@webpieces/nx-webpieces-rules 0.4.900 → 0.4.902

package/src/lib/graph-sorter.js.map

@@ -1 +1 @@
-{"version":3,"file":"graph-sorter.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/lib/graph-sorter.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAqGH,4DAyCC;AASD,wDAgBC;AApKD,iDAAsD;AAyFtD;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CAAC,KAA+B;IACpE,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEvC,OAAO,SAAS,CAAC,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAErC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClC,uEAAuE;YACvE,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAEpE,IAAI,mBAAmB,EAAE,CAAC;gBACtB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,gFAAgF;YAChF,mFAAmF;YACnF,kFAAkF;YAClF,IAAI,mCAAoB,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACrE,sFAAsF;YACtF,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,MAAM,IAAI,KAAK,CACX,+EAA+E,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;QACN,CAAC;QAED,4DAA4D;QAC5D,YAAY,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE1B,oBAAoB;QACpB,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,KAA+B;IAClE,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,+DAA+D;IAC/D,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QACjC,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC1B,6CAA6C;YAC7C,MAAM,CAAC,OAAO,CAAC,GAAG;gBACd,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;aAC3C,CAAC;QACN,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Graph Sorter\n *\n * Performs topological sorting on the dependency graph to:\n * 1. Detect circular dependencies (fails if cycle found)\n * 2. Assign level numbers to each project (level 0 = no deps, level 1 = depends on level 0, etc.)\n * 3. Group projects into layers for deterministic ordering\n */\n\nimport type { ProjectApiRelations } from './api-usage/api-relations';\nimport { ProjectCycleDetector } from './graph-cycles';\n\n/**\n * Graph entry with level metadata plus AI-oriented metadata filled in by\n * enrichGraph() (lib/graph-metadata.ts) before the graph is saved:\n *  - framework: the project's libType — the SET of runtime environments it is\n *    validated to run in, drawn from browser | react | angular | node | express\n *    (e.g. [\"browser\",\"node\"]); from its `framework:` nx tags (source of truth)\n *    or inferred from package.json deps\n *  - shortDescription: summary extracted from the project's responsibilities.md\n *  - responsibilitiesFile: repo-relative path to the FULL responsibilities doc\n *  - designFile: repo-relative path to the generated DI design.json (only for\n *    project.json projects)\n *  - apiRelations: for each api-lib in `dependsOn`, WHY the edge exists — the\n *    APIs this project implements (serves) and/or uses (calls), each with its\n *    transport (rpc | pubsub). Derived by scanning source (see api-usage/).\n */\nexport interface GraphEntry {\n    /**\n     * The project's row: its dependency depth (0 = no deps) — except that every server, client and\n     * app (APP_ROLES) is pinned to the TOP level, and a bundle above the apps it aggregates (#1179,\n     * graph-entry-levels.ts). Every dependency still sits strictly below its dependent.\n     */\n    level: number;\n    dependsOn: string[];\n    framework?: string[];\n    role?: string;\n    /**\n     * The name CLIENTS address this app by at runtime (`new ClientConfig('helper-fsdb')`) — its\n     * deployed service name, DECLARED in project.json as metadata.webpieces.serviceName. Absent for\n     * anything nothing calls by name (libraries, browser apps). See service-name-resolver.ts.\n     */\n    serviceName?: string;\n    /**\n     * The service(s) this project's clients call when the call site cannot carry a literal\n     * `ClientConfig` — the symmetric half of `serviceName`. DECLARED in project.json as\n     * metadata.webpieces.callsService, either a single service name (every untargeted `uses` aims\n     * there) or an `{ apiClassName: serviceName }` map (a client that calls several). Absent for a\n     * project that never calls anything, or one whose call sites all carry literals.\n     * See service-name-resolver.ts.\n     */\n    callsService?: string | Record<string, string>;\n    /**\n     * When false, the project is hidden from the rendered architecture graphs\n     * (its box AND every edge touching it are omitted from dependencies.html and\n     * the runtime graph). It stays in this JSON so the data view is complete.\n     * Absent means drawn (the default). From the project's `drawOnGraph:` nx tag.\n     */\n    drawOnGraph?: boolean;\n    /**\n     * Target service names whose RUNTIME edge from this project is cut out of leveling and cycle\n     * detection, from this project's `cutLegacyCycle:<target>` nx tags. Per EDGE, not per project.\n     * An admission of legacy debt, never an approved pattern — see cut-legacy-cycle-resolver.ts.\n     * Absent (the overwhelmingly normal case) means this project cuts nothing.\n     */\n    cutLegacyCycle?: string[];\n    /**\n     * The products this project belongs to (#1179), sorted. A project carrying `product:<name>` tags\n     * has exactly those — its declared tags are FINAL (#1201). An untagged project has every product\n     * whose tagged project reaches it by a downward walk over `dependsOn` that does not pass through\n     * another tagged project. It is the project's blast radius — a change here is a change to each of\n     * these products. Absent when no product reaches it (and everywhere when no project carries a\n     * `product:` tag). See graph-products.ts.\n     */\n    products?: string[];\n    shortDescription?: string;\n    responsibilitiesFile?: string;\n    designFile?: string;\n    apiRelations?: ProjectApiRelations;\n    runtimeDeclaration?: string;\n    runtimeComposition?: boolean;\n    /**\n     * The @webpieces runtime packages this project's OWN package.json declares — http-routing,\n     * http-server, http-client-node, http-client-browser, cloudtasks-client. Omitted when it\n     * declares none, so TOTAL absence across the file means the file predates this field and\n     * nothing is auto-hidden (see runtime-graph.ts). Core/util/logging packages are deliberately\n     * not markers; see runtime-participant-resolver.ts for why.\n     *\n     * The runtime graph ORs this over a node's library closure: a server whose whole webpieces\n     * stack comes from a shared bootstrap lib participates even though it declares nothing itself.\n     */\n    webpiecesRuntime?: string[];\n}\n\n/**\n * Enhanced graph format with level information\n */\nexport type EnhancedGraph = Record<string, GraphEntry>;\n\n/**\n * Compute topological layers for dependency graph using Kahn's algorithm\n *\n * Projects are grouped into layers where each layer only depends on previous layers.\n * Throws an error if a circular dependency is detected.\n *\n * @param graph - Dependency graph { project: [deps] }\n * @returns Array of layers, each containing sorted project names\n */\nexport function computeTopologicalLayers(graph: Record<string, string[]>): string[][] {\n    const layers: string[][] = [];\n    const processed = new Set<string>();\n    const allProjects = Object.keys(graph);\n\n    while (processed.size < allProjects.length) {\n        const currentLayer: string[] = [];\n\n        for (const project of allProjects) {\n            if (processed.has(project)) continue;\n\n            const deps = graph[project] || [];\n            // Check if all dependencies are in previous layers (already processed)\n            const allDepsInPrevLayers = deps.every((dep) => processed.has(dep));\n\n            if (allDepsInPrevLayers) {\n                currentLayer.push(project);\n            }\n        }\n\n        if (currentLayer.length === 0) {\n            // No progress made = circular dependency. ProjectCycleDetector is the ONE cycle\n            // implementation in this package — it names every chain, in project keys, with the\n            // fix — so this reports through it rather than keeping a second, weaker DFS here.\n            new ProjectCycleDetector().assertAcyclic(graph, 'the project graph');\n            // Unreachable: Kahn only stalls on a cycle, and the assert above throws on every one.\n            const remaining = allProjects.filter((p: string): boolean => !processed.has(p));\n            throw new Error(\n                `Topological sort stalled with no cycle to report — projects left unlayered: ${remaining.join(', ')}`,\n            );\n        }\n\n        // Sort alphabetically within layer for deterministic output\n        currentLayer.sort();\n        layers.push(currentLayer);\n\n        // Mark as processed\n        currentLayer.forEach((p) => processed.add(p));\n    }\n\n    return layers;\n}\n\n/**\n * Sort graph in topological order with alphabetical sorting within layers\n * Returns enhanced format with level metadata\n *\n * @param graph - Unsorted dependency graph { project: [deps] }\n * @returns Sorted graph with level metadata { project: { level: number, dependsOn: [deps] } }\n */\nexport function sortGraphTopologically(graph: Record<string, string[]>): EnhancedGraph {\n    const layers = computeTopologicalLayers(graph);\n    const result: EnhancedGraph = {};\n\n    // Add projects layer by layer (dependencies before dependents)\n    layers.forEach((layer, levelIndex) => {\n        for (const project of layer) {\n            // Already sorted alphabetically within layer\n            result[project] = {\n                level: levelIndex,\n                dependsOn: (graph[project] || []).sort(),\n            };\n        }\n    });\n\n    return result;\n}\n"]}
+{"version":3,"file":"graph-sorter.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/lib/graph-sorter.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAkGH,4DAyCC;AASD,wDAgBC;AAjKD,iDAAsD;AAsFtD;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CAAC,KAA+B;IACpE,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEvC,OAAO,SAAS,CAAC,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAErC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClC,uEAAuE;YACvE,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAEpE,IAAI,mBAAmB,EAAE,CAAC;gBACtB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,gFAAgF;YAChF,mFAAmF;YACnF,kFAAkF;YAClF,IAAI,mCAAoB,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACrE,sFAAsF;YACtF,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,MAAM,IAAI,KAAK,CACX,+EAA+E,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;QACN,CAAC;QAED,4DAA4D;QAC5D,YAAY,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE1B,oBAAoB;QACpB,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,KAA+B;IAClE,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,+DAA+D;IAC/D,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QACjC,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC1B,6CAA6C;YAC7C,MAAM,CAAC,OAAO,CAAC,GAAG;gBACd,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;aAC3C,CAAC;QACN,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Graph Sorter\n *\n * Performs topological sorting on the dependency graph to:\n * 1. Detect circular dependencies (fails if cycle found)\n * 2. Assign level numbers to each project (level 0 = no deps, level 1 = depends on level 0, etc.)\n * 3. Group projects into layers for deterministic ordering\n */\n\nimport type { ProjectApiRelations } from './api-usage/api-relations';\nimport { ProjectCycleDetector } from './graph-cycles';\n\n/**\n * Graph entry with level metadata plus AI-oriented metadata filled in by\n * enrichGraph() (lib/graph-metadata.ts) before the graph is saved:\n *  - framework: the project's libType — the SET of runtime environments it is\n *    validated to run in, drawn from browser | react | angular | node | express\n *    (e.g. [\"browser\",\"node\"]); from its `framework:` nx tags (source of truth)\n *    or inferred from package.json deps\n *  - shortDescription: summary extracted from the project's responsibilities.md\n *  - responsibilitiesFile: repo-relative path to the FULL responsibilities doc\n *  - designFile: repo-relative path to the generated DI design.json (only for\n *    project.json projects)\n *  - apiRelations: for each api-lib in `dependsOn`, WHY the edge exists — the\n *    APIs this project implements (serves) and/or uses (calls), each with its\n *    transport (rpc | pubsub). Derived by scanning source (see api-usage/).\n */\nexport interface GraphEntry {\n    /**\n     * The project's row: its dependency depth (0 = no deps) — except that every server, client and\n     * app (APP_ROLES) is pinned to the TOP level, and a bundle above the apps it aggregates (#1179,\n     * graph-entry-levels.ts). Every dependency still sits strictly below its dependent.\n     */\n    level: number;\n    dependsOn: string[];\n    framework?: string[];\n    role?: string;\n    /**\n     * The name CLIENTS address this app by at runtime (`new ClientConfig('helper-fsdb')`) — its\n     * deployed service name, DECLARED in project.json as metadata.webpieces.serviceName. Absent for\n     * anything nothing calls by name (libraries, browser apps). See service-name-resolver.ts.\n     */\n    serviceName?: string;\n    /**\n     * The service(s) this project's clients call when the call site cannot carry a literal\n     * `ClientConfig` — the symmetric half of `serviceName`. DECLARED in project.json as\n     * metadata.webpieces.callsService, either a single service name (every untargeted `uses` aims\n     * there) or an `{ apiClassName: serviceName }` map (a client that calls several). Absent for a\n     * project that never calls anything, or one whose call sites all carry literals.\n     * See service-name-resolver.ts.\n     */\n    callsService?: string | Record<string, string>;\n    /**\n     * When false, the project is hidden from the rendered architecture graphs\n     * (its box AND every edge touching it are omitted from dependencies.html and\n     * the runtime graph). It stays in this JSON so the data view is complete.\n     * Absent means drawn (the default). From the project's `drawOnGraph:` nx tag.\n     */\n    drawOnGraph?: boolean;\n    /**\n     * Target service names whose RUNTIME edge from this project is cut out of leveling and cycle\n     * detection, from this project's `cutLegacyCycle:<target>` nx tags. Per EDGE, not per project.\n     * An admission of legacy debt, never an approved pattern — see cut-legacy-cycle-resolver.ts.\n     * Absent (the overwhelmingly normal case) means this project cuts nothing.\n     */\n    cutLegacyCycle?: string[];\n    /**\n     * The products this project belongs to (#1179), sorted: exactly its declared `product:<name>` tags\n     * (#1216). Absent for an untagged project — it is in no product, however many tagged projects\n     * depend on it. See graph-products.ts.\n     */\n    products?: string[];\n    shortDescription?: string;\n    responsibilitiesFile?: string;\n    designFile?: string;\n    apiRelations?: ProjectApiRelations;\n    runtimeDeclaration?: string;\n    runtimeComposition?: boolean;\n    /**\n     * The @webpieces runtime packages this project's OWN package.json declares — http-routing,\n     * http-server, http-client-node, http-client-browser, cloudtasks-client. Omitted when it\n     * declares none, so TOTAL absence across the file means the file predates this field and\n     * nothing is auto-hidden (see runtime-graph.ts). Core/util/logging packages are deliberately\n     * not markers; see runtime-participant-resolver.ts for why.\n     *\n     * The runtime graph ORs this over a node's library closure: a server whose whole webpieces\n     * stack comes from a shared bootstrap lib participates even though it declares nothing itself.\n     */\n    webpiecesRuntime?: string[];\n}\n\n/**\n * Enhanced graph format with level information\n */\nexport type EnhancedGraph = Record<string, GraphEntry>;\n\n/**\n * Compute topological layers for dependency graph using Kahn's algorithm\n *\n * Projects are grouped into layers where each layer only depends on previous layers.\n * Throws an error if a circular dependency is detected.\n *\n * @param graph - Dependency graph { project: [deps] }\n * @returns Array of layers, each containing sorted project names\n */\nexport function computeTopologicalLayers(graph: Record<string, string[]>): string[][] {\n    const layers: string[][] = [];\n    const processed = new Set<string>();\n    const allProjects = Object.keys(graph);\n\n    while (processed.size < allProjects.length) {\n        const currentLayer: string[] = [];\n\n        for (const project of allProjects) {\n            if (processed.has(project)) continue;\n\n            const deps = graph[project] || [];\n            // Check if all dependencies are in previous layers (already processed)\n            const allDepsInPrevLayers = deps.every((dep) => processed.has(dep));\n\n            if (allDepsInPrevLayers) {\n                currentLayer.push(project);\n            }\n        }\n\n        if (currentLayer.length === 0) {\n            // No progress made = circular dependency. ProjectCycleDetector is the ONE cycle\n            // implementation in this package — it names every chain, in project keys, with the\n            // fix — so this reports through it rather than keeping a second, weaker DFS here.\n            new ProjectCycleDetector().assertAcyclic(graph, 'the project graph');\n            // Unreachable: Kahn only stalls on a cycle, and the assert above throws on every one.\n            const remaining = allProjects.filter((p: string): boolean => !processed.has(p));\n            throw new Error(\n                `Topological sort stalled with no cycle to report — projects left unlayered: ${remaining.join(', ')}`,\n            );\n        }\n\n        // Sort alphabetically within layer for deterministic output\n        currentLayer.sort();\n        layers.push(currentLayer);\n\n        // Mark as processed\n        currentLayer.forEach((p) => processed.add(p));\n    }\n\n    return layers;\n}\n\n/**\n * Sort graph in topological order with alphabetical sorting within layers\n * Returns enhanced format with level metadata\n *\n * @param graph - Unsorted dependency graph { project: [deps] }\n * @returns Sorted graph with level metadata { project: { level: number, dependsOn: [deps] } }\n */\nexport function sortGraphTopologically(graph: Record<string, string[]>): EnhancedGraph {\n    const layers = computeTopologicalLayers(graph);\n    const result: EnhancedGraph = {};\n\n    // Add projects layer by layer (dependencies before dependents)\n    layers.forEach((layer, levelIndex) => {\n        for (const project of layer) {\n            // Already sorted alphabetically within layer\n            result[project] = {\n                level: levelIndex,\n                dependsOn: (graph[project] || []).sort(),\n            };\n        }\n    });\n\n    return result;\n}\n"]}

package/src/lib/product-dependencies.d.ts

@@ -16,9 +16,11 @@
  *    only on itself; `[]` as the whole field means no product depends on another.
  *  - An edge A -> B of the DEPENDENCY graph is legal when, for EVERY product p of A, B carries p or a
  *    product p's entry allows. A multi-product B satisfies p when ANY of its products is allowed.
- *  - The check reads the RESOLVED membership (`products` in dependencies.json): a project's own tags
- *    are final, an untagged project inherits from the tagged projects that reach it. A project in no
- *    product constrains nothing.
+ *  - The check reads `products` in dependencies.json, which is exactly each project's declared tags
+ *    (#1216). An edge with an UNTAGGED end is skipped: an untagged project is in no product and
+ *    constrains nothing. So an untagged library is a hole in the check (example app -> untagged lib
+ *    -> platform lib is never judged); a consumer closes it by listing its library roles in
+ *    `product-tags.roles`, which makes every such project carry a tag.
  *  - An entry `name`, or an `allowedToDependOn` value, that no `product:` tag uses fails naming it, and
  *    so does a duplicate `name`: a typo must never silently allow or forbid nothing.
  *

package/src/lib/product-dependencies.js

@@ -17,9 +17,11 @@
  *    only on itself; `[]` as the whole field means no product depends on another.
  *  - An edge A -> B of the DEPENDENCY graph is legal when, for EVERY product p of A, B carries p or a
  *    product p's entry allows. A multi-product B satisfies p when ANY of its products is allowed.
- *  - The check reads the RESOLVED membership (`products` in dependencies.json): a project's own tags
- *    are final, an untagged project inherits from the tagged projects that reach it. A project in no
- *    product constrains nothing.
+ *  - The check reads `products` in dependencies.json, which is exactly each project's declared tags
+ *    (#1216). An edge with an UNTAGGED end is skipped: an untagged project is in no product and
+ *    constrains nothing. So an untagged library is a hole in the check (example app -> untagged lib
+ *    -> platform lib is never judged); a consumer closes it by listing its library roles in
+ *    `product-tags.roles`, which makes every such project carry a tag.
  *  - An entry `name`, or an `allowedToDependOn` value, that no `product:` tag uses fails naming it, and
  *    so does a duplicate `name`: a typo must never silently allow or forbid nothing.
  *
@@ -89,8 +91,7 @@ class ProductDependencyMatrix {
                 continue;
             for (const dep of [...(graph[name].dependsOn ?? [])].sort()) {
                 const to = graph[dep]?.products ?? [];
-                // Membership is inherited down every edge, so a product's dependency always carries a
-                // product; a target with none is outside the graph and constrains nothing.
+                // #1216: an untagged target is in no product and constrains nothing — see the header.
                 if (to.length === 0)
                     continue;
                 for (const product of from) {

