@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/commands/archive/run.js

@@ -0,0 +1,355 @@
+/**
+ * The archive itself, under the docs lock: gate, plan, commit.
+ *
+ * The order is the command's whole safety property. Every refusal happens before
+ * a byte is planned (`./plan/gate.ts`), the plan is computed entirely in memory
+ * so a failure on any axis leaves the living docs untouched (`./plan/specs.ts`,
+ * `./plan/contracts/`, `./plan/landscape.ts`), and only a plan that succeeded
+ * on every axis is staged
+ * and swapped. `--dry-run` returns between the second and the third.
+ */
+import { existsSync } from "node:fs";
+import { rename } from "node:fs/promises";
+import { CodedFailure, emitJson, repoPath, sayExplain } from "../../core/envelope/json.js";
+import { message, mkdirReportingCreated, quietPruneEmptyParents, quietRm, rollbackError, rollbackStaged, stageWrites, swapStaged, } from "../../core/staging/commit.js";
+import { clearCommitIntent, writeCommitIntent } from "../../core/staging/recovery/intent.js";
+import { SNAPSHOT_DIR, snapshotDir } from "../../core/staging/snapshot/manifest.js";
+import { SnapshotClobberError, writeSnapshot } from "../../core/staging/snapshot/snapshot.js";
+import { enumeratedServices } from "../../core/repo/service-target.js";
+import { listFleetTree } from "../../core/repo/repo.js";
+import { serviceViewsPath, subsystemViewsPath } from "../../core/repo/paths.js";
+import { serviceViewsState, viewsState } from "../../core/repo/tree/render/stale.js";
+import { loadArchitecture } from "../../core/c4/project/architecture.js";
+import { FleetContext } from "../../core/fleet-context.js";
+import { gate } from "./plan/gate.js";
+import { issueJson, printPlan, refuseJson } from "./plan/refusal.js";
+import { planCapabilities, planGlossary, planSpecs } from "./plan/specs.js";
+import { planOpenapiContracts } from "./plan/contracts/openapi.js";
+import { planAsyncapiContracts } from "./plan/contracts/asyncapi.js";
+import { contractConsumers } from "./plan/contracts/consumers.js";
+import { planDeployments, planFlows, planLandscape } from "./plan/landscape.js";
+import { planFeatureLinks, planInboundLinks } from "./plan/document/links.js";
+import { emptyPlan } from "./plan/state.js";
+import { checklistAtArchive } from "./shipped.js";
+import { outstandingLines } from "./closing.js";
+export async function archiveLocked(config, featureId, opts) {
+    const dryRun = opts.dryRun === true;
+    const json = opts.json === true;
+    // All prose goes through here so `--json` keeps stdout a single JSON document.
+    const say = (line = "") => {
+        if (!json)
+            console.log(line);
+    };
+    // One read index for the whole run, threaded through every planner's
+    // config record: gate, the spec merge and both contract merges each hold
+    // per-service loops that resolve living paths through the enumeration, and
+    // without a shared context every one of those calls re-walks the fleet —
+    // O(services²) work under a lock that guarantees the tree is not moving.
+    // The snapshot resolver below reads through the same context, so it pays
+    // for that enumeration too.
+    const read = { docsDir: config.docsDir, fleet: new FleetContext() };
+    const gated = await gate(read, featureId, opts, say);
+    if (gated === null)
+        return;
+    const { id, dirName, featureDir, gating, advisory, archiveDir, archiveDest, recovered, issues } = gated;
+    say(`archive ${id}${dryRun ? "  (dry run)" : ""}\n`);
+    // PLAN — compute every merge in memory. Nothing is written until the whole plan
+    // succeeds, so a failure on any axis leaves the living docs untouched.
+    const planned = emptyPlan();
+    await planSpecs(read, gated, planned, say);
+    // The business corpus, beside the service one and before the contracts: both
+    // are requirement merges, and reading them together is how a plan stays
+    // legible as "what this feature promises" followed by "how it is built".
+    await planCapabilities(read, gated, planned, say);
+    // The vocabulary the change brings with it, beside the promises it makes:
+    // a create-only whole-file copy, refused at the gate if the word already
+    // lives (`core/glossary/delta.ts`).
+    await planGlossary(read, gated, planned, say);
+    // One consumer index for both contract planners, built only if one of them
+    // overwrites an operation or a message (./plan/contracts/consumers.ts) —
+    // and then over the living fleet as it stands before this merge.
+    const contracts = { ...read, consumers: contractConsumers(read) };
+    await planOpenapiContracts(contracts, gated, planned, say);
+    await planAsyncapiContracts(contracts, gated, planned, say);
+    // `read`, not `config`: the C4 merge now asks which services own their own
+    // interior, and that answer comes from the fleet enumeration this run has
+    // already paid for.
+    await planLandscape(read, gated, planned, say);
+    // The flows this feature brings, after the elements they draw hops over: the
+    // copy is create-only and refused at the gate if the living tree already holds
+    // one (`core/usecases/delta/flows.ts`), and it is ordered after the landscape
+    // merge so a reader of the plan sees the map change before the sequence drawn
+    // on it.
+    await planFlows(config, gated, planned, say);
+    await planDeployments(config, gated, planned, say);
+    // After the merges, because it is the move rather than a merge: the feature's own
+    // documents ride the rename into features/archive/, and their links out of
+    // the feature are re-expressed for it in this same commit
+    // (./plan/document/links.ts) — planned at their current paths, swapped before
+    // the rename carries them, and parked in the snapshot like every other write.
+    await planFeatureLinks(config, gated, planned, say);
+    // And the links the rest of the corpus holds INTO the feature, after every
+    // merge so a document the merge rewrites is relinked from its merged text.
+    await planInboundLinks(read, gated, planned, say);
+    const { writes, planWarns, planGates, openapiRemovals, asyncapiRemovals } = planned;
+    const revouchOwed = planned.revouchOwed.map((r) => ({ ...r, path: repoPath(config.docsDir, r.path) }));
+    // Gate on what only the plan could see: a merged operation pointing at a
+    // component that exists nowhere, a removal marker addressing no operation.
