@descryy/core 0.1.0

package/dist/ledger/resolve.d.ts

@@ -0,0 +1,124 @@
+/**
+ * TIER-A-2's value-lookup half — DEC-223, DEC-136.
+ *
+ * DEC-120/DEC-121 (`validation/{env,sources}.ts`, Lane D) already answer *"is
+ * this variable declared anywhere"*. A refusal-ledger row needs a different
+ * question answered: *"what value does this blocked blockedBy hold, per
+ * environment, from what the repository already has on disk."* Same
+ * declaration surfaces, a different consumer — this file only reads
+ * `sources.ts`'s exports, it does not change them. See `parallel-agents.md`
+ * §3's ledger-lookup row.
+ *
+ * ## What this deliberately does not take as input, and why
+ *
+ * The obvious signature would be `resolve(row: UnresolvedRef)`. `UnresolvedRef`
+ * does not carry the blocked blockedBy — `rawTarget` is the callee
+ * (`"fetch"`, `"api.get"`), and `reason` is human prose with no variable name
+ * in it (confirmed by reading real rows: the same sentence fires for every
+ * `api.<verb>` call regardless of which variable blocks it). DEC-223 §1 asks
+ * for `attrs.blockedBy` to carry this and it does not exist in any shipped
+ * adapter yet — that request is open, addressed to whoever ships the next
+ * ledger-producing change. So this takes an **blockedBy string** directly.
+ * A caller with `attrs.blockedBy` available passes it straight through; a
+ * caller without it (today, every real batch) supplies whatever it already
+ * determined by reading source — which is what the TIER-A-2 measurement this
+ * module was built to close used.
+ *
+ * ## Formats read
+ *
+ * `.env*` and `wrangler.toml`'s `[vars]`/`[env.<name>.vars]` tables
+ * (`REQUEST-D-wrangler-vars-format.md`, DEC-245). Container manifests and
+ * image builds are already in `sources.ts`'s declaration scan but that scan
+ * discards the *value* half — it only proves a name is declared, never what
+ * it is bound to — and neither measured repository's real questions resolve
+ * through either format.
+ *
+ * The wrangler reading itself lives in `sources.ts` — `readWranglerVarsEntries`
+ * — the same file that owns every other format's structural read. This module
+ * only turns its output into `DeclaredEnvValue`s, the same way it already does
+ * for `readDotenvValues`; one reader per format, never a second one for the
+ * same file here.
+ *
+ * ## Never guessed, always refused
+ *
+ * `candidateEnvNames` returns `[]` — never a best guess — for any blockedBy
+ * shape it does not recognise. An blockedBy this module cannot parse stays
+ * exactly as open as it was before this module existed; principle 2 applies
+ * to a lookup the same way it applies to an edge.
+ */
+import type { ResolutionLevel } from "@descryy/ir";
+import type { ConfigSurface, SurfaceScan } from "./../validation/sources.ts";
+/** A value this repository states for one variable, in one environment. */
+export interface DeclaredEnvValue {
+    readonly name: string;
+    /** Derived from the surface's filename — see `environmentOf`'s header. */
+    readonly environment: string;
+    readonly value: string;
+    readonly file: string;
+    readonly line: number;
+    /** `.env.<environment>.local` — Vite's convention, wins over the non-local peer. */
+    readonly local: boolean;
+    /** `.env.example` and its siblings — documents that the name exists; the value is a placeholder. */
+    readonly example: boolean;
+}
+/** One candidate that satisfied an blockedBy, in one environment. */
+export interface ResolvedValue {
+    readonly environment: string;
+    /** Which candidate name actually answered — relevant when `blockedBy` is a fallback chain. */
+    readonly name: string;
+    readonly value: string;
+    readonly file: string;
+    readonly line: number;
+    readonly local: boolean;
+}
+export interface LedgerAccessorResolution {
+    readonly blockedBy: string;
+    /** `[]` means the blockedBy's shape was not recognised — refused, not guessed. */
+    readonly candidates: readonly string[];
+    /** One per environment for which some candidate resolved. */
+    readonly resolved: readonly ResolvedValue[];
+    /**
+     * Every environment this repository's own `.env*` naming asserts exists —
+     * from filenames actually present, including example/placeholder files.
+     * Never invented: a repository with no `.env.production*` file anywhere
+     * does not get `"production"` added here on the assumption that one must
+     * exist. That is the difference between disclosing a real gap and
+     * guessing at one.
