@codyswann/lisa 3.12.0 → 3.13.0

package/dist/strategies/copy-overwrite.d.ts

@@ -34,12 +34,39 @@ export declare class CopyOverwriteStrategy implements ICopyStrategy {
      * so the create path would recreate them. Lisa owns those files outright —
      * see `isLisaOwnedTemplate` — so they refresh here, backed up first, and a
      * project that wants to keep its own copy says so in `.lisaignore`.
+     *
+     * That refresh is unconditional only where Lisa can prove the installed copy
+     * is behind. "Differs from mine" is not that proof — it is equally consistent
+     * with the host being *ahead*, which is how `propswapllc/frontend` had a guard
+     * they had hardened themselves silently replaced by a weaker upstream one. So
+     * a Lisa-owned artifact is now classified before it is replaced, and anything
+     * short of proof that it is stale leaves the host's copy alone with an
+     * explanation. See `classifyHostCopy`.
      * @param sourcePath - Packaged template path
      * @param destPath - Installed file path
      * @param relativePath - Repo-relative path for reporting
      * @param context - Strategy context with config and callbacks
-     * @returns Whether the file was refreshed or left out of date
+     * @returns Whether the file was refreshed, preserved, or left out of date
      */
     private applyNonInteractive;
+    /**
+     * Hold back a Lisa-owned refresh that cannot be proved to be an upgrade.
+     *
+     * Returns a result only when the file is being preserved, so the caller falls
+     * through to its normal refresh path in every provably-safe case — a host copy
+     * that matches a past Lisa release still gets replaced, which is what keeps
+     * genuine drift from accumulating forever.
+     *
+     * A read failure is not treated as permission to overwrite. If the installed
+     * bytes cannot be read they cannot be classified, and a classifier that
+     * defaults to "overwrite" when it is confused is the original defect wearing a
+     * different hat.
+     * @param sourcePath - Packaged template path
+     * @param destPath - Installed file path
+     * @param relativePath - Repo-relative path for reporting
+     * @param ledger - Known-good hashes, defaulting to Lisa's shipping history
+     * @returns A `host-ahead` result when the copy is preserved, else undefined
+     */
+    private preserveIfHostAhead;
 }
 //# sourceMappingURL=copy-overwrite.d.ts.map

package/dist/strategies/copy-overwrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copy-overwrite.d.ts","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG9E;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;IAE1C;;;;;;;OAOG;IACG,KAAK,CACT,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,mBAAmB,CAAC;IAuD/B;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,mBAAmB;CAuBlC"}
+{"version":3,"file":"copy-overwrite.d.ts","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAQ7D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG9E;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;IAE1C;;;;;;;OAOG;IACG,KAAK,CACT,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,mBAAmB,CAAC;IAuD/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;YACW,mBAAmB;IAmCjC;;;;;;;;;;;;;;;;;OAiBG;YACW,mBAAmB;CA2BlC"}