+    // Same doctrine as the coherence gate — a judgment call --approve overrides
+    // (unlike the mechanical merge-failed refusals), and a dry run is gated too.
+    // Checked after the whole plan so the refusal costs nothing: no write has
+    // happened yet either way.
+    if (planGates.length > 0 && !opts.approve) {
+        const msg = `archive ${id} — BLOCKED: ${planGates.length} issue(s) in the contract merge`;
+        if (json) {
+            refuseJson("not-coherent", msg, [...issues, ...planWarns, ...planGates], `features/${dirName}`);
+            return;
+        }
+        console.error(`${msg}:`);
+        for (const i of planGates)
+            console.error(`  ✗ ${i.message}`);
+        console.error(`\nFix them in the feature's openapi.yaml / asyncapi.yaml — or re-run with --approve to merge anyway.`);
+        sayExplain("not-coherent");
+        process.exitCode = 1;
+        return;
+    }
+    if (planGates.length > 0) {
+        say(`\n  ⚠ archiving despite ${planGates.length} contract merge issue(s) (--approve):`);
+        for (const i of planGates)
+            say(`      ✗ ${i.message}`);
+    }
+    // Printed by the dry run and the real merge alike, before either commits to
+    // anything: the merge is what moves these documents, and the merge's PR is
+    // the place their re-vouches belong. Not a finding and not a refusal — the
+    // staleness that follows is honest, and `content.stale` is what grades it.
+    if (revouchOwed.length > 0) {
+        say(`\n  re-vouch owed — this merge moves ${revouchOwed.length} vouched spec(s) under the vouch stamp, so content.stale follows on each until its owner re-vouches:`);
+        for (const r of revouchOwed) {
+            say(`    ${r.path}  (owner: ${r.owner ?? "none recorded"}) — \`loam vouch --service ${r.service}\`, run in that service's repo`);
+        }
+        say(`    land the re-vouches in this PR: \`loam validate --all --base <ref> --strict\` stays red on it until they do.`);
+    }
+    // The plan as data, verb decided now — after the commit everything would read
+    // as an update. The `--json` payload is identical for a dry run and the real
+    // thing except for `archived`; what WOULD happen is what DOES happen.
+    const warnings = [...advisory, ...planWarns];
+    const overridden = opts.approve === true ? [...gating, ...planGates] : [];
+    const plan = writes.map((w) => ({
+        path: repoPath(config.docsDir, w.path),
+        action: existsSync(w.path) ? "update" : "create",
+    }));
+    plan.push({ path: `features/${dirName}`, action: "move", to: `features/archive/${dirName}` });
+    const payload = (archived) => ({
+        command: "archive",
+        feature: id,
+        archived,
+        path: repoPath(config.docsDir, archiveDest),
+        plan,
+        warnings: warnings.map((issue) => issueJson(issue, repoPath(config.docsDir, archiveDest))),
+        overridden: overridden.map((issue) => issueJson(issue, repoPath(config.docsDir, archiveDest))),
+        openapiRemovals,
+        asyncapiRemovals,
+        revouchOwed,
+        // What the requirement merge takes away (./plan/specs.ts). Additive.
+        dropped: planned.dropped.map((row) => ({ ...row, path: repoPath(config.docsDir, row.path) })),
+        // Present only when this run found an interrupted commit and dealt with it:
+        // an agent that sees the docs change under it deserves to be told why, and
+        // the absent field is the ordinary case.
+        ...(recovered === null ? {} : { recovered }),
+    });
+    if (dryRun) {
+        if (json)
+            emitJson(payload(false));
+        // What the real run would print in place of its closing line, said BEFORE
+        // anything is written — the one moment a reader can still act on it.
+        else
+            printPlan(config.docsDir, writes, dirName, outstandingLines({ advisory, planWarns, overridden, staleViews: [], dryRun: true }));
+        return;
+    }
+    // The question the feature asks as it ships, captured before anything below
+    // moves the living docs it is derived from — see ./shipped.ts. It rides in
+    // the snapshot manifest; a dry run writes no snapshot, so it pays nothing.
+    const checklist = await checklistAtArchive(read, gated);
+    // COMMIT — the whole plan computed cleanly. Stage every new version beside its
+    // target, snapshot what is about to be overwritten, then swap them into place.
+    // Staging touches the filesystem — a read-only `architecture/`, a full disk,
+    // a target whose pre-image cannot be read. None of that is a bug in loam, and
+    // reporting `internal` sends the reader looking for one; it is the same
+    // answer as any other merge that could not be computed: nothing was written.
+    let staged;
+    try {
+        staged = await stageWrites(writes);
+    }
+    catch (err) {
+        throw new CodedFailure("merge-failed", `${message(err)} — nothing was written`);
+    }
+    let snapshot = false;
+    let createdArchiveDir = null;
+    try {
+        // The snapshot's resolver pair: how a docs-relative path decomposes into a
+        // service identity, and where that identity lives NOW. Built here — the
+        // command layer's view of the tree — and injected, so the snapshot module
+        // never learns the repo layout. The seam the flat wave left is now
+        // threaded: both answers come from the enumeration, so a service filed
+        // into a subsystem keys its snapshot rows by the directory it actually
+        // lives in, and the clobber guard grades a leftover claim at that same
+        // address. The root-level parse stays as the fallback for the one path
+        // shape the enumeration cannot know yet — a service this archive CREATES,
+        // which always materialises unfiled at services/<id>/.
+        // Tolerant on purpose: a docs repo whose services/ is absent still
+        // archives a landscape-only feature exactly as before — the enumeration
+        // is empty, every row keys by the flat fallback, and the missing
+        // directory stays doctor's diagnosis rather than a merge-failed here.
