@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.1

package/dist/core/diff/base-state.js

@@ -0,0 +1,209 @@
+/**
+ * The base side of `loam diff`: the fleet as the base commit held it, read
+ * entirely out of git's object store (`./base-git.ts`) and parsed with the
+ * SAME parsers the living files go through — `parseRequirements`,
+ * `openapiFromText`, `asyncapiFromText` — so a base document can never read
+ * differently from the identical bytes sitting on disk.
+ *
+ * CLASSIFICATION is a second, simplified spelling of `repo/tree/walk.ts`'s
+ * rule, and that is a recorded risk, not an accident: the walk classifies a
+ * LIVE filesystem (readdir, symlinks, marker files) and cannot walk a git
+ * ref. What keeps the two honest is sharing the artifact-name table
+ * (`ARTIFACT_FILES`/`isServiceArtifactName` from `repo/paths.ts`) and the
+ * marker name (`SUBSYSTEM_MARKER`) instead of respelling them, and restating
+ * — exactly — the walk's SERVICE branches: (1) a directory holding a service
+ * artifact is a service, marker present or not (artifacts win); (2) the leaf
+ * rule — neither marker nor artifact and nothing beneath (an empty or
+ * not-yet-adopted directory, a lone README.md, a lone `.gitkeep` — which is
+ * the whole content of a directory `loam seed` creates) is a service too; (3) nothing
+ * inside a PLAIN service is classified again (`examples/openapi.yaml` two
+ * levels down is interior, the walk stops there), but a service carrying the
+ * marker BESIDE its artifacts is still descended — minus artifact-named
+ * children like `adrs/` — so the services stranded beneath it stay
+ * enumerated, the walk's marker-misplaced branch. Subsystem and unmarked
+ * group directories need no restating: a flat file listing descends through
+ * them by construction. What is deliberately NOT restated: the walk's
+ * findings (`subsystem.marker-misplaced`, `subsystem.unmarked`,
+ * `subsystem.name-collision`) — those are validate's live diagnostics; here
+ * a name claimed twice suspends the subject (`ambiguous`) instead. If
+ * walk.ts's rule ever changes, this module owes the same change;
+ * test/diff.test.ts pins the visible agreement (subsystem move, not-adopted
+ * leaf, stranded-under-marker).
+ *
+ * Deliberate consequence of joining by leaf directory name: a service MOVED
+ * between subsystems keeps its id and diffs as UNCHANGED. Subsystem placement
+ * is navigation, not identity — SCHEMA's own position, and the reason
+ * `subsystem move` never touches a join key.
+ */
+import { isUtf8 } from "node:buffer";
+import { inOrder } from "../kernel/concurrency.js";
+import { parseRequirements } from "../document/parse.js";
+import { openapiFromText } from "../openapi/doc.js";
+import { asyncapiFromText } from "../asyncapi/read.js";
+import { ARTIFACT_FILES, isServiceArtifactName } from "../repo/paths.js";
+import { SUBSYSTEM_MARKER } from "../repo/tree/marker.js";
+import { listBaseTree, showBaseFile } from "./base-git.js";
+/**
+ * Classify the base tree's file listing into service directories — the module
+ * banner's three restated walk branches, in depth order so every ancestor is
+ * decided before anything beneath it.
+ */
+function classifyBaseDirs(paths) {
+    const fileChildren = new Map();
+    const dirChildren = new Map();
+    // Directories nothing VISIBLE lives in, so neither map above names them.
+    const bare = new Set();
+    for (const path of paths) {
+        const all = path.split("/");
+        // Dot-named entries are invisible to the live walk — but the walk still
+        // SEES the directory holding them, because readdir discovered the
+        // directory itself and only its CONTENTS are filtered (walk.ts's
+        // `subdirNames` and `visitDir`). So cut the path at its first dot-named
+        // segment rather than discarding the whole path: everything above the cut
+        // stays a visible directory, the cut segment and everything beneath it
+        // stay invisible. Discarding it outright hid every directory whose only
+        // file is dot-named — which is exactly what `loam seed` writes into a
+        // service directory it creates (`.gitkeep`, and nothing else), so a seeded
+        // service was absent from the base and diffed as `diff.service-added`
+        // against the unchanged tree that had just been committed.
+        const cut = all.findIndex((s) => s.startsWith(".") || s === "");
+        const segments = cut === -1 ? all : all.slice(0, cut);
+        // Only a whole path ends in a file; a cut one is a pure directory chain.
+        const fileAt = cut === -1 ? segments.length - 1 : -1;
+        for (let i = 1; i < segments.length; i += 1) {
+            const dir = segments.slice(0, i).join("/");
+            const child = segments[i];
+            const into = i === fileAt ? fileChildren : dirChildren;
+            let set = into.get(dir);
+            if (set === undefined)
+                into.set(dir, (set = new Set()));
+            set.add(child);
+        }
+        if (fileAt === -1 && segments.length > 1)
+            bare.add(segments.join("/"));
+    }
+    const hasMarker = (dir) => fileChildren.get(dir)?.has(SUBSYSTEM_MARKER) === true;
+    const hasArtifact = (dir) => [...(fileChildren.get(dir) ?? [])].some((f) => isServiceArtifactName(f, "file")) ||
+        [...(dirChildren.get(dir) ?? [])].some((d) => isServiceArtifactName(d, "dir"));
+    // The walk's leaf rule: neither marker nor artifact and nothing beneath is a
+    // service. (A truly EMPTY directory is unrepresentable in a git tree, so at
+    // the base this arm means "no visible entry of ours" — files none of which
+    // are artifacts, or nothing but dot-named entries, the `loam seed` shape.)
+    const isLeafService = (dir) => !hasMarker(dir) && !hasArtifact(dir) && !dirChildren.has(dir);
+    const candidates = [...new Set([...fileChildren.keys(), ...dirChildren.keys(), ...bare])]
+        .filter((dir) => dir !== "services" && dir.startsWith("services/"))
+        .filter((dir) => hasArtifact(dir) || isLeafService(dir))
+        .sort((a, b) => {
+        const depth = a.split("/").length - b.split("/").length;
+        return depth !== 0 ? depth : a < b ? -1 : 1;
+    });
+    const accepted = [];
+    const acceptedDirs = new Set();
+    // Is this candidate INTERIOR to the nearest service already accepted above
+    // it? A plain service swallows everything beneath (the walk stops there); a
+    // marker-beside-artifacts service is descended except through its
+    // artifact-named children (`adrs/`), so a service stranded under it stays.
+    const interior = (segments) => {
+        for (let i = segments.length - 1; i >= 2; i -= 1) {
+            const ancestor = segments.slice(0, i).join("/");
+            if (!acceptedDirs.has(ancestor))
+                continue;
+            return hasMarker(ancestor) ? isServiceArtifactName(segments[i], "dir") : true;
+        }
+        return false;
+    };
+    for (const dir of candidates) {
+        const segments = dir.split("/");
+        if (interior(segments))
+            continue;
+        acceptedDirs.add(dir);
+        accepted.push({ id: segments[segments.length - 1], dir, files: fileChildren.get(dir) ?? new Set() });
+    }
+    return { dirs: accepted, ambiguous: collisions(accepted) };
+}
+function collisions(dirs) {
+    const byId = new Map();
+    for (const d of dirs)
+        byId.set(d.id, [...(byId.get(d.id) ?? []), d.dir]);
+    return new Map([...byId].filter(([, claimants]) => claimants.length > 1));
+}
+/**
+ * Lift one fetched file into an axis state through its parser. Absence is the
+ * listing's answer, a `show` failure is per-subject containment, and only
+ * then do the bytes reach a parser.
