@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/core/owners/codeowners.js

@@ -0,0 +1,141 @@
+/**
+ * A deliberately small CODEOWNERS reader: directory-pattern rules only,
+ * parsed fail-closed, matched mechanically — the join behind
+ * `loam list --owners <path>`. loam does not grow an ownership model of its
+ * own (SCHEMA.md: ownership is CODEOWNERS); this module only reads back, as
+ * data, what the forge's file already says.
+ *
+ * Three postures, and the line between them is the module's whole design:
+ *
+ * - A rule the subset UNDERSTANDS — a plain directory path, optionally
+ *   anchored with a leading `/`, optionally ending `/`, `/*` or `/**` — is
+ *   matched, last match winning, GitHub's own precedence. An OWNER-LESS rule
+ *   with such a pattern is understood too: it CLEARS ownership for what it
+ *   matches, exactly as the forge reads it — skipping it would fail in the
+ *   dangerous direction, leaving the earlier broad rule's team holding a
+ *   service the forge explicitly took off their plate.
+ * - A rule the subset RECOGNISES but does not implement — any other wildcard
+ *   use, `*` and `*.md` above all — is SKIPPED and reported, never guessed
+ *   at: an attribution computed from a half-understood pattern would file
+ *   services under teams the forge never named. Skipping only ever
+ *   UNDER-attributes (a service reads unowned, honestly listed), never the
+ *   reverse. The caller surfaces `skipped` beside the join.
+ * - A line that cannot be read as `pattern owner…` at all refuses as data
+ *   (`{ ok: false, line }`): silently dropping lines of a corrupted file
+ *   would grade it as a thin one — the same fail-closed rule the answers
+ *   reader applies to the other user-named file (`answers-unreadable`).
+ *
+ * Matching is by path SEGMENTS: a rule matches a service directory when the
+ * pattern's segments appear as one contiguous run in the service's
+ * docs-repo-relative directory segments — starting at the root when the
+ * pattern is anchored, at any depth when it is not. Two deliberate
+ * divergences from gitignore semantics, both pinned by
+ * test/list-campaign.test.ts so they are documented behaviour, not accident:
+ * a slash-containing pattern WITHOUT a leading `/` (`services/payments/`)
+ * matches at any depth here, where the forge would anchor it to the root —
+ * a BROADER attribution, since a rule can match at a depth GitHub would
+ * not, though the segments still have to appear verbatim; and a trailing
+ * `/*` is read as the directory itself (services anywhere beneath match),
+ * where GitHub would stop at direct children. One rule for all spellings
+ * keeps the subset explainable in a sentence.
+ *
+ * Pure on purpose: content arrives as a string, and nothing here touches the
+ * filesystem or prints, so the command layer owns the read and the
+ * `owners-unreadable` refusal (core never prints — AGENTS.md).
+ */
+/**
+ * What an owner token may look like: `@user`, `@org/team`, or an email — the
+ * three forms GitHub's own syntax accepts. Anything else in owner position is
+ * a corrupted line, not a rule, and the whole parse refuses with its number.
+ */
+const OWNER_TOKEN = /^@[^\s@/]+(?:\/[^\s@/]+)?$|^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+export function parseCodeowners(content) {
+    const rules = [];
+    const skipped = [];
+    // A UTF-8 BOM would otherwise glue itself onto the first pattern and turn
+    // an anchored rule silently unanchored.
+    const lines = content.replace(/^\uFEFF/, "").split(/\r?\n/);
+    for (const [index, raw] of lines.entries()) {
+        const line = index + 1;
+        const text = raw.trim();
+        if (text === "" || text.startsWith("#"))
+            continue;
+        // A trailing comment is dropped from its `#` token on. Owners precede any
+        // comment, so nothing a comment says can change the rule it annotates —
+        // and the `#` token cannot be index 0, because a line whose first token
+        // starts with `#` took the comment branch above.
+        const tokens = text.split(/\s+/);
+        const hash = tokens.findIndex((token) => token.startsWith("#"));
+        const effective = hash === -1 ? tokens : tokens.slice(0, hash);
+        const pattern = effective[0];
+        const owners = effective.slice(1);
+        const bad = owners.find((token) => !OWNER_TOKEN.test(token));
+        if (bad !== undefined) {
+            return { ok: false, line, problem: `'${bad}' is not an owner (@user, @org/team or an email address)` };
+        }
+        const read = readPattern(pattern);
+        if (read === null) {
+            skipped.push({ line, pattern });
+            continue;
+        }
+        // `owners` may be empty: an owner-less in-subset rule is GitHub's
+        // ownership-clearing form, and last-match-wins performs the clear for
+        // free — a matching empty rule overwrites the earlier team with nobody.
+        rules.push({ line, pattern, ...read, owners });
+    }
+    return { ok: true, rules, skipped };
+}
+/** The pattern grammar of the implemented subset, or null when outside it. */
+function readPattern(pattern) {
+    const trimmed = pattern.endsWith("/**")
+        ? pattern.slice(0, -3)
+        : pattern.endsWith("/*")
+            ? pattern.slice(0, -2)
+            : pattern;
+    // Any wildcard, character class, negation or escape elsewhere in the
+    // pattern is real CODEOWNERS syntax this subset does not implement.
+    if (/[*?[\]!\\]/.test(trimmed))
+        return null;
+    const anchored = trimmed.startsWith("/");
+    const body = (anchored ? trimmed.slice(1) : trimmed).replace(/\/$/, "");
+    if (body === "")
+        return null;
+    const segments = body.split("/");
+    if (segments.some((segment) => segment === ""))
+        return null;
+    return { anchored, segments };
+}
+/**
+ * The owners of the LAST rule matching this directory, or `[]` for an
+ * unowned one — later rules override earlier ones, GitHub's own precedence,
+ * so a specific team can reclaim a corner of a broadly-owned tree. `dir` is
+ * the service's docs-repo-relative directory split on `/`
+ * (`["services", "payments", "pay-a"]`).
+ */
+export function ownersFor(dir, rules) {
+    let owners = [];
+    for (const rule of rules) {
+        if (matches(dir, rule))
+            owners = rule.owners;
+    }
+    return owners;
+}
+/**
+ * A directory pattern names a directory, and covers the service AT that
+ * directory and every service beneath it — which is exactly "the pattern's
+ * segments appear as a contiguous run in the service's own segments".
