@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/core/repo/tree/find.js

@@ -0,0 +1,61 @@
+/**
+ * Name resolution over a walked tree — the questions every `loam subsystem`
+ * verb asks before it acts: what does this name denote, what sits beneath a
+ * subsystem, and which names come close to a miss. One module so `move`,
+ * `rm`, `new` and `history` cannot grow four private spellings of "the flat
+ * namespace" — the walk already enforces one namespace, and resolution must
+ * read it the same way.
+ */
+import { closeIds } from "../../c4/arch.js";
+/**
+ * Resolve one name against the flat namespace. Services win a tie on
+ * purpose: a tie IS `subsystem.name-collision`, already an error finding,
+ * and while it stands the service reading keeps every id-addressed command
+ * coherent.
+ */
+export function findInTree(tree, name) {
+    const service = tree.services.find((s) => s.id === name);
+    if (service !== undefined)
+        return { kind: "service", service };
+    const subsystem = tree.subsystems.find((s) => s.name === name);
+    if (subsystem !== undefined)
+        return { kind: "subsystem", subsystem };
+    return null;
+}
+/** Every name the flat namespace holds — service ids and subsystem names together. */
+export function treeNames(tree) {
+    return [...tree.services.map((s) => s.id), ...tree.subsystems.map((s) => s.name)];
+}
+/**
+ * The near-miss tail a refusal appends to its "no such name" sentence, over
+ * whichever pool the verb resolves against: the close names when there are
+ * any, else `otherwise` — the verb's own pointer at what exists, or "" for
+ * none. Eight refusals across `subsystem`, `adopt --subsystem` and
+ * `list --subsystem` end this way, and each spelled the conditional itself;
+ * the lead sentence and the fallback stay theirs, because those are what
+ * differ.
+ */
+export function closeNamesHint(name, pool, otherwise) {
+    const close = closeIds(name, pool);
+    return close.length > 0 ? ` Close names: ${close.join(", ")}.` : otherwise;
+}
+/**
+ * Does the subsystem at `subPath` contain `path` — itself, or anywhere beneath
+ * it? The move-into-own-subtree refusal. The parameter is the name chain, not
+ * a `SubsystemEntry`, because a chain is all this comparison reads — the one
+ * caller outside this module (`move`) has a chain it just composed and no
+ * entry to hand, and a structural parameter it never reads would force a
+ * placeholder there.
+ */
+export function withinSubsystem(subPath, path) {
+    return subPath.length <= path.length && subPath.every((name, i) => path[i] === name);
+}
+/** Services anywhere beneath a subsystem — the transitive membership the views and counts share. */
+export function servicesUnder(tree, sub) {
+    return tree.services.filter((s) => sub.path.every((name, i) => s.subsystem[i] === name));
+}
+/** Child subsystems anywhere beneath one — `rm`'s other half of "empty". */
+export function subsystemsUnder(tree, sub) {
+    return tree.subsystems.filter((c) => c !== sub && withinSubsystem(sub.path, c.path));
+}
+//# sourceMappingURL=find.js.map

package/dist/core/repo/tree/find.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find.js","sourceRoot":"","sources":["../../../../src/core/repo/tree/find.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAS5C;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,IAAY;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,IAAe;IACvC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAc,EAAE,SAAiB;IAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAAiB,EAAE,IAAc;IAC/D,OAAO,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,GAAmB;IAChE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,GAAmB;IAClE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC","sourcesContent":["/**\n * Name resolution over a walked tree — the questions every `loam subsystem`\n * verb asks before it acts: what does this name denote, what sits beneath a\n * subsystem, and which names come close to a miss. One module so `move`,\n * `rm`, `new` and `history` cannot grow four private spellings of \"the flat\n * namespace\" — the walk already enforces one namespace, and resolution must\n * read it the same way.\n */\nimport { closeIds } from \"../../c4/arch.js\";\nimport type { FleetTree, SubsystemEntry, WalkedService } from \"./walk.js\";\n\n/** What a name denotes in the tree — a service, a subsystem, or nothing. */\nexport type TreeHit =\n  | { kind: \"service\"; service: WalkedService }\n  | { kind: \"subsystem\"; subsystem: SubsystemEntry }\n  | null;\n\n/**\n * Resolve one name against the flat namespace. Services win a tie on\n * purpose: a tie IS `subsystem.name-collision`, already an error finding,\n * and while it stands the service reading keeps every id-addressed command\n * coherent.\n */\nexport function findInTree(tree: FleetTree, name: string): TreeHit {\n  const service = tree.services.find((s) => s.id === name);\n  if (service !== undefined) return { kind: \"service\", service };\n  const subsystem = tree.subsystems.find((s) => s.name === name);\n  if (subsystem !== undefined) return { kind: \"subsystem\", subsystem };\n  return null;\n}\n\n/** Every name the flat namespace holds — service ids and subsystem names together. */\nexport function treeNames(tree: FleetTree): string[] {\n  return [...tree.services.map((s) => s.id), ...tree.subsystems.map((s) => s.name)];\n}\n\n/**\n * The near-miss tail a refusal appends to its \"no such name\" sentence, over\n * whichever pool the verb resolves against: the close names when there are\n * any, else `otherwise` — the verb's own pointer at what exists, or \"\" for\n * none. Eight refusals across `subsystem`, `adopt --subsystem` and\n * `list --subsystem` end this way, and each spelled the conditional itself;\n * the lead sentence and the fallback stay theirs, because those are what\n * differ.\n */\nexport function closeNamesHint(name: string, pool: string[], otherwise: string): string {\n  const close = closeIds(name, pool);\n  return close.length > 0 ? ` Close names: ${close.join(\", \")}.` : otherwise;\n}\n\n/**\n * Does the subsystem at `subPath` contain `path` — itself, or anywhere beneath\n * it? The move-into-own-subtree refusal. The parameter is the name chain, not\n * a `SubsystemEntry`, because a chain is all this comparison reads — the one\n * caller outside this module (`move`) has a chain it just composed and no\n * entry to hand, and a structural parameter it never reads would force a\n * placeholder there.\n */\nexport function withinSubsystem(subPath: string[], path: string[]): boolean {\n  return subPath.length <= path.length && subPath.every((name, i) => path[i] === name);\n}\n\n/** Services anywhere beneath a subsystem — the transitive membership the views and counts share. */\nexport function servicesUnder(tree: FleetTree, sub: SubsystemEntry): WalkedService[] {\n  return tree.services.filter((s) => sub.path.every((name, i) => s.subsystem[i] === name));\n}\n\n/** Child subsystems anywhere beneath one — `rm`'s other half of \"empty\". */\nexport function subsystemsUnder(tree: FleetTree, sub: SubsystemEntry): SubsystemEntry[] {\n  return tree.subsystems.filter((c) => c !== sub && withinSubsystem(sub.path, c.path));\n}\n"]}

package/dist/core/repo/tree/fs.js

@@ -0,0 +1,90 @@
+/**
+ * Directory-entry questions the enumerations share, symlinks followed.
