@okfit/profiles 0.1.0 → 0.3.0

package/BodyProvenance.js

@@ -0,0 +1,44 @@
+import { Timestamp } from "@okfit/core";
+import { Schema } from "effect";
+
+//#region src/BodyProvenance.ts
+/**
+* The body is at HEAD and last changed in the commit described here (P-9).
+* `at` is that commit's author date (P-4); `committedAt` and the author
+* identity are carried for callers that want a history-based policy later (P-40).
+* `creating` is true exactly when the winning entry is also the oldest entry
+* of the path's history — the commit that created the path (S-9).
+*
+* @public
+*/
+const BodyCommitted = Schema.TaggedStruct("committed", {
+	at: Timestamp,
+	sha: Schema.String,
+	committedAt: Timestamp,
+	authorName: Schema.String,
+	authorEmail: Schema.String,
+	creating: Schema.Boolean
+});
+/**
+* The body has no usable commit (P-9): `untracked` means HEAD does not contain
+* the path, `dirty` means the on-disk body differs from HEAD's blob, `unborn`
+* means HEAD has no commits (P-11).
+*
+* @public
+*/
+const BodyUncommitted = Schema.TaggedStruct("uncommitted", { reason: Schema.Literals([
+	"untracked",
+	"dirty",
+	"unborn"
+]) });
+/**
+* What {@link Derivation.generatedAt} reports. A schema so the value also
+* serialises for MCP later without adaptation. Derivation never substitutes
+* `now`; the uncommitted policy is the caller's (P-10).
+*
+* @public
+*/
+const BodyProvenance = Schema.Union([BodyCommitted, BodyUncommitted]);
+
+//#endregion
+export { BodyCommitted, BodyProvenance, BodyUncommitted };

