@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/commands/subsystem/move.js

@@ -0,0 +1,325 @@
+/**
+ * `subsystem move` and `subsystem rename` — ONE transaction over N directory
+ * renames plus BOTH generated views files, the first real consumer of the
+ * journaled txn's moves half (`core/staging/txn/`), plus every markdown link
+ * the renames would otherwise break (`./txn/links.ts`). The planning lives in
+ * this module; the commit window itself is `./txn/txn.ts`, shared with
+ * `new` and `rm`.
+ *
+ * The ONLY move-specific refusal is `move-uncommitted` — git reports
+ * uncommitted changes under a directory being moved, or in a document outside
+ * it whose links the move rewrites — and only on positive evidence: where git
+ * will not say, the move proceeds. After a landed move loam performs the
+ * roadmap's one blessed git write, a best-effort `git add` of the rename
+ * pairs, of the relinked documents and of BOTH regenerated views files, so git
+ * records the renames as renames and `subsystem history` stays answerable once
+ * the user commits. Nothing is ever committed.
+ */
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname, join, sep } from "node:path";
+import { parseSubsystemName } from "../../core/kernel/ids/subsystem.js";
+import { isRecord } from "../../core/kernel/records.js";
+import { emitJson, fail, repoPath } from "../../core/envelope/json.js";
+import { gitDirtyPaths, gitStageRenames } from "../../core/provenance/gitq/moves.js";
+import { servicesDir, serviceViewsPath, subsystemPathUnder, subsystemViewsPath } from "../../core/repo/paths.js";
+import { listFeatures } from "../../core/repo/repo.js";
+import { closeNamesHint, findInTree, treeNames, withinSubsystem } from "../../core/repo/tree/find.js";
+import { SNAPSHOT_COMPAT_VERSION, SNAPSHOT_MANIFEST, snapshotDir } from "../../core/staging/snapshot/manifest.js";
+import { commitWindow, reportViews } from "./txn/txn.js";
+import { movedTree } from "./txn/views.js";
+import { movedLinks, outside } from "./txn/links.js";
+/** `subsystem move <name>... --into <sub|.>` — services and whole subtrees alike. */
+export async function runMove(docsDir, names, into, json) {
+    await commitWindow(docsDir, json, async (tree) => {
+        const seen = new Set();
+        for (const name of names) {
+            if (seen.has(name)) {
+                fail(json, "invalid-option", `'${name}' is named twice — each service or subsystem moves once.`);
+                return null;
+            }
+            seen.add(name);
+        }
+        const target = resolveTarget(tree, into, { docsDir, json });
+        if (target === null)
+            return null;
+        const moved = [];
+        for (const name of names) {
+            const hit = findInTree(tree, name);
+            if (hit === null) {
+                fail(json, "unknown-target", `No service or subsystem '${name}' in the tree.` +
+                    closeNamesHint(name, treeNames(tree), " `loam subsystem list` shows what exists."));
+                return null;
+            }
+            moved.push(hit.kind === "service"
+                ? { name, kind: "service", dir: hit.service.dir, parent: hit.service.subsystem }
+                : { name, kind: "subsystem", dir: hit.subsystem.dir, parent: hit.subsystem.path.slice(0, -1) });
+        }
+        for (const m of moved) {
+            if (m.kind === "subsystem" && withinSubsystem([...m.parent, m.name], target.path)) {
+                fail(json, "invalid-option", `'${m.name}' cannot move into itself or its own subtree.`);
+                return null;
+            }
+            if (m.parent.join("/") === target.path.join("/")) {
+                fail(json, "invalid-option", `'${m.name}' is already directly in ${into === "." ? "the services/ root" : `'${into}'`} — nothing to move.`);
+                return null;
+            }
+            const inside = moved.find((other) => other.kind === "subsystem" && other !== m && (m.dir + sep).startsWith(other.dir + sep));
+            if (inside !== undefined) {
+                fail(json, "invalid-option", `'${m.name}' sits inside '${inside.name}', which is also being moved — name only the subtree root.`);
+                return null;
+            }
+            if (existsSync(join(target.dir, m.name))) {
+                // Unreachable in a healthy flat namespace; a tree already carrying
+                // name collisions can produce it, and refusing beats stacking a
+                // second directory of the same name.
+                fail(json, "already-exists", `${repoPath(docsDir, join(target.dir, m.name))} already exists — fix the name collision first.`);
+                return null;
+            }
+        }
+        const renames = moved.map((m) => ({ from: m.dir, to: join(target.dir, m.name) }));
+        // The links the renames would break, rewritten in the same commit
+        // (`./txn/links.ts`) — and the documents outside the moved directories
+        // that rewrite touches are asked the same uncommitted-work question.
+        const links = await movedLinks(docsDir, renames);
+        if (await refuseUncommitted(docsDir, [...moved.map((m) => m.dir), ...outside(links, renames)], json))
+            return null;
+        const notices = [...(await v2SnapshotNotices(docsDir, moved.map((m) => m.dir))), ...links.notices];
+        return {
+            target: names.join(", "),
+            writes: links.writes,
+            tree: movedTree(tree, renames, servicesDir(docsDir)),
+            moves: renames,
+            failedCode: "move-failed",
+            what: "moved",
+            report: async (views, recovered) => {
+                await stageInGit(docsDir, { renames, relinked: outside(links, renames) }, views);
+                const rows = moved.map((m, i) => ({
+                    name: m.name,
+                    kind: m.kind,
+                    from: repoPath(docsDir, renames[i].from),
+                    to: repoPath(docsDir, renames[i].to),
+                }));
+                const relinked = links.relinked.map((path) => repoPath(docsDir, path));
+                if (json) {
+                    emitJson({
+                        command: "subsystem",
+                        into,
+                        moved: rows,
+                        views: views.subsystems,
+                        serviceViews: views.services,
+                        relinked,
+                        ...(notices.length === 0 ? {} : { warnings: notices }),
+                        ...(recovered === null ? {} : { recovered }),
+                    });
+                    return;
+                }
+                for (const row of rows)
+                    console.log(`moved ${row.from} -> ${row.to}`);
+                for (const path of relinked)
+                    console.log(`relinked ${path}`);
+                for (const n of notices)
+                    console.log(`note: ${n}`);
+                console.log(`Renames staged where git answers; nothing committed${reportViews(views)}.`);
+            },
+        };
+    });
+}
+/** `subsystem rename <old> <new>` — one rename through the same transaction. */
+export async function runRename(docsDir, names, json) {
+    const [from, to] = names;
+    await commitWindow(docsDir, json, async (tree) => {
+        const hit = findInTree(tree, from);
+        if (hit === null) {
+            fail(json, "unknown-target", `No subsystem '${from}' in the tree.` + closeNamesHint(from, tree.subsystems.map((s) => s.name), ""));
+            return null;
+        }
+        if (hit.kind === "service") {
+            fail(json, "invalid-option", `'${from}' is a service — a service's id IS its identity (loam.json, frontmatter, feature specs all join on it), so loam never renames one.`);
+            return null;
+        }
+        const parsed = parseSubsystemName(to, "subsystem name");
+        if (!parsed.ok) {
+            fail(json, "invalid-option", parsed.problem);
+            return null;
+        }
+        const taken = findInTree(tree, to);
+        if (taken !== null) {
+            const where = taken.kind === "service" ? taken.service.dir : taken.subsystem.dir;
+            fail(json, "already-exists", `'${to}' is already a ${taken.kind} (${repoPath(docsDir, where)}) — the namespace is flat at any depth.`);
+            return null;
+        }
+        const rename = { from: hit.subsystem.dir, to: subsystemPathUnder(dirname(hit.subsystem.dir), parsed.name) };
+        // A rename is a one-rename move, and owes the same link rewrite.
