACrB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAC5B,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAC5B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EACjD,CAAC,CAAC,CACH,CAAC;IACF,MAAM,UAAU,GACd,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACpB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC;QAC1C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,QAAQ,CACb,KAAK,EACL,OAAO,CAAC,KAAK,GAAG,UAAU,GAAG,CAAC,EAC9B,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,yBAAyB,EAAE,CAC1D,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,sBAAsB,GAAG,CAC7B,KAAwB,EACO,EAAE;IACjC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,WAAW,GAAG;QAClB,GAAG,2BAA2B;QAC9B,yBAAyB;KAC1B,CAAC;IACF,OAAO,QAAQ,CACb,KAAK,EACL,QAAQ,GAAG,CAAC,EACZ,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,GAAG,CACjB,KAAwB,EACO,EAAE;IACjC,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,IAAI;QACjB,CAAC,CAAC,SAAS,CACP,KAAK,EACL,OAAO,CAAC,KAAK,EACb,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAC7C;QACH,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAU,EAAE;IAChE,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IACzD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,uBAAuB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACvE,CAAC,CAAC"}

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAogFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAknQjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAogFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAunQjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -137,7 +137,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "expo/create-only/.github/workflows/deploy.yml": "a50a7a7fe595bf450cd22b1d1d6d2a733a895d235f2480a9ae1255f57aadc497",
     "expo/create-only/.github/workflows/maestro-e2e.yml": "917d1918f3bff9b4c19db3f9a9bd6fd1d7c5d3db0947dacec3f4797c692632d6",
     "expo/create-only/.github/workflows/nightly-e2e-bypass-reaper.yml": "db78a1012a00cf4e8b023a67bb57566ae85cf790c3856f3e299636c766f0c242",
-    "expo/create-only/.github/workflows/nightly-e2e-health.yml": "89e73a229e1a34f7d9d2926b8a240435db80da3b3842011a1eda09f200a44092",
+    "expo/create-only/.github/workflows/nightly-e2e-health.yml": "1d471dceded3bc74ec7f7703ce5ea6d7913d49a93aabb9fd70a262a12b467f59",
     "expo/create-only/.github/workflows/nightly-e2e-report.yml": "721009809c862b50c4cb5b679307c82cdc1c377914052c323b77d2339c1e6357",
     "expo/create-only/.github/workflows/nightly-e2e-tracking.yml": "3322fe6383df9a966459dd2bf2d0024ab655bf2f59155588b2b2cbbb6acbc62c",
     "expo/create-only/.github/workflows/playwright-e2e.yml": "4910275b5c295719e10baa88e8ddb14fc1082a368f3eecd83f4612abb62821b7",
@@ -7351,6 +7351,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/doctor-lisa-owned-universal.ts": true,
     "src/cli/doctor-merge-drivers.ts": true,
     "src/cli/doctor-monitor-thresholds.ts": true,
+    "src/cli/doctor-nightly-e2e-bypass-arming.ts": true,
     "src/cli/doctor-nightly-e2e-guard-command-files.ts": true,
     "src/cli/doctor-nightly-e2e-guard-contract.ts": true,
     "src/cli/doctor-nightly-e2e-guard-deadline.ts": true,
@@ -7651,6 +7652,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/core/lisa.ts": true,
     "src/core/merge-driver-registration.ts": true,
     "src/core/nightly-e2e-guard-behavior-certificate.ts": true,
+    "src/core/nightly-e2e-pull-request-triggers.ts": true,
     "src/core/override-floors.ts": true,
     "src/core/project-config-kane.ts": true,
     "src/core/project-config-learnings.ts": true,
@@ -8159,6 +8161,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/doctor-lisa-owned-artifacts.test.ts": true,
     "tests/unit/cli/doctor-merge-drivers.test.ts": true,
     "tests/unit/cli/doctor-monitor-thresholds.test.ts": true,
+    "tests/unit/cli/doctor-nightly-e2e-bypass-arming.test.ts": true,
     "tests/unit/cli/doctor-nightly-e2e-guard-deadline.test.ts": true,
     "tests/unit/cli/doctor-nightly-e2e-guard-integration.test.ts": true,
     "tests/unit/cli/doctor-nightly-e2e-guard-proof.test.ts": true,
@@ -8469,6 +8472,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/lisa-owned-templates.test.ts": true,
     "tests/unit/core/lisa-plugin-selection.test.ts": true,
     "tests/unit/core/lisa-skill-sources.test.ts": true,
+    "tests/unit/core/nightly-e2e-pull-request-triggers.test.ts": true,
     "tests/unit/core/no-downstream-project-names.test.ts": true,
     "tests/unit/core/override-floors.test.ts": true,
     "tests/unit/core/packed-learnings-contract.test.ts": true,
@@ -8494,6 +8498,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/upstream-attribution-integrity.test.ts": true,
     "tests/unit/core/workflow-deletion-ownership.test.ts": true,
     "tests/unit/core/workflow-reference-guard.test.ts": true,
+    "tests/unit/detection/cdk-app-shape.test.ts": true,
     "tests/unit/detection/detectors.test.ts": true,
     "tests/unit/docs/onboarding-walkthrough.test.ts": true,
     "tests/unit/governance-contracts.test.ts": true,