+ */
+function axisFrom(raw, parse) {
+    if (raw === null)
+        return { kind: "absent" };
+    if (raw.read.kind === "failed")
+        return { kind: "unreadable", path: raw.rel, error: raw.read.detail };
+    return parse(raw.rel, raw.read.bytes);
+}
+/**
+ * The same refusal `readOpenapi`/`readAsyncapi`/`decodeDocument` make on the
+ * living side: non-UTF-8 bytes would be silently rewritten as U+FFFD by
+ * `toString`, and a document nobody wrote must not be graded.
+ */
+function decodeBase(path, bytes) {
+    if (!isUtf8(bytes))
+        return { unreadable: { kind: "unreadable", path, error: "file is not valid UTF-8" } };
+    return { text: bytes.toString("utf8") };
+}
+function specState(path, bytes) {
+    const decoded = decodeBase(path, bytes);
+    if ("unreadable" in decoded)
+        return decoded.unreadable;
+    try {
+        return { kind: "read", value: parseRequirements(decoded.text) };
+    }
+    catch (e) {
+        return { kind: "unreadable", path, error: e instanceof Error ? e.message : String(e) };
+    }
+}
+function openapiState(path, bytes) {
+    const decoded = decodeBase(path, bytes);
+    if ("unreadable" in decoded)
+        return decoded.unreadable;
+    const doc = openapiFromText(decoded.text);
+    return doc.unreadable
+        ? { kind: "unreadable", path, error: doc.error ?? "not a readable OpenAPI document" }
+        : { kind: "read", value: doc.ops.filter((op) => !op.remove) };
+}
+function asyncapiState(path, bytes) {
+    const decoded = decodeBase(path, bytes);
+    if ("unreadable" in decoded)
+        return decoded.unreadable;
+    const doc = asyncapiFromText(decoded.text);
+    return doc.unreadable
+        ? { kind: "unreadable", path, error: doc.error ?? "not a readable AsyncAPI document" }
+        : { kind: "read", value: doc.messages.filter((m) => m.remove !== true) };
+}
+/** One base service's four axes. Sequential INSIDE the service on purpose: the pool below rations children at the service grain, and four spawns per in-flight worker would multiply past the cap it exists to hold. */
+async function readBaseService(base, d) {
+    const fetch = async (file) => d.files.has(file) ? { rel: `${d.dir}/${file}`, read: await showBaseFile(base, `${d.dir}/${file}`) } : null;
+    return {
+        id: d.id,
+        dir: d.dir,
+        spec: axisFrom(await fetch(ARTIFACT_FILES.spec), specState),
+        archSpec: axisFrom(await fetch(ARTIFACT_FILES.archSpec), specState),
+        openapi: axisFrom(await fetch(ARTIFACT_FILES.openapi), openapiState),
+        asyncapi: axisFrom(await fetch(ARTIFACT_FILES.asyncapi), asyncapiState),
+    };
+}
+/**
+ * The whole base fleet. `failed` only when git cannot LIST the tree — the
+ * whole-diff refusal; a single file that cannot be shown or parsed degrades
+ * its own subject's axis to `unreadable` and nothing else.
+ */
+export async function readBaseFleet(base) {
+    const listing = await listBaseTree(base);
+    if (listing.kind === "failed")
+        return listing;
+    const { dirs, ambiguous } = classifyBaseDirs(listing.paths);
+    const sorted = [...dirs].sort((a, b) => (a.id < b.id ? -1 : 1)).filter((d) => !ambiguous.has(d.id));
+    // Pooled, ordered reads: bounded children in flight, results by input index,
+    // so the same base state always assembles the same fleet.
+    const states = await inOrder(sorted, (d) => readBaseService(base, d));
+    return { kind: "ok", fleet: { services: new Map(states.map((s) => [s.id, s])), ambiguous } };
+}
+//# sourceMappingURL=base-state.js.map

package/dist/core/diff/base-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-state.js","sourceRoot":"","sources":["../../../src/core/diff/base-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAkB,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAqB,MAAM,eAAe,CAAC;AAyD9E;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAe;IACvC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,wEAAwE;QACxE,kEAAkE;QAClE,iEAAiE;QACjE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,2EAA2E;QAC3E,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,yEAAyE;QACzE,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;YACvD,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,GAAG,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC;IAClG,MAAM,WAAW,GAAG,CAAC,GAAW,EAAW,EAAE,CAC3C,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,aAAa,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9G,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;SACtF,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;SACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACxD,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACL,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,2EAA2E;IAC3E,4EAA4E;IAC5E,kEAAkE;IAClE,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,CAAC,QAAkB,EAAW,EAAE;QAC/C,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC1C,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,IAAe;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAKD;;;;GAIG;AACH,SAAS,QAAQ,CAAI,GAAY,EAAE,KAAoD;IACrF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5C,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrG,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;IAC1G,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IACvD,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,UAAU;QACnB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,iCAAiC,EAAE;QACrF,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IACvD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,UAAU;QACnB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,kCAAkC,EAAE;QACtF,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,wNAAwN;AACxN,KAAK,UAAU,eAAe,CAAC,IAAkB,EAAE,CAAU;IAC3D,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE,CACrD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7G,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;QAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;QACnE,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;QACpE,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAkB;IACpD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpG,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC;AAC/F,CAAC","sourcesContent":["/**\n * The base side of `loam diff`: the fleet as the base commit held it, read\n * entirely out of git's object store (`./base-git.ts`) and parsed with the\n * SAME parsers the living files go through — `parseRequirements`,\n * `openapiFromText`, `asyncapiFromText` — so a base document can never read\n * differently from the identical bytes sitting on disk.\n *\n * CLASSIFICATION is a second, simplified spelling of `repo/tree/walk.ts`'s\n * rule, and that is a recorded risk, not an accident: the walk classifies a\n * LIVE filesystem (readdir, symlinks, marker files) and cannot walk a git\n * ref. What keeps the two honest is sharing the artifact-name table\n * (`ARTIFACT_FILES`/`isServiceArtifactName` from `repo/paths.ts`) and the\n * marker name (`SUBSYSTEM_MARKER`) instead of respelling them, and restating\n * — exactly — the walk's SERVICE branches: (1) a directory holding a service\n * artifact is a service, marker present or not (artifacts win); (2) the leaf\n * rule — neither marker nor artifact and nothing beneath (an empty or\n * not-yet-adopted directory, a lone README.md, a lone `.gitkeep` — which is\n * the whole content of a directory `loam seed` creates) is a service too; (3) nothing\n * inside a PLAIN service is classified again (`examples/openapi.yaml` two\n * levels down is interior, the walk stops there), but a service carrying the\n * marker BESIDE its artifacts is still descended — minus artifact-named\n * children like `adrs/` — so the services stranded beneath it stay\n * enumerated, the walk's marker-misplaced branch. Subsystem and unmarked\n * group directories need no restating: a flat file listing descends through\n * them by construction. What is deliberately NOT restated: the walk's\n * findings (`subsystem.marker-misplaced`, `subsystem.unmarked`,\n * `subsystem.name-collision`) — those are validate's live diagnostics; here\n * a name claimed twice suspends the subject (`ambiguous`) instead. If\n * walk.ts's rule ever changes, this module owes the same change;\n * test/diff.test.ts pins the visible agreement (subsystem move, not-adopted\n * leaf, stranded-under-marker).