@chrisdudek/yg 5.0.0-alpha.3 → 5.0.0-alpha.5

package/dist/structure.js

@@ -28,9 +28,23 @@ import * as fs from "fs";
 import * as path2 from "path";
 
 // src/utils/mapping-path.ts
+import { minimatch } from "minimatch";
 function normalizeMappingPath(p) {
   return p.trim().replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
 }
+function isGlobPattern(entry) {
+  return entry.includes("*");
+}
+function globMatch(file, pattern) {
+  return minimatch(file, pattern, { dot: true });
+}
+function mappingEntryMatchesFile(entry, file) {
+  const e = normalizeMappingPath(entry);
+  const f = normalizeMappingPath(file);
+  if (e === "") return false;
+  if (isGlobPattern(e)) return globMatch(f, e);
+  return f === e || f.startsWith(e + "/");
+}
 
 // src/utils/posix.ts
 function toPosix(p) {
@@ -52,9 +66,8 @@ function isAllowed(p, set) {
   if (p === "") return false;
   if (set.has(p)) return true;
   for (const a of set) {
-    if (a === p) return true;
     if (a.startsWith(p + "/")) return true;
-    if (p.startsWith(a + "/")) return true;
+    if (mappingEntryMatchesFile(a, p)) return true;
   }
   return false;
 }
@@ -93,36 +106,64 @@ function resolveAllowedReadPath(raw, allowedSet, projectRoot) {
   return rel;
 }
 function createCtxFs(params) {
-  const { allowedSet, projectRoot, touchedFiles } = params;
+  const { allowedSet, projectRoot, touchedFiles, recorder, subjectFiles } = params;
   function assertAllowed(raw) {
     const p = resolveAllowedReadPath(raw, allowedSet, projectRoot);
     touchedFiles.push(p);
     return p;
   }
+  function isSubjectFile(p) {
+    return subjectFiles !== void 0 && subjectFiles.has(p);
+  }
   return {
     exists(raw) {
       const p = assertAllowed(raw);
       const abs = path2.resolve(projectRoot, p);
+      let result;
       try {
         const stat2 = fs.statSync(abs);
-        return stat2.isDirectory() ? "dir" : stat2.isFile() ? "file" : false;
+        result = stat2.isDirectory() ? "dir" : stat2.isFile() ? "file" : false;
       } catch {
-        return false;
+        result = false;
+      }
+      if (recorder && !isSubjectFile(p)) {
+        recorder.recordExists(p, result);
       }
+      return result;
     },
     read(raw) {
       const p = assertAllowed(raw);
       const abs = path2.resolve(projectRoot, p);
-      return fs.readFileSync(abs, "utf8");
+      let bytes;
+      try {
+        bytes = fs.readFileSync(abs);
+      } catch (err) {
+        if (recorder && !isSubjectFile(p)) recorder.recordReadAbsent(p);
+        throw err;
+      }
+      if (recorder && !isSubjectFile(p)) {
+        recorder.recordRead(p, bytes);
+      }
+      return bytes.toString("utf8");
     },
     list(raw) {
       const p = assertAllowed(raw);
       const abs = path2.resolve(projectRoot, p);
-      const entries = fs.readdirSync(abs, { withFileTypes: true });
-      return entries.map((e) => ({
+      let dirents;
+      try {
+        dirents = fs.readdirSync(abs, { withFileTypes: true });
+      } catch (err) {
+        if (recorder && !isSubjectFile(p)) recorder.recordListAbsent(p);
+        throw err;
+      }
+      const entries = dirents.map((e) => ({
         name: e.name,
         kind: e.isDirectory() ? "dir" : "file"
       }));
+      if (recorder && !isSubjectFile(p)) {
+        recorder.recordList(p, entries);
+      }
+      return entries;
     }
   };
 }
@@ -135,13 +176,7 @@ import * as path3 from "path";
 function isPathInMapping(candidate, mapping) {
   const c = normalizeMappingPath(candidate);
   if (c === "") return false;
-  for (const raw of mapping) {
-    const n = normalizeMappingPath(raw);
-    if (n === "") continue;