+ */
+function matches(dir, rule) {
+    const last = dir.length - rule.segments.length;
+    if (last < 0)
+        return false;
+    const startsAt = (from) => rule.segments.every((segment, i) => dir[from + i] === segment);
+    if (rule.anchored)
+        return startsAt(0);
+    for (let from = 0; from <= last; from += 1) {
+        if (startsAt(from))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=codeowners.js.map

package/dist/core/owners/codeowners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codeowners.js","sourceRoot":"","sources":["../../../src/core/owners/codeowners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAyBH;;;;GAIG;AACH,MAAM,WAAW,GAAG,uDAAuD,CAAC;AAE5E,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,0EAA0E;IAC1E,wCAAwC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,0DAA0D,EAAE,CAAC;QACzG,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QACD,kEAAkE;QAClE,sEAAsE;QACtE,wEAAwE;QACxE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,CAAC,CAAC,OAAO,CAAC;IACd,qEAAqE;IACrE,oEAAoE;IACpE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,GAAsB,EAAE,KAA4B;IAC5E,IAAI,MAAM,GAAsB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,GAAsB,EAAE,IAAgB;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC/C,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAW,EAAE,CACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * A deliberately small CODEOWNERS reader: directory-pattern rules only,\n * parsed fail-closed, matched mechanically — the join behind\n * `loam list --owners <path>`. loam does not grow an ownership model of its\n * own (SCHEMA.md: ownership is CODEOWNERS); this module only reads back, as\n * data, what the forge's file already says.\n *\n * Three postures, and the line between them is the module's whole design:\n *\n * - A rule the subset UNDERSTANDS — a plain directory path, optionally\n *   anchored with a leading `/`, optionally ending `/`, `/*` or `/**` — is\n *   matched, last match winning, GitHub's own precedence. An OWNER-LESS rule\n *   with such a pattern is understood too: it CLEARS ownership for what it\n *   matches, exactly as the forge reads it — skipping it would fail in the\n *   dangerous direction, leaving the earlier broad rule's team holding a\n *   service the forge explicitly took off their plate.\n * - A rule the subset RECOGNISES but does not implement — any other wildcard\n *   use, `*` and `*.md` above all — is SKIPPED and reported, never guessed\n *   at: an attribution computed from a half-understood pattern would file\n *   services under teams the forge never named. Skipping only ever\n *   UNDER-attributes (a service reads unowned, honestly listed), never the\n *   reverse. The caller surfaces `skipped` beside the join.\n * - A line that cannot be read as `pattern owner…` at all refuses as data\n *   (`{ ok: false, line }`): silently dropping lines of a corrupted file\n *   would grade it as a thin one — the same fail-closed rule the answers\n *   reader applies to the other user-named file (`answers-unreadable`).\n *\n * Matching is by path SEGMENTS: a rule matches a service directory when the\n * pattern's segments appear as one contiguous run in the service's\n * docs-repo-relative directory segments — starting at the root when the\n * pattern is anchored, at any depth when it is not. Two deliberate\n * divergences from gitignore semantics, both pinned by\n * test/list-campaign.test.ts so they are documented behaviour, not accident:\n * a slash-containing pattern WITHOUT a leading `/` (`services/payments/`)\n * matches at any depth here, where the forge would anchor it to the root —\n * a BROADER attribution, since a rule can match at a depth GitHub would\n * not, though the segments still have to appear verbatim; and a trailing\n * `/*` is read as the directory itself (services anywhere beneath match),\n * where GitHub would stop at direct children. One rule for all spellings\n * keeps the subset explainable in a sentence.\n *\n * Pure on purpose: content arrives as a string, and nothing here touches the\n * filesystem or prints, so the command layer owns the read and the\n * `owners-unreadable` refusal (core never prints — AGENTS.md).\n */\n\n/** One rule the implemented subset accepted, in file order. */\nexport interface OwnersRule {\n  /** 1-based line number in the file, for messages and reports. */\n  readonly line: number;\n  /** The pattern exactly as written, for reporting. */\n  readonly pattern: string;\n  /** True when the pattern began with `/` — matched from the repo root only. */\n  readonly anchored: boolean;\n  /** The pattern's path segments, leading `/`, trailing `/`, `/*`, `/**` stripped. */\n  readonly segments: readonly string[];\n  readonly owners: readonly string[];\n}\n\n/** A recognised rule outside the implemented subset — reported, never guessed. */\nexport interface SkippedRule {\n  readonly line: number;\n  readonly pattern: string;\n}\n\nexport type ParsedCodeowners =\n  | { readonly ok: true; readonly rules: readonly OwnersRule[]; readonly skipped: readonly SkippedRule[] }\n  | { readonly ok: false; readonly line: number; readonly problem: string };\n\n/**\n * What an owner token may look like: `@user`, `@org/team`, or an email — the\n * three forms GitHub's own syntax accepts. Anything else in owner position is\n * a corrupted line, not a rule, and the whole parse refuses with its number.\n */\nconst OWNER_TOKEN = /^@[^\\s@/]+(?:\\/[^\\s@/]+)?$|^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nexport function parseCodeowners(content: string): ParsedCodeowners {\n  const rules: OwnersRule[] = [];\n  const skipped: SkippedRule[] = [];\n  // A UTF-8 BOM would otherwise glue itself onto the first pattern and turn\n  // an anchored rule silently unanchored.\n  const lines = content.replace(/^\\uFEFF/, \"\").split(/\\r?\\n/);\n  for (const [index, raw] of lines.entries()) {\n    const line = index + 1;\n    const text = raw.trim();\n    if (text === \"\" || text.startsWith(\"#\")) continue;\n    // A trailing comment is dropped from its `#` token on. Owners precede any\n    // comment, so nothing a comment says can change the rule it annotates —\n    // and the `#` token cannot be index 0, because a line whose first token\n    // starts with `#` took the comment branch above.\n    const tokens = text.split(/\\s+/);\n    const hash = tokens.findIndex((token) => token.startsWith(\"#\"));\n    const effective = hash === -1 ? tokens : tokens.slice(0, hash);\n    const pattern = effective[0]!;\n    const owners = effective.slice(1);\n    const bad = owners.find((token) => !OWNER_TOKEN.test(token));\n    if (bad !== undefined) {\n      return { ok: false, line, problem: `'${bad}' is not an owner (@user, @org/team or an email address)` };\n    }\n    const read = readPattern(pattern);\n    if (read === null) {\n      skipped.push({ line, pattern });\n      continue;\n    }\n    // `owners` may be empty: an owner-less in-subset rule is GitHub's\n    // ownership-clearing form, and last-match-wins performs the clear for\n    // free — a matching empty rule overwrites the earlier team with nobody.\n    rules.push({ line, pattern, ...read, owners });\n  }\n  return { ok: true, rules, skipped };\n}\n\n/** The pattern grammar of the implemented subset, or null when outside it. */\nfunction readPattern(pattern: string): { anchored: boolean; segments: string[] } | null {\n  const trimmed = pattern.endsWith(\"/**\")\n    ? pattern.slice(0, -3)\n    : pattern.endsWith(\"/*\")\n      ? pattern.slice(0, -2)\n      : pattern;\n  // Any wildcard, character class, negation or escape elsewhere in the\n  // pattern is real CODEOWNERS syntax this subset does not implement.\n  if (/[*?[\\]!\\\\]/.test(trimmed)) return null;\n  const anchored = trimmed.startsWith(\"/\");\n  const body = (anchored ? trimmed.slice(1) : trimmed).replace(/\\/$/, \"\");\n  if (body === \"\") return null;\n  const segments = body.split(\"/\");\n  if (segments.some((segment) => segment === \"\")) return null;\n  return { anchored, segments };\n}\n\n/**\n * The owners of the LAST rule matching this directory, or `[]` for an\n * unowned one — later rules override earlier ones, GitHub's own precedence,\n * so a specific team can reclaim a corner of a broadly-owned tree. `dir` is\n * the service's docs-repo-relative directory split on `/`\n * (`[\"services\", \"payments\", \"pay-a\"]`).\n */\nexport function ownersFor(dir: readonly string[], rules: readonly OwnersRule[]): readonly string[] {\n  let owners: readonly string[] = [];\n  for (const rule of rules) {\n    if (matches(dir, rule)) owners = rule.owners;\n  }\n  return owners;\n}\n\n/**\n * A directory pattern names a directory, and covers the service AT that\n * directory and every service beneath it — which is exactly \"the pattern's\n * segments appear as a contiguous run in the service's own segments\".\n */\nfunction matches(dir: readonly string[], rule: OwnersRule): boolean {\n  const last = dir.length - rule.segments.length;\n  if (last < 0) return false;\n  const startsAt = (from: number): boolean =>\n    rule.segments.every((segment, i) => dir[from + i] === segment);\n  if (rule.anchored) return startsAt(0);\n  for (let from = 0; from <= last; from += 1) {\n    if (startsAt(from)) return true;\n  }\n  return false;\n}\n"]}

package/dist/core/pack/features.js

@@ -0,0 +1,120 @@
+/**
+ * The in-flight section of one service's context pack: every active feature
+ * whose delta touches the service, projected onto it exactly the way
+ * `loam delta` projects — same helpers (`core/projection/`), same known-set,
+ * same shapes — so the pack and the brief can never disagree about what a
+ * feature changes here.
