@codyswann/lisa 4.42.7 → 4.43.0

package/dist/core/github-actions-condition.d.ts

@@ -0,0 +1,78 @@
+/**
+ * A deliberately small evaluator for the subset of GitHub Actions expression
+ * syntax that Lisa's deploy workflows use in a job-level `if:`, plus the rule
+ * that turns the result into "this job RAN" or "this job was SKIPPED".
+ *
+ * It exists because the defect in #3467 is invisible to anything that only
+ * reads the YAML for the presence or absence of a substring. What went wrong
+ * was a job OUTCOME — a deploy that was skipped rather than failed — and an
+ * outcome is what has to be established. Lisa never runs a host's deploy
+ * workflow itself, so no observation of CI can stand in for that; the
+ * expression has to be evaluated against a scenario.
+ *
+ * ## Why this is production code and not a test helper
+ *
+ * It began as one, under `tests/integration/`. It moved here when #3740 needed
+ * the same question answered in a host repository — *would this job skip
+ * because the release failed?* — by `lisa doctor` and by the migration that
+ * repairs an already-seeded `deploy.yml`. Reimplementing GitHub's implicit
+ * `success()` rule a second time in `src/` would have put two subtly different
+ * copies of one semantics in the tree, which is the drift this repository
+ * repeatedly pays for. There is one implementation, and the test that made it
+ * imports it from here.
+ *
+ * The evaluator THROWS on anything outside the supported subset rather than
+ * guessing. An expression it cannot parse must never quietly evaluate to a
+ * plausible-looking boolean: a caller that cannot read a condition must say so,
+ * because reporting a confident verdict about an expression nobody understood
+ * is the failure mode this whole family of checks exists to catch.
+ *
+ * Supported: `&&`, `||`, `!`, `==`, `!=`, parentheses, single-quoted strings,
+ * `true`/`false`, the status functions `always()` / `cancelled()` / `success()`
+ * / `failure()`, the string functions `startsWith()` / `contains()`, and
+ * context paths under `needs.`, `github.` and `inputs.`.
+ * @module core/github-actions-condition
+ */
+/** The four conclusions a `needs` job can report to a dependent job. */
+export type JobResult = "success" | "failure" | "cancelled" | "skipped";
+/** One upstream job as a dependent job sees it. */
+export interface NeedsEntry {
+    readonly result: JobResult;
+    readonly outputs?: Readonly<Record<string, string>>;
+}
+/** The run state a job-level `if:` is evaluated against. */
+export interface RunScenario {
+    readonly needs: Readonly<Record<string, NeedsEntry>>;
+    /** Flattened `github.*` paths, e.g. `github.event.head_commit.message`. */
+    readonly github: Readonly<Record<string, string>>;
+    /** Flattened `inputs.*` values. */
+    readonly inputs?: Readonly<Record<string, string>>;
+    /** Whether an operator cancelled the run. */
+    readonly cancelled: boolean;
+}
+/**
+ * Split an expression into tokens.
+ * @param source - Raw `if:` text, with any `${{ }}` wrapper already stripped
+ * @returns The token list
+ */
+export declare function tokenize(source: string): readonly string[];
+/**
+ * Evaluate a job-level `if:` under one scenario.
+ * @param condition - The raw `if:` text
+ * @param scenario - The run state
+ * @returns Whether the condition holds
+ */
+export declare function evaluateCondition(condition: string, scenario: RunScenario): boolean;
+/**
+ * Whether a job with this `if:` runs, applying GitHub's rule that an implicit
+ * `success()` is ANDed on unless the condition names a status function.
+ *
+ * That implicit AND is the whole mechanism behind the rails half of #3467: the
+ * condition there said nothing about the release at all, and still skipped when
+ * the release failed.
+ * @param condition - The raw `if:` text, or `""` when the job has none
+ * @param scenario - The run state
+ * @returns True when the job runs, false when GitHub skips it
+ */
+export declare function jobRuns(condition: string, scenario: RunScenario): boolean;
+//# sourceMappingURL=github-actions-condition.d.ts.map

package/dist/core/github-actions-condition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-actions-condition.d.ts","sourceRoot":"","sources":["../../src/core/github-actions-condition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,wEAAwE;AACxE,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAExE,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACrD,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,mCAAmC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AA6CD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAO1D;AAyOD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAYT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAYzE"}

package/dist/core/github-actions-condition.js

@@ -0,0 +1,307 @@
+/**
+ * A deliberately small evaluator for the subset of GitHub Actions expression
+ * syntax that Lisa's deploy workflows use in a job-level `if:`, plus the rule
+ * that turns the result into "this job RAN" or "this job was SKIPPED".