\n *\n * Deliberate consequence of joining by leaf directory name: a service MOVED\n * between subsystems keeps its id and diffs as UNCHANGED. Subsystem placement\n * is navigation, not identity — SCHEMA's own position, and the reason\n * `subsystem move` never touches a join key.\n */\nimport { isUtf8 } from \"node:buffer\";\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport { parseRequirements } from \"../document/parse.js\";\nimport type { Requirement } from \"../document/spec.js\";\nimport { openapiFromText, type Operation } from \"../openapi/doc.js\";\nimport { asyncapiFromText } from \"../asyncapi/read.js\";\nimport type { EventMessage } from \"../asyncapi/model.js\";\nimport { ARTIFACT_FILES, isServiceArtifactName } from \"../repo/paths.js\";\nimport { SUBSYSTEM_MARKER } from \"../repo/tree/marker.js\";\nimport { listBaseTree, showBaseFile, type ResolvedBase } from \"./base-git.js\";\n\n/**\n * One artifact's state on one side of the diff. `unreadable` is the\n * containment arm: the file exists but could not be read as its kind, so\n * every finding on this axis for this subject is SUSPENDED — \"nobody could\n * look\" must never grade as \"nothing is there\", in either direction.\n */\nexport type AxisState<T> =\n  | { kind: \"absent\" }\n  | { kind: \"read\"; value: T }\n  | { kind: \"unreadable\"; path: string; error: string };\n\n/** The keys of a service state that hold requirement-bearing documents. */\nexport type SpecAxisKey = \"spec\" | \"archSpec\";\n\n/**\n * One service on one side of the diff — the same shape for the base ref and\n * the working tree (`./current-state.ts` builds the other), which is what\n * lets `./semantic.ts` join the two without caring which side came from git.\n */\nexport interface ServiceState {\n  id: string;\n  /** Docs-relative directory with forward slashes, e.g. `services/billing/payment-service`. */\n  dir: string;\n  spec: AxisState<Requirement[]>;\n  /** Read on both sides for the `Consumes:` join — the outbox requirement lives here as often as in spec.md (core/coherence/events/lookups.ts's lesson). */\n  archSpec: AxisState<Requirement[]>;\n  /** Operations with `x-loam-remove` markers filtered out: a marker is bookkeeping, never a callable operation. */\n  openapi: AxisState<Operation[]>;\n  /** Messages with removal markers filtered out, for the same reason. */\n  asyncapi: AxisState<EventMessage[]>;\n}\n\nexport interface BaseFleet {\n  /** By service id, insertion-sorted by id — deterministic output depends on it. */\n  services: Map<string, ServiceState>;\n  /**\n   * Ids claimed by MORE than one base directory. The live walk grades this\n   * `subsystem.name-collision`; here the id's base state is unanswerable, so\n   * the subject is carried with every axis suspended rather than one claimant\n   * silently winning the join.\n   */\n  ambiguous: Map<string, string[]>;\n}\n\nexport type BaseFleetRead =\n  | { kind: \"ok\"; fleet: BaseFleet }\n  | { kind: \"failed\"; detail: string };\n\n/** A classified base service directory and which artifact files the base tree listed in it. */\ninterface BaseDir {\n  id: string;\n  dir: string;\n  files: Set<string>;\n}\n\n/**\n * Classify the base tree's file listing into service directories — the module\n * banner's three restated walk branches, in depth order so every ancestor is\n * decided before anything beneath it.\n */\nfunction classifyBaseDirs(paths: string[]): { dirs: BaseDir[]; ambiguous: Map<string, string[]> } {\n  const fileChildren = new Map<string, Set<string>>();\n  const dirChildren = new Map<string, Set<string>>();\n  // Directories nothing VISIBLE lives in, so neither map above names them.\n  const bare = new Set<string>();\n  for (const path of paths) {\n    const all = path.split(\"/\");\n    // Dot-named entries are invisible to the live walk — but the walk still\n    // SEES the directory holding them, because readdir discovered the\n    // directory itself and only its CONTENTS are filtered (walk.ts's\n    // `subdirNames` and `visitDir`). So cut the path at its first dot-named\n    // segment rather than discarding the whole path: everything above the cut\n    // stays a visible directory, the cut segment and everything beneath it\n    // stay invisible. Discarding it outright hid every directory whose only\n    // file is dot-named — which is exactly what `loam seed` writes into a\n    // service directory it creates (`.gitkeep`, and nothing else), so a seeded\n    // service was absent from the base and diffed as `diff.service-added`\n    // against the unchanged tree that had just been committed.\n    const cut = all.findIndex((s) => s.startsWith(\".\") || s === \"\");\n    const segments = cut === -1 ? all : all.slice(0, cut);\n    // Only a whole path ends in a file; a cut one is a pure directory chain.\n    const fileAt = cut === -1 ? segments.length - 1 : -1;\n    for (let i = 1; i < segments.length; i += 1) {\n      const dir = segments.slice(0, i).join(\"/\");\n      const child = segments[i]!;\n      const into = i === fileAt ? fileChildren : dirChildren;\n      let set = into.get(dir);\n      if (set === undefined) into.set(dir, (set = new Set()));\n      set.add(child);\n    }\n    if (fileAt === -1 && segments.length > 1) bare.add(segments.join(\"/\"));\n  }\n  const hasMarker = (dir: string): boolean => fileChildren.get(dir)?.has(SUBSYSTEM_MARKER) === true;\n  const hasArtifact = (dir: string): boolean =>\n    [...(fileChildren.get(dir) ?? [])].some((f) => isServiceArtifactName(f, \"file\")) ||\n    [...(dirChildren.get(dir) ?? [])].some((d) => isServiceArtifactName(d, \"dir\"));\n  // The walk's leaf rule: neither marker nor artifact and nothing beneath is a\n  // service. (A truly EMPTY directory is unrepresentable in a git tree, so at\n  // the base this arm means \"no visible entry of ours\" — files none of which\n  // are artifacts, or nothing but dot-named entries, the `loam seed` shape.)\n  const isLeafService = (dir: string): boolean => !hasMarker(dir) && !hasArtifact(dir) && !dirChildren.has(dir);\n  const candidates = [...new Set([...fileChildren.keys(), ...dirChildren.keys(), ...bare])]\n    .filter((dir) => dir !== \"services\" && dir.startsWith(\"services/\"))\n    .filter((dir) => hasArtifact(dir) || isLeafService(dir))\n    .sort((a, b) => {\n      const depth = a.split(\"/\").length - b.split(\"/\").length;\n      return depth !== 0 ? depth : a < b ? -1 : 1;\n    });\n  const accepted: BaseDir[] = [];\n  const acceptedDirs = new Set<string>();\n  // Is this candidate INTERIOR to the nearest service already accepted above\n  // it? A plain service swallows everything beneath (the walk stops there); a\n  // marker-beside-artifacts service is descended except through its\n  // artifact-named children (`adrs/`), so a service stranded under it stays.