+        const dirOf = new Map((await enumeratedServices(config.docsDir, read.fleet)).map((s) => [s.id, repoPath(config.docsDir, s.dir)]));
+        const serviceKeyOf = (rel) => {
+            for (const [service, dir] of dirOf) {
+                if (rel.startsWith(`${dir}/`))
+                    return { service, artifact: rel.slice(dir.length + 1) };
+            }
+            const m = /^services\/([^/]+)\/(.+)$/.exec(rel);
+            return m ? { service: m[1], artifact: m[2] } : null;
+        };
+        const serviceDirOf = (service) => dirOf.get(service) ?? null;
+        await writeSnapshot({
+            featureDir,
+            movesTo: archiveDest,
+            docsDir: config.docsDir,
+            feature: { featureId: id, dirName },
+            staged,
+            serviceKeyOf,
+            serviceDirOf,
+            ...(checklist === undefined ? {} : { checklist }),
+        });
+        snapshot = true;
+        // The journal, fsynced, BEFORE the first rename: swapStaged is N renames and
+        // only each one of them is atomic, so a kill between two used to leave a
+        // half-merged repo that nothing could name — `doctor` and `status` called it
+        // healthy and `validate --all` blamed the delta. Written from `staged`, so
+        // it records the same digests the swaps are about to produce.
+        await writeCommitIntent(config.docsDir, { command: "archive", restore: "before", feature: id, moveFrom: featureDir, moveTo: archiveDest }, staged);
+        await swapStaged(staged);
+        createdArchiveDir = await mkdirReportingCreated(archiveDir);
+        await rename(featureDir, archiveDest);
+        // Last: while it exists, the commit is in flight.
+        await clearCommitIntent(config.docsDir);
+    }
+    catch (err) {
+        if (err instanceof SnapshotClobberError) {
+            // Nothing swapped — the refusal happens before the journal is even
+            // written — so this only takes the temp files away. Its own code, because
+            // the answer is not "re-run": a previous archive of this feature is still
+            // sitting in the living docs.
+            await rollbackStaged(staged);
+            throw new CodedFailure("commit-interrupted", err.message);
+        }
+        // Everything this run made, unmade: the swapped files, the snapshot inside the
+        // feature that is staying put, and features/archive/ if we are the ones who
+        // created it (mkdirReportingCreated reports null when it was already there).
+        const failures = await rollbackStaged(staged);
+        // The rollback decided the outcome, so the journal has nothing left to
+        // describe — including on rollback-incomplete, where the files it names are
+        // the ones the message tells a human to look at.
+        await clearCommitIntent(config.docsDir);
+        // The snapshot goes only when the rollback HELD. On rollback-incomplete it
+        // holds the only on-disk pre-images of the very files the message tells the
+        // reader to repair by hand — a MODIFIED requirement's previous text appears
+        // nowhere else. Retaining it is safe: the next archive of this feature reads
+        // it before it would replace it, and refuses if the living docs have moved.
+        if (snapshot && failures.length === 0)
+            await quietRm(snapshotDir(featureDir));
+        // `features/archive/` is shared the moment it exists: another archive can
+        // have moved a whole feature into it between our mkdir and this rollback,
+        // and a recursive remove of "the directory we created" took that feature —
+        // snapshot and all — with it, on OUR failure path, in silence. Empty
+        // directories only, stopping at the first that is not.
+        if (createdArchiveDir !== null)
+            await quietPruneEmptyParents(archiveDir, createdArchiveDir);
+        // The code is a caller's answer to "can I trust the repo?": merge-failed
+        // means yes (rolled back), rollback-incomplete means look at it by hand.
+        const wrapped = rollbackError(err, failures);
+        const kept = snapshot && failures.length > 0
+            ? ` Pre-images of the overwritten files are kept in features/${dirName}/${SNAPSHOT_DIR}/files/.`
+            : "";
+        throw new CodedFailure(failures.length > 0 ? "rollback-incomplete" : "merge-failed", wrapped.message + kept);
+    }
+    // This merge just changed the map, and both generated views files are a
+    // function of the tree AND the map: a delta whose element lands inside a
+    // group that exactly covered a subsystem takes that subsystem's boundary
+    // line away, a delta binding an element to a filed service adds an include,
+    // and one new edge changes exactly one service's overview. Archive does not
+    // rewrite either file — `loam subsystem sync` owns them outright, and folding
+    // a second generated artifact into this transaction would mean archive
+    // computing the post-merge tree AND the post-merge map, which is how the two
+    // writers disagree — but it must not report a repo as current when the next
+    // `validate --all` will call it stale. Graded through validate's own
+    // functions, so the two cannot answer differently.
+    const staleViews = await staleGeneratedViews(config.docsDir);
+    if (json) {
+        emitJson({
+            ...payload(true),
+            // The original boolean keeps its exact meaning — `architecture/subsystems.likec4`
+            // and nothing else — because a payload key's meaning is frozen; the list
+            // beside it is the additive answer that can name the second file. Both are
+            // omitted when nothing is stale, exactly as the boolean always was.
+            ...(staleViews.length === 0 ? {} : { staleViews }),
+            ...(staleViews.includes("architecture/subsystems.likec4") ? { subsystemViewsStale: true } : {}),
+        });
+        return;
+    }
+    console.log(`\n  archived: features/${dirName} → features/archive/${dirName}`);
+    console.log(`  snapshot: features/archive/${dirName}/${SNAPSHOT_DIR}/ — \`loam unarchive ${id}\` puts it back`);
+    // The closing line is a claim about the whole docs repo, and it is the line a
+    // reader stops at. It may be printed only when this archive left nothing the
+    // next `validate --all` will fail on; ./closing.ts lists every reason it
+    // cannot be, and those lines are printed instead. Printing it over any of
+    // them is how a red fleet gets reported as a finished one.
+    const owed = outstandingLines({ advisory, planWarns, overridden, staleViews, dryRun: false });
+    if (owed.length === 0) {
+        console.log("  living spec + landscape are now complete + current.");
+        return;
+    }
+    for (const line of owed)
+        console.log(line);
+}
+/**
+ * Which generated files would the next `validate --all` report
+ * `subsystem.views-stale` on? Docs-relative paths, sorted, empty for none.
+ *
+ * Asked through validate's OWN functions rather than a second compare, so the
+ * warning archive prints and the error validate raises can never disagree —
+ * including about the gate validate holds: a map that does not parse is
+ * `landscape.invalid`'s business, and grading a generated file against a map
+ * nobody can read would cascade a second complaint behind the first. An
+ * unreadable map therefore answers "no claim", exactly as validate does.