+ *
+ * It exists because the defect in #3467 is invisible to anything that only
+ * reads the YAML for the presence or absence of a substring. What went wrong
+ * was a job OUTCOME — a deploy that was skipped rather than failed — and an
+ * outcome is what has to be established. Lisa never runs a host's deploy
+ * workflow itself, so no observation of CI can stand in for that; the
+ * expression has to be evaluated against a scenario.
+ *
+ * ## Why this is production code and not a test helper
+ *
+ * It began as one, under `tests/integration/`. It moved here when #3740 needed
+ * the same question answered in a host repository — *would this job skip
+ * because the release failed?* — by `lisa doctor` and by the migration that
+ * repairs an already-seeded `deploy.yml`. Reimplementing GitHub's implicit
+ * `success()` rule a second time in `src/` would have put two subtly different
+ * copies of one semantics in the tree, which is the drift this repository
+ * repeatedly pays for. There is one implementation, and the test that made it
+ * imports it from here.
+ *
+ * The evaluator THROWS on anything outside the supported subset rather than
+ * guessing. An expression it cannot parse must never quietly evaluate to a
+ * plausible-looking boolean: a caller that cannot read a condition must say so,
+ * because reporting a confident verdict about an expression nobody understood
+ * is the failure mode this whole family of checks exists to catch.
+ *
+ * Supported: `&&`, `||`, `!`, `==`, `!=`, parentheses, single-quoted strings,
+ * `true`/`false`, the status functions `always()` / `cancelled()` / `success()`
+ * / `failure()`, the string functions `startsWith()` / `contains()`, and
+ * context paths under `needs.`, `github.` and `inputs.`.
+ * @module core/github-actions-condition
+ */
+/** The status functions whose presence removes GitHub's implicit `success()`. */
+const STATUS_FUNCTIONS = ["always", "cancelled", "success", "failure"];
+/** The two-character operators, matched before the single-character ones. */
+const PAIR_OPERATORS = ["&&", "||", "==", "!="];
+/**
+ * Read the single token at the head of the text.
+ * @param text - Expression text with leading whitespace already removed
+ * @returns The token, quotes included for a string literal
+ */
+function headToken(text) {
+    if (text.startsWith("'")) {
+        const close = text.indexOf("'", 1);
+        if (close < 0) {
+            throw new Error(`unterminated string in expression: ${text}`);
+        }
+        return text.slice(0, close + 1);
+    }
+    if (PAIR_OPERATORS.includes(text.slice(0, 2))) {
+        return text.slice(0, 2);
+    }
+    if ("()!,".includes(text.slice(0, 1))) {
+        return text.slice(0, 1);
+    }
+    const word = /^[A-Za-z0-9_.-]+/.exec(text)?.[0];
+    if (!word) {
+        throw new Error(`unsupported character '${text.slice(0, 1)}' in expression`);
+    }
+    return word;
+}
+/**
+ * Split an expression into tokens.
+ * @param source - Raw `if:` text, with any `${{ }}` wrapper already stripped
+ * @returns The token list
+ */
+export function tokenize(source) {
+    const text = source.trimStart();
+    if (text === "") {
+        return [];
+    }
+    const token = headToken(text);
+    return [token, ...tokenize(text.slice(token.length))];
+}
+/**
+ * GitHub's string-to-boolean cast: only the empty string is falsy.
+ * @param value - An evaluated operand
+ * @returns Its truthiness
+ */
+function truthy(value) {
+    return typeof value === "boolean" ? value : value !== "";
+}
+/**
+ * GitHub compares strings case-insensitively; every operand here is a string or
+ * a boolean, so a normalized string comparison is the whole rule.
+ * @param left - Left operand
+ * @param right - Right operand
+ * @returns Whether the two are equal
+ */
+function equal(left, right) {
+    return String(left).toLowerCase() === String(right).toLowerCase();
+}
+/**
+ * Resolve one `needs.*` path.
+ * @param segments - The dot-split path
+ * @param scenario - The run state
+ * @returns The value
+ */
+function resolveNeeds(segments, scenario) {
+    const entry = scenario.needs[segments[1] ?? ""];
+    if (!entry) {
+        throw new Error(`expression reads ${segments.join(".")}, absent from needs`);
+    }
+    if (segments[2] === "result") {
+        return entry.result;
+    }
+    if (segments[2] !== "outputs") {
+        throw new Error(`unsupported needs path: ${segments.join(".")}`);
+    }
+    // A job that did not succeed publishes no outputs at all. Modelling that is
+    // load-bearing: `needs.x.outputs.y == 'true'` is the shape that silently
+    // turns an upstream failure into a skipped dependent.
