@milehimikey/em 1.13.1 → 1.14.0

package/dist/cli/ciInit.js

@@ -23,8 +23,10 @@
 // team that would rather pin the vanilla preset and gate on drift — opt-in, the same posture
 // docs/ci.md already recommends for `em skill check` ("if you'd rather pin ... add `em skill
 // check` as its own gate instead of silently overwriting").
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { parseManifest } from "../system/manifest.js";
+import { pluginInstallCommands } from "./pluginPin.js";
 import { applyMarker, markerPair, markerRegex } from "../util/markers.js";
 export const CI_WORKFLOW_MARKER = "em-ci";
 export const CONFORM_WORKFLOW_MARKER = "em-conform";
@@ -44,6 +46,106 @@ export function findUnsafeCiInitArg(value) {
     return UNSAFE_ARG_CHARS.test(value) ? value : null;
 }
 // ---- em-ci.yml (PR gates + push-triggered badge rebuild) ----
+/** The `skill-check` job - identical in the single-model and multi-model presets (it checks the
+ *  repo-wide skill install). Runs when the repo vendors the skill bundle OR pins the em plugin in
+ *  `.claude/settings.json` (MIL-231); a plugin repo first registers the pinned plugin on the runner,
+ *  because `em skill check --ci` fails when the plugin is not registered on the machine. Ends
+ *  without a trailing blank line. */
+function skillCheckJob(em, emVersion) {
+    const [addCmd, installCmd] = pluginInstallCommands(emVersion);
+    return `  skill-check:
+    name: em skill check (vendored skill / plugin drift)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Register the pinned em plugin
+        run: |
+          if grep -Eq '"em-[0-9]+-[0-9]+-[0-9]+"' .claude/settings.json 2>/dev/null; then
+            npm i -g @anthropic-ai/claude-code
+            ${addCmd}
+            ${installCmd}
+          else
+            echo "no em plugin pinned in .claude/settings.json - nothing to register"
+          fi
+      - name: Check the em skills match installed em
+        run: |
+          if [ -d .claude/skills/event-modeling ] || grep -Eq '"em-[0-9]+-[0-9]+-[0-9]+"' .claude/settings.json 2>/dev/null; then
+            ${em} skill check --ci
+          else
+            echo "no vendored skill and no em plugin pin - skipping (install the em plugin to opt in, docs/ai-workflow.md)"
+          fi`;
+}
+/** The `system` job (MIL-239 consumer adaptation, MIL-231 wiring) - multi-model only. Fetches full
+ *  history because the failure message names the producer commit. */
+function systemJob(em) {
+    return `  system:
+    name: "em system (consumer adaptation, seam verification)"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Check seams and consumer adaptation
+        run: ${em} system .`;
+}
+/** The `system-scope` job (MIL-240 seam-crossing gate, MIL-231 wiring) - multi-model only; needs
+ *  the base revision. */
+function systemScopeJob(em) {
+    return `  system-scope:
+    name: "em system scope (seam-crossing change set)"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Check the change set against the seams
+        run: |
+          base="\${{ github.event.pull_request.base.sha }}"
+          ${em} system scope --base "$base"`;
+}
+/** The `codeowners-check` job (MIL-234 command, MIL-231 wiring) - multi-model presets only: a
+ *  single-model repo has no seams to route review for. One job for the whole model set. */
+function codeownersCheckJob(em) {
+    return `  codeowners-check:
+    name: "em system codeowners --check (review routing current)"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Check the generated CODEOWNERS block is current
+        run: ${em} system codeowners --check .`;
+}
+/** The `glossary` job - identical in both presets (it already spans every tracked `*.em`). */
+function glossaryJob(em) {
+    return `  glossary:
+    name: "em glossary --fail-on-conflicts (cross-model vocabulary)"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Check glossary consistency across models
+        run: |
+          mapfile -t models < <(git ls-files '*.em')
+          ${em} glossary "\${models[@]}" --fail-on-conflicts`;
+}
 /** The managed block only (no header/`on:`/`jobs:` scaffolding) — what gets written between
  *  the marker pair, both for a fresh file and to patch an existing marked one in place.
  *
@@ -85,6 +187,24 @@ export function ciManagedBody(model, testsDir, emVersion) {
           done
           exit $status
 
+  api-check:
+    name: "em api check (contract current; additive/breaking annotation)"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Check the generated contract is current
+        # Fails only when contracts/<model key>.tsp is missing or stale (run em api generate).