+ *
+ * Moved here from `repo/repo.ts` when the tree walk arrived: the walk and the
+ * feature enumeration must answer "what IS this entry" identically, and the
+ * package direction is `repo → repo/tree` (never back — `walk.ts` says why),
+ * so the shared spelling lives on this side of the edge.
+ */
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { readdir } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * What a directory entry IS, following a symlink to find out.
+ *
+ * `readdir(withFileTypes)` does not follow symlinks: for a symlink `Dirent`
+ * every `isDirectory()`/`isFile()` is false, whatever it points at. That made a
+ * symlinked `services/<id>/` or `features/<id>/` vanish from every enumeration
+ * at once — `list`, `validate --all`, the fleet gate — with no diagnostic
+ * anywhere, which is the one outcome a shared docs repo cannot survive: the
+ * fleet gate reported a service that is not there as fine because it never saw
+ * it. Composing a docs repo out of symlinks (a worktree, a submodule, one
+ * service's directory shared between two checkouts) is legitimate, so they are
+ * FOLLOWED rather than refused. A dangling link stats as nothing and is skipped
+ * exactly as an absent directory is — it is not a service, and saying so would
+ * mean inventing an entry to hang the complaint on.
+ */
+export function entryIs(dir, e, want) {
+    if (!e.isSymbolicLink())
+        return want === "dir" ? e.isDirectory() : e.isFile();
+    try {
+        const s = statSync(join(dir, e.name));
+        return want === "dir" ? s.isDirectory() : s.isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Markdown files sitting directly in `dir`, sorted, as full paths — the ADR
+ * corpus, and the only place that rule is spelled. Symlinks are resolved
+ * through `entryIs`, which is the whole reason this is shared: `show` once kept
+ * a second copy that tested `Dirent.isFile()` itself — always false for a
+ * symlink, whatever it points at — so a docs repo composed of symlinks (the
+ * layout `entryIs` above exists to support) had `loam list` and `loam show`
+ * reporting different ADR counts for the same service. One rule, one answer.
+ *
+ * The list, not the count, is the primitive: the link check reads these same
+ * files, and a corpus that disagreed with the count would grade documents the
+ * fleet listing says are not there.
+ */
+export async function markdownFiles(dir) {
+    if (!existsSync(dir))
+        return [];
+    const entries = await readdir(dir, { withFileTypes: true });
+    return entries
+        .filter((e) => e.name.endsWith(".md") && entryIs(dir, e, "file"))
+        .map((e) => join(dir, e.name))
+        .sort();
+}
+/** How many markdown files sit directly in `dir` — the ADR count, over the corpus above. */
+export async function countMarkdown(dir) {
+    return (await markdownFiles(dir)).length;
+}
+/**
+ * Mark a directory as descended-into; false when it (or another name for it)
+ * already was. The symlink-cycle guard every walk that follows links through
+ * `entryIs` carries — the service tree (`./walk.ts`), the capability tree, the
+ * glossary, the generated-gherkin scan — and for one reason: a followed cycle
+ * without a visited set recurses until the stack ends. A path realpath cannot
+ * resolve is one whose children cannot be read either, so it is never entered.
+ */
+export function markDescended(dir, visited) {
+    let real;
+    try {
+        real = realpathSync(dir);
+    }
+    catch {
+        return false;
+    }
+    if (visited.has(real))
+        return false;
+    visited.add(real);
+    return true;
+}
+/** Sorted non-dot subdirectory names, links followed — a tree walk's deterministic child order. */
+export async function subdirNames(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    return entries.filter((e) => !e.name.startsWith(".") && entryIs(dir, e, "dir")).map((e) => e.name).sort();
+}
+//# sourceMappingURL=fs.js.map

package/dist/core/repo/tree/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../../src/core/repo/tree/fs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAe,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,CAAS,EAAE,IAAoB;IAClE,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE;QAAE,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;SAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;SAC7B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,OAAoB;IAC7D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5G,CAAC","sourcesContent":["/**\n * Directory-entry questions the enumerations share, symlinks followed.\n *\n * Moved here from `repo/repo.ts` when the tree walk arrived: the walk and the\n * feature enumeration must answer \"what IS this entry\" identically, and the\n * package direction is `repo → repo/tree` (never back — `walk.ts` says why),\n * so the shared spelling lives on this side of the edge.\n */\nimport { existsSync, realpathSync, statSync, type Dirent } from \"node:fs\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\n/**\n * What a directory entry IS, following a symlink to find out.