package/dist/strategies/copy-overwrite.js

@@ -1,7 +1,8 @@
 import * as fse from "fs-extra";
-import { copyFile } from "node:fs/promises";
+import { copyFile, readFile } from "node:fs/promises";
 import { mayRefreshTemplate } from "../core/config.js";
 import { isLisaOwnedTemplate } from "../core/lisa-owned-templates.js";
+import { classifyHostCopy, describePreserved, mayRefreshLisaOwned, } from "../core/lisa-owned-provenance.js";
 import { filesIdentical, ensureParentDir } from "../utils/file-operations.js";
 /**
  * Copy-overwrite strategy: Replace file if exists (prompts on conflict)
@@ -74,18 +75,32 @@ export class CopyOverwriteStrategy {
      * so the create path would recreate them. Lisa owns those files outright —
      * see `isLisaOwnedTemplate` — so they refresh here, backed up first, and a
      * project that wants to keep its own copy says so in `.lisaignore`.
+     *
+     * That refresh is unconditional only where Lisa can prove the installed copy
+     * is behind. "Differs from mine" is not that proof — it is equally consistent
+     * with the host being *ahead*, which is how `propswapllc/frontend` had a guard
+     * they had hardened themselves silently replaced by a weaker upstream one. So
+     * a Lisa-owned artifact is now classified before it is replaced, and anything
+     * short of proof that it is stale leaves the host's copy alone with an
+     * explanation. See `classifyHostCopy`.
      * @param sourcePath - Packaged template path
      * @param destPath - Installed file path
      * @param relativePath - Repo-relative path for reporting
      * @param context - Strategy context with config and callbacks
-     * @returns Whether the file was refreshed or left out of date
+     * @returns Whether the file was refreshed, preserved, or left out of date
      */
     async applyNonInteractive(sourcePath, destPath, relativePath, context) {
         const { config, backupFile } = context;
-        if (!isLisaOwnedTemplate(relativePath) &&
+        const lisaOwned = isLisaOwnedTemplate(relativePath);
+        if (!lisaOwned &&
             !mayRefreshTemplate(relativePath, config.refreshTemplates)) {
             return { relativePath, strategy: this.name, action: "stale" };
         }
+        if (lisaOwned) {
+            const preserved = await this.preserveIfHostAhead(sourcePath, destPath, relativePath, context.hashLedger);
+            if (preserved !== undefined)
+                return preserved;
+        }
         // Backed up first: opting in to an overwrite is not opting out of being
         // able to undo it.
         if (!config.dryRun) {
@@ -94,5 +109,40 @@ export class CopyOverwriteStrategy {
         }
         return { relativePath, strategy: this.name, action: "overwritten" };
     }
+    /**
+     * Hold back a Lisa-owned refresh that cannot be proved to be an upgrade.
+     *
+     * Returns a result only when the file is being preserved, so the caller falls
+     * through to its normal refresh path in every provably-safe case — a host copy
+     * that matches a past Lisa release still gets replaced, which is what keeps
+     * genuine drift from accumulating forever.
+     *
+     * A read failure is not treated as permission to overwrite. If the installed
+     * bytes cannot be read they cannot be classified, and a classifier that
+     * defaults to "overwrite" when it is confused is the original defect wearing a
+     * different hat.
+     * @param sourcePath - Packaged template path
+     * @param destPath - Installed file path
+     * @param relativePath - Repo-relative path for reporting
+     * @param ledger - Known-good hashes, defaulting to Lisa's shipping history
+     * @returns A `host-ahead` result when the copy is preserved, else undefined
+     */
+    async preserveIfHostAhead(sourcePath, destPath, relativePath, ledger) {
+        const [hostBytes, lisaBytes] = await Promise.all([
+            readFile(destPath).catch(() => undefined),
+            readFile(sourcePath).catch(() => undefined),
+        ]);
+        if (hostBytes === undefined || lisaBytes === undefined)
+            return undefined;
+        const verdict = classifyHostCopy(relativePath, hostBytes, lisaBytes, ledger);
+        if (mayRefreshLisaOwned(verdict))
+            return undefined;
+        return {
+            relativePath,
+            strategy: this.name,
+            action: "host-ahead",
+            note: describePreserved(relativePath, verdict),
+        };
+    }
 }
 //# sourceMappingURL=copy-overwrite.js.map

package/dist/strategies/copy-overwrite.js.map

@@ -1 +1 @@
-{"version":3,"file":"copy-overwrite.js","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,gBAAyB,CAAC;IAE1C;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CACT,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAChC,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,yEAAyE;QACzE,2CAA2C;QAC3C,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,wCAAwC;QACxC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,mBAAmB,CAC7B,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,eAAe,CAC3C,YAAY,EACZ,UAAU,EACV,QAAQ,CACT,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACrC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAEvC,IACE,CAAC,mBAAmB,CAAC,YAAY,CAAC;YAClC,CAAC,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC1D,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAED,wEAAwE;QACxE,mBAAmB;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtE,CAAC;CACF"}
+{"version":3,"file":"copy-overwrite.js","sourceRoot":"","sources":["../../src/strategies/copy-overwrite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,gBAAyB,CAAC;IAE1C;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CACT,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAChC,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,MAAM,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,yEAAyE;QACzE,2CAA2C;QAC3C,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,wCAAwC;QACxC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,mBAAmB,CAC7B,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CACR,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,eAAe,CAC3C,YAAY,EACZ,UAAU,EACV,QAAQ,CACT,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACrC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACtE,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,OAAwB;QAExB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QACvC,MAAM,SAAS,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAEpD,IACE,CAAC,SAAS;YACV,CAAC,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAC1D,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC9C,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,CAAC,UAAU,CACnB,CAAC;YACF,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;QAChD,CAAC;QAED,wEAAwE;QACxE,mBAAmB;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,MAAmB;QAEnB,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACzC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAEzE,MAAM,OAAO,GAAG,gBAAgB,CAC9B,YAAY,EACZ,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;QACF,IAAI,mBAAmB,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QAEnD,OAAO;YACL,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/strategies/strategy.interface.d.ts

