@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/core/fleet-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-context.js","sourceRoot":"","sources":["../../src/core/fleet-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAoB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAkB,MAAM,aAAa,CAAC;AAEvD,OAAO,EACL,WAAW,GAGZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,YAAY,GAGb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAoB,MAAM,WAAW,CAAC;AAoBhE,SAAS,GAAG,CAAC,IAAY;IACvB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAE3D,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,KAAa,EAAE,KAAe;IACrD,OAAO,CACL,GAAG,KAAK,6CAA6C,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;QAC5G,uFAAuF;QACvF,2GAA2G;QAC3G,gHAAgH,CACjH,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,OAAe,EAAE,IAAY;IAClF,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,qBAAqB;QAC3B,OAAO;QACP,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,IAAY;IAClE,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,OAAO,YAAY;IACN,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IACtD,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IACtD,eAAe,GAAG,IAAI,GAAG,EAA6B,CAAC;IACvD,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC3C,YAAY,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClD,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE/C,MAAM,GAAsB;QAC3C,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;QACtB,0BAA0B,EAAE,CAAC;QAC7B,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,WAAW,EAAE,CAAC;KACf,CAAC;IAEF,iFAAiF;IACjF,KAAK;QACH,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;YACrC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,OAAe,EAAE,IAAI,GAAkC,EAAE;QACpE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjF,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;YACrC,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACrD,wEAAwE;gBACxE,yEAAyE;gBACzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACxE,CAAC;gBACH,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mBAAmB,CAAC,UAAkB;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,0BAA0B,IAAI,CAAC,CAAC;YAC5C,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QACnB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;YAC3B,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,OAAO,mBAAmB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC;YACnC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YAC/B,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC;YAChC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IAEH,UAAU,CAAC,IAAY;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;YAC7B,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF","sourcesContent":["/**\n * Request-scoped read index for commands that walk a whole loam repository.\n *\n * The filesystem remains the source of truth.  This class deliberately has no\n * singleton/global instance: a command creates one after loading loam.json and\n * drops it when that invocation finishes.  Within that lifetime identical\n * reads share their in-flight Promise, which removes both duplicate I/O and\n * duplicate parsing without making a later CLI invocation observe stale data.\n *\n * Because every markdown artifact is read HERE, this is also where the two\n * failures a read must never swallow are answered: bytes that are not UTF-8\n * (which `readFile(path, \"utf8\")` silently turns into U+FFFD, so a UTF-16\n * spec.md parses as zero requirements and grades green), and git conflict\n * markers left in a living document (which parse as prose, and which the next\n * `loam archive` rewrites away). One place, so no reader can forget. The\n * decode itself lives in `document-bytes.ts`, a leaf: the parsers that read a\n * single file without an index owe the same rule, and must not have to import\n * this module — and the fleet it pulls in behind it — to obey it.\n */\nimport { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { readAsyncapi, type AsyncapiDoc } from \"./asyncapi.js\";\nimport { decodeDocument } from \"./document-bytes.js\";\nimport { loadFile, type LoadedDoc } from \"./likec4.js\";\nimport type { Finding } from \"./report.js\";\nimport {\n  readOpenapi,\n  type OpenapiDoc,\n  type Operation,\n} from \"./openapi.js\";\nimport {\n  featureSpecServices,\n  listFeatures,\n  listServices,\n  type FeatureEntry,\n  type ServiceEntry,\n} from \"./repo.js\";\nimport { parseRequirements, type Requirement } from \"./spec.js\";\n\nexport interface FleetContextStats {\n  serviceEnumerations: number;\n  featureEnumerations: number;\n  featureServiceEnumerations: number;\n  textReads: number;\n  requirementParses: number;\n  openapiParses: number;\n  /**\n   * Reads of a service's `asyncapi.yaml`. Counted separately because this axis\n   * is the one that makes a per-service run read the whole fleet: \"does anybody\n   * publish this message\" has no local answer, so `spine.message-unproduced`\n   * walks every service's contract. The memo is what keeps that one walk per\n   * command instead of one per consuming edge.\n   */\n  asyncapiParses: number;\n  likec4Loads: number;\n}\n\nfunction key(path: string): string {\n  return resolve(path);\n}\n\n/* ------------------------------------------------------------------ */\n/* What a read must never swallow                                      */\n/* ------------------------------------------------------------------ */\n\n/**\n * The three-way merge left its markers in the file — 1-based line numbers.\n *\n * The rule is `loam doctor`'s, verbatim, and it lives here now because doctor\n * checked exactly one file (`architecture/landscape.likec4`) from a command\n * that gates nothing. The same markers in a living `services/<svc>/spec.md`\n * parse as prose: `loam validate --all` reported `valid: true`, and the next\n * `loam archive` rewrote the requirements section and dropped the `=======`\n * line with it, turning a conflict anyone can see into a document nobody can\n * tell is wrong. For a shared docs repo where a fleet lands through PRs this is\n * the DEFAULT failure, not an edge.\n */\nconst CONFLICT_MARKERS = [\"<<<<<<<\", \"=======\", \">>>>>>>\"];\n\nexport function conflictMarkerLines(source: string): number[] {\n  const out: number[] = [];\n  source.split(/\\r?\\n/).forEach((line, i) => {\n    if (CONFLICT_MARKERS.some((m) => line.startsWith(m))) out.push(i + 1);\n  });\n  return out;\n}\n\n/** One sentence for the breach, wherever it is found — doctor, validate, either axis. */\nfunction conflictMessage(label: string, lines: number[]): string {\n  return (\n    `${label} still contains git conflict markers (line${lines.length === 1 ? \"\" : \"s\"} ${lines.join(\", \")}) — ` +\n    `both sides of somebody's merge are in the file, so nothing it says is anyone's text. ` +\n    `Resolve the conflict before anything else: loam rewrites this document on archive, and a rewrite deletes ` +\n    `whichever marker lines fall inside the section it owns — a visible conflict becomes a silently malformed file.`\n  );\n}\n\n/**\n * The conflict-marker finding for a requirement document (living spec.md /\n * arch.spec.md, or a feature's delta of one). Null when the text is clean.\n *\n * An error because the document is not valid — nobody wrote what it now says —\n * and because the merge that would consume it is unsafe. It does not carry\n * `gates`: that field is coherence's (issue.ts), and the archive gate has to\n * ask this question itself.\n */\nexport function documentConflictFinding(label: string, subject: string, text: string): Finding | null {\n  const lines = conflictMarkerLines(text);\n  if (lines.length === 0) return null;\n  return {\n    severity: \"error\",\n    code: \"spec.merge-conflict\",\n    subject,\n    message: conflictMessage(label, lines),\n  };\n}\n\n/** The same breach in the fleet map, where it costs every cross-service check at once. */\nexport function landscapeConflictFinding(label: string, text: string): Finding | null {\n  const lines = conflictMarkerLines(text);\n  if (lines.length === 0) return null;\n  return {\n    severity: \"error\",\n    code: \"landscape.merge-conflict\",\n    message: conflictMessage(label, lines),\n  };\n}\n\n/** One coherent filesystem snapshot for one command invocation. */\nexport class FleetContext {\n  private readonly services = new Map<string, Promise<ServiceEntry[]>>();\n  private readonly features = new Map<string, Promise<FeatureEntry[]>>();\n  private readonly featureServices = new Map<string, Promise<string[]>>();\n  private readonly texts = new Map<string, Promise<string>>();\n  private readonly requirements = new Map<string, Promise<Requirement[]>>();\n  private readonly openapis = new Map<string, Promise<OpenapiDoc>>();\n  private readonly asyncapis = new Map<string, Promise<AsyncapiDoc>>();\n  private readonly likec4 = new Map<string, Promise<LoadedDoc>>();\n\n  private readonly counts: FleetContextStats = {\n    serviceEnumerations: 0,\n    featureEnumerations: 0,\n    featureServiceEnumerations: 0,\n    textReads: 0,\n    requirementParses: 0,\n    openapiParses: 0,\n    asyncapiParses: 0,\n    likec4Loads: 0,\n  };\n\n  /** A copy suitable for diagnostics/tests; callers cannot mutate the counters. */\n  stats(): Readonly<FleetContextStats> {\n    return { ...this.counts };\n  }\n\n  listServices(docsDir: string): Promise<ServiceEntry[]> {\n    const k = key(docsDir);\n    let pending = this.services.get(k);\n    if (pending === undefined) {\n      this.counts.serviceEnumerations += 1;\n      pending = listServices(docsDir);\n      this.services.set(k, pending);\n    }\n    return pending;\n  }\n\n  listFeatures(docsDir: string, opts: { includeArchived?: boolean } = {}): Promise<FeatureEntry[]> {\n    const k = `${key(docsDir)}\\0${opts.includeArchived === true ? \"all\" : \"active\"}`;\n    let pending = this.features.get(k);\n    if (pending === undefined) {\n      this.counts.featureEnumerations += 1;\n      pending = listFeatures(docsDir, opts).then((entries) => {\n        // listFeatures has already enumerated every feature's specs/ directory;\n        // seed the narrower lookup so validation/coherence do not read it again.