@latysh-development/monolith 0.0.0-stage → 0.1.0-alpha.1

package/dist/managed/index.js

@@ -0,0 +1,222 @@
+/**
+ * Managed blocks (DX-UPDATE-003): the one mechanism by which `monolith init`
+ * and `monolith update` put MONOLITH-owned text into a file the user also owns
+ * (CLAUDE.md, AGENTS.md, routing-map, skills index) or into a MONOLITH-owned
+ * file the user may extend (`AGENT.md`).
+ *
+ *   <!-- monolith:begin <id> sha256=<16 hex of the body> -->
+ *   ...body...
+ *   <!-- monolith:end <id> -->
+ *
+ * The checksum is what makes a refresh safe without a stored template version:
+ * a block whose body still matches its own checksum was never edited, so it is
+ * ours to refresh; a block that does not match carries a user edit and is left
+ * alone (CONFLICT). Everything outside the markers is never read for meaning
+ * and never changed. Markers inside fenced code blocks are examples, not blocks.
+ * This is not a Markdown parser: it knows lines, fences and these markers.
+ */
+import { createHash } from 'crypto';
+import { readFileSync } from 'fs';
+import { dirname, join, resolve } from 'path';
+import { fileURLToPath } from 'url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// Works from src/managed/ and dist/managed/ alike.
+const MANAGED_TEMPLATES = resolve(__dirname, '..', '..', 'templates', 'default-instance', 'managed');
+export const BLOCK_IDS = ['bootstrap', 'agent', 'routing-idea', 'index-idea'];
+/** `{{MANAGED_<ID>}}` placeholder name used by the init templates. */
+export function placeholderFor(id) {
+    return `MANAGED_${id.toUpperCase().replace(/-/g, '_')}`;
+}
+export function bodyHash(body) {
+    return createHash('sha256').update(normalize(body)).digest('hex').slice(0, 16);
+}
+function normalize(s) {
+    return s.replace(/\r\n/g, '\n').replace(/\s+$/, '');
+}
+/** The body of a block for a given instance root. */
+export function blockBody(id, monolithRoot) {
+    const raw = readFileSync(join(MANAGED_TEMPLATES, `${id}.md`), 'utf8');
+    return normalize(raw.replace(/\{\{MONOLITH_ROOT\}\}/g, monolithRoot));
+}
+/** The block as it is written to a file (markers + body), ending in a newline. */
+export function renderBlock(id, body, eol = '\n') {
+    const lines = [`<!-- monolith:begin ${id} sha256=${bodyHash(body)} -->`, ...normalize(body).split('\n'), `<!-- monolith:end ${id} -->`];
+    return lines.join(eol) + eol;
+}
+const MARKER = /^<!-- monolith:(begin|end) ([a-z-]+)(?: sha256=([0-9a-f]{16}))? -->$/;
+const FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})(.*)$/;
+const FENCE_CLOSE = /^ {0,3}(`{3,}|~{3,})[ \t]*$/;
+function splitLines(text) {
+    return text.match(/[^\n]*\n|[^\n]+$/g) ?? [];
+}
+/** A leading UTF-8 BOM is not part of the first line's Markdown. */
+const stripBom = (l, i) => (i === 0 ? l.replace(/^\uFEFF/, '') : l);
+/**
+ * Per line: is it a fence line or inside a fenced code block? Same rules as
+ * CommonMark for the cases that matter here: a fence is 3+ backticks or tildes
+ * (at most 3 spaces of indent), it closes on the same character with at least
+ * the same length and nothing after it, and a block left open runs to the end
+ * of the file. `open` tells whether the text ends inside such a block.
+ */
+function scanFences(lines) {
+    const hidden = [];
+    let fence = null;
+    for (const [i, l] of lines.entries()) {
+        const t = stripBom(l, i).replace(/\r?\n$/, '');
+        if (fence === null) {
+            const o = FENCE_OPEN.exec(t);
+            if (o && !(o[1][0] === '`' && o[2].includes('`'))) {
+                fence = { ch: o[1][0], len: o[1].length };
+                hidden.push(true);
+            }
+            else
+                hidden.push(false);
+        }
+        else {
+            const c = FENCE_CLOSE.exec(t);
+            if (c && c[1][0] === fence.ch && c[1].length >= fence.len)
+                fence = null;
+            hidden.push(true);
+        }
+    }
+    return { hidden, open: fence !== null };
+}
+/**
+ * Per line (outside fences): does it start inside an HTML comment? `open` tells
+ * whether the text ends inside one. A line that is exactly a marker opens and
+ * closes its own comment and does not change the state. Deliberately naive: a
+ * `<!--` in inline code counts as a comment, which can only make us refuse.
