@sdd-method/author-cli 0.0.0-stage → 0.1.0

package/dist/lib/catalogue/builders/implementations.js

@@ -0,0 +1,214 @@
+// implementations / implementation_members / snapshots / snapshot_members builder
+// (M-ADR 0214, schema 3.15.0).
+//
+// Source: `.sdd/implementation-binding.yaml` (M-ADR 0181 §2.1) and, through its
+// `snapshot_area:` and the snapshot store root, each dated `snapshot.yaml` in that
+// area (M-ADR 0181 §2.5). The implementation id is the durable identity all four
+// catalogues key on, so a binding that names no `implementation:` emits NOTHING and
+// says so: there is no identity to key on, and inventing one from `spec:` would
+// make a binding and its snapshots agree by construction rather than by record.
+//
+// A member's repository end is optional: a `planned` member names a repository
+// that may not exist yet (M-ADR 0181 lifecycle). repo_key always carries the named
+// repository; repo_id carries it only when it resolves in this SDD's repositories,
+// and a non-planned member that does not resolve is a finding.
+import { readFile } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { BINDING_FILENAME, BINDINGS_DIRNAME, bindingFiles } from "../../conformance/binding.js";
+import { baselineIds, exists, readManifest, SnapshotError } from "../../snapshot/manifest.js";
+const str = (v) => (typeof v === "string" ? v.trim() : typeof v === "number" ? String(v) : "");
+const empty = () => ({
+    implementations: [],
+    implementationMembers: [],
+    snapshots: [],
+    snapshotMembers: [],
+});
+/**
+ * Every binding file the SDD carries (M-ADR 0214 §4.9): the single-implementation file and one
+ * per implementation in the bindings directory. Each builds independently; an implementation id
+ * declared twice is refused rather than merged, and a directory file must be named for the
+ * implementation it declares.
+ */
+export async function buildImplementations(inputs) {
+    const out = empty();
+    const declaredIn = new Map();
+    const files = bindingFiles(inputs.sddPath);
+    // Legal, and how drift starts: a forgotten single file keeps contributing rows beside the
+    // directory, and the duplicate-id refusal only catches it when the ids happen to coincide.
+    if (files.length > 1 && files[0] === BINDING_FILENAME) {
+        inputs.findings.add("convention", `implementations: the SDD carries both ${BINDING_FILENAME} and ${BINDINGS_DIRNAME}/ — both are built; move the single binding into the directory as <implementation>.yaml (M-ADR 0214 §4.9)`);
+    }
+    for (const file of files) {
+        const one = await buildOne(inputs, file, declaredIn);
+        out.implementations.push(...one.implementations);
+        out.implementationMembers.push(...one.implementationMembers);
+        out.snapshots.push(...one.snapshots);
+        out.snapshotMembers.push(...one.snapshotMembers);
+    }
+    return out;
+}
+async function buildOne(inputs, bindingFile, declaredIn) {
+    const { sddPath, knownRepoIds, snapshotStore, findings } = inputs;
+    let raw;
+    try {
+        raw = parseYaml(await readFile(join(sddPath, bindingFile), "utf8"));
+    }
+    catch (e) {
+        findings.add("divergence", `implementations: ${bindingFile} does not parse — ${e.message}`);
+        return empty();
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        findings.add("divergence", `implementations: ${bindingFile} is not a mapping — nothing built`);
+        return empty();
+    }
+    const impl = str(raw.implementation);
+    const spec = str(raw.spec);
+    if (impl === "") {
+        findings.add("coverage", `implementations: ${bindingFile} names no implementation — add a top-level \`implementation:\` carrying the id its snapshot manifests carry (M-ADR 0214 §4.1); no implementation, member or snapshot rows are built from it until it does`);
+        return empty();
+    }
+    if (bindingFile.startsWith(`${BINDINGS_DIRNAME}/`)) {
+        const named = basename(bindingFile).replace(/\.ya?ml$/, "");
+        if (named !== impl) {
+            findings.add("divergence", `implementations: ${bindingFile} declares implementation ${impl} — a bindings-directory file is named for its implementation (M-ADR 0214 §4.9); nothing built from it`);
+            return empty();
+        }
+    }
+    const prior = declaredIn.get(impl);
+    if (prior !== undefined) {
+        findings.add("divergence", `implementations: ${impl} is declared by both ${prior} and ${bindingFile} — refused, not merged (M-ADR 0214 §4.9); only ${prior} is built`);
+        return empty();
+    }
+    declaredIn.set(impl, bindingFile);
+    if (spec === "") {
+        findings.add("divergence", `implementations: ${bindingFile} (implementation ${impl}) names no spec — nothing built`);
+        return empty();
+    }
+    const area = str(raw.snapshot_area);
+    const out = empty();
+    out.implementations.push({
+        id: impl,
+        name: str(raw.name) || impl,
+        spec,