-    if (c === n) return true;
-    if (c.startsWith(n + "/")) return true;
-  }
-  return false;
+  return mapping.some((raw) => mappingEntryMatchesFile(raw, c));
 }
 
 // src/structure/ctx-graph.ts
@@ -181,27 +216,48 @@ function computeAllowedNodePaths(currentPath, graph) {
   return allowed;
 }
 function createCtxGraph(params) {
-  const { currentNodePath, graph, projectRoot, touchedFiles } = params;
+  const { currentNodePath, graph, projectRoot, touchedFiles, expandedFilesByNode, recorder, subjectFiles } = params;
   const allowed = computeAllowedNodePaths(currentNodePath, graph);
   function assertAllowed(id) {
     if (!allowed.has(id)) throw new UndeclaredGraphReadError(id);
   }
+  function recordGraphNode(m) {
+    if (!recorder) return;
+    const ygNodePath = path3.join(projectRoot, ".yggdrasil", "model", m.path, "yg-node.yaml");
+    let yamlBytes;
+    try {
+      yamlBytes = fs2.readFileSync(ygNodePath);
+    } catch {
+      yamlBytes = m.nodeYamlRaw !== void 0 ? Buffer.from(m.nodeYamlRaw, "utf8") : void 0;
+    }
+    if (yamlBytes === void 0) {
+      recorder.recordGraphNodeAbsent(m.path);
+    } else {
+      recorder.recordGraphNode(m.path, yamlBytes);
+    }
+  }
   function toPublicNode(m) {
     const files = [];
-    for (const raw of m.meta.mapping ?? []) {
-      const p = normalizeMappingPath(raw);
+    const preExpanded = expandedFilesByNode?.get(m.path);
+    const candidatePaths = preExpanded ?? (m.meta.mapping ?? []).map(normalizeMappingPath);
+    for (const p of candidatePaths) {
       if (!p) continue;
       const abs = path3.resolve(projectRoot, p);
       try {
         const stat2 = fs2.statSync(abs);
         if (stat2.isFile()) {
-          const content = fs2.readFileSync(abs, "utf8");
+          const bytes = fs2.readFileSync(abs);
+          const content = bytes.toString("utf8");
           files.push({ path: p, content });
           touchedFiles.push(p);
+          if (recorder && !subjectFiles?.has(p)) {
+            recorder.recordRead(p, bytes);
+          }
         }
       } catch {
       }
     }
+    recordGraphNode(m);
     return {
       id: m.path,
       type: m.meta.type,
@@ -214,19 +270,29 @@ function createCtxGraph(params) {
     node(id) {
       assertAllowed(id);
       const m = graph.nodes.get(id);
-      return m ? toPublicNode(m) : void 0;
+      if (!m) {
+        if (recorder) recorder.recordGraphNodeAbsent(id);
+        return void 0;
+      }
+      return toPublicNode(m);
     },
     nodesByType(type) {
       const out = [];
+      const matchedIds = [];
       for (const id of allowed) {
         const m = graph.nodes.get(id);
-        if (m && m.meta.type === type) out.push(toPublicNode(m));
+        if (m && m.meta.type === type) {
+          matchedIds.push(m.path);
+          out.push(toPublicNode(m));
+        }
       }
+      if (recorder) recorder.recordGraphNodesByType(type, matchedIds);
       return out;
     },
     relationsFrom(node) {
       assertAllowed(node.id);
       const m = graph.nodes.get(node.id);
+      if (m) recordGraphNode(m);
       return m?.meta.relations ?? [];
     },
     relationsTo(node) {
@@ -234,6 +300,7 @@ function createCtxGraph(params) {
       for (const id of allowed) {
         const m = graph.nodes.get(id);
         if (!m) continue;
+        recordGraphNode(m);
         for (const rel of m.meta.relations ?? []) {
           if (rel.target === node.id) out.push(rel);
         }
@@ -243,6 +310,8 @@ function createCtxGraph(params) {
     children(node) {
       assertAllowed(node.id);
       const m = graph.nodes.get(node.id);