+ */
+function scanComments(lines, hidden) {
+    const inside = [];
+    let open = false;
+    lines.forEach((l, i) => {
+        inside.push(open);
+        if (hidden[i])
+            return;
+        const t = stripBom(l, i).replace(/\r?\n$/, '');
+        if (!open && MARKER.test(t.trim()))
+            return;
+        let at = 0;
+        for (;;) {
+            if (open) {
+                const end = t.indexOf('-->', at);
+                if (end < 0)
+                    break;
+                open = false;
+                at = end + 3;
+            }
+            else {
+                const start = t.indexOf('<!--', at);
+                if (start < 0)
+                    break;
+                open = true;
+                at = start + 4;
+            }
+        }
+    });
+    return { inside, open };
+}
+function markers(lines) {
+    const out = [];
+    const { hidden } = scanFences(lines);
+    const { inside } = scanComments(lines, hidden);
+    lines.forEach((l, i) => {
+        if (hidden[i])
+            return;
+        const t = l.replace(/\r?\n$/, '');
+        const m = MARKER.exec(t.trim());
+        if (m)
+            out.push({ kind: m[1], id: m[2], hash: m[3], line: i, commented: inside[i] });
+    });
+    return out;
+}
+/** Classify `id` in `text` against the template body `desired`. */
+export function inspectBlock(text, id, desired) {
+    const lines = splitLines(text);
+    const all = markers(lines);
+    const mine = all.filter((m) => m.id === id);
+    if (mine.length === 0)
+        return { state: 'absent' };
+    if (mine.some((m) => m.commented)) {
+        return { state: 'malformed', detail: `a "${id}" marker sits inside an HTML comment, so the block is not active` };
+    }
+    const begins = mine.filter((m) => m.kind === 'begin');
+    const ends = mine.filter((m) => m.kind === 'end');
+    if (begins.length !== 1 || ends.length !== 1) {
+        return { state: 'malformed', detail: `${begins.length} begin and ${ends.length} end marker(s) for "${id}"; exactly one of each is required` };
+    }
+    const [b] = begins;
+    const [e] = ends;
+    if (e.line < b.line)
+        return { state: 'malformed', detail: `the "${id}" end marker precedes its begin marker` };
+    if (all.some((m) => m !== b && m !== e && m.line > b.line && m.line < e.line)) {
+        return { state: 'malformed', detail: `another managed marker sits inside the "${id}" block` };
+    }
+    if (b.hash === undefined)
+        return { state: 'malformed', detail: `the "${id}" begin marker has no checksum` };
+    const body = lines.slice(b.line + 1, e.line).join('');
+    if (bodyHash(body) !== b.hash) {
+        return { state: 'edited', detail: `the text inside the "${id}" block was edited after MONOLITH wrote it` };
+    }
+    return { state: 'pristine', current: normalize(body) === normalize(desired), from: b.line, to: e.line, lines };
+}
+function eolOf(text) {
+    return text.includes('\r\n') ? '\r\n' : '\n';
+}
+/** `text` plus the block, appended; every existing byte stays in place. */
+export function appendBlock(text, id, body) {
+    const eol = eolOf(text);
+    const sep = text.length === 0 ? '' : text.endsWith('\n') ? eol : eol + eol;
+    return text + sep + renderBlock(id, body, eol);
+}
+/** `text` with only the lines of the block replaced. */
+export function refreshBlock(text, state, id, body) {
+    const eol = eolOf(text);
+    const rendered = renderBlock(id, body, eol);
+    // The end-marker line may be the unterminated last line of the file: keep it that way.
+    const unterminated = !/\n$/.test(state.lines[state.to]);
+    const block = unterminated ? rendered.slice(0, -eol.length) : rendered;
+    return state.lines.slice(0, state.from).join('') + block + state.lines.slice(state.to + 1).join('');
+}
+/**
+ * `text` with the block appended, or the reason that is not safe. Safe means the
+ * result, read back by `inspectBlock`, shows exactly one well-formed, unedited
+ * block that equals the template, and every original byte is still in place.