\n *\n * `readdir(withFileTypes)` does not follow symlinks: for a symlink `Dirent`\n * every `isDirectory()`/`isFile()` is false, whatever it points at. That made a\n * symlinked `services/<id>/` or `features/<id>/` vanish from every enumeration\n * at once — `list`, `validate --all`, the fleet gate — with no diagnostic\n * anywhere, which is the one outcome a shared docs repo cannot survive: the\n * fleet gate reported a service that is not there as fine because it never saw\n * it. Composing a docs repo out of symlinks (a worktree, a submodule, one\n * service's directory shared between two checkouts) is legitimate, so they are\n * FOLLOWED rather than refused. A dangling link stats as nothing and is skipped\n * exactly as an absent directory is — it is not a service, and saying so would\n * mean inventing an entry to hang the complaint on.\n */\nexport function entryIs(dir: string, e: Dirent, want: \"dir\" | \"file\"): boolean {\n  if (!e.isSymbolicLink()) return want === \"dir\" ? e.isDirectory() : e.isFile();\n  try {\n    const s = statSync(join(dir, e.name));\n    return want === \"dir\" ? s.isDirectory() : s.isFile();\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Markdown files sitting directly in `dir`, sorted, as full paths — the ADR\n * corpus, and the only place that rule is spelled. Symlinks are resolved\n * through `entryIs`, which is the whole reason this is shared: `show` once kept\n * a second copy that tested `Dirent.isFile()` itself — always false for a\n * symlink, whatever it points at — so a docs repo composed of symlinks (the\n * layout `entryIs` above exists to support) had `loam list` and `loam show`\n * reporting different ADR counts for the same service. One rule, one answer.\n *\n * The list, not the count, is the primitive: the link check reads these same\n * files, and a corpus that disagreed with the count would grade documents the\n * fleet listing says are not there.\n */\nexport async function markdownFiles(dir: string): Promise<string[]> {\n  if (!existsSync(dir)) return [];\n  const entries = await readdir(dir, { withFileTypes: true });\n  return entries\n    .filter((e) => e.name.endsWith(\".md\") && entryIs(dir, e, \"file\"))\n    .map((e) => join(dir, e.name))\n    .sort();\n}\n\n/** How many markdown files sit directly in `dir` — the ADR count, over the corpus above. */\nexport async function countMarkdown(dir: string): Promise<number> {\n  return (await markdownFiles(dir)).length;\n}\n\n/**\n * Mark a directory as descended-into; false when it (or another name for it)\n * already was. The symlink-cycle guard every walk that follows links through\n * `entryIs` carries — the service tree (`./walk.ts`), the capability tree, the\n * glossary, the generated-gherkin scan — and for one reason: a followed cycle\n * without a visited set recurses until the stack ends. A path realpath cannot\n * resolve is one whose children cannot be read either, so it is never entered.\n */\nexport function markDescended(dir: string, visited: Set<string>): boolean {\n  let real: string;\n  try {\n    real = realpathSync(dir);\n  } catch {\n    return false;\n  }\n  if (visited.has(real)) return false;\n  visited.add(real);\n  return true;\n}\n\n/** Sorted non-dot subdirectory names, links followed — a tree walk's deterministic child order. */\nexport async function subdirNames(dir: string): Promise<string[]> {\n  const entries = await readdir(dir, { withFileTypes: true });\n  return entries.filter((e) => !e.name.startsWith(\".\") && entryIs(dir, e, \"dir\")).map((e) => e.name).sort();\n}\n"]}

package/dist/core/repo/tree/marker.js

@@ -0,0 +1,61 @@
+/**
+ * The subsystem marker: `subsystem.yaml`, the one file that makes a directory
+ * under `services/` a GROUP rather than a service.
+ *
+ * Presence classifies; content is metadata. The walk decides what a directory
+ * IS from the marker's existence alone, so a marker that cannot be read still
+ * classifies its directory as a subsystem — anything else would let a corrupt
+ * byte reinterpret a whole subtree as a service and swallow the fleet beneath
+ * it, the exact silent-shrink the three-way classification exists to refuse.
+ * An unreadable marker is reported as exactly one `subsystem.invalid` finding
+ * instead (`walk.ts` emits it from the `invalid` field here).
+ *
+ * The defensive-read shape is `core/permissions/permissions.ts`'s: every wrong
+ * shape is an `invalid` sentence naming what is wrong, never a throw — this is
+ * a read model, and a marker somebody hand-edited badly must not take down the
+ * enumeration that would report it.
+ */
+import { readFile } from "node:fs/promises";
+import { parse as parseYaml } from "yaml";
+import { isRecord } from "../../kernel/records.js";
+/** The marker's filename — spelled here and nowhere else. */
+export const SUBSYSTEM_MARKER = "subsystem.yaml";
+/**
+ * Read one marker. An EMPTY file is a valid marker with no metadata — the
+ * marker's job is done by existing, and `title`/`description`/`owner` are all
+ * optional. A `members` key is invalid on purpose: placement is recorded
+ * exactly once, in the directory itself, and a membership list would be a
+ * second copy that merges, drifts and lies (SCHEMA.md's marker-not-manifest
+ * rule).