+      const childIds = m ? m.children.map((c) => c.path) : [];
+      if (recorder) recorder.recordGraphChildren(node.id, childIds);
       return m ? m.children.map(toPublicNode) : [];
     },
     flowParticipants(flowName) {
@@ -258,6 +327,7 @@ function createCtxGraph(params) {
         return false;
       });
       if (!participates) throw new UndeclaredGraphReadError(`flow:${flowName}`);
+      if (recorder) recorder.recordFlowParticipants(flow.name, [...flow.nodes]);
       const out = [];
       for (const nodeId of flow.nodes) {
         const m = graph.nodes.get(nodeId);
@@ -500,12 +570,16 @@ var GRAMMAR_DIRS = [
   path4.resolve(__dirname2, "grammars"),
   path4.resolve(__dirname2, "..", "grammars")
 ];
-var initialized = false;
+var initPromise = null;
 var langCache = /* @__PURE__ */ new Map();
-async function init() {
-  if (initialized) return;
-  await Parser.init();
-  initialized = true;
+function init() {
+  if (initPromise === null) {
+    initPromise = Parser.init();
+    initPromise.catch(() => {
+      initPromise = null;
+    });
+  }
+  return initPromise;
 }
 function resolveWasm(filename, pkg) {
   for (const dir of GRAMMAR_DIRS) {
@@ -528,12 +602,16 @@ async function getParser(extension) {
     throw new Error(`no parser for extension '${extension}'`);
   }
   const cacheKey = info.wasmFile;
-  let lang = langCache.get(cacheKey);
-  if (!lang) {
+  let langP = langCache.get(cacheKey);
+  if (langP === void 0) {
     const wasmPath = resolveWasm(info.wasmFile, info.wasmPackage);
-    lang = await Language.load(wasmPath);
-    langCache.set(cacheKey, lang);
+    langP = Language.load(wasmPath);
+    langCache.set(cacheKey, langP);
+    langP.catch(() => {
+      if (langCache.get(cacheKey) === langP) langCache.delete(cacheKey);
+    });
   }
+  const lang = await langP;
   const parser = new Parser();
   parser.setLanguage(lang);
   return parser;
@@ -559,7 +637,7 @@ var ParseAstNotPrewarmedError = class extends Error {
   }
 };
 function createCtxParsers(params) {
-  const { allowedSet, projectRoot, touchedFiles, astCache } = params;
+  const { allowedSet, projectRoot, touchedFiles, astCache, recorder, subjectFiles } = params;
   function asFile(input) {
     if (typeof input !== "string") {
       touchedFiles.push(input.path);
@@ -567,8 +645,18 @@ function createCtxParsers(params) {
     }
     const p = resolveAllowedReadPath(input, allowedSet, projectRoot);
     const abs = path5.resolve(projectRoot, p);
-    const content = fs3.readFileSync(abs, "utf8");
+    let bytes;
+    try {
+      bytes = fs3.readFileSync(abs);
+    } catch (err) {
+      if (recorder && !subjectFiles?.has(p)) recorder.recordReadAbsent(p);
+      throw err;
+    }
+    const content = bytes.toString("utf8");
     touchedFiles.push(p);
+    if (recorder && !subjectFiles?.has(p)) {
+      recorder.recordRead(p, bytes);
+    }
     return { path: p, content };
   }
   return {
@@ -691,7 +779,7 @@ import { createRequire as createRequire3 } from "module";
 
 // src/io/repo-scanner.ts
 import { readFile, readdir } from "fs/promises";
-import { join, relative as relative2, sep } from "path";
+import { join as join2, relative as relative2, sep } from "path";
 import { createRequire as createRequire2 } from "module";
 
 // src/utils/debug-log.ts
@@ -726,7 +814,9 @@ function isIgnoredByStack2(candidatePath, stack) {
 function hashString(content) {
   return createHash("sha256").update(content).digest("hex");
 }
-var EMPTY_IDENTITY = { ownSubset: hashString(""), ports: {}, aspects: {} };
+function hashBytes(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
 async function collectDirectoryFilePaths(directoryPath, rootDirectoryPath, options) {