+ * An unclosed code fence or HTML comment in `text` swallows the new markers (the next run would
+ * not see the block and append another), so it is refused up front.
+ */
+export function planAppend(text, id, body) {
+    if (scanFences(splitLines(text)).open) {
+        return { ok: false, detail: 'the file ends inside an unclosed fenced code block (``` or ~~~), which would hide the new block' };
+    }
+    const lines = splitLines(text);
+    if (scanComments(lines, scanFences(lines).hidden).open) {
+        return { ok: false, detail: 'the file ends inside an unclosed HTML comment (<!--), which would hide the new block' };
+    }
+    const content = appendBlock(text, id, body);
+    if (!content.startsWith(text))
+        return { ok: false, detail: 'the append would not keep the existing bytes in place' };
+    return verified(content, id, body);
+}
+/** `text` with the block refreshed in place, or the reason that is not safe (see `planAppend`). */
+export function planRefresh(text, state, id, body) {
+    const content = refreshBlock(text, state, id, body);
+    const head = state.lines.slice(0, state.from).join('');
+    const tail = state.lines.slice(state.to + 1).join('');
+    if (!content.startsWith(head) || !content.endsWith(tail))
+        return { ok: false, detail: 'the refresh would change text outside the block' };
+    return verified(content, id, body);
+}
+function verified(content, id, body) {
+    const st = inspectBlock(content, id, body);
+    if (st.state === 'pristine' && st.current)
+        return { ok: true, content };
+    return { ok: false, detail: `the written block would not be recognised as current (${st.state === 'pristine' ? 'stale' : st.state})` };
+}
+/** Text with fenced code blocks and HTML comments removed: what an assistant reads as instructions. */
+export function prose(text) {
+    const lines = splitLines(text);
+    const { hidden } = scanFences(lines);
+    return lines.filter((_, i) => !hidden[i]).join('').replace(/<!--[\s\S]*?-->/g, '');
+}

package/dist/readmodel/dashboard.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `readDashboardModel(projectRoot)` — builds the DashboardReadModel.
+ *
+ * Contract:
+ *  - `projectRoot` is supplied by the embedding process (fixed at startup),
+ *    never by a request. The set of files read is closed (see SourceId).
+ *  - Strictly read-only and synchronous: no write, no lock, no `mutateState`,
+ *    no `validate`, no `import()` of project code, no network. Nothing is
+ *    cached; every call re-reads.
+ *  - Never throws. Failures become SourceReport / ReadNote data.
+ *  - Deterministic: same files ⇒ deep-equal result; no timestamps.
+ *
+ * Containment (G1): the instance root is resolved with `resolveMonolithRoot`
+ * (ADR-009) and every file is read with `readProjectFile`, which realpath-checks
+ * each path component against the real project root and then performs the
+ * bounded, non-blocking read of SEC-001B.1. `readState` is deliberately NOT
+ * used: it does not check containment. Check-then-use races are NOT closed by
+ * Core (SEC-001B) and are therefore not closed here.
+ *
+ * Every source goes through `readProjectFile` (ADR-014): no symlink in any
+ * component, one hard link, regular file, absolute boundary, never the cwd.
+ * This module adds no filesystem checks of its own; it only interprets Core's
+ * typed result (`FILE_CODE_MAP`). Threat model (ADR-013): TM-A supported with
+ * limitations, TM-B partially supported, TM-C (concurrent mutation) NOT supported.
+ */
+import { type ProjectFileErrorCode } from '../root/index.js';
+import type { DashboardReadModel, SourceErrorCode, SourceStatus } from './types.js';
+export declare const ROADMAP_REL = "context/maps/roadmap-index.md";
+/** Protective ceiling, like the other SEC-001B.1 limits — not a content policy. */
+export declare const MAX_ROADMAP_BYTES: number;
+/**
+ * Exhaustive over Core's `ProjectFileErrorCode`: a new Core code is a compile
+ * error here until it is mapped. The status of a security violation is NOT
+ * decided here — `sourceFailure` takes it from Core's `isReadSecurityViolation`,
+ * so the UI keeps no second classification of filesystem security. The
+ * 'forbidden' entries only document that and are checked against Core in tests.