+        # The additive/breaking lines are annotation for the reviewer, never a gate (MIL-237).
+        run: |
+          base="\${{ github.event.pull_request.base.sha }}"
+          ${em} api check "${model}" --base "$base"
+
   slice-index:
     name: "em slice index --check (README table drift)"
     if: github.event_name == 'pull_request'
@@ -126,22 +246,7 @@ export function ciManagedBody(model, testsDir, emVersion) {
       - name: Check slice doc version/content agreement
         run: ${em} ledger "${model}" --from "\${{ github.event.pull_request.base.sha }}"
 
-  skill-check:
-    name: em skill check (vendored skill drift)
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - name: Check vendored skill matches installed em
-        run: |
-          if [ -d .claude/skills/event-modeling ]; then
-            ${em} skill check
-          else
-            echo "no vendored skill at .claude/skills/event-modeling - skipping (run em skill install to opt in)"
-          fi
+${skillCheckJob(em, emVersion)}
 
   upgrade-check:
     name: "em upgrade --check (advisory - hard incompatibilities only, MIL-219)"
@@ -160,19 +265,7 @@ export function ciManagedBody(model, testsDir, emVersion) {
         # steps are applicable" case. See docs/upgrading.md.
         run: ${em} upgrade "${model}" --check
 
-  glossary:
-    name: "em glossary --fail-on-conflicts (cross-model vocabulary)"
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - name: Check glossary consistency across models
-        run: |
-          mapfile -t models < <(git ls-files '*.em')
-          ${em} glossary "\${models[@]}" --fail-on-conflicts
+${glossaryJob(em)}
 
   status-badge:
     name: rebuild status badge (advisory - publish only, never a gate)
@@ -233,12 +326,199 @@ export function buildCiWorkflowFile(model, testsDir, emVersion) {
     const { start, end } = markerPair(CI_WORKFLOW_MARKER, "hash");
     return `${ciWorkflowHeader(model, emVersion)}${start}\n${ciManagedBody(model, testsDir, emVersion)}\n${end}\n`;
 }
+/** Deterministic, valid GitHub Actions job-id suffix per model key. Keys are kebab-case with an
+ *  optional `~N` collision suffix (MIL-193), and `~` is not an Actions id character, so it
+ *  becomes `-`; if two keys then collide (`a-2` and `a~2`), the later one in key order gets a
+ *  numeric suffix until it is unique. Keys are processed in sorted order, so the mapping never
+ *  depends on manifest order. */
+export function ciJobIds(keys) {
+    const ids = new Map();
+    const used = new Set();
+    for (const key of [...keys].sort(compareKeys)) {
+        const base = key.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+        let id = base;
+        for (let n = 2; used.has(id); n++)
+            id = `${base}-${n}`;
+        used.add(id);
+        ids.set(key, id);
+    }
+    return ids;
+}
+function compareKeys(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+/** Models in the order the generators emit them (key order, not manifest order) so reordering
+ *  the manifest never reads as drift. */
+function sortedModels(models) {
+    return [...models].sort((a, b) => compareKeys(a.key, b.key));
+}
+/** The directory a model's design artifacts live in (R6: `dirname(<model>.em)`). */
+export function ciModelDir(modelPath) {
+    const d = dirname(modelPath);
+    return d === "" ? "." : d;
+}
+function modelJobs(m, id, testsDir, em) {
+    const dir = ciModelDir(m.path);
+    const pathspec = dir === "." ? "'*.em'" : `"${dir}/*.em"`;
+    const badge = dir === "." ? "status-badge.svg" : `${dir}/status-badge.svg`;
+    return `  validate-${id}:
+    name: "em validate (changed .em files) [${m.key}]"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Validate changed models
+        run: |
+          set -e
+          base="\${{ github.event.pull_request.base.sha }}"
+          head="\${{ github.event.pull_request.head.sha }}"
+          changed=$(git diff --name-only "$base" "$head" -- ${pathspec})
+          if [ -z "$changed" ]; then
+            echo "no .em files changed"
+            exit 0
+          fi
+          status=0
+          for f in $changed; do
+            echo "::group::em validate $f"
+            ${em} validate "$f" || status=1
+            ${em} validate "$f" --list-issues
+            echo "::endgroup::"
+          done
+          exit $status
+
+  api-check-${id}:
+    name: "em api check (contract current; additive/breaking annotation) [${m.key}]"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Check the generated contract is current
+        # Fails only when contracts/<model key>.tsp is missing or stale (run em api generate).
