@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.2

package/dist/commands/list/views.js

@@ -0,0 +1,105 @@
+/**
+ * What the list actually reads: one row per service, one verification cell per
+ * feature.
+ *
+ * Both are gathered before anything is printed or serialized, because the same
+ * numbers appear in `--json` and in the worklist footer — a footer computed
+ * from a second read is a footer that can contradict the rows above it.
+ */
+import { existsSync } from "node:fs";
+import { loadFile } from "../../core/c4/likec4.js";
+import { serviceResolver } from "../../core/c4/resolve/service.js";
+import { maturityGaps, serviceMaturity, } from "../../core/vocabulary/maturity.js";
+import {} from "../../core/repo/entries.js";
+import { landscapePath, servicePathsAt } from "../../core/repo/paths.js";
+import { featureChecklist } from "../../core/verify/checklist.js";
+import { readVerification } from "../../core/verify/file.js";
+import {} from "../../core/verify/answers.js";
+import { confirmedProvenance, tallyRecord, verificationVerdict, } from "../../core/verify/record.js";
+/**
+ * Read the living landscape ONCE and decide, per service, whether an API is
+ * expected of it. `serviceResolver` is handed the real service ids so an edge
+ * drawn into a modelled container (`paymentService.api`) counts for the service
+ * that owns it — the same resolution `validate` uses, so the two commands
+ * cannot disagree about who is called.
+ */
+export async function serviceViews(docsDir, services, boundService, preloaded) {
+    const known = new Set(services.map((s) => s.id));
+    const lp = landscapePath(docsDir);
+    // `preloaded` is the landscape a caller already holds — `undefined` means
+    // "load it if it exists", null "there is none", the convention
+    // validateService's own `preloaded` follows. The fleet scorecard hands in
+    // the batch-parsed doc because a healthy `validate --all` must spin ZERO
+    // per-document workspaces (test/validate-batch-fallback.test.ts counts
+    // them), and a second parse of a document that run already holds was the
+    // exact per-path cost the batch loader exists to retire.
+    const land = preloaded !== undefined ? preloaded : existsSync(lp) ? await loadFile(lp) : null;
+    const called = new Set();
+    // Positive evidence only: with no landscape, or one that does not parse, we
+    // know nothing about who is called and every service is assumed to have an
+    // API — the conservative direction, because claiming a service needs no
+    // contract is how a real one goes undocumented. This is the SAME rule
+    // `landscapeEvidence` (core/vocabulary/maturity.ts) spells per service for
+    // explore and the context pack — derived fleet-wide here in one pass (one
+    // `called` set for every service) because calling the per-service partition
+    // from this loop would re-walk the whole relationship list once per
+    // service. If the rule moves, both spellings move.
+    const proven = land !== null && land.errors.length === 0;
+    if (proven) {
+        const svcOf = serviceResolver(land.elements, known);
+        for (const r of land.relationships) {
+            if (r.op !== undefined)
+                called.add(svcOf(r.target));
+        }
+    }
+    return services.map((entry) => {
+        const archSpec = existsSync(servicePathsAt(entry.dir).archSpec);
+        const apiExpected = !proven || called.has(entry.id);
+        const view = {
+            entry,
+            archSpec,
+            apiExpected,
+            unverifiableFromHere: entry.sources.declared && boundService !== entry.id,
+        };
+        const missing = maturityGaps(view);
+        return { ...view, maturity: serviceMaturity(view), missing };
+    });
+}
+/**
+ * The verification column. `readVerification` is one file read; the checklist
+ * is derived only when there is a record to judge — on a fleet-sized repo most
+ * features have none, and deriving N checklists to print N dashes is the cost
+ * that would get this column dropped.
+ *
+ * An archived feature's record is frozen history (see `core/verify/record.ts`): archive
+ * merged the feature's operations into the living openapi, so a re-derived
+ * checklist can only mismatch — the record is reported as recorded, never
+ * judged stale.
+ */
+export async function featureVerification(docsDir, f) {
+    const v = await readVerification(f.dir);
+    if (v === null)
+        return null;
+    const stale = f.archived
+        ? false
+        : (await featureChecklist(docsDir, f.dir, f.id)).digest !== v.checklist;
+    const tally = tallyRecord(v);
+    return {
+        state: stale ? "stale" : "recorded",
+        recorded: v.recorded,
+        verdict: verificationVerdict(tally, stale),
+        confirmed: tally.confirmed,
+        claims: tally.claims,
+        attested: tally.attested,
+        answered: confirmedProvenance(v.claims),
+    };
+}
+/* ------------------------------------------------------------------ */
+/* Text                                                                */
+/* ------------------------------------------------------------------ */
+/**
+ * Fixed-width presence flags. `a` and `A` are deliberately the same letter in
+ * two cases: the arch spec and the API are the two things a reader most often
+ * mistakes for each other, and one is lowercase because it is optional.