\n        for (const entry of entries) {\n          const featureKey = key(entry.dir);\n          if (!this.featureServices.has(featureKey)) {\n            this.featureServices.set(featureKey, Promise.resolve(entry.services));\n          }\n        }\n        return entries;\n      });\n      this.features.set(k, pending);\n    }\n    return pending;\n  }\n\n  featureSpecServices(featureDir: string): Promise<string[]> {\n    const k = key(featureDir);\n    let pending = this.featureServices.get(k);\n    if (pending === undefined) {\n      this.counts.featureServiceEnumerations += 1;\n      pending = featureSpecServices(featureDir);\n      this.featureServices.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * A markdown artifact as text. Bytes in, decoded once, and refused rather\n   * than degraded when they are not UTF-8 — see NotUtf8DocumentError.\n   */\n  readText(path: string): Promise<string> {\n    const k = key(path);\n    let pending = this.texts.get(k);\n    if (pending === undefined) {\n      this.counts.textReads += 1;\n      pending = readFile(path).then((bytes) => decodeDocument(bytes, path));\n      this.texts.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * Git conflict markers in an already-read document, by line. Free for any\n   * caller that was going to read the file anyway — which is every caller,\n   * which is the point: the marker check used to cost a whole extra read of one\n   * hand-picked file, so it was done for one hand-picked file.\n   */\n  async conflictMarkers(path: string): Promise<number[]> {\n    return conflictMarkerLines(await this.readText(path));\n  }\n\n  readRequirements(path: string): Promise<Requirement[]> {\n    const k = key(path);\n    let pending = this.requirements.get(k);\n    if (pending === undefined) {\n      this.counts.requirementParses += 1;\n      pending = this.readText(path).then(parseRequirements);\n      this.requirements.set(k, pending);\n    }\n    return pending;\n  }\n\n  readOpenapi(path: string): Promise<OpenapiDoc> {\n    const k = key(path);\n    let pending = this.openapis.get(k);\n    if (pending === undefined) {\n      this.counts.openapiParses += 1;\n      pending = readOpenapi(path);\n      this.openapis.set(k, pending);\n    }\n    return pending;\n  }\n\n  readAsyncapi(path: string): Promise<AsyncapiDoc> {\n    const k = key(path);\n    let pending = this.asyncapis.get(k);\n    if (pending === undefined) {\n      this.counts.asyncapiParses += 1;\n      pending = readAsyncapi(path);\n      this.asyncapis.set(k, pending);\n    }\n    return pending;\n  }\n\n  async operations(path: string): Promise<Operation[]> {\n    return (await this.readOpenapi(path)).ops;\n  }\n\n  async operationIds(path: string): Promise<string[]> {\n    return (await this.readOpenapi(path)).ops.map((op) => op.id);\n  }\n\n  /*\n   * Deliberately no `serviceOperationIds` here. The living-plus-feature union is\n   * a RULE — every removal applied before any upsert — not a read, and a second\n   * copy of a rule is a second chance to spell it differently. This one did: it\n   * interleaved removals with upserts, so a relocated operation answered\n   * \"defined\" through `archive` (no context) and \"gone\" through `validate` and\n   * `status` (context), or the reverse, depending on the order the feature's\n   * YAML happened to spell the two slots in. `core/openapi.ts` owns the rule and\n   * threads a context through the reads underneath it, which is the only part\n   * this class was ever needed for.\n   */\n\n  loadLikeC4(path: string): Promise<LoadedDoc> {\n    const k = key(path);\n    let pending = this.likec4.get(k);\n    if (pending === undefined) {\n      this.counts.likec4Loads += 1;\n      pending = loadFile(path);\n      this.likec4.set(k, pending);\n    }\n    return pending;\n  }\n}\n"]}
+{"version":3,"file":"fleet-context.js","sourceRoot":"","sources":["../../src/core/fleet-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,wBAAwB,EAA6B,MAAM,gCAAgC,CAAC;AACrG,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAkB,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,EAAE,WAAW,EAAmC,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAwC,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAElG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AA8CtD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpD,mEAAmE;AACnE,MAAM,OAAO,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IACtD,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IACtD,eAAe,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC7D,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC3C,YAAY,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClD,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,sBAAsB,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC1E,mBAAmB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACjE,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IAChE;;;;;OAKG;IACc,MAAM,GAAG,IAAI,aAAa,CAAC;QAC1C,aAAa,EAAE,GAAG,EAAE;YAClB,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;KAC5C,CAAC,CAAC;IAEc,MAAM,GAAsB;QAC3C,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;QACtB,0BAA0B,EAAE,CAAC;QAC7B,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,CAAC;QACzB,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;KAChB,CAAC;IAEF,iFAAiF;IACjF,KAAK;QACH,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACK,OAAO,CACb,KAA8B,EAC9B,CAAS,EACT,OAAgC,EAChC,IAAsB;QAEtB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE;YACzB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,OAAgB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,YAAY,CAAC,OAAgB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,YAAY,CAAC,OAAgB,EAAE,IAAI,GAAkC,EAAE;QACrE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAChE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3C,wEAAwE;YACxE,yEAAyE;YACzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,mBAAmB,CAAC,UAAsB;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,4BAA4B,EAAE,GAAG,EAAE,CAC5F,mBAAmB,CAAC,UAAU,CAAC,CAChC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAC3D,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAC5D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,OAAO,mBAAmB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAC1E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAC5C,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,OAAgB;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,CACtF,wBAAwB,CAAC,OAAO,CAAC,CAClC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,UAAsB;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAC5F,uBAAuB,CAAC,UAAU,CAAC,CACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IAEH,UAAU,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,cAAc,CAAC,KAAe;QAClC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAC/B,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,yEAAyE;YACzE,sEAAsE;YACtE,kEAAkE;YAClE,uDAAuD;YACvD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,qGAAqG;IACrG,YAAY,CAAC,OAAgB;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,KAAwB;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,OAAgB,EAAE,KAAmB;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CAAC,OAAgB,EAAE,KAA8B;QAC1E,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;CACF","sourcesContent":["/**\n * Request-scoped read index for commands that walk a whole loam repository.\n *\n * The filesystem remains the source of truth.  This class deliberately has no\n * singleton/global instance: a command creates one after loading loam.json and\n * drops it when that invocation finishes.  Within that lifetime identical\n * reads share their in-flight Promise, which removes both duplicate I/O and\n * duplicate parsing without making a later CLI invocation observe stale data.