+    return entry.result === "success"
+        ? (entry.outputs?.[segments[3] ?? ""] ?? "")
+        : "";
+}
+/**
+ * Resolve one dotted context path against the scenario.
+ * @param path - A path such as `needs.release.result`
+ * @param scenario - The run state
+ * @returns The value, or `""` for a path that resolves to nothing
+ */
+function resolvePath(path, scenario) {
+    if (path === "true" || path === "false") {
+        return path === "true";
+    }
+    const segments = path.split(".");
+    if (segments[0] === "needs") {
+        return resolveNeeds(segments, scenario);
+    }
+    if (segments[0] === "github") {
+        return scenario.github[path] ?? "";
+    }
+    if (segments[0] === "inputs") {
+        return scenario.inputs?.[segments[1] ?? ""] ?? "";
+    }
+    throw new Error(`unsupported context path: ${path}`);
+}
+/**
+ * Evaluate a call to one of the supported functions.
+ * @param name - Function name
+ * @param args - Already-evaluated arguments
+ * @param scenario - The run state
+ * @returns The call's value
+ */
+function callFunction(name, args, scenario) {
+    const results = Object.values(scenario.needs).map(entry => entry.result);
+    const first = String(args[0] ?? "").toLowerCase();
+    const second = String(args[1] ?? "").toLowerCase();
+    switch (name) {
+        case "always":
+            return true;
+        case "cancelled":
+            return scenario.cancelled;
+        case "success":
+            return !scenario.cancelled && results.every(r => r === "success");
+        case "failure":
+            return results.includes("failure");
+        case "startsWith":
+            return first.startsWith(second);
+        case "contains":
+            return first.includes(second);
+        default:
+            throw new Error(`unsupported function: ${name}()`);
+    }
+}
+/**
+ * Collect and evaluate a function call's arguments.
+ * @param tokens - The token list
+ * @param index - Position just after the opening parenthesis
+ * @param scenario - The run state
+ * @param collected - Arguments parsed so far
+ * @returns The arguments and the position just after the closing parenthesis
+ */
+function callArguments(tokens, index, scenario, collected) {
+    if (tokens[index] === ")") {
+        return { args: collected, index: index + 1 };
+    }
+    const argument = expression(tokens, index, scenario);
+    const next = tokens[argument.index] === "," ? argument.index + 1 : argument.index;
+    return callArguments(tokens, next, scenario, [...collected, argument.value]);
+}
+/**
+ * Parse and evaluate a primary term: a negation, a parenthesized expression, a
+ * string literal, a function call, or a context path.
+ * @param tokens - The token list
+ * @param index - Position of the term's first token
+ * @param scenario - The run state
+ * @returns The term's value and the position after it
+ */
+function primary(tokens, index, scenario) {
+    const token = tokens[index];
+    if (token === undefined) {
+        throw new Error("expression ended early");
+    }
+    if (token === "!") {
+        const inner = primary(tokens, index + 1, scenario);
+        return { value: !truthy(inner.value), index: inner.index };
+    }
+    if (token === "(") {
+        const inner = expression(tokens, index + 1, scenario);
+        if (tokens[inner.index] !== ")") {
+            throw new Error("unbalanced parentheses in expression");
+        }
+        return { value: inner.value, index: inner.index + 1 };
+    }
+    if (token.startsWith("'")) {
+        return { value: token.slice(1, -1), index: index + 1 };
+    }
+    if (tokens[index + 1] === "(") {
+        const call = callArguments(tokens, index + 2, scenario, []);
+        return {
+            value: callFunction(token, call.args, scenario),
+            index: call.index,
+        };
+    }
+    return { value: resolvePath(token, scenario), index: index + 1 };
+}
+/**
+ * Parse and evaluate an equality comparison.
+ * @param tokens - The token list
+ * @param index - Position of the comparison's first token
+ * @param scenario - The run state
+ * @returns The comparison's value and the position after it
+ */
+function comparison(tokens, index, scenario) {
+    const left = primary(tokens, index, scenario);
+    const operator = tokens[left.index];
+    if (operator !== "==" && operator !== "!=") {
+        return left;
+    }
+    const right = primary(tokens, left.index + 1, scenario);
+    const same = equal(left.value, right.value);
+    return { value: operator === "==" ? same : !same, index: right.index };
+}
+/**
+ * Fold the `&&` / `||` operators that follow an already-parsed operand.
