@codyswann/lisa 4.54.13 → 4.55.0

package/dist/cli/doctor-rails-deploy-intent.js

@@ -0,0 +1,197 @@
+/**
+ * `lisa doctor` check: does this Rails project SAY why it does not deploy
+ * production?
+ *
+ * The seed was fixed so a new adoption inherits a deploy workflow that
+ * explains the withheld `main` trigger. That fix reaches new adoptions only:
+ * `rails/create-only/.github/workflows/deploy.yml` is written once and never
+ * refreshed, and the file is host-owned from that moment — the header says so,
+ * and the template invites customisation — so a migration that rewrote it
+ * would break the promise `create-only` makes. Nothing else in Lisa ever looks
+ * at the file again, which left every project seeded before the fix carrying a
+ * bare `# - main` that nobody can tell apart from an oversight, in a
+ * population whose size nobody knows (CodySwannGT/lisa#3743,
+ * CodySwannGT/lisa#3779).
+ *
+ * This check REPORTS and names the remedy. It edits nothing, exactly as the
+ * apply path refuses to.
+ *
+ * The point is that an affected project can find ITSELF, so a probe that
+ * cannot look must never render as a project with nothing to report. Every
+ * filesystem answer is three-valued — present, absent, or undeterminable —
+ * and the last one fails rather than passing quietly. Three statuses for three
+ * different facts: `ok` is nothing to state, `warn` is intent left unstated
+ * (a human decides, on a file Lisa will not touch), and `fail` is this check
+ * being unable to answer at all.
+ * @module cli/doctor-rails-deploy-intent
+ */
+import { readFile, stat } from "node:fs/promises";
+import * as path from "node:path";
+import { classifyProductionDeployIntent } from "../core/rails-deploy-production-intent.js";
+/** Name of the deploy-intent check as doctor reports it. */
+export const RAILS_DEPLOY_INTENT_CHECK_NAME = "Rails production deploy intent stated?";
+/** Repo-relative deploy workflow this template seeds. */
+const DEPLOY_WORKFLOW = ".github/workflows/deploy.yml";
+/**
+ * Markers that identify a Rails checkout, matching the Rails project-type
+ * detector: `bin/rails` first, `config/application.rb` second. Both are
+ * definitive; other Ruby frameworks ship neither.
+ */
+const RAILS_MARKERS = ["bin/rails", "config/application.rb"];
+/**
+ * Errno codes that ANSWER the question rather than refusing it: the path is
+ * genuinely not there. Anything else — a permission denial, an I/O error, a
+ * symlink loop — means the probe could not look, which is a different answer
+ * and must not be spelled the same way.
+ */
+const ABSENT_CODES = new Set(["ENOENT", "ENOTDIR", "ENAMETOOLONG"]);
+/**
+ * The errno code of a rejected filesystem call, when it carries one.
+ * @param error - Value thrown by a filesystem call
+ * @returns The errno code, or undefined when the value carries none
+ */
+function errnoCode(error) {
+    const code = typeof error === "object" && error !== null
+        ? error.code
+        : undefined;
+    return typeof code === "string" ? code : undefined;
+}
+/**
+ * Re-throw a filesystem rejection unless it is a definitive absence.
+ *
+ * `fs-extra`'s `pathExists` resolves false for every failure, including a
+ * permission denial, so a directory this process cannot read would report the
+ * same "not a Rails project" as a Node repo.
+ * @param error - Value thrown by a filesystem call
+ * @param relativePath - Repo-relative path being probed
+ * @throws {Error} When the filesystem declined to answer
+ */
+function rethrowUnlessAbsent(error, relativePath) {
+    const code = errnoCode(error);
+    if (code !== undefined && ABSENT_CODES.has(code))
+        return;
+    throw new Error(`could not read ${relativePath}: ${code ?? String(error)}`, {
+        cause: error,
+    });
+}
+/**
+ * Is this a Rails checkout, REJECTING when the filesystem declines to say?
+ * @param projectRoot - Absolute project root
+ * @returns True when a Rails marker is present
+ * @throws {Error} When a marker can be neither confirmed nor ruled out
+ */
+async function isRailsProject(projectRoot) {
+    for (const marker of RAILS_MARKERS) {
+        try {
+            await stat(path.join(projectRoot, marker));
+            return true;
+        }
+        catch (error) {
+            rethrowUnlessAbsent(error, marker);
+        }
+    }
+    return false;
+}
+/**
+ * Read the deploy workflow, REJECTING when the filesystem declines to say.
+ * @param projectRoot - Absolute project root