\n  const interior = (segments: string[]): boolean => {\n    for (let i = segments.length - 1; i >= 2; i -= 1) {\n      const ancestor = segments.slice(0, i).join(\"/\");\n      if (!acceptedDirs.has(ancestor)) continue;\n      return hasMarker(ancestor) ? isServiceArtifactName(segments[i]!, \"dir\") : true;\n    }\n    return false;\n  };\n  for (const dir of candidates) {\n    const segments = dir.split(\"/\");\n    if (interior(segments)) continue;\n    acceptedDirs.add(dir);\n    accepted.push({ id: segments[segments.length - 1]!, dir, files: fileChildren.get(dir) ?? new Set() });\n  }\n  return { dirs: accepted, ambiguous: collisions(accepted) };\n}\n\nfunction collisions(dirs: BaseDir[]): Map<string, string[]> {\n  const byId = new Map<string, string[]>();\n  for (const d of dirs) byId.set(d.id, [...(byId.get(d.id) ?? []), d.dir]);\n  return new Map([...byId].filter(([, claimants]) => claimants.length > 1));\n}\n\n/** One shown base file, or `null` for a file the base tree never listed. */\ntype Fetched = { rel: string; read: Awaited<ReturnType<typeof showBaseFile>> } | null;\n\n/**\n * Lift one fetched file into an axis state through its parser. Absence is the\n * listing's answer, a `show` failure is per-subject containment, and only\n * then do the bytes reach a parser.\n */\nfunction axisFrom<T>(raw: Fetched, parse: (path: string, bytes: Buffer) => AxisState<T>): AxisState<T> {\n  if (raw === null) return { kind: \"absent\" };\n  if (raw.read.kind === \"failed\") return { kind: \"unreadable\", path: raw.rel, error: raw.read.detail };\n  return parse(raw.rel, raw.read.bytes);\n}\n\n/**\n * The same refusal `readOpenapi`/`readAsyncapi`/`decodeDocument` make on the\n * living side: non-UTF-8 bytes would be silently rewritten as U+FFFD by\n * `toString`, and a document nobody wrote must not be graded.\n */\nfunction decodeBase(path: string, bytes: Buffer): { text: string } | { unreadable: AxisState<never> } {\n  if (!isUtf8(bytes)) return { unreadable: { kind: \"unreadable\", path, error: \"file is not valid UTF-8\" } };\n  return { text: bytes.toString(\"utf8\") };\n}\n\nfunction specState(path: string, bytes: Buffer): AxisState<Requirement[]> {\n  const decoded = decodeBase(path, bytes);\n  if (\"unreadable\" in decoded) return decoded.unreadable;\n  try {\n    return { kind: \"read\", value: parseRequirements(decoded.text) };\n  } catch (e) {\n    return { kind: \"unreadable\", path, error: e instanceof Error ? e.message : String(e) };\n  }\n}\n\nfunction openapiState(path: string, bytes: Buffer): AxisState<Operation[]> {\n  const decoded = decodeBase(path, bytes);\n  if (\"unreadable\" in decoded) return decoded.unreadable;\n  const doc = openapiFromText(decoded.text);\n  return doc.unreadable\n    ? { kind: \"unreadable\", path, error: doc.error ?? \"not a readable OpenAPI document\" }\n    : { kind: \"read\", value: doc.ops.filter((op) => !op.remove) };\n}\n\nfunction asyncapiState(path: string, bytes: Buffer): AxisState<EventMessage[]> {\n  const decoded = decodeBase(path, bytes);\n  if (\"unreadable\" in decoded) return decoded.unreadable;\n  const doc = asyncapiFromText(decoded.text);\n  return doc.unreadable\n    ? { kind: \"unreadable\", path, error: doc.error ?? \"not a readable AsyncAPI document\" }\n    : { kind: \"read\", value: doc.messages.filter((m) => m.remove !== true) };\n}\n\n/** One base service's four axes. Sequential INSIDE the service on purpose: the pool below rations children at the service grain, and four spawns per in-flight worker would multiply past the cap it exists to hold. */\nasync function readBaseService(base: ResolvedBase, d: BaseDir): Promise<ServiceState> {\n  const fetch = async (file: string): Promise<Fetched> =>\n    d.files.has(file) ? { rel: `${d.dir}/${file}`, read: await showBaseFile(base, `${d.dir}/${file}`) } : null;\n  return {\n    id: d.id,\n    dir: d.dir,\n    spec: axisFrom(await fetch(ARTIFACT_FILES.spec), specState),\n    archSpec: axisFrom(await fetch(ARTIFACT_FILES.archSpec), specState),\n    openapi: axisFrom(await fetch(ARTIFACT_FILES.openapi), openapiState),\n    asyncapi: axisFrom(await fetch(ARTIFACT_FILES.asyncapi), asyncapiState),\n  };\n}\n\n/**\n * The whole base fleet. `failed` only when git cannot LIST the tree — the\n * whole-diff refusal; a single file that cannot be shown or parsed degrades\n * its own subject's axis to `unreadable` and nothing else.\n */\nexport async function readBaseFleet(base: ResolvedBase): Promise<BaseFleetRead> {\n  const listing = await listBaseTree(base);\n  if (listing.kind === \"failed\") return listing;\n  const { dirs, ambiguous } = classifyBaseDirs(listing.paths);\n  const sorted = [...dirs].sort((a, b) => (a.id < b.id ? -1 : 1)).filter((d) => !ambiguous.has(d.id));\n  // Pooled, ordered reads: bounded children in flight, results by input index,\n  // so the same base state always assembles the same fleet.\n  const states = await inOrder(sorted, (d) => readBaseService(base, d));\n  return { kind: \"ok\", fleet: { services: new Map(states.map((s) => [s.id, s])), ambiguous } };\n}\n"]}

package/dist/core/diff/current-state.js

@@ -0,0 +1,96 @@
+/**
+ * The working-tree side of `loam diff`: the fleet as it stands on disk, read
+ * through the invocation's `FleetContext` into the SAME `ServiceState` shape
+ * `./base-state.ts` builds from git — one shape, so `./semantic.ts` joins the
+ * two sides without caring which one came from the object store.
+ *
+ * Containment discipline, per subject and per axis: an artifact that EXISTS
+ * but cannot be read (non-UTF-8 spec bytes, a directory sitting where a file
+ * belongs, broken contract YAML) degrades that one axis to `unreadable` with
+ * its path — never a thrown enumeration, never an empty list a diff would
+ * read as "everything was removed". Absence stays absence: a file deleted
+ * between the existence probe and the read is classified by its errno
+ * (ENOENT), the same TOCTOU discipline `loadConfig` documents.
+ */
+import { existsSync } from "node:fs";
+import { repoPath } from "../envelope/json.js";
+import { servicePathsAt } from "../repo/paths.js";
+import { inOrder } from "../kernel/concurrency.js";
+function readFailure(e, rel) {
+    const errno = e;
+    if (errno.code === "ENOENT")
+        return { kind: "absent" };
+    return { kind: "unreadable", path: rel, error: e instanceof Error ? e.message : String(e) };
+}
+/** One spec-axis file (`spec.md` / `arch.spec.md`) as parsed requirements. */
+async function requirementsAxis(context, abs, rel) {
+    if (!existsSync(abs))
+        return { kind: "absent" };
+    try {
+        return { kind: "read", value: await context.readRequirements(abs) };
+    }
+    catch (e) {
+        // decodeDocument's non-UTF-8 refusal lands here too: bytes that would
+        // parse as zero requirements must suspend the axis, not empty it.
+        return readFailure(e, rel);
+    }
+}
+async function openapiAxis(context, abs, rel) {
+    if (!existsSync(abs))
+        return { kind: "absent" };
+    try {
+        const doc = await context.readOpenapi(abs);
+        return doc.unreadable
+            ? { kind: "unreadable", path: rel, error: doc.error ?? "not a readable OpenAPI document" }
+            : { kind: "read", value: doc.ops.filter((op) => !op.remove) };
+    }
+    catch (e) {
+        return readFailure(e, rel);
+    }
+}
+async function asyncapiAxis(context, abs, rel) {
+    if (!existsSync(abs))
+        return { kind: "absent" };
+    try {
+        const doc = await context.readAsyncapi(abs);
+        return doc.unreadable
+            ? { kind: "unreadable", path: rel, error: doc.error ?? "not a readable AsyncAPI document" }
+            : { kind: "read", value: doc.messages.filter((m) => m.remove !== true) };
+    }
+    catch (e) {
+        return readFailure(e, rel);
+    }
+}
+/**
+ * The current fleet, one `ServiceState` per enumerated service. The
+ * enumeration itself (the tree walk) may throw `DocsRepoUnavailableError` —
+ * that is the whole-repo refusal `docsRepoReady` fronts, not a per-subject
+ * degradation, and it stays a throw for the command layer to map.