+ *
+ * BOTH generated files, because this merge just changed the map and the
+ * per-service overviews are a function of it in a way the subsystem views are
+ * not: a delta adding one edge changes exactly one service's peer set, and a
+ * delta binding a new element adds a whole view. Naming only the file loam
+ * happened to check first would let a repo be reported current while the very
+ * next `validate --all` calls it stale — the one thing this advisory exists to
+ * prevent.
+ */
+async function staleGeneratedViews(docsDir) {
+    try {
+        const doc = await loadArchitecture(docsDir);
+        if (doc.errors.length > 0)
+            return [];
+        const tree = await listFleetTree(docsDir);
+        const stale = [];
+        if (!(await viewsState(subsystemViewsPath(docsDir), tree, doc)).agrees)
+            stale.push("architecture/subsystems.likec4");
+        if (!(await serviceViewsState(serviceViewsPath(docsDir), tree, doc)).agrees) {
+            stale.push("architecture/services.likec4");
+        }
+        return stale.sort();
+    }
+    catch {
+        // Tolerant for the reason the snapshot resolver above is: a docs repo with
+        // no `services/` at all still archives a landscape-only feature, and this
+        // question is an ADVISORY printed after a commit that already succeeded.
+        // Nothing here may turn a landed archive into a non-zero exit.
+        return [];
+    }
+}
+//# sourceMappingURL=run.js.map

package/dist/commands/archive/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/commands/archive/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EACL,OAAO,EACP,qBAAqB,EACrB,sBAAsB,EACtB,OAAO,EACP,aAAa,EACb,cAAc,EACd,WAAW,EACX,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAmB,MAAM,yCAAyC,CAAC;AAC/G,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAuB,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA4B,EAC5B,SAAiB,EACjB,IAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;IAChC,+EAA+E;IAC/E,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,EAAE,EAAQ,EAAE;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,YAAY,EAAE,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAC3B,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAExG,GAAG,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAErD,gFAAgF;IAChF,uEAAuE;IACvE,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,0EAA0E;IAC1E,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9C,2EAA2E;IAC3E,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,MAAM,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5D,2EAA2E;IAC3E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/C,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,SAAS;IACT,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACnD,kFAAkF;IAClF,2EAA2E;IAC3E,0DAA0D;IAC1D,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IACpF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvG,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,2BAA2B;IAC3B,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,WAAW,EAAE,eAAe,SAAS,CAAC,MAAM,iCAAiC,CAAC;QAC1F,IAAI,IAAI,EAAE,CAAC;YACT,UAAU,CACR,cAAc,EACd,GAAG,EACH,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,EACvC,YAAY,OAAO,EAAE,CACtB,CAAC;YACF,OAAO;QACT,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,sGAAsG,CAAC,CAAC;QACtH,UAAU,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,2BAA2B,SAAS,CAAC,MAAM,uCAAuC,CAAC,CAAC;QACxF,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,wCAAwC,WAAW,CAAC,MAAM,sGAAsG,CAAC,CAAC;QACtK,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,IAAI,eAAe,8BAA8B,CAAC,CAAC,OAAO,gCAAgC,CAAC,CAAC;QACnI,CAAC;QACD,GAAG,CAAC,kHAAkH,CAAC,CAAC;IAC1H,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,IAAI,GAAmC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC;QACtC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KACjD,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,oBAAoB,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,CAAC,QAAiB,EAA2B,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,EAAE;QACX,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;QAC3C,IAAI;QACJ,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1F,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9F,eAAe;QACf,gBAAgB;QAChB,WAAW;QACX,qEAAqE;QACrE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,4EAA4E;QAC5E,2EAA2E;QAC3E,yCAAyC;QACzC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAC7C,CAAC,CAAC;IAEH,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,IAAI;YAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACnC,0EAA0E;QAC1E,qEAAqE;;YAChE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrI,OAAO;IACT,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAExD,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,mEAAmE;QACnE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,0EAA0E;QAC1E,uDAAuD;QACvD,mEAAmE;QACnE,wEAAwE;QACxE,iEAAiE;QACjE,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACrH,CAAC;QACF,MAAM,YAAY,GAAG,CAAC,GAAW,EAAqB,EAAE;YACtD,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;gBACnC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;oBAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACzF,CAAC;YACD,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,CAAC,OAAe,EAAiB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QACpF,MAAM,aAAa,CAAC;YAClB,UAAU;YACV,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE;YACnC,MAAM;YACN,YAAY;YACZ,YAAY;YACZ,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC;QAChB,6EAA6E;QAC7E,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,8DAA8D;QAC9D,MAAM,iBAAiB,CACrB,MAAM,CAAC,OAAO,EACd,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,EACjG,MAAM,CACP,CAAC;QACF,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QACzB,iBAAiB,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACtC,kDAAkD;QAClD,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,mEAAmE;YACnE,0EAA0E;YAC1E,0EAA0E;YAC1E,8BAA8B;YAC9B,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;QACD,+EAA+E;QAC/E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9C,uEAAuE;QACvE,4EAA4E;QAC5E,iDAAiD;QACjD,MAAM,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,iBAAiB,KAAK,IAAI;YAAE,MAAM,sBAAsB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAC5F,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,IAAI,GACR,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,CAAC,6DAA6D,OAAO,IAAI,YAAY,UAAU;YAChG,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC/G,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE7D,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,kFAAkF;YAClF,yEAAyE;YACzE,2EAA2E;YAC3E,oEAAoE;YACpE,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YAClD,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,0BAA0B,OAAO,uBAAuB,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,gCAAgC,OAAO,IAAI,YAAY,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;IAChH,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,mBAAmB,CAAC,OAAgB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACrH,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5E,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * The archive itself, under the docs lock: gate, plan, commit.