package/src/lib/product-dependencies.js.map

@@ -1 +1 @@
-{"version":3,"file":"product-dependencies.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/lib/product-dependencies.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAKH,MAAM,IAAI,GAAG,cAAc,CAAC;AAC5B,MAAM,KAAK,GAAG,GAAG,IAAI,sBAAsB,CAAC;AAE5C,MAAa,uBAAuB;IAIJ;IAH5B,gEAAgE;IAC/C,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE1D,YAA4B,OAA0C;QAA1C,YAAO,GAAP,OAAO,CAAmC;QAClE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1E,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB;gBAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;IAED,uFAAuF;IACvF,UAAU,CAAC,OAAe;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,KAAoB,EAAE,QAA6B;QACxD,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,4FAA4F;IAC5F,cAAc,CAAC,QAA6B;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACT,GAAG,KAAK,cAAc,KAAK,CAAC,IAAI,0CAA0C;oBACtE,cAAc,KAAK,CAAC,IAAI,kEAAkE,CACjG,CAAC;YACN,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CACT,GAAG,KAAK,oBAAoB,KAAK,CAAC,IAAI,+CAA+C,SAAS,MAAM;oBAChG,oCAAoC,CAC3C,CAAC;YACN,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAClC,QAAQ,CAAC,IAAI,CACT,GAAG,KAAK,MAAM,KAAK,CAAC,IAAI,wBAAwB,KAAK,mCAAmC;oBACpF,qBAAqB,SAAS,+CAA+C,CACpF,CAAC;YACN,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,+GAA+G;IAC/G,YAAY,CAAC,KAAoB;QAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;gBACtC,sFAAsF;gBACtF,2EAA2E;gBAC3E,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;oBACzB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;wBAAE,SAAS;oBAC1C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;gBAChE,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,gFAAgF;IACxE,SAAS,CAAC,OAAe,EAAE,EAAqB;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,SAAS,CAAC,IAAY,EAAE,IAAuB,EAAE,GAAW,EAAE,EAAqB,EAAE,OAAe;QACxG,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,CACH,GAAG,IAAI,MAAM,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC;YAC9G,IAAI,OAAO,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;YACxG,iCAAiC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,yDAAyD,CACnH,CAAC;IACN,CAAC;IAED,uGAAuG;IAC/F,IAAI,CAAC,EAAqB,EAAE,OAAe;QAC/C,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAA4B,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAClG,MAAM,IAAI,GACN,KAAK,KAAK,SAAS;YACf,CAAC,CAAC,kBAAkB,OAAO,6BAA6B,IAAI,WAAW,KAAK,EAAE;YAC9E,CAAC,CAAC,QAAQ,IAAI,aAAa,OAAO,kCAAkC,KAAK,EAAE,CAAC;QACpF,OAAO,IAAI,GAAG,KAAK,CAAC;IACxB,CAAC;CACJ;AAvGD,0DAuGC","sourcesContent":["/**\n * The product dependency matrix (#1204): which products may depend on which.\n *\n * Product membership (graph-products.ts) says which product OWNS each box; this says which products\n * may DEPEND on which, so a platform library quietly importing example code is a generation failure\n * instead of one more edge on the graph. It is the second half of the `product-tags` rule — one switch\n * turns the tags requirement and this matrix on and off together.\n *\n *   \"productDependencies\": [\n *     { \"name\": \"example\", \"allowedToDependOn\": [\"platform\", \"openapi\"] },\n *     { \"name\": \"openapi\", \"allowedToDependOn\": [\"platform\"] }\n *   ]\n *\n * Semantics:\n *  - A product may always depend on itself (implied, never listed). A product with no entry may depend\n *    only on itself; `[]` as the whole field means no product depends on another.\n *  - An edge A -> B of the DEPENDENCY graph is legal when, for EVERY product p of A, B carries p or a\n *    product p's entry allows. A multi-product B satisfies p when ANY of its products is allowed.\n *  - The check reads the RESOLVED membership (`products` in dependencies.json): a project's own tags\n *    are final, an untagged project inherits from the tagged projects that reach it. A project in no\n *    product constrains nothing.\n *  - An entry `name`, or an `allowedToDependOn` value, that no `product:` tag uses fails naming it, and\n *    so does a duplicate `name`: a typo must never silently allow or forbid nothing.\n *\n * The runtime graph (HTTP / queue calls between products' services) is deliberately NOT checked:\n * RuntimeProductMembership shows a cross-product call as coupling for a reviewer to see.\n */\n\nimport type { EnhancedGraph } from './graph-sorter';\nimport { ProductDependencyEntry } from '../configs/tag-truth-configs';\n\nconst RULE = 'product-tags';\nconst FIELD = `${RULE}.productDependencies`;\n\nexport class ProductDependencyMatrix {\n    /** product → the products it may depend on, itself included. */\n    private readonly allowed = new Map<string, Set<string>>();\n\n    constructor(public readonly entries: readonly ProductDependencyEntry[]) {\n        for (const entry of entries) {\n            const set = this.allowed.get(entry.name) ?? new Set<string>([entry.name]);\n            for (const other of entry.allowedToDependOn) set.add(other);\n            this.allowed.set(entry.name, set);\n        }\n    }\n\n    /** The products a project of `product` may depend on: itself plus its entry's list. */\n    allowedFor(product: string): Set<string> {\n        return this.allowed.get(product) ?? new Set<string>([product]);\n    }\n\n    /**\n     * Every problem: the matrix's own (unknown names, duplicates), then every illegal edge.\n     *\n     * @param declared every product some project's `product:` tag names\n     */\n    problems(graph: EnhancedGraph, declared: ReadonlySet<string>): string[] {\n        return [...this.configProblems(declared), ...this.edgeProblems(graph)];\n    }\n\n    /** A `name` or `allowedToDependOn` value no `product:` tag uses, and a duplicate `name`. */\n    configProblems(declared: ReadonlySet<string>): string[] {\n        const problems: string[] = [];\n        const known = [...declared].sort();\n        const knownText = known.length === 0 ? 'none — no project carries a product: tag' : known.join(', ');\n        const seen = new Set<string>();\n        for (const entry of this.entries) {\n            if (seen.has(entry.name)) {\n                problems.push(\n                    `${FIELD}: product '${entry.name}' has two entries — merge them into one ` +\n                        `{ \"name\": \"${entry.name}\", \"allowedToDependOn\": [...] } so its allowance is stated once.`,\n                );\n            }\n            seen.add(entry.name);\n            if (!declared.has(entry.name)) {\n                problems.push(\n                    `${FIELD}: entry \"name\": \"${entry.name}\" matches no product: tag (products in use: ${knownText}) — ` +\n                        'fix the typo, or delete the entry.',\n                );\n            }\n            for (const other of entry.allowedToDependOn) {\n                if (declared.has(other)) continue;\n                problems.push(\n                    `${FIELD}: \"${entry.name}\" allowedToDependOn \"${other}\", which matches no product: tag ` +\n                        `(products in use: ${knownText}) — fix the typo, or remove it from the list.`,\n                );\n            }\n        }\n        return problems;\n    }\n\n    /** Every dependency edge, once per product of its source that none of its target's products is allowed for. */\n    edgeProblems(graph: EnhancedGraph): string[] {\n        const problems: string[] = [];\n        for (const name of Object.keys(graph).sort()) {\n            const from = graph[name].products ?? [];\n            if (from.length === 0) continue;\n            for (const dep of [...(graph[name].dependsOn ?? [])].sort()) {\n                const to = graph[dep]?.products ?? [];\n                // Membership is inherited down every edge, so a product's dependency always carries a\n                // product; a target with none is outside the graph and constrains nothing.\n                if (to.length === 0) continue;\n                for (const product of from) {\n                    if (this.satisfies(product, to)) continue;\n                    problems.push(this.violation(name, from, dep, to, product));\n                }\n            }\n        }\n        return problems;\n    }\n\n    /** True when `to` carries `product` or some product `product` may depend on. */\n    private satisfies(product: string, to: readonly string[]): boolean {\n        const allowed = this.allowedFor(product);\n        return to.some((other: string): boolean => allowed.has(other));\n    }\n\n    private violation(name: string, from: readonly string[], dep: string, to: readonly string[], product: string): string {\n        const allowed = [...this.allowedFor(product)].sort();\n        return (\n            `${RULE}: '${name}' [${from.join(', ')}] -> '${dep}' [${to.join(', ')}] crosses a product boundary — product ` +\n            `'${product}' may depend only on [${allowed.join(', ')}]. Either move the code so the dependency stays ` +\n            `inside an allowed product, or ${this.cure(to, product)} in webpieces.config.json (a reviewed one-line change).`\n        );\n    }\n\n    /** The config edit that would allow the edge: one of the target's products, any of which is enough. */\n    private cure(to: readonly string[], product: string): string {\n        const pick = to[0];\n        const anyOf = to.length > 1 ? ` (any one of [${to.join(', ')}] is enough)` : '';\n        const entry = this.entries.find((each: ProductDependencyEntry): boolean => each.name === product);\n        const edit =\n            entry === undefined\n                ? `add { \"name\": \"${product}\", \"allowedToDependOn\": [\"${pick}\"] } to ${FIELD}`\n                : `add \"${pick}\" to the \"${product}\" entry's allowedToDependOn in ${FIELD}`;\n        return edit + anyOf;\n    }\n}\n"]}
+{"version":3,"file":"product-dependencies.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/lib/product-dependencies.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAKH,MAAM,IAAI,GAAG,cAAc,CAAC;AAC5B,MAAM,KAAK,GAAG,GAAG,IAAI,sBAAsB,CAAC;AAE5C,MAAa,uBAAuB;IAIJ;IAH5B,gEAAgE;IAC/C,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE1D,YAA4B,OAA0C;QAA1C,YAAO,GAAP,OAAO,CAAmC;QAClE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1E,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB;gBAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;IAED,uFAAuF;IACvF,UAAU,CAAC,OAAe;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,KAAoB,EAAE,QAA6B;QACxD,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,4FAA4F;IAC5F,cAAc,CAAC,QAA6B;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACT,GAAG,KAAK,cAAc,KAAK,CAAC,IAAI,0CAA0C;oBACtE,cAAc,KAAK,CAAC,IAAI,kEAAkE,CACjG,CAAC;YACN,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CACT,GAAG,KAAK,oBAAoB,KAAK,CAAC,IAAI,+CAA+C,SAAS,MAAM;oBAChG,oCAAoC,CAC3C,CAAC;YACN,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAClC,QAAQ,CAAC,IAAI,CACT,GAAG,KAAK,MAAM,KAAK,CAAC,IAAI,wBAAwB,KAAK,mCAAmC;oBACpF,qBAAqB,SAAS,+CAA+C,CACpF,CAAC;YACN,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,+GAA+G;IAC/G,YAAY,CAAC,KAAoB;QAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;gBACtC,sFAAsF;gBACtF,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;oBACzB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;wBAAE,SAAS;oBAC1C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;gBAChE,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,gFAAgF;IACxE,SAAS,CAAC,OAAe,EAAE,EAAqB;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,SAAS,CAAC,IAAY,EAAE,IAAuB,EAAE,GAAW,EAAE,EAAqB,EAAE,OAAe;QACxG,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,CACH,GAAG,IAAI,MAAM,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC;YAC9G,IAAI,OAAO,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;YACxG,iCAAiC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,yDAAyD,CACnH,CAAC;IACN,CAAC;IAED,uGAAuG;IAC/F,IAAI,CAAC,EAAqB,EAAE,OAAe;QAC/C,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAA4B,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAClG,MAAM,IAAI,GACN,KAAK,KAAK,SAAS;YACf,CAAC,CAAC,kBAAkB,OAAO,6BAA6B,IAAI,WAAW,KAAK,EAAE;YAC9E,CAAC,CAAC,QAAQ,IAAI,aAAa,OAAO,kCAAkC,KAAK,EAAE,CAAC;QACpF,OAAO,IAAI,GAAG,KAAK,CAAC;IACxB,CAAC;CACJ;AAtGD,0DAsGC","sourcesContent":["/**\n * The product dependency matrix (#1204): which products may depend on which.\n *\n * Product membership (graph-products.ts) says which product OWNS each box; this says which products\n * may DEPEND on which, so a platform library quietly importing example code is a generation failure\n * instead of one more edge on the graph. It is the second half of the `product-tags` rule — one switch\n * turns the tags requirement and this matrix on and off together.\n *\n *   \"productDependencies\": [\n *     { \"name\": \"example\", \"allowedToDependOn\": [\"platform\", \"openapi\"] },\n *     { \"name\": \"openapi\", \"allowedToDependOn\": [\"platform\"] }\n *   ]\n *\n * Semantics:\n *  - A product may always depend on itself (implied, never listed). A product with no entry may depend\n *    only on itself; `[]` as the whole field means no product depends on another.\n *  - An edge A -> B of the DEPENDENCY graph is legal when, for EVERY product p of A, B carries p or a\n *    product p's entry allows. A multi-product B satisfies p when ANY of its products is allowed.\n *  - The check reads `products` in dependencies.json, which is exactly each project's declared tags\n *    (#1216). An edge with an UNTAGGED end is skipped: an untagged project is in no product and\n *    constrains nothing. So an untagged library is a hole in the check (example app -> untagged lib\n *    -> platform lib is never judged); a consumer closes it by listing its library roles in\n *    `product-tags.roles`, which makes every such project carry a tag.\n *  - An entry `name`, or an `allowedToDependOn` value, that no `product:` tag uses fails naming it, and\n *    so does a duplicate `name`: a typo must never silently allow or forbid nothing.\n *\n * The runtime graph (HTTP / queue calls between products' services) is deliberately NOT checked:\n * RuntimeProductMembership shows a cross-product call as coupling for a reviewer to see.\n */\n\nimport type { EnhancedGraph } from './graph-sorter';\nimport { ProductDependencyEntry } from '../configs/tag-truth-configs';\n\nconst RULE = 'product-tags';\nconst FIELD = `${RULE}.productDependencies`;\n\nexport class ProductDependencyMatrix {\n    /** product → the products it may depend on, itself included. */\n    private readonly allowed = new Map<string, Set<string>>();\n\n    constructor(public readonly entries: readonly ProductDependencyEntry[]) {\n        for (const entry of entries) {\n            const set = this.allowed.get(entry.name) ?? new Set<string>([entry.name]);\n            for (const other of entry.allowedToDependOn) set.add(other);\n            this.allowed.set(entry.name, set);\n        }\n    }\n\n    /** The products a project of `product` may depend on: itself plus its entry's list. */\n    allowedFor(product: string): Set<string> {\n        return this.allowed.get(product) ?? new Set<string>([product]);\n    }\n\n    /**\n     * Every problem: the matrix's own (unknown names, duplicates), then every illegal edge.\n     *\n     * @param declared every product some project's `product:` tag names\n     */\n    problems(graph: EnhancedGraph, declared: ReadonlySet<string>): string[] {\n        return [...this.configProblems(declared), ...this.edgeProblems(graph)];\n    }\n\n    /** A `name` or `allowedToDependOn` value no `product:` tag uses, and a duplicate `name`. */\n    configProblems(declared: ReadonlySet<string>): string[] {\n        const problems: string[] = [];\n        const known = [...declared].sort();\n        const knownText = known.length === 0 ? 'none — no project carries a product: tag' : known.join(', ');\n        const seen = new Set<string>();\n        for (const entry of this.entries) {\n            if (seen.has(entry.name)) {\n                problems.push(\n                    `${FIELD}: product '${entry.name}' has two entries — merge them into one ` +\n                        `{ \"name\": \"${entry.name}\", \"allowedToDependOn\": [...] } so its allowance is stated once.`,\n                );\n            }\n            seen.add(entry.name);\n            if (!declared.has(entry.name)) {\n                problems.push(\n                    `${FIELD}: entry \"name\": \"${entry.name}\" matches no product: tag (products in use: ${knownText}) — ` +\n                        'fix the typo, or delete the entry.',\n                );\n            }\n            for (const other of entry.allowedToDependOn) {\n                if (declared.has(other)) continue;\n                problems.push(\n                    `${FIELD}: \"${entry.name}\" allowedToDependOn \"${other}\", which matches no product: tag ` +\n                        `(products in use: ${knownText}) — fix the typo, or remove it from the list.`,\n                );\n            }\n        }\n        return problems;\n    }\n\n    /** Every dependency edge, once per product of its source that none of its target's products is allowed for. */\n    edgeProblems(graph: EnhancedGraph): string[] {\n        const problems: string[] = [];\n        for (const name of Object.keys(graph).sort()) {\n            const from = graph[name].products ?? [];\n            if (from.length === 0) continue;\n            for (const dep of [...(graph[name].dependsOn ?? [])].sort()) {\n                const to = graph[dep]?.products ?? [];\n                // #1216: an untagged target is in no product and constrains nothing — see the header.\n                if (to.length === 0) continue;\n                for (const product of from) {\n                    if (this.satisfies(product, to)) continue;\n                    problems.push(this.violation(name, from, dep, to, product));\n                }\n            }\n        }\n        return problems;\n    }\n\n    /** True when `to` carries `product` or some product `product` may depend on. */\n    private satisfies(product: string, to: readonly string[]): boolean {\n        const allowed = this.allowedFor(product);\n        return to.some((other: string): boolean => allowed.has(other));\n    }\n\n    private violation(name: string, from: readonly string[], dep: string, to: readonly string[], product: string): string {\n        const allowed = [...this.allowedFor(product)].sort();\n        return (\n            `${RULE}: '${name}' [${from.join(', ')}] -> '${dep}' [${to.join(', ')}] crosses a product boundary — product ` +\n            `'${product}' may depend only on [${allowed.join(', ')}]. Either move the code so the dependency stays ` +\n            `inside an allowed product, or ${this.cure(to, product)} in webpieces.config.json (a reviewed one-line change).`\n        );\n    }\n\n    /** The config edit that would allow the edge: one of the target's products, any of which is enough. */\n    private cure(to: readonly string[], product: string): string {\n        const pick = to[0];\n        const anyOf = to.length > 1 ? ` (any one of [${to.join(', ')}] is enough)` : '';\n        const entry = this.entries.find((each: ProductDependencyEntry): boolean => each.name === product);\n        const edit =\n            entry === undefined\n                ? `add { \"name\": \"${product}\", \"allowedToDependOn\": [\"${pick}\"] } to ${FIELD}`\n                : `add \"${pick}\" to the \"${product}\" entry's allowedToDependOn in ${FIELD}`;\n        return edit + anyOf;\n    }\n}\n"]}

package/src/lib/product-resolver.d.ts

@@ -5,12 +5,11 @@
  *
  *   "tags": ["framework:angular", "role:client", "product:lang"]
  *
- * A monorepo holding several products tags each product's ENTRY POINTS (servers, clients, apps —
- * the `product-tags` rule makes that required) and the architecture graphs derive the rest: an
- * UNTAGGED library belongs to every product whose tagged project reaches it (graph-products.ts).
- * A library MAY carry its own tag — a published library whose entry points live in other repos, which
- * no in-repo walk can reach correctly — and a project's declared tags are FINAL (#1201): a tagged
- * project keeps exactly its declared set, and no other product's walk paints it or passes through it.
+ * Membership on both architecture graphs is TAGS ONLY (#1216, graph-products.ts): a project belongs
+ * to exactly the products it declares here, and an UNTAGGED project is in no product — it renders as
+ * "no product", a box that still needs a tag. Nothing is inherited over a dependency or a runtime call.
+ * The `product-tags` rule requires a tag on every project whose role it lists; a consumer that wants
+ * every project assigned lists its library roles there too.
  *
  * Several tags are allowed (`product:bugfixer` + `product:helper`). Each name must be lowercase
  * kebab (`lang`, `job-finder`); a malformed tag (`product:`, `product:Lang`) is a problem that fails

package/src/lib/product-resolver.js

@@ -6,12 +6,11 @@
  *
  *   "tags": ["framework:angular", "role:client", "product:lang"]
  *
- * A monorepo holding several products tags each product's ENTRY POINTS (servers, clients, apps —
- * the `product-tags` rule makes that required) and the architecture graphs derive the rest: an
- * UNTAGGED library belongs to every product whose tagged project reaches it (graph-products.ts).
- * A library MAY carry its own tag — a published library whose entry points live in other repos, which
- * no in-repo walk can reach correctly — and a project's declared tags are FINAL (#1201): a tagged
- * project keeps exactly its declared set, and no other product's walk paints it or passes through it.
+ * Membership on both architecture graphs is TAGS ONLY (#1216, graph-products.ts): a project belongs
+ * to exactly the products it declares here, and an UNTAGGED project is in no product — it renders as
+ * "no product", a box that still needs a tag. Nothing is inherited over a dependency or a runtime call.
+ * The `product-tags` rule requires a tag on every project whose role it lists; a consumer that wants
+ * every project assigned lists its library roles there too.
  *
  * Several tags are allowed (`product:bugfixer` + `product:helper`). Each name must be lowercase
  * kebab (`lang`, `job-finder`); a malformed tag (`product:`, `product:Lang`) is a problem that fails