+ * @returns Workflow source, or null when the file is provably absent
+ * @throws {Error} When the file exists but could not be read
+ */
+async function readDeployWorkflow(projectRoot) {
+    try {
+        return await readFile(path.join(projectRoot, DEPLOY_WORKFLOW), "utf8");
+    }
+    catch (error) {
+        rethrowUnlessAbsent(error, DEPLOY_WORKFLOW);
+        return null;
+    }
+}
+/**
+ * What an operator has to make true before uncommenting the entry, stated
+ * here because the project's own copy of the workflow is precisely the file
+ * that does not say.
+ */
+const ENABLING_PRECONDITIONS = "a repository secret named `AWS_ACCOUNT_ID_MAIN` holding the production " +
+    "account id (`noliran/branch-based-secrets` expands `AWS_ACCOUNT_ID` to " +
+    "`AWS_ACCOUNT_ID_<BRANCH IN UPPERCASE>`, so without it the account id " +
+    "resolves empty and the deploy fails at the credentials step); a " +
+    "`DeployServiceRole` in that account trusting this repository's OIDC " +
+    "subject; the ECS cluster, services and ECR repositories this workflow " +
+    "names in `env:`, whose names are fixed rather than suffixed per " +
+    "environment; and a `production` environment in the Rails app";
+/** Operator-facing statement of the finding and its remedy. */
+const UNSTATED_DETAIL = `${DEPLOY_WORKFLOW} comments out its \`main\` branch entry with nothing ` +
+    "saying why, so production deployment being off cannot be told apart from " +
+    "a line someone dropped by mistake. Lisa seeded this file once and will " +
+    `not rewrite it. Enabling production needs ${ENABLING_PRECONDITIONS}. ` +
+    "Uncomment `- main` once all four hold; until then, record beside the " +
+    "commented entry that it is deliberate, so the next reader is not left " +
+    "guessing. Production stays reachable by hand meanwhile through this " +
+    "workflow's `workflow_dispatch` trigger";
+/**
+ * Report whether a Rails project's deploy workflow states its production
+ * intent.
+ *
+ * Warns rather than fails on a hit: nothing is broken, and the remedy is a
+ * human decision about a host-owned file. Fails when the question could not
+ * be answered, for the reason in the module note.
+ * @param targetPath - Project path to inspect
+ * @returns Doctor check result
+ */
+export async function checkRailsDeployIntent(targetPath) {
+    try {
+        const root = await stat(targetPath);
+        if (!root.isDirectory()) {
+            throw new Error(`${targetPath} is not a directory`);
+        }
+        if (!(await isRailsProject(targetPath))) {
+            return ok("Not a Rails project");
+        }
+        const workflowText = await readDeployWorkflow(targetPath);
+        if (workflowText === null) {
+            return ok(`No ${DEPLOY_WORKFLOW} in this project`);
+        }
+        return describeIntent(workflowText);
+    }
+    catch (error) {
+        return {
+            name: RAILS_DEPLOY_INTENT_CHECK_NAME,
+            status: "fail",
+            detail: `Could not determine whether ${DEPLOY_WORKFLOW} states its ` +
+                `production deploy intent: ${error instanceof Error ? error.message : String(error)}. Treated as a failure rather than a pass: a workflow that could ` +
+                "not be read is not one with nothing in it",
+        };
+    }
+}
+/**
+ * Turn a parsed workflow into the check line it earns.
+ * @param workflowText - Full deploy workflow source
+ * @returns Doctor check result
+ * @throws {Error} When the workflow cannot be parsed
+ */
+function describeIntent(workflowText) {
+    switch (classifyProductionDeployIntent(workflowText)) {
+        case "triggers":
+            return ok(`${DEPLOY_WORKFLOW} deploys production from \`main\``);
+        case "explained":
+            return ok(`${DEPLOY_WORKFLOW} states why production is withheld`);
+        case "unmentioned":
+            return ok(`${DEPLOY_WORKFLOW} carries no commented-out \`main\` entry`);
+        default:
+            return {
+                name: RAILS_DEPLOY_INTENT_CHECK_NAME,
+                status: "warn",
+                detail: UNSTATED_DETAIL,
+            };
+    }
+}
+/**
+ * A passing line for this check.
+ * @param detail - What was found
+ * @returns Doctor check result
+ */
+function ok(detail) {
+    return { name: RAILS_DEPLOY_INTENT_CHECK_NAME, status: "ok", detail };
+}
+//# sourceMappingURL=doctor-rails-deploy-intent.js.map