+        const links = await movedLinks(docsDir, [rename]);
+        if (await refuseUncommitted(docsDir, [hit.subsystem.dir, ...outside(links, [rename])], json))
+            return null;
+        const notices = [...(await v2SnapshotNotices(docsDir, [hit.subsystem.dir])), ...links.notices];
+        return {
+            target: `${from} -> ${to}`,
+            writes: links.writes,
+            tree: movedTree(tree, [rename], servicesDir(docsDir)),
+            moves: [rename],
+            failedCode: "move-failed",
+            what: "renamed",
+            report: async (views, recovered) => {
+                await stageInGit(docsDir, { renames: [rename], relinked: outside(links, [rename]) }, views);
+                const relinked = links.relinked.map((path) => repoPath(docsDir, path));
+                if (json) {
+                    emitJson({
+                        command: "subsystem",
+                        renamed: from,
+                        to,
+                        path: repoPath(docsDir, rename.to),
+                        views: views.subsystems,
+                        serviceViews: views.services,
+                        relinked,
+                        ...(notices.length === 0 ? {} : { warnings: notices }),
+                        ...(recovered === null ? {} : { recovered }),
+                    });
+                    return;
+                }
+                console.log(`renamed subsystem '${from}' -> '${to}' (${repoPath(docsDir, rename.to)}/)${reportViews(views)}`);
+                for (const path of relinked)
+                    console.log(`relinked ${path}`);
+                for (const n of notices)
+                    console.log(`note: ${n}`);
+            },
+        };
+    });
+}
+/** Where `--into` points: the services/ root for `.`, an existing subsystem otherwise. */
+function resolveTarget(tree, into, at) {
+    if (into === ".")
+        return { dir: servicesDir(at.docsDir), path: [] };
+    const hit = findInTree(tree, into);
+    if (hit === null) {
+        fail(at.json, "unknown-target", `No subsystem '${into}' to move into.` +
+            closeNamesHint(into, tree.subsystems.map((s) => s.name), " `--into .` unfiles; `loam subsystem new` creates."));
+        return null;
+    }
+    if (hit.kind === "service") {
+        fail(at.json, "invalid-option", `--into names the service '${into}' — a service never contains other services.`);
+        return null;
+    }
+    return { dir: hit.subsystem.dir, path: hit.subsystem.path };
+}
+/**
+ * The one move-specific refusal, on positive evidence only: git names
+ * uncommitted work under a directory about to be renamed — or in a document
+ * outside it whose links the move rewrites (`./txn/links.ts`), which it then
+ * stages exactly as it stages the renames. Null (git will not say) proceeds —
+ * a fleet that does not use git must not be refused over it.
+ */
+async function refuseUncommitted(docsDir, paths, json) {
+    const dirty = await gitDirtyPaths(docsDir, paths.map((d) => repoPath(docsDir, d)));
+    if (dirty === null || dirty.length === 0)
+        return false;
+    fail(json, "move-uncommitted", 
+    // "or untracked", and `git stash -u` by name: the check fires on ANY
+    // porcelain entry, untracked files included, and plain `git stash` does
+    // not stash those — advice that said "stash" sent the user in a loop,
+    // refused again with the same sentence after doing what it asked.
+    `git reports ${dirty.length} uncommitted or untracked path(s) this move would rename or relink: ${dirty.join(", ")}. ` +
+        "Renaming now would sweep them into a move nobody reviewed — commit them, `git stash -u`, or remove them, then re-run. " +
+        "Nothing was moved.");
+    return true;
+}
+/**
+ * Stage the move's whole delta, silently: the rename pairs (both ends — the
+ * delete side and the add side; a moved document whose links this commit
+ * rewrote is inside them), every document OUTSIDE the renames whose links it
+ * rewrote, AND BOTH regenerated views files. They ride
+ * along for the same reason the transaction writes them in the same commit: a
+ * user whose next `git commit` captured the renames without them would commit
+ * a tree `validate --all` fails (`subsystem.views-stale`) — the exact "failing
+ * between two commits" state the roadmap forbids.
+ *
+ * A generated file that is neither ON DISK nor REMOVED BY THIS COMMIT is left
+ * out of the pathspec, and that is a correctness rule rather than tidiness:
+ * `gitStageRenames` runs one `git add -A -- <paths>`, and a pathspec matching
+ * neither the worktree nor the index makes git refuse the WHOLE invocation
+ * (silently — that write is failure-silent by contract) — so naming an absent
+ * `architecture/services.likec4` (a fleet whose map draws no service renders
+ * none) would take the other paths out of the index with it.
+ *
+ * THE `removed` ARM IS WHY `existsSync` ALONE IS NOT THE FILTER. A move can be
+ * the commit that DELETES a generated file rather than rewriting it: a
+ * committed `architecture/subsystems.likec4` standing over a tree that no
+ * longer marks any subsystem (the marker went in an earlier commit) must not
+ * exist, so the window renders null and the transaction removes it — and by the
+ * time this runs the file is gone from disk. Measured 2026-09-07 on exactly that
+ * fixture: under a disk-only filter the path never reached the pathspec, git
+ * reported the deletion as ` D` (unstaged) while both rename ends went in as
+ * `R `, and the user's next `git commit` captured the renames plus a generated
+ * file the tree no longer licenses — `subsystem.views-stale` on a commit loam
+ * itself produced, the exact state the paragraph above says this staging exists
+ * to prevent. A path this commit deleted is still in the INDEX, so it matches
+ * the pathspec and `-A` stages the deletion; the commit window's own
+ * `ViewsActions` is what says which file that was, so no second guess about disk
+ * is needed.
+ *
+ * SEPARATE INVOCATIONS, not one, and the split is what makes the `removed` arm
+ * safe to add: a generated file that was never committed and is deleted here is
+ * in neither the worktree nor the index, and folded into one pathspec it would
+ * take the renames down with it — the failure this function's first rule exists
+ * to refuse. The relinked documents get a call of their own for the same
+ * reason, though each of them is on disk: one bad pathspec must never cost the
+ * renames. Each extra call costs one best-effort spawn. git records a rename from the index state at commit time,
+ * never from which `git add` put the two ends there.
+ */
+async function stageInGit(docsDir, change, views) {
+    await gitStageRenames(docsDir, change.renames.flatMap((r) => [repoPath(docsDir, r.from), repoPath(docsDir, r.to)]));
+    // The documents outside the renames whose links this commit rewrote — their
+    // own invocation, for the pathspec reason above; every one is on disk.