+ */
+//# sourceMappingURL=views.js.map

package/dist/commands/list/views.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"views.js","sourceRoot":"","sources":["../../../src/commands/list/views.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAkB,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,eAAe,GAGhB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAwC,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAmB,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,WAAW,EAEX,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAWrC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,QAAwB,EACxB,YAAgC,EAChC,SAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,0EAA0E;IAC1E,+DAA+D;IAC/D,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,IAAI,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG;YACX,KAAK;YACL,QAAQ;YACR,WAAW;YACX,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,YAAY,KAAK,KAAK,CAAC,EAAE;SAC1E,CAAC;QACF,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAgCD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,CAAe;IAEf,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ;QACtB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;QACnC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;GAIG","sourcesContent":["/**\n * What the list actually reads: one row per service, one verification cell per\n * feature.\n *\n * Both are gathered before anything is printed or serialized, because the same\n * numbers appear in `--json` and in the worklist footer — a footer computed\n * from a second read is a footer that can contradict the rows above it.\n */\nimport { existsSync } from \"node:fs\";\nimport { loadFile, type LoadedDoc } from \"../../core/c4/likec4.js\";\nimport { serviceResolver } from \"../../core/c4/resolve/service.js\";\nimport {\n  maturityGaps,\n  serviceMaturity,\n  type Maturity,\n  type MaturityInput,\n} from \"../../core/vocabulary/maturity.js\";\nimport { type FeatureEntry, type ServiceEntry } from \"../../core/repo/entries.js\";\nimport { landscapePath, servicePathsAt } from \"../../core/repo/paths.js\";\nimport { featureChecklist } from \"../../core/verify/checklist.js\";\nimport { readVerification } from \"../../core/verify/file.js\";\nimport { type AnsweredBy } from \"../../core/verify/answers.js\";\nimport {\n  confirmedProvenance,\n  tallyRecord,\n  type VerificationVerdict,\n  verificationVerdict,\n} from \"../../core/verify/record.js\";\nimport type { DocsDir } from \"../../core/kernel/ids/dirs.js\";\n\nexport interface ServiceView extends MaturityInput {\n  /** True when this service's `sources` can only be resolved from its own repo. */\n  unverifiableFromHere: boolean;\n  maturity: Maturity;\n  /** What stands between this service and the next rung, in fix order. */\n  missing: string[];\n}\n\n/**\n * Read the living landscape ONCE and decide, per service, whether an API is\n * expected of it. `serviceResolver` is handed the real service ids so an edge\n * drawn into a modelled container (`paymentService.api`) counts for the service\n * that owns it — the same resolution `validate` uses, so the two commands\n * cannot disagree about who is called.\n */\nexport async function serviceViews(\n  docsDir: DocsDir,\n  services: ServiceEntry[],\n  boundService: string | undefined,\n  preloaded?: LoadedDoc | null,\n): Promise<ServiceView[]> {\n  const known = new Set(services.map((s) => s.id));\n  const lp = landscapePath(docsDir);\n  // `preloaded` is the landscape a caller already holds — `undefined` means\n  // \"load it if it exists\", null \"there is none\", the convention\n  // validateService's own `preloaded` follows. The fleet scorecard hands in\n  // the batch-parsed doc because a healthy `validate --all` must spin ZERO\n  // per-document workspaces (test/validate-batch-fallback.test.ts counts\n  // them), and a second parse of a document that run already holds was the\n  // exact per-path cost the batch loader exists to retire.\n  const land = preloaded !== undefined ? preloaded : existsSync(lp) ? await loadFile(lp) : null;\n  const called = new Set<string>();\n  // Positive evidence only: with no landscape, or one that does not parse, we\n  // know nothing about who is called and every service is assumed to have an\n  // API — the conservative direction, because claiming a service needs no\n  // contract is how a real one goes undocumented. This is the SAME rule\n  // `landscapeEvidence` (core/vocabulary/maturity.ts) spells per service for\n  // explore and the context pack — derived fleet-wide here in one pass (one\n  // `called` set for every service) because calling the per-service partition\n  // from this loop would re-walk the whole relationship list once per\n  // service. If the rule moves, both spellings move.