+ */
+export async function readCurrentFleet(docsDir, context) {
+    const entries = await context.listServices(docsDir);
+    const states = await inOrder(entries, async (entry) => {
+        const paths = servicePathsAt(entry.dir);
+        return {
+            id: entry.id,
+            dir: repoPath(docsDir, entry.dir),
+            spec: await requirementsAxis(context, paths.spec, repoPath(docsDir, paths.spec)),
+            archSpec: await requirementsAxis(context, paths.archSpec, repoPath(docsDir, paths.archSpec)),
+            openapi: await openapiAxis(context, paths.openapi, repoPath(docsDir, paths.openapi)),
+            asyncapi: await asyncapiAxis(context, paths.asyncapi, repoPath(docsDir, paths.asyncapi)),
+        };
+    });
+    const ambiguous = currentCollisions(states);
+    return {
+        services: new Map(states.filter((s) => !ambiguous.has(s.id)).map((s) => [s.id, s])),
+        ambiguous,
+    };
+}
+/** Ids claimed by more than one enumerated directory, with every claimant named. */
+function currentCollisions(states) {
+    const byId = new Map();
+    for (const s of states)
+        byId.set(s.id, [...(byId.get(s.id) ?? []), s.dir]);
+    return new Map([...byId].filter(([, dirs]) => dirs.length > 1));
+}
+//# sourceMappingURL=current-state.js.map

package/dist/core/diff/current-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-state.js","sourceRoot":"","sources":["../../../src/core/diff/current-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAIrC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAkBnD,SAAS,WAAW,CAAC,CAAU,EAAE,GAAW;IAC1C,MAAM,KAAK,GAAG,CAA0B,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACvD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,gBAAgB,CAAC,OAAqB,EAAE,GAAW,EAAE,GAAW;IAC7E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;IACtE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,sEAAsE;QACtE,kEAAkE;QAClE,OAAO,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE,GAAW,EAAE,GAAW;IACxE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,UAAU;YACnB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,iCAAiC,EAAE;YAC1F,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE,GAAW,EAAE,GAAW;IACzE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,UAAU;YACnB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,kCAAkC,EAAE;YAC3F,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,OAAqB;IAC5E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAyB,EAAE;QAC3E,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC;YACjC,IAAI,EAAE,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAChF,QAAQ,EAAE,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5F,OAAO,EAAE,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACpF,QAAQ,EAAE,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;SACzF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO;QACL,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,SAAS;KACV,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,iBAAiB,CAAC,MAA+B;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC","sourcesContent":["/**\n * The working-tree side of `loam diff`: the fleet as it stands on disk, read\n * through the invocation's `FleetContext` into the SAME `ServiceState` shape\n * `./base-state.ts` builds from git — one shape, so `./semantic.ts` joins the\n * two sides without caring which one came from the object store.\n *\n * Containment discipline, per subject and per axis: an artifact that EXISTS\n * but cannot be read (non-UTF-8 spec bytes, a directory sitting where a file\n * belongs, broken contract YAML) degrades that one axis to `unreadable` with\n * its path — never a thrown enumeration, never an empty list a diff would\n * read as \"everything was removed\". Absence stays absence: a file deleted\n * between the existence probe and the read is classified by its errno\n * (ENOENT), the same TOCTOU discipline `loadConfig` documents.\n */\nimport { existsSync } from \"node:fs\";\nimport type { Requirement } from \"../document/spec.js\";\nimport type { Operation } from \"../openapi/doc.js\";\nimport type { EventMessage } from \"../asyncapi/model.js\";\nimport { repoPath } from \"../envelope/json.js\";\nimport { servicePathsAt } from \"../repo/paths.js\";\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { AxisState, ServiceState } from \"./base-state.js\";\n\nexport interface CurrentFleet {\n  /** By service id, in the enumeration's (sorted-walk) order. Ids the `ambiguous` map claims are excluded. */\n  services: Map<string, ServiceState>;\n  /**\n   * Ids more than one working-tree directory claims — `subsystem.name-collision`'s\n   * live shape, which validate diagnoses. Diffing either claimant would pick a\n   * winner nobody chose (a `new Map` collapse here used to keep the LAST one and\n   * fabricate a whole change story about a service that never moved), so the\n   * subject is suspended exactly as the base side's `ambiguous` map suspends it.\n   */\n  ambiguous: Map<string, string[]>;\n}\n\nfunction readFailure(e: unknown, rel: string): { kind: \"absent\" } | { kind: \"unreadable\"; path: string; error: string } {\n  const errno = e as NodeJS.ErrnoException;\n  if (errno.code === \"ENOENT\") return { kind: \"absent\" };\n  return { kind: \"unreadable\", path: rel, error: e instanceof Error ? e.message : String(e) };\n}\n\n/** One spec-axis file (`spec.md` / `arch.spec.md`) as parsed requirements. */\nasync function requirementsAxis(context: FleetContext, abs: string, rel: string): Promise<AxisState<Requirement[]>> {\n  if (!existsSync(abs)) return { kind: \"absent\" };\n  try {\n    return { kind: \"read\", value: await context.readRequirements(abs) };\n  } catch (e) {\n    // decodeDocument's non-UTF-8 refusal lands here too: bytes that would\n    // parse as zero requirements must suspend the axis, not empty it.\n    return readFailure(e, rel);\n  }\n}\n\nasync function openapiAxis(context: FleetContext, abs: string, rel: string): Promise<AxisState<Operation[]>> {\n  if (!existsSync(abs)) return { kind: \"absent\" };\n  try {\n    const doc = await context.readOpenapi(abs);\n    return doc.unreadable\n      ? { kind: \"unreadable\", path: rel, error: doc.error ?? \"not a readable OpenAPI document\" }\n      : { kind: \"read\", value: doc.ops.filter((op) => !op.remove) };\n  } catch (e) {\n    return readFailure(e, rel);\n  }\n}\n\nasync function asyncapiAxis(context: FleetContext, abs: string, rel: string): Promise<AxisState<EventMessage[]>> {\n  if (!existsSync(abs)) return { kind: \"absent\" };\n  try {\n    const doc = await context.readAsyncapi(abs);\n    return doc.unreadable\n      ? { kind: \"unreadable\", path: rel, error: doc.error ?? \"not a readable AsyncAPI document\" }\n      : { kind: \"read\", value: doc.messages.filter((m) => m.remove !== true) };\n  } catch (e) {\n    return readFailure(e, rel);\n  }\n}\n\n/**\n * The current fleet, one `ServiceState` per enumerated service. The\n * enumeration itself (the tree walk) may throw `DocsRepoUnavailableError` —\n * that is the whole-repo refusal `docsRepoReady` fronts, not a per-subject\n * degradation, and it stays a throw for the command layer to map.\n */\nexport async function readCurrentFleet(docsDir: DocsDir, context: FleetContext): Promise<CurrentFleet> {\n  const entries = await context.listServices(docsDir);\n  const states = await inOrder(entries, async (entry): Promise<ServiceState> => {\n    const paths = servicePathsAt(entry.dir);\n    return {\n      id: entry.id,\n      dir: repoPath(docsDir, entry.dir),\n      spec: await requirementsAxis(context, paths.spec, repoPath(docsDir, paths.spec)),\n      archSpec: await requirementsAxis(context, paths.archSpec, repoPath(docsDir, paths.archSpec)),\n      openapi: await openapiAxis(context, paths.openapi, repoPath(docsDir, paths.openapi)),\n      asyncapi: await asyncapiAxis(context, paths.asyncapi, repoPath(docsDir, paths.asyncapi)),\n    };\n  });\n  const ambiguous = currentCollisions(states);\n  return {\n    services: new Map(states.filter((s) => !ambiguous.has(s.id)).map((s) => [s.id, s])),\n    ambiguous,\n  };\n}\n\n/** Ids claimed by more than one enumerated directory, with every claimant named. */\nfunction currentCollisions(states: readonly ServiceState[]): Map<string, string[]> {\n  const byId = new Map<string, string[]>();\n  for (const s of states) byId.set(s.id, [...(byId.get(s.id) ?? []), s.dir]);\n  return new Map([...byId].filter(([, dirs]) => dirs.length > 1));\n}\n"]}

package/dist/core/diff/scope/changed-paths.js

@@ -0,0 +1,188 @@
+/**
+ * Which targets a base git ref puts in scope — the narrowing behind
+ * `loam validate --all --base <ref>`.