+    await gitStageRenames(docsDir, change.relinked.map((path) => repoPath(docsDir, path)));
+    const generated = [
+        [subsystemViewsPath(docsDir), views.subsystems],
+        [serviceViewsPath(docsDir), views.services],
+    ];
+    await gitStageRenames(docsDir, generated
+        .filter(([path, action]) => action === "removed" || existsSync(path))
+        .map(([path]) => repoPath(docsDir, path)));
+}
+/**
+ * Which archived features hold a VERSION-2 snapshot addressing a path under
+ * one of these directories — the notice, never a refusal, a move prints
+ * before it proceeds. A version-2 manifest predates the tree and records
+ * literal `services/<id>/…` paths, so after this move an `unarchive --force`
+ * of that feature restores into the OLD path, resurrecting the pre-move
+ * directory beside the moved one (two claimants, `subsystem.name-collision`
+ * — loud, but avoidable by being told now). Keyed manifests (version 3 or 4)
+ * key rows by service id and follow the enumeration, so they are not named. Every
+ * failure to read reads as "nothing to warn about": a warning needs positive
+ * evidence exactly as the move's one refusal does.
+ */
+async function v2SnapshotNotices(docsDir, dirs) {
+    const rels = dirs.map((d) => repoPath(docsDir, d));
+    const notices = [];
+    let features;
+    try {
+        features = await listFeatures(docsDir, { includeArchived: true });
+    }
+    catch {
+        return notices;
+    }
+    for (const f of features.filter((entry) => entry.archived)) {
+        let manifest;
+        try {
+            manifest = JSON.parse(await readFile(join(snapshotDir(f.dir), SNAPSHOT_MANIFEST), "utf8"));
+        }
+        catch {
+            continue;
+        }
+        if (!isRecord(manifest) || manifest.version !== SNAPSHOT_COMPAT_VERSION || !Array.isArray(manifest.files))
+            continue;
+        const addressed = rels.filter((rel) => manifest.files.some((row) => isRecord(row) && typeof row.path === "string" && row.path.startsWith(`${rel}/`)));
+        if (addressed.length > 0) {
+            notices.push(`${f.id}'s archived snapshot is version 2 and addresses ${addressed.join(", ")} by literal path — ` +
+                `\`loam unarchive ${f.id} --force\` after this move would restore into the old location, ` +
+                `resurrecting the pre-move directory beside the moved one.`);
+        }
+    }
+    return notices;
+}
+//# sourceMappingURL=move.js.map

package/dist/commands/subsystem/move.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"move.js","sourceRoot":"","sources":["../../../src/commands/subsystem/move.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACjH,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEtG,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAClH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAwC,MAAM,cAAc,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAWrD,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,KAAe,EAAE,IAAY,EAAE,IAAa;IAC1F,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAgC,EAAE;QAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,IAAI,0DAA0D,CAAC,CAAC;gBACjG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,KAAK,GAAY,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,IAAI,CACF,IAAI,EACJ,gBAAgB,EAChB,4BAA4B,IAAI,gBAAgB;oBAC9C,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,2CAA2C,CAAC,CACrF,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,IAAI,KAAK,SAAS;gBACpB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE;gBAChF,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CACjG,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClF,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,+CAA+C,CAAC,CAAC;gBACxF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,4BAA4B,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,qBAAqB,CAAC,CAAC;gBAC3I,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CACvB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,CAClG,CAAC;YACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,kBAAkB,MAAM,CAAC,IAAI,4DAA4D,CAAC,CAAC;gBAClI,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACzC,mEAAmE;gBACnE,gEAAgE;gBAChE,qCAAqC;gBACrC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,iDAAiD,CAAC,CAAC;gBAC9H,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClF,kEAAkE;QAClE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM,iBAAiB,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClH,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QACnG,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YACpD,KAAK,EAAE,OAAO;YACd,UAAU,EAAE,aAAa;YACzB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;gBACjC,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBACjF,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChC,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;oBACzC,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;iBACtC,CAAC,CAAC,CAAC;gBACJ,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBACvE,IAAI,IAAI,EAAE,CAAC;oBACT,QAAQ,CAAC;wBACP,OAAO,EAAE,WAAW;wBACpB,IAAI;wBACJ,KAAK,EAAE,IAAI;wBACX,KAAK,EAAE,KAAK,CAAC,UAAU;wBACvB,YAAY,EAAE,KAAK,CAAC,QAAQ;wBAC5B,QAAQ;wBACR,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;wBACtD,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;qBAC7C,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtE,KAAK,MAAM,IAAI,IAAI,QAAQ;oBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;gBAC7D,KAAK,MAAM,CAAC,IAAI,OAAO;oBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,sDAAsD,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3F,CAAC;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAgB,EAAE,KAAuB,EAAE,IAAa;IACtF,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;IACzB,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAgC,EAAE;QAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,CACF,IAAI,EACJ,gBAAgB,EAChB,iBAAiB,IAAI,gBAAgB,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CACrG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CACF,IAAI,EACJ,gBAAgB,EAChB,IAAI,IAAI,oIAAoI,CAC7I,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;YACjF,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,kBAAkB,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACvI,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5G,iEAAiE;QACjE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,IAAI,MAAM,iBAAiB,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1G,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/F,OAAO;YACL,MAAM,EAAE,GAAG,IAAI,OAAO,EAAE,EAAE;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YACrD,KAAK,EAAE,CAAC,MAAM,CAAC;YACf,UAAU,EAAE,aAAa;YACzB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;gBACjC,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBACvE,IAAI,IAAI,EAAE,CAAC;oBACT,QAAQ,CAAC;wBACP,OAAO,EAAE,WAAW;wBACpB,OAAO,EAAE,IAAI;wBACb,EAAE;wBACF,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;wBAClC,KAAK,EAAE,KAAK,CAAC,UAAU;wBACvB,YAAY,EAAE,KAAK,CAAC,QAAQ;wBAC5B,QAAQ;wBACR,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;wBACtD,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;qBAC7C,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,SAAS,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC9G,KAAK,MAAM,IAAI,IAAI,QAAQ;oBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;gBAC7D,KAAK,MAAM,CAAC,IAAI,OAAO;oBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACrD,CAAC;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,SAAS,aAAa,CAAC,IAAe,EAAE,IAAY,EAAE,EAAuC;IAC3F,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACpE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CACF,EAAE,CAAC,IAAI,EACP,gBAAgB,EAChB,iBAAiB,IAAI,iBAAiB;YACpC