+ */
+export declare const FILE_CODE_MAP: Readonly<Record<ProjectFileErrorCode, readonly [SourceStatus, SourceErrorCode]>>;
+export declare function readDashboardModel(projectRoot: string): DashboardReadModel;
+//# sourceMappingURL=dashboard.d.ts.map

package/dist/readmodel/dashboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../src/readmodel/dashboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,EAQL,KAAK,oBAAoB,EAE1B,MAAM,kBAAkB,CAAC;AAS1B,OAAO,KAAK,EAGV,kBAAkB,EAKlB,eAAe,EAGf,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,WAAW,kCAAkC,CAAC;AAC3D,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAS5C;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAa1G,CAAC;AA+LF,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAQ1E"}

package/dist/readmodel/dashboard.js

@@ -0,0 +1,236 @@
+/**
+ * `readDashboardModel(projectRoot)` — builds the DashboardReadModel.
+ *
+ * Contract:
+ *  - `projectRoot` is supplied by the embedding process (fixed at startup),
+ *    never by a request. The set of files read is closed (see SourceId).
+ *  - Strictly read-only and synchronous: no write, no lock, no `mutateState`,
+ *    no `validate`, no `import()` of project code, no network. Nothing is
+ *    cached; every call re-reads.
+ *  - Never throws. Failures become SourceReport / ReadNote data.
+ *  - Deterministic: same files ⇒ deep-equal result; no timestamps.
+ *
+ * Containment (G1): the instance root is resolved with `resolveMonolithRoot`
+ * (ADR-009) and every file is read with `readProjectFile`, which realpath-checks
+ * each path component against the real project root and then performs the
+ * bounded, non-blocking read of SEC-001B.1. `readState` is deliberately NOT
+ * used: it does not check containment. Check-then-use races are NOT closed by
+ * Core (SEC-001B) and are therefore not closed here.
+ *
+ * Every source goes through `readProjectFile` (ADR-014): no symlink in any
+ * component, one hard link, regular file, absolute boundary, never the cwd.
+ * This module adds no filesystem checks of its own; it only interprets Core's
+ * typed result (`FILE_CODE_MAP`). Threat model (ADR-013): TM-A supported with
+ * limitations, TM-B partially supported, TM-C (concurrent mutation) NOT supported.
+ */
+import { MAX_STATE_BYTES, validateState } from '../coordinatorium/index.js';
+import { CONFIG_FILE_NAME, MAX_PROJECT_FILE_BYTES, isReadSecurityViolation, RootContainmentError, readProjectFile, resolveMonolithRoot, } from '../root/index.js';
+import { MAX_ACTIVE_CONTEXT_BYTES } from '../brief/collect.js';
+import { ACTIVE_MD_REL } from '../brief/constants.js';
+import { extractCurrentStory } from '../brief/story.js';
+import { hasCheckpointOrderMismatch, selectActiveMissions, selectLatestCheckpoint, } from '../brief/selectors.js';
+export const ROADMAP_REL = 'context/maps/roadmap-index.md';
+/** Protective ceiling, like the other SEC-001B.1 limits — not a content policy. */
+export const MAX_ROADMAP_BYTES = 256 * 1024;
+const CHANGED_RETRIES = 3;
+/**
+ * Exhaustive over Core's `ProjectFileErrorCode`: a new Core code is a compile
+ * error here until it is mapped. The status of a security violation is NOT
+ * decided here — `sourceFailure` takes it from Core's `isReadSecurityViolation`,
+ * so the UI keeps no second classification of filesystem security. The
+ * 'forbidden' entries only document that and are checked against Core in tests.