\n  const proven = land !== null && land.errors.length === 0;\n  if (proven) {\n    const svcOf = serviceResolver(land.elements, known);\n    for (const r of land.relationships) {\n      if (r.op !== undefined) called.add(svcOf(r.target));\n    }\n  }\n\n  return services.map((entry) => {\n    const archSpec = existsSync(servicePathsAt(entry.dir).archSpec);\n    const apiExpected = !proven || called.has(entry.id);\n    const view = {\n      entry,\n      archSpec,\n      apiExpected,\n      unverifiableFromHere: entry.sources.declared && boundService !== entry.id,\n    };\n    const missing = maturityGaps(view);\n    return { ...view, maturity: serviceMaturity(view), missing };\n  });\n}\n\n/* ------------------------------------------------------------------ */\n/* JSON                                                                */\n/* ------------------------------------------------------------------ */\n\nexport interface VerificationCell {\n  state: \"recorded\" | \"stale\";\n  /** The day the record was written. */\n  recorded: string;\n  /**\n   * `verify --json`'s own three-valued verdict, through `verificationVerdict` —\n   * not a fourth opinion computed here. `attested` is the one this column got\n   * wrong: a scenario confirmed on an agent's word printed as `11/11` under a\n   * heading that said `verified`, and `list --json` is how the fleet is graded.\n   */\n  verdict: VerificationVerdict;\n  /** Both counts are `tallyRecord`'s — the record's `claims[]`, never its `summary:` block. */\n  confirmed: number;\n  claims: number;\n  /** Of the confirmed, the scenario claims on an agent's word (`attestedClaims`). */\n  attested: number;\n  /**\n   * Of the confirmed, one count per `answered_by` value (`confirmedProvenance`), every key\n   * present. A different question from `attested` above, which is why both are here: `attested`\n   * asks only about `scenario.tested` because that is what the verdict turns on, while this asks\n   * who answered EVERY kind — and reading the first as if it were the second is how the fleet\n   * scorecard credited agent-answered permission and operation claims to a test runner.\n   */\n  answered: Record<AnsweredBy, number>;\n}\n\n/**\n * The verification column. `readVerification` is one file read; the checklist\n * is derived only when there is a record to judge — on a fleet-sized repo most\n * features have none, and deriving N checklists to print N dashes is the cost\n * that would get this column dropped.\n *\n * An archived feature's record is frozen history (see `core/verify/record.ts`): archive\n * merged the feature's operations into the living openapi, so a re-derived\n * checklist can only mismatch — the record is reported as recorded, never\n * judged stale.\n */\nexport async function featureVerification(\n  docsDir: DocsDir,\n  f: FeatureEntry,\n): Promise<VerificationCell | null> {\n  const v = await readVerification(f.dir);\n  if (v === null) return null;\n  const stale = f.archived\n    ? false\n    : (await featureChecklist(docsDir, f.dir, f.id)).digest !== v.checklist;\n  const tally = tallyRecord(v);\n  return {\n    state: stale ? \"stale\" : \"recorded\",\n    recorded: v.recorded,\n    verdict: verificationVerdict(tally, stale),\n    confirmed: tally.confirmed,\n    claims: tally.claims,\n    attested: tally.attested,\n    answered: confirmedProvenance(v.claims),\n  };\n}\n\n/* ------------------------------------------------------------------ */\n/* Text                                                                */\n/* ------------------------------------------------------------------ */\n\n/**\n * Fixed-width presence flags. `a` and `A` are deliberately the same letter in\n * two cases: the arch spec and the API are the two things a reader most often\n * mistakes for each other, and one is lowercase because it is optional.\n */\n"]}

package/dist/commands/mcp/dispatch.js

@@ -0,0 +1,183 @@
+/**
+ * In-process dispatch for one MCP tool call: build a fresh commander program
+ * holding only the commands the selected tool table exposes, run the argv through
+ * it, and hand back what the CLI would have printed.
+ *
+ * This is the proven harness pattern (test/helpers/harness.ts runLoamNow)
+ * moved to the commands layer, minus the chdir: the server's own cwd IS the
+ * workdir, so every call resolves loam.json exactly as the CLI would in that
+ * directory — the server serves ONE repository, the one it started in, and
+ * never changes directory. In-process rather than a child per call because a
+ * child re-pays LikeC4/Langium startup on every validate, and because in dev
+ * there is no built binary to exec.
