@shortlink-org/portolan 0.2.4 → 0.4.0

package/scripts/gen.mjs

@@ -15,9 +15,8 @@ import {
   rmSync,
   statSync,
 } from "node:fs";
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { join, relative, resolve } from "node:path";
+import { isAbsolute, join, relative } from "node:path";
 
 import {
   addBuildStep,
@@ -26,16 +25,18 @@ import {
   writeBuildReport,
 } from "./build-report.mjs";
 import { loadCatalog } from "./catalog-sources.mjs";
-import { historyFor } from "./history.mjs";
+import { changedSince, fileAt, historyFor, lastCommitTouching } from "./history.mjs";
 import { loadManifest, stepKeys } from "./manifest.mjs";
 import { describePlugin, runPlugin } from "./plugin-host.mjs";
-import { vendoredCommit } from "./vendor-lock.mjs";
+import { explainChange } from "./output-diff.mjs";
 import {
   removeOutputFile,
   safeOutputPath,
   writeOutputFile,
 } from "./output-path.mjs";
 import { builtinPlugin } from "./builtin-plugins.mjs";
+import { diagnoseWarnings } from "./warning-policy.mjs";
+import { likec4Sources } from "./gen-likec4.mjs";
 
 const PORTOLAN_VERSION = "0.1.0";
 const EVENTS = process.env.PORTOLAN_EVENTS === "1";
@@ -63,6 +64,10 @@ function event(value) {
 // in one run is drift that never happened.
 const MANIFEST = ".portolan-manifest";
 
+// The one step no manifest declares: the app's own pictures, generated from
+// every source, keyed by its own name in likec4/.portolan-manifest.
+const LIKEC4_STEP = { plugin: "likec4", out: "likec4", key: "likec4" };
+
 const check = process.argv.includes("--check");
 const manifestSha256 = createHash("sha256")
   .update(readFileSync("portolan.json"))
@@ -122,9 +127,12 @@ async function generate() {
 
   // Extractors run first and write catalog fragments; only then is there a
   // catalog for anything else to read.
+  //
+  // No stamp travels with the request (portolan.0010). A fragment is content
+  // and nothing else; when it last changed is what the history of the
+  // fragment says, read wherever the catalog is read.
   for (const step of manifest.extract ?? []) {
     const plugin = pluginNamed(step.plugin);
-    const stamp = stampFor(step.in, step.out);
     // A plugin that asks for history gets the root's, read once per checkout
     // (portolan.0007); left out when the root is not in a checkout, which the
     // plugin reports in its own words.
@@ -135,13 +143,11 @@ async function generate() {
         input: {
           root: step.in,
           output: step.out,
-          commit: stamp.commit,
-          generatedAt: stamp.generatedAt,
           ...(history ? { history } : {}),
         },
         options: step.options ?? {},
       }, {}, { workspace: process.cwd() }),
-    );
+    inputsOf(step));
   }
 
   // Verifiers read observed evidence against the merged catalog while leaving
@@ -152,17 +158,16 @@ async function generate() {
   // carry it into the generators and into the next run.
   for (const step of manifest.verify ?? []) {
     const plugin = pluginNamed(step.plugin);
-    const stamp = stampFor(step.in, step.out);
     const own = (previous(step.out)[keys.keyOf(step)] ?? []).map((name) => join(step.out, name));
-    const { catalog } = await loadSources({ exclude: [...own, ...staleAll()] });
+    const { catalog, sources } = await loadSources({ exclude: [...own, ...staleAll()] });
     await executeStep("verify", step, `${step.plugin} ⇐ ${step.in}`, async () =>
       runPlugin(plugin, {
         portolanVersion: PORTOLAN_VERSION,
-        input: { root: step.in, output: step.out, commit: stamp.commit, generatedAt: stamp.generatedAt },
+        input: { root: step.in, output: step.out },
         catalog,
         options: step.options ?? {},
       }, {}, { workspace: process.cwd() }),
-    );
+    inputsOf(step, sources.map((source) => source.path)));
   }
 
   // What a dropped extract step wrote is not part of the catalog, so it is
@@ -182,18 +187,27 @@ async function generate() {
 
   for (const step of manifest.generate ?? []) {
     const plugin = pluginNamed(step.plugin);
-    const generatedCatalog = step.catalog
-      ? (await loadSources({ profile: step.catalog })).catalog
-      : catalog;
+    const generated = step.catalog
+      ? await loadSources({ profile: step.catalog })
+      : { catalog, sources };
     await executeStep("generate", step, `${step.plugin} → ${step.out}`, async () =>
       runPlugin(plugin, {
         portolanVersion: PORTOLAN_VERSION,
-        catalog: generatedCatalog,
+        catalog: generated.catalog,
         options: step.options ?? {},
       }),
-    );
+    { inputs: generated.sources.map((source) => source.path), excludes: [] });
   }
 