+        snapshot_area: area,
+        doc_path: bindingFile,
+        source_sdd_id: "",
+        platform_sdd_id: "",
+    });
+    const members = Array.isArray(raw.implementations) ? raw.implementations : [];
+    const seen = new Set();
+    for (const [i, m] of members.entries()) {
+        const repoKey = str(m?.repo);
+        if (repoKey === "") {
+            findings.add("divergence", `implementation_members: ${impl} member [${i}] names no repo — skipped`);
+            continue;
+        }
+        const id = `${impl}::${repoKey}`;
+        if (seen.has(id)) {
+            findings.add("divergence", `implementation_members: ${impl} lists ${repoKey} twice — second skipped`);
+            continue;
+        }
+        seen.add(id);
+        const lifecycle = str(m.lifecycle);
+        const resolved = knownRepoIds.has(repoKey);
+        if (!resolved && lifecycle !== "planned") {
+            findings.add("coverage", `implementation_members: ${impl} member ${repoKey} (lifecycle ${lifecycle || "unset"}) does not resolve in this SDD's repositories — name the repository by its id; only a planned member may name one that does not exist yet`);
+        }
+        out.implementationMembers.push({
+            id,
+            implementation_id: impl,
+            repo_id: resolved ? repoKey : "",
+            repo_key: repoKey,
+            role: str(m.role),
+            lifecycle,
+            evidence_direction: str(m["evidence-direction"]) || str(m.evidence_direction),
+            source_sdd_id: "",
+            platform_sdd_id: "",
+        });
+    }
+    if (area === "")
+        return out;
+    if (snapshotStore === undefined || snapshotStore === "") {
+        findings.add("coverage", `snapshots: ${impl} declares snapshot_area ${area} but no snapshot store was given (--snapshot-store or SDD_SNAPSHOT_STORE) — snapshots NOT built`);
+        return out;
+    }
+    const areaRoot = join(snapshotStore, area);
+    if (!(await exists(areaRoot))) {
+        findings.add("coverage", `snapshots: ${impl} snapshot_area ${area} does not exist under the snapshot store ${snapshotStore}`);
+        return out;
+    }
+    const priors = new Map();
+    for (const bid of await baselineIds(areaRoot)) {
+        let manifest;
+        try {
+            manifest = await readManifest(areaRoot, bid);
+        }
+        catch (e) {
+            if (!(e instanceof SnapshotError))
+                throw e;
+            findings.add("divergence", `snapshots: ${impl}@${bid} skipped — ${e.message}`);
+            continue;
+        }
+        if (manifest.implementation !== impl) {
+            findings.add("divergence", `snapshots: ${area}/${bid}/snapshot.yaml names implementation ${manifest.implementation}, the binding names ${impl} — skipped (M-ADR 0214 §4.1: one identity)`);
+            continue;
+        }
+        const sid = `${impl}@${bid}`;
+        if (manifest.prior_snapshot)
+            priors.set(sid, `${impl}@${manifest.prior_snapshot}`);
+        out.snapshots.push({
+            id: sid,
+            implementation_id: impl,
+            baseline_id: bid,
+            prior_snapshot_id: "",
+            credential_scan_result: manifest.credential_scan?.result ?? "",
+            source_sdd_id: "",
+            platform_sdd_id: "",
+        });
+        const inSnapshot = new Set();
+        const member = (repoKey, revision, observedAt, presence) => {
+            if (inSnapshot.has(repoKey)) {
+                findings.add("divergence", `snapshot_members: ${sid} lists ${repoKey} twice (as ${presence} the second time) — second skipped`);
+                return;
+            }
+            inSnapshot.add(repoKey);
+            const resolved = knownRepoIds.has(repoKey);
+            if (!resolved && presence !== "removed") {
+                findings.add("coverage", `snapshot_members: ${sid} member ${repoKey} does not resolve in this SDD's repositories`);
+            }
+            out.snapshotMembers.push({
+                id: `${sid}::${repoKey}`,
+                snapshot_id: sid,
+                repo_id: resolved ? repoKey : "",
+                repo_key: repoKey,
+                source_revision: revision,
+                observed_at: observedAt,
+                presence,
+                source_sdd_id: "",
+                platform_sdd_id: "",
+            });
+        };
+        for (const m of manifest.members) {
+            const carried = m.carried_from !== undefined;
+            member(m.canonical_repo_key, m.source_revision, m.observed_at ?? (carried ? m.carried_from : bid), carried ? "carried" : "observed");
+        }
+        for (const r of manifest.members_removed ?? []) {
+            member(r.canonical_repo_key, r.last_revision, r.last_observed ?? "", "removed");
+        }
+    }
+    // A prior that names a baseline not built here would dangle an internal FK; the
+    // link is kept only when its target is a row, and a missing one is said aloud.