@@ -1,4 +1,5 @@
 import type { CopyStrategy, FileOperationResult, LisaConfig } from "../core/config.js";
+import type { HashLedger } from "../core/lisa-owned-provenance.js";
 /**
  * Context for strategy execution
  */
@@ -9,6 +10,18 @@ export interface StrategyContext {
     readonly backupFile: (absolutePath: string) => Promise<void>;
     /** Prompt user for overwrite decision */
     readonly promptOverwrite: (relativePath: string, sourcePath: string, destPath: string) => Promise<boolean>;
+    /**
+     * Known-good hashes proving which contents Lisa has shipped at each path.
+     *
+     * Injected rather than imported so a test can state which bytes count as a
+     * genuine past release. Without that seam a test can only stage invented
+     * content, which the classifier correctly reads as host-modified — so every
+     * "refresh delivers the fix" test would be asserting the upgrade path while
+     * exercising the downgrade-protection path instead.
+     *
+     * Defaults to Lisa's real shipping history when omitted.
+     */
+    readonly hashLedger?: HashLedger;
 }
 /**
  * Interface for copy strategy implementations

package/dist/strategies/strategy.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strategy.interface.d.ts","sourceRoot":"","sources":["../../src/strategies/strategy.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACX,MAAM,mBAAmB,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAE5B,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,yCAAyC;IACzC,QAAQ,CAAC,eAAe,EAAE,CACxB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B;;;;;;;OAOG;IACH,KAAK,CACH,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACjC"}
+{"version":3,"file":"strategy.interface.d.ts","sourceRoot":"","sources":["../../src/strategies/strategy.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAE5B,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,yCAAyC;IACzC,QAAQ,CAAC,eAAe,EAAE,CACxB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B;;;;;;;OAOG;IACH,KAAK,CACH,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACjC"}

package/expo/create-only/.github/workflows/ci.yml

@@ -1,3 +1,6 @@
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 name: 🔍 CI Quality Checks
 
 on:

package/expo/create-only/.github/workflows/deploy.yml

@@ -1,4 +1,5 @@
-# This file is created by Lisa (create-only — edit freely, Lisa won't overwrite it).
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
 
 # This is an example deployment workflow that demonstrates the recommended pattern:
 # 1. Call the release.yml workflow to create a release

package/expo/create-only/.github/workflows/maestro-e2e.yml

@@ -1,3 +1,6 @@
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 name: 📱 Maestro Native E2E
 
 # Native (iOS + Android) e2e suite on GitHub-hosted runners — the

package/expo/create-only/.github/workflows/nightly-e2e-bypass-reaper.yml

@@ -1,3 +1,6 @@
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 name: 🧹 Nightly E2E Bypass Reaper
 
 # Removes a used `nightly-e2e-bypass` label when its pull request closes.

package/expo/create-only/.github/workflows/nightly-e2e-health.yml

@@ -1,3 +1,6 @@
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 name: 🌙 Nightly E2E Health
 
 # The blocking half of the nightly e2e standard.

package/expo/create-only/.github/workflows/nightly-e2e-report.yml

@@ -1,3 +1,6 @@
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 name: 🌙 Nightly E2E Report
 