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,oDAAoD,CAAC,CACjH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,6BAA6B,IAAI,8CAA8C,CAAC,CAAC;QACjH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,KAAe,EAAE,IAAa;IAC/E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CACF,IAAI,EACJ,kBAAkB;IAClB,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,kEAAkE;IAClE,eAAe,KAAK,CAAC,MAAM,uEAAuE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACpH,wHAAwH;QACxH,oBAAoB,CACvB,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,KAAK,UAAU,UAAU,CACvB,OAAgB,EAChB,MAAuE,EACvE,KAAmB;IAEnB,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG;QAChB,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,UAAU,CAAU;QACxD,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAU;KACrD,CAAC;IACF,MAAM,eAAe,CACnB,OAAO,EACP,SAAS;SACN,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;SACpE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,IAAc;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,QAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,uBAAuB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACpH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CACnC,QAAQ,CAAC,KAAmB,CAAC,IAAI,CAChC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CACzF,CACF,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CACV,GAAG,CAAC,CAAC,EAAE,mDAAmD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB;gBACjG,oBAAoB,CAAC,CAAC,EAAE,kEAAkE;gBAC1F,2DAA2D,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["/**\n * `subsystem move` and `subsystem rename` — ONE transaction over N directory\n * renames plus BOTH generated views files, the first real consumer of the\n * journaled txn's moves half (`core/staging/txn/`), plus every markdown link\n * the renames would otherwise break (`./txn/links.ts`). The planning lives in\n * this module; the commit window itself is `./txn/txn.ts`, shared with\n * `new` and `rm`.\n *\n * The ONLY move-specific refusal is `move-uncommitted` — git reports\n * uncommitted changes under a directory being moved, or in a document outside\n * it whose links the move rewrites — and only on positive evidence: where git\n * will not say, the move proceeds. After a landed move loam performs the\n * roadmap's one blessed git write, a best-effort `git add` of the rename\n * pairs, of the relinked documents and of BOTH regenerated views files, so git\n * records the renames as renames and `subsystem history` stays answerable once\n * the user commits. Nothing is ever committed.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { dirname, join, sep } from \"node:path\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\nimport { parseSubsystemName } from \"../../core/kernel/ids/subsystem.js\";\nimport { isRecord } from \"../../core/kernel/records.js\";\nimport { emitJson, fail, repoPath } from \"../../core/envelope/json.js\";\nimport { gitDirtyPaths, gitStageRenames } from \"../../core/provenance/gitq/moves.js\";\nimport type { FeatureEntry } from \"../../core/repo/entries.js\";\nimport { servicesDir, serviceViewsPath, subsystemPathUnder, subsystemViewsPath } from \"../../core/repo/paths.js\";\nimport { listFeatures } from \"../../core/repo/repo.js\";\nimport { closeNamesHint, findInTree, treeNames, withinSubsystem } from \"../../core/repo/tree/find.js\";\nimport type { FleetTree } from \"../../core/repo/tree/walk.js\";\nimport { SNAPSHOT_COMPAT_VERSION, SNAPSHOT_MANIFEST, snapshotDir } from \"../../core/staging/snapshot/manifest.js\";\nimport { commitWindow, reportViews, type SubsystemTxn, type ViewsActions } from \"./txn/txn.js\";\nimport { movedTree } from \"./txn/views.js\";\nimport { movedLinks, outside } from \"./txn/links.js\";\n\n/** What one name resolved to for a move: where it is, and where it goes. */\ninterface Moved {\n  name: string;\n  kind: \"service\" | \"subsystem\";\n  dir: string;\n  /** Path of the CONTAINING directory, as names from services/ down. */\n  parent: string[];\n}\n\n/** `subsystem move <name>... --into <sub|.>` — services and whole subtrees alike. */\nexport async function runMove(docsDir: DocsDir, names: string[], into: string, json: boolean): Promise<void> {\n  await commitWindow(docsDir, json, async (tree): Promise<SubsystemTxn | null> => {\n    const seen = new Set<string>();\n    for (const name of names) {\n      if (seen.has(name)) {\n        fail(json, \"invalid-option\", `'${name}' is named twice — each service or subsystem moves once.`);\n        return null;\n      }\n      seen.add(name);\n    }\n    const target = resolveTarget(tree, into, { docsDir, json });\n    if (target === null) return null;\n    const moved: Moved[] = [];\n    for (const name of names) {\n      const hit = findInTree(tree, name);\n      if (hit === null) {\n        fail(\n          json,\n          \"unknown-target\",\n          `No service or subsystem '${name}' in the tree.` +\n            closeNamesHint(name, treeNames(tree), \" `loam subsystem list` shows what exists.\"),\n        );\n        return null;\n      }\n      moved.push(\n        hit.kind === \"service\"\n          ? { name, kind: \"service\", dir: hit.service.dir, parent: hit.service.subsystem }\n          : { name, kind: \"subsystem\", dir: hit.subsystem.dir, parent: hit.subsystem.path.slice(0, -1) },\n      );\n    }\n    for (const m of moved) {\n      if (m.kind === \"subsystem\" && withinSubsystem([...m.parent, m.name], target.path)) {\n        fail(json, \"invalid-option\", `'${m.name}' cannot move into itself or its own subtree.`);\n        return null;\n      }\n      if (m.parent.join(\"/\") === target.path.join(\"/\")) {\n        fail(json, \"invalid-option\", `'${m.name}' is already directly in ${into === \".\" ? \"the services/ root\" : `'${into}'`} — nothing to move.`);\n        return null;\n      }\n      const inside = moved.find(\n        (other) => other.kind === \"subsystem\" && other !== m && (m.dir + sep).startsWith(other.dir + sep),\n      );\n      if (inside !== undefined) {\n        fail(json, \"invalid-option\", `'${m.name}' sits inside '${inside.name}', which is also being moved — name only the subtree root.`);\n        return null;\n      }\n      if (existsSync(join(target.dir, m.name))) {\n        // Unreachable in a healthy flat namespace; a tree already carrying\n        // name collisions can produce it, and refusing beats stacking a\n        // second directory of the same name.\n        fail(json, \"already-exists\", `${repoPath(docsDir, join(target.dir, m.name))} already exists — fix the name collision first.`);\n        return null;\n      }\n    }\n    const renames = moved.map((m) => ({ from: m.dir, to: join(target.dir, m.name) }));\n    // The links the renames would break, rewritten in the same commit\n    // (`./txn/links.ts`) — and the documents outside the moved directories\n    // that rewrite touches are asked the same uncommitted-work question.\n    const links = await movedLinks(docsDir, renames);\n    if (await refuseUncommitted(docsDir, [...moved.map((m) => m.dir), ...outside(links, renames)], json)) return null;\n    const notices = [...(await v2SnapshotNotices(docsDir, moved.map((m) => m.dir))), ...links.notices];\n    return {\n      target: names.join(\", \"),\n      writes: links.writes,\n      tree: movedTree(tree, renames, servicesDir(docsDir)),\n      moves: renames,\n      failedCode: \"move-failed\",\n      what: \"moved\",\n      report: async (views, recovered) => {\n        await stageInGit(docsDir, { renames, relinked: outside(links, renames) }, views);\n        const rows = moved.map((m, i) => ({\n          name: m.name,\n          kind: m.kind,\n          from: repoPath(docsDir, renames[i]!.from),\n          to: repoPath(docsDir, renames[i]!.to),\n        }));\n        const relinked = links.relinked.map((path) => repoPath(docsDir, path));\n        if (json) {\n          emitJson({\n            command: \"subsystem\",\n            into,\n            moved: rows,\n            views: views.subsystems,\n            serviceViews: views.services,\n            relinked,\n            ...