package/dist/cli/doctor-rails-deploy-intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-rails-deploy-intent.js","sourceRoot":"","sources":["../../src/cli/doctor-rails-deploy-intent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAG3F,4DAA4D;AAC5D,MAAM,CAAC,MAAM,8BAA8B,GACzC,wCAAwC,CAAC;AAE3C,yDAAyD;AACzD,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAEvD;;;;GAIG;AACH,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,uBAAuB,CAAU,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QACzC,CAAC,CAAE,KAA4B,CAAC,IAAI;QACpC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,KAAc,EAAE,YAAoB;IAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IACzD,MAAM,IAAI,KAAK,CAAC,kBAAkB,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;QAC1E,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,WAAmB;IAC/C,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IACnD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,sBAAsB,GAC1B,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,kEAAkE;IAClE,sEAAsE;IACtE,wEAAwE;IACxE,kEAAkE;IAClE,8DAA8D,CAAC;AAEjE,+DAA+D;AAC/D,MAAM,eAAe,GACnB,GAAG,eAAe,uDAAuD;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,6CAA6C,sBAAsB,IAAI;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,wCAAwC,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,qBAAqB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC,MAAM,eAAe,kBAAkB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,+BAA+B,eAAe,cAAc;gBAC5D,6BACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,mEAAmE;gBACnE,2CAA2C;SAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,YAAoB;IAC1C,QAAQ,8BAA8B,CAAC,YAAY,CAAC,EAAE,CAAC;QACrD,KAAK,UAAU;YACb,OAAO,EAAE,CAAC,GAAG,eAAe,mCAAmC,CAAC,CAAC;QACnE,KAAK,WAAW;YACd,OAAO,EAAE,CAAC,GAAG,eAAe,oCAAoC,CAAC,CAAC;QACpE,KAAK,aAAa;YAChB,OAAO,EAAE,CAAC,GAAG,eAAe,0CAA0C,CAAC,CAAC;QAC1E;YACE,OAAO;gBACL,IAAI,EAAE,8BAA8B;gBACpC,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,eAAe;aACxB,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,EAAE,CAAC,MAAc;IACxB,OAAO,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC"}

package/dist/cli/doctor-seeded-artifacts.d.ts

@@ -0,0 +1,12 @@
+import type { DoctorCheck } from "./doctor.js";
+/**
+ * Run every seeded-artifact check, in the order an operator reads them.
+ *
+ * Sequential rather than concurrent, matching the surrounding checks: they
+ * share a target directory and the report is read top to bottom, so a stable
+ * order is worth more here than the milliseconds.
+ * @param targetPath - Repository root to inspect
+ * @returns One check row per question, in report order
+ */
+export declare function checkSeededArtifacts(targetPath: string): Promise<readonly DoctorCheck[]>;
+//# sourceMappingURL=doctor-seeded-artifacts.d.ts.map