+ *
+ * THE BUSINESS CORPUS IS DELIBERATELY EXCLUDED, and it is the one place this
+ * module and `loam delta` are allowed to differ. `loam delta` gained a
+ * `capabilities` section — the promises a feature changes, and the
+ * `Realizes: <capability>#<id>` entry each one is addressed by — because it is
+ * read by a person about to author a requirement. A context pack is not that:
+ * it is ONE SERVICE'S slice, assembled to be copied into that service's own
+ * repository, and a capability delta names no service. Including it would make
+ * a service repository's briefing depend on the fleet's business corpus — the
+ * first such dependency anywhere in loam, and the exact inversion of the rule
+ * this axis is built on, that neither corpus is derived from the other
+ * (`core/capabilities/rollup.ts` states it: "TWO CORPORA MEET HERE, and neither
+ * is derived from the other"). A service that wants to know which promise its
+ * requirement keeps reads the `Realizes:` line on the requirement itself, which
+ * IS in the pack, because it is part of the service's own document.
+ *
+ * That is an exclusion by design, not an omission waiting to be filled: adding
+ * the section later is a product decision about what a service repository is
+ * allowed to depend on, and it needs to be argued in those terms rather than
+ * landed as a missing field.
+ */
+import { existsSync } from "node:fs";
+import { FleetContext } from "../fleet-context.js";
+import {} from "../c4/likec4.js";
+import { repoPath } from "../envelope/json.js";
+import { stripFrontmatter } from "../document/frontmatter.js";
+import { inOrder } from "../kernel/concurrency.js";
+import { apiChanges } from "../projection/api.js";
+import { eventChanges } from "../projection/events.js";
+import { archSlice, introducedServices } from "../projection/arch-slice.js";
+import { compareIds } from "../repo/entries.js";
+import { featurePaths, featureSpecPaths } from "../repo/paths.js";
+import { packRequirement } from "./living.js";
+export async function buildFeatures(req) {
+    const { docsDir, entry, feature, context } = req;
+    // `--feature` narrows to the one feature and includes it even when it does
+    // not touch the service — a known feature projects onto any living service
+    // (delta's stance), and the empty sections plus the feature's own `services`
+    // list ARE the answer. The default is every active feature, and "touches"
+    // needs each one's C4 delta: a feature that introduces this service draws no
+    // specs/<svc>/ directory yet.
+    const candidates = feature !== null ? [feature] : await context.listFeatures(docsDir);
+    // Batch-parse the deltas through the shared workspace before the pool walks
+    // them: `prefetchLikeC4` seeds the memo, so the loop below hits it instead
+    // of opening one Langium workspace per feature. Accelerator only — a
+    // batch-infrastructure failure degrades silently to per-path loads, so no
+    // answer in the pack can ever depend on tmpdir writability.
+    await context.prefetchLikeC4(candidates.filter((f) => f.has.delta).map((f) => featurePaths(f.dir).delta));
+    // Through the pool: each delta load holds a LikeC4/Langium workspace, and an
+    // unbounded fan-out over the features in flight is the memory shape the pool
+    // exists to cap. Results come back in input order, which listFeatures already
+    // sorted with compareIds — the pack's feature order is that order.
+    const loaded = await inOrder(candidates, async (f) => {
+        const deltaDoc = f.has.delta ? await context.loadLikeC4(featurePaths(f.dir).delta) : null;
+        const services = [...new Set([...f.services, ...introducedServices(deltaDoc, f.id)])].sort(compareIds);
+        return { entry: f, deltaDoc, services };
+    });
+    // A feature whose delta does not parse names no services — `services` above
+    // is only its specs/ list — so "does it touch this one?" has no answer. It
+    // is INCLUDED, with its errors riding in `architecture.errors` (a hole the
+    // command turns into exit 1), because dropping it makes the feature vanish
+    // from every service's pack at exit 0: an agent then works in the service
+    // believing nothing is in flight, which is the vacuously-green trap again,
+    // one document up.
+    const deltaUnread = (l) => l.deltaDoc !== null && l.deltaDoc.errors.length > 0;
+    const included = feature !== null
+        ? loaded
+        : loaded.filter((l) => l.services.includes(entry.id) || deltaUnread(l));
+    // The living∪feature known-set delta.ts builds, so a container-targeted edge
+    // resolves to the same owner here and there.
+    const living = (await context.listServices(docsDir)).map((s) => s.id);
+    return inOrder(included, (l) => projectFeature({ docsDir, service: entry.id, living, context, loaded: l }));
+}
+async function projectFeature(req) {
+    const { docsDir, service, living, context, loaded } = req;
+    const { entry: f, deltaDoc, services } = loaded;
+    const paths = featurePaths(f.dir);
+    const specPaths = featureSpecPaths(f.dir, service);
+    // Independent reads, fanned out; the contract projections carry their own
+    // readability flags, so nothing here throws for a document that merely does
+    // not parse — an unparseable delta is a HOLE the pack reports and the
+    // command turns into exit 1, never a refusal.
+    const [intentText, reqs, archReqs, api, events] = await Promise.all([
+        f.has.intent ? context.readText(paths.intent) : null,
+        existsSync(specPaths.spec) ? context.readRequirements(specPaths.spec) : [],
+        existsSync(specPaths.archSpec) ? context.readRequirements(specPaths.archSpec) : [],
+        apiChanges(specPaths.openapi),
+        eventChanges(specPaths.asyncapi),
+    ]);
+    return {
+        feature: f.id,
+        path: repoPath(docsDir, f.dir),
+        services,
+        intent: intentText === null ? null : stripFrontmatter(intentText).trim(),
+        requirements: reqs.map(packRequirement),
+        archRequirements: archReqs.map(packRequirement),
+        ...apiSplit(api),
+        events,
+        architecture: archSlice(deltaDoc, service, f.id, new Set([...living, ...services])),
+    };
+}
+/**
+ * The delta payload's split shape, kept verbatim: `api` stays exactly the
+ * operations array `loam delta` emits, and the document's readability rides
+ * alongside as its own key — a consumer indexing one must not have to learn a
+ * second shape here.