+ */
+export const FILE_CODE_MAP = {
+    FILE_MISSING: ['absent', 'SOURCE_ABSENT'],
+    FILE_OUTSIDE_PROJECT: ['forbidden', 'SOURCE_OUTSIDE_PROJECT'],
+    FILE_UNRESOLVABLE: ['unreadable', 'SOURCE_UNRESOLVABLE'],
+    FILE_NOT_REGULAR: ['forbidden', 'SOURCE_NOT_REGULAR'],
+    FILE_EMPTY: ['corrupt', 'SOURCE_EMPTY'],
+    FILE_TOO_LARGE: ['unreadable', 'SOURCE_TOO_LARGE'],
+    FILE_CHANGED: ['unreadable', 'SOURCE_CHANGED'],
+    FILE_UNREADABLE: ['unreadable', 'SOURCE_UNREADABLE'],
+    FILE_SYMLINK: ['forbidden', 'SOURCE_SYMLINK'],
+    FILE_HARDLINKED: ['forbidden', 'SOURCE_HARDLINKED'],
+    READ_BOUNDARY_INVALID: ['forbidden', 'SOURCE_BOUNDARY_INVALID'],
+    READ_UNSUPPORTED_PLATFORM: ['forbidden', 'SOURCE_UNSUPPORTED_PLATFORM'],
+};
+/** Never maps a security violation to anything but 'forbidden'; no default for unknown codes. */
+function sourceFailure(code) {
+    const [status, sourceCode] = FILE_CODE_MAP[code];
+    return [isReadSecurityViolation(code) ? 'forbidden' : status, sourceCode];
+}
+function report(id, path, status, code) {
+    return { id, path, status, code };
+}
+function withStatus(r, status, code) {
+    return { ...r, status, code };
+}
+/** One contained, bounded read of a fixed project-relative path. */
+function load(projectRoot, id, relPath, maxBytes) {
+    try {
+        let read = readProjectFile(projectRoot, relPath, { maxBytes, allowEmpty: true });
+        // A rename-based writer replacing the file under us is normal, not a fault.
+        for (let i = 1; i < CHANGED_RETRIES && !read.ok && read.code === 'FILE_CHANGED'; i++) {
+            read = readProjectFile(projectRoot, relPath, { maxBytes, allowEmpty: true });
+        }
+        if (read.ok)
+            return { report: report(id, relPath, 'available', null), content: read.content };
+        const [status, code] = sourceFailure(read.code);
+        return { report: report(id, relPath, status, code), content: null };
+    }
+    catch {
+        return { report: report(id, relPath, 'unreadable', 'INTERNAL'), content: null };
+    }
+}
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function loadConfig(projectRoot) {
+    const loaded = load(projectRoot, 'config', CONFIG_FILE_NAME, MAX_PROJECT_FILE_BYTES);
+    if (loaded.report.status === 'absent')
+        return { report: loaded.report, read: { status: 'absent' }, name: null };
+    if (loaded.content === null) {
+        return { report: loaded.report, read: null, name: null };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(loaded.content);
+    }
+    catch {
+        return { report: withStatus(loaded.report, 'corrupt', 'CONFIG_INVALID'), read: null, name: null };
+    }
+    if (!isPlainObject(parsed)) {
+        return { report: withStatus(loaded.report, 'corrupt', 'CONFIG_INVALID'), read: null, name: null };
+    }
+    const project = parsed.project;
+    const rawName = isPlainObject(project) ? project.name : undefined;
+    const name = typeof rawName === 'string' && rawName.length > 0 ? rawName : null;
+    return { report: loaded.report, read: { status: 'ok', cfg: parsed }, name };
+}
+function loadState(projectRoot, root) {
+    const loaded = load(projectRoot, 'state', `${root.monolithRoot}/state.json`, MAX_STATE_BYTES);
+    if (loaded.content === null)
+        return { report: loaded.report, state: null, schemaVersionOnDisk: null };
+    const corrupt = (code) => ({
+        report: withStatus(loaded.report, 'corrupt', code),
+        state: null,
+        schemaVersionOnDisk: null,
+    });
+    if (loaded.content.trim() === '')
+        return corrupt('SOURCE_EMPTY');
+    let parsed;
+    try {
+        parsed = JSON.parse(loaded.content);
+    }
+    catch {
+        return corrupt('PARSE_ERROR');
+    }
+    try {
+        const state = validateState(parsed);
+        const onDisk = isPlainObject(parsed) && typeof parsed.schemaVersion === 'number' ? parsed.schemaVersion : null;
+        return { report: loaded.report, state, schemaVersionOnDisk: onDisk };
+    }
+    catch {
+        return corrupt('SCHEMA_INVALID');
+    }
+}
+function section(data, sources) {
+    return { data, sources };
+}
+/** Root could not be trusted: nothing below it is read (fail closed, never a default fallback). */
+function unreadableModel(config, rootCode = 'ROOT_INVALID') {
+    const refused = (id) => report(id, null, 'forbidden', rootCode);
+    const state = refused('state');
+    const story = refused('activeStory');
+    const roadmap = refused('roadmap');
+    return {
+        projectOverview: section(null, [config, state, story]),
+        currentMissions: section(null, [state]),
+        checkpoints: section(null, [state]),
+        roadmap: section(null, [roadmap]),
+        diagnostics: { validation: 'NOT_PERFORMED', sources: [config, state, story, roadmap], notes: [] },
+    };
+}
+function buildModel(projectRoot) {
+    const config = loadConfig(projectRoot);
+    if (config.read === null)
+        return unreadableModel(config.report);
+    let root;
+    try {
+        root = resolveMonolithRoot(projectRoot, config.read);
+    }
+    catch (err) {
+        if (err instanceof RootContainmentError)
+            return unreadableModel(config.report);
+        throw err;
+    }
+    const notes = [];
+    const stateResult = loadState(projectRoot, root);
+    const storyLoaded = load(projectRoot, 'activeStory', `${root.monolithRoot}/${ACTIVE_MD_REL}`, MAX_ACTIVE_CONTEXT_BYTES);
+    const roadmapLoaded = load(projectRoot, 'roadmap', `${root.monolithRoot}/${ROADMAP_REL}`, MAX_ROADMAP_BYTES);
+    // An absent state.json means "no missions ever recorded", exactly like `brief`.