+        # The additive/breaking lines are annotation for the reviewer, never a gate (MIL-237).
+        run: |
+          base="\${{ github.event.pull_request.base.sha }}"
+          ${em} api check "${m.path}" --base "$base"
+
+  slice-index-${id}:
+    name: "em slice index --check (README table drift) [${m.key}]"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Check README Slices table is current
+        run: ${em} slice index "${m.path}" --check
+
+  coverage-${id}:
+    name: "em coverage --strict (invariant citations) [${m.key}]"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Check invariant test coverage
+        # Counts INV-* IDs in \`implemented\` slice docs only (MIL-207) - a ready-to-implement
+        # doc has nothing yet to cite it, so this job is green on a fresh scaffold and on a
+        # doc-only ratification PR. Pass --include-ready for the older, forward-looking report.
+        run: ${em} coverage "${m.path}" --tests "${testsDir}" --strict
+
+  ledger-${id}:
+    name: "em ledger (slice doc version/content agreement) [${m.key}]"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Check slice doc version/content agreement
+        run: ${em} ledger "${m.path}" --from "\${{ github.event.pull_request.base.sha }}"
+
+  upgrade-check-${id}:
+    name: "em upgrade --check (advisory - hard incompatibilities only, MIL-219) [${m.key}]"
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Check for hard upgrade incompatibilities
+        # Advisory: exits non-zero ONLY on a hard incompatibility (an unparseable state file, an
+        # old .em shape em migrate itself refuses) - never on the ordinary "some mechanical
+        # steps are applicable" case. See docs/upgrading.md.
+        run: ${em} upgrade "${m.path}" --check
+
+  status-badge-${id}:
+    name: "rebuild status badge (advisory - publish only, never a gate) [${m.key}]"
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Rebuild status badge
+        run: ${em} status "${m.path}" --tests "${testsDir}" --badge -o "${badge}"
+      - name: Commit badge if changed
+        # Every model has its own badge job and they run in parallel on a push, so rebase onto
+        # whatever a sibling job pushed first.
+        run: |
+          git add -- "${badge}"
+          if git diff --cached --quiet -- "${badge}"; then
+            echo "${badge} unchanged"
+            exit 0
+          fi
+          git config user.name "em-ci"
+          git config user.email "em-ci@users.noreply.github.com"
+          git commit -m "em ci: rebuild status badge [skip ci]"
+          git pull --rebase origin "$GITHUB_REF_NAME"
+          git push`;
+}
+/** The managed block for a whole system: per-model `validate-`/`slice-index-`/`coverage-`/
+ *  `ledger-`/`upgrade-check-`/`status-badge-<id>` jobs, then ONE `skill-check` and ONE
+ *  `glossary` (both repo-wide). Same version-pin discipline as `ciManagedBody`. */
+export function ciManagedBodyMulti(models, testsDir, emVersion) {
+    const em = `npx @milehimikey/em@${emVersion}`;
+    const sorted = sortedModels(models);
+    const ids = ciJobIds(sorted.map((m) => m.key));
+    const perModel = sorted.map((m) => modelJobs(m, ids.get(m.key), testsDir, em));
+    return [...perModel, codeownersCheckJob(em), systemJob(em), systemScopeJob(em), skillCheckJob(em, emVersion), glossaryJob(em)].join("\n\n");
+}
+export function buildCiWorkflowFileMulti(arg, models, testsDir, emVersion) {
+    const { start, end } = markerPair(CI_WORKFLOW_MARKER, "hash");
+    return `${ciWorkflowHeader(arg, emVersion)}${start}\n${ciManagedBodyMulti(models, testsDir, emVersion)}\n${end}\n`;
+}
 // ---- em-conform.yml (scheduled, advisory-only conformance cadence) ----
 /** The managed block only (no header/`on:`/`permissions:`/`jobs:` scaffolding) — what gets
  *  written between the marker pair, both for a fresh file and to patch an existing marked one
  *  in place. */
-export function conformManagedBody(model, emVersion) {
+export function conformManagedBody(model, emVersion, usePlugin = false) {
     const modelDir = dirname(model) === "." ? "." : dirname(model);
+    // MIL-231: a repo that declares the em plugin installs it (pinned to this em's version) and runs
+    // /em:conform; any other repo keeps the vendored bundle install and /event-modeling conform.