\n *\n * The order is the command's whole safety property. Every refusal happens before\n * a byte is planned (`./plan/gate.ts`), the plan is computed entirely in memory\n * so a failure on any axis leaves the living docs untouched (`./plan/specs.ts`,\n * `./plan/contracts/`, `./plan/landscape.ts`), and only a plan that succeeded\n * on every axis is staged\n * and swapped. `--dry-run` returns between the second and the third.\n */\nimport { existsSync } from \"node:fs\";\nimport { rename } from \"node:fs/promises\";\nimport { CodedFailure, emitJson, repoPath, sayExplain } from \"../../core/envelope/json.js\";\nimport {\n  message,\n  mkdirReportingCreated,\n  quietPruneEmptyParents,\n  quietRm,\n  rollbackError,\n  rollbackStaged,\n  stageWrites,\n  swapStaged,\n} from \"../../core/staging/commit.js\";\nimport { clearCommitIntent, writeCommitIntent } from \"../../core/staging/recovery/intent.js\";\nimport { SNAPSHOT_DIR, snapshotDir } from \"../../core/staging/snapshot/manifest.js\";\nimport { SnapshotClobberError, writeSnapshot, type ServiceKey } from \"../../core/staging/snapshot/snapshot.js\";\nimport { enumeratedServices } from \"../../core/repo/service-target.js\";\nimport { listFleetTree } from \"../../core/repo/repo.js\";\nimport { serviceViewsPath, subsystemViewsPath } from \"../../core/repo/paths.js\";\nimport { serviceViewsState, viewsState } from \"../../core/repo/tree/render/stale.js\";\nimport { loadArchitecture } from \"../../core/c4/project/architecture.js\";\nimport { FleetContext } from \"../../core/fleet-context.js\";\nimport { gate } from \"./plan/gate.js\";\nimport { issueJson, printPlan, refuseJson, type ArchiveOptions } from \"./plan/refusal.js\";\nimport { planCapabilities, planGlossary, planSpecs } from \"./plan/specs.js\";\nimport { planOpenapiContracts } from \"./plan/contracts/openapi.js\";\nimport { planAsyncapiContracts } from \"./plan/contracts/asyncapi.js\";\nimport { contractConsumers } from \"./plan/contracts/consumers.js\";\nimport { planDeployments, planFlows, planLandscape } from \"./plan/landscape.js\";\nimport { planFeatureLinks, planInboundLinks } from \"./plan/document/links.js\";\nimport { emptyPlan } from \"./plan/state.js\";\nimport { checklistAtArchive } from \"./shipped.js\";\nimport { outstandingLines } from \"./closing.js\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\n\nexport async function archiveLocked(\n  config: { docsDir: DocsDir },\n  featureId: string,\n  opts: ArchiveOptions,\n): Promise<void> {\n  const dryRun = opts.dryRun === true;\n  const json = opts.json === true;\n  // All prose goes through here so `--json` keeps stdout a single JSON document.\n  const say = (line = \"\"): void => {\n    if (!json) console.log(line);\n  };\n\n  // One read index for the whole run, threaded through every planner's\n  // config record: gate, the spec merge and both contract merges each hold\n  // per-service loops that resolve living paths through the enumeration, and\n  // without a shared context every one of those calls re-walks the fleet —\n  // O(services²) work under a lock that guarantees the tree is not moving.\n  // The snapshot resolver below reads through the same context, so it pays\n  // for that enumeration too.\n  const read = { docsDir: config.docsDir, fleet: new FleetContext() };\n  const gated = await gate(read, featureId, opts, say);\n  if (gated === null) return;\n  const { id, dirName, featureDir, gating, advisory, archiveDir, archiveDest, recovered, issues } = gated;\n\n  say(`archive ${id}${dryRun ? \"  (dry run)\" : \"\"}\\n`);\n\n  // PLAN — compute every merge in memory. Nothing is written until the whole plan\n  // succeeds, so a failure on any axis leaves the living docs untouched.\n  const planned = emptyPlan();\n  await planSpecs(read, gated, planned, say);\n  // The business corpus, beside the service one and before the contracts: both\n  // are requirement merges, and reading them together is how a plan stays\n  // legible as \"what this feature promises\" followed by \"how it is built\".\n  await planCapabilities(read, gated, planned, say);\n  // The vocabulary the change brings with it, beside the promises it makes:\n  // a create-only whole-file copy, refused at the gate if the word already\n  // lives (`core/glossary/delta.ts`).\n  await planGlossary(read, gated, planned, say);\n  // One consumer index for both contract planners, built only if one of them\n  // overwrites an operation or a message (./plan/contracts/consumers.ts) —\n  // and then over the living fleet as it stands before this merge.\n  const contracts = { ...read, consumers: contractConsumers(read) };\n  await planOpenapiContracts(contracts, gated, planned, say);\n  await planAsyncapiContracts(contracts, gated, planned, say);\n  // `read`, not `config`: the C4 merge now asks which services own their own\n  // interior, and that answer comes from the fleet enumeration this run has\n  // already paid for.\n  await planLandscape(read, gated, planned, say);\n  // The flows this feature brings, after the elements they draw hops over: the\n  // copy is create-only and refused at the gate if the living tree already holds\n  // one (`core/usecases/delta/flows.ts`), and it is ordered after the landscape\n  // merge so a reader of the plan sees the map change before the sequence drawn\n  // on it.\n  await planFlows(config, gated, planned, say);\n  await planDeployments(config, gated, planned, say);\n  // After the merges, because it is the move rather than a merge: the feature's own\n  // documents ride the rename into features/archive/, and their links out of\n  // the feature are re-expressed for it in this same commit\n  // (./plan/document/links.ts) — planned at their current paths, swapped before\n  // the rename carries them, and parked in the snapshot like every other write.\n  await planFeatureLinks(config, gated, planned, say);\n  // And the links the rest of the corpus holds INTO the feature, after every\n  // merge so a document the merge rewrites is relinked from its merged text.\n  await planInboundLinks(read, gated, planned, say);\n  const { writes, planWarns, planGates, openapiRemovals, asyncapiRemovals } = planned;\n  const revouchOwed = planned.revouchOwed.map((r) => ({ ...r, path: repoPath(config.docsDir, r.path) }));\n\n  // Gate on what only the plan could see: a merged operation pointing at a\n  // component that exists nowhere, a removal marker addressing no operation.\n  // Same doctrine as the coherence gate — a judgment call --approve overrides\n  // (unlike the mechanical merge-failed refusals), and a dry run is gated too.\n  // Checked after the whole plan so the refusal costs nothing: no write has\n  // happened yet either way.\n  if (planGates.length > 0 && !opts.approve) {\n    const msg = `archive ${id} — BLOCKED: ${planGates.length} issue(s) in the contract merge`;\n    if (json) {\n      refuseJson(\n        \"not-coherent\",\n        msg,\n        [...issues, ...planWarns, ...planGates],\n        `features/${dirName}`,\n      );\n      return;\n    }\n    console.error(`${msg}:`);\n    for (const i of planGates) console.error(`  ✗ ${i.message}`);\n    console.error(`\\nFix them in the feature's openapi.yaml / asyncapi.yaml — or re-run with --approve to merge anyway.