+  // The LikeC4 sources are pages of the catalog like any the generators
+  // write: committed, reviewed as a diff, and held to the catalog by the
+  // check. They used to be written only before the dev server started,
+  // which left a flow a verifier had just changed with a picture of the
+  // flow before - and a run from the page with no picture of a new flow.
+  await executeStep("generate", LIKEC4_STEP, "likec4 → likec4", async () => ({
+    files: await likec4Sources({ catalog, manifest }),
+  }), { inputs: sources.map((source) => source.path), excludes: [] });
+
   sweepAll();
 }
 
@@ -208,6 +222,17 @@ function sweepAll() {
   }
 }
 
+/**
+ * The keys of the steps that write into a directory this run: the manifest's,
+ * and the likec4 step's in its own directory, which no manifest declares and
+ * the sweep would otherwise take for a step that was dropped.
+ */
+function liveKeysIn(out) {
+  const live = new Set(keys.liveIn(out));
+  if (out === LIKEC4_STEP.out) live.add(LIKEC4_STEP.key);
+  return live;
+}
+
 /** Every file the sweep would remove, in every directory a step writes into. */
 function staleAll() {
   const outs = new Set(
@@ -230,7 +255,7 @@ function staleAll() {
  */
 function staleIn(out) {
   const listing = previous(out);
-  const live = keys.liveIn(out);
+  const live = liveKeysIn(out);
   const dead = Object.keys(listing).filter((key) => !live.has(key));
   if (dead.length === 0) return [];
 
@@ -249,13 +274,27 @@ function staleIn(out) {
   return stale;
 }
 
-async function executeStep(phase, step, label, work) {
+/**
+ * Runs one step and settles its files. `reads` is what the step reads - paths,
+ * and the output directories among them to leave out - so that an output
+ * that moved can be explained by what moved among its inputs since the
+ * output was last committed.
+ */
+async function executeStep(phase, step, label, work, reads) {
   const startedAt = Date.now();
   event({ type: "step-started", ordinal: report.steps.length, phase, plugin: step.plugin, input: step.in, output: step.out });
   try {
     const { files, warnings = [] } = await work();
-    const changes = apply(files, step.out, keys.keyOf(step), check);
-    const changed = summarise(label, files, changes, warnings);
+    const diagnostics = diagnoseWarnings({
+      plugin: step.plugin,
+      warnings,
+      policies: manifest.warningPolicies,
+      project: projectForStep(step),
+      phase,
+    });
+    const changes = apply(files, step.out, step.key ?? keys.keyOf(step), check);
+    const since = changes.length > 0 ? whyChanged(step, files.map((file) => join(step.out, file.name)), reads) : null;
+    const changed = summarise(label, files, changes, diagnostics, since);
     drifted = changed || drifted;
     const result = {
       phase,
@@ -267,10 +306,14 @@ async function executeStep(phase, step, label, work) {
       fileCount: files.length,
       changedCount: changes.length,
       changes,
+      // What moved among the inputs since the output was last committed, when
+      // something in the output moved; the Settings page can say why.
+      ...(since ? { since } : {}),
       files: files.map((file) => join(step.out, file.name)),
       // What the plugin could not read, in its own words. Already printed as
       // it ran; kept here so the Settings page can list it beside the step.
       warnings,
+      diagnostics,
     };
     addBuildStep(report, result);
     persistReport();
@@ -296,6 +339,15 @@ async function executeStep(phase, step, label, work) {
   }
 }
 
+function projectForStep(step) {
+  if (!step.in) return "";
+  const input = String(step.in).replace(/\\/g, "/").replace(/\/+$/, "");
+  const projects = (manifest.projects ?? [])
+    .filter((project) => typeof project?.id === "string" && typeof project?.root === "string")
+    .sort((left, right) => right.root.length - left.root.length);
+  return projects.find((project) => input === project.root || input.startsWith(`${project.root}/`))?.id ?? "";
+}
+
 function persistReport() {
   try {
     writeBuildReport(report);
@@ -334,9 +386,17 @@ async function needsOf(plugin) {
   return pluginNeeds.get(plugin.name);
 }
 