+    const install = usePlugin ? `${pluginInstallCommands(emVersion).join(" && ")}` : "em skill install --force";
+    const invoke = usePlugin ? "/em:conform" : "/event-modeling conform";
     return `  conform:
     runs-on: ubuntu-latest
     steps:
@@ -253,8 +533,8 @@ export function conformManagedBody(model, emVersion) {
       - name: Run conform phase
         run: |
           npm i -g @milehimikey/em@${emVersion} @anthropic-ai/claude-code
-          em skill install --force
-          claude -p "/event-modeling conform" \\
+          ${install}
+          claude -p "${invoke}" \\
             --allowedTools "Bash(em:*),Bash(git:*),Read,Grep,Glob,Write,Edit"
         env:
           ANTHROPIC_API_KEY: \${{ secrets.ANTHROPIC_API_KEY }}
@@ -296,34 +576,108 @@ permissions:
 jobs:
 `;
 }
-export function buildConformWorkflowFile(model, emVersion) {
+export function buildConformWorkflowFile(model, emVersion, usePlugin = false) {
     const { start, end } = markerPair(CONFORM_WORKFLOW_MARKER, "hash");
-    return `${conformWorkflowHeader(model, emVersion)}${start}\n${conformManagedBody(model, emVersion)}\n${end}\n`;
+    return `${conformWorkflowHeader(model, emVersion)}${start}\n${conformManagedBody(model, emVersion, usePlugin)}\n${end}\n`;
+}
+/** Conformance for a whole system: the same single `conform` job fanned out over a matrix of
+ *  model directories (`MODEL_DIR: ${{ matrix.model }}`). Directories, not models: two models in
+ *  one directory share a conformance folder, so the matrix lists each directory once. */
+export function conformManagedBodyMulti(models, emVersion, usePlugin = false) {
+    const dirs = [...new Set(models.map((m) => ciModelDir(m.path)))].sort(compareKeys);
+    const single = conformManagedBody("x/x.em", emVersion, usePlugin);
+    const strategy = `    strategy:\n      fail-fast: false\n      matrix:\n        model:\n${dirs.map((d) => `          - ${JSON.stringify(d)}`).join("\n")}\n`;
+    return single
+        .replace("    runs-on: ubuntu-latest\n", `    runs-on: ubuntu-latest\n${strategy}`)
+        .replace(/MODEL_DIR: x$/, "MODEL_DIR: ${{ matrix.model }}");
+}
+export function buildConformWorkflowFileMulti(arg, models, emVersion, usePlugin = false) {
+    const { start, end } = markerPair(CONFORM_WORKFLOW_MARKER, "hash");
+    return `${conformWorkflowHeader(arg, emVersion)}${start}\n${conformManagedBodyMulti(models, emVersion, usePlugin)}\n${end}\n`;
+}
+function dedupe(values) {
+    return [...new Set(values)];
 }
 /**
- * Which model an existing managed block was generated for, read from the block's own content
- * (MIL-256). Deliberately content-derived rather than a new marker line: blocks written by em
- * 1.13.0 and earlier carry no machine-readable model, but every one of them bakes the model into
- * the per-model `run:` lines (em-ci.yml: `slice index "<model>" --check`; em-conform.yml:
- * `MODEL_DIR: <dir>`). Neither pattern includes the `npx @milehimikey/em@<ver>` pin, so a
- * version difference can never read as a different model. Returns null when the block was
- * hand-edited past recognition - callers then treat it as the same model (the conservative,
- * pre-MIL-256 behavior) rather than refusing on a guess.
+ * The model SET an existing managed block was generated for, read from the block's own content
+ * (MIL-256, widened to sets by MIL-233). Deliberately content-derived rather than a new marker
+ * line: blocks written by em 1.13.0 and earlier carry no machine-readable model, but every one
+ * of them bakes the model into the per-model `run:` lines. em-ci.yml: every
+ * `slice index "<model>" --check` line (one per model); em-conform.yml: every `matrix.model`
+ * entry of a multi-model block, else the single `MODEL_DIR: <dir>` line. None of these patterns
+ * includes the `npx @milehimikey/em@<ver>` pin, so a version difference can never read as a
+ * different model. Returns `[]` when the block was hand-edited past recognition - callers then
+ * treat it as covering the requested models (the conservative, pre-MIL-256 behavior) rather than
+ * refusing on a guess.