+    const built = new Set(out.snapshots.map((s) => String(s["id"])));
+    for (const [i, s] of out.snapshots.entries()) {
+        const prior = priors.get(String(s["id"]));
+        if (prior === undefined)
+            continue;
+        if (built.has(prior))
+            out.snapshots[i] = { ...s, prior_snapshot_id: prior };
+        else
+            findings.add("divergence", `snapshots: ${String(s["id"])} names prior ${prior}, which is not a snapshot in ${area} — link dropped`);
+    }
+    return out;
+}
+//# sourceMappingURL=implementations.js.map

package/dist/lib/catalogue/builders/index.js

@@ -0,0 +1,64 @@
+/**
+ * Re-exports for the per-source row discoverers used by the canonical
+ * `sdd-cli catalogue build` orchestrator.
+ *
+ * Each builder is responsible for exactly one node catalogue (or a small
+ * tightly-coupled group when reading the same source). The orchestrator
+ * in build.ts composes them with a deterministic order.
+ */
+export { buildDomains } from "./domains.js";
+export { buildProducts } from "./products.js";
+export { buildApplicationDataPlaneBindings, buildApplicationDataPlaneDeviations, } from "./application-data-plane-bindings.js";
+export { buildApplicationConformanceCoverage } from "./application-conformance-coverage.js";
+export { buildImplementations } from "./implementations.js";
+export { buildRepositories } from "./repositories.js";
+export { buildServices } from "./services.js";
+export { buildAdrs } from "./adrs.js";
+export { buildAdrSupersedes } from "./adr-supersedes.js";
+export { buildFeatures } from "./features.js";
+export { buildFeatureGroups } from "./feature-groups.js";
+export { buildFeatureGrounding } from "./feature-grounding.js";
+export { buildCapabilitySpec } from "./capability-spec.js";
+export { buildDeclaredExternalContracts } from "./contracts.js";
+export { buildContracts } from "./contracts.js";
+export { buildRepoEdges, deriveFeatureRepoFromServices } from "./repo-edges.js";
+export { buildRepoCapabilityExemption } from "./repo-capability-exemption.js";
+export { buildServiceCapabilityExemption } from "./service-capability-exemption.js";
+export { buildExternalSystemExemption } from "./external-system-exemption.js";
+export { buildContainerDependency, reportEntryIdReferentCollisions } from "./container-dependency.js";
+export { buildPersonaContainer } from "./persona-container.js";
+export { buildEvents } from "./events.js";
+export { buildServiceEvent, buildCapabilityEvent, buildFeatureEvent, } from "./event-edges.js";
+export { buildServiceContract } from "./service-contract.js";
+export { buildServiceContractConsumes } from "./service-contract-consumes.js";
+export { buildGlossaryItems, backfillGlossaryRelations } from "./glossary.js";
+export { buildGlossaryXref } from "./glossary-xref.js";
+export { buildCapabilities } from "./capabilities.js";
+export { buildC4Systems } from "./c4-systems.js";
+export { buildC4Containers } from "./c4-containers.js";
+export { buildC4Components } from "./c4-components.js";
+export { buildPersonas } from "./personas.js";
+export { buildScreens } from "./screens.js";
+export { buildUserJourneys } from "./user-journeys.js";
+export { buildPersonaJourney, buildPersonaFeature, buildJourneyFeature, } from "./persona-journey-edges.js";
+export { buildProductEdges } from "./product-edges.js";
+export { buildIntegrations } from "./integrations.js";
+export { buildCapabilityService, buildCapabilityAdr, buildCapabilityFeature, buildCapabilityContract, } from "./capability-edges.js";
+export { buildFeatureContract } from "./feature-contract.js";
+export { buildDomainModels } from "./domain-models.js";
+export { buildCapabilityDomainModel } from "./capability-domain-model.js";