+ * @param left - The operand parsed so far
+ * @param tokens - The token list
+ * @param scenario - The run state
+ * @returns The folded value and the position after it
+ */
+function logicalTail(left, tokens, scenario) {
+    const operator = tokens[left.index];
+    if (operator !== "&&" && operator !== "||") {
+        return left;
+    }
+    const right = comparison(tokens, left.index + 1, scenario);
+    const value = operator === "&&"
+        ? truthy(left.value) && truthy(right.value)
+        : truthy(left.value) || truthy(right.value);
+    return logicalTail({ value, index: right.index }, tokens, scenario);
+}
+/**
+ * Parse and evaluate a full expression.
+ * @param tokens - The token list
+ * @param index - Position of the expression's first token
+ * @param scenario - The run state
+ * @returns The expression's value and the position after it
+ */
+function expression(tokens, index, scenario) {
+    return logicalTail(comparison(tokens, index, scenario), tokens, scenario);
+}
+/**
+ * Evaluate a job-level `if:` under one scenario.
+ * @param condition - The raw `if:` text
+ * @param scenario - The run state
+ * @returns Whether the condition holds
+ */
+export function evaluateCondition(condition, scenario) {
+    const stripped = condition
+        .trim()
+        .replace(/^\$\{\{/, "")
+        .replace(/\}\}$/, "")
+        .trim();
+    const tokens = tokenize(stripped);
+    const parsed = expression(tokens, 0, scenario);
+    if (parsed.index !== tokens.length) {
+        throw new Error(`unparsed tail in expression: ${condition}`);
+    }
+    return truthy(parsed.value);
+}
+/**
+ * Whether a job with this `if:` runs, applying GitHub's rule that an implicit
+ * `success()` is ANDed on unless the condition names a status function.
+ *
+ * That implicit AND is the whole mechanism behind the rails half of #3467: the
+ * condition there said nothing about the release at all, and still skipped when
+ * the release failed.
+ * @param condition - The raw `if:` text, or `""` when the job has none
+ * @param scenario - The run state
+ * @returns True when the job runs, false when GitHub skips it
+ */
+export function jobRuns(condition, scenario) {
+    const results = Object.values(scenario.needs).map(entry => entry.result);
+    const dependenciesSucceeded = !scenario.cancelled && results.every(result => result === "success");
+    if (condition.trim() === "") {
+        return dependenciesSucceeded;
+    }
+    const namesStatusFunction = STATUS_FUNCTIONS.some(name => new RegExp(`\\b${name}\\s*\\(`).test(condition));
+    const holds = evaluateCondition(condition, scenario);
+    return namesStatusFunction ? holds : holds && dependenciesSucceeded;
+}
+//# sourceMappingURL=github-actions-condition.js.map

package/dist/core/github-actions-condition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-actions-condition.js","sourceRoot":"","sources":["../../src/core/github-actions-condition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA+BH,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAEhF,6EAA6E;AAC7E,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEhD;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAChC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,KAAY;IAC1B,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,IAAW,EAAE,KAAY;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,QAA2B,EAC3B,QAAqB;IAErB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oBAAoB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,4EAA4E;IAC5E,yEAAyE;IACzE,sDAAsD;IACtD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;QAC/B,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,QAAqB;IACtD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACxC,OAAO,IAAI,KAAK,MAAM,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,IAAY,EACZ,IAAsB,EACtB,QAAqB;IAErB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;QACd,KAAK,WAAW;YACd,OAAO,QAAQ,CAAC,SAAS,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACpE,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC;YACE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,IAAI,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,MAAyB,EACzB,KAAa,EACb,QAAqB,EACrB,SAA2B;IAE3B,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,IAAI,GACR,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvE,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CACd,MAAyB,EACzB,KAAa,EACb,QAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5D,OAAO;YACL,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC/C,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,MAAyB,EACzB,KAAa,EACb,QAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,EAAE,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAClB,IAAY,EACZ,MAAyB,EACzB,QAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI;QACf,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,MAAyB,EACzB,KAAa,EACb,QAAqB;IAErB,OAAO,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAiB,EACjB,QAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS;SACvB,IAAI,EAAE;SACN,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,QAAqB;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,qBAAqB,GACzB,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IACvE,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvD,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAChD,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,qBAAqB,CAAC;AACtE,CAAC"}

package/dist/core/nightly-e2e-guard-behavior-certificate.js

@@ -34,9 +34,9 @@ export const NIGHTLY_E2E_GUARD_BEHAVIOR_CERTIFICATES = Object.freeze({
     }),
     dfd2fef680de5ef03e63075e8a61c62ca4d95cdfdff6201939b79c748d3397f6: Object.freeze({
         contractVersion: "1.9.0",
-        packageVersions: Object.freeze(["4.42.7"]),
+        packageVersions: Object.freeze(["4.43.0"]),
         provenances: Object.freeze([
-            "workspace package @codyswann/lisa@4.42.7 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
+            "workspace package @codyswann/lisa@4.43.0 (typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs)",
         ]),
     }),
 });

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAokFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAuzQjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAskFpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAo0QjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -1148,6 +1148,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/check-shell-guard-refusal-coverage.mjs": "d6b056c4311ea612e85d16ae565a57c5e10c822e87e21d689e12a6cc89dfda3f",
     "scripts/check-state-classification.mjs": "26baaa85c0758fa41f1f66257f7d3a31ea4dd5cf17a9c0acaa3e89caaaf6265a",
     "scripts/check-template-workflow-refs.mjs": "89176394a933d0a42c39ab1805a45e782a2f3e1893d707ac1afb439062397088",
+    "scripts/check-test-case-executed.mjs": "99c4e0f4544f67c920d787fe6a7fb801ac37c591b6392791b4e3d1802bec5359",
     "scripts/check-third-party-action-pins.mjs": "c085949d734edfef2807a95bc7c4814485e30f7bfad4d5054586aa264a5d42b4",
     "scripts/check-typecheck-tests.mjs": "f09e5da1e70b20228c39f6133fc355bcbc8c3af0fb65e1afd100203d862b1b9e",
     "scripts/check-ui-demo-data.mjs": "82a5ed89ae830482dbaab99e2f8eeededcde60a7dd6ac145f191b4ac8394c85b",
@@ -1421,6 +1422,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     ".github/workflows/nightly-e2e-health.yml": true,
     ".github/workflows/nightly-e2e-report.yml": true,
     ".github/workflows/nightly-e2e-tracking.yml": true,
+    ".github/workflows/nightly-tmpdir-growth-benchmark.yml": true,
     ".github/workflows/playwright-e2e.yml": true,
     ".github/workflows/plugins-sync.yml": true,
     ".github/workflows/publish-to-npm.yml": true,
@@ -7350,6 +7352,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "scripts/check-shell-guard-refusal-coverage.mjs": true,
     "scripts/check-state-classification.mjs": true,
     "scripts/check-template-workflow-refs.mjs": true,
+    "scripts/check-test-case-executed.mjs": true,
     "scripts/check-third-party-action-pins.mjs": true,
     "scripts/check-typecheck-tests.mjs": true,
     "scripts/check-ui-demo-data.mjs": true,
@@ -7487,6 +7490,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/cli/doctor-readiness-context.ts": true,
     "src/cli/doctor-readiness-credentials.ts": true,
     "src/cli/doctor-readiness-delivery.ts": true,
+    "src/cli/doctor-readiness-deploy-outcome.ts": true,
     "src/cli/doctor-readiness-domain.ts": true,
     "src/cli/doctor-readiness-guardrails.ts": true,
     "src/cli/doctor-readiness-journey-freshness.ts": true,
@@ -7715,6 +7719,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/core/config.ts": true,
     "src/core/configured-learnings-path.ts": true,
     "src/core/deletion-basis.ts": true,
+    "src/core/deploy-release-dependence.ts": true,
     "src/core/downstream-names.ts": true,
     "src/core/downstream-references.ts": true,
     "src/core/enforcement-census-report.ts": true,
@@ -7724,6 +7729,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/core/gate-declaration-drift.ts": true,