package/dist/cli/doctor-seeded-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-seeded-artifacts.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-seeded-artifacts.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAkBjC"}

package/dist/cli/doctor-seeded-artifacts.js

@@ -0,0 +1,54 @@
+/**
+ * The four checks that ask what Lisa SEEDED into this repository, and whether
+ * what it seeded still says what it meant.
+ *
+ * They are grouped because they are one operator question asked four ways, and
+ * because each of them exists for the same structural reason: the write path
+ * that could have prevented the defect is reached exactly once, before the file
+ * exists. A repository that received the template earlier therefore has no
+ * signal of any kind — the seeding postinstall is skipped under CI, the file is
+ * untracked, and the tool the file disables reports only that it found nothing.
+ * A fix on the write path reaches the NEXT adoption; these four are how an
+ * existing one finds itself.
+ *
+ * `doctor-lisa-owned-artifacts` is the inverse and deliberately stays where it
+ * is: it walks the templates Lisa SHIPS and asks whether this project's copies
+ * are current. A template removed upstream leaves that loop entirely, which is
+ * why `checkStaleManagedBanner` below walks the other direction — the files on
+ * disk that CLAIM Lisa manages them, asking which of those claims the installed
+ * package still backs.
+ * @module cli/doctor-seeded-artifacts
+ */
+import { checkCdkPresetAdoption } from "./doctor-cdk-preset-adoption.js";
+import { checkConfigShadowing } from "./doctor-config-shadowing.js";
+import { checkRailsDeployIntent } from "./doctor-rails-deploy-intent.js";
+import { checkStaleManagedBanner } from "./doctor-stale-managed-banner.js";
+/**
+ * Run every seeded-artifact check, in the order an operator reads them.
+ *
+ * Sequential rather than concurrent, matching the surrounding checks: they
+ * share a target directory and the report is read top to bottom, so a stable
+ * order is worth more here than the milliseconds.
+ * @param targetPath - Repository root to inspect
+ * @returns One check row per question, in report order
+ */
+export async function checkSeededArtifacts(targetPath) {
+    return [
+        // Whether a file Lisa seeded is OUTRANKING one the project wrote itself
+        // (CodySwannGT/lisa#3858).
+        await checkConfigShadowing(targetPath),
+        // Whether a file Lisa is FORBIDDEN to refresh still reads as deliberate.
+        // The seed fix reaches new adoptions only and the apply path will not
+        // rewrite a host-owned workflow (CodySwannGT/lisa#3779).
+        await checkRailsDeployIntent(targetPath),
+        // Whether a whole stack preset was delivered to a repository that never
+        // qualified for it. The detection fix reaches the next decision only, and
+        // the dead-code gate it skewed reports SUCCESS (CodySwannGT/lisa#3711).
+        await checkCdkPresetAdoption(targetPath),
+        // Which "Lisa manages this file" banners the installed package still
+        // backs. A proposal to remove one such orphaned workflow was declined on
+        // the strength of the false banner (CodySwannGT/lisa#3703).
+        await checkStaleManagedBanner(targetPath),
+    ];
+}
+//# sourceMappingURL=doctor-seeded-artifacts.js.map

package/dist/cli/doctor-seeded-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-seeded-artifacts.js","sourceRoot":"","sources":["../../src/cli/doctor-seeded-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAG3E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB;IAElB,OAAO;QACL,wEAAwE;QACxE,2BAA2B;QAC3B,MAAM,oBAAoB,CAAC,UAAU,CAAC;QACtC,yEAAyE;QACzE,sEAAsE;QACtE,yDAAyD;QACzD,MAAM,sBAAsB,CAAC,UAAU,CAAC;QACxC,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,sBAAsB,CAAC,UAAU,CAAC;QACxC,qEAAqE;QACrE,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,uBAAuB,CAAC,UAAU,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-stale-banner-scan.d.ts