\n *\n * Because every markdown artifact is read HERE, this is also where the two\n * failures a read must never swallow are answered: bytes that are not UTF-8\n * (which `readFile(path, \"utf8\")` silently turns into U+FFFD, so a UTF-16\n * spec.md parses as zero requirements and grades green), and git conflict\n * markers left in a living document (which parse as prose, and which the next\n * `loam archive` rewrites away). One place, so no reader can forget. Both\n * RULES live in leaves — the decode in `document-bytes.ts`, the marker scan\n * and its findings in `conflict-markers.ts` — because the parsers and graders\n * that touch a single file without an index owe the same rules, and must not\n * have to import this module — and the fleet it pulls in behind it — to obey\n * them.\n */\nimport { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { readAsyncapi } from \"./asyncapi/read.js\";\nimport type { AsyncapiDoc } from \"./asyncapi/model.js\";\nimport { readCapabilityVocabulary, type CapabilityVocabulary } from \"./capabilities/capabilities.js\";\nimport { featureCapabilityDeltas } from \"./capabilities/delta/tree.js\";\nimport type { CapabilityTree } from \"./capabilities/tree.js\";\nimport { conflictMarkerLines } from \"./conflict-markers.js\";\nimport { decodeDocument } from \"./kernel/document-bytes.js\";\nimport { memo } from \"./kernel/concurrency.js\";\nimport { loadFile, type LoadedDoc } from \"./c4/likec4.js\";\nimport { loadBatch } from \"./c4/workspace.js\";\nimport { ServiceModels } from \"./c4/prefetch/fleet.js\";\nimport type { ServiceModel } from \"./c4/service-model/load.js\";\nimport type { ModelShape } from \"./c4/service-model/shape.js\";\nimport type { ServicePaths } from \"./repo/paths.js\";\nimport { readOpenapi, type OpenapiDoc, type Operation } from \"./openapi/doc.js\";\nimport type { RawServiceId } from \"./kernel/ids/service.js\";\nimport { type FeatureEntry, type ServiceEntry } from \"./repo/entries.js\";\nimport { featureSpecServices, listFeatures, listFleetTree, serviceEntries } from \"./repo/repo.js\";\nimport type { FleetTree } from \"./repo/tree/walk.js\";\nimport { parseRequirements } from \"./document/parse.js\";\nimport { type Requirement } from \"./document/spec.js\";\nimport type { DocsDir, FeatureDir } from \"./kernel/ids/dirs.js\";\n\nexport interface FleetContextStats {\n  serviceEnumerations: number;\n  featureEnumerations: number;\n  featureServiceEnumerations: number;\n  textReads: number;\n  requirementParses: number;\n  openapiParses: number;\n  /**\n   * Reads of a service's `asyncapi.yaml`. Counted separately because this axis\n   * is the one that makes a per-service run read the whole fleet: \"does anybody\n   * publish this message\" has no local answer, so `spine.message-unproduced`\n   * walks every service's contract. The memo is what keeps that one walk per\n   * command instead of one per consuming edge.\n   */\n  asyncapiParses: number;\n  /**\n   * Reads of the capability vocabulary — `architecture/capabilities.yaml` AND\n   * the `capabilities/` walk, which are one vocabulary and so one read. One per\n   * invocation is the capability axis's exit criterion, and this counter is how\n   * a test pins it. (Permissions predates the memo and re-parses per service —\n   * do not copy that.)\n   */\n  capabilityParses: number;\n  /**\n   * Walks of ONE feature's `capabilities/` delta tree. Counted apart from\n   * `capabilityParses` because it answers a different question about a\n   * different directory, and because a fleet that has not adopted the business\n   * axis must be able to prove it pays nothing: every feature's walk is a\n   * single `existsSync` that finds no directory, so this counter rises while\n   * `textReads` and `requirementParses` do not.\n   */\n  featureCapabilityWalks: number;\n  likec4Loads: number;\n  /**\n   * PER-SERVICE PROJECTS parsed — the map plus one extending model, staged\n   * together (`c4/service-model/`). Apart from `likec4Loads` because they are\n   * different units: that counter means documents parsed alone, and a fleet\n   * whose models all extend the map moves every unit to this one. One project\n   * per service is the axis's exit criterion, and this is how a test pins it.\n   */\n  projectLoads: number;\n}\n\nconst key = (path: string): string => resolve(path);\n\n/** One coherent filesystem snapshot for one command invocation. */\nexport class FleetContext {\n  private readonly trees = new Map<string, Promise<FleetTree>>();\n  private readonly services = new Map<string, Promise<ServiceEntry[]>>();\n  private readonly features = new Map<string, Promise<FeatureEntry[]>>();\n  private readonly featureServices = new Map<string, Promise<RawServiceId[]>>();\n  private readonly texts = new Map<string, Promise<string>>();\n  private readonly requirements = new Map<string, Promise<Requirement[]>>();\n  private readonly openapis = new Map<string, Promise<OpenapiDoc>>();\n  private readonly asyncapis = new Map<string, Promise<AsyncapiDoc>>();\n  private readonly capabilityVocabularies = new Map<string, Promise<CapabilityVocabulary>>();\n  private readonly featureCapabilities = new Map<string, Promise<CapabilityTree>>();\n  private readonly likec4 = new Map<string, Promise<LoadedDoc>>();\n  /**\n   * The service-model axis's own memos, one object because the rules they\n   * encode are `c4/prefetch/fleet.ts`'s rather than this class's. It counts\n   * through this instance's counter, so `stats()` stays the one place a caller\n   * reads what an invocation cost.\n   */\n  private readonly models = new ServiceModels({\n    onProjectLoad: () => {\n      this.counts.projectLoads += 1;\n    },\n    known: async (docsDir) => new Set((await this.listServices(docsDir)).map((s) => s.id)),\n    standalone: (path) => this.loadLikeC4(path),\n  });\n\n  private readonly counts: FleetContextStats = {\n    serviceEnumerations: 0,\n    featureEnumerations: 0,\n    featureServiceEnumerations: 0,\n    textReads: 0,\n    requirementParses: 0,\n    openapiParses: 0,\n    asyncapiParses: 0,\n    capabilityParses: 0,\n    featureCapabilityWalks: 0,\n    likec4Loads: 0,\n    projectLoads: 0,\n  };\n\n  /** A copy suitable for diagnostics/tests; callers cannot mutate the counters. */\n  stats(): Readonly<FleetContextStats> {\n    return { ...this.counts };\n  }\n\n  /**\n   * `memo`, counting the miss under `counter` — every read below is this one\n   * call. The count is taken when the load STARTS, inside the miss, so a\n   * second asker of an in-flight read is a hit and is never counted: the\n   * counters mean \"work this invocation paid for\", which is what the stats\n   * tests pin per axis.\n   */\n  private counted<T>(\n    store: Map<string, Promise<T>>,\n    k: string,\n    counter: keyof FleetContextStats,\n    make: () => Promise<T>,\n  ): Promise<T> {\n    return memo(store, k, () => {\n      this.counts[counter] += 1;\n      return make();\n    });\n  }\n\n  /**\n   * The classified `services/` tree — the ONE enumeration this invocation\n   * performs. `listServices` below derives its entries from this memo, so a\n   * command that asks for both the fleet and the tree's findings (`validate\n   * --all` does) still walks the directories exactly once. The counter keeps\n   * its historical meaning — walks of `services/` — it just counts the walk\n   * where the walk now happens.\n   */\n  fleetTree(docsDir: DocsDir): Promise<FleetTree> {\n    return this.counted(this.trees, key(docsDir), \"serviceEnumerations\", () => listFleetTree(docsDir));\n  }\n\n  listServices(docsDir: DocsDir): Promise<ServiceEntry[]> {\n    return memo(this.services, key(docsDir), () => this.fleetTree(docsDir).then(serviceEntries));\n  }\n\n  listFeatures(docsDir: DocsDir, opts: { includeArchived?: boolean } = {}): Promise<FeatureEntry[]> {\n    const k = `${key(docsDir)}\\0${opts.includeArchived === true ? \"all\" : \"active\"}`;\n    return this.counted(this.features, k, \"featureEnumerations\", () =>\n      listFeatures(docsDir, opts).then((entries) => {\n        // listFeatures has already enumerated every feature's specs/ directory;\n        // seed the narrower lookup so validation/coherence do not read it again.\n        for (const entry of entries) {\n          const featureKey = key(entry.dir);\n          if (!this.featureServices.has(featureKey)) {\n            this.featureServices.set(featureKey, Promise.resolve(entry.services));\n          }\n        }\n        return entries;\n      }),\n    );\n  }\n\n  featureSpecServices(featureDir: FeatureDir): Promise<RawServiceId[]> {\n    return this.counted(this.featureServices, key(featureDir), \"featureServiceEnumerations\", () =>\n      featureSpecServices(featureDir),\n    );\n  }\n\n  /**\n   * A markdown artifact as text. Bytes in, decoded once, and refused rather\n   * than degraded when they are not UTF-8 — see NotUtf8DocumentError.\n   */\n  readText(path: string): Promise<string> {\n    return this.counted(this.texts, key(path), \"textReads\", () =>\n      readFile(path).then((bytes) => decodeDocument(bytes, path)),\n    );\n  }\n\n  /**\n   * Git conflict markers in an already-read document, by line. Free for any\n   * caller that was going to read the file anyway — which is every caller,\n   * which is the point: the marker check used to cost a whole extra read of one\n   * hand-picked file, so it was done for one hand-picked file.