+ *
+ * The capture is process-global (console, exitCode), which is safe under
+ * exactly one condition the serve loop guarantees: calls are strictly
+ * sequential — each one is awaited to completion before the next frame is
+ * read — and `parseAsync` resolves only after the action has fully run (the
+ * entire test suite rests on that same guarantee). Nothing here may be
+ * module-level state: two serve sessions in one process (the tests do this)
+ * must not see each other.
+ *
+ * NOTE for test/agents.test.ts's scan: registration happens through the
+ * imported register functions; this module must never contain the literal
+ * dot-command-paren call, comments included, or the CLI surface count breaks.
+ */
+import { Command, CommanderError } from "commander";
+import { format } from "node:util";
+import { emitJsonError } from "../../core/envelope/json.js";
+import { registerValidate } from "../validate/validate.js";
+import { registerStatus } from "../status/status.js";
+import { registerList } from "../list/list.js";
+import { registerShow } from "../show/show.js";
+import { registerDelta } from "../delta/delta.js";
+import { registerDiff } from "../diff/diff.js";
+import { registerExplore } from "../explore.js";
+import { registerDependencies } from "../dependencies.js";
+import { registerDoctor } from "../doctor.js";
+import { registerContext } from "../context/context.js";
+import { registerGate } from "../gate/gate.js";
+import { registerExplain } from "../explain/explain.js";
+import { registerInstructions } from "../instructions.js";
+import { registerSteps } from "../steps/steps.js";
+import { registerNew } from "../new/new.js";
+import { registerRebase } from "../rebase/rebase.js";
+import { registerGherkin } from "../gherkin/gherkin.js";
+import { registerArchive } from "../archive/archive.js";
+/**
+ * Every console method Node's Console writes to STDOUT — the protocol stream,
+ * where one stray line corrupts the transport. Hooking only `log` was the
+ * reviewed defect here: a `console.info` in any command, or in a dependency a
+ * command loads, would have written straight into the client's frame stream
+ * with every suite green. `warn`/`error` go to stderr, captured for the
+ * server log rather than the wire.
+ */
+const STDOUT_METHODS = [
+    "log", "info", "debug", "dir", "dirxml", "table",
+    "group", "groupCollapsed", "groupEnd", "count", "countReset", "timeLog", "timeEnd",
+];
+const STDERR_METHODS = ["warn", "error"];
+/**
+ * Replace the console methods named above with sink writers; the returned
+ * function restores every original. Captured output is `format(...)`ed, so
+ * `table`/`group` lose their layout — acceptable on purpose: the invariant
+ * bought here is that their BYTES stay off the protocol stream, not that
+ * their rendering survives.
+ */
+export function captureConsole(sinks) {
+    const target = console;
+    const writer = (sink) => (...parts) => {
+        sink.push(format(...parts));
+    };
+    const toStdout = writer(sinks.stdout);
+    const toStderr = writer(sinks.stderr);
+    const original = new Map();
+    for (const [names, replacement] of [
+        [STDOUT_METHODS, toStdout],
+        [STDERR_METHODS, toStderr],
+    ]) {
+        for (const name of names) {
+            // A method absent on this Node build has nothing to capture — and
+            // nothing to restore, so it must not enter the map either.
+            if (typeof target[name] !== "function")
+                continue;
+            original.set(name, target[name]);
+            target[name] = replacement;
+        }
+    }
+    return () => {
+        for (const [name, method] of original)
+            target[name] = method;
+    };
+}
+/** Commander output codes whose printed output is the point, not a usage failure. */
+const PASS_THROUGH = new Set(["commander.help", "commander.helpDisplayed", "commander.version"]);
+/**
+ * The scoped program, output routed into `sinks`. configureOutput and
+ * exitOverride are set BEFORE the register calls on purpose: commander copies
+ * inherited settings onto a subcommand when it is created, so settings applied
+ * after registration would leave every subcommand writing to the real stdout —
+ * which for an MCP server is the protocol stream.