     "src/core/git-service.ts": true,
     "src/core/gitattributes-merge-drivers.ts": true,
+    "src/core/github-actions-condition.ts": true,
     "src/core/guard-capabilities.ts": true,
     "src/core/hook-copy-parity.ts": true,
     "src/core/host-rules-pointer.ts": true,
@@ -7823,7 +7829,10 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/logging/index.ts": true,
     "src/logging/logger.interface.ts": true,
     "src/logging/silent-logger.ts": true,
+    "src/migrations/deploy-outcome-guard-edit.ts": true,
+    "src/migrations/deploy-outcome-guard-yaml.ts": true,
     "src/migrations/ensure-audit-ignore-local-exclusions.ts": true,
+    "src/migrations/ensure-deploy-outcome-guard.ts": true,
     "src/migrations/ensure-jest-rn-mock-accessibility-manager.ts": true,
     "src/migrations/ensure-learnings-gitattributes.ts": true,
     "src/migrations/ensure-learnings-merge-driver.ts": true,
@@ -8139,7 +8148,6 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/integration/deploy-gate-blocks-release.test.ts": true,
     "tests/integration/deploy-moment-evidence.test.ts": true,
     "tests/integration/deploy-moment-runner.test.ts": true,
-    "tests/integration/deploy-outcome-guard-helper.ts": true,
     "tests/integration/deploy-outcome-guard.test.ts": true,
     "tests/integration/doctor-nightly-e2e-guard-cli-helper.ts": true,
     "tests/integration/doctor-nightly-e2e-guard-cli.test.ts": true,
@@ -8331,6 +8339,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/cli/doctor-readiness-delivery-reusable-callers.test.ts": true,
     "tests/unit/cli/doctor-readiness-delivery-triggers.test.ts": true,
     "tests/unit/cli/doctor-readiness-delivery.test.ts": true,
+    "tests/unit/cli/doctor-readiness-deploy-outcome.test.ts": true,
     "tests/unit/cli/doctor-readiness-domain-ephemeral.test.ts": true,
     "tests/unit/cli/doctor-readiness-domain-negatives.test.ts": true,
     "tests/unit/cli/doctor-readiness-domain.test.ts": true,
@@ -8553,6 +8562,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/config/test-run-child-process-analyzer.test.ts": true,
     "tests/unit/config/test-run-supervision-wiring.test.ts": true,
     "tests/unit/config/test-scratch-guard.test.ts": true,
+    "tests/unit/config/tmpdir-growth-benchmark-scheduled.test.ts": true,
     "tests/unit/config/tsconfig-no-unused-flags.test.ts": true,
     "tests/unit/config/tsconfig-template-references.test.ts": true,
     "tests/unit/config/vitest-base.test.ts": true,
@@ -8578,6 +8588,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/apply-mode.test.ts": true,
     "tests/unit/core/bootstrap-environment.test.ts": true,
     "tests/unit/core/deletion-basis.test.ts": true,
+    "tests/unit/core/deploy-release-dependence.test.ts": true,
     "tests/unit/core/enforcement-census-roster.test.ts": true,
     "tests/unit/core/enforcement-census.test.ts": true,
     "tests/unit/core/fs-extra-namespace-callsites.test.ts": true,
@@ -8794,6 +8805,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/hooks/worktree-create.test.ts": true,
     "tests/unit/migrations/ensure-audit-ignore-local-exclusions-esbuild.test.ts": true,
     "tests/unit/migrations/ensure-audit-ignore-local-exclusions.test.ts": true,
+    "tests/unit/migrations/ensure-deploy-outcome-guard.test.ts": true,
     "tests/unit/migrations/ensure-jest-rn-mock-accessibility-manager.test.ts": true,
     "tests/unit/migrations/ensure-learnings-gitattributes.test.ts": true,
     "tests/unit/migrations/ensure-learnings-merge-driver.test.ts": true,
@@ -8885,6 +8897,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/scripts/check-self-dependency-pin.test.ts": true,
     "tests/unit/scripts/check-shell-guard-refusal-coverage.test.ts": true,
     "tests/unit/scripts/check-template-workflow-refs.test.ts": true,
+    "tests/unit/scripts/check-test-case-executed.test.ts": true,
     "tests/unit/scripts/check-third-party-action-pins.test.ts": true,
     "tests/unit/scripts/check-ui-demo-data.test.ts": true,
     "tests/unit/scripts/check-whole-output-guards.test.ts": true,
@@ -9587,6 +9600,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "wiki/decisions/2026-08-12-in-session-ticket-ready-role.md": true,
     "wiki/decisions/2026-08-12-ratchet-policy.md": true,
     "wiki/decisions/2026-08-19-guard-mutation-gate.md": true,
+    "wiki/decisions/2026-09-04-state-change-without-inverse.md": true,
     "wiki/documentation/assets/lisa-architecture.svg": true,
     "wiki/documentation/claude/overinstructions.md": true,
     "wiki/documentation/claude/review.md": true,