@@ -0,0 +1,44 @@
+import type { ShippedTemplateStrategy } from "../core/stale-managed-banner.js";
+/** One entry of a directory listing, reduced to what the scan needs. */
+export interface DirectoryEntry {
+    /** Base name of the entry within its directory. */
+    readonly name: string;
+    /** Whether the entry is a regular file. Symlinks are deliberately not. */
+    readonly isFile: boolean;
+}
+/** How the scan reaches the filesystem, so tests can make it refuse. */
+export interface BannerScanDeps {
+    /**
+     * List one directory, REJECTING when the filesystem declines to say and
+     * resolving to an empty list only when the directory is provably absent.
+     */
+    readonly readDirectory?: (absolute: string) => Promise<readonly DirectoryEntry[]>;
+}
+/**
+ * List a directory, distinguishing "not there" from "could not look".
+ * @param absolute - Absolute directory path
+ * @returns Its entries, or an empty list when it is provably absent
+ * @throws {Error} When the filesystem cannot answer
+ */
+export declare function listDirectory(absolute: string): Promise<readonly DirectoryEntry[]>;
+/**
+ * Read the leading bytes of a file, distinguishing absence from refusal.
+ * @param absolute - Absolute file path
+ * @returns Its leading bytes as text, or undefined when it is provably absent
+ * @throws {Error} When the filesystem cannot answer
+ */
+export declare function readHeaderPrefix(absolute: string): Promise<string | undefined>;
+/**
+ * Every destination path the installed package ships, across every lane.
+ *
+ * Deliberately not scoped to the stacks this project detects as. A template
+ * that ships only under one stack is still shipped, and an index built from
+ * detected stacks would report every stack-specific artifact in a repository as
+ * retired the moment detection shifted — the same false accusation this check
+ * exists to end, arriving through the detector instead of the package.
+ * @param lisaRoot - Installed Lisa package root
+ * @returns Destination path to the strategy that ships it
+ * @throws {Error} When a template directory cannot be read
+ */
+export declare function shippedDestinations(lisaRoot: string): Promise<ReadonlyMap<string, ShippedTemplateStrategy>>;
+//# sourceMappingURL=doctor-stale-banner-scan.d.ts.map

package/dist/cli/doctor-stale-banner-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-stale-banner-scan.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-stale-banner-scan.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AA0B/E,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;CACzC;AAeD;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAcpC;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAsB7B;AA8CD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAmBvD"}