   let stack = options.gitignoreStack ?? [];
   try {
@@ -764,26 +854,50 @@ async function collectDirectoryFilePaths(directoryPath, rootDirectoryPath, optio
   result.push(...fileStats);
   return result;
 }
+async function expandGlobEntry(projectRoot, glob, gitignoreStack) {
+  const segments = glob.split("/");
+  const firstGlobIdx = segments.findIndex((s) => isGlobPattern(s));
+  const baseSegments = firstGlobIdx > 0 ? segments.slice(0, firstGlobIdx) : [];
+  const baseDir = baseSegments.length > 0 ? path7.join(projectRoot, ...baseSegments) : projectRoot;
+  try {
+    const dirEntries = await collectDirectoryFilePaths(baseDir, projectRoot, {
+      projectRoot,
+      gitignoreStack
+    });
+    return dirEntries.filter((entry) => globMatch(entry.relPath, glob)).map((entry) => ({
+      relPath: toPosixPath(entry.relPath),
+      absPath: entry.absPath,
+      mtimeMs: entry.mtimeMs
+    }));
+  } catch {
+    return [];
+  }
+}
 async function expandMappingPaths(projectRoot, mappingPaths) {
   const gitignoreStack = await loadRootGitignoreStack2(projectRoot);
   const result = [];
   for (const mp of mappingPaths) {
-    const absPath = path7.join(projectRoot, mp);
-    try {
-      const st = await stat(absPath);
-      if (st.isDirectory()) {
-        const dirEntries = await collectDirectoryFilePaths(absPath, absPath, {
-          projectRoot,
-          gitignoreStack
-        });
-        for (const entry of dirEntries) {
-          result.push(toPosixPath(path7.join(mp, entry.relPath)));
+    if (isGlobPattern(mp)) {
+      const entries = await expandGlobEntry(projectRoot, mp, gitignoreStack);
+      for (const entry of entries) result.push(entry.relPath);
+    } else {
+      const absPath = path7.join(projectRoot, mp);
+      try {
+        const st = await stat(absPath);
+        if (st.isDirectory()) {
+          const dirEntries = await collectDirectoryFilePaths(absPath, absPath, {
+            projectRoot,
+            gitignoreStack
+          });
+          for (const entry of dirEntries) {
+            result.push(toPosixPath(path7.join(mp, entry.relPath)));
+          }
+        } else {
+          result.push(toPosixPath(mp));
         }
-      } else {
-        result.push(toPosixPath(mp));
+      } catch {
+        continue;
       }
-    } catch {
-      continue;
     }
   }
   return result;
@@ -831,8 +945,8 @@ var SuppressMarkerError = class extends Error {
   }
   code = "SUPPRESS_MARKER_MISSING_REASON";
 };
-var RE_SINGLE = /\byg-suppress\(\s*([^)]+?)\s*\)\s*(.+)?$/;
-var RE_DISABLE = /\byg-suppress-disable\(\s*([^)]+?)\s*\)\s*(.+)?$/;
+var RE_SINGLE = /\byg-suppress\(\s*([^)]+?)\s*\)\s*(.+)?$/m;
+var RE_DISABLE = /\byg-suppress-disable\(\s*([^)]+?)\s*\)\s*(.+)?$/m;
 var RE_ENABLE = /\byg-suppress-enable\(\s*([^)]+?)\s*\)/;
 function commentBody(text) {
   if (text.startsWith("//")) return text.slice(2).trim();
@@ -866,15 +980,23 @@ function parseMarker(commentText, line, file) {
   if (m) return makeMarker("single", m, line, file);
   return null;
 }
-function collectSuppressions(tree, file, totalLines) {
-  if (getLanguageForExtension(extname3(file)) === null) {
-    return [];
-  }
-  const comments = findComments({ path: file, ast: tree });
+function collectSuppressions(tree, file, totalLines, content) {
+  const hasGrammar = getLanguageForExtension(extname3(file)) !== null;
   const markers = [];
-  for (const c of comments) {
-    const m = parseMarker(c.text, c.startPosition.row + 1, file);
-    if (m) markers.push(m);
+  if (hasGrammar && tree) {
+    const comments = findComments({ path: file, ast: tree });
+    for (const c of comments) {