package/src/lib/product-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"product-resolver.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/lib/product-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAIU,QAAA,kBAAkB,GAAG,UAAU,CAAC;AAE7C,kGAAkG;AAClG,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAEhD,MAAa,iBAAiB;IAGN;IAEA;IAJpB;IACI,kGAAkG;IAClF,QAAkB;IAClC,2FAA2F;IAC3E,QAAkB;QAFlB,aAAQ,GAAR,QAAQ,CAAU;QAElB,aAAQ,GAAR,QAAQ,CAAU;IACnC,CAAC;CACP;AAPD,8CAOC;AAED,MAAa,eAAe;IACxB,2DAA2D;IAC3D,OAAO,CAAC,IAAiB;QACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAAkB,CAAC;gBAAE,SAAS;YAClD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,0BAAkB,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACb,CAAC;YACD,QAAQ,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,IAAI,kBAAkB,GAAG,+DAA+D;gBAC5F,mDAAmD,CAC1D,CAAC;QACN,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IAED,WAAW,CAAC,IAAY;QACpB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;CACJ;AAvBD,0CAuBC","sourcesContent":["/**\n * Product Resolver (#1179)\n *\n * Reads the products a project DECLARES with the nx tag `product:<name>` on its project.json:\n *\n *   \"tags\": [\"framework:angular\", \"role:client\", \"product:lang\"]\n *\n * A monorepo holding several products tags each product's ENTRY POINTS (servers, clients, apps —\n * the `product-tags` rule makes that required) and the architecture graphs derive the rest: an\n * UNTAGGED library belongs to every product whose tagged project reaches it (graph-products.ts).\n * A library MAY carry its own tag — a published library whose entry points live in other repos, which\n * no in-repo walk can reach correctly — and a project's declared tags are FINAL (#1201): a tagged\n * project keeps exactly its declared set, and no other product's walk paints it or passes through it.\n *\n * Several tags are allowed (`product:bugfixer` + `product:helper`). Each name must be lowercase\n * kebab (`lang`, `job-finder`); a malformed tag (`product:`, `product:Lang`) is a problem that fails\n * generation with the project named — the same way two `role:` tags do (role-resolver.ts).\n *\n * Why a tag and not a config key: it moves with the project, nx understands it for free\n * (`nx show projects --projects tag:product:lang`), and a tag an older plugin does not know is ignored,\n * so a consumer can tag BEFORE the release that reads the tags ships.\n */\n\nimport { ProjectInfo } from './project-info';\n\nexport const PRODUCT_TAG_PREFIX = 'product:';\n\n/** Lowercase kebab: letters and digits, single dashes between words, no leading/trailing dash. */\nconst PRODUCT_NAME = /^[a-z0-9]+(-[a-z0-9]+)*$/;\n\nexport class ProductResolution {\n    constructor(\n        /** The declared product names, sorted and de-duplicated; empty when the project declares none. */\n        public readonly products: string[],\n        /** One line per malformed tag, naming the project; empty when every tag is well formed. */\n        public readonly problems: string[],\n    ) {}\n}\n\nexport class ProductResolver {\n    /** Every `product:` tag the project carries, validated. */\n    resolve(info: ProjectInfo): ProductResolution {\n        const products = new Set<string>();\n        const problems: string[] = [];\n        for (const tag of info.tags) {\n            if (!tag.startsWith(PRODUCT_TAG_PREFIX)) continue;\n            const name = tag.slice(PRODUCT_TAG_PREFIX.length);\n            if (this.isValidName(name)) {\n                products.add(name);\n                continue;\n            }\n            problems.push(\n                `${info.name}: product tag '${tag}' is malformed — the name after 'product:' must be lowercase ` +\n                    `kebab (e.g. 'product:lang', 'product:job-finder')`,\n            );\n        }\n        return new ProductResolution([...products].sort(), problems);\n    }\n\n    isValidName(name: string): boolean {\n        return PRODUCT_NAME.test(name);\n    }\n}\n"]}
+{"version":3,"file":"product-resolver.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/lib/product-resolver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AAIU,QAAA,kBAAkB,GAAG,UAAU,CAAC;AAE7C,kGAAkG;AAClG,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAEhD,MAAa,iBAAiB;IAGN;IAEA;IAJpB;IACI,kGAAkG;IAClF,QAAkB;IAClC,2FAA2F;IAC3E,QAAkB;QAFlB,aAAQ,GAAR,QAAQ,CAAU;QAElB,aAAQ,GAAR,QAAQ,CAAU;IACnC,CAAC;CACP;AAPD,8CAOC;AAED,MAAa,eAAe;IACxB,2DAA2D;IAC3D,OAAO,CAAC,IAAiB;QACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,0BAAkB,CAAC;gBAAE,SAAS;YAClD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,0BAAkB,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnB,SAAS;YACb,CAAC;YACD,QAAQ,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,IAAI,kBAAkB,GAAG,+DAA+D;gBAC5F,mDAAmD,CAC1D,CAAC;QACN,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IAED,WAAW,CAAC,IAAY;QACpB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;CACJ;AAvBD,0CAuBC","sourcesContent":["/**\n * Product Resolver (#1179)\n *\n * Reads the products a project DECLARES with the nx tag `product:<name>` on its project.json:\n *\n *   \"tags\": [\"framework:angular\", \"role:client\", \"product:lang\"]\n *\n * Membership on both architecture graphs is TAGS ONLY (#1216, graph-products.ts): a project belongs\n * to exactly the products it declares here, and an UNTAGGED project is in no product — it renders as\n * \"no product\", a box that still needs a tag. Nothing is inherited over a dependency or a runtime call.\n * The `product-tags` rule requires a tag on every project whose role it lists; a consumer that wants\n * every project assigned lists its library roles there too.\n *\n * Several tags are allowed (`product:bugfixer` + `product:helper`). Each name must be lowercase\n * kebab (`lang`, `job-finder`); a malformed tag (`product:`, `product:Lang`) is a problem that fails\n * generation with the project named — the same way two `role:` tags do (role-resolver.ts).\n *\n * Why a tag and not a config key: it moves with the project, nx understands it for free\n * (`nx show projects --projects tag:product:lang`), and a tag an older plugin does not know is ignored,\n * so a consumer can tag BEFORE the release that reads the tags ships.\n */\n\nimport { ProjectInfo } from './project-info';\n\nexport const PRODUCT_TAG_PREFIX = 'product:';\n\n/** Lowercase kebab: letters and digits, single dashes between words, no leading/trailing dash. */\nconst PRODUCT_NAME = /^[a-z0-9]+(-[a-z0-9]+)*$/;\n\nexport class ProductResolution {\n    constructor(\n        /** The declared product names, sorted and de-duplicated; empty when the project declares none. */\n        public readonly products: string[],\n        /** One line per malformed tag, naming the project; empty when every tag is well formed. */\n        public readonly problems: string[],\n    ) {}\n}\n\nexport class ProductResolver {\n    /** Every `product:` tag the project carries, validated. */\n    resolve(info: ProjectInfo): ProductResolution {\n        const products = new Set<string>();\n        const problems: string[] = [];\n        for (const tag of info.tags) {\n            if (!tag.startsWith(PRODUCT_TAG_PREFIX)) continue;\n            const name = tag.slice(PRODUCT_TAG_PREFIX.length);\n            if (this.isValidName(name)) {\n                products.add(name);\n                continue;\n            }\n            problems.push(\n                `${info.name}: product tag '${tag}' is malformed — the name after 'product:' must be lowercase ` +\n                    `kebab (e.g. 'product:lang', 'product:job-finder')`,\n            );\n        }\n        return new ProductResolution([...products].sort(), problems);\n    }\n\n    isValidName(name: string): boolean {\n        return PRODUCT_NAME.test(name);\n    }\n}\n"]}

package/src/lib/runtime-graph-model.d.ts

@@ -54,12 +54,10 @@ export interface RuntimeService {
      */
     drawOnGraph?: boolean;
     /**
-     * The products this service belongs to (#1179), sorted. A service whose dependencies.json entry
-     * carries `products` keeps exactly those — they are final (#1201). A service with none gets every
-     * product whose service reaches it over RUNTIME `dependsOn` (through a queue to its consumers
-     * included) without passing through another service that carries products; a call into another
-     * product's service shows as the runtime edge, not as a product. Absent for a service in no
-     * product. See graph-products.ts.
+     * The products this service belongs to (#1179), sorted: exactly its project's declared
+     * `product:<name>` tags (#1216). Never derived from a runtime call or a queue; a call into another
+     * product's service shows as the runtime edge, not as a product. Absent for a service whose
+     * project is untagged. See graph-products.ts.
      */
     products?: string[];
 }

package/src/lib/runtime-graph-model.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-graph-model.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/lib/runtime-graph-model.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG","sourcesContent":["/**\n * Runtime Graph model\n *\n * The serialization DTOs for architecture/runtime-dependencies.json. Split out of runtime-graph.ts,\n * which owns the DERIVATION (and had grown past the file-size limit), so the committed data shape\n * can be read on its own — it is what every consumer of the file, and any future Terraform\n * cross-check, actually programs against.\n *\n * Interfaces rather than classes: these are parsed straight out of JSON with `JSON.parse`, so a\n * class would only ever be a shape assertion over a plain object, never a constructed instance.\n */\n\nimport type {\n    ApiRef,\n    ApiTransport,\n    ExternalSystemDeclaration,\n    ExternalSystemKind,\n} from './api-usage/api-relations';\n\nexport interface RuntimeService {\n    level: number;\n    /**\n     * The project's declared nx role — 'server' or 'client' (a library is never a node). Carried so\n     * the viz can LABEL the node with what it actually is: it used to infer the role from\n     * `implements.length > 0`, which labelled every relation-less server \"client\". Optional so a\n     * runtime-dependencies.json written before this field existed still parses and still renders\n     * exactly as it did (the visualizer falls back to the old inference).\n     */\n    role?: string;\n    /**\n     * The name clients address this service by (`new ClientConfig('helper-fsdb')`), declared in its\n     * project.json. Absent for a service nothing calls by name (e.g. a browser app).\n     */\n    serviceName?: string;\n    /**\n     * The service(s) this node's clients call when the call site carries no literal `ClientConfig`,\n     * declared in its project.json (metadata.webpieces.callsService). A single name, or an\n     * `{ apiClassName: serviceName }` map. Absent when the node declares no target. Mirrors\n     * GraphEntry.callsService; it is the CALLING-side counterpart of `serviceName`.\n     */\n    callsService?: string | Record<string, string>;\n    implements: string[];\n    /**\n     * apiClassName -> the LIBRARY project whose apiRelations declared that implements, for the apis\n     * this service serves through an embedded library rather than its own source (e.g. a shared\n     * route-registration lib). Answers \"who implements WarmupApi, and where did that come from?\",\n     * which previously required walking the dependsOn closure by hand.\n     */\n    implementsVia?: Record<string, string>;\n    uses: string[];\n    dependsOn: string[];\n    /** Reviewed binding provenance and runtime conditions, retained for compact detail views. */\n    wiringUses?: ApiRef[];\n    wiringImplements?: ApiRef[];\n    /**\n     * When false, this service is hidden from the rendered runtime graph (its\n     * node AND every edge touching it are omitted from the HTML/DOT). It stays\n     * in runtime-dependencies.json so the data view is complete. Absent means\n     * drawn (the default). Mirrors GraphEntry.drawOnGraph from the `drawOnGraph:`\n     * nx tag.\n     */\n    drawOnGraph?: boolean;\n    /**\n     * The products this service belongs to (#1179), sorted. A service whose dependencies.json entry\n     * carries `products` keeps exactly those — they are final (#1201). A service with none gets every\n     * product whose service reaches it over RUNTIME `dependsOn` (through a queue to its consumers\n     * included) without passing through another service that carries products; a call into another\n     * product's service shows as the runtime edge, not as a product. Absent for a service in no\n     * product. See graph-products.ts.\n     */\n    products?: string[];\n}\n\nexport interface RuntimeApi {\n    implementedBy: string[];\n    usedBy: string[];\n    /** Transport of this API — 'rpc' (direct call) or 'pubsub' (delivered through a queue). */\n    type?: ApiTransport;\n    /**\n     * The api-lib project that OWNS this contract. For a contract nothing in-repo implements, this\n     * is the external library the calls leave the repo through (`lib-firestore`, `lib-gmail`), which\n     * is what the runtime viz labels its terminal external nodes with.\n     */\n    owner?: string;\n    /**\n     * Set when the contract carries an `@externalSystem <kind> [label]` JSDoc tag — the vendor seam\n     * declaring WHAT it is a seam to, so the viz can draw firestore as a database rather than as the\n     * same grey box as every other external. Absent on everything else.\n     */\n    externalSystem?: ExternalSystemDeclaration;\n}\n\nexport interface RuntimeEdge {\n    from: string;\n    to: string;\n    via: string[];\n    /**\n     * Transport of this edge. 'rpc' → a direct call arrow. 'pubsub' → the producer enqueues and the\n     * consumer is delivered later, so the runtime viz draws it as producer → QUEUE → consumer.\n     * Edges are split by transport, so every edge is a single kind.\n     */\n    type?: ApiTransport;\n    /**\n     * `\"ApiClassName.methodName\"` — the queue this edge flows through. Present iff `type` is\n     * 'pubsub'. Queues are per METHOD, not per service pair, because that is the unit Cloud Tasks\n     * (and Terraform) actually create, so two services exchanging three queued methods are three\n     * queues rather than one arrow.\n     */\n    queue?: string;\n    /**\n     * True when the CALLING project carries a `cutLegacyCycle:<target>` nx tag naming this edge's\n     * target — an admission that this hop closes a REAL cycle that is being tolerated as legacy\n     * debt, not a claim that it is harmless. The edge is still drawn (dashed, labelled \"legacy\n     * cycle\"); it is only excluded from leveling and cycle detection. Absent on every other edge.\n     */\n    cutLegacyCycle?: boolean;\n}\n\n/**\n * One Cloud Tasks queue: the async seam between a producer and a consumer, at METHOD granularity.\n *\n * `producedBy` and `consumedBy` are deliberately not symmetric in confidence — see\n * {@link ApiRef.methodsInferred}. The consumer is derived from `addRoutes` plus the contract's\n * method table and is exact; the producer is attributed to every queued method of the contract it\n * built a client for, because which methods it enqueues is not statically recoverable.\n */\nexport interface RuntimeQueue {\n    api: string;\n    method: string;\n    /** `@Queue(...)` override, else `${Api}-${method}` — the name Terraform must match 1:1. */\n    queueName: string;\n    producedBy: string[];\n    consumedBy: string[];\n}\n\n/**\n * An endpoint driven by something that is NOT an in-repo caller — a clock or an outside system.\n * These never appear as runtime EDGES (there is no in-repo `from`), which is exactly why they were\n * invisible until now: a nightly sweep and a GCP push subscription are real runtime entry points\n * with real Terraform behind them, and the graph showed neither.\n */\nexport interface RuntimeTrigger {\n    /** 'cron' → a scheduler fires it; 'external' → a system outside this repo posts to it. */\n    kind: 'cron' | 'external';\n    api: string;\n    method: string;\n    /** The service that SERVES the endpoint (the arrow's head). */\n    service: string;\n    /** Present for 'cron': the Cloud Scheduler job / queue name Terraform must match. */\n    queueName?: string;\n    /**\n     * Present for 'external': WHO outside this repo posts to it, declared as\n     * `@Endpoint(POST, p, WRITE, EXTERNAL, { calledBy: 'twilio' })`.\n     *\n     * The SAME `(kind,label)` an OUTBOUND {@link RuntimeExternalSystem} carries, so an inbound\n     * `saas twilio` and an outbound `saas twilio` share a node identity and converge on ONE box —\n     * `label` is the identity here too, not display text.\n     *\n     * Optional only for graphs generated BEFORE the caller was required; generation now fails rather\n     * than emitting an `external` method without one.\n     */\n    caller?: ExternalSystemDeclaration;\n}\n\nexport interface RuntimeUnresolved {\n    service: string;\n    api: string;\n}\n\n/**\n * A system outside this repo that a service TALKS TO, drawn with a shape that says what it is\n * (a database as a cylinder, a bucket as a folder) instead of the one grey box every external\n * used to collapse into.\n *\n * Two declaration sites feed this, because the two real cases differ in whether a contract exists:\n *\n * - **Wrapped** — the repo has a vendor seam (`FirestoreAdminApi`), so the kind is declared with an\n *   `@externalSystem <kind> [label]` JSDoc tag on the contract. A decorator cannot go on a TS\n *   `interface`, and these seams are interfaces, so JSDoc is the only marker that fits in place.\n * - **Unwrapped** — the service opens the connection itself with no contract to mark (a `pg.Pool`,\n *   a TypeORM `DataSource`), so the declaration is an `external:<kind>:<identity>` nx tag on that\n *   project's project.json.\n *\n * `label` is the node IDENTITY, not just display text: two services declaring `postgres` converge on\n * ONE node with two arrows into it, rather than drawing a database each.\n */\nexport interface RuntimeExternalSystem {\n    kind: ExternalSystemKind;\n    /** Display name AND node identity — declarations sharing a label share a node. */\n    label: string;\n    /** Services with a direct arrow to it. No transitive fan-out: a tag speaks only for its project. */\n    usedBy: string[];\n    /** Contracts flowing over it. Empty for the unwrapped (tag-declared) case — there are none. */\n    apis: string[];\n}\n\n/**\n * One caller's calls into a {@link RuntimeRemoteService}, one entry per (caller, transport): `via`\n * lists the contracts it calls there.\n */\nexport interface RuntimeRemoteCall {\n    from: string;\n    via: string[];\n    type: ApiTransport;\n}\n\n/**\n * A service OUTSIDE this workspace (another repo, a VM, partner endpoints) declared in the reviewed\n * `remoteServices` table of dependencies.json (#1203). It is a SERVICE — it implements our contracts —\n * so it is drawn as a service node, distinct from a vendor external system. Render-only, like the\n * external systems: it is never leveled or cycle-checked, because its own calls are not in this repo.\n */\nexport interface RuntimeRemoteService {\n    /** Display text from the reviewed declaration; the key is the identity. */\n    label?: string;\n    /** The contracts it is declared to implement, as `Api (transport)`, in reviewed order. */\n    implements: string[];\n    /** Workspace services that target it, sorted by caller then transport. */\n    calledBy: RuntimeRemoteCall[];\n}\n\nexport interface RuntimeGraph {\n    services: Record<string, RuntimeService>;\n    apis: Record<string, RuntimeApi>;\n    runtimeEdges: RuntimeEdge[];\n    unresolvedUses: RuntimeUnresolved[];\n    /** `\"Api.method\"` -> the queue between its producers and its consumers. */\n    queues: Record<string, RuntimeQueue>;\n    /** Clock- and outside-driven entry points, sorted for determinism. */\n    triggers: RuntimeTrigger[];\n    /**\n     * Declared external systems, keyed by identity. Optional so every graph written before this\n     * existed still parses — an absent map means \"nothing declared\", which renders exactly as before.\n     */\n    externalSystems?: Record<string, RuntimeExternalSystem>;\n    /**\n     * Reviewed out-of-workspace services, keyed by service name (#1203). Absent when none are\n     * declared, so every graph written before this existed parses and renders exactly as before.\n     */\n    remoteServices?: Record<string, RuntimeRemoteService>;\n}\n"]}
+{"version":3,"file":"runtime-graph-model.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/lib/runtime-graph-model.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG","sourcesContent":["/**\n * Runtime Graph model\n *\n * The serialization DTOs for architecture/runtime-dependencies.json. Split out of runtime-graph.ts,\n * which owns the DERIVATION (and had grown past the file-size limit), so the committed data shape\n * can be read on its own — it is what every consumer of the file, and any future Terraform\n * cross-check, actually programs against.\n *\n * Interfaces rather than classes: these are parsed straight out of JSON with `JSON.parse`, so a\n * class would only ever be a shape assertion over a plain object, never a constructed instance.\n */\n\nimport type {\n    ApiRef,\n    ApiTransport,\n    ExternalSystemDeclaration,\n    ExternalSystemKind,\n} from './api-usage/api-relations';\n\nexport interface RuntimeService {\n    level: number;\n    /**\n     * The project's declared nx role — 'server' or 'client' (a library is never a node). Carried so\n     * the viz can LABEL the node with what it actually is: it used to infer the role from\n     * `implements.length > 0`, which labelled every relation-less server \"client\". Optional so a\n     * runtime-dependencies.json written before this field existed still parses and still renders\n     * exactly as it did (the visualizer falls back to the old inference).\n     */\n    role?: string;\n    /**\n     * The name clients address this service by (`new ClientConfig('helper-fsdb')`), declared in its\n     * project.json. Absent for a service nothing calls by name (e.g. a browser app).\n     */\n    serviceName?: string;\n    /**\n     * The service(s) this node's clients call when the call site carries no literal `ClientConfig`,\n     * declared in its project.json (metadata.webpieces.callsService). A single name, or an\n     * `{ apiClassName: serviceName }` map. Absent when the node declares no target. Mirrors\n     * GraphEntry.callsService; it is the CALLING-side counterpart of `serviceName`.\n     */\n    callsService?: string | Record<string, string>;\n    implements: string[];\n    /**\n     * apiClassName -> the LIBRARY project whose apiRelations declared that implements, for the apis\n     * this service serves through an embedded library rather than its own source (e.g. a shared\n     * route-registration lib). Answers \"who implements WarmupApi, and where did that come from?\",\n     * which previously required walking the dependsOn closure by hand.\n     */\n    implementsVia?: Record<string, string>;\n    uses: string[];\n    dependsOn: string[];\n    /** Reviewed binding provenance and runtime conditions, retained for compact detail views. */\n    wiringUses?: ApiRef[];\n    wiringImplements?: ApiRef[];\n    /**\n     * When false, this service is hidden from the rendered runtime graph (its\n     * node AND every edge touching it are omitted from the HTML/DOT). It stays\n     * in runtime-dependencies.json so the data view is complete. Absent means\n     * drawn (the default). Mirrors GraphEntry.drawOnGraph from the `drawOnGraph:`\n     * nx tag.\n     */\n    drawOnGraph?: boolean;\n    /**\n     * The products this service belongs to (#1179), sorted: exactly its project's declared\n     * `product:<name>` tags (#1216). Never derived from a runtime call or a queue; a call into another\n     * product's service shows as the runtime edge, not as a product. Absent for a service whose\n     * project is untagged. See graph-products.ts.\n     */\n    products?: string[];\n}\n\nexport interface RuntimeApi {\n    implementedBy: string[];\n    usedBy: string[];\n    /** Transport of this API — 'rpc' (direct call) or 'pubsub' (delivered through a queue). */\n    type?: ApiTransport;\n    /**\n     * The api-lib project that OWNS this contract. For a contract nothing in-repo implements, this\n     * is the external library the calls leave the repo through (`lib-firestore`, `lib-gmail`), which\n     * is what the runtime viz labels its terminal external nodes with.\n     */\n    owner?: string;\n    /**\n     * Set when the contract carries an `@externalSystem <kind> [label]` JSDoc tag — the vendor seam\n     * declaring WHAT it is a seam to, so the viz can draw firestore as a database rather than as the\n     * same grey box as every other external. Absent on everything else.\n     */\n    externalSystem?: ExternalSystemDeclaration;\n}\n\nexport interface RuntimeEdge {\n    from: string;\n    to: string;\n    via: string[];\n    /**\n     * Transport of this edge. 'rpc' → a direct call arrow. 'pubsub' → the producer enqueues and the\n     * consumer is delivered later, so the runtime viz draws it as producer → QUEUE → consumer.\n     * Edges are split by transport, so every edge is a single kind.\n     */\n    type?: ApiTransport;\n    /**\n     * `\"ApiClassName.methodName\"` — the queue this edge flows through. Present iff `type` is\n     * 'pubsub'. Queues are per METHOD, not per service pair, because that is the unit Cloud Tasks\n     * (and Terraform) actually create, so two services exchanging three queued methods are three\n     * queues rather than one arrow.\n     */\n    queue?: string;\n    /**\n     * True when the CALLING project carries a `cutLegacyCycle:<target>` nx tag naming this edge's\n     * target — an admission that this hop closes a REAL cycle that is being tolerated as legacy\n     * debt, not a claim that it is harmless. The edge is still drawn (dashed, labelled \"legacy\n     * cycle\"); it is only excluded from leveling and cycle detection. Absent on every other edge.\n     */\n    cutLegacyCycle?: boolean;\n}\n\n/**\n * One Cloud Tasks queue: the async seam between a producer and a consumer, at METHOD granularity.\n *\n * `producedBy` and `consumedBy` are deliberately not symmetric in confidence — see\n * {@link ApiRef.methodsInferred}. The consumer is derived from `addRoutes` plus the contract's\n * method table and is exact; the producer is attributed to every queued method of the contract it\n * built a client for, because which methods it enqueues is not statically recoverable.\n */\nexport interface RuntimeQueue {\n    api: string;\n    method: string;\n    /** `@Queue(...)` override, else `${Api}-${method}` — the name Terraform must match 1:1. */\n    queueName: string;\n    producedBy: string[];\n    consumedBy: string[];\n}\n\n/**\n * An endpoint driven by something that is NOT an in-repo caller — a clock or an outside system.\n * These never appear as runtime EDGES (there is no in-repo `from`), which is exactly why they were\n * invisible until now: a nightly sweep and a GCP push subscription are real runtime entry points\n * with real Terraform behind them, and the graph showed neither.\n */\nexport interface RuntimeTrigger {\n    /** 'cron' → a scheduler fires it; 'external' → a system outside this repo posts to it. */\n    kind: 'cron' | 'external';\n    api: string;\n    method: string;\n    /** The service that SERVES the endpoint (the arrow's head). */\n    service: string;\n    /** Present for 'cron': the Cloud Scheduler job / queue name Terraform must match. */\n    queueName?: string;\n    /**\n     * Present for 'external': WHO outside this repo posts to it, declared as\n     * `@Endpoint(POST, p, WRITE, EXTERNAL, { calledBy: 'twilio' })`.\n     *\n     * The SAME `(kind,label)` an OUTBOUND {@link RuntimeExternalSystem} carries, so an inbound\n     * `saas twilio` and an outbound `saas twilio` share a node identity and converge on ONE box —\n     * `label` is the identity here too, not display text.\n     *\n     * Optional only for graphs generated BEFORE the caller was required; generation now fails rather\n     * than emitting an `external` method without one.\n     */\n    caller?: ExternalSystemDeclaration;\n}\n\nexport interface RuntimeUnresolved {\n    service: string;\n    api: string;\n}\n\n/**\n * A system outside this repo that a service TALKS TO, drawn with a shape that says what it is\n * (a database as a cylinder, a bucket as a folder) instead of the one grey box every external\n * used to collapse into.\n *\n * Two declaration sites feed this, because the two real cases differ in whether a contract exists:\n *\n * - **Wrapped** — the repo has a vendor seam (`FirestoreAdminApi`), so the kind is declared with an\n *   `@externalSystem <kind> [label]` JSDoc tag on the contract. A decorator cannot go on a TS\n *   `interface`, and these seams are interfaces, so JSDoc is the only marker that fits in place.\n * - **Unwrapped** — the service opens the connection itself with no contract to mark (a `pg.Pool`,\n *   a TypeORM `DataSource`), so the declaration is an `external:<kind>:<identity>` nx tag on that\n *   project's project.json.\n *\n * `label` is the node IDENTITY, not just display text: two services declaring `postgres` converge on\n * ONE node with two arrows into it, rather than drawing a database each.\n */\nexport interface RuntimeExternalSystem {\n    kind: ExternalSystemKind;\n    /** Display name AND node identity — declarations sharing a label share a node. */\n    label: string;\n    /** Services with a direct arrow to it. No transitive fan-out: a tag speaks only for its project. */\n    usedBy: string[];\n    /** Contracts flowing over it. Empty for the unwrapped (tag-declared) case — there are none. */\n    apis: string[];\n}\n\n/**\n * One caller's calls into a {@link RuntimeRemoteService}, one entry per (caller, transport): `via`\n * lists the contracts it calls there.\n */\nexport interface RuntimeRemoteCall {\n    from: string;\n    via: string[];\n    type: ApiTransport;\n}\n\n/**\n * A service OUTSIDE this workspace (another repo, a VM, partner endpoints) declared in the reviewed\n * `remoteServices` table of dependencies.json (#1203). It is a SERVICE — it implements our contracts —\n * so it is drawn as a service node, distinct from a vendor external system. Render-only, like the\n * external systems: it is never leveled or cycle-checked, because its own calls are not in this repo.\n */\nexport interface RuntimeRemoteService {\n    /** Display text from the reviewed declaration; the key is the identity. */\n    label?: string;\n    /** The contracts it is declared to implement, as `Api (transport)`, in reviewed order. */\n    implements: string[];\n    /** Workspace services that target it, sorted by caller then transport. */\n    calledBy: RuntimeRemoteCall[];\n}\n\nexport interface RuntimeGraph {\n    services: Record<string, RuntimeService>;\n    apis: Record<string, RuntimeApi>;\n    runtimeEdges: RuntimeEdge[];\n    unresolvedUses: RuntimeUnresolved[];\n    /** `\"Api.method\"` -> the queue between its producers and its consumers. */\n    queues: Record<string, RuntimeQueue>;\n    /** Clock- and outside-driven entry points, sorted for determinism. */\n    triggers: RuntimeTrigger[];\n    /**\n     * Declared external systems, keyed by identity. Optional so every graph written before this\n     * existed still parses — an absent map means \"nothing declared\", which renders exactly as before.\n     */\n    externalSystems?: Record<string, RuntimeExternalSystem>;\n    /**\n     * Reviewed out-of-workspace services, keyed by service name (#1203). Absent when none are\n     * declared, so every graph written before this existed parses and renders exactly as before.\n     */\n    remoteServices?: Record<string, RuntimeRemoteService>;\n}\n"]}