+ */
+function apiSplit(api) {
+    return {
+        api: api.changes,
+        openapi: { unreadable: api.unreadable, ...(api.error === undefined ? {} : { error: api.error }) },
+    };
+}
+//# sourceMappingURL=features.js.map

package/dist/core/pack/features.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features.js","sourceRoot":"","sources":["../../../src/core/pack/features.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAkB,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,UAAU,EAAiC,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAmB,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAkB,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAwC,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAwB,MAAM,aAAa,CAAC;AAiCpE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB;IACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAEjD,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACtF,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,OAAO,CAAC,cAAc,CAC1B,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAC5E,CAAC;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,MAAM,GAAoB,MAAM,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACxF,UAAU,CACX,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,mBAAmB;IACnB,MAAM,WAAW,GAAG,CAAC,CAAgB,EAAW,EAAE,CAChD,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,MAAM,QAAQ,GACZ,OAAO,KAAK,IAAI;QACd,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9G,CAAC;AAUD,KAAK,UAAU,cAAc,CAAC,GAAmB;IAC/C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEnD,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,8CAA8C;IAC9C,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QACpD,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QAC1E,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;QAClF,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7B,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,EAAE;QACb,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC;QAC9B,QAAQ;QACR,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;QACxE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;QACvC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;QAC/C,GAAG,QAAQ,CAAC,GAAG,CAAC;QAChB,MAAM;QACN,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;KACpF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,GAAa;IAC7B,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,OAAO;QAChB,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE;KAClG,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The in-flight section of one service's context pack: every active feature\n * whose delta touches the service, projected onto it exactly the way\n * `loam delta` projects — same helpers (`core/projection/`), same known-set,\n * same shapes — so the pack and the brief can never disagree about what a\n * feature changes here.\n *\n * THE BUSINESS CORPUS IS DELIBERATELY EXCLUDED, and it is the one place this\n * module and `loam delta` are allowed to differ. `loam delta` gained a\n * `capabilities` section — the promises a feature changes, and the\n * `Realizes: <capability>#<id>` entry each one is addressed by — because it is\n * read by a person about to author a requirement. A context pack is not that:\n * it is ONE SERVICE'S slice, assembled to be copied into that service's own\n * repository, and a capability delta names no service. Including it would make\n * a service repository's briefing depend on the fleet's business corpus — the\n * first such dependency anywhere in loam, and the exact inversion of the rule\n * this axis is built on, that neither corpus is derived from the other\n * (`core/capabilities/rollup.ts` states it: \"TWO CORPORA MEET HERE, and neither\n * is derived from the other\"). A service that wants to know which promise its\n * requirement keeps reads the `Realizes:` line on the requirement itself, which\n * IS in the pack, because it is part of the service's own document.\n *\n * That is an exclusion by design, not an omission waiting to be filled: adding\n * the section later is a product decision about what a service repository is\n * allowed to depend on, and it needs to be argued in those terms rather than\n * landed as a missing field.\n */\nimport { existsSync } from \"node:fs\";\nimport { FleetContext } from \"../fleet-context.js\";\nimport { type LoadedDoc } from \"../c4/likec4.js\";\nimport { repoPath } from \"../envelope/json.js\";\nimport { stripFrontmatter } from \"../document/frontmatter.js\";\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport { apiChanges, type ApiChange, type ApiSlice } from \"../projection/api.js\";\nimport { eventChanges, type EventSlice } from \"../projection/events.js\";\nimport { archSlice, introducedServices, type ArchSlice } from \"../projection/arch-slice.js\";\nimport { compareIds, type FeatureEntry, type ServiceEntry } from \"../repo/entries.js\";\nimport { featurePaths, featureSpecPaths } from \"../repo/paths.js\";\nimport { packRequirement, type PackRequirement } from \"./living.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\n\n/** One active feature's projection onto the pack's service — `loam delta`'s shapes, verbatim. */\nexport interface PackFeature {\n  feature: string;\n  path: string;\n  /** Every service the feature speaks about: its spec deltas plus what its C4 delta introduces. */\n  services: string[];\n  intent: string | null;\n  requirements: PackRequirement[];\n  archRequirements: PackRequirement[];\n  api: ApiChange[];\n  openapi: { unreadable: boolean; error?: string };\n  events: EventSlice;\n  architecture: ArchSlice;\n}\n\nexport interface FeaturesRequest {\n  docsDir: DocsDir;\n  entry: ServiceEntry;\n  /** The one feature `--feature` named, or null for every touching feature. */\n  feature: FeatureEntry | null;\n  context: FleetContext;\n}\n\n/** A feature with its delta loaded and its full service list derived. */\ninterface LoadedFeature {\n  entry: FeatureEntry;\n  deltaDoc: LoadedDoc | null;\n  services: string[];\n}\n\nexport async function buildFeatures(req: FeaturesRequest): Promise<PackFeature[]> {\n  const { docsDir, entry, feature, context } = req;\n\n  // `--feature` narrows to the one feature and includes it even when it does\n  // not touch the service — a known feature projects onto any living service\n  // (delta's stance), and the empty sections plus the feature's own `services`\n  // list ARE the answer. The default is every active feature, and \"touches\"\n  // needs each one's C4 delta: a feature that introduces this service draws no\n  // specs/<svc>/ directory yet.\n  const candidates = feature !== null ? [feature] : await context.listFeatures(docsDir);\n  // Batch-parse the deltas through the shared workspace before the pool walks\n  // them: `prefetchLikeC4` seeds the memo, so the loop below hits it instead\n  // of opening one Langium workspace per feature. Accelerator only — a\n  // batch-infrastructure failure degrades silently to per-path loads, so no\n  // answer in the pack can ever depend on tmpdir writability.\n  await context.prefetchLikeC4(\n    candidates.filter((f) => f.has.delta).map((f) => featurePaths(f.dir).delta),\n  );\n  // Through the pool: each delta load holds a LikeC4/Langium workspace, and an\n  // unbounded fan-out over the features in flight is the memory shape the pool\n  // exists to cap. Results come back in input order, which listFeatures already\n  // sorted with compareIds — the pack's feature order is that order.\n  const loaded: LoadedFeature[] = await inOrder(candidates, async (f) => {\n    const deltaDoc = f.has.delta ? await context.loadLikeC4(featurePaths(f.dir).delta) : null;\n    const services = [...new Set([...f.services, ...introducedServices(deltaDoc, f.id)])].sort(\n      compareIds,\n    );\n    return { entry: f, deltaDoc, services };\n  });\n  // A feature whose delta does not parse names no services — `services` above\n  // is only its specs/ list — so \"does it touch this one?