+      const m = parseMarker(c.text, c.startPosition.row + 1, file);
+      if (m) markers.push(m);
+    }
+  } else if (content !== void 0) {
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const m = parseMarker(lines[i], i + 1, file);
+      if (m) markers.push(m);
+    }
+  } else {
+    return [];
   }
   markers.sort((a, b) => a.line - b.line);
   const ranges = [];
@@ -974,18 +1096,7 @@ function validateCheckModuleExport(mod, opts) {
   return { ok: true };
 }
 
-// src/structure/runner.ts
-var StructureRunnerError = class extends Error {
-  constructor(code, data) {
-    super(`${code}: ${data.what}
-${data.why}
-${data.next}`);
-    this.code = code;
-    this.messageData = data;
-    this.name = "StructureRunnerError";
-  }
-  messageData;
-};
+// src/utils/binary-extensions.ts
 var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
   ".gif",
   ".png",
@@ -1015,6 +1126,141 @@ var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
   ".wasm",
   ".bin"
 ]);
+
+// src/core/pair-hash.ts
+function observationKey(kind, target) {
+  return `${kind}:${target}`;
+}
+var MISSING_OBSERVATION = "missing";
+function hashNodeSetObservation(nodeIds) {
+  const lines = [...nodeIds].sort((a, b) => a < b ? -1 : a > b ? 1 : 0).join("\n");
+  return hashString(lines);
+}
+function hashReadObservation(bytes) {
+  return hashBytes(bytes);
+}
+function hashListObservation(entries) {
+  const lines = [...entries].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0).map((e) => `${e.name}:${e.kind}`).join("\n");
+  return hashString(lines);
+}
+function hashExistsObservation(result) {
+  return hashString(result === false ? "false" : result);
+}
+
+// src/structure/observations.ts
+var ObservationRecorder = class {
+  _entries = /* @__PURE__ */ new Map();
+  // key → hash (first-wins)
+  _tainted = false;
+  /** Record a file-read observation. `bytes` is the raw content read. */
+  recordRead(repoRelPosixPath, bytes) {
+    this._record(observationKey("read", repoRelPosixPath), hashReadObservation(bytes));
+  }
+  /** Record a directory-listing observation. */
+  recordList(repoRelPosixDir, entries) {
+    this._record(observationKey("list", repoRelPosixDir), hashListObservation(entries));
+  }
+  /** Record an existence-probe observation (including negative probes where result === false). */
+  recordExists(repoRelPosixPath, result) {
+    this._record(observationKey("exists", repoRelPosixPath), hashExistsObservation(result));
+  }
+  /** Record a graph-node observation by hashing its yg-node.yaml bytes. */
+  recordGraphNode(nodePath, ygNodeYamlBytes) {
+    this._record(observationKey("graph", nodePath), hashReadObservation(ygNodeYamlBytes));
+  }
+  /**
+   * Record an ABSENT file-read observation: the check attempted a read that threw
+   * (the path passed the allow-check but the file was missing/unreadable at read
+   * time). Folds MISSING_OBSERVATION under the same read:<path> key the verifier
+   * re-observes — so if the check swallowed the throw and treated the file as
+   * absent, a later successful read of that path changes the value ⇒ unverified
+   * (spec §3.1, over-record: a throwing access is still an observation).
+   */
+  recordReadAbsent(repoRelPosixPath) {
+    this._record(observationKey("read", repoRelPosixPath), MISSING_OBSERVATION);
+  }
+  /**
+   * Record an ABSENT directory-listing observation: the check attempted a list
+   * that threw (path allow-checked but the dir was missing/unreadable at list
+   * time). Folds MISSING_OBSERVATION under the list:<path> key — a later
+   * successful listing changes the value ⇒ unverified (spec §3.1, over-record).