+ */
+export async function readSubsystemMarker(path) {
+    let doc;
+    try {
+        doc = parseYaml(await readFile(path, "utf8"));
+    }
+    catch (e) {
+        return { invalid: e instanceof Error ? e.message : String(e) };
+    }
+    if (doc === null || doc === undefined)
+        return {};
+    if (!isRecord(doc))
+        return { invalid: "the document is not a mapping" };
+    if (doc["members"] !== undefined) {
+        return {
+            invalid: "it declares `members` — a subsystem's members are the service directories inside it, " +
+                "recorded exactly once, in the directory itself; a list here would be a second copy that drifts",
+        };
+    }
+    for (const field of ["title", "description", "owner"]) {
+        const value = doc[field];
+        if (value !== undefined && typeof value !== "string") {
+            return { invalid: `\`${field}\` is not a string` };
+        }
+    }
+    return {
+        ...(typeof doc["title"] === "string" ? { title: doc["title"] } : {}),
+        ...(typeof doc["description"] === "string" ? { description: doc["description"] } : {}),
+        ...(typeof doc["owner"] === "string" ? { owner: doc["owner"] } : {}),
+    };
+}
+//# sourceMappingURL=marker.js.map

package/dist/core/repo/tree/marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marker.js","sourceRoot":"","sources":["../../../../src/core/repo/tree/marker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAUjD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IACxE,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EACL,uFAAuF;gBACvF,gGAAgG;SACnG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAU,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The subsystem marker: `subsystem.yaml`, the one file that makes a directory\n * under `services/` a GROUP rather than a service.\n *\n * Presence classifies; content is metadata. The walk decides what a directory\n * IS from the marker's existence alone, so a marker that cannot be read still\n * classifies its directory as a subsystem — anything else would let a corrupt\n * byte reinterpret a whole subtree as a service and swallow the fleet beneath\n * it, the exact silent-shrink the three-way classification exists to refuse.\n * An unreadable marker is reported as exactly one `subsystem.invalid` finding\n * instead (`walk.ts` emits it from the `invalid` field here).\n *\n * The defensive-read shape is `core/permissions/permissions.ts`'s: every wrong\n * shape is an `invalid` sentence naming what is wrong, never a throw — this is\n * a read model, and a marker somebody hand-edited badly must not take down the\n * enumeration that would report it.\n */\nimport { readFile } from \"node:fs/promises\";\nimport { parse as parseYaml } from \"yaml\";\nimport { isRecord } from \"../../kernel/records.js\";\n\n/** The marker's filename — spelled here and nowhere else. */\nexport const SUBSYSTEM_MARKER = \"subsystem.yaml\";\n\nexport interface SubsystemMeta {\n  title?: string;\n  description?: string;\n  owner?: string;\n  /** Why the file could not be read as subsystem metadata, when it could not. */\n  invalid?: string;\n}\n\n/**\n * Read one marker. An EMPTY file is a valid marker with no metadata — the\n * marker's job is done by existing, and `title`/`description`/`owner` are all\n * optional. A `members` key is invalid on purpose: placement is recorded\n * exactly once, in the directory itself, and a membership list would be a\n * second copy that merges, drifts and lies (SCHEMA.md's marker-not-manifest\n * rule).\n */\nexport async function readSubsystemMarker(path: string): Promise<SubsystemMeta> {\n  let doc: unknown;\n  try {\n    doc = parseYaml(await readFile(path, \"utf8\"));\n  } catch (e) {\n    return { invalid: e instanceof Error ? e.message : String(e) };\n  }\n  if (doc === null || doc === undefined) return {};\n  if (!isRecord(doc)) return { invalid: \"the document is not a mapping\" };\n  if (doc[\"members\"] !== undefined) {\n    return {\n      invalid:\n        \"it declares `members` — a subsystem's members are the service directories inside it, \" +\n        \"recorded exactly once, in the directory itself; a list here would be a second copy that drifts\",\n    };\n  }\n  for (const field of [\"title\", \"description\", \"owner\"] as const) {\n    const value = doc[field];\n    if (value !== undefined && typeof value !== \"string\") {\n      return { invalid: `\\`${field}\\` is not a string` };\n    }\n  }\n  return {\n    ...(typeof doc[\"title\"] === \"string\" ? { title: doc[\"title\"] } : {}),\n    ...(typeof doc[\"description\"] === \"string\" ? { description: doc[\"description\"] } : {}),\n    ...(typeof doc[\"owner\"] === \"string\" ? { owner: doc[\"owner\"] } : {}),\n  };\n}\n"]}

package/dist/core/repo/tree/render/body.js

@@ -0,0 +1,258 @@
+/**
+ * What one subsystem's generated view SHOWS: which boxes it draws around the
+ * services beneath a directory, and the one thing it may say about the map.
+ *
+ * Split from `../views.ts` when that file crossed the 400-line limit: the file
+ * render (header, view ids, staleness comparison) and the body render (the
+ * boxes) are two subjects, and the seam is exactly where the second one
+ * consults the LANDSCAPE. Everything here reads element ids and nothing else —
+ * no view is ever parsed (docs/DESIGN.md rule 26), and the generated file
+ * stays a pure function of the tree plus the committed map.
+ */
+import {} from "../../../c4/likec4.js";
+import { serviceResolver } from "../../../c4/resolve/service.js";
+import { servicesUnder, withinSubsystem } from "../find.js";
+import { subsystemLabel } from "./text.js";
+export function renderContext(tree, elements) {
+    const known = new Set(tree.services.map((s) => s.id));
+    const resolve = serviceResolver(elements, known);
+    return {
+        tree,
+        elementOf: elementByService(tree, elements, resolve),
+        elementIds: new Set(elements.map((e) => e.id)),
+        isServiceElement: (id) => known.has(resolve(id)),
+    };
+}
+/**
+ * Three shapes, and which one applies is a fact about the landscape rather
+ * than a setting:
+ *
+ *  1. **The model draws this group.** Some ancestor element holds exactly this
+ *     subsystem's members and nothing else, so the view includes it beside the
+ *     leaves and the renderer nests them inside the box the AUTHOR drew, with
+ *     the author's own title. Measured: including the ancestor alone renders
+ *     one empty box and the leaves alone render flat — both lines are needed.
+ *  2. **The model is flat.** No member element is nested at all, so there is
+ *     no authored box to agree with, and the view wraps the members in a
+ *     `group '<title>'` of its own — a real named box in the renderer, derived
+ *     from the DIRECTORY the services already sit in, mirroring the subtree so
+ *     a parent subsystem shows its children as boxes rather than as one pile.
+ *     Nothing is invented: the grouping is the tree, and the tree is what this
+ *     file has always mirrored.
+ *  3. **The model nests them, differently.** The members ARE nested but no
+ *     ancestor owns exactly them — the directory tree and the map disagree
+ *     about this group. loam draws no box (a synthetic one would silently
+ *     replace the author's boundary with the folder's, and the picture would
+ *     look the same whether or not the two agree) and writes ONE comment line
+ *     saying so, outside the view body. That comment is the whole of loam's
+ *     answer to the drift: it grades nothing, it fails nothing, and it appears
+ *     in the diff of the very commit that caused it — placement stays a fact
+ *     nothing branches on.
+ */
+export function viewBody(ctx, sub) {
+    const members = memberElements(ctx, sub);
+    if (members.length === 0)
+        return { lines: [], disclosure: null, of: null };
+    if (members.every((id) => !id.includes("."))) {
+        return { lines: [...groupedBody(ctx, sub, "    "), ...boundaryLines(members)], disclosure: null, of: null };
+    }
+    const includes = [...ownedAncestors(ctx, sub), ...members].map((id) => `    include ${id}`);
+    const lines = [...includes, ...boundaryLines(members)];
+    const owner = owningAncestor(ctx, sub);
+    if (owner !== null)
+        return { lines, disclosure: null, of: owner };
+    const shared = sharedAncestor(ctx, members);
+    return {
+        lines,
+        of: null,
+        disclosure: shared === null
+            ? "model: no boundary — these members do not share a containing element."