package/Derivation.js

@@ -0,0 +1,200 @@
+import { GitHistory } from "./GitHistory.js";
+import { Actor, OkfitConfig } from "@okfit/core";
+import { Crypto, DateTime, Duration, Effect, Encoding, FileSystem, Option, Path, Schema } from "effect";
+import { Git } from "@effected/git";
+import { FrontmatterSource } from "@effected/markdown";
+
+//#region src/Derivation.ts
+/**
+* git has no identity to derive a `human:` actor from (P-13 step 4).
+* `userName` and `userEmail` are the trimmed `configGet` answers when git had
+* them and absent keys otherwise (decision 53: not `name`/`email`, since every
+* Effect error class carries the class name on its own prototype and a field
+* literally named `name` would shadow `error.name` when present); test for
+* git's answer with `Object.hasOwn(error, "userName")`.
+*
+* @public
+*/
+var HumanActorUnresolvedError = class extends Schema.TaggedError()("HumanActorUnresolvedError", {
+	userName: Schema.optionalKey(Schema.String),
+	userEmail: Schema.optionalKey(Schema.String)
+}) {
+	get message() {
+		return "git has no user.name or user.email to derive a human actor from; set one or add actors.humans";
+	}
+};
+/**
+* The writer is an agent but `actors.agent` is not configured (P-17); the
+* profile never sets it.
+*
+* @public
+*/
+var AgentActorUnconfiguredError = class extends Schema.TaggedError()("AgentActorUnconfiguredError", {}) {
+	get message() {
+		return "writer is agent but actors.agent is not configured";
+	}
+};
+const HUMAN_PREFIX = "human:";
+const FALLBACK_STALE_AFTER = Duration.days(90);
+const decodeActor = Schema.decodeSync(Actor);
+const normalise = (text) => text.replace(/\r\n?/g, "\n").trimEnd();
+const body = (text) => normalise(FrontmatterSource.split(text).body);
+const bodyDigest = (text) => Effect.gen(function* () {
+	const bytes = yield* (yield* Crypto.Crypto).digest("SHA-256", new TextEncoder().encode(body(text)));
+	return Encoding.encodeHex(bytes);
+});
+/** The text before the first `@` (the whole value when there is none), or undefined when empty or containing whitespace. */
+const localPartOf = (email) => {
+	if (email === void 0) return void 0;
+	const at = email.indexOf("@");
+	const local = at === -1 ? email : email.slice(0, at);
+	return local.length > 0 && !/\s/.test(local) ? local : void 0;
+};
+/** P-13 step 3: lower-case, runs outside `[a-z0-9._-]` to `-`, leading and trailing `-` trimmed. */
+const slugOf = (name) => {
+	if (name === void 0) return void 0;
+	const slug = name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+	return slug.length > 0 ? slug : void 0;
+};
+const humanActorId = (identity, humans) => {
+	const local = localPartOf(identity.email);
+	const slug = slugOf(identity.name);
+	const candidates = [local, slug].filter((candidate) => candidate !== void 0).map((candidate) => candidate.toLowerCase());
+	for (const entry of humans) {
+		if (!entry.startsWith(HUMAN_PREFIX)) continue;
+		if (candidates.includes(entry.slice(6).toLowerCase())) return Option.some(entry);
+	}
+	if (local !== void 0) return Option.some(decodeActor(`${HUMAN_PREFIX}${local}`));
+	if (slug !== void 0) return Option.some(decodeActor(`${HUMAN_PREFIX}${slug}`));
+	return Option.none();
+};
+const staleAfter = (from, config) => DateTime.addDuration(from, config.lifecycle?.default_stale_after ?? OkfitConfig.DEFAULTS.lifecycle?.default_stale_after ?? FALLBACK_STALE_AFTER);
+const committed = (entry, entries) => ({
+	_tag: "committed",
+	at: entry.authoredAt,
+	sha: entry.sha,
+	committedAt: entry.committedAt,
+	authorName: entry.authorName,
+	authorEmail: entry.authorEmail,
+	creating: entry === entries[entries.length - 1]
+});
+const uncommitted = (reason) => ({
+	_tag: "uncommitted",
+	reason
+});
+/**
+* Spec 5.4 derivation rules for the `software-project` profile, package-global
+* (P-38). Pure members take every input as an argument; effectful members
+* require `Git`, `GitHistory` and, for the worktree read, `FileSystem` and
+* `Path` (P-30). Never writes, never reads `generated.by` (P-40).
+*
+* @public
+*/
+var Derivation = class {
+	constructor() {}
+	/**
+	* `FrontmatterSource.split(text).body`, then CRLF and lone CR to LF, then trailing whitespace at end of
+	* text removed (P-6). Pure. Applied to both sides of every comparison so `core.autocrlf` worktrees compare clean.
+	*/
+	static body = body;
+	/**
+	* Lowercase 64-char hex sha256 of `Derivation.body(text)`, through `effect`'s platform-agnostic
+	* `Crypto` service (issue #19). Same normalization as `body`, so a frontmatter-only edit or a
+	* `core.autocrlf` worktree never changes the digest.
+	*/
+	static bodyDigest = bodyDigest;
+	/**
+	* Spec 5.4 rule 2 as P-2 (DERIVE option C). Steps:
+	*  1. `root = Git.repoRoot(dirname(file))`: a file outside any repository surfaces `NotARepositoryError`;
+	*     submodules and worktrees work because the question is asked from the file's directory (P-39).