\" has no answer. It\n  // is INCLUDED, with its errors riding in `architecture.errors` (a hole the\n  // command turns into exit 1), because dropping it makes the feature vanish\n  // from every service's pack at exit 0: an agent then works in the service\n  // believing nothing is in flight, which is the vacuously-green trap again,\n  // one document up.\n  const deltaUnread = (l: LoadedFeature): boolean =>\n    l.deltaDoc !== null && l.deltaDoc.errors.length > 0;\n  const included =\n    feature !== null\n      ? loaded\n      : loaded.filter((l) => l.services.includes(entry.id) || deltaUnread(l));\n\n  // The living∪feature known-set delta.ts builds, so a container-targeted edge\n  // resolves to the same owner here and there.\n  const living = (await context.listServices(docsDir)).map((s) => s.id);\n  return inOrder(included, (l) => projectFeature({ docsDir, service: entry.id, living, context, loaded: l }));\n}\n\ninterface ProjectRequest {\n  docsDir: DocsDir;\n  service: ServiceEntry[\"id\"];\n  living: string[];\n  context: FleetContext;\n  loaded: LoadedFeature;\n}\n\nasync function projectFeature(req: ProjectRequest): Promise<PackFeature> {\n  const { docsDir, service, living, context, loaded } = req;\n  const { entry: f, deltaDoc, services } = loaded;\n  const paths = featurePaths(f.dir);\n  const specPaths = featureSpecPaths(f.dir, service);\n\n  // Independent reads, fanned out; the contract projections carry their own\n  // readability flags, so nothing here throws for a document that merely does\n  // not parse — an unparseable delta is a HOLE the pack reports and the\n  // command turns into exit 1, never a refusal.\n  const [intentText, reqs, archReqs, api, events] = await Promise.all([\n    f.has.intent ? context.readText(paths.intent) : null,\n    existsSync(specPaths.spec) ? context.readRequirements(specPaths.spec) : [],\n    existsSync(specPaths.archSpec) ? context.readRequirements(specPaths.archSpec) : [],\n    apiChanges(specPaths.openapi),\n    eventChanges(specPaths.asyncapi),\n  ]);\n\n  return {\n    feature: f.id,\n    path: repoPath(docsDir, f.dir),\n    services,\n    intent: intentText === null ? null : stripFrontmatter(intentText).trim(),\n    requirements: reqs.map(packRequirement),\n    archRequirements: archReqs.map(packRequirement),\n    ...apiSplit(api),\n    events,\n    architecture: archSlice(deltaDoc, service, f.id, new Set([...living, ...services])),\n  };\n}\n\n/**\n * The delta payload's split shape, kept verbatim: `api` stays exactly the\n * operations array `loam delta` emits, and the document's readability rides\n * alongside as its own key — a consumer indexing one must not have to learn a\n * second shape here.\n */\nfunction apiSplit(api: ApiSlice): { api: ApiChange[]; openapi: { unreadable: boolean; error?: string } } {\n  return {\n    api: api.changes,\n    openapi: { unreadable: api.unreadable, ...(api.error === undefined ? {} : { error: api.error }) },\n  };\n}\n"]}

package/dist/core/pack/joins.js

@@ -0,0 +1,112 @@
+/**
+ * The three fleet-vocabulary joins in one service's context pack: the
+ * permissions its requirements gate on, the capabilities they realize, and the
+ * business flows it is a hop of. All three resolve a per-service fact against a
+ * fleet document, which is what separates them from `./living.ts` — that module
+ * never has to look past the service's own directory and the fleet map.
+ *
+ * The use-case join is the newest and the one whose absence was loudest: an
+ * agent briefed on a service was told which capabilities its requirements
+ * realize and never told that step 4 of Checkout calls it. The capability is the
+ * label; the flow is the caller.
+ */
+import { FleetContext } from "../fleet-context.js";
+import { capabilityRollup } from "../capabilities/rollup.js";
+import { repoPath } from "../envelope/json.js";
+import { readVocabulary } from "../permissions/permissions.js";
+import { compareIds } from "../repo/entries.js";
+import { permissionsPath, servicePathsAt, SPEC_AXES } from "../repo/paths.js";
+import { existsSync } from "node:fs";
+import { readUseCases } from "../usecases/fleet.js";
+import { flowsClaiming } from "../usecases/capability.js";
+import { flowsTouching } from "../usecases/touch.js";
+export async function buildJoins(req) {
+    const { docsDir, entry, context } = req;
+    const paths = servicePathsAt(entry.dir);
+    // The same two spec reads `living.ts` makes — memoized on the shared
+    // context, so whichever module asks first pays the I/O once and the two
+    // cannot read two different versions of one file. Fanned out because the
+    // axes are independent; SPEC_AXES order (spec before arch-spec) is preserved
+    // by Promise.all, which is what keeps `wanted` deterministic.
+    const perAxis = await Promise.all(SPEC_AXES.map((axis) => existsSync(paths[axis.key]) ? context.readRequirements(paths[axis.key]) : Promise.resolve([])));
+    const active = perAxis.flat().filter((r) => r.kind !== "REMOVED");
+    // One vocabulary parse per pack — the pack asks about one service, so this
+    // is once per invocation, not the per-service re-parse fleet-context.ts's
+    // stats comment warns against copying.
+    const vocab = await readVocabulary(permissionsPath(docsDir));
+    const wanted = [...new Set(active.flatMap((r) => r.requires))].sort(compareIds);
+    const permissions = wanted.map((id) => {
+        const decl = vocab.byId.get(id);
+        if (decl === undefined)
+            return { id, declared: false };
+        return {
+            id,
+            declared: true,
+            subject: decl.subject,
+            name: decl.name,
+            ...(decl.description === undefined ? {} : { description: decl.description }),
+            ...(decl.ownedBy === undefined ? {} : { ownedBy: decl.ownedBy }),
+            enforcedBy: decl.enforcedBy,
+        };
+    });
+    // One rollup pass through the shared context cache, exactly as explore seeds
+    // capabilities — the reader is injected because fleet-context.ts imports the
+    // capabilities package and an import back would be a package cycle.
+    const entries = await context.listServices(docsDir);
+    const capVocab = await context.capabilities(docsDir);
+    const unread = [];
+    const rows = await capabilityRollup({
+        services: entries,
+        vocab: capVocab,
+        read: (p) => context.readRequirements(p).catch(() => {
+            // Unreadable means "this file's realizations are unknown", never "the
+            // pack is unanswerable": the rollup walks EVERY service's spec files,
+            // so without this per-read containment one sibling's bad encoding
+            // refused every other service's briefing — and only once the fleet
+            // declared its first capability, which is exactly the moment the walk
+            // starts. The miss travels as `capabilitiesUnread` and is graded as a
+            // hole; the target's own copy of the same rejection still refuses the
+            // pack through `living.ts`'s uncontained read.
+            unread.push(repoPath(docsDir, p));
+            return [];
+        }),
+    });
+    // One use-case scan for the whole pack, feeding both joins below. It gates
+    // its own load, so a docs repo whose architecture/ never mentions the reserved
+    // tag prefix costs a readdir here rather than a LikeC4 workspace — the same
+    // discipline `loam delta` needs and this pack inherits for free.