package/dist/cli/doctor-stale-banner-scan.js

@@ -0,0 +1,152 @@
+/**
+ * The two filesystem reads the stale-banner check depends on, and the rule
+ * that both obey: an answer the filesystem declined to give is not an answer.
+ *
+ * Kept separate from `doctor-stale-managed-banner.ts` for the max-lines budget,
+ * the same way the Lisa-owned artifact fixtures are split. The distinction it
+ * encodes is the load-bearing one: `fs-extra`'s `pathExists` and a bare
+ * `catch { return [] }` both resolve a permission denial into the same shape as
+ * an empty directory, and this check's whole job is to tell "found nothing"
+ * apart from "could not look" (CodySwannGT/lisa#3703).
+ * @module cli/doctor-stale-banner-scan
+ */
+import { open, readdir } from "node:fs/promises";
+import * as path from "node:path";
+import { COPY_STRATEGIES, PROJECT_TYPE_ORDER } from "../core/config.js";
+/**
+ * Errno codes that answer the question rather than refusing it: the path is
+ * genuinely not there. Anything else — a permission denial, an I/O error, a
+ * symlink loop — means the probe could not look, which is a different answer
+ * and must not be spelled the same way.
+ */
+const ABSENT_CODES = new Set(["ENOENT", "ENOTDIR", "ENAMETOOLONG"]);
+/**
+ * How many leading bytes of a host file are read to recover its header.
+ *
+ * A header is four lines at most (`core/ownership-header`), and the population
+ * scanned includes repository roots that hold lockfiles measured in megabytes.
+ * Reading whole files to look at their first two lines would make the check
+ * cost proportional to the repository rather than to the question.
+ */
+const HEADER_PREFIX_BYTES = 1024;
+/** The seeding strategy, whose claim any other strategy outranks. */
+const CREATE_ONLY = "create-only";
+/** The lane directories a Lisa package ships templates under. */
+const TEMPLATE_LANES = ["all", ...PROJECT_TYPE_ORDER];
+/**
+ * The errno code of a rejected filesystem call, when it carries one.
+ * @param error - Value thrown by a filesystem call
+ * @returns The errno code, or undefined when the value carries none
+ */
+function errnoCode(error) {
+    const code = typeof error === "object" && error !== null
+        ? error.code
+        : undefined;
+    return typeof code === "string" ? code : undefined;
+}
+/**
+ * List a directory, distinguishing "not there" from "could not look".
+ * @param absolute - Absolute directory path
+ * @returns Its entries, or an empty list when it is provably absent
+ * @throws {Error} When the filesystem cannot answer
+ */
+export async function listDirectory(absolute) {
+    try {
+        const entries = await readdir(absolute, { withFileTypes: true });
+        return entries.map(entry => ({
+            isFile: entry.isFile(),
+            name: entry.name,
+        }));
+    }
+    catch (error) {
+        const code = errnoCode(error);
+        if (code !== undefined && ABSENT_CODES.has(code))
+            return [];
+        throw new Error(`could not read ${absolute}: ${code ?? String(error)}`, {
+            cause: error,
+        });
+    }
+}
+/**
+ * Read the leading bytes of a file, distinguishing absence from refusal.
+ * @param absolute - Absolute file path
+ * @returns Its leading bytes as text, or undefined when it is provably absent
+ * @throws {Error} When the filesystem cannot answer
+ */
+export async function readHeaderPrefix(absolute) {
+    try {
+        const handle = await open(absolute, "r");
+        try {
+            const buffer = Buffer.alloc(HEADER_PREFIX_BYTES);
+            const { bytesRead } = await handle.read(buffer, 0, HEADER_PREFIX_BYTES, 0);
+            return buffer.subarray(0, bytesRead).toString("utf8");
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        const code = errnoCode(error);
+        if (code !== undefined && ABSENT_CODES.has(code))
+            return undefined;
+        throw new Error(`could not read ${absolute}: ${code ?? String(error)}`, {
+            cause: error,
+        });
+    }
+}
+/**
+ * The strategy bucket a template directory name falls into.
+ * @param strategy - Strategy directory name under a lane
+ * @returns The bucket the banner classifier acts on
+ */
+function bucket(strategy) {
+    if (strategy === "copy-overwrite" || strategy === CREATE_ONLY) {
+        return strategy;
+    }
+    return "other";
+}
+/**
+ * Walk one lane/strategy tree, collecting every destination it ships.
+ * @param root - Absolute path of the lane/strategy directory
+ * @param prefix - Repo-relative destination prefix accumulated so far
+ * @param strategy - Strategy the lane ships these destinations under
+ * @returns Destination/strategy pairs found beneath `root`
+ * @throws {Error} When a directory cannot be read
+ */
+async function walkTree(root, prefix, strategy) {
+    const entries = await listDirectory(root);
+    const found = await Promise.all(entries.map(async (entry) => {
+        const destination = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+        return entry.isFile
+            ? [[destination, strategy]]
+            : walkTree(path.join(root, entry.name), destination, strategy);
+    }));
+    return found.flat();
+}
+/**
+ * Every destination path the installed package ships, across every lane.
+ *
+ * Deliberately not scoped to the stacks this project detects as. A template
+ * that ships only under one stack is still shipped, and an index built from
+ * detected stacks would report every stack-specific artifact in a repository as
+ * retired the moment detection shifted — the same false accusation this check
+ * exists to end, arriving through the detector instead of the package.
+ * @param lisaRoot - Installed Lisa package root
+ * @returns Destination path to the strategy that ships it
+ * @throws {Error} When a template directory cannot be read
+ */
+export async function shippedDestinations(lisaRoot) {
+    const lanes = await Promise.all(TEMPLATE_LANES.flatMap(lane => COPY_STRATEGIES.map(async (strategy) => walkTree(path.join(lisaRoot, lane, strategy), "", bucket(strategy)))));
+    const pairs = lanes.flat();
+    // A destination can be shipped by more than one lane, and the strategies can
+    // disagree — `create-only` in one stack, `copy-overwrite` in another. Seeds
+    // are laid down first so a non-seed claim, arriving later, wins the Map. That
+    // is the conservative direction: a disagreement makes the banner read as
+    // accurate rather than overstated, producing silence rather than a finding
+    // nobody can act on.
+    return new Map([
+        ...pairs.filter(([, strategy]) => strategy === CREATE_ONLY),
+        ...pairs.filter(([, strategy]) => strategy !== CREATE_ONLY),
+    ]);
+}
+//# sourceMappingURL=doctor-stale-banner-scan.js.map