+	*  2. `realPath` both (rev-parse is symlink-resolved), then the repo-relative posix path via `Path` (P-39).
+	*  3. `worktree = body(readFileString(file))`.
+	*  4. `Git.show(realRoot, "HEAD", rel)`: `UnknownRefError` is `uncommitted { unborn }` (P-11), `Option.none`
+	*     is `uncommitted { untracked }` (P-47), a body differing from `worktree` is `uncommitted { dirty }` (P-9).
+	*     The comparison is against HEAD's blob, never the newest log entry (P-46).
+	*  5. `entries = GitHistory.pathLog(realRoot, rel)` newest first (P-5, P-46); `[]` is `uncommitted { unborn }`.
+	*  6. One `Git.show` per older blob (P-8), newest first: the first entry whose body differs from the next
+	*     older entry's body wins, else the oldest entry (the creating commit). "Previous" is the previous entry
+	*     of the simplified `--follow` history, not the true parent (P-7). The newest entry's body is never
+	*     re-fetched: `head.blob`, already confirmed equal to `worktree` by step 4, is reused (decision 56).
+	*     `Option.none` for an older entry counts as "differs", never a defect (decision 56).
+	* `config` is reserved and ignored (P-48). Never writes, never reads `by` (P-40).
+	*/
+	static generatedAt = Effect.fn("Derivation.generatedAt")(function* (options) {
+		const git = yield* Git;
+		const history = yield* GitHistory;
+		const fs = yield* FileSystem.FileSystem;
+		const path = yield* Path.Path;
+		const root = yield* git.repoRoot(path.dirname(options.file));
+		const realRoot = yield* fs.realPath(root);
+		const realFile = yield* fs.realPath(options.file);
+		const rel = path.relative(realRoot, realFile).split(path.sep).join("/");
+		const worktree = body(yield* fs.readFileString(options.file));
+		const head = yield* git.show(realRoot, "HEAD", rel).pipe(Effect.map((blob) => ({
+			unborn: false,
+			blob
+		})), Effect.catchTag("UnknownRefError", () => Effect.succeed({
+			unborn: true,
+			blob: Option.none()
+		})));
+		if (head.unborn) return uncommitted("unborn");
+		if (Option.isNone(head.blob)) return uncommitted("untracked");
+		if (body(head.blob.value) !== worktree) return uncommitted("dirty");
+		const entries = yield* history.pathLog(realRoot, rel);
+		const newest = entries[0];
+		if (newest === void 0) return uncommitted("unborn");
+		let current = worktree;
+		for (let index = 0; index < entries.length - 1; index += 1) {
+			const entry = entries[index];
+			const older = entries[index + 1];
+			if (entry === void 0 || older === void 0) break;
+			const olderBlob = yield* git.show(realRoot, older.sha, older.path);
+			if (Option.isNone(olderBlob)) return committed(entry, entries);
+			const olderBody = body(olderBlob.value);
+			if (olderBody !== current) return committed(entry, entries);
+			current = olderBody;
+		}
+		return committed(entries[entries.length - 1] ?? newest, entries);
+	});
+	/**
+	* P-13 / P-14, pure. Candidates: the email local part (returned as written, lower-cased only for matching)
+	* and the `user.name` slug. Order, first hit wins: (1) a `human:` entry of `humans` whose id equals a
+	* candidate case-insensitively, returned verbatim; (2) `human:<local>`; (3) `human:<slug>`; (4) none.
+	* The result is branded through core's `Actor` codec and always passes it.
+	*/
+	static humanActorId = humanActorId;
+	/**
+	* Spec 5.4 rule 1 (P-16, P-45). `"agent"`: `config.actors.agent`, else {@link AgentActorUnconfiguredError}
+	* (P-17). `"human"`: `Git.configGet(cwd, "user.name")` and `Git.configGet(cwd, "user.email")` in merged
+	* scope (P-15) through {@link Derivation.humanActorId}; none is {@link HumanActorUnresolvedError}.
+	* Answers only "who is writing now" (P-40).
+	*/
+	static generatedBy = Effect.fn("Derivation.generatedBy")(function* (options) {
+		if (options.writer === "agent") {
+			const agent = options.config.actors?.agent;
+			if (agent === void 0) return yield* new AgentActorUnconfiguredError({});
+			return agent;
+		}
+		const git = yield* Git;
+		const name = Option.getOrUndefined(yield* git.configGet(options.cwd, "user.name"));
+		const email = Option.getOrUndefined(yield* git.configGet(options.cwd, "user.email"));
+		const identity = {
+			...name === void 0 ? {} : { name },
+			...email === void 0 ? {} : { email }
+		};
+		const resolved = humanActorId(identity, options.config.actors?.humans ?? []);
+		if (Option.isNone(resolved)) return yield* new HumanActorUnresolvedError({
+			...identity.name === void 0 ? {} : { userName: identity.name },
+			...identity.email === void 0 ? {} : { userEmail: identity.email }
+		});
+		return resolved.value;
+	});
+	/**
+	* P-19, pure: `from` plus `config.lifecycle.default_stale_after`, falling back to `OkfitConfig.DEFAULTS`'
+	* 90 days. `from` is the caller's: `generated.at` when committed, else its own `now`.
+	*/
+	static staleAfter = staleAfter;
+};
+
+//#endregion
+export { AgentActorUnconfiguredError, Derivation, HumanActorUnresolvedError };

