clud-bug 0.7.0-rc.23 → 0.7.0-rc.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/dist/cli/post-check-run.d.ts.map +1 -1
  2. package/dist/cli/post-check-run.js +83 -9
  3. package/dist/cli/post-check-run.js.map +1 -1
  4. package/dist/core/version.d.ts +1 -1
  5. package/dist/core/version.js +1 -1
  6. package/package.json +1 -1
  7. package/src/cli/post-check-run.ts +93 -9
  8. package/src/core/version.ts +1 -1
  9. package/templates/workflow-py.yml.tmpl +1 -1
  10. package/templates/workflow-ts.yml.tmpl +1 -1
  11. package/templates/workflow.yml.tmpl +1 -1
package/dist/cli/post-check-run.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"post-check-run.d.ts","sourceRoot":"","sources":["../../src/cli/post-check-run.ts"],"names":[],"mappings":"AAgCA,UAAU,gBAAgB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;CACd;AAoHD,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgG3E"}
1
+ {"version":3,"file":"post-check-run.d.ts","sourceRoot":"","sources":["../../src/cli/post-check-run.ts"],"names":[],"mappings":"AAgCA,UAAU,gBAAgB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;CACd;AAwMD,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgG3E"}
package/dist/cli/post-check-run.js CHANGED
@@ -43,20 +43,78 @@ function loadDiffFiles(bundle) {
43
43
  }
44
44
  return raw ? splitUnifiedDiff(raw) : [];
45
45
  }
46
+ /**
47
+ * Mint the single-use nonce (Z4 ① replay-closure) the notary requires before it
48
+ * will certify a bundle: `POST {repo, pr, head_sha}` to `/notarize/challenge`
49
+ * (a sub-path of `/notarize`, matching the server route), expect `{ nonce }`.
50
+ * Classified like `/notarize` — a 4xx is the server AUTHORITATIVELY
51
+ * declining (terminal), a 5xx/network error just means the endpoint is DOWN
52
+ * (fallback to the self-attested check) — EXCEPT 402 (not-entitled): that's not
53
+ * a decline of THIS bundle, it's "this install can't be notarized at all", so it
54
+ * gets a loud warning explaining why the check is unnotarized and falls back
55
+ * rather than blocking the review with a bare rejection.
56
+ */
57
+ async function fetchChallenge(notaryUrl, bundle, warn) {
58
+ const url = notaryUrl.replace(/\/+$/, '') + '/notarize/challenge';
59
+ let res;
60
+ try {
61
+ res = await fetch(url, {
62
+ method: 'POST',
63
+ headers: { 'content-type': 'application/json' },
64
+ body: JSON.stringify({ repo: bundle.repo, pr: bundle.pr, head_sha: bundle.head_sha }),
65
+ });
66
+ }
67
+ catch (e) {
68
+ warn(`notary challenge endpoint unreachable (${e instanceof Error ? e.message : String(e)}); falling back to the self-attested check.`);
69
+ return 'fallback';
70
+ }
71
+ if (res.status === 402) {
72
+ warn([
73
+ 'this review is NOT notarized — no independent check verified it; the',
74
+ 'merge check is self-attested only.',
75
+ 'Install the clud-bug App / upgrade to certify: https://cludbug.dev',
76
+ ].join('\n'));
77
+ return 'fallback';
78
+ }
79
+ if (notaryResponseIsRejection(res.status)) {
80
+ warn(`notary declined the challenge (HTTP ${res.status}); not certifying.`);
81
+ return 'rejected';
82
+ }
83
+ if (!res.ok) {
84
+ warn(`notary challenge endpoint unavailable (HTTP ${res.status}); falling back to the self-attested check.`);
85
+ return 'fallback';
86
+ }
87
+ let body;
88
+ try {
89
+ body = await res.json();
90
+ }
91
+ catch (e) {
92
+ warn(`notary challenge response was not valid JSON (${e instanceof Error ? e.message : String(e)}); falling back to the self-attested check.`);
93
+ return 'fallback';
94
+ }
95
+ const nonce = body && typeof body === 'object' ? body['nonce'] : undefined;
96
+ if (typeof nonce !== 'string' || !nonce) {
97
+ warn('notary challenge response is missing a nonce; falling back to the self-attested check.');
98
+ return 'fallback';
99
+ }
100
+ return { nonce };
101
+ }
46
102
  /**
47
103
  * The notary submit path (Phase Z). Reads + parses the bundle, LOCALLY
48
104
  * re-validates it (the handshake — a deterministic program refusing to certify
49
- * an inconsistent/ungrounded review), then POSTs to the notary. The server (Z4)
50
- * re-validates ①–⑤ against GitHub and — as SOLE issuer — posts the pinned check.