 # The REPORTING half of the nightly e2e standard, and the companion to

package/expo/create-only/babel.config.js

@@ -1,3 +1,6 @@
+// Seeded by Lisa on first setup — this file is YOURS.
+// Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 /**
  * Babel Configuration
  *

package/expo/create-only/jest.config.local.ts

@@ -1,3 +1,6 @@
+// Seeded by Lisa on first setup — this file is YOURS.
+// Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 /**
  * Jest Configuration - Project-Local Customizations
  *

package/expo/create-only/jest.config.react-native-mock.js

@@ -1,3 +1,6 @@
+// Seeded by Lisa on first setup — this file is YOURS.
+// Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 /**
  * React Native TurboModule Mock Configuration
  *

package/expo/create-only/jest.setup.local.ts

@@ -1,3 +1,6 @@
+// Seeded by Lisa on first setup — this file is YOURS.
+// Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 /**
  * Jest Setup - Project-Local Customizations
  *

package/expo/create-only/jest.setup.pre.local.js

@@ -1,3 +1,6 @@
+// Seeded by Lisa on first setup — this file is YOURS.
+// Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 /**
  * Jest Pre-Setup - Project-Local Customizations
  *

package/expo/create-only/scripts/zap-baseline.sh

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 # OWASP ZAP Baseline Scan — Expo Web Export
 # Builds the Expo web export, serves it locally, and runs a ZAP baseline scan via Docker.
 # Outputs an HTML report to zap-report.html in the project root.

package/harper-fabric/create-only/.github/workflows/deploy.yml

@@ -1,3 +1,6 @@
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 # This file is create-only from Lisa.
 # Customize it for your Harper Fabric target; Lisa will not overwrite it.
 

package/harper-fabric/create-only/.github/workflows/zap-baseline.yml

@@ -1,3 +1,6 @@
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 # This file is create-only from Lisa.
 # Customize the target URL and rules for your Harper Fabric app.
 

package/harper-fabric/create-only/scripts/zap-baseline.sh

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 # OWASP ZAP Baseline Scan - Harper Fabric app
 # Builds the Harper app, starts it locally when no deployed target is supplied,
 # and runs a ZAP baseline scan via Docker.

package/nestjs/create-only/.github/workflows/deploy.yml

@@ -1,3 +1,6 @@
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 # This is an example deployment workflow that demonstrates the recommended pattern:
 # 1. Call the release.yml workflow to create a release
 # 2. Implement your custom deployment logic

package/nestjs/create-only/scripts/zap-baseline.sh

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 # OWASP ZAP Baseline Scan — NestJS GraphQL API
 # Builds and starts the NestJS server, then runs a ZAP baseline scan via Docker.
 # Outputs an HTML report to zap-report.html in the project root.

package/nestjs/create-only/vitest.config.local.ts

@@ -1,3 +1,6 @@
+// Seeded by Lisa on first setup — this file is YOURS.
+// Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
+
 /**
  * Vitest Configuration - Project-Local Customizations
  *

package/npm-package/create-only/.github/workflows/publish-to-npm.yml

@@ -1,4 +1,5 @@
-# This file was created by Lisa on first setup.
+# Seeded by Lisa on first setup — this file is YOURS.
+# Lisa will not overwrite it. (copy-overwrite assets ARE replaced each run.)
 # You can customize this file — Lisa will not overwrite it.
 
 # Reusable workflow for publishing to npm with OIDC trusted publishing

package/package.json

@@ -35,6 +35,8 @@
     "check:learnings-budget": "bun scripts/check-learnings-budget.ts",
     "build:upstream-evidence-manifest": "node scripts/generate-upstream-evidence-manifest.mjs",
     "check:upstream-evidence-manifest": "node scripts/generate-upstream-evidence-manifest.mjs --check",
+    "build:lisa-owned-hash-ledger": "node scripts/generate-lisa-owned-hash-ledger.mjs",
+    "check:lisa-owned-hash-ledger": "node scripts/generate-lisa-owned-hash-ledger.mjs --check",
     "refresh:upstream-public-commits": "node scripts/generate-upstream-evidence-manifest.mjs --refresh-public-commits",
     "check:rules-pairing": "bash scripts/check-rules-pairing.sh",
     "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
@@ -122,7 +124,7 @@
     }
   },
   "name": "@codyswann/lisa",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-no-verify.sh