package/GitHistory.js

@@ -0,0 +1,107 @@
+import { Timestamp } from "@okfit/core";
+import { Context, Effect, Layer, Schema } from "effect";
+import { Git } from "@effected/git";
+
+//#region src/GitHistory.ts
+/**
+* One record of the path log, newest first (P-3, P-5): the commit, both dates decoded through core's
+* `Timestamp` (`%aI` / `%cI`, strict ISO with an offset; the `Type` is `DateTime.Utc`, P-4), the author
+* identity, and the repository-relative posix path the blob had at that commit (the `--name-only` line).
+* @public
+*/
+var PathHistoryEntry = class extends Schema.Class("PathHistoryEntry")({
+	sha: Schema.String,
+	authoredAt: Timestamp,
+	committedAt: Timestamp,
+	authorName: Schema.String,
+	authorEmail: Schema.String,
+	path: Schema.String
+}) {};
+/**
+* Profiles' own spawn failure, shaped like `@effected/git`'s `GitCommandError` (P-12). Raised by
+* `GitHistory.layer` for any `GitCommandError` `Git.log` produces, including the one `Git.log`
+* itself synthesizes when its own spawn timeout expires.
+* @public
+*/
+var GitHistoryError = class extends Schema.TaggedError()("GitHistoryError", {
+	/** The argv without the leading `git`. */
+	args: Schema.Array(Schema.String),
+	/** The working directory the command ran in. */
+	cwd: Schema.String,
+	/** git's exit code; absent when git never produced one. */
+	exitCode: Schema.optionalKey(Schema.Number),
+	/** git's stderr, captured under `LC_ALL=C`. */
+	stderr: Schema.String,
+	/** Spawn failure text, `timed out after 30s`, or `Git.log`'s own absorbed-failure detail. */
+	detail: Schema.optionalKey(Schema.String)
+}) {
+	get message() {
+		const exit = this.exitCode === void 0 ? "" : ` (exit ${this.exitCode})`;
+		return `git ${this.args.join(" ")}${exit} in ${this.cwd}: ${this.detail ?? this.stderr}`;
+	}
+};
+const toGitHistoryError = (cwd, error) => new GitHistoryError({
+	args: error.args,
+	cwd,
+	...error.exitCode === void 0 ? {} : { exitCode: error.exitCode },
+	stderr: error.stderr,
+	...error.detail === void 0 ? {} : { detail: error.detail }
+});
+const make = (git) => ({ pathLog: (cwd, path, options) => Effect.gen(function* () {
+	return (yield* git.log(cwd, {
+		paths: [path],
+		follow: true,
+		firstParentDiffMerges: true,
+		...options?.limit === void 0 ? {} : { limit: options.limit }
+	}).pipe(Effect.catchTag("GitCommandError", (error) => Effect.fail(toGitHistoryError(cwd, error))))).filter((entry) => entry.paths.length > 0).map((entry) => {
+		const [path] = entry.paths;
+		return PathHistoryEntry.make({
+			sha: entry.sha,
+			authoredAt: entry.authoredAt,
+			committedAt: entry.committedAt,
+			authorName: entry.authorName,
+			authorEmail: entry.authorEmail,
+			path: path ?? ""
+		});
+	});
+}) });
+const notScripted = (path) => Effect.die(/* @__PURE__ */ new Error(`GitHistory.makeTest: pathLog(${path}) was called but not scripted`));
+/**
+* A path-scoped, date-bearing log: `Git.log` reads the whole repository history, and this adapter scopes
+* it to one path (`--follow`, `--diff-merges=first-parent`) and decodes it into `PathHistoryEntry`.
+* Delegates to `Git.log` as of `@effected/git` 0.12.0 (P-1, spec deviation retired).
+* @public
+*/
+var GitHistory = class GitHistory extends Context.Service()("@okfit/profiles/GitHistory") {
+	/**
+	* Live layer (P-1, P-5, P-11): one `Git.log` call per `pathLog`, resolved once at construction like
+	* `Git.layer` itself, so every member's `R` is `never`. `Git.log` already degrades an unborn `HEAD` and
+	* an unmatched pathspec to the empty array and classifies `not a git repository` as `NotARepositoryError`
+	* (both pass through unchanged); every other failure becomes `GitHistoryError`, including the one
+	* `Git.log` itself produces when its own 30 s spawn timeout expires (`@effected/git`'s `GIT_TIMEOUT`
+	* ceiling, not this adapter's) — `Git.log` never lets a bare `Cause.TimeoutError` escape. The CLI
+	* provides `ChildProcessSpawner` through `NodeServices.layer` (P-30).
+	*/
+	static layer = Layer.effect(GitHistory, Effect.gen(function* () {
+		const git = yield* Git;
+		return make(git);
+	})).pipe(Layer.provide(Git.layer));
+	/**
+	* Scripted double (P-32): responses keyed by the `path` argument exactly as passed to `pathLog`. A call
+	* whose path has no entry DIES with `GitHistory.makeTest: pathLog(<path>) was called but not scripted`,
+	* mirroring `Git.makeTest`; `limit` is honoured by slicing. Models none of the live semantics.
+	*/
+	static makeTest = (script) => ({ pathLog: (_cwd, path, options) => {
+		if (!Object.hasOwn(script, path)) return notScripted(path);
+		const entries = script[path] ?? [];
+		return Effect.succeed(options?.limit === void 0 ? entries : entries.slice(0, options.limit));
+	} });
+	/**
+	* `Layer.succeed(GitHistory, GitHistory.makeTest(script))`. Mints a fresh layer per call: bind it to a
+	* `const`, since layers memoize by reference.
+	*/
+	static layerTest = (script) => Layer.succeed(GitHistory, GitHistory.makeTest(script));
+};
+
+//#endregion
+export { GitHistory, GitHistoryError, PathHistoryEntry, make };