package/dist/cli/doctor-stale-banner-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-stale-banner-scan.js","sourceRoot":"","sources":["../../src/cli/doctor-stale-banner-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,qEAAqE;AACrE,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,iEAAiE;AACjE,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,GAAG,kBAAkB,CAAU,CAAC;AAqB/D;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QACzC,CAAC,CAAE,KAA4B,CAAC,IAAI;QACpC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;YACtE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACjD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CACrC,MAAM,EACN,CAAC,EACD,mBAAmB,EACnB,CAAC,CACF,CAAC;YACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;YACtE,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,QAAgB;IAC9B,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9D,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD;;;;;;;GAOG;AACH,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,MAAc,EACd,QAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAmC,EAAE;QAC3D,MAAM,WAAW,GACf,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC,MAAM;YACjB,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;YACpC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACnE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAC5B,eAAe,CAAC,GAAG,CAAC,KAAK,EAAC,QAAQ,EAAC,EAAE,CACnC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CACpE,CACF,CACF,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,qBAAqB;IACrB,OAAO,IAAI,GAAG,CAAC;QACb,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,WAAW,CAAC;QAC3D,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,WAAW,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/doctor-stale-managed-banner.d.ts

@@ -0,0 +1,19 @@
+import { type BannerScanDeps } from "./doctor-stale-banner-scan.js";
+/** Name of the stale-banner check as doctor reports it. */
+export declare const STALE_MANAGED_BANNER_CHECK_NAME = "Managed-file banners true?";
+/** Shape of one doctor check result (structurally identical to doctor's). */
+interface BannerCheckResult {
+    name: string;
+    status: "ok" | "warn" | "fail";
+    detail: string;
+}
+/**
+ * Report files whose managed banner the installed package no longer backs.
+ * @param targetPath - Project path to inspect
+ * @param lisaRoot - Installed Lisa package root (injected by tests)
+ * @param deps - Filesystem seam, so a refusing directory can be exercised
+ * @returns Doctor check result
+ */
+export declare function checkStaleManagedBanner(targetPath: string, lisaRoot?: string, deps?: BannerScanDeps): Promise<BannerCheckResult>;
+export {};
+//# sourceMappingURL=doctor-stale-managed-banner.d.ts.map

package/dist/cli/doctor-stale-managed-banner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-stale-managed-banner.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-stale-managed-banner.ts"],"names":[],"mappings":"AA+CA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,+BAA+B,CAAC;AAGvC,2DAA2D;AAC3D,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AAc5E,6EAA6E;AAC7E,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAsFD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAA0B,EACpC,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAqC5B"}