105
+ * an inconsistent/ungrounded review), mints a challenge nonce, then POSTs to the
106
+ * notary. The server (Z4) re-validates ①–⑤ against GitHub and — as SOLE issuer —
107
+ * posts the pinned check.
51
108
  *
52
109
  * Outcomes:
53
110
  * 'posted' — the notary accepted; the SERVER owns the check, do not self-post.
54
111
  * 'rejected' — the certification is definitively refused (malformed / inconsistent /
55
- * ungrounded bundle, OR a server 4xx AUTHORITATIVELY declining). Post
56
- * NO check — never a false green off a bad artifact or over a server "no".
57
- * 'fallback' — the endpoint is DOWN (network error or 5xx), not a verdict; the caller
58
- * may self-post the self-attested check (derived from THIS bundle) so local
59
- * max mode keeps gating while Z4 is pending.
112
+ * ungrounded bundle, OR a server 4xx AUTHORITATIVELY declining, on either
113
+ * `/challenge` or `/notarize`). Post NO check — never a false green off a
114
+ * bad artifact or over a server "no".
115
+ * 'fallback' — the endpoint is DOWN (network error or 5xx) or NOT ENTITLED (402), not a
116
+ * verdict; the caller may self-post the self-attested check (derived from
117
+ * THIS bundle) so local max mode keeps gating while Z4 is pending.
60
118
  */
61
119
  async function submitToNotary(notaryUrl, bundlePath, warn) {
62
120
  let bundle;
@@ -90,8 +148,24 @@ async function submitToNotary(notaryUrl, bundlePath, warn) {
90
148
  return { outcome: 'rejected', bundle };
91
149
  }
92
150
  }
93
- // Submit. TODO(Z4): the server mints/consumes the nonce, re-fetches GitHub's
94
- // ground-truth diff, re-runs ①–⑤, signs, and posts the pinned check.
151
+ // The notary certifies a PR head (it re-fetches GitHub's PR diff), so a
152
+ // pr-less bundle (a commit-trigger local pre-notarization, no PR yet) can't be
153
+ // notarized — don't waste a challenge on a guaranteed 422; self-attest instead.
154
+ if (bundle.pr == null) {
155
+ warn('bundle has no PR — the notary certifies PR heads; using the self-attested check.');
156
+ return { outcome: 'fallback', bundle };
157
+ }
158
+ // Mint the single-use nonce (① replay-closure) before certifying. A terminal
159
+ // decline here (bad request / not-entitled) never reaches `/notarize`; only a
160
+ // minted nonce does.
161
+ const challenge = await fetchChallenge(notaryUrl, bundle, warn);
162
+ if (challenge === 'rejected')
163
+ return { outcome: 'rejected', bundle };
164
+ if (challenge === 'fallback')
165
+ return { outcome: 'fallback', bundle };
166
+ bundle.nonce = challenge.nonce;
167
+ // Submit. The server re-fetches GitHub's ground-truth diff, re-runs ①–⑤,
168
+ // checks + consumes the nonce, signs, and posts the pinned check.