\n   */\n  async conflictMarkers(path: string): Promise<number[]> {\n    return conflictMarkerLines(await this.readText(path));\n  }\n\n  readRequirements(path: string): Promise<Requirement[]> {\n    return this.counted(this.requirements, key(path), \"requirementParses\", () =>\n      this.readText(path).then(parseRequirements),\n    );\n  }\n\n  readOpenapi(path: string): Promise<OpenapiDoc> {\n    return this.counted(this.openapis, key(path), \"openapiParses\", () => readOpenapi(path));\n  }\n\n  readAsyncapi(path: string): Promise<AsyncapiDoc> {\n    return this.counted(this.asyncapis, key(path), \"asyncapiParses\", () => readAsyncapi(path));\n  }\n\n  /**\n   * The capability vocabulary, read once per invocation. Direction rule,\n   * load-bearing: this file imports `capabilities/capabilities.js`, so nothing\n   * under src/core/capabilities/ may import this module back — that edge is a\n   * core-root↔capabilities package cycle `import/no-cycle` cannot see, which is\n   * why the functions there take plain data or a `read` function, never a FleetContext.\n   */\n  capabilities(docsDir: DocsDir): Promise<CapabilityVocabulary> {\n    return this.counted(this.capabilityVocabularies, key(docsDir), \"capabilityParses\", () =>\n      readCapabilityVocabulary(docsDir),\n    );\n  }\n\n  /**\n   * One feature's `capabilities/` delta tree, walked once per invocation. Two\n   * readers ask for it in the same run — the delta-shape walk\n   * (`core/delta/delta.ts`) and the capability overlay\n   * (`core/coherence/declared.ts`) — and without the memo a feature carrying\n   * three capability deltas paid the readdirs twice.\n   *\n   * The direction rule stated on `capabilities()` above applies verbatim: the\n   * function this stands in front of takes a plain `FeatureDir`, never a\n   * FleetContext, so `src/core/capabilities/` never imports this module back.\n   */\n  featureCapabilityDeltas(featureDir: FeatureDir): Promise<CapabilityTree> {\n    return this.counted(this.featureCapabilities, key(featureDir), \"featureCapabilityWalks\", () =>\n      featureCapabilityDeltas(featureDir),\n    );\n  }\n\n  async operations(path: string): Promise<Operation[]> {\n    return (await this.readOpenapi(path)).ops;\n  }\n\n  async operationIds(path: string): Promise<string[]> {\n    return (await this.readOpenapi(path)).ops.map((op) => op.id);\n  }\n\n  /*\n   * Deliberately no `serviceOperationIds` here. The living-plus-feature union is\n   * a RULE — every removal applied before any upsert — not a read, and a second\n   * copy of a rule is a second chance to spell it differently. This one did: it\n   * interleaved removals with upserts, so a relocated operation answered\n   * \"defined\" through `archive` (no context) and \"gone\" through `validate` and\n   * `status` (context), or the reverse, depending on the order the feature's\n   * YAML happened to spell the two slots in. `core/openapi/doc.ts` owns the rule and\n   * threads a context through the reads underneath it, which is the only part\n   * this class was ever needed for.\n   */\n\n  loadLikeC4(path: string): Promise<LoadedDoc> {\n    return this.counted(this.likec4, key(path), \"likec4Loads\", () => loadFile(path));\n  }\n\n  /**\n   * Parse many `.likec4` documents through ONE shared workspace (`loadBatch`)\n   * and seed the memo above, so every later `loadLikeC4` in this invocation is\n   * a hit. Purely an accelerator: the cache is still this instance's — one\n   * invocation, one snapshot, no module state — and the counter still means\n   * \"documents parsed via LikeC4\", incremented once per batch-parsed document.\n   *\n   * The failure story is the contract here. A batch-INFRASTRUCTURE failure —\n   * a sandboxed runner denying tmpdir writes is the environment class ROADMAP\n   * documents — degrades to today's per-path loads by seeding nothing: never\n   * an error, and never fewer findings, only the old speed. A path the batch\n   * could not stage (missing, unreadable) is simply absent from the result, so\n   * the later `loadLikeC4` reproduces today's per-path error exactly. And\n   * fewer than two misses returns without a workspace at all: one document\n   * gains nothing from batch isolation it already has.\n   */\n  async prefetchLikeC4(paths: string[]): Promise<void> {\n    const missing = [...new Set(paths.map(key))].filter((k) => !this.likec4.has(k));\n    if (missing.length < 2) return;\n    let docs: Map<string, LoadedDoc>;\n    try {\n      docs = await loadBatch(missing);\n    } catch {\n      return;\n    }\n    for (const [k, doc] of docs) {\n      // Keyed by the same `key()` as loadLikeC4 — loadBatch resolves paths the\n      // identical way, and `missing` was already resolved, so this holds by\n      // construction; the has() guard keeps a concurrent load's promise\n      // authoritative rather than double-counting the parse.\n      if (this.likec4.has(k)) continue;\n      this.counts.likec4Loads += 1;\n      this.likec4.set(k, Promise.resolve(doc));\n    }\n  }\n\n  /** The fleet map as the PROJECT it is — landscape plus use cases, minus the generated views file. */\n  architecture(docsDir: DocsDir): Promise<LoadedDoc> {\n    return this.models.architecture(docsDir);\n  }\n\n  /**\n   * Which shape each of these models has, keyed by resolved path — one read of\n   * each file's bytes per invocation. Ask over the FULL enumeration, never a\n   * narrowed run's subset: shapes decide which directories are owed a\n   * per-service `likec4.config.json`, and a partial map answers \"not\n   * standalone\" for every service outside it.\n   */\n  modelShapes(paths: readonly string[]): Promise<Map<string, ModelShape>> {\n    return this.models.shapes(paths);\n  }\n\n  /**\n   * A service's C4 model, read the way its own SHAPE demands — the one entry\n   * point for every reader of `model.likec4`, standalone or extending\n   * (`c4/service-model/load.ts` states the four arms and why each exists).\n   */\n  serviceModel(docsDir: DocsDir, paths: ServicePaths): Promise<ServiceModel> {\n    return this.models.model(docsDir, paths);\n  }\n\n  /**\n   * Every service's model prepared in two workspaces whatever the fleet's mix:\n   * the extending ones as one project each in one of them, the standalone ones\n   * through the document batch above. An accelerator with `prefetchLikeC4`'s\n   * failure story exactly — a batch that could not be created seeds nothing, so\n   * findings never change because of a tmpdir, only the speed does.\n   */\n  async prefetchServiceModels(docsDir: DocsDir, paths: readonly ServicePaths[]): Promise<void> {\n    await this.prefetchLikeC4(await this.models.prefetch(docsDir, paths));\n  }\n}\n"]}

package/dist/core/gate/checks.js

@@ -0,0 +1,208 @@
+/**
+ * The four checks behind `loam gate` — a can-i-deploy-shaped PURE QUERY over
+ * evidence other commands already recorded. Nothing here executes anything,
+ * writes anything, takes the docs lock, or re-derives a coherence plan: every
+ * answer is either already on disk (verification.yaml, vouch stamps, the
+ * commit journal) or a presence/landscape fact the enumeration carries.
+ *
+ *   partners      the landscape's direct joins, both ends graded on the ladder
+ *   freshness     content.stale / sources.stale over the target and partners,
+ *                 plus the one integrity error that makes freshness
+ *                 unjudgeable (frontmatter.malformed) and a refusing decode
+ *                 of the spec bytes themselves
+ *   verification  verificationState per feature touching the service — the
+ *                 active ones, plus those archived after `--since <ref>` when
+ *                 a pipeline names the docs commit it last deployed from
+ *                 (its own module, `./verification.ts`)
+ *   interrupted   the `.loam-commit` journal — the one repo state that poisons
+ *                 every other answer above
+ *
+ * Every `gate.*` code is spelled as a literal `code:` property at its emit
+ * site, never through a code-taking factory parameter — verifyStep
+ * (core/status/verification.ts) records that test/codes-drift.test.ts's
+ * collector is blind to the parameter form, and a refactor toward a factory
+ * would silently undocument the family.
+ */
+import { existsSync } from "node:fs";
+import { inOrder } from "../kernel/concurrency.js";
+import { serviceProvenance } from "../provenance/findings.js";
+import { interruptedCommitFinding } from "../staging/recovery/finding.js";
+import { servicePathsAt, SPEC_AXES } from "../repo/paths.js";
+import { serviceTreePath } from "../kernel/ids/dirs.js";
+import { locateServicePaths } from "../repo/service-target.js";
+import { atLeastDocumented, partnerScan } from "./partners.js";
+import { verificationCheck } from "./verification.js";
+import { unreadableSubject } from "./report.js";
+export async function gateReport(req) {
+    // The scan first, alone: freshness walks the partner set it derives. The
+    // three remaining checks are independent of each other — different files,
+    // memoized reads — so they run concurrently; only the scan must be ordered.