+            : `model: no boundary — ${shared} also holds services outside this subsystem.`,
+    };
+}
+/**
+ * What this group TOUCHES: for each member, every edge it has in either
+ * direction, so the view answers "what does payments talk to" and not only
+ * "who is in payments".
+ *
+ * **The measured trap, and it is why these lines are appended by the caller of
+ * `groupedBody` rather than inside it:** placed INSIDE the `group { }` block of
+ * the flat-map body shape, this exact predicate parses and validates with ZERO
+ * errors and draws a false picture. Measured at likec4 1.59.2 on a flat map of
+ * `alpha, beta` grouped and `outsider, store` outside it: at view level the two
+ * neighbours are drawn with no parent, correctly outside the box; moved inside
+ * the `group { }`, both are drawn as CHILDREN of that group — the diagram then
+ * claims `outsider` and `store` are part of the subsystem. A maintainer tidying
+ * the body by moving these lines next to the includes they refer to would ship
+ * that, and nothing anywhere would report it. They belong at view level, always.
+ *
+ * The WILDCARD is correct here, and that is not an inconsistency with the
+ * per-service views, which measure it as a defect (`./service/peers.ts`): at
+ * subsystem altitude a counterpart collapsing to its own group box is exactly
+ * the sentence "payments touches identity", and — once those group boxes are
+ * themselves views' subjects (`of <ancestor>`) — it is a click-through into
+ * that subsystem. At service altitude the same collapse is a lie about who
+ * calls whom.
+ *
+ * MEMBERS only, never `ownedAncestors`: `-> *` on an authored container pulls
+ * in every edge any descendant of it has, and in the `// model: no boundary`
+ * shape that container also holds services outside this subsystem — the view
+ * would draw traffic that is nobody-here's. Measured at 58 services in 11
+ * groups: 13-15 nodes and 31-39 edges per subsystem view, of which 11-12 nodes
+ * carry drill-down — the members into their own service views, the neighbouring
+ * group boxes into THEIR subsystem views.
+ */
+function boundaryLines(members) {
+    return ["", ...members.map((id) => `    include ${id} -> *, * -> ${id}`)];
+}
+/**
+ * The flat-model body: this subsystem as a box, its child subsystems as boxes
+ * inside it, its own services as leaves. Recursive, and the recursion is the
+ * point — a parent subsystem's view is otherwise one undifferentiated pile of
+ * every service beneath it.
+ *
+ * An empty child renders an empty named box, which is what the tree says: the
+ * group exists and holds nothing yet.
+ */
+function groupedBody(ctx, sub, indent) {
+    const inner = `${indent}  `;
+    const out = [`${indent}group '${subsystemLabel(sub)}' {`];
+    for (const child of childSubsystems(ctx, sub))
+        out.push(...groupedBody(ctx, child, inner));
+    for (const id of directMemberElements(ctx, sub))
+        out.push(`${inner}include ${id}`);
+    out.push(`${indent}}`);
+    return out;
+}
+/** The child subsystems one level down, ordered by name. */
+function childSubsystems(ctx, sub) {
+    return ctx.tree.subsystems
+        .filter((c) => c.path.length === sub.path.length + 1 && withinSubsystem(sub.path, c.path))
+        .sort((a, b) => (a.name < b.name ? -1 : 1));
+}
+/** The drawn elements of the services filed in THIS directory, not in a child. */
+function directMemberElements(ctx, sub) {
+    return drawnElements(ctx, membersOf(ctx.tree, sub).filter((s) => s.subsystem.length === sub.path.length));
+}
+/** The drawn elements of every service beneath this subsystem, ordered by service id. */
+function memberElements(ctx, sub) {
+    return drawnElements(ctx, membersOf(ctx.tree, sub));
+}
+/**
+ * The element ids these services resolve to. A service the map does not draw
+ * is omitted rather than invented: the omission is already an error
+ * (`landscape.service-unmodelled`), and rendering only what the committed
+ * documents resolve keeps the output a function of committed bytes alone.
+ */
+function drawnElements(ctx, services) {
+    return services.map((s) => ctx.elementOf.get(s.id)).filter((id) => id !== undefined);
+}
+/**
+ * The boxes a nested-model view draws: this subsystem's own owning ancestor
+ * when it has one, plus the owning ancestor of every subsystem beneath it — so
+ * a parent view keeps its children's boundaries instead of flattening them
+ * into one box. Sorted and de-duplicated, because two subsystems resolve to
+ * one element only in a tree that already reports a collision.
+ */
+function ownedAncestors(ctx, sub) {
+    const found = new Set();
+    for (const candidate of ctx.tree.subsystems) {
+        if (!withinSubsystem(sub.path, candidate.path))
+            continue;
+        const owner = owningAncestor(ctx, candidate);
+        if (owner !== null)
+            found.add(owner);
+    }
+    return [...found].sort();
+}
+/**
+ * The deepest ancestor element that holds exactly this subsystem's members —
+ * or null when no element does.
+ *
+ * "Exactly" is the whole guard, and dropping it was measured on loam's own
+ * `examples/docs`: the members' longest common ancestor there is a group of
+ * five services while the subsystem holds two, so an unguarded include would
+ * generate a box labelled for the group with two of its five children drawn
+ * inside it — a diagram asserting something false, in a file the reader is
+ * told not to edit. Tightness is judged over ELEMENTS rather than over
+ * documented services: mid-adoption a group commonly holds systems no
+ * `services/<id>/` exists for yet, and counting only the documented ones would
+ * draw that same false box for the whole of an adoption.
+ *
+ * An ancestor that is itself a service's element is refused separately: one
+ * service's box containing another's is a picture of nothing.