+     */
+    readonly knownEnvironments: readonly string[];
+    /** `knownEnvironments` minus `resolved`'s environments — the honest "still open" list. */
+    readonly unresolvedEnvironments: readonly string[];
+    /**
+     * DEC-244's precedent (corrected from an earlier mis-citation of DEC-111,
+     * which is unrelated): a direct read of a declarative document needs no
+     * resolution and is treated as R3, the same class of evidence
+     * `adapter-openapi`/`adapter-sql` use to reach R3 with no language adapter
+     * at all. Present only when at least one candidate was recognised — an
+     * unparseable blockedBy has no resolution to state because nothing was
+     * read.
+     */
+    readonly resolution: ResolutionLevel | null;
+}
+/**
+ * The candidate variable names an blockedBy could resolve to, in the order
+ * they would actually be tried at runtime. `[]` when any side of the
+ * blockedBy is neither a recognised accessor nor a literal fallback —
+ * refused as a whole rather than partially understood, per rule 2.
+ */
+export declare function candidateEnvNames(blockedBy: string): readonly string[];
+/**
+ * Every value this repository's `.env*` and `wrangler.toml` surfaces state,
+ * across every environment they name. Read once per repository;
+ * `resolveAgainstDeclared` runs many times against the result rather than
+ * rescanning per ledger row.
+ */
+export declare function readDeclaredEnvValues(root: string, scan: SurfaceScan, readFile: (file: string) => string): readonly DeclaredEnvValue[];
+/**
+ * Resolve one blocked blockedBy against every declared value this
+ * repository already has on disk. Never invents an environment, never picks
+ * a value from a different repository, never treats an example file's
+ * placeholder as an answer.
+ */
+export declare function resolveAgainstDeclared(blockedBy: string, declared: readonly DeclaredEnvValue[]): LedgerAccessorResolution;
+export type { ConfigSurface };
+//# sourceMappingURL=resolve.d.ts.map

package/dist/ledger/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/ledger/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAG7E,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,oGAAoG;IACpG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,0FAA0F;IAC1F,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;CAC7C;AA2DD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CActE;AAsCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,gBAAgB,EAAE,CA8CtI;AAgBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GACpC,wBAAwB,CAiD1B;AAED,YAAY,EAAE,aAAa,EAAE,CAAC"}

package/dist/ledger/resolve.js

@@ -0,0 +1,290 @@
+/**
+ * TIER-A-2's value-lookup half — DEC-223, DEC-136.
+ *
+ * DEC-120/DEC-121 (`validation/{env,sources}.ts`, Lane D) already answer *"is
+ * this variable declared anywhere"*. A refusal-ledger row needs a different
+ * question answered: *"what value does this blocked blockedBy hold, per
+ * environment, from what the repository already has on disk."* Same
+ * declaration surfaces, a different consumer — this file only reads
+ * `sources.ts`'s exports, it does not change them. See `parallel-agents.md`
+ * §3's ledger-lookup row.
+ *
+ * ## What this deliberately does not take as input, and why
+ *
+ * The obvious signature would be `resolve(row: UnresolvedRef)`. `UnresolvedRef`
+ * does not carry the blocked blockedBy — `rawTarget` is the callee
+ * (`"fetch"`, `"api.get"`), and `reason` is human prose with no variable name
+ * in it (confirmed by reading real rows: the same sentence fires for every
+ * `api.<verb>` call regardless of which variable blocks it). DEC-223 §1 asks
+ * for `attrs.blockedBy` to carry this and it does not exist in any shipped
+ * adapter yet — that request is open, addressed to whoever ships the next
+ * ledger-producing change. So this takes an **blockedBy string** directly.
+ * A caller with `attrs.blockedBy` available passes it straight through; a
+ * caller without it (today, every real batch) supplies whatever it already
+ * determined by reading source — which is what the TIER-A-2 measurement this
+ * module was built to close used.
+ *
+ * ## Formats read
+ *
+ * `.env*` and `wrangler.toml`'s `[vars]`/`[env.<name>.vars]` tables
+ * (`REQUEST-D-wrangler-vars-format.md`, DEC-245). Container manifests and
+ * image builds are already in `sources.ts`'s declaration scan but that scan
+ * discards the *value* half — it only proves a name is declared, never what
+ * it is bound to — and neither measured repository's real questions resolve
+ * through either format.