+export { buildFeatureDomainModel } from "./feature-domain-model.js";
+export { buildFeatureSubscriptionChannels } from "./feature-subscription-channels.js";
+export { buildProductPlatformDependencies } from "./product-platform-dependencies.js";
+export { buildC4ExternalSystems } from "./c4-external-systems.js";
+export { buildSystemExternalDependency } from "./system-external-dependency.js";
+export { buildPersonaC4System } from "./persona-c4system.js";
+export { entitySlug } from "./entity-slug.js";
+export { buildEntitiesFromManifest } from "./entities-manifest.js";
+export { buildEntitiesFromMermaid } from "./entities-mermaid.js";
+export { buildServiceEntityFromTables } from "./service-entity-tables.js";
+export { enrichEntityPersistenceKind } from "./entity-persistence.js";
+export { buildC4ContainerEntity, buildC4SystemEntity, } from "./c4-entity-rollups.js";
+export { buildQualityScores } from "./quality-scores.js";
+export { buildScaffolds } from "./scaffolds.js";
+//# sourceMappingURL=index.js.map

package/dist/lib/catalogue/builders/integration-components.js

@@ -0,0 +1,344 @@
+// integration_component builder — emits one row per component declared in an
+// integration-product's `integration-manifest.yaml` `components:` array
+// (M-ADR 0171 §9, catalogued per §10.1).
+//
+// An integration SDD is a one-to-many spec→code unit (M-ADR 0106): one SDD owns N
+// component code repos, each with its own wire shape and interaction pattern. §9.3
+// calls the tier the SOURCE OF TRUTH for the pattern, with the SDD-level
+// `ingestionPattern`/`invocationPattern` as its aggregate. Until this builder the
+// tier was consumed by NOTHING — the integrations builder read only
+// integrationId/providerName/profileType/parentIntegrationProductId/
+// sub_integrations, and no validator mentioned `components`.
+//
+// TWO RULES, both deliberately non-fatal.
+//
+// 1. OPTIONAL CODE LINKAGE (§10.2). A component names an INTERACTION SURFACE —
+//    commonly one provider feed — not necessarily a deployable. The tier sits at
+//    finer granularity than the code: one provider legitimately declares five feed
+//    components against two code repos, and those repos are already catalogued
+//    under their own correct names. So the id itself is NOT required to resolve.
+//
+//    Requiring it would have coarsened the tier to the deployable set, collapsing
+//    five declared feeds into two repo names and destroying the per-feed
+//    distinction the tier exists to carry — the failure mode M-ADR 0193 §4.2
+//    refuses one axis over, where matching a data_plane binding's target against a
+//    platform-dep's would drive adopters to coarsen `target` to the gateway id.
+//
+//    The code link is therefore the OPTIONAL `componentRepo`. Absent carries no
+//    finding (`resolution: undeclared`). DECLARED it must resolve, because a
+//    declared link is a positive assertion the method can check — and a
+//    declared-but-unresolvable one is a COVERAGE finding, not a load failure.
+//
+// 2. AGGREGATE CROSS-CHECK (§9.3/§10.3). Where both tiers are declared, the
+//    SDD-level pattern should appear among the matching-direction components'
+//    patterns. A disagreement is a convention finding, NOT a reconciliation: it
+//    means either the tier is incomplete or the SDD-level value is stale, and
+//    deriving one from the other would discard exactly that signal. Same reasoning
+//    M-ADR 0193 §4.2 reached for data_plane vs platform-dependencies.
+//
+// The method does not enumerate `componentType`, `transport`, `format` or `auth` —
+// the adopter owns framework-role vocabulary (§9.5) and the wire details, while the
+// portable semantic is the pattern.