package/src/lib/runtime-graph.js

@@ -179,7 +179,7 @@ class RuntimeGraphDeriver {
             queues: edgeResult.queues,
             triggers: this.buildTriggers(decls),
         };
-        // #1179: each product's services — its tagged ones plus everything they reach at runtime.
+        // #1179/#1216: each service's products are exactly its project's declared product tags.
         new graph_products_1.RuntimeProductMembership().apply(graph, this.projects);
         // A destination whose address arrives at RUNTIME is declared on its CONTRACT
         // (`@externalSystem runtime partner-webhooks`), so it needs no branch of its own here: it is

package/src/lib/runtime-graph.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-graph.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/lib/runtime-graph.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAsoBH,gDAMC;AASD,4DAcC;AAxpBD,6DAAwD;AACxD,+DAAqD;AAErD,mEAAmG;AACnG,mEAA6F;AAC7F,qDAA4D;AAC5D,iEAA6D;AA4B7D,iEAA0F;AAE1F,gGAAgG;AAChG,uDAM4B;AALxB,8HAAA,0BAA0B,OAAA;AAC1B,oHAAA,gBAAgB,OAAA;AAChB,0HAAA,sBAAsB,OAAA;AACtB,oHAAA,gBAAgB,OAAA;AAChB,yHAAA,qBAAqB,OAAA;AASzB;;;;GAIG;AACH,MAAa,kBAAkB;IAEP;IAEA;IAQA;IASA;IApBpB,YACoB,KAAmB;IACnC,6FAA6F;IAC7E,QAAkB;IAClC;;;;;;OAMG;IACa,WAAqB,EAAE;IACvC;;;;;;;OAOG;IACa,aAAuB,EAAE;QAnBzB,UAAK,GAAL,KAAK,CAAc;QAEnB,aAAQ,GAAR,QAAQ,CAAU;QAQlB,aAAQ,GAAR,QAAQ,CAAe;QASvB,eAAU,GAAV,UAAU,CAAe;IAC1C,CAAC;CACP;AAvBD,gDAuBC;AAED;;;;;;;;GAQG;AACH,MAAM,mBAAmB;IAsBA;IAEA;IAMA;IAKA;IAlCrB,8FAA8F;IAC7E,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvD,0FAA0F;IACzE,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,QAAQ,GAAa,EAAE,CAAC;IACxB,QAAQ,GAAa,EAAE,CAAC;IACzC,+FAA+F;IAC9E,UAAU,GAAa,EAAE,CAAC;IAC3C,mGAAmG;IAClF,WAAW,CAAsB;IAElD;;;;;;OAMG;IACc,YAAY,CAAU;IAEvC,YACqB,QAAuB;IACxC,mGAAmG;IAClF,cAA2B;IAC5C;;;;OAIG;IACc,eAA6B,EAAE;IAChD;;;OAGG;IACc,sBAA2C,EAAE;IAC9D,0FAA0F;IAC1F,iBAAiC,EAAE;QAflB,aAAQ,GAAR,QAAQ,CAAe;QAEvB,mBAAc,GAAd,cAAc,CAAa;QAM3B,iBAAY,GAAZ,YAAY,CAAmB;QAK/B,wBAAmB,GAAnB,mBAAmB,CAA0B;QAI9D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5C,CAAC,KAAiB,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAC9D,CAAC;QACF,yFAAyF;QACzF,4FAA4F;QAC5F,0FAA0F;QAC1F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClE,CAAC;QACD,0FAA0F;QAC1F,4FAA4F;QAC5F,2EAA2E;QAC3E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,GAAG,IAAI,0BAA0B,QAAQ,4CAA4C;oBACjF,GAAG,QAAQ,wDAAwD,CAC1E,CAAC;YACN,CAAC;QACL,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,0CAAmB,CACtC,cAAc,EACd,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAC3D,IAAI,CAAC,QAAQ,CAChB,CAAC;IACN,CAAC;IAED,QAAQ;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChD,kFAAkF;QAClF,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,GAAG,IAAA,qCAAc,EAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAC7E,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,OAAO,GAA+B,EAAE,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAChF,MAAM,KAAK,GAAiB;YACxB,QAAQ;YACR,IAAI,EAAE,OAAO;YACb,YAAY,EAAE,UAAU,CAAC,KAAK;YAC9B,cAAc,EAAE,UAAU,CAAC,UAAU;YACrC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;SACtC,CAAC;QACF,0FAA0F;QAC1F,IAAI,yCAAwB,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,6EAA6E;QAC7E,6FAA6F;QAC7F,2FAA2F;QAC3F,mFAAmF;QACnF,MAAM,OAAO,GAAG,IAAA,yCAAsB,EAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAC3E,IAAA,wCAAqB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,IAAI,kBAAkB,CACzB,KAAK,EACL,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,QAAQ,EACb,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAC9B,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,KAAiB;QACnC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;wBAAE,SAAS;oBACnE,MAAM,OAAO,GAAmB;wBAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,GAAG,EAAE,GAAG,CAAC,GAAG;wBACZ,MAAM,EAAE,MAAM,CAAC,IAAI;wBACnB,OAAO,EAAE,IAAI,CAAC,IAAI;qBACrB,CAAC;oBACF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;wBAAE,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;oBACjE,+EAA+E;oBAC/E,iFAAiF;oBACjF,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;wBACzD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAChB,CAAC,CAAiB,EAAE,CAAiB,EAAE,EAAE,CACrC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5B,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;YAChC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CACzC,CAAC;IACN,CAAC;IAED,mGAAmG;IAC3F,SAAS,CAAC,GAAW;QACzB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;;;OASG;IACK,YAAY;QAChB,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjC,MAAM,IAAI,GAAG,IAAI,kCAAY,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpE,oFAAoF;YACpF,qFAAqF;YACrF,yFAAyF;YACzF,uFAAuF;YACvF,0FAA0F;YAC1F,KAAK,CAAC,IAAI,CAAC;gBACP,IAAI;gBACJ,cAAc,EAAE,IAAA,oCAAY,EAAC,IAAA,2BAAW,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC9D,QAAQ,EAAE,IAAA,oCAAY,EAAC,IAAA,2BAAW,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAClD,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC5B,CAAC,CAAC;QACP,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,wFAAwF;IAChF,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QACvC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sBAAsB,CAAC,IAAc;QACzC,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,yFAAyF;QACzF,8FAA8F;QAC9F,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACK,yBAAyB,CAC7B,IAAY,EACZ,IAAkB,EAClB,OAAoB,EACpB,mBAA4B,IAAI;QAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,IAAI,gBAAgB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;oBAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACnC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;gBACrD,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;oBACtC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtB,CAAC;YACL,CAAC;QACL,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,+CAA+C;YAC/E,IAAI,CAAC,yBAAyB,CAC1B,GAAG,EACH,IAAI,EACJ,OAAO,EACP,gBAAgB,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,CACxD,CAAC;QACN,CAAC;IACL,CAAC;IAED,uDAAuD;IAC/C,SAAS,CAAC,KAAiB;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,IAAkB,EAAc,EAAE;YAC3D,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,KAAK,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBAChD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,KAAK,CAAC;QACjB,CAAC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,cAAc;gBACjC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAC7B,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,0FAA0F;IAClF,UAAU,CAAC,KAAiB,EAAE,IAA6B;QAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;QAChD,MAAM,UAAU,GAAwB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,wFAAwF;gBACxF,gEAAgE;gBAChE,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC7E,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;oBAAE,SAAS;gBAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,IAAI,EAAE,CAAC;gBAC5D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5B,iFAAiF;oBACjF,+EAA+E;oBAC/E,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;oBACtD,SAAS;gBACb,CAAC;gBACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;oBACjE,2EAA2E;oBAC3E,8EAA8E;oBAC9E,8DAA8D;oBAC9D,IAAI,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;wBAAE,SAAS;oBAC5D,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACxB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;wBAClE,SAAS;oBACb,CAAC;oBACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;oBACrD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpC,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO;YACH,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YACnC,UAAU,EAAE,IAAA,sCAAc,EAAC,UAAU,CAAC;YACtC,MAAM,EAAE,IAAA,oCAAY,EAAC,MAAM,CAAC;SAC/B,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CAClB,IAAY,EACZ,EAAU,EACV,GAAW,EACX,QAAkC,EAClC,MAAiC;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,UAAU,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YACrD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO;QACX,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,WAAW,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YACrD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAE5B,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtB,KAAK,GAAG;oBACJ,GAAG;oBACH,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,qEAAqE;oBACrE,mEAAmE;oBACnE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE;oBACtD,UAAU,EAAE,EAAE;oBACd,UAAU,EAAE,EAAE;iBACjB,CAAC;gBACF,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,YAAsB;QAChE,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC;QAClC,IAAI,OAAO,KAAK,SAAS;YACrB,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS;YACtB,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAEtF,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,IAAY,EAAE,GAAW;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;QACnD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CACtB,IAAY,EACZ,GAAW,EACX,YAAsB,EACtB,MAAc,EACd,MAAkC;QAElC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,mCAAmC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,MAAM,KAAK,cAAc;gBACrB,CAAC,CAAC,GAAG,IAAI,8CAA8C,MAAM,gCAAgC;oBACvF,gCAAgC,MAAM,oDAAoD;oBAC1F,oCAAoC,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI;gBAC3F,CAAC,CAAC,GAAG,IAAI,WAAW,GAAG,CAAC,GAAG,iBAAiB,MAAM,yCAAyC;oBACrF,GAAG,MAAM,2EAA2E;oBACpF,IAAI,MAAM,0EAA0E;oBACpF,uCAAuC,CACpD,CAAC;YACF,OAAO,YAAY,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GACL,MAAM,KAAK,cAAc;gBACrB,CAAC,CAAC,GAAG,IAAI,2BAA2B,MAAM,aAAa,IAAI,GAAG;gBAC9D,CAAC,CAAC,GAAG,IAAI,WAAW,GAAG,CAAC,GAAG,iBAAiB,MAAM,aAAa,IAAI,GAAG,CAAC;YAC/E,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,GAAG,GAAG,SAAS,IAAI,oBAAoB,GAAG,CAAC,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB;gBAC/F,gCAAgC,CACvC,CAAC;YACF,OAAO,YAAY,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,IAAY,EAAE,GAAW,EAAE,YAAsB;QACtE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,GAAG,IAAI,UAAU,GAAG,CAAC,GAAG,wCAAwC,YAAY,CAAC,MAAM,YAAY;gBAC3F,iBAAiB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD;gBAC5F,iDAAiD,GAAG,CAAC,GAAG,2DAA2D;gBACnH,0FAA0F;gBAC1F,+DAA+D,IAAI,kBAAkB,CAC5F,CAAC;QACN,CAAC;QACD,OAAO,YAAY,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,QAAkC;QACpD,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAgB;gBACtB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACd,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;gBACZ,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,CAAC,IAAI,EAAE;gBAC1C,IAAI,EAAE,KAAK,CAAC,CAAC,CAAiB;aACjC,CAAC;YACF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,IAAI,CACN,CAAC,CAAc,EAAE,CAAc,EAAE,EAAE,CAC/B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5B,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1C,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CACnD,CAAC;QACF,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,aAAa,CAAC,KAAiB,EAAE,KAAoB;QACzD,MAAM,QAAQ,GAAmC,EAAE,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,0FAA0F;YAC1F,0FAA0F;YAC1F,6DAA6D;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CACxB,IAAI,GAAG,CACH,KAAK;iBACA,MAAM,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;iBAChD,GAAG,CAAC,CAAC,CAAc,EAAE,EAAE,CACpB,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,CACpD,CACR,CACJ,CAAC,IAAI,EAAE,CAAC;YACT,sFAAsF;YACtF,iFAAiF;YACjF,MAAM,OAAO,GAAmB;gBAC5B,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6CAA6C;gBACnF,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW;gBAClD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY;gBACpD,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACzD,aAAa,EACT,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,oCAAY,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC9E,0EAA0E;gBAC1E,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClE,SAAS;gBACT,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;oBAClE,CAAC,CAAC,IAAI,CAAC,QAAQ;oBACf,CAAC,CAAC,SAAS;gBACf,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;oBAC9E,CAAC,CAAC,IAAI,CAAC,cAAc;oBACrB,CAAC,CAAC,SAAS;aAClB,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YAC9B,oFAAoF;YACpF,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC;YAChC,CAAC;iBAAM,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC;gBAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,mCAAY,EAAC,IAAA,yCAAkB,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ;AAED;;;;;GAKG;AACH,qGAAqG;AACrG,SAAgB,kBAAkB,CAC9B,QAAuB,EACvB,iBAA8B,IAAI,GAAG,EAAU,EAC/C,eAA6B,EAAE;IAE/B,OAAO,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,qGAAqG;AACrG,SAAgB,wBAAwB,CACpC,QAAuB,EACvB,iBAA8B,IAAI,GAAG,EAAU,EAC/C,eAA6B,EAAE,EAC/B,kBAAuC,EAAE,EACzC,iBAAiC,EAAE;IAEnC,OAAO,IAAI,mBAAmB,CAC1B,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,eAAe,EACf,cAAc,CACjB,CAAC,QAAQ,EAAE,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,qFAAqF;AACrF,+DAA0D;AAAjD,wHAAA,gBAAgB,OAAA","sourcesContent":["/**\n * Runtime Graph\n *\n * Derives the runtime microservice graph SOLELY from architecture/dependencies.json\n * (the single source of truth): each project's `apiRelations` carry which api\n * classes it implements/uses and their transport (rpc | pubsub). Both\n * `architecture:generate` and `architecture:validate-runtime-architecture` call\n * the SAME `deriveRuntimeGraph`, so the committed graph and the validated graph\n * can never diverge.\n *\n * The runtime edge Z -> X (Z depends on X at runtime) is INFERRED: Z `uses` api\n * Y and X `implements` api Y. This edge does not exist in the compile-time\n * dependencies.json (both Z and X only compile-depend on the api library Y).\n *\n * WHICH X is decided by the call site, not by \"everyone who implements Y\", in\n * priority order: (1) a literal at the call site —\n * `createRpcClient(Y, new ClientConfig('helper-fsdb'))` — kept as\n * `ApiRef.targetService`; else (2) the calling project's declared `callsService`\n * (project.json metadata.webpieces.callsService), the symmetric half of\n * `serviceName` for the shared-library case where the client is built once from a\n * config field so no literal can sit at the call site; else (3) fan-out. A named\n * target from (1) or (2) is matched against each node's DECLARED `serviceName`.\n * Fanning an edge out to every implementer is catastrophic for a company-wide\n * contract registered in a shared library — it manufactures calls that cannot\n * happen, and cycles that do not exist. When a target cannot be resolved the old\n * fan-out still happens, but a warning names the call site (see\n * RuntimeGraphReport.warnings): a wrong-but-green graph is worse than a failing\n * one, so it must never degrade silently.\n */\n\nimport { sortGraphTopologically } from './graph-sorter';\nimport type { EnhancedGraph, GraphEntry } from './graph-sorter';\nimport type {\n    ApiContracts,\n    ApiMethodMeta,\n    ApiRef,\n    ApiTransport,\n    ExternalSystemDecls,\n} from './api-usage/api-relations';\nimport { sortApiRefs } from './api-usage/api-relations';\nimport { RelationSink } from './runtime-graph-decls';\nimport type { ScanDecl } from './runtime-graph-decls';\nimport { dedupApiRefs, sortedQueues, sortedRecord, sortUnresolved } from './runtime-graph-sorters';\nimport { attachExternalSystems, resolveExternalSystems } from './api-usage/external-systems';\nimport { RuntimeProductMembership } from './graph-products';\nimport { RemoteCallCollector } from './runtime-remote-calls';\nimport type { RemoteServices } from './remote-services';\nimport type {\n    RuntimeApi,\n    RuntimeEdge,\n    RuntimeExternalSystem,\n    RuntimeGraph,\n    RuntimeQueue,\n    RuntimeService,\n    RuntimeTrigger,\n    RuntimeUnresolved,\n} from './runtime-graph-model';\nimport { toError } from '../toError';\n\n// The committed data shape lives in runtime-graph-model.ts; re-exported here so every existing\n// `from './runtime-graph'` import keeps working and there is still one obvious place to import from.\nexport type {\n    RuntimeApi,\n    RuntimeEdge,\n    RuntimeExternalSystem,\n    RuntimeGraph,\n    RuntimeQueue,\n    RuntimeRemoteCall,\n    RuntimeRemoteService,\n    RuntimeService,\n    RuntimeTrigger,\n    RuntimeUnresolved,\n} from './runtime-graph-model';\nimport { adjacencyFromEdges, applyCycleCuts, assignLevels } from './runtime-graph-levels';\n\n// Persistence lives in runtime-graph-io.ts; re-exported for the same reason as the model types.\nexport {\n    DEFAULT_RUNTIME_GRAPH_PATH,\n    saveRuntimeGraph,\n    runtimeGraphFileExists,\n    loadRuntimeGraph,\n    serializeRuntimeGraph,\n} from './runtime-graph-io';\n\ninterface EdgeResult {\n    edges: RuntimeEdge[];\n    unresolved: RuntimeUnresolved[];\n    queues: Record<string, RuntimeQueue>;\n}\n\n/**\n * The derived graph PLUS everything the derivation had to guess at. `warnings` is deliberately not\n * part of RuntimeGraph: it is not committed data, it is the report that stops a guessed edge from\n * passing for a derived one. Executors print it.\n */\nexport class RuntimeGraphReport {\n    constructor(\n        public readonly graph: RuntimeGraph,\n        /** Human-readable lines naming every call site whose target the graph could not pin down. */\n        public readonly warnings: string[],\n        /**\n         * Call sites that name a target the repo does not contain. Unlike a warning these FAIL the\n         * build: the contract IS served in-repo, so the name is a typo or a stale rename, and the\n         * only reason it stayed invisible is that the graph quietly fanned the edge out instead.\n         * (A call to a service outside the repo never reaches here — nothing in-repo implements its\n         * contract, so it is `unresolvedUses`.)\n         */\n        public readonly problems: string[] = [],\n        /**\n         * role:server nodes omitted from the DRAWING because they declare no webpieces runtime\n         * package anywhere in their library closure and serve/call nothing in-repo. Neither a\n         * warning nor a problem — this is intended behavior, and shouting on every clean run is how\n         * warnings stop being read. Deliberately NOT persisted: a graph file that records its own\n         * omissions gets committed and stops being read. Executors print it instead, so the\n         * omission is always visible and never silent.\n         */\n        public readonly autoHidden: string[] = [],\n    ) {}\n}\n\n/**\n * Derives the runtime microservice graph from architecture/dependencies.json `apiRelations`:\n * implementers × users per API, split by transport. An rpc edge is a direct call; a pubsub edge flows\n * through a queue (drawn producer → queue → consumer by the visualizer).\n *\n * Nodes are the runnable apps only — role:server / role:client. A library is NEVER a node; its\n * implements/uses (a shared client-factory or route-registration lib) are attributed to the\n * servers/clients that embed it, walked transitively over dependsOn (see collectDecls).\n */\nclass RuntimeGraphDeriver {\n    /** apiClassName -> the api-lib project that owns the contract (from the apiRelations key). */\n    private readonly apiOwners = new Map<string, string>();\n    /** Addressable name -> the runtime node answering to it; how a targeted call resolves. */\n    private readonly nodeByServiceName = new Map<string, string>();\n    private readonly warnings: string[] = [];\n    private readonly problems: string[] = [];\n    /** role:server nodes hidden by isNonParticipantServer, in the order buildServices met them. */\n    private readonly autoHidden: string[] = [];\n    /** Uses aimed at a reviewed out-of-workspace service (#1203); built once the names are claimed. */\n    private readonly remoteCalls: RemoteCallCollector;\n\n    /**\n     * False when NO project in the graph carries `webpiecesRuntime`, i.e. the file was written\n     * before the field existed. Auto-hiding is then off ENTIRELY, so an old dependencies.json\n     * renders exactly as it did — absence of the field must never be read as \"declares none\".