  */
-export function managedBlockModel(markerName, blockBody) {
+export function managedBlockModels(markerName, blockBody) {
     if (markerName === CONFORM_WORKFLOW_MARKER) {
+        const lines = blockBody.split("\n");
+        const at = lines.findIndex((l) => /^\s*matrix:\s*$/.test(l));
+        if (at >= 0) {
+            const flow = /^\s*model:\s*\[(.*)\]\s*$/.exec(lines[at + 1] ?? "");
+            if (flow)
+                return dedupe(flow[1].split(",").map((v) => unquoteScalar(v.trim())).filter((v) => v !== ""));
+            if (/^\s*model:\s*$/.test(lines[at + 1] ?? "")) {
+                const out = [];
+                for (const l of lines.slice(at + 2)) {
+                    const item = /^\s*- (.+?)\s*$/.exec(l);
+                    if (!item)
+                        break;
+                    out.push(unquoteScalar(item[1]));
+                }
+                return dedupe(out);
+            }
+        }
         const m = /^\s*MODEL_DIR: (.+?)\s*$/m.exec(blockBody);
-        return m ? m[1] : null;
+        return m && !m[1].startsWith("${{") ? [m[1]] : [];
     }
-    const m = /\bslice index "([^"]*)" --check\b/.exec(blockBody);
-    return m ? m[1] : null;
+    return dedupe([...blockBody.matchAll(/\bslice index "([^"]*)" --check\b/g)].map((m) => m[1]));
+}
+function unquoteScalar(v) {
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) {
+        try {
+            return JSON.parse(v);
+        }
+        catch {
+            return v.slice(1, -1);
+        }
+    }
+    return v;
 }
 function existingBlockBody(content, markerName) {
     const m = markerRegex(markerName, "hash").exec(content);
     return m ? m[2] : null;
 }
-/** `--force` over another model's block also retargets the generated header's own wording
- *  (`em ci init <model>` on `#` comment lines above the start marker) at the new model, taken
+/** The model set of an existing workflow file's managed block (`[]` when unmarked/unreadable). */
+export function fileBlockModels(content, markerName) {
+    const body = existingBlockBody(content, markerName);
+    return body === null ? [] : managedBlockModels(markerName, body);
+}
+/** `--check`'s extra detail for a stale multi-model block: which models the manifest adds and
+ *  which the workflow still names that the manifest no longer does. `null` when the sets agree. */
+export function describeSetChange(previous, requested) {
+    const added = requested.filter((m) => !previous.includes(m));
+    const removed = previous.filter((m) => !requested.includes(m));
+    if (added.length === 0 && removed.length === 0)
+        return null;
+    const parts = [];
+    if (added.length > 0)
+        parts.push(`no section for ${added.join(", ")}`);
+    if (removed.length > 0)
+        parts.push(`section for ${removed.join(", ")} is not in the manifest`);
+    return parts.join("; ");
+}
+/** The one-line explanation of an `other-models` refusal (also printed by `--check`), ending in
+ *  what to do about it. Names both sets. */
+export function describeOtherModels(path, status) {
+    if (status.narrowing) {
+        return `${path} covers ${status.previous.length} models (${status.previous.join(", ")}) - re-run with the system manifest, or --force to narrow it to ${status.requested.join(", ")}`;
+    }
+    return `${path} was generated for ${status.previous.join(", ")}, not ${status.requested.join(", ")} - re-run with --force to replace it`;
+}
+/** `--force` over another model set's block also retargets the generated header's own wording
+ *  (`em ci init <arg>` on `#` comment lines above the start marker) at the new argument, taken
  *  from the freshly generated header. Only those exact generated phrasings are touched; a
  *  header the repo reworded, and everything below the start marker, is left alone. */
 function retargetHeader(content, generated, markerName) {
@@ -345,13 +699,18 @@ function retargetHeader(content, generated, markerName) {
  * the text between the markers, reused to patch an existing marked file in place without
  * touching whatever a repo added around it.
  *
- * MIL-256 (#174): the managed block is single-model (multi-model is MIL-233). A marked file
- * whose block was generated for a DIFFERENT model than `managedBody` is `other-model` (refused)
- * unless `force`, then `replace-model`. The same model with any other difference (version pin,
- * old text) stays `stale`, exactly as before. `em upgrade`'s ci-block step re-derives the model
- * from the existing file itself, so it only ever plans the same model.