`);\n    sayExplain(\"not-coherent\");\n    process.exitCode = 1;\n    return;\n  }\n  if (planGates.length > 0) {\n    say(`\\n  ⚠ archiving despite ${planGates.length} contract merge issue(s) (--approve):`);\n    for (const i of planGates) say(`      ✗ ${i.message}`);\n  }\n  // Printed by the dry run and the real merge alike, before either commits to\n  // anything: the merge is what moves these documents, and the merge's PR is\n  // the place their re-vouches belong. Not a finding and not a refusal — the\n  // staleness that follows is honest, and `content.stale` is what grades it.\n  if (revouchOwed.length > 0) {\n    say(`\\n  re-vouch owed — this merge moves ${revouchOwed.length} vouched spec(s) under the vouch stamp, so content.stale follows on each until its owner re-vouches:`);\n    for (const r of revouchOwed) {\n      say(`    ${r.path}  (owner: ${r.owner ?? \"none recorded\"}) — \\`loam vouch --service ${r.service}\\`, run in that service's repo`);\n    }\n    say(`    land the re-vouches in this PR: \\`loam validate --all --base <ref> --strict\\` stays red on it until they do.`);\n  }\n\n  // The plan as data, verb decided now — after the commit everything would read\n  // as an update. The `--json` payload is identical for a dry run and the real\n  // thing except for `archived`; what WOULD happen is what DOES happen.\n  const warnings = [...advisory, ...planWarns];\n  const overridden = opts.approve === true ? [...gating, ...planGates] : [];\n  const plan: Array<Record<string, unknown>> = writes.map((w) => ({\n    path: repoPath(config.docsDir, w.path),\n    action: existsSync(w.path) ? \"update\" : \"create\",\n  }));\n  plan.push({ path: `features/${dirName}`, action: \"move\", to: `features/archive/${dirName}` });\n  const payload = (archived: boolean): Record<string, unknown> => ({\n    command: \"archive\",\n    feature: id,\n    archived,\n    path: repoPath(config.docsDir, archiveDest),\n    plan,\n    warnings: warnings.map((issue) => issueJson(issue, repoPath(config.docsDir, archiveDest))),\n    overridden: overridden.map((issue) => issueJson(issue, repoPath(config.docsDir, archiveDest))),\n    openapiRemovals,\n    asyncapiRemovals,\n    revouchOwed,\n    // What the requirement merge takes away (./plan/specs.ts). Additive.\n    dropped: planned.dropped.map((row) => ({ ...row, path: repoPath(config.docsDir, row.path) })),\n    // Present only when this run found an interrupted commit and dealt with it:\n    // an agent that sees the docs change under it deserves to be told why, and\n    // the absent field is the ordinary case.\n    ...(recovered === null ? {} : { recovered }),\n  });\n\n  if (dryRun) {\n    if (json) emitJson(payload(false));\n    // What the real run would print in place of its closing line, said BEFORE\n    // anything is written — the one moment a reader can still act on it.\n    else printPlan(config.docsDir, writes, dirName, outstandingLines({ advisory, planWarns, overridden, staleViews: [], dryRun: true }));\n    return;\n  }\n\n  // The question the feature asks as it ships, captured before anything below\n  // moves the living docs it is derived from — see ./shipped.ts. It rides in\n  // the snapshot manifest; a dry run writes no snapshot, so it pays nothing.\n  const checklist = await checklistAtArchive(read, gated);\n\n  // COMMIT — the whole plan computed cleanly. Stage every new version beside its\n  // target, snapshot what is about to be overwritten, then swap them into place.\n  // Staging touches the filesystem — a read-only `architecture/`, a full disk,\n  // a target whose pre-image cannot be read. None of that is a bug in loam, and\n  // reporting `internal` sends the reader looking for one; it is the same\n  // answer as any other merge that could not be computed: nothing was written.\n  let staged;\n  try {\n    staged = await stageWrites(writes);\n  } catch (err) {\n    throw new CodedFailure(\"merge-failed\", `${message(err)} — nothing was written`);\n  }\n  let snapshot = false;\n  let createdArchiveDir: string | null = null;\n  try {\n    // The snapshot's resolver pair: how a docs-relative path decomposes into a\n    // service identity, and where that identity lives NOW. Built here — the\n    // command layer's view of the tree — and injected, so the snapshot module\n    // never learns the repo layout. The seam the flat wave left is now\n    // threaded: both answers come from the enumeration, so a service filed\n    // into a subsystem keys its snapshot rows by the directory it actually\n    // lives in, and the clobber guard grades a leftover claim at that same\n    // address. The root-level parse stays as the fallback for the one path\n    // shape the enumeration cannot know yet — a service this archive CREATES,\n    // which always materialises unfiled at services/<id>/.\n    // Tolerant on purpose: a docs repo whose services/ is absent still\n    // archives a landscape-only feature exactly as before — the enumeration\n    // is empty, every row keys by the flat fallback, and the missing\n    // directory stays doctor's diagnosis rather than a merge-failed here.\n    const dirOf = new Map(\n      (await enumeratedServices(config.docsDir, read.fleet)).map((s) => [s.id as string, repoPath(config.docsDir, s.dir)]),\n    );\n    const serviceKeyOf = (rel: string): ServiceKey | null => {\n      for (const [service, dir] of dirOf) {\n        if (rel.startsWith(`${dir}/`)) return { service, artifact: rel.slice(dir.length + 1) };\n      }\n      const m = /^services\\/([^/]+)\\/(.+)$/.exec(rel);\n      return m ? { service: m[1]!, artifact: m[2]! } : null;\n    };\n    const serviceDirOf = (service: string): string | null => dirOf.get(service) ?? null;\n    await writeSnapshot({\n      featureDir,\n      movesTo: archiveDest,\n      docsDir: config.docsDir,\n      feature: { featureId: id, dirName },\n      staged,\n      serviceKeyOf,\n      serviceDirOf,\n      ...(checklist === undefined ? {} : { checklist }),\n    });\n    snapshot = true;\n    // The journal, fsynced, BEFORE the first rename: swapStaged is N renames and\n    // only each one of them is atomic, so a kill between two used to leave a\n    // half-merged repo that nothing could name — `doctor` and `status` called it\n    // healthy and `validate --all` blamed the delta. Written from `staged`, so\n    // it records the same digests the swaps are about to produce.\n    await writeCommitIntent(\n      config.docsDir,\n      { command: \"archive\", restore: \"before\", feature: id, moveFrom: featureDir, moveTo: archiveDest },\n      staged,\n    );\n    await swapStaged(staged);\n    createdArchiveDir = await mkdirReportingCreated(archiveDir);\n    await rename(featureDir, archiveDest);\n    // Last: while it exists, the commit is in flight.