-/** Prints what a step did, and says whether it left the tree out of date. */
-function summarise(label, files, changes, warnings = []) {
-  const said = warnings.length > 0 ? `, ${warnings.length} warning${warnings.length === 1 ? "" : "s"}` : "";
+/**
+ * Prints what a step did, and says whether it left the tree out of date. A
+ * file that differs says where it first differs, and the step says what moved
+ * among its inputs since the output was last committed - or that nothing
+ * did, which points at the plugin.
+ */
+function summarise(label, files, changes, diagnostics = [], since = null) {
+  const suppressed = diagnostics.filter((diagnostic) => diagnostic.suppressed).length;
+  const said = diagnostics.length > 0
+    ? `, ${diagnostics.length} warning${diagnostics.length === 1 ? "" : "s"}${suppressed ? ` (${suppressed} suppressed)` : ""}`
+    : "";
   const summary = `${label}: ${files.length} file${files.length === 1 ? "" : "s"}${said}`;
 
   if (changes.length === 0) {
@@ -347,120 +407,86 @@ function summarise(label, files, changes, warnings = []) {
 
   if (!check) {
     console.log(`${summary}, ${changes.length} written`);
+    if (since) console.log(`  ${describeSince(since)}`);
 
     return false;
   }
 
   console.error(`${summary}, ${changes.length} out of date:`);
-  for (const change of changes.slice(0, 20)) console.error(`  ${change.kind.padEnd(8)} ${change.path}`);
+  for (const change of changes.slice(0, 20)) {
+    console.error(`  ${change.kind.padEnd(8)} ${change.path}${change.reason ? ` — ${change.reason}` : ""}`);
+  }
   if (changes.length > 20) console.error(`  ... and ${changes.length - 20} more`);
+  if (since) console.error(`  ${describeSince(since)}`);
 
   return true;
 }
 
 /**
- * When the source a fragment describes last changed, and at which commit
- * (portolan.0002).
- *
- * The host works this out rather than the extractor, for two reasons. A plugin
- * that reads a clock produces a different fragment on every run, which cannot
- * be committed and cannot be checked; and a plugin that shells out to git is a
- * plugin that can never be sandboxed. Stamped from the last commit to touch the
- * directory, a fragment changes exactly when its subject does.
- *
- * The output is excluded from that history, and it has to be: a fragment
- * written beside the code it describes is inside the directory it is stamped
- * from, so committing one would move the stamp, which would make the fragment
- * out of date, which would rewrite it - and `--check` would never come back
- * clean two runs in a row.
+ * What a step reads, for saying why its output moved: its root and whatever
+ * else it was handed, less every output directory inside the root, because a
+ * fragment written beside the code it describes is not an input to itself.
  */
-function stampFor(root, out) {
-  // A copy of another repository is dated by the commit it is a copy OF, which
-  // the fetch step wrote down beside it. Read before git, and without touching
-  // git at all: the local history of a vendored directory says when somebody
-  // ran the fetch, which is a fact about this repository and not about the
-  // service the fragment describes.
-  //
-  // Short, like every other stamp, because a stamp is read rather than
-  // resolved. The full sha travels separately, in the pin the fetch also
-  // wrote, where a link is built from it.
-  const vendored = vendoredCommit(root);
-  if (vendored) {
-    // No date. Nothing here knows when that commit was made - the lock records
-    // what was fetched, not when it was authored - and a date invented from
-    // the local clock would make the merge call this the stalest source in the
-    // estate every time it ran.
-    return { commit: vendored.slice(0, 7), generatedAt: "" };
-  }
-
-  // The history read is the one the root lives in. A manifest pointed at a
-  // checkout elsewhere on the disk - the service being documented, not a copy
-  // of it vendored here - is stamped from that checkout's history, because the
-  // fragment describes that service and not the repository the manifest sits
-  // in. A root with no repository around it is stamped as uncommitted.
-  const repo = repositoryOf(root);
-  if (!repo) {
-    return { commit: "uncommitted", generatedAt: process.env.PORTOLAN_GENERATED_AT || new Date().toISOString() };
-  }
-
-  // A shallow clone has no history to read: the one commit that was fetched has
-  // no parent, so every path looks as though it changed there and every fragment
-  // is stamped with the checkout rather than with its subject. That is wrong
-  // quietly - the fragments regenerate, `--check` reports drift, and nothing
-  // says why - so it is refused here instead.
-  if (shallow(repo)) {
-    fail(
-      `${repo} is a shallow clone, where every path looks as though it changed in ` +
-        "the single commit that was fetched, so a fragment cannot be stamped " +
-        "with the commit it describes. Fetch the full history first " +
-        "(git fetch --unshallow, or actions/checkout with fetch-depth: 0).",
-    );
+function inputsOf(step, extra = []) {
+  const excludes = [];
+  for (const other of allSteps()) {
+    if (!other.out || other.out === step.in) continue;
+    const inside = relative(step.in, other.out);
+    if (inside && !inside.startsWith("..") && !isAbsolute(inside)) excludes.push(other.out);
   }
+  return { inputs: [step.in, ...extra], excludes };
+}
 