+    const scan = await partnerScan({ docsDir: req.docsDir, service: req.service, fleet: req.fleet });
+    const [freshness, verification, interrupted] = await Promise.all([
+        freshnessFindings(req, scan),
+        verificationCheck(req),
+        interruptedCommitFinding(req.docsDir),
+    ]);
+    const checks = [
+        { check: "partners", findings: partnersFindings(scan, req.service) },
+        { check: "freshness", findings: freshness },
+        { check: "verification", findings: verification.findings },
+        { check: "interrupted", findings: interrupted === null ? [] : [interrupted] },
+    ];
+    return {
+        service: req.service,
+        since: req.since === undefined ? null : { ref: req.since.ref, commit: req.since.commit },
+        landscape: scan.landscape,
+        partners: scan.partners,
+        features: verification.features,
+        checks,
+    };
+}
+/* ------------------------------------------------------------------ */
+/* Check 1: partners                                                   */
+/* ------------------------------------------------------------------ */
+function partnersFindings(scan, service) {
+    const findings = [];
+    // "Could not look" must never read as "no partners" — the docsRepoReady
+    // doctrine one level down. `validate --all` owns the diagnosis of the
+    // landscape itself; this code only refuses the false silence. The two ways
+    // of not looking are graded apart, the way `landscape.missing` and
+    // `landscape.invalid` are: ABSENT is a warning — a repo before its first
+    // adopt legitimately has no map yet — but a map that EXISTS and cannot be
+    // parsed or read is an ERROR, because `validate --all` fails that repo
+    // (`landscape.invalid`) and a deploy gate that passed where the fleet gate
+    // fails would be the quieter of two contradictory verdicts.
+    if (scan.landscape === "absent") {
+        findings.push({
+            severity: "warn",
+            code: "gate.partners-unknown",
+            message: `architecture/landscape.likec4 does not exist, so the partner set for '${service}' could not be derived — an absent map means nobody could look, not that nothing joins this service. \`loam validate --all\` diagnoses the landscape itself.`,
+        });
+    }
+    else if (scan.landscape === "invalid") {
+        findings.push({
+            severity: "error",
+            code: "gate.partners-unknown",
+            message: `architecture/landscape.likec4 exists but cannot be used — ${scan.landscapeProblem ?? "it did not parse"} — so the partner set for '${service}' could not be derived. ` +
+                `A broken map means nobody could look, not that nothing joins this service, and \`loam validate --all\` fails this repo for the same file. Fix the landscape, then re-run.`,
+        });
+    }
+    // The rung depends on the landscape only through the api question (does
+    // anything call this service?). With no readable map that question is
+    // unanswerable, and the fail-closed grading — `landscapeEvidence`: no proof
+    // means an API is expected — would convict a worker or UI for a contract
+    // nobody may be owed. One unanswerable fact yields ONE finding (the
+    // landscape's own, above), so under an unreadable map this error fires only
+    // when the service is below `documented` REGARDLESS of the api question.
+    const target = scan.landscape === "read" ? scan.target : scan.targetWithoutApi;
+    if (!atLeastDocumented(target.maturity)) {
+        findings.push({
+            severity: "error",
+            code: "gate.service-undocumented",
+            subject: service,
+            message: `${serviceTreePath(scan.targetEntry)}/ sits at '${target.maturity}' on the adoption ladder — below 'documented', the docs cannot say what its joins even are, so no recorded evidence can answer the deploy question. ` +
+                `Author the baseline (\`loam adopt --service ${service}\` briefs it); this check passes once the required artifact set exists and its spec.md no longer says \`adoption: partial\`.`,
+            details: target.gaps,
+            text: { detailPrefix: "- " },
+        });
+    }
+    // The partners that HAVE a directory, by id: their findings name it, and it
+    // is `services/<subsystem>/<id>/` for a filed one. The no-directory branch
+    // below keeps the bare `services/<id>/` spelling deliberately — there is no
+    // directory to name, and the unfiled form is what the fix would create.
+    const partnerPath = new Map(scan.partnerEntries.map((e) => [e.id, serviceTreePath(e)]));
+    for (const p of scan.partners) {
+        // An `#external` partner is somebody else's system: its side of the join
+        // is unrecorded ON PURPOSE, the same exemption the landscape census grants
+        // (`landscape.service-undocumented` skips #external too). The fleet's own
+        // infrastructure — a `database`, `queue`, `topic`, `cache` or `bucket` — is
+        // not a partner at all and never reaches this loop: `./partners.ts` drops it
+        // from the SET, beside the actors, because the three remedies below are all
+        // false of a store the fleet runs.
+        if (p.external)
+            continue;
+        if (p.maturity === null) {
+            findings.push({
+                severity: "warn",
+                code: "gate.partner-undocumented",
+                subject: p.service,
+                message: `'${p.service}' joins '${service}' (${p.via.join(", ")}) but has no services/${p.service}/ directory — its side of the join is unrecorded. ` +
+                    `Adopt it, bind its landscape element to the right service with metadata { service '<id>' }, or tag it #external if it is not ours.`,
+                details: p.via,
+            });
+        }
+        else if (!atLeastDocumented(p.maturity)) {
+            findings.push({
+                severity: "warn",
+                code: "gate.partner-undocumented",
+                subject: p.service,
+                message: `${partnerPath.get(p.service) ?? `services/${p.service}`}/ sits at '${p.maturity}' — below 'documented' — while it joins '${service}' (${p.via.join(", ")}): its side of the join is not fully recorded. \`loam adopt --service ${p.service}\` briefs what is missing.`,
+                details: p.via,
+            });
+        }
+    }
+    return findings;
+}
+/* ------------------------------------------------------------------ */
+/* Check 2: freshness                                                  */
+/* ------------------------------------------------------------------ */
+/**
+ * `serviceProvenance` filtered to the two staleness codes plus the ONE
+ * integrity error that makes freshness unjudgeable: `frontmatter.malformed`.
+ * A header YAML refuses to parse cannot certify a `content_digest`, and
+ * dropping that error read "cannot judge" as "nothing stale" — the exact
+ * fail-open a deploy gate must not have. Everything else provenance grades
+ * (missing owners, unstamped sources, absent frontmatter) is `validate`'s
+ * report to make — a deploy gate that repeated it would drown the findings a
+ * pipeline can actually act on at deploy time.
+ */
+async function freshnessFindings(req, scan) {
+    const subjects = [
+        {
+            id: req.service,
+            repoDir: req.repoDir,
+            paths: await locateServicePaths(req.docsDir, req.service, req.fleet),
+        },
+        // Only the DOCUMENTED partners: a partner with no directory has nothing to
+        // grade, and already carries gate.partner-undocumented from check 1.
+        ...scan.partnerEntries.map((e) => ({
+            id: e.id,
+            repoDir: undefined,
+            paths: servicePathsAt(e.dir),
+        })),
+    ];
+    // Independent per-subject reads through the shared memo; inOrder keeps the
+    // findings in subject order (target first, partners sorted) so identical
+    // state yields identical bytes.
+    const graded = await inOrder(subjects, async (s) => {
+        try {
+            // The integrity gate serviceProvenance cannot give: its own reads decode
+            // with 'utf8', which silently turns UTF-16 bytes into replacement
+            // characters — the file then grades as having no frontmatter at all (a
+            // warning this check does not retain), and mangled bytes read as
+            // "nothing stale". So both spec axes are decoded FIRST through the
+            // invocation's read index, whose decoder refuses non-UTF-8 naming the
+            // file (NotUtf8DocumentError spells `path` the way Node does, so the
+            // containment below names it without knowing the type).
+            for (const axis of SPEC_AXES) {
+                const path = s.paths[axis.key];
+                if (existsSync(path))
+                    await req.fleet.readText(path);
+            }
+            const all = await serviceProvenance(req.docsDir, s.id, { repoDir: s.repoDir, fleet: req.fleet });
+            return all
+                .filter((f) => f.code === "content.stale" ||
+                f.code === "sources.stale" ||
+                f.code === "frontmatter.malformed")
+                // The staleness emitters name the file in the message but set no
+                // subject; the payload's per-service attribution should not make a
+                // caller parse it back out of prose.