+ * Block identity (MIL-256 #174, MIL-233): a block is identified by the SET of models it names
+ * (`managedBlockModels`). The requested set wins unless that would lose models by accident:
+ *   - disjoint sets are `other-models` (refused without `force`, `replace-models` with it);
+ *   - `multi` false (a single `<model.em>` argument) against a block naming several models is
+ *     `other-models` too (`narrowing`) - the single-model form must never silently narrow it;
+ *   - otherwise (same set, superset, subset or overlap, requested from the system manifest) the
+ *     block is regenerated for the requested set - `stale` when anything differs, e.g. a version
+ *     pin, an added model or a removed one.
+ * `em upgrade`'s ci-block step re-derives its arguments from the existing file (and, for a
+ * multi-model block, from the manifest), so it only ever plans the same set.
  */
-export function planCiFile(path, generated, managedBody, markerName, force) {
+export function planCiFile(path, generated, managedBody, markerName, force, multi = false) {
     if (!existsSync(path))
         return { kind: "create", content: generated };
     const original = readFileSync(path, "utf8");
@@ -361,19 +720,64 @@ export function planCiFile(path, generated, managedBody, markerName, force) {
     }
     if (updated === original)
         return { kind: "ok", content: original };
-    const existing = existingBlockBody(original, markerName);
-    const previous = existing === null ? null : managedBlockModel(markerName, existing);
-    const next = managedBlockModel(markerName, managedBody);
-    if (previous !== null && next !== null && previous !== next) {
-        if (!force)
-            return { kind: "other-model", previous };
-        return { kind: "replace-model", content: retargetHeader(updated, generated, markerName), previous };
+    const previous = fileBlockModels(original, markerName);
+    const requested = managedBlockModels(markerName, managedBody);
+    if (previous.length > 0 && requested.length > 0) {
+        const overlap = requested.some((m) => previous.includes(m));
+        const narrowing = overlap && !multi && previous.length > 1;
+        if (!overlap || narrowing) {
+            if (!force)
+                return { kind: "other-models", previous, requested, narrowing };
+            return { kind: "replace-models", content: retargetHeader(updated, generated, markerName), previous, requested, narrowing };
+        }
     }
     return { kind: "stale", content: updated, current: original };
 }
 export function applyCiFile(path, status) {
-    if (status.kind === "create" || status.kind === "stale" || status.kind === "would-replace" || status.kind === "replace-model") {
+    if (status.kind === "create" || status.kind === "stale" || status.kind === "would-replace" || status.kind === "replace-models") {
         writeFileSync(path, status.content, "utf8");
     }
 }
+/** Read the system manifest at `target` (a file, or a directory holding `system.yaml`) and turn
+ *  its `models:` into `CiModel`s whose paths are relative to `baseDir` - the repo root the
+ *  workflows run from. Reuses MIL-235's `parseManifest`; compiling the models is not needed to
+ *  write a workflow, so a model that does not compile does not block it. Every path goes through
+ *  `findUnsafeCiInitArg`; a source must be a `.em` file inside `baseDir`. */
+export function ciModelsFromManifest(target, baseDir) {
+    let manifestPath = target;
+    try {
+        if (statSync(target).isDirectory())
+            manifestPath = join(target, "system.yaml");
+    }
+    catch {
+        return { ok: false, message: `cannot read ${target}` };
+    }
+    let text;
+    try {
+        text = readFileSync(manifestPath, "utf8");
+    }
+    catch {
+        return { ok: false, message: `cannot read ${manifestPath}` };
+    }
+    const parsed = parseManifest(text);
+    if (!parsed.ok) {
+        return { ok: false, message: `${manifestPath} is not a valid system manifest: ${parsed.diagnostics.map((d) => d.message).join("; ")}` };
+    }
+    const models = [];
+    for (const entry of parsed.manifest.models) {
+        if (!entry.source.endsWith(".em")) {
+            return { ok: false, message: `${manifestPath}: model "${entry.key}" source ${entry.source} is not a .em file - the CI jobs run em against .em sources` };
+        }
+        const rel = relative(resolve(baseDir), resolve(dirname(manifestPath), entry.source)).split(sep).join("/");
+        if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) {
+            return { ok: false, message: `${manifestPath}: model "${entry.key}" source ${entry.source} is outside the repository root (${baseDir})` };
+        }
+        const unsafe = findUnsafeCiInitArg(rel);
+        if (unsafe) {
+            return { ok: false, message: `${manifestPath}: model "${entry.key}" path must not contain '"', '\`', '$', or a newline: ${unsafe}` };
+        }
+        models.push({ key: entry.key, path: rel });
+    }
+    return { ok: true, models, manifestPath };
+}
 //# sourceMappingURL=ciInit.js.map