+ *
+ * The defect this exists for: a partly-adopted fleet has no CI setting that is
+ * both passing today and tightening over time. `--all` is green over eleven
+ * undocumented services (they warn, and warnings do not gate) and `--strict` is
+ * red from the first minute of adoption until the last boundary is written, so
+ * a team installs either a gate that never notices adoption stalling at 8% or
+ * one it cannot turn on. `--base` is the third setting: grade what this branch
+ * TOUCHED, at full `--strict` severity if the caller wants it, and let the
+ * untouched majority stay untouched.
+ *
+ * A SUB-PACKAGE of `core/diff/` rather than a sixth file in it, because that
+ * directory is at the five-file limit and because this is a different subject
+ * from the semantic diff beside it: `diff` compares two states of the fleet and
+ * reports what moved, this one only decides WHICH SUBJECTS a run should look
+ * at. Nothing here reads a document.
+ *
+ * What it does NOT do, and the line is not negotiable: a diff-scoped validate
+ * cannot see a victim boundary the change did not touch. Removing an operation
+ * from `payment-service` puts `payment-service` in scope and leaves
+ * `checkout-web` — whose living requirement still names the operation — out of
+ * it. That join is `loam diff --base`'s question and it stays `loam diff`'s;
+ * the two gates answer "did you document what you touched" and "did you break a
+ * consumer", and neither substitutes for the other. Selling a green here that
+ * hides a broken join would be worse than shipping no flag at all.
+ */
+import { declineDetail, gitText } from "../../provenance/git.js";
+import { repoPath } from "../../envelope/json.js";
+import { resolveBase } from "../base-git.js";
+/**
+ * Every path that differs between `ref` and the WORKING TREE, docs-relative.
+ *
+ * Two questions, not one, and the second is not optional: `git diff` compares
+ * the tree git tracks, so a service adopted five minutes ago — a brand new
+ * `services/<id>/spec.md` nobody has committed — is invisible to it. `validate`
+ * grades the working tree, so the scope has to be the working tree's, and an
+ * untracked new boundary that the run then skipped would be the flag's very
+ * first user reporting that it graded nothing.
+ *
+ * `--no-renames` on purpose: with rename detection on (git's default since
+ * 2.9) a service moved into a subsystem reports only its DESTINATION, and the
+ * checks that grade the fleet from the old placement would be out of scope.
+ * Two paths for a move is the honest answer.
+ *
+ * `-z` because git quotes non-ASCII and space-bearing paths in line output —
+ * the same reason `gitTrackedFiles` asks that way, and the same phantom
+ * directory named `"src` if it did not.
+ */
+async function changedPaths(docsDir, commit, prefix) {
+    // Both run from docsDir. `git diff` ignores cwd and answers for the whole
+    // repository with root-relative paths; `git ls-files` restricts itself to
+    // cwd, and `--full-name` makes ITS paths root-relative too — so one prefix
+    // strip below is correct for both, exactly as `listBaseTree` needs one.
+    const tracked = await gitText(docsDir, ["diff", "--name-only", "--no-renames", "-z", commit, "--"]);
+    if (tracked.spawnError !== undefined || tracked.code !== 0 || tracked.overflowed) {
+        return { detail: tracked.overflowed ? "the changed-path listing exceeded the output cap." : declineDetail(tracked) };
+    }
+    const untracked = await gitText(docsDir, ["ls-files", "--others", "--exclude-standard", "--full-name", "-z"]);
+    if (untracked.spawnError !== undefined || untracked.code !== 0 || untracked.overflowed) {
+        return { detail: untracked.overflowed ? "the untracked-path listing exceeded the output cap." : declineDetail(untracked) };
+    }
+    const seen = new Set();
+    for (const raw of [...tracked.out.split("\0"), ...untracked.out.split("\0")]) {
+        // A docs repo checked out as a subdirectory of a larger repository answers
+        // in the whole repository's paths; anything outside the docs dir is
+        // somebody else's change and is not a target here.
+        if (raw === "" || !raw.startsWith(prefix))
+            continue;
+        const rel = raw.slice(prefix.length);
+        if (rel !== "")
+            seen.add(rel);
+    }
+    return [...seen].sort();
+}
+/**
+ * Is `path` inside `dir`? Both docs-relative, forward-slashed.
+ *
+ * A prefix test on the directory plus a separator, never a split on "/" and a
+ * read of the second segment: a service filed under a subsystem lives at
+ * `services/platform/payment-service/`, not at `services/<id>/`, and a
+ * path-splitting implementation drops every filed service out of scope
+ * SILENTLY — the run stays green because it graded nothing, which is the exact
+ * failure this flag is not allowed to have. The separator is what stops
+ * `services/pay` from claiming `services/payments/spec.md`.
+ */
+function inside(path, dir) {
+    return dir !== "" && (path === dir || path.startsWith(`${dir}/`));
+}
+/** The fleet's own documents — the landscape target's subject, which owns no service directory. */
+const ARCHITECTURE_DIR = "architecture";
+/**
+ * Narrow a `--all` run to what changed since `ref`.
+ *
+ * Targets are matched through the ENUMERATIONS' own directories
+ * (`ServiceEntry.dir`, `FeatureEntry.dir`), turned docs-relative by the same
+ * `repoPath` the JSON contract uses. That is the whole reason the enumerations
+ * are passed in rather than re-derived: they already know where each service
+ * sits, at whatever depth, and asking them is what makes a filed fleet work.
+ */
+export async function scopeSince(request) {
+    const { docsDir, ref } = request;
+    const base = await resolveBase(docsDir, ref);
+    if (base.kind === "no-git") {
+        return {
+            kind: "refused",
+            code: "repository-unavailable",
+            message: `The docs repo at ${docsDir} is not somewhere git can answer from (${base.detail}) — ` +
+                `--base narrows the run to what changed since a ref, which it reads with read-only git questions ` +
+                `(rev-parse/diff/ls-files). Clone the docs repo with its history, then re-run — or drop --base to grade every target.`,
+        };
+    }
+    if (base.kind === "no-ref") {
+        return {
+            kind: "refused",
+            code: "unknown-target",
+            message: `--base ${ref} does not resolve to a commit in the docs repo at ${docsDir}` +
+                `${base.detail === "" ? "" : ` (${base.detail})`}. ` +
+                `Pass a ref that exists there — main, origin/main, a tag or a commit sha — fetching first if it lives on the remote.`,
+        };
+    }
+    const changed = await changedPaths(docsDir, base.commit, base.prefix);
+    if (!Array.isArray(changed)) {
+        // Git resolved the ref and then would not say what moved. There is no
+        // partial answer to give: a scope built from half an answer grades a
+        // subset nobody chose and reports it as the branch's whole footprint.
+        return {
+            kind: "refused",
+            code: "repository-unavailable",
+            message: `git could not list what changed since ${ref} in the docs repo at ${docsDir} (${changed.detail}) — ` +
+                `without that list there is no honest scope, and a run over a guessed subset would report a green ` +
+                `for targets nobody graded. Re-run once git can answer, or drop --base to grade every target.`,
+        };
+    }
+    const dirOf = (abs) => repoPath(docsDir, abs);
+    return {
+        kind: "scope",
+        ref,
+        commit: base.commit,
+        // `architecture/` is the landscape target's whole directory: the fleet map,
+        // the permission/capability/obligation vocabularies and the fleet ADRs all
+        // live there, and every one of them is graded by the landscape target
+        // rather than by any service.