+ */
+function owningAncestor(ctx, sub) {
+    const members = memberElements(ctx, sub);
+    if (members.length === 0)
+        return null;
+    const owned = new Set(members);
+    for (const candidate of ancestorChain(members)) {
+        if (!ctx.elementIds.has(candidate) || ctx.isServiceElement(candidate))
+            continue;
+        if (ownsExactly(ctx, candidate, owned))
+            return candidate;
+    }
+    return null;
+}
+/** The deepest common ancestor the map declares at all — the disclosure's subject. */
+function sharedAncestor(ctx, members) {
+    return ancestorChain(members).find((id) => ctx.elementIds.has(id)) ?? null;
+}
+/** The common proper ancestors of every member id, deepest first. */
+function ancestorChain(members) {
+    const segments = members.map((id) => id.split("."));
+    let common = Math.min(...segments.map((s) => s.length - 1));
+    for (let i = 0; i < common; i++) {
+        if (!segments.every((s) => s[i] === segments[0][i])) {
+            common = i;
+            break;
+        }
+    }
+    const out = [];
+    for (let depth = common; depth > 0; depth--)
+        out.push(segments[0].slice(0, depth).join("."));
+    return out;
+}
+/**
+ * Does every element beneath `ancestor` belong to this subsystem — as a
+ * member, as one of a member's own containers, or as a container of one?
+ */
+function ownsExactly(ctx, ancestor, members) {
+    const prefix = `${ancestor}.`;
+    for (const id of ctx.elementIds) {
+        if (!id.startsWith(prefix))
+            continue;
+        const claimed = [...members].some((m) => id === m || id.startsWith(`${m}.`) || m.startsWith(`${id}.`));
+        if (!claimed)
+            return false;
+    }
+    return true;
+}
+/**
+ * The landscape element standing for each service id: for every element,
+ * resolve it through the shared join, and let the SHALLOWEST element win
+ * (document order breaking ties). Shallowest, because `serviceResolver`
+ * resolves a service's own containers to the service too, and a view should
+ * include the service-level box, not whichever nested container happened to be
+ * declared first.
+ */
+function elementByService(tree, elements, resolve) {
+    const known = new Set(tree.services.map((s) => s.id));
+    const depth = (id) => id.split(".").length;
+    const out = new Map();
+    for (const e of elements) {
+        const service = resolve(e.id);
+        if (!known.has(service))
+            continue;
+        const held = out.get(service);
+        if (held === undefined || depth(e.id) < depth(held))
+            out.set(service, e.id);
+    }
+    return out;
+}
+/** Services beneath this subsystem at any depth, ordered by id — the transitive membership. */
+function membersOf(tree, sub) {
+    return [...servicesUnder(tree, sub)].sort((a, b) => (a.id < b.id ? -1 : 1));
+}
+//# sourceMappingURL=body.js.map

package/dist/core/repo/tree/render/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../../../../src/core/repo/tree/render/body.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAa,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAiB3C,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,QAAgB;IAC7D,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;QACpD,UAAU,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9C,gBAAgB,EAAE,CAAC,EAAU,EAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAkB,EAAE,GAAmB;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC3E,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9G,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO;QACL,KAAK;QACL,EAAE,EAAE,IAAI;QACR,UAAU,EACR,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,wBAAwB,MAAM,8CAA8C;KACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,GAAkB,EAAE,GAAmB,EAAE,MAAc;IAC1E,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,UAAU,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,KAAK,MAAM,EAAE,IAAI,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW,EAAE,EAAE,CAAC,CAAC;IACnF,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,SAAS,eAAe,CAAC,GAAkB,EAAE,GAAmB;IAC9D,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;SACzF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,kFAAkF;AAClF,SAAS,oBAAoB,CAAC,GAAkB,EAAE,GAAmB;IACnE,OAAO,aAAa,CAClB,GAAG,EACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,GAAkB,EAAE,GAAmB;IAC7D,OAAO,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAkB,EAAE,QAAyB;IAClE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,GAAkB,EAAE,GAAmB;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACzD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,cAAc,CAAC,GAAkB,EAAE,GAAmB;IAC7D,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC;YAAE,SAAS;QAChF,IAAI,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,GAAkB,EAAE,OAAiB;IAC3D,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;AAC7E,CAAC;AAED,qEAAqE;AACrE,SAAS,aAAa,CAAC,OAAiB;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC,CAAC;YACX,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAkB,EAAE,QAAgB,EAAE,OAA4B;IACrF,MAAM,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACvB,IAAe,EACf,QAAgB,EAChB,OAA+B;IAE/B,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,SAAS,SAAS,CAAC,IAAe,EAAE,GAAmB;IACrD,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * What one subsystem's generated view SHOWS: which boxes it draws around the\n * services beneath a directory, and the one thing it may say about the map.\n *\n * Split from `../views.ts` when that file crossed the 400-line limit: the file\n * render (header, view ids, staleness comparison) and the body render (the\n * boxes) are two subjects, and the seam is exactly where the second one\n * consults the LANDSCAPE. Everything here reads element ids and nothing else —\n * no view is ever parsed (docs/DESIGN.md rule 26), and the generated file\n * stays a pure function of the tree plus the committed map.\n */\nimport { type Elem } from \"../../../c4/likec4.js\";\nimport { serviceResolver } from \"../../../c4/resolve/service.js\";\nimport { servicesUnder, withinSubsystem } from \"../find.js\";\nimport type { FleetTree, SubsystemEntry, WalkedService } from \"../walk.js\";\nimport { subsystemLabel } from \"./text.js\";\n\n/**\n * Everything a view's body needs from the landscape, resolved ONCE: the\n * element standing for each service, every element id the map declares, and\n * whether an element is a service's own box. A record rather than four\n * threaded parameters because the body render recurses down the subsystem\n * subtree and would otherwise sit on the parameter limit at every hop\n * (`docs/CODE-STYLE.md`'s own prescription).