95
169
  const url = notaryUrl.replace(/\/+$/, '') + '/notarize';
96
170
  try {
97
171
  const res = await fetch(url, {
package/dist/cli/post-check-run.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"post-check-run.js","sourceRoot":"","sources":["../../src/cli/post-check-run.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,iEAAiE;AACjE,EAAE;AACF,SAAS;AACT,qFAAqF;AACrF,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,6EAA6E;AAC7E,iFAAiF;AAEjF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,GAG1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAkB3C,SAAS,EAAE,CAAC,GAAW,EAAE,OAAiB,EAAE,KAAc;IACxD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnG,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,MAAoB;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5B,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAUD;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,cAAc,CAC3B,SAAiB,EACjB,UAAkB,EAClB,IAAyB;IAEzB,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,gCAAgC,UAAU,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;QACpH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,iBAAiB,UAAU,0DAA0D,CAAC,CAAC;QAC5F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,IAAI,CAAC,uCAAuC,WAAW,CAAC,MAAM,mBAAmB,CAAC,CAAC;QACnF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACnB,IAAI,CAAC,+DAA+D,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC3H,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,8CAA8C,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC9H,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,MAAM,CAAC,OAAO,kCAAkC,CAAC,CAAC;YACtJ,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QACD,2EAA2E;QAC3E,sDAAsD;QACtD,IAAI,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,oCAAoC,GAAG,CAAC,MAAM,oBAAoB,CAAC,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,4BAA4B,GAAG,CAAC,MAAM,6CAA6C,CAAC,CAAC;QAC1F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC;QAC9H,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAsB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAEpF,0EAA0E;IAC1E,IAAI,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,KAAK,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACnF,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACd,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,8EAA8E;IAC9E,oFAAoF;IACpF,IAAI,cAAc,GAAwB,IAAI,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,SAAS,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAChF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/E,IAAI,OAAO,KAAK,UAAU;YAAE,OAAO;QACnC,6EAA6E;QAC7E,8EAA8E;QAC9E,cAAc,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,yEAAyE;IACzE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACrC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpE,UAAU,GAAI,QAAqC,CAAC,UAAU,KAAK,IAAI,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,OAAO,GAAG,cAAc;QAC5B,CAAC,CAAC,cAAc,CAAC,OAAO;QACxB,CAAC,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,cAAc;QAClC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QACzE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAmB,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnG,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAEnG,yEAAyE;IACzE,IAAI,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,IAAI,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAA4B;QACpC,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,WAAW;QACnB,UAAU;QACV,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KAC3B,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;IAE/E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC;YACnC,KAAK,KAAK,IAAI,SAAS,IAAI,IAAI,IAAI,QAAQ,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;YACrE,aAAa,OAAO,WAAW,UAAU,WAAW,MAAM,iBAAiB,UAAU,IAAI;YACzF,YAAY,KAAK,IAAI,CACxB,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,IAAI,CAAC,8FAA8F,CAAC,CAAC;IAEtI,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,IAAI,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,6DAA6D;QAC7D,IAAI,CAAC,sBAAsB,mBAAmB,WAAW,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,6BAA6B,CAAC,CAAC;QAC/H,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,mBAAmB,MAAM,UAAU,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3G,CAAC"}
1
+ {"version":3,"file":"post-check-run.js","sourceRoot":"","sources":["../../src/cli/post-check-run.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,iEAAiE;AACjE,EAAE;AACF,SAAS;AACT,qFAAqF;AACrF,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,6EAA6E;AAC7E,iFAAiF;AAEjF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,GAG1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAkB3C,SAAS,EAAE,CAAC,GAAW,EAAE,OAAiB,EAAE,KAAc;IACxD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnG,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,MAAoB;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5B,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,CAAC,EAAE;YAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAaD;;;;;;;;;;GAUG;AACH,KAAK,UAAU,cAAc,CAC3B,SAAiB,EACjB,MAAoB,EACpB,IAAyB;IAEzB,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,qBAAqB,CAAC;IAClE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;SACtF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,0CAA0C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC;QACxI,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,CACF;YACE,sEAAsE;YACtE,oCAAoC;YACpC,oEAAoE;SACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,uCAAuC,GAAG,CAAC,MAAM,oBAAoB,CAAC,CAAC;QAC5E,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,+CAA+C,GAAG,CAAC,MAAM,6CAA6C,CAAC,CAAC;QAC7G,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC;QAC/I,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,IAAI,CAAC,wFAAwF,CAAC,CAAC;QAC/F,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,cAAc,CAC3B,SAAiB,EACjB,UAAkB,EAClB,IAAyB;IAEzB,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,gCAAgC,UAAU,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;QACpH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,iBAAiB,UAAU,0DAA0D,CAAC,CAAC;QAC5F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,IAAI,CAAC,uCAAuC,WAAW,CAAC,MAAM,mBAAmB,CAAC,CAAC;QACnF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACnB,IAAI,CAAC,+DAA+D,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC3H,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,8CAA8C,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC9H,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,kFAAkF,CAAC,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,qBAAqB;IACrB,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAChE,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrE,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrE,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAE/B,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,MAAM,CAAC,OAAO,kCAAkC,CAAC,CAAC;YACtJ,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QACD,2EAA2E;QAC3E,sDAAsD;QACtD,IAAI,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,oCAAoC,GAAG,CAAC,MAAM,oBAAoB,CAAC,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,4BAA4B,GAAG,CAAC,MAAM,6CAA6C,CAAC,CAAC;QAC1F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC;QAC9H,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAsB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAEpF,0EAA0E;IAC1E,IAAI,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,KAAK,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACnF,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACd,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,8EAA8E;IAC9E,oFAAoF;IACpF,IAAI,cAAc,GAAwB,IAAI,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,SAAS,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAChF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/E,IAAI,OAAO,KAAK,UAAU;YAAE,OAAO;QACnC,6EAA6E;QAC7E,8EAA8E;QAC9E,cAAc,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,yEAAyE;IACzE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACrC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpE,UAAU,GAAI,QAAqC,CAAC,UAAU,KAAK,IAAI,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,OAAO,GAAG,cAAc;QAC5B,CAAC,CAAC,cAAc,CAAC,OAAO;QACxB,CAAC,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,cAAc;QAClC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QACzE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAmB,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnG,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAEnG,yEAAyE;IACzE,IAAI,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,IAAI,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAA4B;QACpC,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,WAAW;QACnB,UAAU;QACV,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KAC3B,CAAC;IACF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QAAE,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;IAE/E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC;YACnC,KAAK,KAAK,IAAI,SAAS,IAAI,IAAI,IAAI,QAAQ,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;YACrE,aAAa,OAAO,WAAW,UAAU,WAAW,MAAM,iBAAiB,UAAU,IAAI;YACzF,YAAY,KAAK,IAAI,CACxB,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,IAAI,CAAC,8FAA8F,CAAC,CAAC;IAEtI,6EAA6E;IAC7E,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,IAAI,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,6DAA6D;QAC7D,IAAI,CAAC,sBAAsB,mBAAmB,WAAW,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,6BAA6B,CAAC,CAAC;QAC/H,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,mBAAmB,MAAM,UAAU,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3G,CAAC"}
package/dist/core/version.d.ts CHANGED
@@ -1,2 +1,2 @@
1
- export declare const PKG_VERSION = "0.7.0-rc.23";
1
+ export declare const PKG_VERSION = "0.7.0-rc.24";
2
2
  //# sourceMappingURL=version.d.ts.map
package/dist/core/version.js CHANGED
@@ -1,4 +1,4 @@
1
1
  // Generated by scripts/gen-version.mjs at build time. Do not edit.
2
2
  // Regenerated automatically on every `npm run build` via "prebuild" hook.
3
- export const PKG_VERSION = '0.7.0-rc.23';
3
+ export const PKG_VERSION = '0.7.0-rc.24';
4
4
  //# sourceMappingURL=version.js.map
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "clud-bug",
3
- "version": "0.7.0-rc.23",
3
+ "version": "0.7.0-rc.24",
4
4
  "description": "Skill-driven Claude PR review. Ship a brand-voice skill, get brand reviews. Each finding cites the skill that motivated it. CLI installs the workflow + a baseline kit; add more from skills.sh.",
5
5
  "homepage": "https://cludbug.dev",
6
6
  "bugs": "https://github.com/thrillmade/clud-bug/issues",
package/src/cli/post-check-run.ts CHANGED
@@ -81,20 +81,88 @@ interface NotaryResult {
81
81
  bundle: NotaryBundle | null;
82
82
  }
83
83
 
84
+ /** Outcome of the `POST /challenge` round-trip that precedes `/notarize`. */
85
+ type ChallengeResult = { nonce: string } | 'rejected' | 'fallback';
86
+
87
+ /**
88
+ * Mint the single-use nonce (Z4 ① replay-closure) the notary requires before it
89
+ * will certify a bundle: `POST {repo, pr, head_sha}` to `/notarize/challenge`
90
+ * (a sub-path of `/notarize`, matching the server route), expect `{ nonce }`.