+    const known = new Set(entries.map((e) => e.id));
+    const scan = await readUseCases({ docsDir, known });
+    const capabilities = rows
+        .filter((row) => row.services.includes(entry.id))
+        .map((row) => ({
+        id: row.id,
+        ...(row.description === undefined ? {} : { description: row.description }),
+        ...(row.owner === undefined ? {} : { owner: row.owner }),
+        requirements: [
+            ...new Set(row.realizedBy.filter((r) => r.service === entry.id).map((r) => r.requirement)),
+        ],
+        useCases: flowsClaiming(scan, row.id),
+    }));
+    return {
+        permissions,
+        permissionsVocabulary: {
+            present: vocab.present,
+            ...(vocab.invalid === undefined ? {} : { invalid: vocab.invalid }),
+        },
+        capabilities,
+        capabilitiesVocabulary: {
+            present: capVocab.present,
+            ...(capVocab.invalid === undefined ? {} : { invalid: capVocab.invalid }),
+        },
+        // The rollup awaits each read in its own walk order, so the push order is
+        // already deterministic; sorted anyway, because the CONTRACT is the sorted
+        // list, not the walk.
+        capabilitiesUnread: [...unread].sort(compareIds),
+        useCaseSteps: flowsTouching(scan, new Set([entry.id])),
+        useCaseScan: scan.kind === "read"
+            ? { unreadable: false }
+            : { unreadable: true, ...(scan.errors[0] === undefined ? {} : { error: scan.errors[0] }) },
+    };
+}
+//# sourceMappingURL=joins.js.map

package/dist/core/pack/joins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"joins.js","sourceRoot":"","sources":["../../../src/core/pack/joins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAqB,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAuB,MAAM,sBAAsB,CAAC;AA8F1E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAiB;IAChD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACxC,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAExC,qEAAqE;IACrE,wEAAwE;IACxE,yEAAyE;IACzE,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,OAAO,GAAoB,MAAM,OAAO,CAAC,GAAG,CAChD,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACrB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAC9F,CACF,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAElE,2EAA2E;IAC3E,0EAA0E;IAC1E,uCAAuC;IACvC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,WAAW,GAAqB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACvD,OAAO;YACL,EAAE;YACF,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAChE,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;QAClC,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACV,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACrC,sEAAsE;YACtE,sEAAsE;YACtE,kEAAkE;YAClE,mEAAmE;YACnE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,+CAA+C;YAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;KACL,CAAC,CAAC;IACH,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,YAAY,GAAqB,IAAI;SACxC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QACxD,YAAY,EAAE;YACZ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;SAC3F;QACD,QAAQ,EAAE,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC,CAAC;IAEN,OAAO;QACL,WAAW;QACX,qBAAqB,EAAE;YACrB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;SACnE;QACD,YAAY;QACZ,sBAAsB,EAAE;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;SACzE;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,sBAAsB;QACtB,kBAAkB,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAChD,YAAY,EAAE,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,WAAW,EACT,IAAI,CAAC,IAAI,KAAK,MAAM;YAClB,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;YACvB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC/F,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The three fleet-vocabulary joins in one service's context pack: the\n * permissions its requirements gate on, the capabilities they realize, and the\n * business flows it is a hop of. All three resolve a per-service fact against a\n * fleet document, which is what separates them from `./living.ts` — that module\n * never has to look past the service's own directory and the fleet map.\n *\n * The use-case join is the newest and the one whose absence was loudest: an\n * agent briefed on a service was told which capabilities its requirements\n * realize and never told that step 4 of Checkout calls it. The capability is the\n * label; the flow is the caller.\n */\nimport { FleetContext } from \"../fleet-context.js\";\nimport { capabilityRollup } from \"../capabilities/rollup.js\";\nimport { repoPath } from \"../envelope/json.js\";\nimport { readVocabulary } from \"../permissions/permissions.js\";\nimport { compareIds, type ServiceEntry } from \"../repo/entries.js\";\nimport { permissionsPath, servicePathsAt, SPEC_AXES } from \"../repo/paths.js\";\nimport { existsSync } from \"node:fs\";\nimport { readUseCases } from \"../usecases/fleet.js\";\nimport { flowsClaiming, type ClaimingFlow } from \"../usecases/capability.js\";\nimport { flowsTouching, type TouchedUseCase } from \"../usecases/touch.js\";\nimport type { Requirement } from \"../document/spec.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\n\n/**\n * One `Requires:` entry, resolved against `architecture/permissions.yaml`.\n * A discriminated pair rather than optional-field soup: the declared variant\n * carries what the vocabulary says, the undeclared one carries only the claim\n * — inventing an empty `enforcedBy` for a permission nobody declared would be\n * a statement about a declaration that does not exist. Undeclared entries are\n * carried, never refused: explore's \"every miss is a field\" ethos, and\n * `permissions.unknown` is `validate`'s finding to make.\n */\nexport type PackPermission =\n  | {\n      id: string;\n      declared: true;\n      subject: string;\n      name: string;\n      description?: string;\n      ownedBy?: string;\n      enforcedBy: string[];\n    }\n  | { id: string; declared: false };\n\n/** One declared capability this service realizes part of, with the realizing requirement names. */\nexport interface PackCapability {\n  id: string;\n  description?: string;\n  owner?: string;\n  /** This service's realizing requirement names, in the rollup's own (file, requirement) order. */\n  requirements: string[];\n  /**\n   * The declared `dynamic view`s that CLAIM this capability, fleet-wide — not\n   * only the ones this service is a hop of.\n   *\n   * Fleet-wide is the deliberate half. A capability is realized by several\n   * services and drawn as one flow, so the flow a reader needs in order to\n   * understand what this service's requirements are FOR is usually one where\n   * this service appears at a single hop, or at none yet. `useCaseSteps` below\n   * is the narrower answer — where this service actually appears — and the two\n   * are different questions on purpose.\n   *\n   * Empty when nothing claims it, and empty when `useCaseScan` says nobody could\n   * look; that ambiguity is why the scan's health rides beside it.\n   */\n  useCases: ClaimingFlow[];\n}\n\nexport interface JoinsSlice {\n  permissions: PackPermission[];\n  /**\n   * Whether the vocabulary itself could be read — beside the entries it\n   * resolves, so `declared: false` over a broken file is legible as the\n   * file's fault. `invalid` is a HOLE (`packHoles`): every entry above then\n   * reports `declared: false` because nobody could look, not because the\n   * claim is wrong, and exit 0 over that would be a positive false claim.\n   */\n  permissionsVocabulary: { present: boolean; invalid?: string };\n  capabilities: PackCapability[];\n  /** The capability vocabulary's own health — `permissionsVocabulary`'s twin, and a hole for the same reason: an unreadable file empties `capabilities` above, and \"(none realized here)\" over a parse failure is the vacuously-green trap. */\n  capabilitiesVocabulary: { present: boolean; invalid?: string };\n  /**\n   * Repo-relative paths of OTHER services' spec files the capability rollup\n   * could not read. The rollup walks the whole fleet, so an unreadable\n   * sibling must degrade (recorded here, graded as a hole) rather than refuse\n   * — one service's briefing must never be hostage to another service's\n   * encoding. The TARGET's own documents keep their refusal: `living.ts`\n   * reads them without this containment.