\n */\nexport interface RenderContext {\n  tree: FleetTree;\n  elementOf: Map<string, string>;\n  elementIds: ReadonlySet<string>;\n  isServiceElement: (id: string) => boolean;\n}\n\nexport function renderContext(tree: FleetTree, elements: Elem[]): RenderContext {\n  const known: ReadonlySet<string> = new Set(tree.services.map((s) => s.id));\n  const resolve = serviceResolver(elements, known);\n  return {\n    tree,\n    elementOf: elementByService(tree, elements, resolve),\n    elementIds: new Set(elements.map((e) => e.id)),\n    isServiceElement: (id: string): boolean => known.has(resolve(id)),\n  };\n}\n\n/** A view's body lines, the one comment the render may write above it, and its subject. */\nexport interface ViewBody {\n  lines: string[];\n  disclosure: string | null;\n  /**\n   * The element this view is declared `of`, or null when the map holds none\n   * that owns exactly this subsystem. It is computed here rather than by the\n   * file render because `owningAncestor` below already decides it — the same\n   * answer decides which of the three body shapes applies, and two callers\n   * deriving it separately could draw the boundary of one element while\n   * declaring the view of another.\n   */\n  of: string | null;\n}\n\n/**\n * Three shapes, and which one applies is a fact about the landscape rather\n * than a setting:\n *\n *  1. **The model draws this group.** Some ancestor element holds exactly this\n *     subsystem's members and nothing else, so the view includes it beside the\n *     leaves and the renderer nests them inside the box the AUTHOR drew, with\n *     the author's own title. Measured: including the ancestor alone renders\n *     one empty box and the leaves alone render flat — both lines are needed.\n *  2. **The model is flat.** No member element is nested at all, so there is\n *     no authored box to agree with, and the view wraps the members in a\n *     `group '<title>'` of its own — a real named box in the renderer, derived\n *     from the DIRECTORY the services already sit in, mirroring the subtree so\n *     a parent subsystem shows its children as boxes rather than as one pile.\n *     Nothing is invented: the grouping is the tree, and the tree is what this\n *     file has always mirrored.\n *  3. **The model nests them, differently.** The members ARE nested but no\n *     ancestor owns exactly them — the directory tree and the map disagree\n *     about this group. loam draws no box (a synthetic one would silently\n *     replace the author's boundary with the folder's, and the picture would\n *     look the same whether or not the two agree) and writes ONE comment line\n *     saying so, outside the view body. That comment is the whole of loam's\n *     answer to the drift: it grades nothing, it fails nothing, and it appears\n *     in the diff of the very commit that caused it — placement stays a fact\n *     nothing branches on.\n */\nexport function viewBody(ctx: RenderContext, sub: SubsystemEntry): ViewBody {\n  const members = memberElements(ctx, sub);\n  if (members.length === 0) return { lines: [], disclosure: null, of: null };\n  if (members.every((id) => !id.includes(\".\"))) {\n    return { lines: [...groupedBody(ctx, sub, \"    \"), ...boundaryLines(members)], disclosure: null, of: null };\n  }\n  const includes = [...ownedAncestors(ctx, sub), ...members].map((id) => `    include ${id}`);\n  const lines = [...includes, ...boundaryLines(members)];\n  const owner = owningAncestor(ctx, sub);\n  if (owner !== null) return { lines, disclosure: null, of: owner };\n  const shared = sharedAncestor(ctx, members);\n  return {\n    lines,\n    of: null,\n    disclosure:\n      shared === null\n        ? \"model: no boundary — these members do not share a containing element.\"\n        : `model: no boundary — ${shared} also holds services outside this subsystem.`,\n  };\n}\n\n/**\n * What this group TOUCHES: for each member, every edge it has in either\n * direction, so the view answers \"what does payments talk to\" and not only\n * \"who is in payments\".\n *\n * **The measured trap, and it is why these lines are appended by the caller of\n * `groupedBody` rather than inside it:** placed INSIDE the `group { }` block of\n * the flat-map body shape, this exact predicate parses and validates with ZERO\n * errors and draws a false picture. Measured at likec4 1.59.2 on a flat map of\n * `alpha, beta` grouped and `outsider, store` outside it: at view level the two\n * neighbours are drawn with no parent, correctly outside the box; moved inside\n * the `group { }`, both are drawn as CHILDREN of that group — the diagram then\n * claims `outsider` and `store` are part of the subsystem. A maintainer tidying\n * the body by moving these lines next to the includes they refer to would ship\n * that, and nothing anywhere would report it. They belong at view level, always.\n *\n * The WILDCARD is correct here, and that is not an inconsistency with the\n * per-service views, which measure it as a defect (`./service/peers.ts`): at\n * subsystem altitude a counterpart collapsing to its own group box is exactly\n * the sentence \"payments touches identity\", and — once those group boxes are\n * themselves views' subjects (`of <ancestor>`) — it is a click-through into\n * that subsystem. At service altitude the same collapse is a lie about who\n * calls whom.\n *\n * MEMBERS only, never `ownedAncestors`: `-> *` on an authored container pulls\n * in every edge any descendant of it has, and in the `// model: no boundary`\n * shape that container also holds services outside this subsystem — the view\n * would draw traffic that is nobody-here's. Measured at 58 services in 11\n * groups: 13-15 nodes and 31-39 edges per subsystem view, of which 11-12 nodes\n * carry drill-down — the members into their own service views, the neighbouring\n * group boxes into THEIR subsystem views.\n */\nfunction boundaryLines(members: readonly string[]): string[] {\n  return [\"\", ...members.map((id) => `    include ${id} -> *, * -> ${id}`)];\n}\n\n/**\n * The flat-model body: this subsystem as a box, its child subsystems as boxes\n * inside it, its own services as leaves. Recursive, and the recursion is the\n * point — a parent subsystem's view is otherwise one undifferentiated pile of\n * every service beneath it.\n *\n * An empty child renders an empty named box, which is what the tree says: the\n * group exists and holds nothing yet.