91
+ * Classified like `/notarize` — a 4xx is the server AUTHORITATIVELY
92
+ * declining (terminal), a 5xx/network error just means the endpoint is DOWN
93
+ * (fallback to the self-attested check) — EXCEPT 402 (not-entitled): that's not
94
+ * a decline of THIS bundle, it's "this install can't be notarized at all", so it
95
+ * gets a loud warning explaining why the check is unnotarized and falls back
96
+ * rather than blocking the review with a bare rejection.
97
+ */
98
+ async function fetchChallenge(
99
+ notaryUrl: string,
100
+ bundle: NotaryBundle,
101
+ warn: (m: string) => void,
102
+ ): Promise<ChallengeResult> {
103
+ const url = notaryUrl.replace(/\/+$/, '') + '/notarize/challenge';
104
+ let res: Response;
105
+ try {
106
+ res = await fetch(url, {
107
+ method: 'POST',
108
+ headers: { 'content-type': 'application/json' },
109
+ body: JSON.stringify({ repo: bundle.repo, pr: bundle.pr, head_sha: bundle.head_sha }),
110
+ });
111
+ } catch (e) {
112
+ warn(`notary challenge endpoint unreachable (${e instanceof Error ? e.message : String(e)}); falling back to the self-attested check.`);
113
+ return 'fallback';
114
+ }
115
+
116
+ if (res.status === 402) {
117
+ warn(
118
+ [
119
+ 'this review is NOT notarized — no independent check verified it; the',
120
+ 'merge check is self-attested only.',
121
+ 'Install the clud-bug App / upgrade to certify: https://cludbug.dev',
122
+ ].join('\n'),
123
+ );
124
+ return 'fallback';
125
+ }
126
+ if (notaryResponseIsRejection(res.status)) {
127
+ warn(`notary declined the challenge (HTTP ${res.status}); not certifying.`);
128
+ return 'rejected';
129
+ }
130
+ if (!res.ok) {
131
+ warn(`notary challenge endpoint unavailable (HTTP ${res.status}); falling back to the self-attested check.`);
132
+ return 'fallback';
133
+ }
134
+
135
+ let body: unknown;
136
+ try {
137
+ body = await res.json();
138
+ } catch (e) {
139
+ warn(`notary challenge response was not valid JSON (${e instanceof Error ? e.message : String(e)}); falling back to the self-attested check.`);
140
+ return 'fallback';
141
+ }
142
+ const nonce = body && typeof body === 'object' ? (body as Record<string, unknown>)['nonce'] : undefined;
143
+ if (typeof nonce !== 'string' || !nonce) {
144
+ warn('notary challenge response is missing a nonce; falling back to the self-attested check.');
145
+ return 'fallback';
146
+ }
147
+ return { nonce };
148
+ }
149
+
84
150
  /**
85
151
  * The notary submit path (Phase Z). Reads + parses the bundle, LOCALLY
86
152
  * re-validates it (the handshake — a deterministic program refusing to certify
87
- * an inconsistent/ungrounded review), then POSTs to the notary. The server (Z4)
88
- * re-validates ①–⑤ against GitHub and — as SOLE issuer — posts the pinned check.
153
+ * an inconsistent/ungrounded review), mints a challenge nonce, then POSTs to the
154
+ * notary. The server (Z4) re-validates ①–⑤ against GitHub and — as SOLE issuer —
155
+ * posts the pinned check.
89
156
  *
90
157
  * Outcomes:
91
158
  * 'posted' — the notary accepted; the SERVER owns the check, do not self-post.
92
159
  * 'rejected' — the certification is definitively refused (malformed / inconsistent /
93
- * ungrounded bundle, OR a server 4xx AUTHORITATIVELY declining). Post
94
- * NO check — never a false green off a bad artifact or over a server "no".
95
- * 'fallback' — the endpoint is DOWN (network error or 5xx), not a verdict; the caller
96
- * may self-post the self-attested check (derived from THIS bundle) so local
97
- * max mode keeps gating while Z4 is pending.