+        landscape: changed.some((path) => inside(path, ARCHITECTURE_DIR)),
+        services: request.services.filter((svc) => changed.some((path) => inside(path, dirOf(svc.dir)))),
+        features: request.features.filter((feat) => changed.some((path) => inside(path, dirOf(feat.dir)))),
+        totals: { services: request.services.length, features: request.features.length },
+    };
+}
+/**
+ * The `scope` object the `--json` payload carries — the run saying out loud
+ * what it looked at.
+ *
+ * Additive, and emitted only under `--base`, so no consumer of today's payload
+ * moves. It exists because the alternative is a payload that is byte-shaped
+ * like a whole-fleet run and is not one: `summary.services` would report two
+ * where the fleet has twelve, `valid: true` would read as a claim about the
+ * fleet, and nothing in the document would say otherwise.
+ */
+export function scopeJson(scope) {
+    return {
+        base: scope.ref,
+        commit: scope.commit,
+        landscape: scope.landscape,
+        services: scope.services.map((svc) => svc.id),
+        features: scope.features.map((feat) => feat.id),
+        totals: scope.totals,
+    };
+}
+/**
+ * The one line both the text view and a reader of a CI log need: how much of
+ * the fleet this run actually graded, and against what.
+ *
+ * The "nothing was graded" clause is the load-bearing half. A `--base` run with
+ * no targets in scope has nothing to report and exits 0 — correctly, the branch
+ * touched no governed boundary — and a 0 that reads like a green over the
+ * system is the exact failure the docs-repo readiness gate exists to prevent.
+ * So the sentence says it, rather than letting an empty report say nothing.
+ */
+export function scopeLine(scope) {
+    const graded = scope.services.length + scope.features.length + (scope.landscape ? 1 : 0);
+    return (`${scope.services.length} of ${scope.totals.services} services, ` +
+        `${scope.features.length} of ${scope.totals.features} features in scope since ${scope.ref}` +
+        (scope.landscape ? ", plus the landscape" : "") +
+        (graded === 0 ? " — nothing was graded" : ""));
+}
+//# sourceMappingURL=changed-paths.js.map

package/dist/core/diff/scope/changed-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changed-paths.js","sourceRoot":"","sources":["../../../../src/core/diff/scope/changed-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAkB,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAgD7C;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,MAAc,EAAE,MAAc;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACpG,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACjF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IACvH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9G,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACvF,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7H,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC7E,2EAA2E;QAC3E,oEAAoE;QACpE,mDAAmD;QACnD,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,mGAAmG;AACnG,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAqB;IACpD,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EACL,oBAAoB,OAAO,0CAA0C,IAAI,CAAC,MAAM,MAAM;gBACtF,kGAAkG;gBAClG,sHAAsH;SACzH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,gBAAgB;YACtB,OAAO,EACL,UAAU,GAAG,qDAAqD,OAAO,EAAE;gBAC3E,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,IAAI;gBACpD,qHAAqH;SACxH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EACL,yCAAyC,GAAG,wBAAwB,OAAO,KAAK,OAAO,CAAC,MAAM,MAAM;gBACpG,mGAAmG;gBACnG,8FAA8F;SACjG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO;QACL,IAAI,EAAE,OAAO;QACb,GAAG;QACH,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,4EAA4E;QAC5E,2EAA2E;QAC3E,sEAAsE;QACtE,8BAA8B;QAC9B,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACjE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChG,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClG,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE;KACjF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,KAAoB;IAC5C,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,KAAoB;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,CACL,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,aAAa;QACjE,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,4BAA4B,KAAK,CAAC,GAAG,EAAE;QAC3F,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9C,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Which targets a base git ref puts in scope — the narrowing behind\n * `loam validate --all --base <ref>`.\n *\n * The defect this exists for: a partly-adopted fleet has no CI setting that is\n * both passing today and tightening over time. `--all` is green over eleven\n * undocumented services (they warn, and warnings do not gate) and `--strict` is\n * red from the first minute of adoption until the last boundary is written, so\n * a team installs either a gate that never notices adoption stalling at 8% or\n * one it cannot turn on. `--base` is the third setting: grade what this branch\n * TOUCHED, at full `--strict` severity if the caller wants it, and let the\n * untouched majority stay untouched.\n *\n * A SUB-PACKAGE of `core/diff/` rather than a sixth file in it, because that\n * directory is at the five-file limit and because this is a different subject\n * from the semantic diff beside it: `diff` compares two states of the fleet and\n * reports what moved, this one only decides WHICH SUBJECTS a run should look\n * at. Nothing here reads a document.\n *\n * What it does NOT do, and the line is not negotiable: a diff-scoped validate\n * cannot see a victim boundary the change did not touch. Removing an operation\n * from `payment-service` puts `payment-service` in scope and leaves\n * `checkout-web` — whose living requirement still names the operation — out of\n * it. That join is `loam diff --base`'s question and it stays `loam diff`'s;\n * the two gates answer \"did you document what you touched\" and \"did you break a\n * consumer\", and neither substitutes for the other. Selling a green here that\n * hides a broken join would be worse than shipping no flag at all.\n */\nimport { declineDetail, gitText } from \"../../provenance/git.js\";\nimport { repoPath, type ErrorCode } from \"../../envelope/json.js\";\nimport { resolveBase } from \"../base-git.js\";\nimport type { DocsDir } from \"../../kernel/ids/dirs.js\";\nimport type { FeatureEntry, ServiceEntry } from \"../../repo/entries.js\";\n\n/** Everything the narrowing needs: where to ask, what to ask about, and what there is to narrow. */\nexport interface ScopeRequest {\n  docsDir: DocsDir;\n  /** The ref as the caller spelled it — echoed in every message and in the payload. */\n  ref: string;\n  /** The run's full service enumeration, at whatever depth the tree walk found each one. */\n  services: readonly ServiceEntry[];\n  /** The run's full ACTIVE feature enumeration. */\n  features: readonly FeatureEntry[];\n}\n\n/** The narrowed run: which targets the branch touched, and what it narrowed from. */\nexport interface ValidateScope {\n  kind: \"scope\";\n  ref: string;\n  /** The 40-hex commit `ref` resolved to — what a rerun would have to pass to reproduce this scope. */\n  commit: string;\n  /** Did `architecture/` change? The landscape target is the fleet's own subject and has no directory of its own. */\n  landscape: boolean;\n  services: ServiceEntry[];\n  features: FeatureEntry[];\n  /** The denominators — what the run would have graded without `--base`. */\n  totals: { services: number; features: number };\n}\n\n/**\n * A refusal, already spelled. The code is one `loam diff` already emits for the\n * same two conditions and the message is in the same register, deliberately: a\n * second stable code for \"that ref does not resolve\" would be a second thing to\n * document, branch on and keep in step, for a condition that is identical.\n *\n * The prose is built here rather than in the command because it is the same\n * sentence for every caller and because `base-git.ts`'s `detail` — git's own\n * words, bounded — is what makes it diagnosable; a command that only received a\n * `kind` would have to reinvent the sentence to say why.\n */\nexport interface ScopeRefusal {\n  kind: \"refused\";\n  code: ErrorCode;\n  message: string;\n}\n\nexport type ScopeOutcome = ValidateScope | ScopeRefusal;\n\n/**\n * Every path that differs between `ref` and the WORKING TREE, docs-relative.