+    const stateUsable = stateResult.report.status === 'available' || stateResult.report.status === 'absent';
+    const state = stateResult.state;
+    const missions = state ? Object.values(state.tactical.missions) : [];
+    const active = state ? selectActiveMissions(state) : [];
+    if (stateResult.schemaVersionOnDisk === 1)
+        notes.push({ code: 'STATE_LEGACY_SCHEMA_MIGRATED', severity: 'info' });
+    if (active.length > 1)
+        notes.push({ code: 'MULTIPLE_ACTIVE_MISSIONS', severity: 'info' });
+    let currentStory = null;
+    if (storyLoaded.content !== null) {
+        const extraction = extractCurrentStory(storyLoaded.content);
+        if (extraction.hasCurrentStorySection && extraction.excerpt !== null && extraction.lineRange !== null) {
+            currentStory = { excerpt: extraction.excerpt, lineRange: extraction.lineRange };
+        }
+        else {
+            notes.push({ code: 'ACTIVE_MD_NO_CURRENT_STORY', severity: 'info' });
+        }
+    }
+    const overview = {
+        name: config.name,
+        monolithRoot: root.monolithRoot,
+        monolithRootSource: root.source,
+        stateSchemaVersionOnDisk: stateResult.schemaVersionOnDisk,
+        stateRevision: state && stateResult.report.status === 'available' ? state.revision : null,
+        activeMissionCount: stateUsable ? active.length : null,
+        finishedMissionCount: stateUsable ? missions.length - active.length : null,
+        currentStory,
+    };
+    const currentMissions = stateUsable ? { active } : null;
+    let checkpoints = null;
+    if (state !== null || stateResult.report.status === 'absent') {
+        const all = state ? Object.values(state.tactical.checkpoints) : [];
+        checkpoints = {
+            byActiveMission: active.map((m) => {
+                const latest = state ? selectLatestCheckpoint(state, m.id) : null;
+                if (state && latest && hasCheckpointOrderMismatch(state, m.id, latest)) {
+                    notes.push({ code: 'CHECKPOINT_ORDER_MISMATCH', severity: 'info' });
+                }
+                return { missionId: m.id, count: all.filter((c) => c.missionId === m.id).length, latest };
+            }),
+        };
+    }
+    const roadmap = roadmapLoaded.content === null ? null : { text: roadmapLoaded.content };
+    return {
+        projectOverview: section(overview, [config.report, stateResult.report, storyLoaded.report]),
+        currentMissions: section(currentMissions, [stateResult.report]),
+        checkpoints: section(checkpoints, [stateResult.report]),
+        roadmap: section(roadmap, [roadmapLoaded.report]),
+        diagnostics: {
+            validation: 'NOT_PERFORMED',
+            sources: [config.report, stateResult.report, storyLoaded.report, roadmapLoaded.report],
+            notes,
+        },
+    };
+}
+export function readDashboardModel(projectRoot) {
+    try {
+        return buildModel(projectRoot);
+    }
+    catch {
+        // Unexpected fault: report it as data, without any message or path.