\n    await clearCommitIntent(config.docsDir);\n  } catch (err) {\n    if (err instanceof SnapshotClobberError) {\n      // Nothing swapped — the refusal happens before the journal is even\n      // written — so this only takes the temp files away. Its own code, because\n      // the answer is not \"re-run\": a previous archive of this feature is still\n      // sitting in the living docs.\n      await rollbackStaged(staged);\n      throw new CodedFailure(\"commit-interrupted\", err.message);\n    }\n    // Everything this run made, unmade: the swapped files, the snapshot inside the\n    // feature that is staying put, and features/archive/ if we are the ones who\n    // created it (mkdirReportingCreated reports null when it was already there).\n    const failures = await rollbackStaged(staged);\n    // The rollback decided the outcome, so the journal has nothing left to\n    // describe — including on rollback-incomplete, where the files it names are\n    // the ones the message tells a human to look at.\n    await clearCommitIntent(config.docsDir);\n    // The snapshot goes only when the rollback HELD. On rollback-incomplete it\n    // holds the only on-disk pre-images of the very files the message tells the\n    // reader to repair by hand — a MODIFIED requirement's previous text appears\n    // nowhere else. Retaining it is safe: the next archive of this feature reads\n    // it before it would replace it, and refuses if the living docs have moved.\n    if (snapshot && failures.length === 0) await quietRm(snapshotDir(featureDir));\n    // `features/archive/` is shared the moment it exists: another archive can\n    // have moved a whole feature into it between our mkdir and this rollback,\n    // and a recursive remove of \"the directory we created\" took that feature —\n    // snapshot and all — with it, on OUR failure path, in silence. Empty\n    // directories only, stopping at the first that is not.\n    if (createdArchiveDir !== null) await quietPruneEmptyParents(archiveDir, createdArchiveDir);\n    // The code is a caller's answer to \"can I trust the repo?\": merge-failed\n    // means yes (rolled back), rollback-incomplete means look at it by hand.\n    const wrapped = rollbackError(err, failures);\n    const kept =\n      snapshot && failures.length > 0\n        ? ` Pre-images of the overwritten files are kept in features/${dirName}/${SNAPSHOT_DIR}/files/.`\n        : \"\";\n    throw new CodedFailure(failures.length > 0 ? \"rollback-incomplete\" : \"merge-failed\", wrapped.message + kept);\n  }\n\n  // This merge just changed the map, and both generated views files are a\n  // function of the tree AND the map: a delta whose element lands inside a\n  // group that exactly covered a subsystem takes that subsystem's boundary\n  // line away, a delta binding an element to a filed service adds an include,\n  // and one new edge changes exactly one service's overview. Archive does not\n  // rewrite either file — `loam subsystem sync` owns them outright, and folding\n  // a second generated artifact into this transaction would mean archive\n  // computing the post-merge tree AND the post-merge map, which is how the two\n  // writers disagree — but it must not report a repo as current when the next\n  // `validate --all` will call it stale. Graded through validate's own\n  // functions, so the two cannot answer differently.\n  const staleViews = await staleGeneratedViews(config.docsDir);\n\n  if (json) {\n    emitJson({\n      ...payload(true),\n      // The original boolean keeps its exact meaning — `architecture/subsystems.likec4`\n      // and nothing else — because a payload key's meaning is frozen; the list\n      // beside it is the additive answer that can name the second file. Both are\n      // omitted when nothing is stale, exactly as the boolean always was.\n      ...(staleViews.length === 0 ? {} : { staleViews }),\n      ...(staleViews.includes(\"architecture/subsystems.likec4\") ? { subsystemViewsStale: true } : {}),\n    });\n    return;\n  }\n  console.log(`\\n  archived: features/${dirName} → features/archive/${dirName}`);\n  console.log(`  snapshot: features/archive/${dirName}/${SNAPSHOT_DIR}/ — \\`loam unarchive ${id}\\` puts it back`);\n  // The closing line is a claim about the whole docs repo, and it is the line a\n  // reader stops at. It may be printed only when this archive left nothing the\n  // next `validate --all` will fail on; ./closing.ts lists every reason it\n  // cannot be, and those lines are printed instead. Printing it over any of\n  // them is how a red fleet gets reported as a finished one.\n  const owed = outstandingLines({ advisory, planWarns, overridden, staleViews, dryRun: false });\n  if (owed.length === 0) {\n    console.log(\"  living spec + landscape are now complete + current.\");\n    return;\n  }\n  for (const line of owed) console.log(line);\n}\n\n/**\n * Which generated files would the next `validate --all` report\n * `subsystem.views-stale` on? Docs-relative paths, sorted, empty for none.\n *\n * Asked through validate's OWN functions rather than a second compare, so the\n * warning archive prints and the error validate raises can never disagree —\n * including about the gate validate holds: a map that does not parse is\n * `landscape.invalid`'s business, and grading a generated file against a map\n * nobody can read would cascade a second complaint behind the first. An\n * unreadable map therefore answers \"no claim\", exactly as validate does.\n *\n * BOTH generated files, because this merge just changed the map and the\n * per-service overviews are a function of it in a way the subsystem views are\n * not: a delta adding one edge changes exactly one service's peer set, and a\n * delta binding a new element adds a whole view. Naming only the file loam\n * happened to check first would let a repo be reported current while the very\n * next `validate --all` calls it stale — the one thing this advisory exists to\n * prevent.\n */\nasync function staleGeneratedViews(docsDir: DocsDir): Promise<string[]> {\n  try {\n    const doc = await loadArchitecture(docsDir);\n    if (doc.errors.length > 0) return [];\n    const tree = await listFleetTree(docsDir);\n    const stale: string[] = [];\n    if (!(await viewsState(subsystemViewsPath(docsDir), tree, doc)).agrees) stale.push(\"architecture/subsystems.likec4\");\n    if (!(await serviceViewsState(serviceViewsPath(docsDir), tree, doc)).agrees) {\n      stale.push(\"architecture/services.likec4\");\n    }\n    return stale.sort();\n  } catch {\n    // Tolerant for the reason the snapshot resolver above is: a docs repo with\n    // no `services/` at all still archives a landscape-only feature, and this\n    // question is an ADVISORY printed after a commit that already succeeded.\n    // Nothing here may turn a landed archive into a non-zero exit.\n    return [];\n  }\n}\n"]}

package/dist/commands/archive/shipped.js

@@ -0,0 +1,49 @@
+/**
+ * What `archive` writes down about the verification a feature ships with: the
+ * digest of the checklist it asks at the moment of the merge, captured into
+ * the undo snapshot's manifest (`core/staging/snapshot/manifest.ts`,
+ * `readSnapshotChecklist`).