\n     * Any repo regenerated after this change has at least one webpieces project, so the guard\n     * cannot wrongly suppress the feature.\n     */\n    private readonly markersKnown: boolean;\n\n    constructor(\n        private readonly projects: EnhancedGraph,\n        /** Project names tagged drawOnGraph:false — kept in the JSON but flagged so the viz omits them. */\n        private readonly hiddenProjects: Set<string>,\n        /**\n         * The per-contract method tables, read from the generated `architecture/apis/<Api>.json`\n         * files (ApiContractFiles). A contract with no entry — no file, or no endpoints — makes every\n         * pubsub edge through it fall back to one unnamed queue per service pair instead of failing.\n         */\n        private readonly apiContracts: ApiContracts = {},\n        /**\n         * Declared external systems from dependencies.json, keyed by identity. Empty means nothing\n         * was declared, which renders exactly as it did before declarations existed.\n         */\n        private readonly externalSystemDecls: ExternalSystemDecls = {},\n        /** Reviewed out-of-workspace services from dependencies.json `remoteServices` (#1203). */\n        remoteServices: RemoteServices = {},\n    ) {\n        this.markersKnown = Object.values(projects).some(\n            (entry: GraphEntry) => entry.webpiecesRuntime !== undefined,\n        );\n        // A node ALWAYS answers to its own module name, so a repo whose deployed names match its\n        // project names needs no declaration at all — and no alias can ever redirect 'ai-chat' away\n        // from the ai-chat module. Module names are therefore claimed FIRST and are unshadowable.\n        for (const name of Object.keys(projects).sort()) {\n            if (this.isNode(name)) this.nodeByServiceName.set(name, name);\n        }\n        // `serviceName` then adds the alias a repo needs when its deployed name is NOT its module\n        // name (helper-svr serving 'helper-portal'). Colliding with a module is a misconfiguration,\n        // not a precedence question: the alias is silently unreachable, so say so.\n        for (const name of Object.keys(projects).sort()) {\n            const declared = projects[name].serviceName;\n            if (!this.isNode(name) || declared === undefined) continue;\n            const claimant = this.nodeByServiceName.get(declared);\n            if (claimant === undefined) {\n                this.nodeByServiceName.set(declared, name);\n            } else if (claimant !== name) {\n                this.problems.push(\n                    `${name} declares serviceName '${declared}', but that is already the module name of ` +\n                        `${claimant} — the alias can never be reached. Rename one of them.`,\n                );\n            }\n        }\n        this.remoteCalls = new RemoteCallCollector(\n            remoteServices,\n            (name: string): boolean => this.nodeByServiceName.has(name),\n            this.problems,\n        );\n    }\n\n    assemble(): RuntimeGraphReport {\n        const decls = this.collectDecls();\n        const apis = this.buildApis(decls);\n        const edgeResult = this.buildEdges(decls, apis);\n        // Cuts are stamped BEFORE buildServices, which is where leveling reads the edges.\n        this.problems.push(\n            ...applyCycleCuts(edgeResult.edges, this.projects, this.nodeByServiceName),\n        );\n        const services = this.buildServices(decls, edgeResult.edges);\n        const apisObj: Record<string, RuntimeApi> = {};\n        for (const api of Array.from(apis.keys()).sort()) apisObj[api] = apis.get(api)!;\n        const graph: RuntimeGraph = {\n            services,\n            apis: apisObj,\n            runtimeEdges: edgeResult.edges,\n            unresolvedUses: edgeResult.unresolved,\n            queues: edgeResult.queues,\n            triggers: this.buildTriggers(decls),\n        };\n        // #1179: each product's services — its tagged ones plus everything they reach at runtime.\n        new RuntimeProductMembership().apply(graph, this.projects);\n        // A destination whose address arrives at RUNTIME is declared on its CONTRACT\n        // (`@externalSystem runtime partner-webhooks`), so it needs no branch of its own here: it is\n        // resolved by the same call every other declared system is, converges on one node when two\n        // services deliver over the same contract, and is watched by the same drift check.\n        const systems = resolveExternalSystems(this.externalSystemDecls, services);\n        attachExternalSystems(graph, systems);\n        this.remoteCalls.attach(graph);\n        return new RuntimeGraphReport(\n            graph,\n            this.warnings,\n            this.problems,\n            [...this.autoHidden].sort(),\n        );\n    }\n\n    /**\n     * The clock- and outside-driven entry points: for every contract a node IMPLEMENTS, each method\n     * declared `cron` or `external` becomes a trigger pointing AT that node.\n     *\n     * Driven off `implements` rather than `uses` on purpose — these have no in-repo caller at all,\n     * which is why they never produced an edge and stayed invisible.\n     */\n    private buildTriggers(decls: ScanDecl[]): RuntimeTrigger[] {\n        const triggers: RuntimeTrigger[] = [];\n        for (const decl of decls) {\n            for (const ref of decl.implementsApis) {\n                for (const method of this.methodsOf(ref.api)) {\n                    if (method.kind !== 'cron' && method.kind !== 'external') continue;\n                    const trigger: RuntimeTrigger = {\n                        kind: method.kind,\n                        api: ref.api,\n                        method: method.name,\n                        service: decl.name,\n                    };\n                    if (method.kind === 'cron') trigger.queueName = method.queueName;\n                    // ONLY for 'external' (a clock needs no vendor name), and only when declared —\n                    // a graph committed before callers were required has none and must still render.\n                    if (method.kind === 'external' && method.caller !== undefined)\n                        trigger.caller = method.caller;\n                    triggers.push(trigger);\n                }\n            }\n        }\n        return triggers.sort(\n            (a: RuntimeTrigger, b: RuntimeTrigger) =>\n                a.kind.localeCompare(b.kind) ||\n                a.api.localeCompare(b.api) ||\n                a.method.localeCompare(b.method) ||\n                a.service.localeCompare(b.service),\n        );\n    }\n\n    /** The committed method table for a contract, or [] when it declares none (e.g. a vendor seam). */\n    private methodsOf(api: string): ApiMethodMeta[] {\n        return this.apiContracts[api]?.methods ?? [];\n    }\n\n    /**\n     * One ScanDecl per RUNTIME NODE (role:server / role:client). A node's effective\n     * relations are its OWN apiRelations PLUS those of every library in its transitive\n     * dependsOn closure: a lib that calls createRpcClient/addRoutes runs inside the\n     * server/client that embeds it, so the relation is attributed to that node — the\n     * lib is never a runtime node. Recursion stops at other nodes (each server/client\n     * owns its own relations). dependsOn is transitively reduced, but reduction\n     * preserves reachability, so the recursive walk still reaches every lib a node\n     * embeds through libraries.\n     */\n    private collectDecls(): ScanDecl[] {\n        const decls: ScanDecl[] = [];\n        for (const name of Object.keys(this.projects).sort()) {\n            if (!this.isNode(name)) continue;\n            const sink = new RelationSink(name);\n            this.collectEffectiveRelations(name, sink, new Set<string>([name]));\n            // EVERY node gets a decl, including one with zero relations. Gating this on \"has at\n            // least one implements/uses\" silently DELETED any deployed server whose work arrives\n            // from outside the repo (a pull subscription): the diagram looked complete while missing\n            // a running service — confidently wrong, not visibly incomplete. isNode() is the whole\n            // test; drawOnGraph:false is the ONE opt-out, and such a node renders as an isolated box.\n            decls.push({\n                name,\n                implementsApis: dedupApiRefs(sortApiRefs(sink.implementsApis)),\n                usesApis: dedupApiRefs(sortApiRefs(sink.usesApis)),\n                implementsVia: sink.implementsVia,\n                markerVia: sink.markerVia,\n            });\n        }\n        return decls;\n    }\n\n    /** True when a project is a runtime node — a server or client app (never a library). */\n    private isNode(name: string): boolean {\n        const role = this.projects[name]?.role;\n        return role === 'server' || role === 'client';\n    }\n\n    /**\n     * True for a role:server that speaks NO webpieces runtime package anywhere in its library\n     * closure AND serves/calls no in-repo contract — a legacy Express/NestJS service sitting in the\n     * same monorepo. This graph is built entirely out of webpieces contracts, so such a service can\n     * only ever draw as a disconnected box: it has no edges by construction and never will.\n     *\n     * It stays a NODE and stays in runtime-dependencies.json (drawOnGraph:false), which is the whole\n     * difference between hiding it and the silent deletion #542 removed — the data view still shows\n     * a deployed role:server, only the picture drops it. Removing it from isNode() instead would\n     * also drop it from nodeByServiceName, so a targeted ClientConfig('orders-manager') from a drawn\n     * service would stop resolving and decay into an unresolved use: a graph that got quietly WORSE\n     * while looking cleaner. The COMPILE-TIME graph (dependencies.html) still draws these projects;\n     * they genuinely exist, and only the runtime drawing claims to show webpieces services.\n     *\n     * role:client is deliberately never auto-hidden: a browser app can legitimately declare no\n     * marker at all, and nothing checks clients for presence the way checkServersPresent checks\n     * servers, so there is no equivalent failure to prevent.\n     */\n    private isNonParticipantServer(decl: ScanDecl): boolean {\n        if (!this.markersKnown) return false;\n        if (this.projects[decl.name]?.role !== 'server') return false;\n        if (decl.markerVia.size > 0) return false;\n        // Belt-and-braces: serving or calling an in-repo contract IS participation, whatever the\n        // package list says. This is what keeps a mechanism we did not anticipate from being blanked.\n        return decl.implementsApis.length === 0 && decl.usesApis.length === 0;\n    }\n\n    /**\n     * Accumulate `name`'s own api relations, then recurse through its LIBRARY deps\n     * (skipping other nodes, which own their own relations). `visited` guards against\n     * re-walking a lib reachable by more than one path (and any cycle).\n     */\n    private collectEffectiveRelations(\n        name: string,\n        sink: RelationSink,\n        visited: Set<string>,\n        includeRelations: boolean = true,\n    ): void {\n        const entry = this.projects[name];\n        if (entry === undefined) return;\n        sink.addMarkers(entry.webpiecesRuntime, name);\n        const relations = entry.apiRelations;\n        if (includeRelations && relations !== undefined) {\n            for (const owner of Object.keys(relations).sort()) {\n                for (const ref of relations[owner].implements) {\n                    this.apiOwners.set(ref.api, owner);\n                    sink.addImplements(ref, ref.declaredVia ?? name);\n                }\n                for (const ref of relations[owner].uses) {\n                    this.apiOwners.set(ref.api, owner);\n                    sink.addUses(ref);\n                }\n            }\n        }\n        for (const dep of entry.dependsOn) {\n            if (visited.has(dep)) continue;\n            visited.add(dep);\n            if (this.isNode(dep)) continue; // another server/client owns its own relations\n            this.collectEffectiveRelations(\n                dep,\n                sink,\n                visited,\n                includeRelations && entry.runtimeComposition !== true,\n            );\n        }\n    }\n\n    /** apiClassName -> { implementedBy, usedBy, type }. */\n    private buildApis(decls: ScanDecl[]): Map<string, RuntimeApi> {\n        const apis = new Map<string, RuntimeApi>();\n        const ensure = (api: string, type: ApiTransport): RuntimeApi => {\n            let entry = apis.get(api);\n            if (!entry) {\n                entry = { implementedBy: [], usedBy: [], type };\n                apis.set(api, entry);\n            }\n            return entry;\n        };\n        for (const decl of decls) {\n            for (const ref of decl.implementsApis)\n                ensure(ref.api, ref.type).implementedBy.push(decl.name);\n            for (const ref of decl.usesApis) ensure(ref.api, ref.type).usedBy.push(decl.name);\n        }\n        for (const api of apis.keys()) {\n            const entry = apis.get(api)!;\n            entry.implementedBy.sort();\n            entry.usedBy = Array.from(new Set(entry.usedBy)).sort();\n            const owner = this.apiOwners.get(api);\n            if (owner !== undefined) entry.owner = owner;\n        }\n        return apis;\n    }\n\n    /** Inferred edges U -> I via api A, split by transport; plus uses with no implementer. */\n    private buildEdges(decls: ScanDecl[], apis: Map<string, RuntimeApi>): EdgeResult {\n        const viaByKey = new Map<string, Set<string>>();\n        const unresolved: RuntimeUnresolved[] = [];\n        const queues = new Map<string, RuntimeQueue>();\n        for (const decl of decls) {\n            for (const ref of decl.usesApis) {\n                // A named target outside this workspace (#1203) is a remote service, not an implementer\n                // to resolve among the nodes and not an unresolved vendor call.\n                const wanted = ref.targetService ?? this.callsServiceFor(decl.name, ref.api);\n                if (this.remoteCalls.claim(decl.name, ref, wanted)) continue;\n                const implementers = apis.get(ref.api)?.implementedBy ?? [];\n                if (implementers.length === 0) {\n                    // Nobody in-repo serves it. For a vendor contract that is the ANSWER, not a gap:\n                    // the call leaves the repo, and the viz terminates it at a dashed vendor node.\n                    unresolved.push({ service: decl.name, api: ref.api });\n                    continue;\n                }\n                for (const target of this.targetsFor(decl.name, ref, implementers)) {\n                    // A service calling ITSELF synchronously is noise; a service ENQUEUEING to\n                    // itself is a real, common topology (deferring its own work), and dropping it\n                    // was hiding the single most interesting thing about a queue.\n                    if (target === decl.name && ref.type !== 'pubsub') continue;\n                    if (ref.type === 'pubsub') {\n                        this.addQueuedEdges(decl.name, target, ref.api, viaByKey, queues);\n                        continue;\n                    }\n                    const key = `${decl.name} ${target} ${ref.type}`;\n                    if (!viaByKey.has(key)) viaByKey.set(key, new Set());\n                    viaByKey.get(key)!.add(ref.api);\n                }\n            }\n        }\n        return {\n            edges: this.edgesFromKeys(viaByKey),\n            unresolved: sortUnresolved(unresolved),\n            queues: sortedQueues(queues),\n        };\n    }\n\n    /**\n     * One edge PER QUEUED METHOD of `api`, plus the queue each flows through.\n     *\n     * Per method rather than per service pair because that is the unit Cloud Tasks and Terraform\n     * create: two services exchanging three queued methods run three independently-configured,\n     * independently-backed-up queues, and collapsing them into one arrow hides which one is stuck.\n     *\n     * A contract with no method table (no `architecture/apis/<Api>.json` for it)\n     * degrades to a single unnamed queue for the pair — the old behavior — rather than vanishing.\n     */\n    private addQueuedEdges(\n        from: string,\n        to: string,\n        api: string,\n        viaByKey: Map<string, Set<string>>,\n        queues: Map<string, RuntimeQueue>,\n    ): void {\n        const queued = this.methodsOf(api).filter((m: ApiMethodMeta) => m.kind === 'cloudtasks');\n        if (queued.length === 0) {\n            const key = `${from} ${to} pubsub `;\n            if (!viaByKey.has(key)) viaByKey.set(key, new Set());\n            viaByKey.get(key)!.add(api);\n            return;\n        }\n        for (const method of queued) {\n            const queueKey = `${api}.${method.name}`;\n            const key = `${from} ${to} pubsub ${queueKey}`;\n            if (!viaByKey.has(key)) viaByKey.set(key, new Set());\n            viaByKey.get(key)!.add(api);\n\n            let queue = queues.get(queueKey);\n            if (queue === undefined) {\n                queue = {\n                    api,\n                    method: method.name,\n                    // Every cloudtasks method carries a queueName; the fallback covers a\n                    // dependencies.json written before queueName became kind-specific.\n                    queueName: method.queueName ?? `${api}-${method.name}`,\n                    producedBy: [],\n                    consumedBy: [],\n                };\n                queues.set(queueKey, queue);\n            }\n            if (!queue.producedBy.includes(from)) queue.producedBy.push(from);\n            if (!queue.consumedBy.includes(to)) queue.consumedBy.push(to);\n        }\n    }\n\n    /**\n     * WHICH implementers this one `uses` reaches. Resolution order (most specific wins):\n     *   1. a literal `ClientConfig` at the call site (`ref.targetService`) — names ONE node;\n     *   2. else the calling project's declared `callsService` (project.json) — for the shared-library\n     *      case where the literal cannot sit at the call site, it lives one indirection away in the app;\n     *   3. else the historical fan-out — the only safe superset — recording WHY, so a fanned-out (i.e.\n     *      possibly fictional) edge can never pass for a derived one.\n     * A named target (1 or 2) that resolves to no module, or to a module that does not serve the\n     * contract, is a PROBLEM (fails the build), never a silent drop.\n     */\n    private targetsFor(user: string, ref: ApiRef, implementers: string[]): string[] {\n        const literal = ref.targetService;\n        if (literal !== undefined)\n            return this.resolveNamedTarget(user, ref, implementers, literal, 'literal');\n\n        const declared = this.callsServiceFor(user, ref.api);\n        if (declared !== undefined)\n            return this.resolveNamedTarget(user, ref, implementers, declared, 'callsService');\n\n        return this.untargetedFanOut(user, ref, implementers);\n    }\n\n    /**\n     * The declared `callsService` target for this node's use of `api`, or undefined when none applies.