\n   */\n  capabilitiesUnread: string[];\n  /**\n   * The declared business flows this service is a hop of, and only the hops that\n   * mention it — `core/usecases/touch.ts`'s endpoint join, so a flow drawn for\n   * work not yet done still answers.\n   */\n  useCaseSteps: TouchedUseCase[];\n  /**\n   * The use-case axis's own health — `permissionsVocabulary`'s twin, and a hole\n   * for the same reason. An `architecture/` that does not parse empties BOTH\n   * `useCaseSteps` and every `PackCapability.useCases` above while looking\n   * exactly like a fleet that draws no flows, and \"no business flow depends on\n   * this service\" is the single most misleading thing this pack could say about\n   * a directory nobody opened.\n   */\n  useCaseScan: { unreadable: boolean; error?: string };\n}\n\nexport interface JoinsRequest {\n  docsDir: DocsDir;\n  entry: ServiceEntry;\n  context: FleetContext;\n}\n\nexport async function buildJoins(req: JoinsRequest): Promise<JoinsSlice> {\n  const { docsDir, entry, context } = req;\n  const paths = servicePathsAt(entry.dir);\n\n  // The same two spec reads `living.ts` makes — memoized on the shared\n  // context, so whichever module asks first pays the I/O once and the two\n  // cannot read two different versions of one file. Fanned out because the\n  // axes are independent; SPEC_AXES order (spec before arch-spec) is preserved\n  // by Promise.all, which is what keeps `wanted` deterministic.\n  const perAxis: Requirement[][] = await Promise.all(\n    SPEC_AXES.map((axis) =>\n      existsSync(paths[axis.key]) ? context.readRequirements(paths[axis.key]) : Promise.resolve([]),\n    ),\n  );\n  const active = perAxis.flat().filter((r) => r.kind !== \"REMOVED\");\n\n  // One vocabulary parse per pack — the pack asks about one service, so this\n  // is once per invocation, not the per-service re-parse fleet-context.ts's\n  // stats comment warns against copying.\n  const vocab = await readVocabulary(permissionsPath(docsDir));\n  const wanted = [...new Set(active.flatMap((r) => r.requires))].sort(compareIds);\n  const permissions: PackPermission[] = wanted.map((id) => {\n    const decl = vocab.byId.get(id);\n    if (decl === undefined) return { id, declared: false };\n    return {\n      id,\n      declared: true,\n      subject: decl.subject,\n      name: decl.name,\n      ...(decl.description === undefined ? {} : { description: decl.description }),\n      ...(decl.ownedBy === undefined ? {} : { ownedBy: decl.ownedBy }),\n      enforcedBy: decl.enforcedBy,\n    };\n  });\n\n  // One rollup pass through the shared context cache, exactly as explore seeds\n  // capabilities — the reader is injected because fleet-context.ts imports the\n  // capabilities package and an import back would be a package cycle.\n  const entries = await context.listServices(docsDir);\n  const capVocab = await context.capabilities(docsDir);\n  const unread: string[] = [];\n  const rows = await capabilityRollup({\n    services: entries,\n    vocab: capVocab,\n    read: (p) =>\n      context.readRequirements(p).catch(() => {\n        // Unreadable means \"this file's realizations are unknown\", never \"the\n        // pack is unanswerable\": the rollup walks EVERY service's spec files,\n        // so without this per-read containment one sibling's bad encoding\n        // refused every other service's briefing — and only once the fleet\n        // declared its first capability, which is exactly the moment the walk\n        // starts. The miss travels as `capabilitiesUnread` and is graded as a\n        // hole; the target's own copy of the same rejection still refuses the\n        // pack through `living.ts`'s uncontained read.\n        unread.push(repoPath(docsDir, p));\n        return [];\n      }),\n  });\n  // One use-case scan for the whole pack, feeding both joins below. It gates\n  // its own load, so a docs repo whose architecture/ never mentions the reserved\n  // tag prefix costs a readdir here rather than a LikeC4 workspace — the same\n  // discipline `loam delta` needs and this pack inherits for free.\n  const known = new Set(entries.map((e) => e.id));\n  const scan = await readUseCases({ docsDir, known });\n  const capabilities: PackCapability[] = rows\n    .filter((row) => row.services.includes(entry.id))\n    .map((row) => ({\n      id: row.id,\n      ...(row.description === undefined ? {} : { description: row.description }),\n      ...(row.owner === undefined ? {} : { owner: row.owner }),\n      requirements: [\n        ...new Set(row.realizedBy.filter((r) => r.service === entry.id).map((r) => r.requirement)),\n      ],\n      useCases: flowsClaiming(scan, row.id),\n    }));\n\n  return {\n    permissions,\n    permissionsVocabulary: {\n      present: vocab.present,\n      ...(vocab.invalid === undefined ? {} : { invalid: vocab.invalid }),\n    },\n    capabilities,\n    capabilitiesVocabulary: {\n      present: capVocab.present,\n      ...(capVocab.invalid === undefined ? {} : { invalid: capVocab.invalid }),\n    },\n    // The rollup awaits each read in its own walk order, so the push order is\n    // already deterministic; sorted anyway, because the CONTRACT is the sorted\n    // list, not the walk.\n    capabilitiesUnread: [...unread].sort(compareIds),\n    useCaseSteps: flowsTouching(scan, new Set([entry.id])),\n    useCaseScan:\n      scan.kind === \"read\"\n        ? { unreadable: false }\n        : { unreadable: true, ...(scan.errors[0] === undefined ? {} : { error: scan.errors[0] }) },\n  };\n}\n"]}

package/dist/core/pack/living.js

@@ -0,0 +1,157 @@
+/**
+ * The living slice of one service's context pack: its requirements verbatim,
+ * its two contracts, its provenance, its maturity, and the fleet edges around
+ * it — everything the docs repo says about the service TODAY, before any
+ * feature in flight is consulted.
+ *
+ * Split from `./pack.ts` because it answers about the LIVING documents while
+ * `./features.ts` answers about the deltas over them — two phases of one
+ * briefing, and the line limit is what asked the question.
+ */
+import { existsSync } from "node:fs";
+import { FleetContext } from "../fleet-context.js";
+import { brokenDocumentPaths } from "../c4/likec4.js";
+import { serviceResolver } from "../c4/resolve/service.js";
+import { repoPath } from "../envelope/json.js";
+import { listField, parseFrontmatter, stringField } from "../document/frontmatter.js";
+import { scopeText } from "../provenance/sample/scope.js";
+import {} from "../document/spec.js";
+import { landscapeEvidence, maturityGaps, serviceMaturity, } from "../vocabulary/maturity.js";
+import {} from "../repo/entries.js";
+import { landscapePath, servicePathsAt } from "../repo/paths.js";
+import { NO_DEPLOYMENT } from "../c4/parsed/deployment.js";
+import { serviceTopology } from "../deployment/objects.js";
+export function packRequirement(r) {
+    return {
+        kind: r.kind,
+        ...(r.id === undefined ? {} : { id: r.id }),
+        name: r.name,
+        text: r.text.join("\n").trim(),
+        operations: r.operations,
+        covers: r.covers,
+        requires: r.requires,
+        capabilities: r.capabilities,
+        publishes: r.publishes,
+        consumes: r.consumes,
+        scenarios: r.scenarios.map((s) => ({ name: s.name, lines: s.lines })),
+    };
+}
+export async function buildLiving(req) {
+    const { docsDir, entry, context } = req;
+    const paths = servicePathsAt(entry.dir);
+    // Independent reads, fanned out together; each is memoized on the shared
+    // context, so anything `./joins.ts` or `./features.ts` re-asks is free.