160
+ * ungrounded bundle, OR a server 4xx AUTHORITATIVELY declining, on either
161
+ * `/challenge` or `/notarize`). Post NO check — never a false green off a
162
+ * bad artifact or over a server "no".
163
+ * 'fallback' — the endpoint is DOWN (network error or 5xx) or NOT ENTITLED (402), not a
164
+ * verdict; the caller may self-post the self-attested check (derived from
165
+ * THIS bundle) so local max mode keeps gating while Z4 is pending.
98
166
  */
99
167
  async function submitToNotary(
100
168
  notaryUrl: string,
@@ -133,8 +201,24 @@ async function submitToNotary(
133
201
  }
134
202
  }
135
203
 
136
- // Submit. TODO(Z4): the server mints/consumes the nonce, re-fetches GitHub's
137
- // ground-truth diff, re-runs ①–⑤, signs, and posts the pinned check.
204
+ // The notary certifies a PR head (it re-fetches GitHub's PR diff), so a
205
+ // pr-less bundle (a commit-trigger local pre-notarization, no PR yet) can't be
206
+ // notarized — don't waste a challenge on a guaranteed 422; self-attest instead.
207
+ if (bundle.pr == null) {
208
+ warn('bundle has no PR — the notary certifies PR heads; using the self-attested check.');
209
+ return { outcome: 'fallback', bundle };
210
+ }
211
+
212
+ // Mint the single-use nonce (① replay-closure) before certifying. A terminal
213
+ // decline here (bad request / not-entitled) never reaches `/notarize`; only a
214
+ // minted nonce does.
215
+ const challenge = await fetchChallenge(notaryUrl, bundle, warn);
216
+ if (challenge === 'rejected') return { outcome: 'rejected', bundle };
217
+ if (challenge === 'fallback') return { outcome: 'fallback', bundle };
218
+ bundle.nonce = challenge.nonce;
219
+
220
+ // Submit. The server re-fetches GitHub's ground-truth diff, re-runs ①–⑤,
221
+ // checks + consumes the nonce, signs, and posts the pinned check.
138
222
  const url = notaryUrl.replace(/\/+$/, '') + '/notarize';
139
223
  try {
140
224
  const res = await fetch(url, {
package/src/core/version.ts CHANGED
@@ -1,3 +1,3 @@
1
1
  // Generated by scripts/gen-version.mjs at build time. Do not edit.
2
2
  // Regenerated automatically on every `npm run build` via "prebuild" hook.
3
- export const PKG_VERSION = '0.7.0-rc.23';
3
+ export const PKG_VERSION = '0.7.0-rc.24';
package/templates/workflow-py.yml.tmpl CHANGED
@@ -413,7 +413,7 @@ jobs:
413
413
  # Strict-mode gate — composite action; see workflow.yml.tmpl for design notes.
414
414
  - name: Strict mode — fail check on critical findings
415
415
  if: success()
416
- uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.7.0-rc.23
416
+ uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.7.0-rc.24
417
417
  with:
418
418
  github-token: ${{ secrets.GITHUB_TOKEN }}
419
419
  # v0.6.22 / 0.0.O: summary now posted by github-actions[bot].
package/templates/workflow-ts.yml.tmpl CHANGED
@@ -413,7 +413,7 @@ jobs:
413
413
  # Strict-mode gate — composite action; see workflow.yml.tmpl for design notes.
414
414
  - name: Strict mode — fail check on critical findings
415
415
  if: success()
416
- uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.7.0-rc.23
416
+ uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.7.0-rc.24
417
417
  with:
418
418
  github-token: ${{ secrets.GITHUB_TOKEN }}
419
419
  # v0.6.22 / 0.0.O: summary now posted by github-actions[bot].
package/templates/workflow.yml.tmpl CHANGED
@@ -717,7 +717,7 @@ jobs:
717
717
  # Letting the action's own failure fail the check is louder and right.
718
718
  - name: Strict mode — fail check on critical findings
719
719
  if: success()
720
- uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.7.0-rc.23
720
+ uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.7.0-rc.24
721
721
  with:
722
722
  github-token: ${{ secrets.GITHUB_TOKEN }}
723
723
  # v0.6.22 / 0.0.O: the summary is now posted by the workflow