@@ -5,9 +5,22 @@
 # check. See feedback_never_no_verify in user memory.
 #
 # Blocked bypass vectors:
-#   1. the --no-verify long flag (any subcommand, any position, incl. subshells);
+#   1. --no-verify, and any prefix abbreviation git would accept for it;
 #   2. HUSKY=0 / HUSKY_SKIP_HOOKS=... — disables husky-managed git hooks;
-#   3. core.hooksPath pointed at /dev/null or set empty — disables ALL git hooks.
+#   3. core.hooksPath pointed anywhere but an allowlisted in-repo hooks dir;
+#   4. --config-env=core.hooksPath=VAR, in both the one- and two-token spellings;
+#   5. GIT_CONFIG_KEY_<n>=core.hooksPath env-var-style command-scope config.
+#
+# The line below is what lets `lisa apply` tell a downstream copy of this guard
+# that is BEHIND from one that is AHEAD. Byte comparison cannot: both look like
+# "differs from mine", and guessing "behind" is how a fork's stronger guard gets
+# silently replaced by a weaker upstream one. Refresh compares the two declared
+# sets, and refuses to overwrite a copy declaring anything this one does not.
+#
+# Add a name here in the same commit that closes a vector. A hardening that
+# forgets to is invisible to refresh, and shows up as an unexplained diff at
+# review time instead of a named capability.
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-no-verify.sh

@@ -5,9 +5,22 @@
 # check. See feedback_never_no_verify in user memory.
 #
 # Blocked bypass vectors:
-#   1. the --no-verify long flag (any subcommand, any position, incl. subshells);
+#   1. --no-verify, and any prefix abbreviation git would accept for it;
 #   2. HUSKY=0 / HUSKY_SKIP_HOOKS=... — disables husky-managed git hooks;
-#   3. core.hooksPath pointed at /dev/null or set empty — disables ALL git hooks.
+#   3. core.hooksPath pointed anywhere but an allowlisted in-repo hooks dir;
+#   4. --config-env=core.hooksPath=VAR, in both the one- and two-token spellings;
+#   5. GIT_CONFIG_KEY_<n>=core.hooksPath env-var-style command-scope config.
+#
+# The line below is what lets `lisa apply` tell a downstream copy of this guard
+# that is BEHIND from one that is AHEAD. Byte comparison cannot: both look like
+# "differs from mine", and guessing "behind" is how a fork's stronger guard gets
+# silently replaced by a weaker upstream one. Refresh compares the two declared
+# sets, and refuses to overwrite a copy declaring anything this one does not.
+#
+# Add a name here in the same commit that closes a vector. A hardening that
+# forgets to is invisible to refresh, and shows up as an unexplained diff at
+# review time instead of a named capability.
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/block-no-verify.sh

@@ -5,9 +5,22 @@
 # check. See feedback_never_no_verify in user memory.
 #
 # Blocked bypass vectors:
-#   1. the --no-verify long flag (any subcommand, any position, incl. subshells);
+#   1. --no-verify, and any prefix abbreviation git would accept for it;
 #   2. HUSKY=0 / HUSKY_SKIP_HOOKS=... — disables husky-managed git hooks;
-#   3. core.hooksPath pointed at /dev/null or set empty — disables ALL git hooks.
+#   3. core.hooksPath pointed anywhere but an allowlisted in-repo hooks dir;
+#   4. --config-env=core.hooksPath=VAR, in both the one- and two-token spellings;
+#   5. GIT_CONFIG_KEY_<n>=core.hooksPath env-var-style command-scope config.
+#
+# The line below is what lets `lisa apply` tell a downstream copy of this guard
+# that is BEHIND from one that is AHEAD. Byte comparison cannot: both look like
+# "differs from mine", and guessing "behind" is how a fork's stronger guard gets
+# silently replaced by a weaker upstream one. Refresh compares the two declared
+# sets, and refuses to overwrite a copy declaring anything this one does not.
+#
+# Add a name here in the same commit that closes a vector. A hardening that
+# forgets to is invisible to refresh, and shows up as an unexplained diff at
+# review time instead of a named capability.
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.12.0",
+  "version": "3.13.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"