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { z } from "zod";
+const REL_PATH = "integration-manifest.yaml";
+const ComponentSchema = z.object({
+    id: z.string().optional(),
+    componentRepo: z.string().optional(),
+    componentType: z.string().optional(),
+    protocol: z
+        .object({
+        transport: z.string().optional(),
+        format: z.string().optional(),
+        auth: z.string().optional(),
+    })
+        .optional(),
+    dataFlow: z
+        .object({
+        direction: z.string().optional(),
+        frequency: z.string().optional(),
+        primaryEntities: z.array(z.string()).optional(),
+    })
+        .optional(),
+    ingestionPattern: z.string().optional(),
+    invocationPattern: z.string().optional(),
+    patternQualifier: z.string().optional(),
+});
+/**
+ * A per-component manifest is a FULL integration-manifest shape, so it carries the
+ * component fields plus its own `integrationId` (its declared identity). Only the
+ * fields this catalogue models are read; the rest — `dependencies`, `field_mappings`,
+ * `evidence`, `openQuestions` — are deliberately out of scope here: they are new concepts,
+ * not component attributes. `dependencies.sharedLibraries` is read by its own builder,
+ * repo-dependency.ts, as `repo_dependency` rows (M-ADR 0217).
+ */
+const ComponentManifestSchema = ComponentSchema.extend({
+    integrationId: z.string().optional(),
+});
+const ManifestSchema = z.object({
+    integrationId: z.string().optional(),
+    ingestionPattern: z.string().optional(),
+    invocationPattern: z.string().optional(),
+    components: z.array(ComponentSchema).optional(),
+});
+export async function buildIntegrationComponents(inputs) {
+    if (inputs.profile !== "integration-product")
+        return [];
+    let text;
+    try {
+        text = await readFile(join(inputs.sddPath, REL_PATH), "utf-8");
+    }
+    catch (err) {
+        // A missing manifest is already reported by the integrations builder; a second
+        // finding for the same cause would be noise.
+        if (err.code !== "ENOENT")
+            throw err;
+        return [];
+    }
+    let raw;
+    try {
+        raw = parseYaml(text);
+    }
+    catch {
+        return []; // likewise already reported
+    }
+    const parsed = ManifestSchema.safeParse(raw);
+    if (!parsed.success) {
+        inputs.findings.add("convention", `${REL_PATH}: components shape violation — ${parsed.error.issues
+            .map((i) => i.path.join(".") + ": " + i.message)
+            .join("; ")}`);
+        return [];
+    }
+    const components = parsed.data.components ?? [];
+    // NO early return on an empty array: §9.1's SECOND home is read below, and 21 SDDs
+    // on the reverse estate declare components ONLY there. Returning early here is what
+    // kept 86 of 101 components invisible — the array form was not just the first source
+    // read, it was the only one that could produce a row at all.
+    const integrationId = (parsed.data.integrationId ?? "").trim() || inputs.sddId;
+    const rows = [];
+    const seen = new Set();
+    for (const [i, c] of components.entries()) {
+        const componentId = (c.id ?? "").trim();
+        if (componentId === "") {
+            inputs.findings.add("convention", `${REL_PATH}: components[${i}] has no id — dropped; a component must name the interaction surface it represents (M-ADR 0171 §9.1)`);
+            continue;
+        }
+        const id = `${integrationId}__${componentId}`;
+        if (seen.has(id)) {
+            inputs.findings.add("divergence", `integration_component: duplicate component id="${id}" — two components of one integration cannot share an id; second dropped`);
+            continue;
+        }
+        seen.add(id);
+        // §10.2 linkage. Resolve the DECLARED `componentRepo`, never the component id
+        // itself. Repository first, service as the legitimate alternative where the
+        // deployable is catalogued as one.
+        const componentRepo = (c.componentRepo ?? "").trim();
+        let resolution;
+        if (componentRepo === "") {
+            // The normal case for a feed-level component. Not a finding: the method does
+            // not impose deployable granularity on the tier.