+ */
+function readProgram(sinks, authoring = false) {
+    const program = new Command();
+    program.name("loam");
+    program.exitOverride();
+    program.configureOutput({
+        writeOut: (text) => sinks.stdout.push(text),
+        writeErr: (text) => sinks.stderr.push(text),
+    });
+    registerValidate(program);
+    registerStatus(program);
+    registerList(program);
+    registerShow(program);
+    registerDelta(program);
+    registerDiff(program);
+    registerExplore(program);
+    registerDependencies(program);
+    registerDoctor(program);
+    registerContext(program);
+    registerGate(program);
+    registerExplain(program);
+    // The two that read no config at all. They are here for the same reason they
+    // are in MCP_TOOLS: an agent meets `instructions` and `steps` BEFORE the
+    // repository is wired, and every generated skill's first line points at
+    // `loam instructions <workflow>`. This list and MCP_TOOLS are two copies of
+    // one roster, and nothing counted them against each other until a tool
+    // advertised in `tools/list` and absent here answered a `tools/call` with
+    // `unknown command 'instructions'` — an envelope that reads as the caller's
+    // mistake. `test/mcp-serve.test.ts` now calls every advertised tool.
+    registerInstructions(program);
+    registerSteps(program);
+    if (authoring) {
+        registerNew(program);
+        registerRebase(program);
+        registerGherkin(program);
+        registerArchive(program);
+    }
+    return program;
+}
+/**
+ * Run one tool argv. Never throws: whatever goes wrong becomes an envelope in
+ * `stdout` with `code` 1, so the serve loop's answer to THIS call is the only
+ * thing affected — one bad call must never take the server down, and a
+ * memoised rejection cannot exist because nothing here outlives the call.
+ */
+export async function runToolArgv(argv, authoring = false) {
+    const sinks = { stdout: [], stderr: [] };
+    const previousExitCode = process.exitCode;
+    const restoreConsole = captureConsole(sinks);
+    process.exitCode = undefined;
+    try {
+        await readProgram(sinks, authoring).parseAsync(["node", "loam", ...argv]);
+    }
+    catch (err) {
+        if (err instanceof CommanderError) {
+            if (PASS_THROUGH.has(err.code)) {
+                // Unreachable through the tool schemas (the argv builder refuses every
+                // '-'-prefixed string, so --help/--version cannot arrive), kept for the
+                // day it is not: the output already sits in the sinks; keep its code.
+                if (process.exitCode === undefined)
+                    process.exitCode = err.exitCode;
+            }
+            else {
+                // The same envelope cli.ts's catch emits for a usage error, so an MCP
+                // caller still receives machine-readable JSON, not a bare exception.
+                emitJsonError("invalid-option", err.message.replace(/^error: /, ""));
+            }
+        }
+        else {
+            // An unexpected throw from a command action: the CLI's own catch-all
+            // (`internal`) — the one code with no stable meaning, carried so the
+            // caller gets an envelope rather than a dead call.
+            emitJsonError("internal", err instanceof Error ? err.message : String(err));
+        }
+    }
+    finally {
+        restoreConsole();
+    }
+    const code = typeof process.exitCode === "number" ? process.exitCode : 0;
+    process.exitCode = previousExitCode;
+    return { stdout: sinks.stdout.join("\n"), stderr: sinks.stderr.join("\n"), code };
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/commands/mcp/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/commands/mcp/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAcxD;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG;IACrB,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO;IAChD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS;CAC1E,CAAC;AACX,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAY;IACzC,MAAM,MAAM,GAAG,OAA6C,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAQ,EAAE;QAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI;QACjC,CAAC,cAAc,EAAE,QAAQ,CAAC;QAC1B,CAAC,cAAc,EAAE,QAAQ,CAAC;KAClB,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,kEAAkE;YAClE,2DAA2D;YAC3D,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,UAAU;gBAAE,SAAS;YACjD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,yBAAyB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEjG;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAY,EAAE,SAAS,GAAG,KAAK;IAClD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,CAAC,YAAY,EAAE,CAAC;IACvB,OAAO,CAAC,eAAe,CAAC;QACtB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3C,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;KAC5C,CAAC,CAAC;IACH,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,IAAI,SAAS,EAAE,CAAC;QACd,WAAW,CAAC,OAAO,CAAC,CAAC;QACrB,cAAc,CAAC,OAAO,CAAC,CAAC;QACxB,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,SAAS,GAAG,KAAK;IAEjB,MAAM,KAAK,GAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAChD,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC1C,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;oBAAE,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,qEAAqE;gBACrE,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,qEAAqE;YACrE,mDAAmD;YACnD,aAAa,CAAC,UAAU,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC;IACpC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACpF,CAAC","sourcesContent":["/**\n * In-process dispatch for one MCP tool call: build a fresh commander program\n * holding only the commands the selected tool table exposes, run the argv through\n * it, and hand back what the CLI would have printed.\n *\n * This is the proven harness pattern (test/helpers/harness.ts runLoamNow)\n * moved to the commands layer, minus the chdir: the server's own cwd IS the\n * workdir, so every call resolves loam.json exactly as the CLI would in that\n * directory — the server serves ONE repository, the one it started in, and\n * never changes directory. In-process rather than a child per call because a\n * child re-pays LikeC4/Langium startup on every validate, and because in dev\n * there is no built binary to exec.\n *\n * The capture is process-global (console, exitCode), which is safe under\n * exactly one condition the serve loop guarantees: calls are strictly\n * sequential — each one is awaited to completion before the next frame is\n * read — and `parseAsync` resolves only after the action has fully run (the\n * entire test suite rests on that same guarantee). Nothing here may be\n * module-level state: two serve sessions in one process (the tests do this)\n * must not see each other.\n *\n * NOTE for test/agents.test.ts's scan: registration happens through the\n * imported register functions; this module must never contain the literal\n * dot-command-paren call, comments included, or the CLI surface count breaks.\n */\nimport { Command, CommanderError } from \"commander\";\nimport { format } from \"node:util\";\nimport { emitJsonError } from \"../../core/envelope/json.js\";\nimport { registerValidate } from \"../validate/validate.js\";\nimport { registerStatus } from \"../status/status.js\";\nimport { registerList } from \"../list/list.js\";\nimport { registerShow } from \"../show/show.js\";\nimport { registerDelta } from \"../delta/delta.js\";\nimport { registerDiff } from \"../diff/diff.js\";\nimport { registerExplore } from \"../explore.js\";\nimport { registerDependencies } from \"../dependencies.js\";\nimport { registerDoctor } from \"../doctor.js\";\nimport { registerContext } from \"../context/context.js\";\nimport { registerGate } from \"../gate/gate.js\";\nimport { registerExplain } from \"../explain/explain.js\";\nimport { registerInstructions } from \"../instructions.js\";\nimport { registerSteps } from \"../steps/steps.js\";\nimport { registerNew } from \"../new/new.js\";\nimport { registerRebase } from \"../rebase/rebase.js\";\nimport { registerGherkin } from \"../gherkin/gherkin.js\";\nimport { registerArchive } from \"../archive/archive.js\";\n\nexport interface DispatchResult {\n  readonly stdout: string;\n  readonly stderr: string;\n  readonly code: number;\n}\n\n/** Console sinks for one dispatch — a value, not module state, so calls cannot share buffers. */\nexport interface Sinks {\n  readonly stdout: string[];\n  readonly stderr: string[];\n}\n\n/**\n * Every console method Node's Console writes to STDOUT — the protocol stream,\n * where one stray line corrupts the transport. Hooking only `log` was the\n * reviewed defect here: a `console.info` in any command, or in a dependency a\n * command loads, would have written straight into the client's frame stream\n * with every suite green. `warn`/`error` go to stderr, captured for the\n * server log rather than the wire.\n */\nconst STDOUT_METHODS = [\n  \"log\", \"info\", \"debug\", \"dir\", \"dirxml\", \"table\",\n  \"group\", \"groupCollapsed\", \"groupEnd\", \"count\", \"countReset\", \"timeLog\", \"timeEnd\",\n] as const;\nconst STDERR_METHODS = [\"warn\", \"error\"] as const;\n\n/**\n * Replace the console methods named above with sink writers; the returned\n * function restores every original. Captured output is `format(...)`ed, so\n * `table`/`group` lose their layout — acceptable on purpose: the invariant\n * bought here is that their BYTES stay off the protocol stream, not that\n * their rendering survives.