(notices.length === 0 ? {} : { warnings: notices }),\n            ...(recovered === null ? {} : { recovered }),\n          });\n          return;\n        }\n        for (const row of rows) console.log(`moved ${row.from} -> ${row.to}`);\n        for (const path of relinked) console.log(`relinked ${path}`);\n        for (const n of notices) console.log(`note: ${n}`);\n        console.log(`Renames staged where git answers; nothing committed${reportViews(views)}.`);\n      },\n    };\n  });\n}\n\n/** `subsystem rename <old> <new>` — one rename through the same transaction. */\nexport async function runRename(docsDir: DocsDir, names: [string, string], json: boolean): Promise<void> {\n  const [from, to] = names;\n  await commitWindow(docsDir, json, async (tree): Promise<SubsystemTxn | null> => {\n    const hit = findInTree(tree, from);\n    if (hit === null) {\n      fail(\n        json,\n        \"unknown-target\",\n        `No subsystem '${from}' in the tree.` + closeNamesHint(from, tree.subsystems.map((s) => s.name), \"\"),\n      );\n      return null;\n    }\n    if (hit.kind === \"service\") {\n      fail(\n        json,\n        \"invalid-option\",\n        `'${from}' is a service — a service's id IS its identity (loam.json, frontmatter, feature specs all join on it), so loam never renames one.`,\n      );\n      return null;\n    }\n    const parsed = parseSubsystemName(to, \"subsystem name\");\n    if (!parsed.ok) {\n      fail(json, \"invalid-option\", parsed.problem);\n      return null;\n    }\n    const taken = findInTree(tree, to);\n    if (taken !== null) {\n      const where = taken.kind === \"service\" ? taken.service.dir : taken.subsystem.dir;\n      fail(json, \"already-exists\", `'${to}' is already a ${taken.kind} (${repoPath(docsDir, where)}) — the namespace is flat at any depth.`);\n      return null;\n    }\n    const rename = { from: hit.subsystem.dir, to: subsystemPathUnder(dirname(hit.subsystem.dir), parsed.name) };\n    // A rename is a one-rename move, and owes the same link rewrite.\n    const links = await movedLinks(docsDir, [rename]);\n    if (await refuseUncommitted(docsDir, [hit.subsystem.dir, ...outside(links, [rename])], json)) return null;\n    const notices = [...(await v2SnapshotNotices(docsDir, [hit.subsystem.dir])), ...links.notices];\n    return {\n      target: `${from} -> ${to}`,\n      writes: links.writes,\n      tree: movedTree(tree, [rename], servicesDir(docsDir)),\n      moves: [rename],\n      failedCode: \"move-failed\",\n      what: \"renamed\",\n      report: async (views, recovered) => {\n        await stageInGit(docsDir, { renames: [rename], relinked: outside(links, [rename]) }, views);\n        const relinked = links.relinked.map((path) => repoPath(docsDir, path));\n        if (json) {\n          emitJson({\n            command: \"subsystem\",\n            renamed: from,\n            to,\n            path: repoPath(docsDir, rename.to),\n            views: views.subsystems,\n            serviceViews: views.services,\n            relinked,\n            ...(notices.length === 0 ? {} : { warnings: notices }),\n            ...(recovered === null ? {} : { recovered }),\n          });\n          return;\n        }\n        console.log(`renamed subsystem '${from}' -> '${to}' (${repoPath(docsDir, rename.to)}/)${reportViews(views)}`);\n        for (const path of relinked) console.log(`relinked ${path}`);\n        for (const n of notices) console.log(`note: ${n}`);\n      },\n    };\n  });\n}\n\n/** Where `--into` points: the services/ root for `.`, an existing subsystem otherwise. */\nfunction resolveTarget(tree: FleetTree, into: string, at: { docsDir: DocsDir; json: boolean }): { dir: string; path: string[] } | null {\n  if (into === \".\") return { dir: servicesDir(at.docsDir), path: [] };\n  const hit = findInTree(tree, into);\n  if (hit === null) {\n    fail(\n      at.json,\n      \"unknown-target\",\n      `No subsystem '${into}' to move into.` +\n        closeNamesHint(into, tree.subsystems.map((s) => s.name), \" `--into .` unfiles; `loam subsystem new` creates.\"),\n    );\n    return null;\n  }\n  if (hit.kind === \"service\") {\n    fail(at.json, \"invalid-option\", `--into names the service '${into}' — a service never contains other services.`);\n    return null;\n  }\n  return { dir: hit.subsystem.dir, path: hit.subsystem.path };\n}\n\n/**\n * The one move-specific refusal, on positive evidence only: git names\n * uncommitted work under a directory about to be renamed — or in a document\n * outside it whose links the move rewrites (`./txn/links.ts`), which it then\n * stages exactly as it stages the renames. Null (git will not say) proceeds —\n * a fleet that does not use git must not be refused over it.\n */\nasync function refuseUncommitted(docsDir: DocsDir, paths: string[], json: boolean): Promise<boolean> {\n  const dirty = await gitDirtyPaths(docsDir, paths.map((d) => repoPath(docsDir, d)));\n  if (dirty === null || dirty.length === 0) return false;\n  fail(\n    json,\n    \"move-uncommitted\",\n    // \"or untracked\", and `git stash -u` by name: the check fires on ANY\n    // porcelain entry, untracked files included, and plain `git stash` does\n    // not stash those — advice that said \"stash\" sent the user in a loop,\n    // refused again with the same sentence after doing what it asked.\n    `git reports ${dirty.length} uncommitted or untracked path(s) this move would rename or relink: ${dirty.join(\", \")}. ` +\n      \"Renaming now would sweep them into a move nobody reviewed — commit them, `git stash -u`, or remove them, then re-run. \" +\n      \"Nothing was moved.\",\n  );\n  return true;\n}\n\n/**\n * Stage the move's whole delta, silently: the rename pairs (both ends — the\n * delete side and the add side; a moved document whose links this commit\n * rewrote is inside them), every document OUTSIDE the renames whose links it\n * rewrote, AND BOTH regenerated views files. They ride\n * along for the same reason the transaction writes them in the same commit: a\n * user whose next `git commit` captured the renames without them would commit\n * a tree `validate --all` fails (`subsystem.views-stale`) — the exact \"failing\n * between two commits\" state the roadmap forbids.\n *\n * A generated file that is neither ON DISK nor REMOVED BY THIS COMMIT is left\n * out of the pathspec, and that is a correctness rule rather than tidiness:\n * `gitStageRenames` runs one `git add -A -- <paths>`, and a pathspec matching\n * neither the worktree nor the index makes git refuse the WHOLE invocation\n * (silently — that write is failure-silent by contract) — so naming an absent\n * `architecture/services.likec4` (a fleet whose map draws no service renders\n * none) would take the other paths out of the index with it.