+            resolution = "undeclared";
+        }
+        else if (inputs.knownRepoIds.has(componentRepo)) {
+            resolution = "repository";
+        }
+        else if (inputs.knownServiceIds.has(componentRepo)) {
+            resolution = "service";
+        }
+        else {
+            resolution = "unresolved";
+            inputs.findings.add("coverage", `integration_component: component "${componentId}" (${integrationId}) declares componentRepo "${componentRepo}", which matches no repositories.id or services.id in this SDD — ` +
+                `a declared code linkage is an assertion the method checks (M-ADR 0171 §10.2). Either catalogue that deployable, correct the linkage, or drop it ` +
+                `(an undeclared linkage is legitimate — the tier is at interaction-surface granularity). Not a load failure.`);
+        }
+        const direction = (c.dataFlow?.direction ?? "").trim();
+        rows.push({
+            id,
+            integration_id: integrationId,
+            component_id: componentId,
+            component_repo: componentRepo,
+            resolution,
+            component_type: (c.componentType ?? "").trim(),
+            direction,
+            frequency: (c.dataFlow?.frequency ?? "").trim(),
+            transport: (c.protocol?.transport ?? "").trim(),
+            format: (c.protocol?.format ?? "").trim(),
+            auth: (c.protocol?.auth ?? "").trim(),
+            ingestion_pattern: (c.ingestionPattern ?? "").trim(),
+            invocation_pattern: (c.invocationPattern ?? "").trim(),
+            pattern_qualifier: (c.patternQualifier ?? "").trim(),
+            primary_entities: (c.dataFlow?.primaryEntities ?? []).join(";"),
+            declared_in: "components-array",
+            source_sdd_id: "",
+        });
+    }
+    // SECOND HOME (§9.1): a full `integration-manifest.yaml` per component repo under
+    // `repos/<component>/`. Read after the array form so `seen` already holds the
+    // array-form ids and a collision across the two homes is caught rather than
+    // silently duplicated — measured disjoint today, but the two forms are authored
+    // independently and nothing stops them meeting.
+    rows.push(...(await readComponentManifests({
+        sddPath: inputs.sddPath,
+        findings: inputs.findings,
+        integrationId,
+        knownRepoIds: inputs.knownRepoIds,
+        knownServiceIds: inputs.knownServiceIds,
+        seen,
+    })));
+    checkAggregate({
+        findings: inputs.findings,
+        integrationId,
+        sddIngestion: (parsed.data.ingestionPattern ?? "").trim(),
+        sddInvocation: (parsed.data.invocationPattern ?? "").trim(),
+        rows,
+    });
+    return rows;
+}
+/** `repos/` — where the per-component manifests live (M-ADR 0171 §9.1, second home). */
+const REPOS_DIR = "repos";
+/**
+ * Read the per-component manifests: one row per `repos/<component>/integration-manifest.yaml`.
+ *
+ * IDENTITY. Same `${integrationId}__${componentId}` scheme as the array form, so both
+ * homes are addressable the same way and the PK stays `id`. The component id is the
+ * manifest's own `integrationId` — its declared identity — NOT the directory name. They
+ * agree in 82 of 86 real cases; where they differ the declaration wins, because a
+ * directory is a location and the manifest is a statement.
+ *
+ * RESOLUTION differs from the array form by construction, and that is real rather than a
+ * quirk: the containing directory IS the component repo, so linkage is structural. It is
+ * resolved against the same known-id sets, so a component whose directory matches no
+ * catalogued repo or service still reports `unresolved` — the useful signal — instead of
+ * being assumed correct because it exists on disk.
+ */
+async function readComponentManifests(args) {
+    let entries;
+    try {
+        entries = (await readdir(join(args.sddPath, REPOS_DIR), { withFileTypes: true }))
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name)
+            .sort();
+    }
+    catch (err) {
+        // No `repos/` is the normal case for an SDD using the array form, or none.
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+    const rows = [];
+    for (const dir of entries) {
+        const rel = `${REPOS_DIR}/${dir}/${REL_PATH}`;
+        let text;
+        try {
+            text = await readFile(join(args.sddPath, rel), "utf-8");
+        }
+        catch (err) {
+            // A component repo directory without a manifest is not a defect: the
+            // per-component form is optional, and `repos/` holds reverse content besides.
+            if (err.code === "ENOENT")
+                continue;
+            throw err;
+        }
+        let raw;
+        try {
+            raw = parseYaml(text);
+        }
+        catch (err) {
+            args.findings.add("convention", `${rel}: failed to parse YAML — component dropped (${err.message})`);
+            continue;
+        }
+        const parsed = ComponentManifestSchema.safeParse(raw);
+        if (!parsed.success) {
+            args.findings.add("convention", `${rel}: shape violation — ${parsed.error.issues
+                .map((i) => i.path.join(".") + ": " + i.message)
+                .join("; ")}`);
+            continue;
+        }
+        // The manifest's declared identity, falling back to the directory only when it
+        // declares none at all.
