fix: support shrunk client payloads on v2-lite

[yeelali14]

Problem

client_payload arrives in one of three shapes — plain JSON, base64(gzip(JSON)), or a small reference to a payload stashed on the resolver. v2-lite read fields out of it with fromJSON(fromJSON(inputs.client_payload)) in four places, which throws on the last two shapes before any step runs.

Why the YAML fix alone is not enough

action.yml deliberately passes CLIENT_PAYLOAD through untouched — the action resolves only the fields needed for step expressions, and the engine inflates the payload. That's intentional: inflated it's ~1.4MB+, so pushing it through a step output would risk E2BIG and defeat the compression entirely.

So the engine has to understand the envelope, and v2-lite's does not:

	engine bundle	decodes shrunk payload?
v2 (2.0.258)	core 2.1.282-6	✅
v2-lite (2.0.211, Jan)	core 2.1.246	❌

Without the bump the checkout steps would succeed and dist/index.js would then fail. Hence two changes.

Changes

1. action.yml — resolve the fields via scripts/resolve-payload-fields.js, as v2 does.
2. Engine bump — @linearb/gitstream-core 2.1.246 → 2.1.301, dist/ rebuilt.

Lite properties preserved

dist/ was rebuilt with this branch's own package script (ncc + copy-wasm) rather than copied from v2 — copying would have broken the thing that makes this branch lite:

this branch  dist/node_modules/ = @wasm-fmt
v2 (2.0.258) dist/node_modules/ = @wasm-fmt @octokit axios lodash moment agent-base asynckit …

Also untouched: the runtime Install Dependencies for plugins step, the absence of NODE_PATH, and the existing action pins — the new step reuses this branch's github-script@v8 rather than importing v2's v9. checkout@v6, upload-artifact@v6, ALL=100 and the git-fetch behaviour are all left as they are.

Verification

• Rebuilt bundle contains oversized-payload-reference, payloadUrl, gunzipSync.
• 66 tests pass (8 suites), lint clean, prettier clean.
• The 7 steps.payload-fields.outputs.* references match the 7 keys emitted.

Known follow-up (not in this PR)

dist/ still carries four orphaned chunk files from the January build — 407/582/788/888.index.js and a root-level ruff_fmt_bg.wasm. The current build emits only 178/880/966/index.js (matching v2 exactly), so these are dead weight on a branch whose point is being lite. Left alone deliberately: deleting build artifacts isn't part of a payload fix, and a smaller diff is easier to review. Worth a separate cleanup.

Separately: this branch's releases have silently no-opped since January because a stray v2-lite tag shadows the v2-lite branch, so git checkout v2-lite in the release job detaches onto the tag and the push is a no-op. That needs fixing before anything here reaches consumers.

🤖 Generated with Claude Code

✨ PR Description

Purpose: Enable v2-lite action version to handle compressed and oversized client payloads through a dedicated payload resolution utility.

Main changes:

• Created resolve-payload-fields.js script supporting plain JSON, gzip-compressed, and server-stashed payload formats with security validation
• Updated action.yml to resolve payload fields via github-script step before checkout, replacing inline JSON parsing
• Upgraded gitstream-core to v2.1.301 and modified main.ts to use v2-lite action version

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Secrets	0   0   0   0	View in Orca

[linearb]

✨ PR Review

The PR is well-structured and correctly addresses the three payload shapes. The resolution script is clean, the security mitigations (origin check, size cap, secret masking) are solid, and the test coverage is thorough. One functional gap stands out in the updated action.yml.

1 issues detected:

🐞 Bug - `steps.payload-fields.outputs.github_token` is now resolved and masked, but the cm repo and cm org checkout steps are not using it — they were not updated alongside the base-branch checkout.

Details: The "Checkout cm repo" and "Checkout cm org" steps do not supply a token field. The entire motivation of this PR is to make the github_token from the payload available to downstream steps — the base-branch checkout was correctly updated to use steps.payload-fields.outputs.github_token || github.token, but the two CM checkouts were not. If either CM repository is private, these steps will fall back to the default GITHUB_TOKEN, which may not have access, silently producing a clone failure or an empty checkout that the engine then processes incorrectly.

File: action.yml (119-133)

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Review using Guidelines Learn how}

[yeelali14]

Closing — not needed. Shrink-payload support is landing on develop/@v2 via #571; v2-lite isn't getting it.