-  // Only an output INSIDE the root is excluded. An output beside it, or above
-  // it, is not in the root's history to begin with - and excluding a parent
-  // would exclude the root itself, leaving nothing to read and a stamp that
-  // moved on every commit.
-  const rootInRepo = relative(repo, resolve(root)) || ".";
-  const outInRepo = out ? relative(repo, resolve(out)) : "";
-  const inside = out && (outInRepo === rootInRepo || outInRepo.startsWith(`${rootInRepo.replace(/\/$/, "")}/`) || rootInRepo === ".");
-  const exclude = inside && outInRepo !== rootInRepo && !outInRepo.startsWith("..") ? [`:(exclude)${outInRepo}`] : [];
-
-  for (const args of [
-    ["log", "-1", "--format=%h %cI", "--", rootInRepo, ...exclude],
-    ["log", "-1", "--format=%h %cI"],
-  ]) {
-    const answer = git(repo, args);
-    if (!answer) continue;
-    const [commit, generatedAt] = answer.split(" ");
-    if (commit && generatedAt) return { commit, generatedAt };
-  }
+function allSteps() {
+  return [...(manifest.extract ?? []), ...(manifest.verify ?? []), ...(manifest.generate ?? [])];
+}
 
-  return { commit: "uncommitted", generatedAt: process.env.PORTOLAN_GENERATED_AT || new Date().toISOString() };
+/**
+ * Why a step's output is not what it was: the commit that last touched the
+ * output is when it was last generated, and what changed among the inputs
+ * since then is the reason. The history is the record of the last generation
+ * (portolan.0010); nothing is written down to know this.
+ *
+ * The manifest counts as an input only where this step's own entry moved.
+ * The whole file changes whenever any step is touched, and naming it for
+ * every other step would explain nothing.
+ */
+function whyChanged(step, outputs, reads) {
+  const committed = lastCommitTouching(process.cwd(), outputs);
+  if (!committed) return { committed: null, changed: [] };
+  const changed = changedSince(process.cwd(), committed.commit, reads.inputs, reads.excludes);
+  if (stepEntryChanged(committed.commit, step)) changed.push("portolan.json (this step's entry)");
+  return { committed, changed };
 }
 
-/** Runs git in a repository and answers with its trimmed output, or "" when it refused. */
-function git(repo, args) {
+/** Whether the manifest at `commit` told this step the same thing it is told now. */
+function stepEntryChanged(commit, step) {
+  // A step no manifest declares has no entry to have changed.
+  if (step.key) return false;
+  let then;
   try {
-    return execFileSync("git", ["-C", repo, ...args], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
+    then = JSON.parse(fileAt(process.cwd(), commit, "portolan.json"));
   } catch {
-    // Not a repository, or no commit touches this path yet. git has already
-    // said so on its own stderr, which is not this run's log.
-    return "";
+    return true; // No manifest there, or not one that parses: everything about the step is new.
   }
+  const phase = ["extract", "verify", "generate"].find((name) => (manifest[name] ?? []).includes(step));
+  const before = (then[phase] ?? []).find(
+    (other) =>
+      other.plugin === step.plugin &&
+      (other.in ?? "") === (step.in ?? "") &&
+      other.out === step.out &&
+      (other.options?.out ?? "") === (step.options?.out ?? ""),
+  );
+  return !before || JSON.stringify(before) !== JSON.stringify(step);
 }
 