+ *
+ * The wrangler reading itself lives in `sources.ts` — `readWranglerVarsEntries`
+ * — the same file that owns every other format's structural read. This module
+ * only turns its output into `DeclaredEnvValue`s, the same way it already does
+ * for `readDotenvValues`; one reader per format, never a second one for the
+ * same file here.
+ *
+ * ## Never guessed, always refused
+ *
+ * `candidateEnvNames` returns `[]` — never a best guess — for any blockedBy
+ * shape it does not recognise. An blockedBy this module cannot parse stays
+ * exactly as open as it was before this module existed; principle 2 applies
+ * to a lookup the same way it applies to an edge.
+ */
+import { readWranglerVarsEntries } from "./../validation/sources.js";
+/** Direct reads of `.env*` need no resolution — DEC-244's precedent, reused rather than restated. */
+const DECLARATIVE_RESOLUTION = 3;
+const ACCESSOR = [
+    /^import\.meta\.env\.([A-Za-z_][A-Za-z0-9_]*)$/,
+    /^process\.env\.([A-Za-z_][A-Za-z0-9_]*)$/,
+    /^process\.env\[["']([A-Za-z_][A-Za-z0-9_]*)["']\]$/,
+    /^env\.([A-Za-z_][A-Za-z0-9_]*)$/,
+    /^env\[["']([A-Za-z_][A-Za-z0-9_]*)["']\]$/,
+];
+const LITERAL = /^(?:(["'`]).*\1|undefined|null|true|false|\d+(?:\.\d+)?)$/;
+/**
+ * Split on top-level `||` / `??`, never inside a quoted literal.
+ *
+ * The blocked strings this reads are call-site fragments, not general JS — no
+ * nested ternaries, no parenthesised groups observed in either measured
+ * repository. Good enough for what real code does here; anything stranger
+ * fails a `parseSide` downstream and the whole blockedBy is refused rather
+ * than partially trusted.
+ */
+function splitTopLevelFallback(blockedBy) {
+    const parts = [];
+    let depth = 0;
+    let quote = null;
+    let start = 0;
+    for (let i = 0; i < blockedBy.length; i += 1) {
+        const c = blockedBy[i];
+        if (quote !== null) {
+            if (c === quote && blockedBy[i - 1] !== "\\")
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'" || c === "`") {
+            quote = c;
+            continue;
+        }
+        if (c === "(" || c === "[")
+            depth += 1;
+        else if (c === ")" || c === "]")
+            depth -= 1;
+        else if (depth === 0 && (blockedBy.startsWith("||", i) || blockedBy.startsWith("??", i))) {
+            parts.push(blockedBy.slice(start, i));
+            i += 1;
+            start = i + 1;
+        }
+    }
+    parts.push(blockedBy.slice(start));
+    return parts.map((p) => p.trim()).filter((p) => p !== "");
+}
+function parseSide(side) {
+    for (const pattern of ACCESSOR) {
+        const match = pattern.exec(side);
+        if (match?.[1] !== undefined)
+            return match[1];
+    }
+    return null;
+}
+/**
+ * The candidate variable names an blockedBy could resolve to, in the order
+ * they would actually be tried at runtime. `[]` when any side of the
+ * blockedBy is neither a recognised accessor nor a literal fallback —
+ * refused as a whole rather than partially understood, per rule 2.