+ *
+ * Archive reads no verdict — verify never gates the merge, and nothing here
+ * changes that: a record's state decides nothing about whether the archive
+ * runs. But once archived, a record is frozen history, and the checklist it
+ * could be held to is gone — the merge moves the feature's operations into the
+ * living contract, so a derivation after it can only mismatch. That made
+ * archiving the cheapest way past `loam gate --since`: a record gone stale
+ * read `verified` again the moment its feature shipped. With the question as
+ * it stood at the merge written down beside the record, the gate holds the
+ * frozen record to the feature that actually shipped, and `list`, `status` and
+ * `verify` keep reading it as the frozen history they always did.
+ *
+ * A module of its own rather than lines in `./run.ts`, which sequences the
+ * commit and is near the line limit; this is the one place archive asks the
+ * done-check anything.
+ */
+import { featureChecklist } from "../../core/verify/checklist.js";
+import { readVerificationState } from "../../core/verify/read/file.js";
+/**
+ * The digest a fresh `loam verify` would derive for the feature right now —
+ * call it before the first byte of the merge lands — or undefined when there
+ * is nothing worth capturing.
+ *
+ * Only a feature that carries a READABLE record pays for the derivation (it
+ * loads the delta into a LikeC4 workspace): with no record, or one nothing can
+ * read, the gate's answer is "absent" or "unreadable" whatever the checklist
+ * was, so a capture would buy nothing.
+ *
+ * Every failure is "nothing captured", never a refusal — verify does not gate
+ * the archive, and a derivation that could not run must not start to. The
+ * gate reads an absent capture as frozen history and says so.
+ */
+export async function checklistAtArchive(read, feature) {
+    try {
+        const record = await readVerificationState(feature.featureDir);
+        if (record.state !== "ok")
+            return undefined;
+        return (await featureChecklist(read.docsDir, feature.featureDir, feature.id, read.fleet)).digest;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=shipped.js.map

package/dist/commands/archive/shipped.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shipped.js","sourceRoot":"","sources":["../../../src/commands/archive/shipped.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAIvE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA+C,EAC/C,OAA+C;IAE/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["/**\n * What `archive` writes down about the verification a feature ships with: the\n * digest of the checklist it asks at the moment of the merge, captured into\n * the undo snapshot's manifest (`core/staging/snapshot/manifest.ts`,\n * `readSnapshotChecklist`).\n *\n * Archive reads no verdict — verify never gates the merge, and nothing here\n * changes that: a record's state decides nothing about whether the archive\n * runs. But once archived, a record is frozen history, and the checklist it\n * could be held to is gone — the merge moves the feature's operations into the\n * living contract, so a derivation after it can only mismatch. That made\n * archiving the cheapest way past `loam gate --since`: a record gone stale\n * read `verified` again the moment its feature shipped. With the question as\n * it stood at the merge written down beside the record, the gate holds the\n * frozen record to the feature that actually shipped, and `list`, `status` and\n * `verify` keep reading it as the frozen history they always did.\n *\n * A module of its own rather than lines in `./run.ts`, which sequences the\n * commit and is near the line limit; this is the one place archive asks the\n * done-check anything.\n */\nimport { featureChecklist } from \"../../core/verify/checklist.js\";\nimport { readVerificationState } from \"../../core/verify/read/file.js\";\nimport type { FleetContext } from \"../../core/fleet-context.js\";\nimport type { DocsDir, FeatureDir } from \"../../core/kernel/ids/dirs.js\";\n\n/**\n * The digest a fresh `loam verify` would derive for the feature right now —\n * call it before the first byte of the merge lands — or undefined when there\n * is nothing worth capturing.\n *\n * Only a feature that carries a READABLE record pays for the derivation (it\n * loads the delta into a LikeC4 workspace): with no record, or one nothing can\n * read, the gate's answer is \"absent\" or \"unreadable\" whatever the checklist\n * was, so a capture would buy nothing.\n *\n * Every failure is \"nothing captured\", never a refusal — verify does not gate\n * the archive, and a derivation that could not run must not start to. The\n * gate reads an absent capture as frozen history and says so.\n */\nexport async function checklistAtArchive(\n  read: { docsDir: DocsDir; fleet: FleetContext },\n  feature: { id: string; featureDir: FeatureDir },\n): Promise<string | undefined> {\n  try {\n    const record = await readVerificationState(feature.featureDir);\n    if (record.state !== \"ok\") return undefined;\n    return (await featureChecklist(read.docsDir, feature.featureDir, feature.id, read.fleet)).digest;\n  } catch {\n    return undefined;\n  }\n}\n"]}