+        const internal = report('config', null, 'unreadable', 'INTERNAL');
+        return unreadableModel(internal, 'INTERNAL');
+    }
+}

package/dist/readmodel/index.d.ts

@@ -0,0 +1,3 @@
+export { readDashboardModel, ROADMAP_REL, MAX_ROADMAP_BYTES } from './dashboard.js';
+export type { CheckpointsData, CurrentMissions, DashboardReadModel, MissionCheckpoints, NoteCode, ProjectOverview, ReadDiagnostics, ReadNote, RoadmapData, Section, SourceErrorCode, SourceId, SourceReport, SourceStatus, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/readmodel/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/readmodel/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpF,YAAY,EACV,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,eAAe,EACf,eAAe,EACf,QAAQ,EACR,WAAW,EACX,OAAO,EACP,eAAe,EACf,QAAQ,EACR,YAAY,EACZ,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/readmodel/index.js

@@ -0,0 +1 @@
+export { readDashboardModel, ROADMAP_REL, MAX_ROADMAP_BYTES } from './dashboard.js';

package/dist/readmodel/types.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Typed Read Model for Mission Control (UI-001B.1, ADR-010).
+ *
+ * A pure, read-only projection of data MONOLITH Core already owns. It adds no
+ * persistent schema and no source of truth: every field is copied from, or
+ * counted over, an existing artifact (`monolith.config.json`, `state.json`,
+ * `active.md`, `roadmap-index.md`).
+ *
+ * Errors are DATA, not text: only fixed enum codes and project-relative paths
+ * cross this boundary. No absolute path, no exception message and no file
+ * excerpt other than the explicit content fields below ever appears in a
+ * diagnostic, so the DTO is safe to serialize over HTTP later (G2 still gates
+ * that).
+ */
+import type { Checkpoint, Mission } from '../coordinatorium/types.js';
+/** The fixed, closed set of files this model reads. */
+export type SourceId = 'config' | 'state' | 'activeStory' | 'roadmap';
+/**
+ * - available: read and (where applicable) parsed successfully
+ * - absent:    the file does not exist (a legitimate state for a fresh project)
+ * - corrupt:   the file was read but its content is unusable
+ * - forbidden: reading was refused by a security boundary
+ * - unreadable: the file exists inside the boundary but could not be read
+ */
+export type SourceStatus = 'available' | 'absent' | 'corrupt' | 'forbidden' | 'unreadable';
+export type SourceErrorCode = 'SOURCE_ABSENT' | 'SOURCE_OUTSIDE_PROJECT' | 'SOURCE_UNRESOLVABLE' | 'SOURCE_NOT_REGULAR' | 'SOURCE_EMPTY' | 'SOURCE_TOO_LARGE' | 'SOURCE_CHANGED' | 'SOURCE_UNREADABLE' | 'SOURCE_SYMLINK' | 'SOURCE_HARDLINKED' | 'SOURCE_BOUNDARY_INVALID' | 'SOURCE_UNSUPPORTED_PLATFORM' | 'PARSE_ERROR' | 'SCHEMA_INVALID' | 'CONFIG_INVALID' | 'ROOT_INVALID' | 'INTERNAL';
+export interface SourceReport {
+    id: SourceId;
+    /** Project-relative, `/`-separated; null when the instance root could not be trusted. */
+    path: string | null;
+    status: SourceStatus;
+    /** null iff status === 'available'. */
+    code: SourceErrorCode | null;
+}
+/** `data` is null only when the sections' sources could not supply it. */
+export interface Section<T> {
+    data: T | null;
+    /** The sources this section depends on, in fixed order. */
+    sources: SourceReport[];
+}
+export interface ProjectOverview {
+    /** `project.name` from `monolith.config.json`; null when absent or not a non-empty string. */
+    name: string | null;
+    /** Validated relative instance root (ADR-009), `/`-separated. */
+    monolithRoot: string;
+    monolithRootSource: 'config' | 'default';
+    /** `schemaVersion` as found on disk (1 is migrated in memory); null unless state is available. */
+    stateSchemaVersionOnDisk: number | null;
+    stateRevision: number | null;
+    /** Counts over `tactical.missions`; null unless state is available or absent (absent ⇒ 0). */
+    activeMissionCount: number | null;
+    finishedMissionCount: number | null;
+    /** Verbatim `## Current Story` section of `active.md`; null when the section cannot be shown. */
+    currentStory: {
+        excerpt: string;
+        lineRange: string;
+    } | null;
+}
+export interface CurrentMissions {
+    /** Every `in_progress` mission, ordered by (startedAt, id). More than one is reported, never collapsed. */
+    active: Mission[];
+}
+export interface MissionCheckpoints {
+    missionId: string;
+    /** Number of checkpoints recorded for the mission. */
+    count: number;
+    /**
+     * Highest-ordinal checkpoint (ID order is authoritative, as in `brief`).