+        const componentId = (parsed.data.integrationId ?? "").trim() || dir;
+        const id = `${args.integrationId}__${componentId}`;
+        if (args.seen.has(id)) {
+            args.findings.add("divergence", `integration_component: component id="${id}" declared in BOTH §9.1 homes (components array and ${rel}) — ` +
+                `one component cannot be declared twice; the per-component manifest is dropped. Remove whichever declaration is stale.`);
+            continue;
+        }
+        args.seen.add(id);
+        // Structural linkage: the directory IS the repo. Still resolved, so a component
+        // whose directory matches nothing catalogued reports `unresolved` rather than
+        // being assumed correct because it exists on disk.
+        let resolution;
+        if (args.knownRepoIds.has(dir))
+            resolution = "repository";
+        else if (args.knownServiceIds.has(dir))
+            resolution = "service";
+        else {
+            resolution = "unresolved";
+            args.findings.add("coverage", `integration_component: per-component manifest at ${rel} names a component repo "${dir}" that matches no repositories.id or services.id in this SDD (M-ADR 0171 §10.2). ` +
+                `Catalogue that deployable or correct the directory name. Not a load failure.`);
+        }
+        rows.push({
+            id,
+            integration_id: args.integrationId,
+            component_id: componentId,
+            component_repo: dir,
+            resolution,
+            component_type: (parsed.data.componentType ?? "").trim(),
+            direction: (parsed.data.dataFlow?.direction ?? "").trim(),
+            frequency: (parsed.data.dataFlow?.frequency ?? "").trim(),
+            transport: (parsed.data.protocol?.transport ?? "").trim(),
+            format: (parsed.data.protocol?.format ?? "").trim(),
+            auth: (parsed.data.protocol?.auth ?? "").trim(),
+            ingestion_pattern: (parsed.data.ingestionPattern ?? "").trim(),
+            invocation_pattern: (parsed.data.invocationPattern ?? "").trim(),
+            pattern_qualifier: (parsed.data.patternQualifier ?? "").trim(),
+            primary_entities: (parsed.data.dataFlow?.primaryEntities ?? []).join(";"),
+            declared_in: "component-manifest",
+            source_sdd_id: "",
+        });
+    }
+    return rows;
+}
+/**
+ * §9.3 / §10.3 cross-check. The SDD-level pattern is the aggregate of the
+ * matching-direction components' patterns, so a declared SDD-level value that
+ * appears nowhere in the tier is a disagreement worth surfacing. Cross-checked,
+ * never derived — the disagreement is the informative case.
+ *
+ * Silent when either side is undeclared: absence is not disagreement, and the tier
+ * is optional.
+ */
+function checkAggregate(args) {
+    const { findings, integrationId, sddIngestion, sddInvocation, rows } = args;
+    const patternsFor = (dir, col) => {
+        const out = new Set();
+        for (const r of rows) {
+            const d = String(r["direction"] ?? "");
+            // `bidirectional` counts toward both directions.
+            if (d !== dir && d !== "bidirectional")
+                continue;
+            const p = String(r[col] ?? "");
+            if (p !== "")
+                out.add(p);
+        }
+        return out;
+    };
+    for (const [sddValue, dir, col, field] of [
+        [sddIngestion, "inbound", "ingestion_pattern", "ingestionPattern"],
+        [sddInvocation, "outbound", "invocation_pattern", "invocationPattern"],
+    ]) {
+        if (sddValue === "")
+            continue; // nothing declared at SDD level
+        const tier = patternsFor(dir, col);
+        if (tier.size === 0)
+            continue; // tier declares no pattern for this direction
+        if (!tier.has(sddValue)) {
+            findings.add("convention", `integration_component: ${integrationId} declares SDD-level ${field}="${sddValue}" but its ${dir} components declare {${[...tier].sort().join(", ")}} — ` +
+                `the SDD-level value is the aggregate of the component tier (M-ADR 0171 §9.3), so either the tier is incomplete or the SDD-level value is stale. ` +
+                `Cross-checked, not derived (§10.3).`);
+        }
+    }
+}
+//# sourceMappingURL=integration-components.js.map