+                .map((f) => (f.subject === undefined ? { ...f, subject: s.id } : f));
+        }
+        catch (err) {
+            return [unreadableSubject("service", s.id, err)];
+        }
+    });
+    return graded.flat();
+}
+//# sourceMappingURL=checks.js.map

package/dist/core/gate/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../../src/core/gate/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAqB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAK/D,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAoB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAmD,MAAM,aAAa,CAAC;AAkBjG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAgB;IAC/C,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjG,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/D,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC;QAC5B,iBAAiB,CAAC,GAAG,CAAC;QACtB,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,GAAgB;QAC1B,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;QACpE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC3C,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC1D,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE;KAC9E,CAAC;IACF,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE;QACxF,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,SAAS,gBAAgB,CAAC,IAAiB,EAAE,OAAe;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,mEAAmE;IACnE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,yEAAyE,OAAO,8JAA8J;SACxP,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EACL,6DAA6D,IAAI,CAAC,gBAAgB,IAAI,kBAAkB,8BAA8B,OAAO,0BAA0B;gBACvK,2KAA2K;SAC9K,CAAC,CAAC;IACL,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,oEAAoE;IACpE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC/E,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,OAAO;YAChB,OAAO,EACL,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,MAAM,CAAC,QAAQ,sJAAsJ;gBACvN,+CAA+C,OAAO,8HAA8H;YACtL,OAAO,EAAE,MAAM,CAAC,IAAI;YACpB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,mCAAmC;QACnC,IAAI,CAAC,CAAC,QAAQ;YAAE,SAAS;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EACL,IAAI,CAAC,CAAC,OAAO,YAAY,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,oDAAoD;oBAC5I,oIAAoI;gBACtI,OAAO,EAAE,CAAC,CAAC,GAAG;aACf,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EACL,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,QAAQ,4CAA4C,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC,OAAO,4BAA4B;gBACzQ,OAAO,EAAE,CAAC,CAAC,GAAG;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,IAAiB;IAClE,MAAM,QAAQ,GAA6E;QACzF;YACE,EAAE,EAAE,GAAG,CAAC,OAAO;YACf,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC;SACrE;QACD,2EAA2E;QAC3E,qEAAqE;QACrE,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;KACJ,CAAC;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,IAAI,CAAC;YACH,yEAAyE;YACzE,kEAAkE;YAClE,uEAAuE;YACvE,iEAAiE;YACjE,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,wDAAwD;YACxD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,UAAU,CAAC,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YACjG,OAAO,GAAG;iBACP,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,eAAe;gBAC1B,CAAC,CAAC,IAAI,KAAK,eAAe;gBAC1B,CAAC,CAAC,IAAI,KAAK,uBAAuB,CACrC;gBACD,iEAAiE;gBACjE,mEAAmE;gBACnE,qCAAqC;iBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC","sourcesContent":["/**\n * The four checks behind `loam gate` — a can-i-deploy-shaped PURE QUERY over\n * evidence other commands already recorded. Nothing here executes anything,\n * writes anything, takes the docs lock, or re-derives a coherence plan: every\n * answer is either already on disk (verification.yaml, vouch stamps, the\n * commit journal) or a presence/landscape fact the enumeration carries.\n *\n *   partners      the landscape's direct joins, both ends graded on the ladder\n *   freshness     content.stale / sources.stale over the target and partners,\n *                 plus the one integrity error that makes freshness\n *                 unjudgeable (frontmatter.malformed) and a refusing decode\n *                 of the spec bytes themselves\n *   verification  verificationState per feature touching the service — the\n *                 active ones, plus those archived after `--since <ref>` when\n *                 a pipeline names the docs commit it last deployed from\n *                 (its own module, `./verification.ts`)\n *   interrupted   the `.loam-commit` journal — the one repo state that poisons\n *                 every other answer above\n *\n * Every `gate.*` code is spelled as a literal `code:` property at its emit\n * site, never through a code-taking factory parameter — verifyStep\n * (core/status/verification.ts) records that test/codes-drift.test.ts's\n * collector is blind to the parameter form, and a refactor toward a factory\n * would silently undocument the family.\n */\nimport { existsSync } from \"node:fs\";\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport { serviceProvenance } from \"../provenance/findings.js\";\nimport { interruptedCommitFinding } from \"../staging/recovery/finding.js\";\nimport { servicePathsAt, SPEC_AXES, type ServicePaths } from \"../repo/paths.js\";\nimport { serviceTreePath } from \"../kernel/ids/dirs.js\";\nimport { locateServicePaths } from \"../repo/service-target.js\";\nimport type { Finding } from \"../vocabulary/report.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport type { RawServiceId } from \"../kernel/ids/service.js\";\nimport { atLeastDocumented, partnerScan, type PartnerScan } from \"./partners.js\";\nimport { verificationCheck } from \"./verification.js\";\nimport { unreadableSubject, type GateCheck, type GateReport, type GateSince } from \"./report.js\";\n\nexport interface GateRequest {\n  docsDir: DocsDir;\n  /** The service being deployed — a name the enumeration approved. */\n  service: RawServiceId;\n  /**\n   * The repository loam is standing in, passed ONLY when the gated service is\n   * this repo's own binding — validate's `repoOf` rule: `sources` are paths\n   * into a service's own repository, so `sources.stale` is honestly checkable\n   * only there, while `content.stale` needs nothing but the document.\n   */\n  repoDir?: string;\n  fleet: FleetContext;\n  /** `--since <ref>`, resolved by the command; absent means in-flight features only. */\n  since?: GateSince;\n}\n\nexport async function gateReport(req: GateRequest): Promise<GateReport> {\n  // The scan first, alone: freshness walks the partner set it derives. The\n  // three remaining checks are independent of each other — different files,\n  // memoized reads — so they run concurrently; only the scan must be ordered.\n  const scan = await partnerScan({ docsDir: req.docsDir, service: req.service, fleet: req.fleet });\n  const [freshness, verification, interrupted] = await Promise.all([\n    freshnessFindings(req, scan),\n    verificationCheck(req),\n    interruptedCommitFinding(req.docsDir),\n  ]);\n  const checks: GateCheck[] = [\n    { check: \"partners\", findings: partnersFindings(scan, req.service) },\n    { check: \"freshness\", findings: freshness },\n    { check: \"verification\", findings: verification.findings },\n    { check: \"interrupted\", findings: interrupted === null ? [] : [interrupted] },\n  ];\n  return {\n    service: req.service,\n    since: req.since === undefined ? null : { ref: req.since.ref, commit: req.since.commit },\n    landscape: scan.landscape,\n    partners: scan.partners,\n    features: verification.features,\n    checks,\n  };\n}\n\n/* ------------------------------------------------------------------ */\n/* Check 1: partners                                                   */\n/* ------------------------------------------------------------------ */\n\nfunction partnersFindings(scan: PartnerScan, service: string): Finding[] {\n  const findings: Finding[] = [];\n  // \"Could not look\" must never read as \"no partners\" — the docsRepoReady\n  // doctrine one level down. `validate --all` owns the diagnosis of the\n  // landscape itself; this code only refuses the false silence. The two ways\n  // of not looking are graded apart, the way `landscape.missing` and\n  // `landscape.invalid` are: ABSENT is a warning — a repo before its first\n  // adopt legitimately has no map yet — but a map that EXISTS and cannot be\n  // parsed or read is an ERROR, because `validate --all` fails that repo\n  // (`landscape.invalid`) and a deploy gate that passed where the fleet gate\n  // fails would be the quieter of two contradictory verdicts.\n  if (scan.landscape === \"absent\") {\n    findings.push({\n      severity: \"warn\",\n      code: \"gate.partners-unknown\",\n      message: `architecture/landscape.likec4 does not exist, so the partner set for '${service}' could not be derived — an absent map means nobody could look, not that nothing joins this service. \\`loam validate --all\\` diagnoses the landscape itself.`,\n    });\n  } else if (scan.landscape === \"invalid\") {\n    findings.push({\n      severity: \"error\",\n      code: \"gate.partners-unknown\",\n      message:\n        `architecture/landscape.likec4 exists but cannot be used — ${scan.landscapeProblem ?? \"it did not parse\"} — so the partner set for '${service}' could not be derived. ` +\n        `A broken map means nobody could look, not that nothing joins this service, and \\`loam validate --all\\` fails this repo for the same file. Fix the landscape, then re-run.`,\n    });\n  }\n  // The rung depends on the landscape only through the api question (does\n  // anything call this service?). With no readable map that question is\n  // unanswerable, and the fail-closed grading — `landscapeEvidence`: no proof\n  // means an API is expected — would convict a worker or UI for a contract\n  // nobody may be owed. One unanswerable fact yields ONE finding (the\n  // landscape's own, above), so under an unreadable map this error fires only\n  // when the service is below `documented` REGARDLESS of the api question.