+   */
+  recordListAbsent(repoRelPosixDir) {
+    this._record(observationKey("list", repoRelPosixDir), MISSING_OBSERVATION);
+  }
+  /**
+   * Record a NEGATIVE graph-node observation: the check looked up a node that
+   * does not exist. Folds the MISSING_OBSERVATION token so the verifier's
+   * re-observation (which reads that node's yg-node.yaml and also yields
+   * MISSING_OBSERVATION when absent) reproduces it byte-for-byte — and creating
+   * the node later changes the value ⇒ unverified (spec §3.1, over-record).
+   */
+  recordGraphNodeAbsent(nodePath) {
+    this._record(observationKey("graph", nodePath), MISSING_OBSERVATION);
+  }
+  /**
+   * Record a child-set observation for `nodePath`: the SET of node ids returned
+   * by ctx.graph.children(node). Folds membership only — adding/removing a child
+   * invalidates; a content edit to an unchanged child rides its own graph:
+   * observation (spec §3.1).
+   */
+  recordGraphChildren(nodePath, childIds) {
+    this._record(observationKey("graph-children", nodePath), hashNodeSetObservation(childIds));
+  }
+  /**
+   * Record a by-type-set observation for `type`: the SET of node ids returned by
+   * ctx.graph.nodesByType(type). Folds membership only — adding/removing a node
+   * of that type invalidates (spec §3.1).
+   */
+  recordGraphNodesByType(type, nodeIds) {
+    this._record(observationKey("graph-bytype", type), hashNodeSetObservation(nodeIds));
+  }
+  /**
+   * Record a flow-participant-set observation for `flowName`: the SET of declared
+   * participant ids of the flow. Folds the flow's participant list (the flow
+   * DEFINITION's membership) so adding/removing a participant in the flow file
+   * invalidates the verdict, even when every still-present participant node is
+   * unchanged (spec §3.1, flowParticipants minor).
+   */
+  recordFlowParticipants(flowName, participantIds) {
+    this._record(observationKey("graph-flow", flowName), hashNodeSetObservation(participantIds));
+  }
+  /**
+   * Returns a sorted, deduplicated array of [observationKey, observationHash] pairs.
+   * Re-observing the same key with a different hash sets `tainted = true` and keeps
+   * the first hash (first-observation-wins).
+   */
+  snapshot() {
+    const result = [...this._entries.entries()];
+    result.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return result;
+  }
+  /** True if the same path was observed with different content during this run. */
+  get tainted() {
+    return this._tainted;
+  }
+  _record(key, hash) {
+    const existing = this._entries.get(key);
+    if (existing === void 0) {
+      this._entries.set(key, hash);
+    } else if (existing !== hash) {
+      this._tainted = true;
+    }
+  }
+};
+
+// src/structure/runner.ts
+var StructureRunnerError = class extends Error {
+  constructor(code, data) {
+    super(`${code}: ${data.what}
+${data.why}
+${data.next}`);
+    this.code = code;
+    this.messageData = data;
+    this.name = "StructureRunnerError";
+  }
+  messageData;
+};
 async function buildOwnFiles(node, projectRoot, touchedFiles) {
   const childMappingEntries = [];
   for (const child of node.children) {
@@ -1030,24 +1276,43 @@ async function buildOwnFiles(node, projectRoot, touchedFiles) {
     if (childMappingEntries.length > 0 && isPathInMapping(p, childMappingEntries)) continue;
     if (BINARY_EXTENSIONS.has(path8.extname(p).toLowerCase())) continue;
     const abs = path8.resolve(projectRoot, p);
-    let content;
+    let bytes;
     try {
-      content = fs4.readFileSync(abs, "utf8");
+      bytes = fs4.readFileSync(abs);
     } catch {
       continue;
     }
-    result.push({ path: p, content });