+     * Its `remainingSteps` are a HISTORICAL record at that checkpoint, not the
+     * project's current plan.
+     */
+    latest: Checkpoint | null;
+}
+export interface CheckpointsData {
+    /** One entry per active mission, same order as `CurrentMissions.active`. */
+    byActiveMission: MissionCheckpoints[];
+}
+export interface RoadmapData {
+    /** Raw, unparsed text of `roadmap-index.md`. Untrusted: must be shown escaped, never rendered or executed. */
+    text: string;
+}
+export type NoteCode = 'STATE_LEGACY_SCHEMA_MIGRATED' | 'MULTIPLE_ACTIVE_MISSIONS' | 'CHECKPOINT_ORDER_MISMATCH' | 'ACTIVE_MD_NO_CURRENT_STORY';
+export interface ReadNote {
+    code: NoteCode;
+    severity: 'info' | 'warn';
+}
+export interface ReadDiagnostics {
+    /**
+     * This reports availability of the fixed sources only. `monolith validate`
+     * is never run, so a clean report is NOT a statement that the project is valid.
+     */
+    validation: 'NOT_PERFORMED';
+    /** Every source, in fixed order: config, state, activeStory, roadmap. */
+    sources: SourceReport[];
+    notes: ReadNote[];
+}
+export interface DashboardReadModel {
+    projectOverview: Section<ProjectOverview>;
+    currentMissions: Section<CurrentMissions>;
+    checkpoints: Section<CheckpointsData>;
+    roadmap: Section<RoadmapData>;
+    diagnostics: ReadDiagnostics;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/readmodel/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/readmodel/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAEtE,uDAAuD;AACvD,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3F,MAAM,MAAM,eAAe,GACvB,eAAe,GACf,wBAAwB,GACxB,qBAAqB,GACrB,oBAAoB,GACpB,cAAc,GACd,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,yBAAyB,GACzB,6BAA6B,GAC7B,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,cAAc,GACd,UAAU,CAAC;AAEf,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,QAAQ,CAAC;IACb,yFAAyF;IACzF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,uCAAuC;IACvC,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;CAC9B;AAED,0EAA0E;AAC1E,MAAM,WAAW,OAAO,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACf,2DAA2D;IAC3D,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,8FAA8F;IAC9F,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,iEAAiE;IACjE,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,QAAQ,GAAG,SAAS,CAAC;IACzC,kGAAkG;IAClG,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,iGAAiG;IACjG,YAAY,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAC9B,2GAA2G;IAC3G,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,eAAe,EAAE,kBAAkB,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,8GAA8G;IAC9G,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,QAAQ,GAChB,8BAA8B,GAC9B,0BAA0B,GAC1B,2BAA2B,GAC3B,4BAA4B,CAAC;AAEjC,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,UAAU,EAAE,eAAe,CAAC;IAC5B,yEAAyE;IACzE,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,QAAQ,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,WAAW,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,WAAW,EAAE,eAAe,CAAC;CAC9B"}

package/dist/readmodel/types.js

@@ -0,0 +1,15 @@
+/**
+ * Typed Read Model for Mission Control (UI-001B.1, ADR-010).
+ *
+ * A pure, read-only projection of data MONOLITH Core already owns. It adds no
+ * persistent schema and no source of truth: every field is copied from, or
+ * counted over, an existing artifact (`monolith.config.json`, `state.json`,
+ * `active.md`, `roadmap-index.md`).
+ *
+ * Errors are DATA, not text: only fixed enum codes and project-relative paths
+ * cross this boundary. No absolute path, no exception message and no file
+ * excerpt other than the explicit content fields below ever appears in a
+ * diagnostic, so the DTO is safe to serialize over HTTP later (G2 still gates
+ * that).
+ */
+export {};