-/** The working tree a directory belongs to, or "" when no repository holds it. */
-function repositoryOf(dir) {
-  return git(dir, ["rev-parse", "--show-toplevel"]);
-}
-
-/** Whether the history this runs against is truncated. */
-function shallow(repo) {
-  return git(repo, ["rev-parse", "--is-shallow-repository"]) === "true";
+function describeSince({ committed, changed }) {
+  if (!committed) return "the output has never been committed, so there is nothing to compare its inputs against";
+  const when = `${committed.commit} (${committed.date}), when the output was last committed`;
+  if (changed.length === 0) return `no input changed since ${when}; the plugin itself did`;
+  const shown = changed.slice(0, 6).join(", ");
+  const more = changed.length > 6 ? ` and ${changed.length - 6} more` : "";
+  return `since ${when}, ${changed.length} input${changed.length === 1 ? "" : "s"} changed: ${shown}${more}`;
 }
 
 /** Reads, merges and validates every source the manifest names. */
@@ -497,7 +523,11 @@ function apply(files, out, key, checkOnly) {
 
     if (binary ? Buffer.isBuffer(current) && current.equals(wanted) : current === wanted) continue;
 
-    changes.push({ kind: current === null ? "added" : "changed", path: join(out, file.name) });
+    changes.push({
+      kind: current === null ? "added" : "changed",
+      path: join(out, file.name),
+      reason: explainChange(current, wanted, file.name),
+    });
     if (checkOnly) continue;
 
     try {
@@ -549,7 +579,7 @@ function apply(files, out, key, checkOnly) {
 function sweep(out, checkOnly) {
   const changes = [];
   const listing = previous(out);
-  const live = keys.liveIn(out);
+  const live = liveKeysIn(out);
   const dead = Object.keys(listing).filter((key) => !live.has(key));
   if (dead.length === 0) return changes;
 

package/scripts/gitops-example.test.mjs

@@ -0,0 +1,108 @@
+// The example GitOps tree, rendered the way Argo CD would render it.
+//
+// Every overlay under examples/gitops/envs/*/shop/* is built with kustomize
+// - the binary when it is on the PATH, kubectl's copy otherwise - and what
+// the environment says (the tag, the replica count, the variable) has to be
+// what comes out. Then the tree is held to the snapshot in examples/argocd:
+// an overlay that no Application in the snapshot deploys, or an Application
+// pointing at a directory that is not here, is the two examples drifting
+// apart, which is the one thing an example must not do.
+import { execFileSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const root = fileURLToPath(new URL("..", import.meta.url));
+const gitops = join(root, "examples", "gitops");
+
+/** kustomize itself, else the copy kubectl ships; the output is the same. */
+function kustomizeCommand() {
+  for (const candidate of ["kustomize"]) {
+    try {
+      execFileSync(candidate, ["version"], { stdio: "ignore" });
+      return [candidate, "build"];
+    } catch {
+      // Not on the PATH.
+    }
+  }
+  return ["kubectl", "kustomize"];
+}
+
+const [command, ...args] = kustomizeCommand();
+const build = (dir) => execFileSync(command, [...args, dir], { encoding: "utf8" });
+
+/** `<env>/shop/<service>` for every overlay in the tree, sorted. */
+function overlays() {
+  const out = [];
+  for (const env of readdirSync(join(gitops, "envs")).sort()) {
+    const shop = join(gitops, "envs", env, "shop");
+    if (!existsSync(shop)) continue;
+    for (const service of readdirSync(shop).sort()) {
+      if (existsSync(join(shop, service, "kustomization.yaml"))) out.push({ env, service, dir: join(shop, service) });
+    }
+  }
+  return out;
+}
+
+describe("the example GitOps tree", () => {
+  it("has an overlay for cart in both environments and pricing in prod only", () => {
+    expect(overlays().map((o) => `${o.env}/${o.service}`)).toEqual(["prod/cart", "prod/pricing", "staging/cart"]);
+  });
+
+  it("renders cart in prod at the tag prod runs, three replicas, labelled with the environment", () => {
+    const rendered = build(join(gitops, "envs", "prod", "shop", "cart"));
+    expect(rendered).toContain("image: ghcr.io/shortlink-org/cart:2.1.0");
+    expect(rendered).toContain("replicas: 3");
+    expect(rendered).toContain("env: prod");
+    expect(rendered).toContain("app.kubernetes.io/part-of: shop");
+    // The base's names and namespace survive the overlay.
+    expect(rendered).toMatch(/kind: Ingress[\s\S]*namespace: shop/);
+  });
+
+  it("renders cart in staging as the release candidate, one replica, NODE_ENV restated and nothing else lost", () => {
+    const rendered = build(join(gitops, "envs", "staging", "shop", "cart"));
+    expect(rendered).toContain("image: ghcr.io/shortlink-org/cart:2.2.0-rc.1");
+    expect(rendered).toContain("replicas: 1");
+    expect(rendered).toMatch(/name: NODE_ENV\n\s+value: staging/);
+    // Merged by name: the other variables the base declares are still there.
+    expect(rendered).toMatch(/name: PRICING_ADDR\n\s+value: pricing\.shop\.svc:9090/);
+    expect(rendered).not.toContain("value: production");
+  });
+
+  it("renders pricing in prod with the longer cache and the secret untouched", () => {
+    const rendered = build(join(gitops, "envs", "prod", "shop", "pricing"));
+    expect(rendered).toContain("image: ghcr.io/shortlink-org/pricing:1.4.2");
+    expect(rendered).toContain("PRICE_LIST_TTL: 1h");
+    expect(rendered).toContain("OTEL_EXPORTER_OTLP_ENDPOINT");
+    expect(rendered).toContain("kind: Secret");
+  });
+
+  it("is what the snapshot in examples/argocd was recorded from", () => {
+    const snapshot = JSON.parse(readFileSync(join(root, "examples", "argocd", "argocd.apps.json"), "utf8"));
+    const placed = snapshot.deployments.filter((d) => d.project === "shop");
+    // One Application per overlay, named as the ApplicationSet names it,
+    // pointing at the overlay, labelled onto the service.
+    expect(placed.map((d) => [d.name, d.environment, d.path, d.service]).sort()).toEqual(
+      overlays().map((o) => [`shop-${o.service}-${o.env}`, o.env, `examples/gitops/envs/${o.env}/shop/${o.service}`, `shop.${o.service}`]).sort(),
+    );
+    // The image the snapshot says runs is the image the overlay renders.
+    for (const deployment of placed) {
+      const rendered = build(join(root, deployment.path));
+      for (const image of deployment.images ?? []) expect(rendered).toContain(`image: ${image}`);
+    }
+    // The clusters the environments name are the ones the snapshot places in.
+    for (const { env } of overlays()) {
+      const cluster = readFileSync(join(gitops, "envs", env, "cluster.yaml"), "utf8").match(/^\s+name: (.+)$/m)?.[1];
+      for (const deployment of placed.filter((d) => d.environment === env)) expect(deployment.cluster).toBe(cluster);
+    }
+  });
+
+  it("names every Application in the shop ApplicationSet with the labels the fetcher places by", () => {
+    const appset = readFileSync(join(gitops, "appsets", "shop.yaml"), "utf8");
+    expect(appset).toContain("app.kubernetes.io/part-of: shop");
+    expect(appset).toContain('app.kubernetes.io/name: "{{.path.basename}}"');
+    expect(appset).toContain('name: "shop-{{.path.basename}}-{{.env}}"');
+    expect(appset).toContain("path: examples/gitops/envs/*/cluster.yaml");
+  });
+});