\n *\n * THE `removed` ARM IS WHY `existsSync` ALONE IS NOT THE FILTER. A move can be\n * the commit that DELETES a generated file rather than rewriting it: a\n * committed `architecture/subsystems.likec4` standing over a tree that no\n * longer marks any subsystem (the marker went in an earlier commit) must not\n * exist, so the window renders null and the transaction removes it — and by the\n * time this runs the file is gone from disk. Measured 2026-09-07 on exactly that\n * fixture: under a disk-only filter the path never reached the pathspec, git\n * reported the deletion as ` D` (unstaged) while both rename ends went in as\n * `R `, and the user's next `git commit` captured the renames plus a generated\n * file the tree no longer licenses — `subsystem.views-stale` on a commit loam\n * itself produced, the exact state the paragraph above says this staging exists\n * to prevent. A path this commit deleted is still in the INDEX, so it matches\n * the pathspec and `-A` stages the deletion; the commit window's own\n * `ViewsActions` is what says which file that was, so no second guess about disk\n * is needed.\n *\n * SEPARATE INVOCATIONS, not one, and the split is what makes the `removed` arm\n * safe to add: a generated file that was never committed and is deleted here is\n * in neither the worktree nor the index, and folded into one pathspec it would\n * take the renames down with it — the failure this function's first rule exists\n * to refuse. The relinked documents get a call of their own for the same\n * reason, though each of them is on disk: one bad pathspec must never cost the\n * renames. Each extra call costs one best-effort spawn. git records a rename from the index state at commit time,\n * never from which `git add` put the two ends there.\n */\nasync function stageInGit(\n  docsDir: DocsDir,\n  change: { renames: { from: string; to: string }[]; relinked: string[] },\n  views: ViewsActions,\n): Promise<void> {\n  await gitStageRenames(docsDir, change.renames.flatMap((r) => [repoPath(docsDir, r.from), repoPath(docsDir, r.to)]));\n  // The documents outside the renames whose links this commit rewrote — their\n  // own invocation, for the pathspec reason above; every one is on disk.\n  await gitStageRenames(docsDir, change.relinked.map((path) => repoPath(docsDir, path)));\n  const generated = [\n    [subsystemViewsPath(docsDir), views.subsystems] as const,\n    [serviceViewsPath(docsDir), views.services] as const,\n  ];\n  await gitStageRenames(\n    docsDir,\n    generated\n      .filter(([path, action]) => action === \"removed\" || existsSync(path))\n      .map(([path]) => repoPath(docsDir, path)),\n  );\n}\n\n/**\n * Which archived features hold a VERSION-2 snapshot addressing a path under\n * one of these directories — the notice, never a refusal, a move prints\n * before it proceeds. A version-2 manifest predates the tree and records\n * literal `services/<id>/…` paths, so after this move an `unarchive --force`\n * of that feature restores into the OLD path, resurrecting the pre-move\n * directory beside the moved one (two claimants, `subsystem.name-collision`\n * — loud, but avoidable by being told now). Keyed manifests (version 3 or 4)\n * key rows by service id and follow the enumeration, so they are not named. Every\n * failure to read reads as \"nothing to warn about\": a warning needs positive\n * evidence exactly as the move's one refusal does.\n */\nasync function v2SnapshotNotices(docsDir: DocsDir, dirs: string[]): Promise<string[]> {\n  const rels = dirs.map((d) => repoPath(docsDir, d));\n  const notices: string[] = [];\n  let features: FeatureEntry[];\n  try {\n    features = await listFeatures(docsDir, { includeArchived: true });\n  } catch {\n    return notices;\n  }\n  for (const f of features.filter((entry) => entry.archived)) {\n    let manifest: unknown;\n    try {\n      manifest = JSON.parse(await readFile(join(snapshotDir(f.dir), SNAPSHOT_MANIFEST), \"utf8\"));\n    } catch {\n      continue;\n    }\n    if (!isRecord(manifest) || manifest.version !== SNAPSHOT_COMPAT_VERSION || !Array.isArray(manifest.files)) continue;\n    const addressed = rels.filter((rel) =>\n      (manifest.files as unknown[]).some(\n        (row) => isRecord(row) && typeof row.path === \"string\" && row.path.startsWith(`${rel}/`),\n      ),\n    );\n    if (addressed.length > 0) {\n      notices.push(\n        `${f.id}'s archived snapshot is version 2 and addresses ${addressed.join(\", \")} by literal path — ` +\n          `\\`loam unarchive ${f.id} --force\\` after this move would restore into the old location, ` +\n          `resurrecting the pre-move directory beside the moved one.`,\n      );\n    }\n  }\n  return notices;\n}\n"]}

package/dist/commands/subsystem/query.js

@@ -0,0 +1,113 @@
+/**
+ * The read verbs: `subsystem list` (the tree with member and unfiled counts)
+ * and `subsystem history` (how a service or subsystem moved, asked of git).
+ *
+ * `history` stays inside the provenance doctrine (`core/provenance/git.ts`):
+ * loam asks git and never tells it, and every way git declines reads as "git
+ * will not say" — nothing to answer, exit 0, no finding. The question
+ * follows a representative FILE (a service's first surviving artifact, a
+ * subsystem's marker), because `git log --follow` is defined for one file
+ * and prints nothing at all for a directory path; each hop's directories are
+ * read off the file's own rename record.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { emitJson, fail, repoPath } from "../../core/envelope/json.js";
+import { gitRenameHops, gitRenamePairingAmbiguous } from "../../core/provenance/gitq/moves.js";
+import { servicePathsAt } from "../../core/repo/paths.js";
+import { listFleetTree } from "../../core/repo/repo.js";
+import { closeNamesHint, findInTree, servicesUnder, treeNames } from "../../core/repo/tree/find.js";
+import { SUBSYSTEM_MARKER } from "../../core/repo/tree/marker.js";
+export async function runList(docsDir, json) {
+    const tree = await listFleetTree(docsDir);
+    const sorted = [...tree.subsystems].sort((a, b) => (a.path.join("/") < b.path.join("/") ? -1 : 1));
+    const unfiled = tree.services.filter((s) => s.subsystem.length === 0).length;
+    const memberCount = (sub) => servicesUnder(tree, sub).length;
+    if (json) {
+        emitJson({
+            command: "subsystem",
+            subsystems: sorted.map((sub) => ({
+                name: sub.name,
+                path: repoPath(docsDir, sub.dir),
+                title: sub.meta.title ?? null,
+                memberCount: memberCount(sub),
+            })),
+            unfiledServices: unfiled,
+            services: tree.services.length,
+        });
+        return;
+    }
+    if (sorted.length === 0) {
+        console.log(`no subsystems — the fleet is flat (${tree.services.length} service(s), all unfiled).`);
+        return;
+    }
+    console.log(`subsystems (${sorted.length})`);
+    for (const sub of sorted) {
+        const indent = "  ".repeat(sub.path.length);
+        const title = sub.meta.title === undefined ? "" : `  ${sub.meta.title}`;
+        console.log(`${indent}${sub.name}${title}  — ${memberCount(sub)} service(s)`);
+    }
+    console.log(`unfiled: ${unfiled} of ${tree.services.length} service(s)`);
+}
+export async function runHistory(docsDir, name, json) {
+    const tree = await listFleetTree(docsDir);
+    const hit = findInTree(tree, name);
+    if (hit === null) {
+        fail(json, "unknown-target", `No service or subsystem '${name}' in the tree.` + closeNamesHint(name, treeNames(tree), ""));
+        return;
+    }
+    const kind = hit.kind;
+    const file = representativeFile(hit);
+    const followed = file === null ? null : await gitRenameHops(docsDir, repoPath(docsDir, file));
+    // Every hop is cross-checked against its own commit before it is repeated:
+    // `--follow` pairs paths by content, and identical files moved together
+    // (empty markers above all) make that pairing a guess — a hop from a
+    // directory this subsystem never inhabited. A guessed hop, or a commit the
+    // check cannot read, poisons the whole answer, because the hops chain: one
+    // untrusted link makes every earlier "from" untrustworthy too.