\n  const target = scan.landscape === \"read\" ? scan.target : scan.targetWithoutApi;\n  if (!atLeastDocumented(target.maturity)) {\n    findings.push({\n      severity: \"error\",\n      code: \"gate.service-undocumented\",\n      subject: service,\n      message:\n        `${serviceTreePath(scan.targetEntry)}/ sits at '${target.maturity}' on the adoption ladder — below 'documented', the docs cannot say what its joins even are, so no recorded evidence can answer the deploy question. ` +\n        `Author the baseline (\\`loam adopt --service ${service}\\` briefs it); this check passes once the required artifact set exists and its spec.md no longer says \\`adoption: partial\\`.`,\n      details: target.gaps,\n      text: { detailPrefix: \"- \" },\n    });\n  }\n  // The partners that HAVE a directory, by id: their findings name it, and it\n  // is `services/<subsystem>/<id>/` for a filed one. The no-directory branch\n  // below keeps the bare `services/<id>/` spelling deliberately — there is no\n  // directory to name, and the unfiled form is what the fix would create.\n  const partnerPath = new Map(scan.partnerEntries.map((e) => [e.id as string, serviceTreePath(e)]));\n  for (const p of scan.partners) {\n    // An `#external` partner is somebody else's system: its side of the join\n    // is unrecorded ON PURPOSE, the same exemption the landscape census grants\n    // (`landscape.service-undocumented` skips #external too). The fleet's own\n    // infrastructure — a `database`, `queue`, `topic`, `cache` or `bucket` — is\n    // not a partner at all and never reaches this loop: `./partners.ts` drops it\n    // from the SET, beside the actors, because the three remedies below are all\n    // false of a store the fleet runs.\n    if (p.external) continue;\n    if (p.maturity === null) {\n      findings.push({\n        severity: \"warn\",\n        code: \"gate.partner-undocumented\",\n        subject: p.service,\n        message:\n          `'${p.service}' joins '${service}' (${p.via.join(\", \")}) but has no services/${p.service}/ directory — its side of the join is unrecorded. ` +\n          `Adopt it, bind its landscape element to the right service with metadata { service '<id>' }, or tag it #external if it is not ours.`,\n        details: p.via,\n      });\n    } else if (!atLeastDocumented(p.maturity)) {\n      findings.push({\n        severity: \"warn\",\n        code: \"gate.partner-undocumented\",\n        subject: p.service,\n        message:\n          `${partnerPath.get(p.service) ?? `services/${p.service}`}/ sits at '${p.maturity}' — below 'documented' — while it joins '${service}' (${p.via.join(\", \")}): its side of the join is not fully recorded. \\`loam adopt --service ${p.service}\\` briefs what is missing.`,\n        details: p.via,\n      });\n    }\n  }\n  return findings;\n}\n\n/* ------------------------------------------------------------------ */\n/* Check 2: freshness                                                  */\n/* ------------------------------------------------------------------ */\n\n/**\n * `serviceProvenance` filtered to the two staleness codes plus the ONE\n * integrity error that makes freshness unjudgeable: `frontmatter.malformed`.\n * A header YAML refuses to parse cannot certify a `content_digest`, and\n * dropping that error read \"cannot judge\" as \"nothing stale\" — the exact\n * fail-open a deploy gate must not have. Everything else provenance grades\n * (missing owners, unstamped sources, absent frontmatter) is `validate`'s\n * report to make — a deploy gate that repeated it would drown the findings a\n * pipeline can actually act on at deploy time.\n */\nasync function freshnessFindings(req: GateRequest, scan: PartnerScan): Promise<Finding[]> {\n  const subjects: { id: RawServiceId; repoDir: string | undefined; paths: ServicePaths }[] = [\n    {\n      id: req.service,\n      repoDir: req.repoDir,\n      paths: await locateServicePaths(req.docsDir, req.service, req.fleet),\n    },\n    // Only the DOCUMENTED partners: a partner with no directory has nothing to\n    // grade, and already carries gate.partner-undocumented from check 1.\n    ...scan.partnerEntries.map((e) => ({\n      id: e.id,\n      repoDir: undefined,\n      paths: servicePathsAt(e.dir),\n    })),\n  ];\n  // Independent per-subject reads through the shared memo; inOrder keeps the\n  // findings in subject order (target first, partners sorted) so identical\n  // state yields identical bytes.\n  const graded = await inOrder(subjects, async (s) => {\n    try {\n      // The integrity gate serviceProvenance cannot give: its own reads decode\n      // with 'utf8', which silently turns UTF-16 bytes into replacement\n      // characters — the file then grades as having no frontmatter at all (a\n      // warning this check does not retain), and mangled bytes read as\n      // \"nothing stale\". So both spec axes are decoded FIRST through the\n      // invocation's read index, whose decoder refuses non-UTF-8 naming the\n      // file (NotUtf8DocumentError spells `path` the way Node does, so the\n      // containment below names it without knowing the type).\n      for (const axis of SPEC_AXES) {\n        const path = s.paths[axis.key];\n        if (existsSync(path)) await req.fleet.readText(path);\n      }\n      const all = await serviceProvenance(req.docsDir, s.id, { repoDir: s.repoDir, fleet: req.fleet });\n      return all\n        .filter(\n          (f) =>\n            f.code === \"content.stale\" ||\n            f.code === \"sources.stale\" ||\n            f.code === \"frontmatter.malformed\",\n        )\n        // The staleness emitters name the file in the message but set no\n        // subject; the payload's per-service attribution should not make a\n        // caller parse it back out of prose.\n        .map((f) => (f.subject === undefined ? { ...f, subject: s.id } : f));\n    } catch (err) {\n      return [unreadableSubject(\"service\", s.id, err)];\n    }\n  });\n  return graded.flat();\n}\n"]}

package/dist/core/gate/partners.js

@@ -0,0 +1,246 @@
+/**
+ * The direct join partners of one service, derived from the LIVING landscape,
+ * and the maturity grading of everything on either end of a join.
+ *
+ * The landscape is the only place the fleet's joins are drawn, so the partner
+ * set is exactly the edges whose resolved source or target is the gated
+ * service — resolved through `serviceResolver` with the ENUMERATED fleet
+ * riding in, the same ride that keeps container-modelling landscapes attached
+ * everywhere else (an edge into `paymentService.api` is an edge into the
+ * service that owns it). A landscape that is absent or does not parse yields
+ * NO partner set, never an empty one: `landscape` says which, and the check
+ * layer turns "could not look" into `gate.partners-unknown` rather than
+ * letting it read as "no partners".
+ */
+import { existsSync } from "node:fs";
+import { errorText } from "../c4/likec4.js";
+import { serviceResolver } from "../c4/resolve/service.js";
+import { ACTOR_KINDS, EXTERNAL_TAG, INFRA_KINDS, landscapeEvidence, maturityGaps, serviceMaturity, MATURITY_LADDER, } from "../vocabulary/maturity.js";
+import { compareIds } from "../repo/entries.js";
+import { landscapePath, servicePathsAt } from "../repo/paths.js";
+import { enumeratedServices } from "../repo/service-target.js";
+import { ancestorIds } from "../kernel/ids/fqn/ancestors.js";
+/** Is this rung at or above `documented` — the fixed threshold check 1 grades against? */
+export function atLeastDocumented(m) {
+    return MATURITY_LADDER.indexOf(m) >= MATURITY_LADDER.indexOf("documented");
+}
+/**
+ * What the map says about one edge END: does it stand for a person, is it
+ * INFRASTRUCTURE, and is it tagged `#external`? Walked up the ancestor chain
+ * because all three facts are usually written on the containing system while
+ * the edge is drawn from a nested element — but the walk STOPS at the first
+ * element that stands for a service (an explicit binding or a title naming a
+ * real directory, `serviceResolver`'s own first two rungs, checked after that
+ * element's own facts are read). What sits above the service boundary is a
+ * grouping, and a grouping's `#external` is the grouping's claim, not the
+ * service's: without the stop, an adopted service drawn inside an `#external`
+ * zone was exempted from `gate.partner-undocumented` and its real rung hidden.
+ *
+ * `infra` is read only off an element that stands for NO service AND sits
+ * inside none, which is the asymmetry the `standsFor` local exists for. That is
+ * `commands/validate/fleet/census.ts` in two steps and in its order:
+ * `serviceLevelElements` drops everything drawn inside a service BEFORE
+ * `drawnSystems` ever applies the kind test, so a service's own interior never
+ * reaches it. Both halves are load-bearing. A `database` bound with
+ * `metadata { service '<id>' }` is an adopted service that happens to be drawn
+ * as a store — its side of the join IS recorded, and dropping it would hide a
+ * real partner's rung. And a store drawn INSIDE its owner — `orderService.db`,
+ * the ordinary way a team draws a private datastore — is that service's
+ * interior: reading the kind off it convicted the WHOLE endpoint as
+ * infrastructure, and `partnerScan` then dropped order-service from the partner
+ * set, so a service this gate exists to grade vanished because of how somebody
+ * drew its storage. The kind is the fallback for an element nothing else
+ * answers for, never the override.