\n     * A string declaration aims every untargeted use at one service; a map aims per api-class.\n     */\n    private callsServiceFor(user: string, api: string): string | undefined {\n        const declared = this.projects[user]?.callsService;\n        if (declared === undefined) return undefined;\n        if (typeof declared === 'string') return declared;\n        return declared[api];\n    }\n\n    /**\n     * Resolve a NAMED target (from a call-site literal or a project-level `callsService`) to the one\n     * module that serves it. A name no module answers to, or a module that does not serve the\n     * contract, fails the build — the wording names which declaration to fix, `source` deciding it.\n     */\n    private resolveNamedTarget(\n        user: string,\n        ref: ApiRef,\n        implementers: string[],\n        wanted: string,\n        source: 'literal' | 'callsService',\n    ): string[] {\n        const node = this.nodeByServiceName.get(wanted);\n        const served = `${implementers.length} module(s) serve this contract (${implementers.join(', ')})`;\n        if (node === undefined) {\n            this.problems.push(\n                source === 'callsService'\n                    ? `${user} declares metadata.webpieces.callsService '${wanted}' in its project.json, but NO ` +\n                          `module answers to that name. ${served}. Point callsService at a module name, or declare ` +\n                          `metadata.webpieces.serviceName: '${wanted}' on the module that serves \"${ref.api}\".`\n                    : `${user} calls \"${ref.api}\" at service '${wanted}', but NO module answers to that name. ` +\n                          `${served}. Either use the module name, or declare metadata.webpieces.serviceName: ` +\n                          `'${wanted}' on the module that serves it (and translate any environment prefix in ` +\n                          `ClientRegistry.setDeriver, not here).`,\n            );\n            return implementers;\n        }\n        if (!implementers.includes(node)) {\n            const via =\n                source === 'callsService'\n                    ? `${user} declares callsService '${wanted}' (module ${node})`\n                    : `${user} calls \"${ref.api}\" at service '${wanted}' (module ${node})`;\n            this.problems.push(\n                `${via}, but ${node} does NOT serve \"${ref.api}\" — ${implementers.join(', ')} do. At runtime that ` +\n                    `call has nothing to answer it.`,\n            );\n            return implementers;\n        }\n        return [node];\n    }\n\n    /**\n     * A use with no literal client config. One implementer is unambiguous, so it stays silent; more\n     * than one means every edge but one is fiction — exactly the failure this mechanism exists to\n     * stop — so it is reported even though the graph still (conservatively) draws them all.\n     */\n    private untargetedFanOut(user: string, ref: ApiRef, implementers: string[]): string[] {\n        if (implementers.length > 1) {\n            this.warnings.push(\n                `${user} uses \"${ref.api}\" with no literal client config, and ${implementers.length} services ` +\n                    `implement it (${implementers.join(', ')}) — an edge is drawn to EVERY one, so all but one ` +\n                    `are fiction. Name the target: createRpcClient(${ref.api}, new ClientConfig('<serviceName>', ClientRole.SERVER)); ` +\n                    `or, when the client is built in a shared library (no literal can sit at the call site), ` +\n                    `declare metadata.webpieces.callsService: '<serviceName>' on ${user}'s project.json.`,\n            );\n        }\n        return implementers;\n    }\n\n    /**\n     * Rebuild edges from their `\"from to type queue\"` keys. The 4th part is the queue (\"Api.method\")\n     * and is empty for every non-queued edge; it is part of the KEY so two queued methods between\n     * the same pair stay two edges instead of collapsing into one.\n     */\n    private edgesFromKeys(viaByKey: Map<string, Set<string>>): RuntimeEdge[] {\n        const edges: RuntimeEdge[] = [];\n        for (const key of viaByKey.keys()) {\n            const parts = key.split(' ');\n            const edge: RuntimeEdge = {\n                from: parts[0],\n                to: parts[1],\n                via: Array.from(viaByKey.get(key)!).sort(),\n                type: parts[2] as ApiTransport,\n            };\n            if (parts[3] !== undefined && parts[3] !== '') edge.queue = parts[3];\n            edges.push(edge);\n        }\n        edges.sort(\n            (a: RuntimeEdge, b: RuntimeEdge) =>\n                a.from.localeCompare(b.from) ||\n                a.to.localeCompare(b.to) ||\n                (a.type ?? '').localeCompare(b.type ?? '') ||\n                (a.queue ?? '').localeCompare(b.queue ?? ''),\n        );\n        return edges;\n    }\n\n    private buildServices(decls: ScanDecl[], edges: RuntimeEdge[]): Record<string, RuntimeService> {\n        const services: Record<string, RuntimeService> = {};\n        for (const decl of decls) {\n            // A queued hop depends on the QUEUE, not on the peer: the producer hands off and returns,\n            // so naming the consumer here would assert a coupling that does not exist (and would make\n            // a service that defers work to itself look self-dependent).\n            const dependsOn = Array.from(\n                new Set(\n                    edges\n                        .filter((e: RuntimeEdge) => e.from === decl.name)\n                        .map((e: RuntimeEdge) =>\n                            e.queue === undefined ? e.to : `queue:${e.queue}`,\n                        ),\n                ),\n            ).sort();\n            // Keys are written in this order; an undefined value is omitted by JSON.stringify, so\n            // the committed JSON stays clean AND deterministic without conditional assembly.\n            const service: RuntimeService = {\n                level: 0,\n                role: this.projects[decl.name]?.role, // labels a relation-less node for what it IS\n                serviceName: this.projects[decl.name]?.serviceName,\n                callsService: this.projects[decl.name]?.callsService,\n                implements: decl.implementsApis.map((r: ApiRef) => r.api),\n                implementsVia:\n                    decl.implementsVia.size > 0 ? sortedRecord(decl.implementsVia) : undefined,\n                // One api used against two services is two refs but ONE api in this list.\n                uses: Array.from(new Set(decl.usesApis.map((r: ApiRef) => r.api))),\n                dependsOn,\n                wiringUses: decl.usesApis.some((ref) => ref.declaredVia !== undefined)\n                    ? decl.usesApis\n                    : undefined,\n                wiringImplements: decl.implementsApis.some((ref) => ref.declaredVia !== undefined)\n                    ? decl.implementsApis\n                    : undefined,\n            };\n            services[decl.name] = service;\n            // The explicit tag wins and is NOT reported as auto-hidden — somebody asked for it.\n            if (this.hiddenProjects.has(decl.name)) {\n                service.drawOnGraph = false;\n            } else if (this.isNonParticipantServer(decl)) {\n                service.drawOnGraph = false;\n                this.autoHidden.push(decl.name);\n            }\n        }\n        const levels = assignLevels(adjacencyFromEdges(Object.keys(services), edges));\n        for (const name of Object.keys(services)) services[name].level = levels[name] ?? 0;\n        return services;\n    }\n}\n\n/**\n * Derive the runtime graph from dependencies.json's project `apiRelations` — the\n * single source of truth shared by generate + validate. `hiddenProjects`\n * (drawOnGraph:false, defaults to none) are kept in the graph but flagged so the\n * runtime visualizer omits their nodes + edges.\n */\n// webpieces-disable no-function-outside-class -- module entry point for the runtime graph derivation\nexport function deriveRuntimeGraph(\n    projects: EnhancedGraph,\n    hiddenProjects: Set<string> = new Set<string>(),\n    apiContracts: ApiContracts = {},\n): RuntimeGraph {\n    return deriveRuntimeGraphReport(projects, hiddenProjects, apiContracts).graph;\n}\n\n/**\n * The same derivation, plus the warnings it produced (every edge it had to GUESS at). Executors use\n * this form and print the warnings; `deriveRuntimeGraph` is the convenience form for callers that\n * only want the data. The warnings are deliberately kept OUT of runtime-dependencies.json — a graph\n * file that records its own doubts would just get committed and stop being read.\n */\n// webpieces-disable no-function-outside-class -- module entry point for the runtime graph derivation\nexport function deriveRuntimeGraphReport(\n    projects: EnhancedGraph,\n    hiddenProjects: Set<string> = new Set<string>(),\n    apiContracts: ApiContracts = {},\n    externalSystems: ExternalSystemDecls = {},\n    remoteServices: RemoteServices = {},\n): RuntimeGraphReport {\n    return new RuntimeGraphDeriver(\n        projects,\n        hiddenProjects,\n        apiContracts,\n        externalSystems,\n        remoteServices,\n    ).assemble();\n}\n\n// Levels + adjacency live in runtime-graph-levels.ts; re-exported for the same reason the model types\n// and the io helpers above are — one obvious place to import the runtime graph from.\nexport { runtimeAdjacency } from './runtime-graph-levels';\n"]}
+{"version":3,"file":"runtime-graph.js","sourceRoot":"","sources":["../../../../../../packages/tooling/nx-webpieces-rules/src/lib/runtime-graph.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAsoBH,gDAMC;AASD,4DAcC;AAxpBD,6DAAwD;AACxD,+DAAqD;AAErD,mEAAmG;AACnG,mEAA6F;AAC7F,qDAA4D;AAC5D,iEAA6D;AA4B7D,iEAA0F;AAE1F,gGAAgG;AAChG,uDAM4B;AALxB,8HAAA,0BAA0B,OAAA;AAC1B,oHAAA,gBAAgB,OAAA;AAChB,0HAAA,sBAAsB,OAAA;AACtB,oHAAA,gBAAgB,OAAA;AAChB,yHAAA,qBAAqB,OAAA;AASzB;;;;GAIG;AACH,MAAa,kBAAkB;IAEP;IAEA;IAQA;IASA;IApBpB,YACoB,KAAmB;IACnC,6FAA6F;IAC7E,QAAkB;IAClC;;;;;;OAMG;IACa,WAAqB,EAAE;IACvC;;;;;;;OAOG;IACa,aAAuB,EAAE;QAnBzB,UAAK,GAAL,KAAK,CAAc;QAEnB,aAAQ,GAAR,QAAQ,CAAU;QAQlB,aAAQ,GAAR,QAAQ,CAAe;QASvB,eAAU,GAAV,UAAU,CAAe;IAC1C,CAAC;CACP;AAvBD,gDAuBC;AAED;;;;;;;;GAQG;AACH,MAAM,mBAAmB;IAsBA;IAEA;IAMA;IAKA;IAlCrB,8FAA8F;IAC7E,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvD,0FAA0F;IACzE,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,QAAQ,GAAa,EAAE,CAAC;IACxB,QAAQ,GAAa,EAAE,CAAC;IACzC,+FAA+F;IAC9E,UAAU,GAAa,EAAE,CAAC;IAC3C,mGAAmG;IAClF,WAAW,CAAsB;IAElD;;;;;;OAMG;IACc,YAAY,CAAU;IAEvC,YACqB,QAAuB;IACxC,mGAAmG;IAClF,cAA2B;IAC5C;;;;OAIG;IACc,eAA6B,EAAE;IAChD;;;OAGG;IACc,sBAA2C,EAAE;IAC9D,0FAA0F;IAC1F,iBAAiC,EAAE;QAflB,aAAQ,GAAR,QAAQ,CAAe;QAEvB,mBAAc,GAAd,cAAc,CAAa;QAM3B,iBAAY,GAAZ,YAAY,CAAmB;QAK/B,wBAAmB,GAAnB,mBAAmB,CAA0B;QAI9D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5C,CAAC,KAAiB,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAC9D,CAAC;QACF,yFAAyF;QACzF,4FAA4F;QAC5F,0FAA0F;QAC1F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClE,CAAC;QACD,0FAA0F;QAC1F,4FAA4F;QAC5F,2EAA2E;QAC3E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,GAAG,IAAI,0BAA0B,QAAQ,4CAA4C;oBACjF,GAAG,QAAQ,wDAAwD,CAC1E,CAAC;YACN,CAAC;QACL,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,IAAI,0CAAmB,CACtC,cAAc,EACd,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAC3D,IAAI,CAAC,QAAQ,CAChB,CAAC;IACN,CAAC;IAED,QAAQ;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChD,kFAAkF;QAClF,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,GAAG,IAAA,qCAAc,EAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAC7E,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,OAAO,GAA+B,EAAE,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAChF,MAAM,KAAK,GAAiB;YACxB,QAAQ;YACR,IAAI,EAAE,OAAO;YACb,YAAY,EAAE,UAAU,CAAC,KAAK;YAC9B,cAAc,EAAE,UAAU,CAAC,UAAU;YACrC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;SACtC,CAAC;QACF,wFAAwF;QACxF,IAAI,yCAAwB,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,6EAA6E;QAC7E,6FAA6F;QAC7F,2FAA2F;QAC3F,mFAAmF;QACnF,MAAM,OAAO,GAAG,IAAA,yCAAsB,EAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QAC3E,IAAA,wCAAqB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,IAAI,kBAAkB,CACzB,KAAK,EACL,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,QAAQ,EACb,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAC9B,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,KAAiB;QACnC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;wBAAE,SAAS;oBACnE,MAAM,OAAO,GAAmB;wBAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,GAAG,EAAE,GAAG,CAAC,GAAG;wBACZ,MAAM,EAAE,MAAM,CAAC,IAAI;wBACnB,OAAO,EAAE,IAAI,CAAC,IAAI;qBACrB,CAAC;oBACF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;wBAAE,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;oBACjE,+EAA+E;oBAC/E,iFAAiF;oBACjF,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;wBACzD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAChB,CAAC,CAAiB,EAAE,CAAiB,EAAE,EAAE,CACrC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5B,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;YAChC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CACzC,CAAC;IACN,CAAC;IAED,mGAAmG;IAC3F,SAAS,CAAC,GAAW;QACzB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;;;OASG;IACK,YAAY;QAChB,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjC,MAAM,IAAI,GAAG,IAAI,kCAAY,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpE,oFAAoF;YACpF,qFAAqF;YACrF,yFAAyF;YACzF,uFAAuF;YACvF,0FAA0F;YAC1F,KAAK,CAAC,IAAI,CAAC;gBACP,IAAI;gBACJ,cAAc,EAAE,IAAA,oCAAY,EAAC,IAAA,2BAAW,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC9D,QAAQ,EAAE,IAAA,oCAAY,EAAC,IAAA,2BAAW,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAClD,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC5B,CAAC,CAAC;QACP,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,wFAAwF;IAChF,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QACvC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sBAAsB,CAAC,IAAc;QACzC,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9D,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,yFAAyF;QACzF,8FAA8F;QAC9F,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACK,yBAAyB,CAC7B,IAAY,EACZ,IAAkB,EAClB,OAAoB,EACpB,mBAA4B,IAAI;QAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,IAAI,gBAAgB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;oBAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACnC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;gBACrD,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;oBACtC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtB,CAAC;YACL,CAAC;QACL,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,+CAA+C;YAC/E,IAAI,CAAC,yBAAyB,CAC1B,GAAG,EACH,IAAI,EACJ,OAAO,EACP,gBAAgB,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,CACxD,CAAC;QACN,CAAC;IACL,CAAC;IAED,uDAAuD;IAC/C,SAAS,CAAC,KAAiB;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,IAAkB,EAAc,EAAE;YAC3D,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,KAAK,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBAChD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,KAAK,CAAC;QACjB,CAAC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,cAAc;gBACjC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAC7B,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,0FAA0F;IAClF,UAAU,CAAC,KAAiB,EAAE,IAA6B;QAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;QAChD,MAAM,UAAU,GAAwB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,wFAAwF;gBACxF,gEAAgE;gBAChE,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC7E,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;oBAAE,SAAS;gBAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,IAAI,EAAE,CAAC;gBAC5D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5B,iFAAiF;oBACjF,+EAA+E;oBAC/E,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;oBACtD,SAAS;gBACb,CAAC;gBACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;oBACjE,2EAA2E;oBAC3E,8EAA8E;oBAC9E,8DAA8D;oBAC9D,IAAI,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;wBAAE,SAAS;oBAC5D,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACxB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;wBAClE,SAAS;oBACb,CAAC;oBACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;oBACrD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpC,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO;YACH,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YACnC,UAAU,EAAE,IAAA,sCAAc,EAAC,UAAU,CAAC;YACtC,MAAM,EAAE,IAAA,oCAAY,EAAC,MAAM,CAAC;SAC/B,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CAClB,IAAY,EACZ,EAAU,EACV,GAAW,EACX,QAAkC,EAClC,MAAiC;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,UAAU,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YACrD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO;QACX,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,WAAW,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YACrD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAE5B,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtB,KAAK,GAAG;oBACJ,GAAG;oBACH,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,qEAAqE;oBACrE,mEAAmE;oBACnE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE;oBACtD,UAAU,EAAE,EAAE;oBACd,UAAU,EAAE,EAAE;iBACjB,CAAC;gBACF,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,YAAsB;QAChE,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,CAAC;QAClC,IAAI,OAAO,KAAK,SAAS;YACrB,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS;YACtB,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAEtF,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,IAAY,EAAE,GAAW;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;QACnD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAClD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CACtB,IAAY,EACZ,GAAW,EACX,YAAsB,EACtB,MAAc,EACd,MAAkC;QAElC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,mCAAmC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,MAAM,KAAK,cAAc;gBACrB,CAAC,CAAC,GAAG,IAAI,8CAA8C,MAAM,gCAAgC;oBACvF,gCAAgC,MAAM,oDAAoD;oBAC1F,oCAAoC,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI;gBAC3F,CAAC,CAAC,GAAG,IAAI,WAAW,GAAG,CAAC,GAAG,iBAAiB,MAAM,yCAAyC;oBACrF,GAAG,MAAM,2EAA2E;oBACpF,IAAI,MAAM,0EAA0E;oBACpF,uCAAuC,CACpD,CAAC;YACF,OAAO,YAAY,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GACL,MAAM,KAAK,cAAc;gBACrB,CAAC,CAAC,GAAG,IAAI,2BAA2B,MAAM,aAAa,IAAI,GAAG;gBAC9D,CAAC,CAAC,GAAG,IAAI,WAAW,GAAG,CAAC,GAAG,iBAAiB,MAAM,aAAa,IAAI,GAAG,CAAC;YAC/E,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,GAAG,GAAG,SAAS,IAAI,oBAAoB,GAAG,CAAC,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB;gBAC/F,gCAAgC,CACvC,CAAC;YACF,OAAO,YAAY,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,IAAY,EAAE,GAAW,EAAE,YAAsB;QACtE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,IAAI,CACd,GAAG,IAAI,UAAU,GAAG,CAAC,GAAG,wCAAwC,YAAY,CAAC,MAAM,YAAY;gBAC3F,iBAAiB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD;gBAC5F,iDAAiD,GAAG,CAAC,GAAG,2DAA2D;gBACnH,0FAA0F;gBAC1F,+DAA+D,IAAI,kBAAkB,CAC5F,CAAC;QACN,CAAC;QACD,OAAO,YAAY,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,QAAkC;QACpD,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAgB;gBACtB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACd,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;gBACZ,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,CAAC,IAAI,EAAE;gBAC1C,IAAI,EAAE,KAAK,CAAC,CAAC,CAAiB;aACjC,CAAC;YACF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,IAAI,CACN,CAAC,CAAc,EAAE,CAAc,EAAE,EAAE,CAC/B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5B,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1C,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CACnD,CAAC;QACF,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,aAAa,CAAC,KAAiB,EAAE,KAAoB;QACzD,MAAM,QAAQ,GAAmC,EAAE,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,0FAA0F;YAC1F,0FAA0F;YAC1F,6DAA6D;YAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CACxB,IAAI,GAAG,CACH,KAAK;iBACA,MAAM,CAAC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;iBAChD,GAAG,CAAC,CAAC,CAAc,EAAE,EAAE,CACpB,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,CACpD,CACR,CACJ,CAAC,IAAI,EAAE,CAAC;YACT,sFAAsF;YACtF,iFAAiF;YACjF,MAAM,OAAO,GAAmB;gBAC5B,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6CAA6C;gBACnF,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW;gBAClD,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY;gBACpD,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACzD,aAAa,EACT,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAA,oCAAY,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC9E,0EAA0E;gBAC1E,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClE,SAAS;gBACT,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;oBAClE,CAAC,CAAC,IAAI,CAAC,QAAQ;oBACf,CAAC,CAAC,SAAS;gBACf,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;oBAC9E,CAAC,CAAC,IAAI,CAAC,cAAc;oBACrB,CAAC,CAAC,SAAS;aAClB,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YAC9B,oFAAoF;YACpF,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC;YAChC,CAAC;iBAAM,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC;gBAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,mCAAY,EAAC,IAAA,yCAAkB,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ;AAED;;;;;GAKG;AACH,qGAAqG;AACrG,SAAgB,kBAAkB,CAC9B,QAAuB,EACvB,iBAA8B,IAAI,GAAG,EAAU,EAC/C,eAA6B,EAAE;IAE/B,OAAO,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,qGAAqG;AACrG,SAAgB,wBAAwB,CACpC,QAAuB,EACvB,iBAA8B,IAAI,GAAG,EAAU,EAC/C,eAA6B,EAAE,EAC/B,kBAAuC,EAAE,EACzC,iBAAiC,EAAE;IAEnC,OAAO,IAAI,mBAAmB,CAC1B,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,eAAe,EACf,cAAc,CACjB,CAAC,QAAQ,EAAE,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,qFAAqF;AACrF,+DAA0D;AAAjD,wHAAA,gBAAgB,OAAA","sourcesContent":["/**\n * Runtime Graph\n *\n * Derives the runtime microservice graph SOLELY from architecture/dependencies.json\n * (the single source of truth): each project's `apiRelations` carry which api\n * classes it implements/uses and their transport (rpc | pubsub). Both\n * `architecture:generate` and `architecture:validate-runtime-architecture` call\n * the SAME `deriveRuntimeGraph`, so the committed graph and the validated graph\n * can never diverge.