+    const content = bytes.toString("utf8");
+    result.push({ file: { path: p, content }, bytes });
     touchedFiles.push(p);
   }
   return result;
 }
+function wrapNonSubjectFile(f, repoRelPosixPath, bytes, recorder) {
+  if (bytes === void 0) return f;
+  const { content, ...rest } = f;
+  let recorded = false;
+  const wrapped = { ...rest };
+  Object.defineProperty(wrapped, "content", {
+    enumerable: true,
+    configurable: true,
+    get() {
+      if (!recorded) {
+        recorder.recordRead(repoRelPosixPath, bytes);
+        recorded = true;
+      }
+      return content;
+    }
+  });
+  return wrapped;
+}
 async function enumerateMappedFilesAsync(mappingPaths, projectRoot) {
   const normalized = mappingPaths.map(normalizeMappingPath).filter((p) => p !== "");
   return expandMappingPaths(projectRoot, normalized);
 }
 async function runStructureAspect(params) {
   ensureLoaderRegistered();
-  const { aspectDir, aspectId, nodePath, graph, projectRoot } = params;
+  const { aspectDir, aspectId, nodePath, graph, projectRoot, subjectScope } = params;
   const astCache = params.parseCache ?? /* @__PURE__ */ new Map();
   const touchedFiles = [];
   const node = graph.nodes.get(nodePath);
@@ -1079,21 +1344,46 @@ async function runStructureAspect(params) {
   }
   const checkFn = mod.check;
   const allowedSet = collectAllowedReadsForAspect(nodePath, graph);
-  const ctxFs = createCtxFs({ allowedSet, projectRoot, touchedFiles });
-  const ctxGraph = createCtxGraph({ currentNodePath: nodePath, graph, projectRoot, touchedFiles });
-  const parsers = createCtxParsers({ allowedSet, projectRoot, touchedFiles, astCache });
-  const ownFiles = await buildOwnFiles(node, projectRoot, touchedFiles);
+  const recorder = new ObservationRecorder();
+  const ownFilesRaw = (node.meta.mapping ?? []).map(normalizeMappingPath).filter((p) => p !== "");
+  const ownFilesExpanded = await expandMappingPaths(projectRoot, ownFilesRaw);
+  const subjectFiles = subjectScope !== void 0 ? new Set(subjectScope.map(normalizeMappingPath)) : new Set(ownFilesExpanded);
+  const ctxFs = createCtxFs({ allowedSet, projectRoot, touchedFiles, recorder, subjectFiles });
+  const expandedFilesByNode = /* @__PURE__ */ new Map();
+  for (const id of computeAllowedNodePaths(nodePath, graph)) {
+    const m = graph.nodes.get(id);
+    if (m) expandedFilesByNode.set(id, await enumerateMappedFilesAsync(m.meta.mapping ?? [], projectRoot));
+  }
+  const ctxGraph = createCtxGraph({ currentNodePath: nodePath, graph, projectRoot, touchedFiles, expandedFilesByNode, recorder, subjectFiles });
+  const parsers = createCtxParsers({ allowedSet, projectRoot, touchedFiles, astCache, recorder, subjectFiles });
+  const ownFilesWithBytes = await buildOwnFiles(node, projectRoot, touchedFiles);
+  const ownFiles = ownFilesWithBytes.map((x) => x.file);
+  const bytesByPath = /* @__PURE__ */ new Map();
+  for (const x of ownFilesWithBytes) bytesByPath.set(normalizeMappingPath(x.file.path), x.bytes);
   await prewarmupAstCache({ astCache, projectRoot, files: ownFiles });
   const ownFilesEnriched = enrichFilesWithAst(ownFiles, astCache);
+  let nodeFilesEnriched;
+  let ctxFilesEnriched;
+  if (subjectScope !== void 0) {
+    nodeFilesEnriched = recorder !== void 0 ? ownFilesEnriched.map((f) => {
+      const p = normalizeMappingPath(f.path);
+      if (subjectFiles.has(p)) return f;
+      return wrapNonSubjectFile(f, p, bytesByPath.get(p), recorder);
+    }) : ownFilesEnriched;
+    ctxFilesEnriched = ownFilesEnriched.filter((f) => subjectFiles.has(normalizeMappingPath(f.path)));
+  } else {
+    nodeFilesEnriched = ownFilesEnriched;
+    ctxFilesEnriched = ownFilesEnriched;
+  }
   const ctx = {
     node: {