+ */
+function endFacts(byId, known, id) {
+    let actor = false;
+    let infra = false;
+    let external = false;
+    // The id itself, then each dotted ancestor — the same walk `serviceResolver`
+    // resolves through, out of the one module that spells it
+    // (`core/kernel/ids/fqn/ancestors.ts`).
+    for (const candidate of ancestorIds(id)) {
+        const e = byId.get(candidate);
+        if (e === undefined)
+            continue;
+        const standsFor = e.service !== undefined || known.has(e.title);
+        if (ACTOR_KINDS.has(e.kind.toLowerCase()))
+            actor = true;
+        if (!standsFor && INFRA_KINDS.has(e.kind.toLowerCase()))
+            infra = true;
+        if (e.tags.includes(EXTERNAL_TAG))
+            external = true;
+        if (standsFor) {
+            // Everything the walk has visited so far was drawn INSIDE this service,
+            // so nothing visited so far was service-LEVEL and no kind read off it
+            // answers for a service — `serviceLevelElements` filtering ahead of the
+            // kind test, spelled as a walk. `actor` and `external` are deliberately
+            // left standing: a person or an `#external` tag written on a container is
+            // still a claim about this endpoint, while the store shape is a claim
+            // about the owner's interior.
+            infra = false;
+            break;
+        }
+    }
+    return { actor, infra, external };
+}
+/** How one edge joins the two ends, in the words the finding and the payload both use. */
+function viaOf(r) {
+    const typed = [
+        ...(r.op === undefined ? [] : [`operation ${r.op}`]),
+        ...(r.publishes === undefined ? [] : [`message ${r.publishes}`]),
+        ...(r.consumes === undefined ? [] : [`message ${r.consumes}`]),
+    ];
+    if (typed.length > 0)
+        return typed;
+    return [r.title === undefined ? "untyped edge" : `edge '${r.title}'`];
+}
+export async function partnerScan(req) {
+    const { docsDir, service, fleet } = req;
+    // The same memoized enumeration the command's resolveServiceTarget already
+    // performed on this FleetContext — one walk answers both questions.
+    const entries = await enumeratedServices(docsDir, fleet);
+    // Keyed as plain strings on purpose: the lookups below arrive from the
+    // resolver, whose names are document-asserted, and only a hit proves a
+    // directory. The VALUES keep the enumeration's provenance.
+    const entryById = new Map(entries.map((e) => [e.id, e]));
+    const known = new Set(entries.map((e) => e.id));
+    const lp = landscapePath(docsDir);
+    let landscape = "absent";
+    let landscapeProblem = null;
+    let elements = [];
+    let relationships = [];
+    if (existsSync(lp)) {
+        try {
+            const doc = await fleet.loadLikeC4(lp);
+            if (doc.errors.length > 0) {
+                landscape = "invalid";
+                const first = doc.errors[0];
+                // Through `errorText` — the raw message had no line, and a dropped
+                // quote's is a parser token list of thousands of lines.
+                landscapeProblem =
+                    `${doc.errors.length} parse error(s)` +
+                        (first === undefined ? "" : ` — first: ${errorText(first)}`);
+            }
+            else {
+                landscape = "read";
+                elements = doc.elements;
+                relationships = doc.relationships;
+            }
+        }
+        catch (err) {
+            // A landscape that could not be READ, graded as one that did not PARSE —
+            // commands/validate/fleet/load.ts's containment doctrine, spelled here
+            // because core cannot import it: "could not be read" and "did not parse"
+            // have the same consequence (nothing may be concluded from this file).
+            // The reason travels into the finding, message-preserving as
+            // `unreadableLandscape` is; the read error must not kill the run — the
+            // other three checks still have answers.
+            landscape = "invalid";
+            landscapeProblem = err instanceof Error ? err.message : String(err);
+        }
+    }
+    const parses = landscape === "read";
+    const svcOf = parses
+        ? serviceResolver(elements, known)
+        : (id) => id;
+    const elementIds = elements.map((e) => e.id);
+    // One service's ladder rung. `landscapeEvidence` is the ONE shared spelling
+    // of the positive-evidence apiExpected rule (core/vocabulary/maturity.ts);
+    // its own docblock warns against calling it per service inside a FLEET loop,
+    // and this loop is not one — it runs over the gated service and its direct
+    // partners, a handful, never the enumeration.
+    const gradeWith = (entry, apiExpected) => {
+        const input = {
+            entry,
+            archSpec: existsSync(servicePathsAt(entry.dir).archSpec),
+            apiExpected,
+        };
+        return { maturity: serviceMaturity(input), gaps: maturityGaps(input) };
+    };
+    const grade = (entry) => gradeWith(entry, landscapeEvidence({ id: entry.id, parses, relationships, elementIds, svcOf }).apiExpected);
+    // Unreachable by construction: the command layer resolved `service` against
+    // the same memoized enumeration this scan just read, and refused
+    // `unknown-service` when no directory answered. Failing closed here beats
+    // grading a service nobody enumerated as if its absence were a rung.
+    const targetEntry = entryById.get(service);
+    if (targetEntry === undefined) {
+        throw new Error(`gate: '${service}' vanished from the enumeration between resolve and scan`);
+    }
+    const byId = new Map(elements.map((e) => [e.id, e]));
+    const acc = new Map();
+    const join = (name, role, r, external) => {
+        const slot = acc.get(name) ?? { consumer: false, provider: false, external: false, via: new Set() };
+        if (role === "consumer")
+            slot.consumer = true;
+        else
+            slot.provider = true;
+        slot.external = slot.external || external;
+        for (const v of viaOf(r))
+            slot.via.add(v);
+        acc.set(name, slot);
+    };
+    for (const r of relationships) {
+        const source = svcOf(r.source);
+        const target = svcOf(r.target);
+        // A self-edge (both ends resolve to the gated service — its own containers
+        // talking to each other) names no partner.
+        if (source === target)
+            continue;
+        if (target === service) {
+            const facts = endFacts(byId, known, r.source);
+            // A person is never a deploy participant, and neither is the fleet's own
+            // infrastructure: the two kind exemptions every landscape census applies
+            // (drawnSystems, commands/validate/fleet/census.ts), spelled here off the
+            // same two sets so a gate and a validate run cannot disagree about what a
+            // partner IS.
+            //
+            // The infra half is the newer one, and it had a measured cost. A
+            // `database` the fleet owns and draws at fleet level joined every service
+            // that reads it, with `maturity: null` because there is no
+            // `services/<title>/` — so `gate.partner-undocumented` told the deployer
+            // to "adopt it, bind it … or tag it #external", three remedies none of
+            // which is true of a Postgres (measured on a one-service fixture,
+            // 2026-09-07). It is dropped from the partner SET rather than exempted
+            // from the finding, which is the actor precedent exactly: `partners` is
+            // the list of counterparties whose DOCS the gate grades, and a store has
+            // none to grade.
+            if (!facts.actor && !facts.infra)
+                join(source, "consumer", r, facts.external);
+        }
+        else if (source === service) {
+            const facts = endFacts(byId, known, r.target);
+            if (!facts.actor && !facts.infra)
+                join(target, "provider", r, facts.external);
+        }
+    }
+    // Sorted by id so identical state yields identical bytes — the accumulator's
+    // order is the landscape's edge order, which a reformat may shuffle.
+    const joined = [...acc.entries()].sort((a, b) => compareIds(a[0], b[0]));
+    const partners = joined.map(([name, slot]) => {
+        const entry = entryById.get(name);
+        return {
+            service: name,
+            maturity: entry === undefined ? null : grade(entry).maturity,
+            role: slot.consumer && slot.provider ? "both" : slot.consumer ? "consumer" : "provider",
+            via: [...slot.via].sort(),
+            // An adopted service is OURS whatever a zone's tag says: `external` and
+            // a maturity rung together must be unrepresentable, or the rung the
+            // payload carries is one the exemption hides and the human view drops.
+            external: entry === undefined && slot.external,
+        };
+    });
+    return {
+        landscape,
+        landscapeProblem,
+        targetEntry,
+        target: grade(targetEntry),
+        targetWithoutApi: gradeWith(targetEntry, false),
+        partners,
+        partnerEntries: joined.flatMap(([name]) => {
+            const entry = entryById.get(name);
+            return entry === undefined ? [] : [entry];
+        }),
+    };
+}
+//# sourceMappingURL=partners.js.map