\n *\n * The runtime edge Z -> X (Z depends on X at runtime) is INFERRED: Z `uses` api\n * Y and X `implements` api Y. This edge does not exist in the compile-time\n * dependencies.json (both Z and X only compile-depend on the api library Y).\n *\n * WHICH X is decided by the call site, not by \"everyone who implements Y\", in\n * priority order: (1) a literal at the call site —\n * `createRpcClient(Y, new ClientConfig('helper-fsdb'))` — kept as\n * `ApiRef.targetService`; else (2) the calling project's declared `callsService`\n * (project.json metadata.webpieces.callsService), the symmetric half of\n * `serviceName` for the shared-library case where the client is built once from a\n * config field so no literal can sit at the call site; else (3) fan-out. A named\n * target from (1) or (2) is matched against each node's DECLARED `serviceName`.\n * Fanning an edge out to every implementer is catastrophic for a company-wide\n * contract registered in a shared library — it manufactures calls that cannot\n * happen, and cycles that do not exist. When a target cannot be resolved the old\n * fan-out still happens, but a warning names the call site (see\n * RuntimeGraphReport.warnings): a wrong-but-green graph is worse than a failing\n * one, so it must never degrade silently.\n */\n\nimport { sortGraphTopologically } from './graph-sorter';\nimport type { EnhancedGraph, GraphEntry } from './graph-sorter';\nimport type {\n    ApiContracts,\n    ApiMethodMeta,\n    ApiRef,\n    ApiTransport,\n    ExternalSystemDecls,\n} from './api-usage/api-relations';\nimport { sortApiRefs } from './api-usage/api-relations';\nimport { RelationSink } from './runtime-graph-decls';\nimport type { ScanDecl } from './runtime-graph-decls';\nimport { dedupApiRefs, sortedQueues, sortedRecord, sortUnresolved } from './runtime-graph-sorters';\nimport { attachExternalSystems, resolveExternalSystems } from './api-usage/external-systems';\nimport { RuntimeProductMembership } from './graph-products';\nimport { RemoteCallCollector } from './runtime-remote-calls';\nimport type { RemoteServices } from './remote-services';\nimport type {\n    RuntimeApi,\n    RuntimeEdge,\n    RuntimeExternalSystem,\n    RuntimeGraph,\n    RuntimeQueue,\n    RuntimeService,\n    RuntimeTrigger,\n    RuntimeUnresolved,\n} from './runtime-graph-model';\nimport { toError } from '../toError';\n\n// The committed data shape lives in runtime-graph-model.ts; re-exported here so every existing\n// `from './runtime-graph'` import keeps working and there is still one obvious place to import from.\nexport type {\n    RuntimeApi,\n    RuntimeEdge,\n    RuntimeExternalSystem,\n    RuntimeGraph,\n    RuntimeQueue,\n    RuntimeRemoteCall,\n    RuntimeRemoteService,\n    RuntimeService,\n    RuntimeTrigger,\n    RuntimeUnresolved,\n} from './runtime-graph-model';\nimport { adjacencyFromEdges, applyCycleCuts, assignLevels } from './runtime-graph-levels';\n\n// Persistence lives in runtime-graph-io.ts; re-exported for the same reason as the model types.\nexport {\n    DEFAULT_RUNTIME_GRAPH_PATH,\n    saveRuntimeGraph,\n    runtimeGraphFileExists,\n    loadRuntimeGraph,\n    serializeRuntimeGraph,\n} from './runtime-graph-io';\n\ninterface EdgeResult {\n    edges: RuntimeEdge[];\n    unresolved: RuntimeUnresolved[];\n    queues: Record<string, RuntimeQueue>;\n}\n\n/**\n * The derived graph PLUS everything the derivation had to guess at. `warnings` is deliberately not\n * part of RuntimeGraph: it is not committed data, it is the report that stops a guessed edge from\n * passing for a derived one. Executors print it.\n */\nexport class RuntimeGraphReport {\n    constructor(\n        public readonly graph: RuntimeGraph,\n        /** Human-readable lines naming every call site whose target the graph could not pin down. */\n        public readonly warnings: string[],\n        /**\n         * Call sites that name a target the repo does not contain. Unlike a warning these FAIL the\n         * build: the contract IS served in-repo, so the name is a typo or a stale rename, and the\n         * only reason it stayed invisible is that the graph quietly fanned the edge out instead.\n         * (A call to a service outside the repo never reaches here — nothing in-repo implements its\n         * contract, so it is `unresolvedUses`.)\n         */\n        public readonly problems: string[] = [],\n        /**\n         * role:server nodes omitted from the DRAWING because they declare no webpieces runtime\n         * package anywhere in their library closure and serve/call nothing in-repo. Neither a\n         * warning nor a problem — this is intended behavior, and shouting on every clean run is how\n         * warnings stop being read. Deliberately NOT persisted: a graph file that records its own\n         * omissions gets committed and stops being read. Executors print it instead, so the\n         * omission is always visible and never silent.\n         */\n        public readonly autoHidden: string[] = [],\n    ) {}\n}\n\n/**\n * Derives the runtime microservice graph from architecture/dependencies.json `apiRelations`:\n * implementers × users per API, split by transport. An rpc edge is a direct call; a pubsub edge flows\n * through a queue (drawn producer → queue → consumer by the visualizer).\n *\n * Nodes are the runnable apps only — role:server / role:client. A library is NEVER a node; its\n * implements/uses (a shared client-factory or route-registration lib) are attributed to the\n * servers/clients that embed it, walked transitively over dependsOn (see collectDecls).\n */\nclass RuntimeGraphDeriver {\n    /** apiClassName -> the api-lib project that owns the contract (from the apiRelations key). */\n    private readonly apiOwners = new Map<string, string>();\n    /** Addressable name -> the runtime node answering to it; how a targeted call resolves. */\n    private readonly nodeByServiceName = new Map<string, string>();\n    private readonly warnings: string[] = [];\n    private readonly problems: string[] = [];\n    /** role:server nodes hidden by isNonParticipantServer, in the order buildServices met them. */\n    private readonly autoHidden: string[] = [];\n    /** Uses aimed at a reviewed out-of-workspace service (#1203); built once the names are claimed. */\n    private readonly remoteCalls: RemoteCallCollector;\n\n    /**\n     * False when NO project in the graph carries `webpiecesRuntime`, i.e. the file was written\n     * before the field existed. Auto-hiding is then off ENTIRELY, so an old dependencies.json\n     * renders exactly as it did — absence of the field must never be read as \"declares none\".\n     * Any repo regenerated after this change has at least one webpieces project, so the guard\n     * cannot wrongly suppress the feature.\n     */\n    private readonly markersKnown: boolean;\n\n    constructor(\n        private readonly projects: EnhancedGraph,\n        /** Project names tagged drawOnGraph:false — kept in the JSON but flagged so the viz omits them. */\n        private readonly hiddenProjects: Set<string>,\n        /**\n         * The per-contract method tables, read from the generated `architecture/apis/<Api>.json`\n         * files (ApiContractFiles). A contract with no entry — no file, or no endpoints — makes every\n         * pubsub edge through it fall back to one unnamed queue per service pair instead of failing.\n         */\n        private readonly apiContracts: ApiContracts = {},\n        /**\n         * Declared external systems from dependencies.json, keyed by identity. Empty means nothing\n         * was declared, which renders exactly as it did before declarations existed.\n         */\n        private readonly externalSystemDecls: ExternalSystemDecls = {},\n        /** Reviewed out-of-workspace services from dependencies.json `remoteServices` (#1203). */\n        remoteServices: RemoteServices = {},\n    ) {\n        this.markersKnown = Object.values(projects).some(\n            (entry: GraphEntry) => entry.webpiecesRuntime !== undefined,\n        );\n        // A node ALWAYS answers to its own module name, so a repo whose deployed names match its\n        // project names needs no declaration at all — and no alias can ever redirect 'ai-chat' away\n        // from the ai-chat module. Module names are therefore claimed FIRST and are unshadowable.\n        for (const name of Object.keys(projects).sort()) {\n            if (this.isNode(name)) this.nodeByServiceName.set(name, name);\n        }\n        // `serviceName` then adds the alias a repo needs when its deployed name is NOT its module\n        // name (helper-svr serving 'helper-portal'). Colliding with a module is a misconfiguration,\n        // not a precedence question: the alias is silently unreachable, so say so.\n        for (const name of Object.keys(projects).sort()) {\n            const declared = projects[name].serviceName;\n            if (!this.isNode(name) || declared === undefined) continue;\n            const claimant = this.nodeByServiceName.get(declared);\n            if (claimant === undefined) {\n                this.nodeByServiceName.set(declared, name);\n            } else if (claimant !== name) {\n                this.problems.push(\n                    `${name} declares serviceName '${declared}', but that is already the module name of ` +\n                        `${claimant} — the alias can never be reached. Rename one of them.`,\n                );\n            }\n        }\n        this.remoteCalls = new RemoteCallCollector(\n            remoteServices,\n            (name: string): boolean => this.nodeByServiceName.has(name),\n            this.problems,\n        );\n    }\n\n    assemble(): RuntimeGraphReport {\n        const decls = this.collectDecls();\n        const apis = this.buildApis(decls);\n        const edgeResult = this.buildEdges(decls, apis);\n        // Cuts are stamped BEFORE buildServices, which is where leveling reads the edges.\n        this.problems.push(\n            ...applyCycleCuts(edgeResult.edges, this.projects, this.nodeByServiceName),\n        );\n        const services = this.buildServices(decls, edgeResult.edges);\n        const apisObj: Record<string, RuntimeApi> = {};\n        for (const api of Array.from(apis.keys()).sort()) apisObj[api] = apis.get(api)!;\n        const graph: RuntimeGraph = {\n            services,\n            apis: apisObj,\n            runtimeEdges: edgeResult.edges,\n            unresolvedUses: edgeResult.unresolved,\n            queues: edgeResult.queues,\n            triggers: this.buildTriggers(decls),\n        };\n        // #1179/#1216: each service's products are exactly its project's declared product tags.\n        new RuntimeProductMembership().apply(graph, this.projects);\n        // A destination whose address arrives at RUNTIME is declared on its CONTRACT\n        // (`@externalSystem runtime partner-webhooks`), so it needs no branch of its own here: it is\n        // resolved by the same call every other declared system is, converges on one node when two\n        // services deliver over the same contract, and is watched by the same drift check.\n        const systems = resolveExternalSystems(this.externalSystemDecls, services);\n        attachExternalSystems(graph, systems);\n        this.remoteCalls.attach(graph);\n        return new RuntimeGraphReport(\n            graph,\n            this.warnings,\n            this.problems,\n            [...this.autoHidden].sort(),\n        );\n    }\n\n    /**\n     * The clock- and outside-driven entry points: for every contract a node IMPLEMENTS, each method\n     * declared `cron` or `external` becomes a trigger pointing AT that node.\n     *\n     * Driven off `implements` rather than `uses` on purpose — these have no in-repo caller at all,\n     * which is why they never produced an edge and stayed invisible.\n     */\n    private buildTriggers(decls: ScanDecl[]): RuntimeTrigger[] {\n        const triggers: RuntimeTrigger[] = [];\n        for (const decl of decls) {\n            for (const ref of decl.implementsApis) {\n                for (const method of this.methodsOf(ref.api)) {\n                    if (method.kind !== 'cron' && method.kind !== 'external') continue;\n                    const trigger: RuntimeTrigger = {\n                        kind: method.kind,\n                        api: ref.api,\n                        method: method.name,\n                        service: decl.name,\n                    };\n                    if (method.kind === 'cron') trigger.queueName = method.queueName;\n                    // ONLY for 'external' (a clock needs no vendor name), and only when declared —\n                    // a graph committed before callers were required has none and must still render.\n                    if (method.kind === 'external' && method.caller !== undefined)\n                        trigger.caller = method.caller;\n                    triggers.push(trigger);\n                }\n            }\n        }\n        return triggers.sort(\n            (a: RuntimeTrigger, b: RuntimeTrigger) =>\n                a.kind.localeCompare(b.kind) ||\n                a.api.localeCompare(b.api) ||\n                a.method.localeCompare(b.method) ||\n                a.service.localeCompare(b.service),\n        );\n    }\n\n    /** The committed method table for a contract, or [] when it declares none (e.g. a vendor seam). */\n    private methodsOf(api: string): ApiMethodMeta[] {\n        return this.apiContracts[api]?.methods ?? [];\n    }\n\n    /**\n     * One ScanDecl per RUNTIME NODE (role:server / role:client). A node's effective\n     * relations are its OWN apiRelations PLUS those of every library in its transitive\n     * dependsOn closure: a lib that calls createRpcClient/addRoutes runs inside the\n     * server/client that embeds it, so the relation is attributed to that node — the\n     * lib is never a runtime node. Recursion stops at other nodes (each server/client\n     * owns its own relations). dependsOn is transitively reduced, but reduction\n     * preserves reachability, so the recursive walk still reaches every lib a node\n     * embeds through libraries.\n     */\n    private collectDecls(): ScanDecl[] {\n        const decls: ScanDecl[] = [];\n        for (const name of Object.keys(this.projects).sort()) {\n            if (!this.isNode(name)) continue;\n            const sink = new RelationSink(name);\n            this.collectEffectiveRelations(name, sink, new Set<string>([name]));\n            // EVERY node gets a decl, including one with zero relations. Gating this on \"has at\n            // least one implements/uses\" silently DELETED any deployed server whose work arrives\n            // from outside the repo (a pull subscription): the diagram looked complete while missing\n            // a running service — confidently wrong, not visibly incomplete. isNode() is the whole\n            // test; drawOnGraph:false is the ONE opt-out, and such a node renders as an isolated box.\n            decls.push({\n                name,\n                implementsApis: dedupApiRefs(sortApiRefs(sink.implementsApis)),\n                usesApis: dedupApiRefs(sortApiRefs(sink.usesApis)),\n                implementsVia: sink.implementsVia,\n                markerVia: sink.markerVia,\n            });\n        }\n        return decls;\n    }\n\n    /** True when a project is a runtime node — a server or client app (never a library). */\n    private isNode(name: string): boolean {\n        const role = this.projects[name]?.role;\n        return role === 'server' || role === 'client';\n    }\n\n    /**\n     * True for a role:server that speaks NO webpieces runtime package anywhere in its library\n     * closure AND serves/calls no in-repo contract — a legacy Express/NestJS service sitting in the\n     * same monorepo. This graph is built entirely out of webpieces contracts, so such a service can\n     * only ever draw as a disconnected box: it has no edges by construction and never will.\n     *\n     * It stays a NODE and stays in runtime-dependencies.json (drawOnGraph:false), which is the whole\n     * difference between hiding it and the silent deletion #542 removed — the data view still shows\n     * a deployed role:server, only the picture drops it. Removing it from isNode() instead would\n     * also drop it from nodeByServiceName, so a targeted ClientConfig('orders-manager') from a drawn\n     * service would stop resolving and decay into an unresolved use: a graph that got quietly WORSE\n     * while looking cleaner. The COMPILE-TIME graph (dependencies.html) still draws these projects;\n     * they genuinely exist, and only the runtime drawing claims to show webpieces services.