       id: node.path,
       type: node.meta.type,
       mapping: node.meta.mapping ?? [],
-      files: ownFilesEnriched,
+      files: nodeFilesEnriched,
       ports: node.meta.ports ?? {}
     },
-    files: ownFilesEnriched,
+    files: ctxFilesEnriched,
     fs: ctxFs,
     graph: ctxGraph,
     parseAst: parsers.parseAst,
@@ -1127,7 +1417,9 @@ async function runStructureAspect(params) {
           file: `.yggdrasil/aspects/${aspectId}/check.mjs`
         }],
         touchedFiles: [],
-        succeeded: false
+        succeeded: false,
+        observations: recorder.snapshot(),
+        observationsTainted: recorder.tainted
       };
     }
     if (err instanceof UndeclaredGraphReadError) {
@@ -1138,7 +1430,9 @@ async function runStructureAspect(params) {
           file: `.yggdrasil/aspects/${aspectId}/check.mjs`
         }],
         touchedFiles: [],
-        succeeded: false
+        succeeded: false,
+        observations: recorder.snapshot(),
+        observationsTainted: recorder.tainted
       };
     }
     if (err instanceof ParseAstNotPrewarmedError) {
@@ -1149,14 +1443,16 @@ async function runStructureAspect(params) {
           file: `.yggdrasil/model/${nodePath}/yg-node.yaml`
         }],
         touchedFiles: [],
-        succeeded: false
+        succeeded: false,
+        observations: recorder.snapshot(),
+        observationsTainted: recorder.tainted
       };
     }
     throw new StructureRunnerError("STRUCTURE_CHECK_THROWN", {
       what: `check.mjs threw an exception while running (aspect '${aspectId}').`,
       why: `${err.message}
 ${err.stack ?? ""}`,
-      next: `Fix the bug in check.mjs and re-run yg approve.`
+      next: `Fix the bug in check.mjs, then re-run: yg check --approve`
     });
   }
   if (raw !== null && typeof raw === "object" && typeof raw.then === "function") {
@@ -1194,12 +1490,22 @@ ${err.stack ?? ""}`,
     }
     violations.push(vv);
   }
+  const contentByPath = /* @__PURE__ */ new Map();
+  for (const f of [...ownFiles, ...astInputSet]) {
+    contentByPath.set(normalizeMappingPath(f.path), f.content);
+  }
   const rangesByFile = /* @__PURE__ */ new Map();
   function rangesFor(filePath) {
     const existing = rangesByFile.get(filePath);
     if (existing !== void 0) return existing;
     const cached = astCache.get(filePath);
-    const ranges = cached ? collectSuppressions(cached.ast, filePath, cached.content.split("\n").length) : null;
+    let ranges;
+    if (cached) {
+      ranges = collectSuppressions(cached.ast, filePath, cached.content.split("\n").length, cached.content);
+    } else {
+      const content = contentByPath.get(filePath);
+      ranges = content !== void 0 ? collectSuppressions(void 0, filePath, content.split("\n").length, content) : null;
+    }
     rangesByFile.set(filePath, ranges);
     return ranges;
   }
@@ -1209,7 +1515,13 @@ ${err.stack ?? ""}`,
     if (!ranges) return true;
     return !isLineSuppressed(ranges, aspectId, v.line);
   });
-  return { violations: visible, touchedFiles, succeeded: true };
+  return {
+    violations: visible,
+    touchedFiles,
+    succeeded: true,
+    observations: recorder.snapshot(),
+    observationsTainted: recorder.tainted
+  };
 }
 
 // src/ast/walk.ts
@@ -1242,9 +1554,8 @@ function report(file, node, message) {
 }
 
 // src/ast/file-path.ts
-import { minimatch } from "minimatch";
 function inFile(file, pattern) {
-  if ("glob" in pattern) return minimatch(file.path, pattern.glob);
+  if ("glob" in pattern) return globMatch(file.path, pattern.glob);
   if ("regex" in pattern) return pattern.regex.test(file.path);
   if ("contains" in pattern) return file.path.includes(pattern.contains);
   return false;