+    let ambiguous = false;
+    for (const h of followed ?? []) {
+        if ((await gitRenamePairingAmbiguous(docsDir, h.commit, h.to)) !== false) {
+            ambiguous = true;
+            break;
+        }
+    }
+    const hops = ambiguous ? null : followed;
+    const parent = (rel) => rel.slice(0, Math.max(0, rel.lastIndexOf("/")));
+    const moves = (hops ?? []).map((h) => ({ from: parent(h.from), to: parent(h.to), commit: h.commit }));
+    if (json) {
+        // Additive honesty key: `answered: false` is git DECLINING (or nothing to
+        // follow, or a rename record too ambiguous to trust), not git answering
+        // "never moved" — exit 0 either way, no finding.
+        emitJson({ command: "subsystem", name, kind, moves, answered: hops !== null });
+        return;
+    }
+    if (ambiguous) {
+        console.log(`git will not say — a commit in this file's history moved identical files together, ` +
+            `so \`git log --follow\` pairs them by guesswork and the hops cannot be trusted. No finding either way.`);
+        return;
+    }
+    if (hops === null) {
+        console.log(`git will not say — not a repository, git unavailable, or nothing here to follow. No finding either way.`);
+        return;
+    }
+    if (moves.length === 0) {
+        console.log(`no recorded moves for '${name}'.`);
+        return;
+    }
+    for (const m of moves)
+        console.log(`${m.from} -> ${m.to}  (${m.commit.slice(0, 7)})`);
+}
+/**
+ * The file whose rename record carries the directory's history: a
+ * subsystem's own marker; for a service, the first artifact that exists
+ * today, in the fixed artifact order — deterministic, so two runs follow the
+ * same file. A service with no artifact on disk gives git nothing to follow.
+ */
+function representativeFile(hit) {
+    if (hit.kind === "subsystem")
+        return join(hit.subsystem.dir, SUBSYSTEM_MARKER);
+    const p = servicePathsAt(hit.service.dir);
+    return [p.spec, p.model, p.archSpec, p.openapi, p.asyncapi, p.runbook, p.health].find(existsSync) ?? null;
+}
+//# sourceMappingURL=query.js.map

package/dist/commands/subsystem/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../../src/commands/subsystem/query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,IAAa;IAC3D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7E,MAAM,WAAW,GAAG,CAAC,GAAmB,EAAU,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACrF,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC;gBAChC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;gBAC7B,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC;aAC9B,CAAC,CAAC;YACH,eAAe,EAAE,OAAO;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;SAC/B,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,sCAAsC,IAAI,CAAC,QAAQ,CAAC,MAAM,4BAA4B,CAAC,CAAC;QACpG,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,KAAK,OAAO,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,aAAa,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAgB,EAAE,IAAY,EAAE,IAAa;IAC5E,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CACF,IAAI,EACJ,gBAAgB,EAChB,4BAA4B,IAAI,gBAAgB,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAC7F,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9F,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,yBAAyB,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YACzE,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtG,IAAI,IAAI,EAAE,CAAC;QACT,0EAA0E;QAC1E,wEAAwE;QACxE,iDAAiD;QACjD,QAAQ,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CACT,qFAAqF;YACnF,wGAAwG,CAC3G,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,yGAAyG,CAAC,CAAC;QACvH,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,IAAI,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAA+C;IACzE,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;AAC5G,CAAC","sourcesContent":["/**\n * The read verbs: `subsystem list` (the tree with member and unfiled counts)\n * and `subsystem history` (how a service or subsystem moved, asked of git).\n *\n * `history` stays inside the provenance doctrine (`core/provenance/git.ts`):\n * loam asks git and never tells it, and every way git declines reads as \"git\n * will not say\" — nothing to answer, exit 0, no finding. The question\n * follows a representative FILE (a service's first surviving artifact, a\n * subsystem's marker), because `git log --follow` is defined for one file\n * and prints nothing at all for a directory path; each hop's directories are\n * read off the file's own rename record.\n */\nimport { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\nimport { emitJson, fail, repoPath } from \"../../core/envelope/json.js\";\nimport { gitRenameHops, gitRenamePairingAmbiguous } from \"../../core/provenance/gitq/moves.js\";\nimport { servicePathsAt } from \"../../core/repo/paths.js\";\nimport { listFleetTree } from \"../../core/repo/repo.js\";\nimport { closeNamesHint, findInTree, servicesUnder, treeNames } from \"../../core/repo/tree/find.js\";\nimport { SUBSYSTEM_MARKER } from \"../../core/repo/tree/marker.js\";\nimport type { SubsystemEntry } from \"../../core/repo/tree/walk.js\";\n\nexport async function runList(docsDir: DocsDir, json: boolean): Promise<void> {\n  const tree = await listFleetTree(docsDir);\n  const sorted = [...tree.subsystems].sort((a, b) => (a.path.join(\"/\") < b.path.join(\"/\") ? -1 : 1));\n  const unfiled = tree.services.filter((s) => s.subsystem.length === 0).length;\n  const memberCount = (sub: SubsystemEntry): number => servicesUnder(tree, sub).length;\n  if (json) {\n    emitJson({\n      command: \"subsystem\",\n      subsystems: sorted.map((sub) => ({\n        name: sub.name,\n        path: repoPath(docsDir, sub.dir),\n        title: sub.meta.title ?? null,\n        memberCount: memberCount(sub),\n      })),\n      unfiledServices: unfiled,\n      services: tree.services.length,\n    });\n    return;\n  }\n  if (sorted.length === 0) {\n    console.log(`no subsystems — the fleet is flat (${tree.services.length} service(s), all unfiled).`);\n    return;\n  }\n  console.log(`subsystems (${sorted.length})`);\n  for (const sub of sorted) {\n    const indent = \"  \".repeat(sub.path.length);\n    const title = sub.meta.title === undefined ? \"\" : `  ${sub.meta.title}`;\n    console.log(`${indent}${sub.name}${title}  — ${memberCount(sub)} service(s)`);\n  }\n  console.log(`unfiled: ${unfiled} of ${tree.services.length} service(s)`);\n}\n\nexport async function runHistory(docsDir: DocsDir, name: string, json: boolean): Promise<void> {\n  const tree = await listFleetTree(docsDir);\n  const hit = findInTree(tree, name);\n  if (hit === null) {\n    fail(\n      json,\n      \"unknown-target\",\n      `No service or subsystem '${name}' in the tree.` + closeNamesHint(name, treeNames(tree), \"\"),\n    );\n    return;\n  }\n  const kind = hit.kind;\n  const file = representativeFile(hit);\n  const followed = file === null ? null : await gitRenameHops(docsDir, repoPath(docsDir, file));\n  // Every hop is cross-checked against its own commit before it is repeated:\n  // `--follow` pairs paths by content, and identical files moved together\n  // (empty markers above all) make that pairing a guess — a hop from a\n  // directory this subsystem never inhabited. A guessed hop, or a commit the\n  // check cannot read, poisons the whole answer, because the hops chain: one\n  // untrusted link makes every earlier \"from\" untrustworthy too.