package/scripts/go-discovery.test.mjs

@@ -0,0 +1,30 @@
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterEach, expect, it } from "vitest";
+import { discoverProject } from "./local-discovery.mjs";
+
+const roots = [];
+afterEach(() => roots.splice(0).forEach((root) => rmSync(root, { recursive: true, force: true })));
+function discover(files) {
+  const root = mkdtempSync(join(tmpdir(), "portolan-go-discovery-"));
+  roots.push(root);
+  for (const [name, text] of Object.entries({ "go.mod": "module example.com/app\n", ...files })) {
+    const path = join(root, name);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, text);
+  }
+  return discoverProject(root, ".").detections.map((item) => item.plugin);
+}
+it("offers Go flows and SQL for a service without any DDD directories", () => {
+  expect(discover({
+    "web/routes.go": 'package web\nimport "net/http"\nfunc Register(m *http.ServeMux) { m.HandleFunc("POST /orders", create) }',
+    "store/migrations/001.sql": "CREATE TABLE orders (id uuid PRIMARY KEY);",
+  })).toEqual(expect.arrayContaining(["go-domain", "sql"]));
+});
+it("does not offer Go domain extraction for unregistered helpers or generated handlers", () => {
+  for (const source of [
+    'package web\nimport "net/http"\nfunc Help(w http.ResponseWriter, r *http.Request) {}',
+    '// Code generated by fixture. DO NOT EDIT.\npackage web\nimport "net/http"\nfunc Register() { http.HandleFunc("/x", help) }',
+  ]) expect(discover({ "web/routes.go": source })).not.toContain("go-domain");
+});