package/Profile.js

@@ -0,0 +1,38 @@
+import { DiagnosticRange, DiagnosticSeverity } from "@okfit/core";
+import { Schema } from "effect";
+
+//#region src/Profile.ts
+/**
+* Names of the profiles this package ships (P-38).
+*
+* @public
+*/
+const PROFILE_NAMES = ["software-project"];
+/**
+* Profile-owned diagnostic codes (P-21). Core's `LintCode` is untouched; all
+* three are severity `error` and are not configurable.
+*
+* @public
+*/
+const ProfileDiagnosticCode = Schema.Literals([
+	"project-missing",
+	"project-multiple",
+	"project-not-at-root"
+]);
+/**
+* Same fields as core's `Diagnostic` with a profile code; a `Schema.Struct`
+* per P-21/P-51. `file` is the bundle-relative posix path, `""` for the
+* bundle-level `project-missing`. `range` is never set in phase 1.
+*
+* @public
+*/
+const ProfileDiagnostic = Schema.Struct({
+	file: Schema.String,
+	range: Schema.optionalKey(DiagnosticRange),
+	code: ProfileDiagnosticCode,
+	severity: DiagnosticSeverity,
+	message: Schema.String
+});
+
+//#endregion
+export { PROFILE_NAMES, ProfileDiagnostic, ProfileDiagnosticCode };

package/Profiles.js

@@ -0,0 +1,27 @@
+import { softwareProject } from "./SoftwareProject.js";
+import { Option } from "effect";
+
+//#region src/Profiles.ts
+const REGISTRY = /* @__PURE__ */ new Map([[softwareProject.name, softwareProject]]);
+/**
+* The profile registry (P-38). No third-party registration in phase 1; the
+* `DEFAULTS < profile < file` merge is the CLI's (D-28).
+*
+* @public
+*/
+var Profiles = class {
+	constructor() {}
+	/** The `software-project` profile (spec 5). */
+	static softwareProject = softwareProject;
+	/**
+	* `Option.none` for `"none"`, unknown names and anything not in
+	* `PROFILE_NAMES`; the CLI decides what that means (P-38). Exact match only.
+	*/
+	static get = (name) => {
+		const found = REGISTRY.get(name);
+		return found === void 0 ? Option.none() : Option.some(found);
+	};
+};
+
+//#endregion
+export { Profiles };