\n *\n * Two questions, not one, and the second is not optional: `git diff` compares\n * the tree git tracks, so a service adopted five minutes ago — a brand new\n * `services/<id>/spec.md` nobody has committed — is invisible to it. `validate`\n * grades the working tree, so the scope has to be the working tree's, and an\n * untracked new boundary that the run then skipped would be the flag's very\n * first user reporting that it graded nothing.\n *\n * `--no-renames` on purpose: with rename detection on (git's default since\n * 2.9) a service moved into a subsystem reports only its DESTINATION, and the\n * checks that grade the fleet from the old placement would be out of scope.\n * Two paths for a move is the honest answer.\n *\n * `-z` because git quotes non-ASCII and space-bearing paths in line output —\n * the same reason `gitTrackedFiles` asks that way, and the same phantom\n * directory named `\"src` if it did not.\n */\nasync function changedPaths(docsDir: DocsDir, commit: string, prefix: string): Promise<string[] | { detail: string }> {\n  // Both run from docsDir. `git diff` ignores cwd and answers for the whole\n  // repository with root-relative paths; `git ls-files` restricts itself to\n  // cwd, and `--full-name` makes ITS paths root-relative too — so one prefix\n  // strip below is correct for both, exactly as `listBaseTree` needs one.\n  const tracked = await gitText(docsDir, [\"diff\", \"--name-only\", \"--no-renames\", \"-z\", commit, \"--\"]);\n  if (tracked.spawnError !== undefined || tracked.code !== 0 || tracked.overflowed) {\n    return { detail: tracked.overflowed ? \"the changed-path listing exceeded the output cap.\" : declineDetail(tracked) };\n  }\n  const untracked = await gitText(docsDir, [\"ls-files\", \"--others\", \"--exclude-standard\", \"--full-name\", \"-z\"]);\n  if (untracked.spawnError !== undefined || untracked.code !== 0 || untracked.overflowed) {\n    return { detail: untracked.overflowed ? \"the untracked-path listing exceeded the output cap.\" : declineDetail(untracked) };\n  }\n  const seen = new Set<string>();\n  for (const raw of [...tracked.out.split(\"\\0\"), ...untracked.out.split(\"\\0\")]) {\n    // A docs repo checked out as a subdirectory of a larger repository answers\n    // in the whole repository's paths; anything outside the docs dir is\n    // somebody else's change and is not a target here.\n    if (raw === \"\" || !raw.startsWith(prefix)) continue;\n    const rel = raw.slice(prefix.length);\n    if (rel !== \"\") seen.add(rel);\n  }\n  return [...seen].sort();\n}\n\n/**\n * Is `path` inside `dir`? Both docs-relative, forward-slashed.\n *\n * A prefix test on the directory plus a separator, never a split on \"/\" and a\n * read of the second segment: a service filed under a subsystem lives at\n * `services/platform/payment-service/`, not at `services/<id>/`, and a\n * path-splitting implementation drops every filed service out of scope\n * SILENTLY — the run stays green because it graded nothing, which is the exact\n * failure this flag is not allowed to have. The separator is what stops\n * `services/pay` from claiming `services/payments/spec.md`.\n */\nfunction inside(path: string, dir: string): boolean {\n  return dir !== \"\" && (path === dir || path.startsWith(`${dir}/`));\n}\n\n/** The fleet's own documents — the landscape target's subject, which owns no service directory. */\nconst ARCHITECTURE_DIR = \"architecture\";\n\n/**\n * Narrow a `--all` run to what changed since `ref`.\n *\n * Targets are matched through the ENUMERATIONS' own directories\n * (`ServiceEntry.dir`, `FeatureEntry.dir`), turned docs-relative by the same\n * `repoPath` the JSON contract uses. That is the whole reason the enumerations\n * are passed in rather than re-derived: they already know where each service\n * sits, at whatever depth, and asking them is what makes a filed fleet work.\n */\nexport async function scopeSince(request: ScopeRequest): Promise<ScopeOutcome> {\n  const { docsDir, ref } = request;\n  const base = await resolveBase(docsDir, ref);\n  if (base.kind === \"no-git\") {\n    return {\n      kind: \"refused\",\n      code: \"repository-unavailable\",\n      message:\n        `The docs repo at ${docsDir} is not somewhere git can answer from (${base.detail}) — ` +\n        `--base narrows the run to what changed since a ref, which it reads with read-only git questions ` +\n        `(rev-parse/diff/ls-files). Clone the docs repo with its history, then re-run — or drop --base to grade every target.`,\n    };\n  }\n  if (base.kind === \"no-ref\") {\n    return {\n      kind: \"refused\",\n      code: \"unknown-target\",\n      message:\n        `--base ${ref} does not resolve to a commit in the docs repo at ${docsDir}` +\n        `${base.detail === \"\" ? \"\" : ` (${base.detail})`}. ` +\n        `Pass a ref that exists there — main, origin/main, a tag or a commit sha — fetching first if it lives on the remote.`,\n    };\n  }\n\n  const changed = await changedPaths(docsDir, base.commit, base.prefix);\n  if (!Array.isArray(changed)) {\n    // Git resolved the ref and then would not say what moved. There is no\n    // partial answer to give: a scope built from half an answer grades a\n    // subset nobody chose and reports it as the branch's whole footprint.\n    return {\n      kind: \"refused\",\n      code: \"repository-unavailable\",\n      message:\n        `git could not list what changed since ${ref} in the docs repo at ${docsDir} (${changed.detail}) — ` +\n        `without that list there is no honest scope, and a run over a guessed subset would report a green ` +\n        `for targets nobody graded. Re-run once git can answer, or drop --base to grade every target.`,\n    };\n  }\n\n  const dirOf = (abs: string): string => repoPath(docsDir, abs);\n  return {\n    kind: \"scope\",\n    ref,\n    commit: base.commit,\n    // `architecture/` is the landscape target's whole directory: the fleet map,\n    // the permission/capability/obligation vocabularies and the fleet ADRs all\n    // live there, and every one of them is graded by the landscape target\n    // rather than by any service.\n    landscape: changed.some((path) => inside(path, ARCHITECTURE_DIR)),\n    services: request.services.filter((svc) => changed.some((path) => inside(path, dirOf(svc.dir)))),\n    features: request.features.filter((feat) => changed.some((path) => inside(path, dirOf(feat.dir)))),\n    totals: { services: request.services.length, features: request.features.length },\n  };\n}\n\n/**\n * The `scope` object the `--json` payload carries — the run saying out loud\n * what it looked at.\n *\n * Additive, and emitted only under `--base`, so no consumer of today's payload\n * moves. It exists because the alternative is a payload that is byte-shaped\n * like a whole-fleet run and is not one: `summary.services` would report two\n * where the fleet has twelve, `valid: true` would read as a claim about the\n * fleet, and nothing in the document would say otherwise.\n */\nexport function scopeJson(scope: ValidateScope): Record<string, unknown> {\n  return {\n    base: scope.ref,\n    commit: scope.commit,\n    landscape: scope.landscape,\n    services: scope.services.map((svc) => svc.id),\n    features: scope.features.map((feat) => feat.id),\n    totals: scope.totals,\n  };\n}\n\n/**\n * The one line both the text view and a reader of a CI log need: how much of\n * the fleet this run actually graded, and against what.\n *\n * The \"nothing was graded\" clause is the load-bearing half. A `--base` run with\n * no targets in scope has nothing to report and exits 0 — correctly, the branch\n * touched no governed boundary — and a 0 that reads like a green over the\n * system is the exact failure the docs-repo readiness gate exists to prevent.\n * So the sentence says it, rather than letting an empty report say nothing.\n */\nexport function scopeLine(scope: ValidateScope): string {\n  const graded = scope.services.length + scope.features.length + (scope.landscape ? 1 : 0);\n  return (\n    `${scope.services.length} of ${scope.totals.services} services, ` +\n    `${scope.features.length} of ${scope.totals.features} features in scope since ${scope.ref}` +\n    (scope.landscape ? \", plus the landscape\" : \"\") +\n    (graded === 0 ? \" — nothing was graded\" : \"\")\n  );\n}\n"]}