+    const [reqs, archReqs, api, events, specText, archText, land] = await Promise.all([
+        entry.has.spec ? context.readRequirements(paths.spec) : [],
+        existsSync(paths.archSpec) ? context.readRequirements(paths.archSpec) : [],
+        context.readOpenapi(paths.openapi),
+        context.readAsyncapi(paths.asyncapi),
+        entry.has.spec ? context.readText(paths.spec) : null,
+        // Both headers, exactly as `show` reads both (commands/show/service.ts):
+        // a memo hit on the same read the requirements above already paid for.
+        existsSync(paths.archSpec) ? context.readText(paths.archSpec) : null,
+        // The `architecture/` PROJECT, never `architecture/landscape.likec4` alone.
+        // The map is a project — the landscape merged with every use case, palette
+        // and second `model { }` block beside it — and reading one file of it made
+        // this pack answer differently from `loam adopt` about the same tree
+        // (review finding F26, reproduced: with a broken `architecture/palette.likec4`
+        // beside a landscape that parses, `adopt --service order-service` reported
+        // `parses: false` and refused to say anything about the map, while `context
+        // order-service` reported `parses: true` and listed its edges). The brief's
+        // own banner (core/brief/landscape.ts) already named this module as the
+        // reader that disagreed. Whichever answer is right, an agent handed both
+        // has no way to tell — and the renderer's answer is the project's.
+        //
+        // `present` stays a fact about the FILE (`existsSync` below), so a repo
+        // with no landscape is still "absent" rather than "empty project".
+        existsSync(landscapePath(docsDir)) ? context.architecture(docsDir) : null,
+    ]);
+    const present = land !== null;
+    const parses = land !== null && land.errors.length === 0;
+    const elements = parses ? land.elements : [];
+    // Edges are filed under the service an element is BOUND to, with the
+    // enumerated fleet riding in — the same resolution `show`, `explore` and
+    // `validate` use, so no two commands can disagree about who calls whom.
+    const known = new Set((await context.listServices(docsDir)).map((s) => s.id));
+    const svcOf = serviceResolver(elements, known);
+    // The partition, the modelled probe and the apiExpected rule are ONE shared
+    // derivation (core/vocabulary/maturity.ts `landscapeEvidence`) — the same
+    // one explore's describe uses, so the pack and explore cannot spell the same
+    // rule two ways. They are handed the same DOCUMENTS as well: `explore` reads
+    // the `architecture/` project too (core/explore/explore.ts), which it did not
+    // when this slice moved off the single file — for a while the two differed by
+    // input on a fleet whose sibling document is broken, which is a disagreement
+    // no reader of both could resolve.
+    const { inbound, outbound, modelled, apiExpected } = landscapeEvidence({
+        id: entry.id,
+        parses,
+        relationships: parses ? land.relationships : [],
+        elementIds: elements.map((e) => e.id),
+        svcOf,
+    });
+    // Where this service RUNS, from the landscape's own deployment model. The
+    // pack's reader is an agent about to write the implementation, and until this
+    // slice existed it described a service's calls and contracts while saying
+    // nothing whatever about its topology — so a failover got written against a
+    // map nobody had read. Empty for every fleet that draws none, which is the
+    // axis's opt-in and not a finding.
+    //
+    // Read off the PROJECT, for the reason `validate/service/specs.ts` pays the
+    // same load: `architecture/` is one LikeC4 project and a fleet's
+    // `deployment { }` block is ordinarily a file beside the landscape, not
+    // inside it. A single-file read would report "this service runs nowhere" over
+    // a repo that draws it, which is the one answer a briefing must never give.
+    // This used to be a SECOND load, made only when the landscape file itself
+    // declared no topology; `land` is that project now, so the fallback would be
+    // the same document parsed twice.
+    const topology = parses ? (land.deployment ?? NO_DEPLOYMENT) : NO_DEPLOYMENT;
+    const deployment = serviceTopology(topology, elements, known, entry.id);
+    const input = { entry, archSpec: existsSync(paths.archSpec), apiExpected };
+    const header = (text) => text === null ? { present: false, malformed: false, data: {}, body: "" } : parseFrontmatter(text);
+    const fm = header(specText);
+    const governs = (op) => reqs.filter((r) => r.operations.includes(op)).map((r) => r.name);
+    const sent = new Set(events.sent);
+    const received = new Set(events.received);
+    return {
+        maturity: serviceMaturity(input),
+        missing: maturityGaps(input),
+        frontmatter: {
+            status: stringField(fm, "status") ?? null,
+            owner: stringField(fm, "owner") ?? null,
+            last_verified: stringField(fm, "last_verified") ?? null,
+            // Through `scopeText`, not `stringField`: a scope whose value is not
+            // text is still a stamped partial read, and this pack is read by an
+            // agent that will otherwise take `status: verified` at face value.
+            vouch_scope: scopeText(fm),
+            sources: listField(fm, "sources"),
+        },
+        archSpec: { vouch_scope: scopeText(header(archText)) },
+        landscape: { present, parses, broken: land === null ? [] : brokenDocumentPaths(docsDir, land.errors), modelled, inbound, outbound },
+        deployment,
+        requirements: reqs.map(packRequirement),
+        archRequirements: archReqs.map(packRequirement),
+        openapi: { unreadable: api.unreadable, ...(api.error === undefined ? {} : { error: api.error }) },
+        // Document order — a fact of the file, hence of the state. `x-loam-remove`
+        // markers are filtered exactly as `show` filters them: they are deletion
+        // markers from a delta, not operations anybody can call.
+        operations: api.ops
+            .filter((o) => !o.remove)
+            .map((o) => ({ id: o.id, method: o.method.toUpperCase(), path: o.path, governedBy: governs(o.id) })),
+        asyncapi: { unreadable: events.unreadable, ...(events.error === undefined ? {} : { error: events.error }) },
+        messages: events.messages
+            .filter((m) => m.remove !== true)
+            .map((m) => ({
+            name: m.name,
+            slot: m.slot,
+            direction: sent.has(m.name) ? "send" : received.has(m.name) ? "receive" : null,
+        })),
+        pointers: {
+            runbook: { present: entry.has.runbook, path: repoPath(docsDir, paths.runbook) },
+            health: { present: entry.has.health, path: repoPath(docsDir, paths.health) },
+            // The enumeration already counted the ADRs; a second readdir here could
+            // only disagree with it.
+            adrs: { count: entry.adrs, path: repoPath(docsDir, paths.adrsDir) },
+        },
+    };
+}
+//# sourceMappingURL=living.js.map