+ */
+export function candidateEnvNames(blockedBy) {
+    const sides = splitTopLevelFallback(blockedBy);
+    if (sides.length === 0)
+        return [];
+    const names = [];
+    for (const side of sides) {
+        const name = parseSide(side);
+        if (name !== null) {
+            if (!names.includes(name))
+                names.push(name);
+            continue;
+        }
+        if (LITERAL.test(side))
+            continue; // a string/number/undefined fallback names nothing
+        return []; // an unrecognised shape anywhere refuses the whole blockedBy
+    }
+    return names;
+}
+const EXAMPLE_SUFFIX = /\.(example|sample|template|dist|defaults?)$/i;
+const ENV_BASENAME = /^\.env(?:\.([A-Za-z0-9_-]+))?$/;
+/** `.env`, `.env.local`, `.env.<name>`, `.env.<name>.local`, and each with an example suffix. */
+function environmentOf(basename) {
+    const example = EXAMPLE_SUFFIX.test(basename) ? basename.replace(EXAMPLE_SUFFIX, "") : basename;
+    if (example === ".env" || example === ".env.local") {
+        return { environment: "default", local: example.endsWith(".local") };
+    }
+    const local = example.endsWith(".local");
+    const stem = local ? example.slice(0, -6) : example;
+    const match = ENV_BASENAME.exec(stem);
+    const name = match?.[1];
+    if (name === undefined)
+        return null;
+    return { environment: name, local };
+}
+/** `KEY=value` and `# KEY=value` (the commented-declaration case is skipped — no active value to read). */
+function readDotenvValues(text) {
+    const out = [];
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+        const raw = lines[i] ?? "";
+        if (/^\s*#/.test(raw))
+            continue;
+        const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(raw);
+        if (match === null)
+            continue;
+        const name = match[1];
+        let value = (match[2] ?? "").trim();
+        if (name === undefined)
+            continue;
+        const quoted = /^(["'])(.*)\1$/.exec(value);
+        if (quoted?.[2] !== undefined)
+            value = quoted[2];
+        out.push({ name, value, line: i + 1 });
+    }
+    return out;
+}
+/**
+ * Every value this repository's `.env*` and `wrangler.toml` surfaces state,
+ * across every environment they name. Read once per repository;
+ * `resolveAgainstDeclared` runs many times against the result rather than
+ * rescanning per ledger row.
+ */
+export function readDeclaredEnvValues(root, scan, readFile) {
+    const out = [];
+    for (const surface of scan.surfaces) {
+        if (surface.format !== "dotenv" && surface.format !== "wranglerVars")
+            continue;
+        let text;
+        try {
+            text = readFile(`${root}/${surface.file}`);
+        }
+        catch {
+            continue; // unreadable — already surfaced by scanConfigSurfaces's own `unreadable` list
+        }
+        if (surface.format === "wranglerVars") {
+            // A commented-out `# KEY = "value"` line documents, it does not supply —
+            // the same rule `readDotenvValues` applies by simply never reading a
+            // commented line at all.
+            for (const entry of readWranglerVarsEntries(text)) {
+                if (entry.commented || entry.value === null)
+                    continue;
+                out.push({
+                    name: entry.name,
+                    environment: entry.environment,
+                    value: entry.value,
+                    file: surface.file,
+                    line: entry.line,
+                    local: false,
+                    example: false,
+                });
+            }
+            continue;
+        }
+        const basename = surface.file.split("/").pop() ?? surface.file;
+        const env = environmentOf(basename);
+        if (env === null)
+            continue;
+        for (const { name, value, line } of readDotenvValues(text)) {
+            out.push({
+                name,
+                environment: env.environment,
+                value,
+                file: surface.file,
+                line,
+                local: env.local,
+                example: surface.example,
+            });
+        }
+    }
+    return out;
+}
+/** `knownEnvironments` — every environment tag any `.env*` surface asserts, example files included. */
+function knownEnvironmentsOf(declared) {
+    const set = new Set();
+    for (const d of declared)
+        set.add(d.environment);
+    return [...set].sort();
+}
+/** A `.local` value for the same (name, environment) outranks the non-local one, same as Vite resolves them. */
+function pickBest(candidates) {
+    const local = candidates.find((c) => c.local && !c.example);
+    if (local !== undefined)
+        return local;
+    return candidates.find((c) => !c.example);
+}
+/**
+ * Resolve one blocked blockedBy against every declared value this
+ * repository already has on disk. Never invents an environment, never picks
+ * a value from a different repository, never treats an example file's
+ * placeholder as an answer.
+ */
+export function resolveAgainstDeclared(blockedBy, declared) {
+    const candidates = candidateEnvNames(blockedBy);
+    const knownEnvironments = knownEnvironmentsOf(declared);
+    if (candidates.length === 0) {
+        return {
+            blockedBy,
+            candidates: [],
+            resolved: [],
+            knownEnvironments,
+            unresolvedEnvironments: knownEnvironments,
+            resolution: null,
+        };
+    }
+    const byEnvironment = new Map();
+    for (const d of declared) {
+        if (!candidates.includes(d.name))
+            continue;
+        const list = byEnvironment.get(d.environment) ?? [];
+        list.push(d);
+        byEnvironment.set(d.environment, list);
+    }
+    const resolved = [];
+    for (const environment of knownEnvironments) {
+        const options = byEnvironment.get(environment);
+        if (options === undefined)
+            continue;
+        // Earlier candidates win, same priority order the fallback chain itself uses.