\n */\nfunction groupedBody(ctx: RenderContext, sub: SubsystemEntry, indent: string): string[] {\n  const inner = `${indent}  `;\n  const out = [`${indent}group '${subsystemLabel(sub)}' {`];\n  for (const child of childSubsystems(ctx, sub)) out.push(...groupedBody(ctx, child, inner));\n  for (const id of directMemberElements(ctx, sub)) out.push(`${inner}include ${id}`);\n  out.push(`${indent}}`);\n  return out;\n}\n\n/** The child subsystems one level down, ordered by name. */\nfunction childSubsystems(ctx: RenderContext, sub: SubsystemEntry): SubsystemEntry[] {\n  return ctx.tree.subsystems\n    .filter((c) => c.path.length === sub.path.length + 1 && withinSubsystem(sub.path, c.path))\n    .sort((a, b) => (a.name < b.name ? -1 : 1));\n}\n\n/** The drawn elements of the services filed in THIS directory, not in a child. */\nfunction directMemberElements(ctx: RenderContext, sub: SubsystemEntry): string[] {\n  return drawnElements(\n    ctx,\n    membersOf(ctx.tree, sub).filter((s) => s.subsystem.length === sub.path.length),\n  );\n}\n\n/** The drawn elements of every service beneath this subsystem, ordered by service id. */\nfunction memberElements(ctx: RenderContext, sub: SubsystemEntry): string[] {\n  return drawnElements(ctx, membersOf(ctx.tree, sub));\n}\n\n/**\n * The element ids these services resolve to. A service the map does not draw\n * is omitted rather than invented: the omission is already an error\n * (`landscape.service-unmodelled`), and rendering only what the committed\n * documents resolve keeps the output a function of committed bytes alone.\n */\nfunction drawnElements(ctx: RenderContext, services: WalkedService[]): string[] {\n  return services.map((s) => ctx.elementOf.get(s.id)).filter((id): id is string => id !== undefined);\n}\n\n/**\n * The boxes a nested-model view draws: this subsystem's own owning ancestor\n * when it has one, plus the owning ancestor of every subsystem beneath it — so\n * a parent view keeps its children's boundaries instead of flattening them\n * into one box. Sorted and de-duplicated, because two subsystems resolve to\n * one element only in a tree that already reports a collision.\n */\nfunction ownedAncestors(ctx: RenderContext, sub: SubsystemEntry): string[] {\n  const found = new Set<string>();\n  for (const candidate of ctx.tree.subsystems) {\n    if (!withinSubsystem(sub.path, candidate.path)) continue;\n    const owner = owningAncestor(ctx, candidate);\n    if (owner !== null) found.add(owner);\n  }\n  return [...found].sort();\n}\n\n/**\n * The deepest ancestor element that holds exactly this subsystem's members —\n * or null when no element does.\n *\n * \"Exactly\" is the whole guard, and dropping it was measured on loam's own\n * `examples/docs`: the members' longest common ancestor there is a group of\n * five services while the subsystem holds two, so an unguarded include would\n * generate a box labelled for the group with two of its five children drawn\n * inside it — a diagram asserting something false, in a file the reader is\n * told not to edit. Tightness is judged over ELEMENTS rather than over\n * documented services: mid-adoption a group commonly holds systems no\n * `services/<id>/` exists for yet, and counting only the documented ones would\n * draw that same false box for the whole of an adoption.\n *\n * An ancestor that is itself a service's element is refused separately: one\n * service's box containing another's is a picture of nothing.\n */\nfunction owningAncestor(ctx: RenderContext, sub: SubsystemEntry): string | null {\n  const members = memberElements(ctx, sub);\n  if (members.length === 0) return null;\n  const owned = new Set(members);\n  for (const candidate of ancestorChain(members)) {\n    if (!ctx.elementIds.has(candidate) || ctx.isServiceElement(candidate)) continue;\n    if (ownsExactly(ctx, candidate, owned)) return candidate;\n  }\n  return null;\n}\n\n/** The deepest common ancestor the map declares at all — the disclosure's subject. */\nfunction sharedAncestor(ctx: RenderContext, members: string[]): string | null {\n  return ancestorChain(members).find((id) => ctx.elementIds.has(id)) ?? null;\n}\n\n/** The common proper ancestors of every member id, deepest first. */\nfunction ancestorChain(members: string[]): string[] {\n  const segments = members.map((id) => id.split(\".\"));\n  let common = Math.min(...segments.map((s) => s.length - 1));\n  for (let i = 0; i < common; i++) {\n    if (!segments.every((s) => s[i] === segments[0]![i])) {\n      common = i;\n      break;\n    }\n  }\n  const out: string[] = [];\n  for (let depth = common; depth > 0; depth--) out.push(segments[0]!.slice(0, depth).join(\".\"));\n  return out;\n}\n\n/**\n * Does every element beneath `ancestor` belong to this subsystem — as a\n * member, as one of a member's own containers, or as a container of one?\n */\nfunction ownsExactly(ctx: RenderContext, ancestor: string, members: ReadonlySet<string>): boolean {\n  const prefix = `${ancestor}.`;\n  for (const id of ctx.elementIds) {\n    if (!id.startsWith(prefix)) continue;\n    const claimed = [...members].some((m) => id === m || id.startsWith(`${m}.`) || m.startsWith(`${id}.`));\n    if (!claimed) return false;\n  }\n  return true;\n}\n\n/**\n * The landscape element standing for each service id: for every element,\n * resolve it through the shared join, and let the SHALLOWEST element win\n * (document order breaking ties). Shallowest, because `serviceResolver`\n * resolves a service's own containers to the service too, and a view should\n * include the service-level box, not whichever nested container happened to be\n * declared first.\n */\nfunction elementByService(\n  tree: FleetTree,\n  elements: Elem[],\n  resolve: (id: string) => string,\n): Map<string, string> {\n  const known: ReadonlySet<string> = new Set(tree.services.map((s) => s.id));\n  const depth = (id: string): number => id.split(\".\").length;\n  const out = new Map<string, string>();\n  for (const e of elements) {\n    const service = resolve(e.id);\n    if (!known.has(service)) continue;\n    const held = out.get(service);\n    if (held === undefined || depth(e.id) < depth(held)) out.set(service, e.id);\n  }\n  return out;\n}\n\n/** Services beneath this subsystem at any depth, ordered by id — the transitive membership. */\nfunction membersOf(tree: FleetTree, sub: SubsystemEntry): WalkedService[] {\n  return [...servicesUnder(tree, sub)].sort((a, b) => (a.id < b.id ? -1 : 1));\n}\n"]}