\n     *\n     * role:client is deliberately never auto-hidden: a browser app can legitimately declare no\n     * marker at all, and nothing checks clients for presence the way checkServersPresent checks\n     * servers, so there is no equivalent failure to prevent.\n     */\n    private isNonParticipantServer(decl: ScanDecl): boolean {\n        if (!this.markersKnown) return false;\n        if (this.projects[decl.name]?.role !== 'server') return false;\n        if (decl.markerVia.size > 0) return false;\n        // Belt-and-braces: serving or calling an in-repo contract IS participation, whatever the\n        // package list says. This is what keeps a mechanism we did not anticipate from being blanked.\n        return decl.implementsApis.length === 0 && decl.usesApis.length === 0;\n    }\n\n    /**\n     * Accumulate `name`'s own api relations, then recurse through its LIBRARY deps\n     * (skipping other nodes, which own their own relations). `visited` guards against\n     * re-walking a lib reachable by more than one path (and any cycle).\n     */\n    private collectEffectiveRelations(\n        name: string,\n        sink: RelationSink,\n        visited: Set<string>,\n        includeRelations: boolean = true,\n    ): void {\n        const entry = this.projects[name];\n        if (entry === undefined) return;\n        sink.addMarkers(entry.webpiecesRuntime, name);\n        const relations = entry.apiRelations;\n        if (includeRelations && relations !== undefined) {\n            for (const owner of Object.keys(relations).sort()) {\n                for (const ref of relations[owner].implements) {\n                    this.apiOwners.set(ref.api, owner);\n                    sink.addImplements(ref, ref.declaredVia ?? name);\n                }\n                for (const ref of relations[owner].uses) {\n                    this.apiOwners.set(ref.api, owner);\n                    sink.addUses(ref);\n                }\n            }\n        }\n        for (const dep of entry.dependsOn) {\n            if (visited.has(dep)) continue;\n            visited.add(dep);\n            if (this.isNode(dep)) continue; // another server/client owns its own relations\n            this.collectEffectiveRelations(\n                dep,\n                sink,\n                visited,\n                includeRelations && entry.runtimeComposition !== true,\n            );\n        }\n    }\n\n    /** apiClassName -> { implementedBy, usedBy, type }. */\n    private buildApis(decls: ScanDecl[]): Map<string, RuntimeApi> {\n        const apis = new Map<string, RuntimeApi>();\n        const ensure = (api: string, type: ApiTransport): RuntimeApi => {\n            let entry = apis.get(api);\n            if (!entry) {\n                entry = { implementedBy: [], usedBy: [], type };\n                apis.set(api, entry);\n            }\n            return entry;\n        };\n        for (const decl of decls) {\n            for (const ref of decl.implementsApis)\n                ensure(ref.api, ref.type).implementedBy.push(decl.name);\n            for (const ref of decl.usesApis) ensure(ref.api, ref.type).usedBy.push(decl.name);\n        }\n        for (const api of apis.keys()) {\n            const entry = apis.get(api)!;\n            entry.implementedBy.sort();\n            entry.usedBy = Array.from(new Set(entry.usedBy)).sort();\n            const owner = this.apiOwners.get(api);\n            if (owner !== undefined) entry.owner = owner;\n        }\n        return apis;\n    }\n\n    /** Inferred edges U -> I via api A, split by transport; plus uses with no implementer. */\n    private buildEdges(decls: ScanDecl[], apis: Map<string, RuntimeApi>): EdgeResult {\n        const viaByKey = new Map<string, Set<string>>();\n        const unresolved: RuntimeUnresolved[] = [];\n        const queues = new Map<string, RuntimeQueue>();\n        for (const decl of decls) {\n            for (const ref of decl.usesApis) {\n                // A named target outside this workspace (#1203) is a remote service, not an implementer\n                // to resolve among the nodes and not an unresolved vendor call.\n                const wanted = ref.targetService ?? this.callsServiceFor(decl.name, ref.api);\n                if (this.remoteCalls.claim(decl.name, ref, wanted)) continue;\n                const implementers = apis.get(ref.api)?.implementedBy ?? [];\n                if (implementers.length === 0) {\n                    // Nobody in-repo serves it. For a vendor contract that is the ANSWER, not a gap:\n                    // the call leaves the repo, and the viz terminates it at a dashed vendor node.\n                    unresolved.push({ service: decl.name, api: ref.api });\n                    continue;\n                }\n                for (const target of this.targetsFor(decl.name, ref, implementers)) {\n                    // A service calling ITSELF synchronously is noise; a service ENQUEUEING to\n                    // itself is a real, common topology (deferring its own work), and dropping it\n                    // was hiding the single most interesting thing about a queue.\n                    if (target === decl.name && ref.type !== 'pubsub') continue;\n                    if (ref.type === 'pubsub') {\n                        this.addQueuedEdges(decl.name, target, ref.api, viaByKey, queues);\n                        continue;\n                    }\n                    const key = `${decl.name} ${target} ${ref.type}`;\n                    if (!viaByKey.has(key)) viaByKey.set(key, new Set());\n                    viaByKey.get(key)!.add(ref.api);\n                }\n            }\n        }\n        return {\n            edges: this.edgesFromKeys(viaByKey),\n            unresolved: sortUnresolved(unresolved),\n            queues: sortedQueues(queues),\n        };\n    }\n\n    /**\n     * One edge PER QUEUED METHOD of `api`, plus the queue each flows through.\n     *\n     * Per method rather than per service pair because that is the unit Cloud Tasks and Terraform\n     * create: two services exchanging three queued methods run three independently-configured,\n     * independently-backed-up queues, and collapsing them into one arrow hides which one is stuck.\n     *\n     * A contract with no method table (no `architecture/apis/<Api>.json` for it)\n     * degrades to a single unnamed queue for the pair — the old behavior — rather than vanishing.\n     */\n    private addQueuedEdges(\n        from: string,\n        to: string,\n        api: string,\n        viaByKey: Map<string, Set<string>>,\n        queues: Map<string, RuntimeQueue>,\n    ): void {\n        const queued = this.methodsOf(api).filter((m: ApiMethodMeta) => m.kind === 'cloudtasks');\n        if (queued.length === 0) {\n            const key = `${from} ${to} pubsub `;\n            if (!viaByKey.has(key)) viaByKey.set(key, new Set());\n            viaByKey.get(key)!.add(api);\n            return;\n        }\n        for (const method of queued) {\n            const queueKey = `${api}.${method.name}`;\n            const key = `${from} ${to} pubsub ${queueKey}`;\n            if (!viaByKey.has(key)) viaByKey.set(key, new Set());\n            viaByKey.get(key)!.add(api);\n\n            let queue = queues.get(queueKey);\n            if (queue === undefined) {\n                queue = {\n                    api,\n                    method: method.name,\n                    // Every cloudtasks method carries a queueName; the fallback covers a\n                    // dependencies.json written before queueName became kind-specific.\n                    queueName: method.queueName ?? `${api}-${method.name}`,\n                    producedBy: [],\n                    consumedBy: [],\n                };\n                queues.set(queueKey, queue);\n            }\n            if (!queue.producedBy.includes(from)) queue.producedBy.push(from);\n            if (!queue.consumedBy.includes(to)) queue.consumedBy.push(to);\n        }\n    }\n\n    /**\n     * WHICH implementers this one `uses` reaches. Resolution order (most specific wins):\n     *   1. a literal `ClientConfig` at the call site (`ref.targetService`) — names ONE node;\n     *   2. else the calling project's declared `callsService` (project.json) — for the shared-library\n     *      case where the literal cannot sit at the call site, it lives one indirection away in the app;\n     *   3. else the historical fan-out — the only safe superset — recording WHY, so a fanned-out (i.e.\n     *      possibly fictional) edge can never pass for a derived one.\n     * A named target (1 or 2) that resolves to no module, or to a module that does not serve the\n     * contract, is a PROBLEM (fails the build), never a silent drop.\n     */\n    private targetsFor(user: string, ref: ApiRef, implementers: string[]): string[] {\n        const literal = ref.targetService;\n        if (literal !== undefined)\n            return this.resolveNamedTarget(user, ref, implementers, literal, 'literal');\n\n        const declared = this.callsServiceFor(user, ref.api);\n        if (declared !== undefined)\n            return this.resolveNamedTarget(user, ref, implementers, declared, 'callsService');\n\n        return this.untargetedFanOut(user, ref, implementers);\n    }\n\n    /**\n     * The declared `callsService` target for this node's use of `api`, or undefined when none applies.\n     * A string declaration aims every untargeted use at one service; a map aims per api-class.\n     */\n    private callsServiceFor(user: string, api: string): string | undefined {\n        const declared = this.projects[user]?.callsService;\n        if (declared === undefined) return undefined;\n        if (typeof declared === 'string') return declared;\n        return declared[api];\n    }\n\n    /**\n     * Resolve a NAMED target (from a call-site literal or a project-level `callsService`) to the one\n     * module that serves it. A name no module answers to, or a module that does not serve the\n     * contract, fails the build — the wording names which declaration to fix, `source` deciding it.\n     */\n    private resolveNamedTarget(\n        user: string,\n        ref: ApiRef,\n        implementers: string[],\n        wanted: string,\n        source: 'literal' | 'callsService',\n    ): string[] {\n        const node = this.nodeByServiceName.get(wanted);\n        const served = `${implementers.length} module(s) serve this contract (${implementers.join(', ')})`;\n        if (node === undefined) {\n            this.problems.push(\n                source === 'callsService'\n                    ? `${user} declares metadata.webpieces.callsService '${wanted}' in its project.json, but NO ` +\n                          `module answers to that name. ${served}. Point callsService at a module name, or declare ` +\n                          `metadata.webpieces.serviceName: '${wanted}' on the module that serves \"${ref.api}\".`\n                    : `${user} calls \"${ref.api}\" at service '${wanted}', but NO module answers to that name. ` +\n                          `${served}. Either use the module name, or declare metadata.webpieces.serviceName: ` +\n                          `'${wanted}' on the module that serves it (and translate any environment prefix in ` +\n                          `ClientRegistry.setDeriver, not here).`,\n            );\n            return implementers;\n        }\n        if (!implementers.includes(node)) {\n            const via =\n                source === 'callsService'\n                    ? `${user} declares callsService '${wanted}' (module ${node})`\n                    : `${user} calls \"${ref.api}\" at service '${wanted}' (module ${node})`;\n            this.problems.push(\n                `${via}, but ${node} does NOT serve \"${ref.api}\" — ${implementers.join(', ')} do. At runtime that ` +\n                    `call has nothing to answer it.`,\n            );\n            return implementers;\n        }\n        return [node];\n    }\n\n    /**\n     * A use with no literal client config. One implementer is unambiguous, so it stays silent; more\n     * than one means every edge but one is fiction — exactly the failure this mechanism exists to\n     * stop — so it is reported even though the graph still (conservatively) draws them all.\n     */\n    private untargetedFanOut(user: string, ref: ApiRef, implementers: string[]): string[] {\n        if (implementers.length > 1) {\n            this.warnings.push(\n                `${user} uses \"${ref.api}\" with no literal client config, and ${implementers.length} services ` +\n                    `implement it (${implementers.join(', ')}) — an edge is drawn to EVERY one, so all but one ` +\n                    `are fiction. Name the target: createRpcClient(${ref.api}, new ClientConfig('<serviceName>', ClientRole.SERVER)); ` +\n                    `or, when the client is built in a shared library (no literal can sit at the call site), ` +\n                    `declare metadata.webpieces.callsService: '<serviceName>' on ${user}'s project.json.`,\n            );\n        }\n        return implementers;\n    }\n\n    /**\n     * Rebuild edges from their `\"from to type queue\"` keys. The 4th part is the queue (\"Api.method\")\n     * and is empty for every non-queued edge; it is part of the KEY so two queued methods between\n     * the same pair stay two edges instead of collapsing into one.\n     */\n    private edgesFromKeys(viaByKey: Map<string, Set<string>>): RuntimeEdge[] {\n        const edges: RuntimeEdge[] = [];\n        for (const key of viaByKey.keys()) {\n            const parts = key.split(' ');\n            const edge: RuntimeEdge = {\n                from: parts[0],\n                to: parts[1],\n                via: Array.from(viaByKey.get(key)!).sort(),\n                type: parts[2] as ApiTransport,\n            };\n            if (parts[3] !== undefined && parts[3] !== '') edge.queue = parts[3];\n            edges.push(edge);\n        }\n        edges.sort(\n            (a: RuntimeEdge, b: RuntimeEdge) =>\n                a.from.localeCompare(b.from) ||\n                a.to.localeCompare(b.to) ||\n                (a.type ?? '').localeCompare(b.type ?? '') ||\n                (a.queue ?? '').localeCompare(b.queue ?? ''),\n        );\n        return edges;\n    }\n\n    private buildServices(decls: ScanDecl[], edges: RuntimeEdge[]): Record<string, RuntimeService> {\n        const services: Record<string, RuntimeService> = {};\n        for (const decl of decls) {\n            // A queued hop depends on the QUEUE, not on the peer: the producer hands off and returns,\n            // so naming the consumer here would assert a coupling that does not exist (and would make\n            // a service that defers work to itself look self-dependent).\n            const dependsOn = Array.from(\n                new Set(\n                    edges\n                        .filter((e: RuntimeEdge) => e.from === decl.name)\n                        .map((e: RuntimeEdge) =>\n                            e.queue === undefined ? e.to : `queue:${e.queue}`,\n                        ),\n                ),\n            ).sort();\n            // Keys are written in this order; an undefined value is omitted by JSON.stringify, so\n            // the committed JSON stays clean AND deterministic without conditional assembly.\n            const service: RuntimeService = {\n                level: 0,\n                role: this.projects[decl.name]?.role, // labels a relation-less node for what it IS\n                serviceName: this.projects[decl.name]?.serviceName,\n                callsService: this.projects[decl.name]?.callsService,\n                implements: decl.implementsApis.map((r: ApiRef) => r.api),\n                implementsVia:\n                    decl.implementsVia.size > 0 ? sortedRecord(decl.implementsVia) : undefined,\n                // One api used against two services is two refs but ONE api in this list.\n                uses: Array.from(new Set(decl.usesApis.map((r: ApiRef) => r.api))),\n                dependsOn,\n                wiringUses: decl.usesApis.some((ref) => ref.declaredVia !== undefined)\n                    ? decl.usesApis\n                    : undefined,\n                wiringImplements: decl.implementsApis.some((ref) => ref.declaredVia !== undefined)\n                    ? decl.implementsApis\n                    : undefined,\n            };\n            services[decl.name] = service;\n            // The explicit tag wins and is NOT reported as auto-hidden — somebody asked for it.\n            if (this.hiddenProjects.has(decl.name)) {\n                service.drawOnGraph = false;\n            } else if (this.isNonParticipantServer(decl)) {\n                service.drawOnGraph = false;\n                this.autoHidden.push(decl.name);\n            }\n        }\n        const levels = assignLevels(adjacencyFromEdges(Object.keys(services), edges));\n        for (const name of Object.keys(services)) services[name].level = levels[name] ?? 0;\n        return services;\n    }\n}\n\n/**\n * Derive the runtime graph from dependencies.json's project `apiRelations` — the\n * single source of truth shared by generate + validate. `hiddenProjects`\n * (drawOnGraph:false, defaults to none) are kept in the graph but flagged so the\n * runtime visualizer omits their nodes + edges.\n */\n// webpieces-disable no-function-outside-class -- module entry point for the runtime graph derivation\nexport function deriveRuntimeGraph(\n    projects: EnhancedGraph,\n    hiddenProjects: Set<string> = new Set<string>(),\n    apiContracts: ApiContracts = {},\n): RuntimeGraph {\n    return deriveRuntimeGraphReport(projects, hiddenProjects, apiContracts).graph;\n}\n\n/**\n * The same derivation, plus the warnings it produced (every edge it had to GUESS at). Executors use\n * this form and print the warnings; `deriveRuntimeGraph` is the convenience form for callers that\n * only want the data. The warnings are deliberately kept OUT of runtime-dependencies.json — a graph\n * file that records its own doubts would just get committed and stop being read.\n */\n// webpieces-disable no-function-outside-class -- module entry point for the runtime graph derivation\nexport function deriveRuntimeGraphReport(\n    projects: EnhancedGraph,\n    hiddenProjects: Set<string> = new Set<string>(),\n    apiContracts: ApiContracts = {},\n    externalSystems: ExternalSystemDecls = {},\n    remoteServices: RemoteServices = {},\n): RuntimeGraphReport {\n    return new RuntimeGraphDeriver(\n        projects,\n        hiddenProjects,\n        apiContracts,\n        externalSystems,\n        remoteServices,\n    ).assemble();\n}\n\n// Levels + adjacency live in runtime-graph-levels.ts; re-exported for the same reason the model types\n// and the io helpers above are — one obvious place to import the runtime graph from.\nexport { runtimeAdjacency } from './runtime-graph-levels';\n"]}

package/src/lib/tag-truth.d.ts

@@ -109,8 +109,8 @@ export declare class TagTruthValidator {
     private declaredProducts;
     /**
      * #1179 — a project whose role the rule lists declares at least one well-formed `product:<name>`.
-     * The DECLARED tags are read, never the derived `products`: a server inheriting membership from an
-     * orchestrator that depends on it still states its own product. A malformed tag is not counted here
+     * The DECLARED tags are read straight from the project's tags, not from the graph's `products`
+     * field, so this check does not depend on enrichment order. A malformed tag is not counted here
      * because enrichGraph already fails on it, naming the tag.
      */
     private productTagProblems;