+        for (const name of candidates) {
+            const forName = options.filter((o) => o.name === name);
+            const best = pickBest(forName);
+            if (best !== undefined) {
+                resolved.push({ environment, name, value: best.value, file: best.file, line: best.line, local: best.local });
+                break;
+            }
+        }
+    }
+    const resolvedEnvironments = new Set(resolved.map((r) => r.environment));
+    const unresolvedEnvironments = knownEnvironments.filter((e) => !resolvedEnvironments.has(e));
+    return {
+        blockedBy,
+        candidates,
+        resolved,
+        knownEnvironments,
+        unresolvedEnvironments,
+        resolution: DECLARATIVE_RESOLUTION,
+    };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/ledger/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/ledger/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAKH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAwDrE,qGAAqG;AACrG,MAAM,sBAAsB,GAAoB,CAAC,CAAC;AAElD,MAAM,QAAQ,GAAG;IACf,+CAA+C;IAC/C,0CAA0C;IAC1C,oDAAoD;IACpD,iCAAiC;IACjC,2CAA2C;CACnC,CAAC;AAEX,MAAM,OAAO,GAAG,2DAA2D,CAAC;AAE5E;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,KAAK,IAAI,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,KAAK,GAAG,IAAI,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,KAAK,GAAG,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAClC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACvC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC,IAAI,CAAC,CAAC;YACP,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,mDAAmD;QACrF,OAAO,EAAE,CAAC,CAAC,6DAA6D;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,cAAc,GAAG,8CAA8C,CAAC;AACtE,MAAM,YAAY,GAAG,gCAAgC,CAAC;AAEtD,iGAAiG;AACjG,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChG,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QACnD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,2GAA2G;AAC3G,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAoD,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,MAAM,KAAK,GAAG,wDAAwD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAiB,EAAE,QAAkC;IACvG,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc;YAAE,SAAS;QAC/E,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,8EAA8E;QAC1F,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACtC,yEAAyE;YACzE,qEAAqE;YACrE,yBAAyB;YACzB,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;oBAAE,SAAS;gBACtD,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;QAC/D,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI;gBACJ,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,KAAK;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI;gBACJ,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uGAAuG;AACvG,SAAS,mBAAmB,CAAC,QAAqC;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,gHAAgH;AAChH,SAAS,QAAQ,CAAC,UAAuC;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,QAAqC;IAErC,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAExD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,SAAS;YACT,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,iBAAiB;YACjB,sBAAsB,EAAE,iBAAiB;YACzC,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,WAAW,IAAI,iBAAiB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,8EAA8E;QAC9E,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC7G,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,MAAM,sBAAsB,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7F,OAAO;QACL,SAAS;QACT,UAAU;QACV,QAAQ;QACR,iBAAiB;QACjB,sBAAsB;QACtB,UAAU,EAAE,sBAAsB;KACnC,CAAC;AACJ,CAAC"}

package/dist/multipr/fingerprint.d.ts

@@ -0,0 +1,56 @@
+/**
+ * §14.5's missing half: producing the fingerprints `findSuperseded` compares.
+ *
+ * ## The two git semantics, and why they differ on purpose
+ *
+ * The question is *"is this change's work already on base?"*, and answering it
+ * needs **two different diffs**:
+ *
+ * - **What the change touched** comes from `base...head` — three dots, against
+ *   the merge base. That is what a reviewer sees, and it does not include
+ *   somebody else's commits that landed on base afterwards.
+ * - **What base holds now** comes from the **tip of base**, not the merge base.
+ *
+ * That asymmetry *is* the mechanism. If someone else landed the same work while
+ * this change sat open, the three-dot diff still shows the change touching the
+ * file — its merge base is old — while base's tip already matches. Comparing
+ * against the merge base instead would report every open change as unsuperseded
+ * forever, because a merge base by construction predates the change.
+ *
+ * ## Granularity is the honest limit, and it is not a resolution problem
+ *
+ * These are **whole-file** hashes — git's own blob ids, which is the strongest
+ * available statement that two versions are identical, and the weakest useful
+ * unit. A change that edited one file for two reasons, one of which landed, is
+ * reported as differing. That is the conservative direction and the correct one:
+ * the finding this feeds tells a human to close a pull request, so a missed
+ * supersession costs a review and a false one costs the work.
+ *
+ * Node-level fingerprints would need the same file re-parsed at two commits,
+ * which is adapter work rather than core's. When that exists it changes the
+ * basis string and nothing else — `findSuperseded` compares opaque strings by
+ * construction, so this is a producer swap, not a redesign.