\n  let ambiguous = false;\n  for (const h of followed ?? []) {\n    if ((await gitRenamePairingAmbiguous(docsDir, h.commit, h.to)) !== false) {\n      ambiguous = true;\n      break;\n    }\n  }\n  const hops = ambiguous ? null : followed;\n  const parent = (rel: string): string => rel.slice(0, Math.max(0, rel.lastIndexOf(\"/\")));\n  const moves = (hops ?? []).map((h) => ({ from: parent(h.from), to: parent(h.to), commit: h.commit }));\n  if (json) {\n    // Additive honesty key: `answered: false` is git DECLINING (or nothing to\n    // follow, or a rename record too ambiguous to trust), not git answering\n    // \"never moved\" — exit 0 either way, no finding.\n    emitJson({ command: \"subsystem\", name, kind, moves, answered: hops !== null });\n    return;\n  }\n  if (ambiguous) {\n    console.log(\n      `git will not say — a commit in this file's history moved identical files together, ` +\n        `so \\`git log --follow\\` pairs them by guesswork and the hops cannot be trusted. No finding either way.`,\n    );\n    return;\n  }\n  if (hops === null) {\n    console.log(`git will not say — not a repository, git unavailable, or nothing here to follow. No finding either way.`);\n    return;\n  }\n  if (moves.length === 0) {\n    console.log(`no recorded moves for '${name}'.`);\n    return;\n  }\n  for (const m of moves) console.log(`${m.from} -> ${m.to}  (${m.commit.slice(0, 7)})`);\n}\n\n/**\n * The file whose rename record carries the directory's history: a\n * subsystem's own marker; for a service, the first artifact that exists\n * today, in the fixed artifact order — deterministic, so two runs follow the\n * same file. A service with no artifact on disk gives git nothing to follow.\n */\nfunction representativeFile(hit: NonNullable<ReturnType<typeof findInTree>>): string | null {\n  if (hit.kind === \"subsystem\") return join(hit.subsystem.dir, SUBSYSTEM_MARKER);\n  const p = servicePathsAt(hit.service.dir);\n  return [p.spec, p.model, p.archSpec, p.openapi, p.asyncapi, p.runbook, p.health].find(existsSync) ?? null;\n}\n"]}

package/dist/commands/subsystem/subsystem.js

@@ -0,0 +1,98 @@
+import { configOrRefuse, fail } from "../../core/envelope/json.js";
+import { DocsRepoUnavailableError } from "../../core/repo/state.js";
+import { docsRepoReady, reportDocsRepoError } from "../policy/gate.js";
+import { runNew, runRm } from "./edit.js";
+import { runMove, runRename } from "./move.js";
+import { runHistory, runList } from "./query.js";
+import { runSync } from "./sync.js";
+const VERBS = ["new", "move", "rename", "rm", "list", "history", "sync"];
+/** How many names each verb takes, spelled once so the refusals agree with the dispatch. */
+const NAMES = {
+    new: { min: 1, max: 1, usage: "subsystem new <name> [--under <sub>] [--title <text>] [--description <text>] [--owner <name>]" },
+    move: { min: 1, max: Infinity, usage: "subsystem move <name>... --into <sub|.>" },
+    rename: { min: 2, max: 2, usage: "subsystem rename <old> <new>" },
+    rm: { min: 1, max: 1, usage: "subsystem rm <name>" },
+    list: { min: 0, max: 0, usage: "subsystem list" },
+    history: { min: 1, max: 1, usage: "subsystem history <name>" },
+    sync: { min: 0, max: 0, usage: "subsystem sync" },
+};
+/** The flag/verb contradictions worth refusing: an ignored flag is a lie about what ran. */
+function flagMisuse(verb, opts) {
+    if (opts.into !== undefined && verb !== "move")
+        return `--into belongs to 'move' (${NAMES.move.usage}).`;
+    if (opts.into === undefined && verb === "move")
+        return `'move' needs a destination: ${NAMES.move.usage} ('.' unfiles).`;
+    for (const [flag, value] of [
+        ["--under", opts.under],
+        ["--title", opts.title],
+        ["--description", opts.description],
+        ["--owner", opts.owner],
+    ]) {
+        if (value !== undefined && verb !== "new")
+            return `${flag} belongs to 'new' (${NAMES.new.usage}).`;
+    }
+    return null;
+}
+export function registerSubsystem(program) {
+    program
+        .command("subsystem")
+        .description("Manage the subsystem tree under services/ — the grouping no identity depends on")
+        .argument("<verb>", VERBS.join(" | "))
+        .argument("[names...]", "the subsystem or service names the verb applies to")
+        .option("--into <name>", "move: the destination subsystem, or '.' for the services/ root (unfiled)")
+        .option("--under <name>", "new: the parent subsystem (default: the services/ root)")
+        .option("--title <text>", "new: the subsystem's human title, kept in subsystem.yaml")
+        .option("--description <text>", "new: what the group is, kept in subsystem.yaml")
+        .option("--owner <name>", "new: who answers for the group, kept in subsystem.yaml")
+        .option("--json", "emit the machine contract instead of the human view")
+        .action(async (verb, names, opts) => {
+        const json = opts.json === true;
+        if (!VERBS.includes(verb)) {
+            // The same code `list` gives a bad section: one mistake class, one code.
+            fail(json, "invalid-option", `Unknown verb '${verb}'. Expected: ${VERBS.join(" | ")}.`);
+            return;
+        }
+        const arity = NAMES[verb];
+        if (names.length < arity.min || names.length > arity.max) {
+            fail(json, "invalid-option", `'${verb}' takes ${arity.min === arity.max ? arity.min : `${arity.min}+`} name(s): ${arity.usage}`);
+            return;
+        }
+        const misuse = flagMisuse(verb, opts);
+        if (misuse !== null) {
+            fail(json, "invalid-option", misuse);
+            return;
+        }
+        const config = await configOrRefuse(json);
+        if (config === null)
+            return;
+        const { docsDir } = config;
+        // "services": every verb reads or rewrites the tree that IS the fleet,
+        // so a docsDir with no services/ is a refusal, never an empty answer.
+        if (!docsRepoReady(json, docsDir, "services"))
+            return;
+        try {
+            switch (verb) {
+                case "new":
+                    return await runNew(docsDir, names[0], opts, json);
+                case "move":
+                    return await runMove(docsDir, names, opts.into, json);
+                case "rename":
+                    return await runRename(docsDir, [names[0], names[1]], json);
+                case "rm":
+                    return await runRm(docsDir, names[0], json);
+                case "list":
+                    return await runList(docsDir, json);
+                case "history":
+                    return await runHistory(docsDir, names[0], json);
+                case "sync":
+                    return await runSync(docsDir, json);
+            }
+        }
+        catch (err) {
+            if (!(err instanceof DocsRepoUnavailableError))
+                throw err;
+            reportDocsRepoError(json, err);
+        }
+    });
+}
+//# sourceMappingURL=subsystem.js.map