package/Provenance.js

@@ -0,0 +1,94 @@
+import { Derivation } from "./Derivation.js";
+import { Diagnostic, OkfitConfig, Timestamp } from "@okfit/core";
+import { DateTime, Effect, Path, Schema } from "effect";
+
+//#region src/Provenance.ts
+const encodeAt = Schema.encodeSync(Timestamp);
+/**
+* A profiles-owned lint over committed provenance (S-8). NOT a `Profile`
+* member and NOT a `ProfileDiagnostic` -- it returns core `Diagnostic`s with
+* code `"generated-at-drift"`, a real `LintCode` member, so `severityFor`,
+* the `[lint]` table, the renderers, the hook, and the MCP tool treat it
+* like every other lint (S-7). `Profile.check` and `ProfileDiagnosticCode`
+* are unchanged.
+*
+* Two tiers per concept (issue #19, body-digest design): when
+* `generated.body_sha256` is present, drift is decided ENTIRELY by comparing it to
+* `Derivation.bodyDigest` of the concept's current source -- no git call at
+* all, so this works for a dirty worktree too (that is the point: an edited
+* body is caught immediately, before it is even committed) and survives a
+* squash/rebase merge that only rewrites commit dates, since the body
+* itself, and therefore its digest, never changed. When `body_sha256` is
+* absent (an un-migrated concept), this falls back to the original
+* git-derived date comparison against `Derivation.generatedAt`, preserving
+* `--skip-provenance`'s meaning for bundles that have not run `okfit sync`
+* since this field was introduced.
+*
+* The tier-2 fallback returns `[]` the moment a `NotARepositoryError`
+* surfaces: a bundle outside git has nothing to derive for any concept still
+* on tier 2, so the first occurrence short-circuits the whole walk, not just
+* the concept that triggered it (S-8). Emits no `range` (S-12, Judge note
+* 7): `Diagnostic.range` is `Schema.optionalKey` and is simply omitted.
+*
+* `Provenance.lint` is total over severity (S-28, amending Judge note 3):
+* when `OkfitConfig.severityFor(config, "generated-at-drift")` resolves to
+* `"off"`, it returns `[]` before any per-concept work and before any git
+* call, so it is safe to call at any severity and never needs to cast
+* `"off"` away. `validate/run.ts` (the CLI) still gates on `"off"` before
+* calling at all; the two agree by construction (both skip the walk).
+*
+* A third, optional options argument carries `skipGitTier`: when `true`, a
+* concept that falls through to tier 2 (no `generated.body_sha256`
+* recorded) is skipped entirely -- no `Derivation.generatedAt` call, no
+* git spawn at all -- while tier 1 still runs, unaffected, for every
+* concept that DOES carry a digest. This is a runtime skip, not a
+* type-level narrowing: the R channel still lists `Git | GitHistory` even
+* when every call happens to skip them, since the type describes what the
+* function CAN require, not what one particular call ends up using.
+* Defaults to `false`, so every existing caller keeps its current
+* behavior unchanged.
+*
+* @public
+*/
+var Provenance = class {
+	constructor() {}
+	static lint = Effect.fn("Provenance.lint")(function* (bundle, config, options) {
+		const severity = OkfitConfig.severityFor(config, "generated-at-drift");
+		if (severity === "off") return [];
+		const skipGitTier = options?.skipGitTier === true;
+		const path = yield* Path.Path;
+		const diagnostics = [];
+		for (const [, concept] of bundle.concepts) {
+			if (concept.frontmatter.generated === void 0) continue;
+			const recordedDigest = concept.frontmatter.generated.body_sha256;
+			if (recordedDigest !== void 0) {
+				const currentDigest = yield* Derivation.bodyDigest(concept.document.source);
+				if (currentDigest === recordedDigest) continue;
+				diagnostics.push(Diagnostic.make({
+					file: concept.path,
+					code: "generated-at-drift",
+					severity,
+					message: `the body has changed since generated.at was last stamped: generated.body_sha256 is ${recordedDigest}, the current body hashes to ${currentDigest}`
+				}));
+				continue;
+			}
+			if (skipGitTier) continue;
+			const file = path.join(bundle.root, concept.path);
+			const derived = yield* Derivation.generatedAt({ file }).pipe(Effect.catchTag("NotARepositoryError", () => Effect.succeed(void 0)));
+			if (derived === void 0) return [];
+			if (derived._tag === "uncommitted") continue;
+			const recorded = concept.frontmatter.generated.at;
+			if (recorded !== void 0 && DateTime.Equivalence(recorded, derived.at)) continue;
+			diagnostics.push(Diagnostic.make({
+				file: concept.path,
+				code: "generated-at-drift",
+				severity,
+				message: `generated.at is ${recorded === void 0 ? "missing" : encodeAt(recorded)}; the last body change was ${encodeAt(derived.at)} (${derived.sha.slice(0, 7)})`
+			}));
+		}
+		return diagnostics;
+	});
+};
+
+//#endregion
+export { Provenance };