+ *
+ * ## What is not language knowledge
+ *
+ * Nothing here reads code. It asks git for content hashes and compares them,
+ * which is why it can ship in core at all — rule 1 is satisfied by never
+ * looking inside the bytes.
+ */
+import type { SupersededCandidate } from "./superseded.ts";
+/** What `git ls-tree`/`diff` produced, and what a caller must be told about it. */
+export interface CandidateReport {
+    readonly candidates: readonly SupersededCandidate[];
+    readonly notes: readonly string[];
+    /** The string `findSuperseded` should carry into its disclosure. */
+    readonly fingerprintBasis: string;
+}
+/**
+ * Fingerprint every file a change touched, as the change leaves it and as base
+ * holds it now.
+ *
+ * @param base the branch this change would merge into — compared at its **tip**
+ * @param head the tip of the change
+ */
+export declare function supersededCandidates(cwd: string, base: string, head?: string): Promise<CandidateReport>;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/multipr/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../src/multipr/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oEAAoE;IACpE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAkED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,SAAS,GACZ,OAAO,CAAC,eAAe,CAAC,CAoE1B"}

package/dist/multipr/fingerprint.js

@@ -0,0 +1,169 @@
+/**
+ * §14.5's missing half: producing the fingerprints `findSuperseded` compares.
+ *
+ * ## The two git semantics, and why they differ on purpose
+ *
+ * The question is *"is this change's work already on base?"*, and answering it
+ * needs **two different diffs**:
+ *
+ * - **What the change touched** comes from `base...head` — three dots, against
+ *   the merge base. That is what a reviewer sees, and it does not include
+ *   somebody else's commits that landed on base afterwards.
+ * - **What base holds now** comes from the **tip of base**, not the merge base.
+ *
+ * That asymmetry *is* the mechanism. If someone else landed the same work while
+ * this change sat open, the three-dot diff still shows the change touching the
+ * file — its merge base is old — while base's tip already matches. Comparing
+ * against the merge base instead would report every open change as unsuperseded
+ * forever, because a merge base by construction predates the change.
+ *
+ * ## Granularity is the honest limit, and it is not a resolution problem
+ *
+ * These are **whole-file** hashes — git's own blob ids, which is the strongest
+ * available statement that two versions are identical, and the weakest useful
+ * unit. A change that edited one file for two reasons, one of which landed, is
+ * reported as differing. That is the conservative direction and the correct one:
+ * the finding this feeds tells a human to close a pull request, so a missed
+ * supersession costs a review and a false one costs the work.
+ *
+ * Node-level fingerprints would need the same file re-parsed at two commits,
+ * which is adapter work rather than core's. When that exists it changes the
+ * basis string and nothing else — `findSuperseded` compares opaque strings by
+ * construction, so this is a producer swap, not a redesign.
+ *
+ * ## What is not language knowledge
+ *
+ * Nothing here reads code. It asks git for content hashes and compares them,
+ * which is why it can ship in core at all — rule 1 is satisfied by never
+ * looking inside the bytes.
+ */
+import { spawn } from "node:child_process";
+import { cleanGitEnv } from "../sources/git/env.js";
+const BASIS = "git blob identity at whole-file granularity — two versions are called identical when git " +
+    "gives them the same object id, and a difference means only that the file bytes differ";
+/**
+ * Pathspecs are chunked rather than passed whole. A large change can exceed the
+ * argument limit, and the failure mode is an OS-level error whose message says
+ * nothing about paths — the kind of thing that gets diagnosed as a git problem.
+ */
+const PATH_CHUNK = 200;
+async function git(cwd, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("git", args, { cwd, env: cleanGitEnv() });
+        let out = "";
+        let err = "";
+        child.stdout.on("data", (d) => (out += d.toString("utf8")));
+        child.stderr.on("data", (d) => (err += d.toString("utf8")));
+        child.on("error", reject);
+        child.on("close", (code) => {
+            if (code === 0)
+                resolve(out);
+            else
+                reject(new Error(`git ${args.slice(0, 2).join(" ")} failed: ${err.trim() || code}`));
+        });
+    });
+}
+/**
+ * Blob ids for `paths` at `ref`. A path absent from the tree is **absent from
+ * the map**, which the caller turns into `"absent"` — distinct from a git
+ * failure, which throws and becomes `"unknown"`.
+ *
+ * `-z` because a path may legally contain a newline. (It may not contain NUL,
+ * which is why NUL is the correct delimiter *on a pipe* even though it is the
+ * wrong thing to write into a file a human is meant to review.)
+ */
+async function blobIds(cwd, ref, paths) {
+    const found = new Map();
+    for (let i = 0; i < paths.length; i += PATH_CHUNK) {
+        const chunk = paths.slice(i, i + PATH_CHUNK);
+        const out = await git(cwd, ["ls-tree", "-r", "-z", ref, "--", ...chunk]);
+        for (const record of out.split("\0")) {
+            if (record === "")
+                continue;
+            // "<mode> <type> <sha>\t<path>"
+            const tab = record.indexOf("\t");
+            if (tab === -1)
+                continue;
+            const meta = record.slice(0, tab).split(/\s+/);
+            const sha = meta[2];
+            const path = record.slice(tab + 1);
+            if (sha !== undefined && meta[1] === "blob")
+                found.set(path, sha);
+        }
+    }
+    return found;
+}
+function diffTypeOf(status) {
+    if (status.startsWith("A"))
+        return "added";
+    if (status.startsWith("D"))
+        return "deleted";
+    return "modified";
+}
+/**
+ * Fingerprint every file a change touched, as the change leaves it and as base
+ * holds it now.
+ *
+ * @param base the branch this change would merge into — compared at its **tip**
+ * @param head the tip of the change
+ */
+export async function supersededCandidates(cwd, base, head = "HEAD") {
+    const notes = [];
+    // Three dots: what this change touched, against the merge base. Renames are
+    // followed so a moved file is one candidate rather than a delete and an add.
+    const statusOut = await git(cwd, ["diff", "--name-status", "-M", "-z", `${base}...${head}`]);
+    const touched = [];
+    const fields = statusOut.split("\0");
+    for (let i = 0; i < fields.length; i += 1) {
+        const status = fields[i];
+        if (status === undefined || status === "")
+            continue;
+        // A rename record is `R<score>\0<old>\0<new>` — three fields, and the new
+        // path is the one that exists to be compared.
+        if (status.startsWith("R") || status.startsWith("C")) {
+            const to = fields[i + 2];
+            if (to !== undefined && to !== "")
+                touched.push({ path: to, diffType: "modified" });
+            i += 2;
+            continue;
+        }
+        const path = fields[i + 1];
+        if (path !== undefined && path !== "")
+            touched.push({ path, diffType: diffTypeOf(status) });
+        i += 1;
+    }
+    if (touched.length === 0) {
+        notes.push(`No file differs between ${base} and ${head}, so there was nothing to fingerprint. An ` +
+            "empty diff is a real answer and is not the same as a change whose work is already on base.");
+        return { candidates: [], notes, fingerprintBasis: BASIS };
+    }
+    const paths = touched.map((t) => t.path);
+    // The tip of base, deliberately — see the header. Resolved once so a branch
+    // that moves mid-run cannot make two halves of one answer disagree.
+    const baseSha = (await git(cwd, ["rev-parse", base])).trim();
+    const [afterBlobs, baseBlobs] = await Promise.all([
+        blobIds(cwd, head, paths),
+        blobIds(cwd, baseSha, paths),
+    ]);
+    const candidates = touched.map((t) => ({
+        nodeId: t.path,
+        file: t.path,
+        diffType: t.diffType,
+        after: afterBlobs.get(t.path) ?? "absent",
+        base: baseBlobs.get(t.path) ?? "absent",
+        // R0: nothing was parsed. The comparison itself is exact — git object ids
+        // are equal only for identical content — but the *claim* rests on
+        // whole-file granularity being the right unit for "this work is already
+        // there", which is a judgement no resolution level supports. Rule 2's
+        // direction: understate.
+        resolution: 0,
+    }));
+    notes.push(`${candidates.length} file(s) fingerprinted at ${head} and at ${base} (${baseSha.slice(0, 12)}). ` +
+        "Base is compared at its tip rather than at the merge base: if this work landed by another " +
+        "route while the change was open, the merge base still predates it and only the tip shows it.");
+    notes.push("Fingerprints are whole-file. A file edited for two reasons, one of which landed, reports as " +
+        "differing — the conservative direction, and the right one for a check whose finding tells " +
+        "someone to discard work.");
+    return { candidates, notes, fingerprintBasis: BASIS };
+}
+//# sourceMappingURL=fingerprint.js.map