\n */\nexport function captureConsole(sinks: Sinks): () => void {\n  const target = console as unknown as Record<string, unknown>;\n  const writer = (sink: string[]) => (...parts: unknown[]): void => {\n    sink.push(format(...parts));\n  };\n  const toStdout = writer(sinks.stdout);\n  const toStderr = writer(sinks.stderr);\n  const original = new Map<string, unknown>();\n  for (const [names, replacement] of [\n    [STDOUT_METHODS, toStdout],\n    [STDERR_METHODS, toStderr],\n  ] as const) {\n    for (const name of names) {\n      // A method absent on this Node build has nothing to capture — and\n      // nothing to restore, so it must not enter the map either.\n      if (typeof target[name] !== \"function\") continue;\n      original.set(name, target[name]);\n      target[name] = replacement;\n    }\n  }\n  return () => {\n    for (const [name, method] of original) target[name] = method;\n  };\n}\n\n/** Commander output codes whose printed output is the point, not a usage failure. */\nconst PASS_THROUGH = new Set([\"commander.help\", \"commander.helpDisplayed\", \"commander.version\"]);\n\n/**\n * The scoped program, output routed into `sinks`. configureOutput and\n * exitOverride are set BEFORE the register calls on purpose: commander copies\n * inherited settings onto a subcommand when it is created, so settings applied\n * after registration would leave every subcommand writing to the real stdout —\n * which for an MCP server is the protocol stream.\n */\nfunction readProgram(sinks: Sinks, authoring = false): Command {\n  const program = new Command();\n  program.name(\"loam\");\n  program.exitOverride();\n  program.configureOutput({\n    writeOut: (text) => sinks.stdout.push(text),\n    writeErr: (text) => sinks.stderr.push(text),\n  });\n  registerValidate(program);\n  registerStatus(program);\n  registerList(program);\n  registerShow(program);\n  registerDelta(program);\n  registerDiff(program);\n  registerExplore(program);\n  registerDependencies(program);\n  registerDoctor(program);\n  registerContext(program);\n  registerGate(program);\n  registerExplain(program);\n  // The two that read no config at all. They are here for the same reason they\n  // are in MCP_TOOLS: an agent meets `instructions` and `steps` BEFORE the\n  // repository is wired, and every generated skill's first line points at\n  // `loam instructions <workflow>`. This list and MCP_TOOLS are two copies of\n  // one roster, and nothing counted them against each other until a tool\n  // advertised in `tools/list` and absent here answered a `tools/call` with\n  // `unknown command 'instructions'` — an envelope that reads as the caller's\n  // mistake. `test/mcp-serve.test.ts` now calls every advertised tool.\n  registerInstructions(program);\n  registerSteps(program);\n  if (authoring) {\n    registerNew(program);\n    registerRebase(program);\n    registerGherkin(program);\n    registerArchive(program);\n  }\n  return program;\n}\n\n/**\n * Run one tool argv. Never throws: whatever goes wrong becomes an envelope in\n * `stdout` with `code` 1, so the serve loop's answer to THIS call is the only\n * thing affected — one bad call must never take the server down, and a\n * memoised rejection cannot exist because nothing here outlives the call.\n */\nexport async function runToolArgv(\n  argv: readonly string[],\n  authoring = false,\n): Promise<DispatchResult> {\n  const sinks: Sinks = { stdout: [], stderr: [] };\n  const previousExitCode = process.exitCode;\n  const restoreConsole = captureConsole(sinks);\n  process.exitCode = undefined;\n  try {\n    await readProgram(sinks, authoring).parseAsync([\"node\", \"loam\", ...argv]);\n  } catch (err) {\n    if (err instanceof CommanderError) {\n      if (PASS_THROUGH.has(err.code)) {\n        // Unreachable through the tool schemas (the argv builder refuses every\n        // '-'-prefixed string, so --help/--version cannot arrive), kept for the\n        // day it is not: the output already sits in the sinks; keep its code.\n        if (process.exitCode === undefined) process.exitCode = err.exitCode;\n      } else {\n        // The same envelope cli.ts's catch emits for a usage error, so an MCP\n        // caller still receives machine-readable JSON, not a bare exception.\n        emitJsonError(\"invalid-option\", err.message.replace(/^error: /, \"\"));\n      }\n    } else {\n      // An unexpected throw from a command action: the CLI's own catch-all\n      // (`internal`) — the one code with no stable meaning, carried so the\n      // caller gets an envelope rather than a dead call.\n      emitJsonError(\"internal\", err instanceof Error ? err.message : String(err));\n    }\n  } finally {\n    restoreConsole();\n  }\n  const code = typeof process.exitCode === \"number\" ? process.exitCode : 0;\n  process.exitCode = previousExitCode;\n  return { stdout: sinks.stdout.join(\"\\n\"), stderr: sinks.stderr.join(\"\\n\"), code };\n}\n"]}

package/dist/commands/mcp/mcp.js

@@ -0,0 +1,34 @@
+import { runToolArgv } from "./dispatch.js";
+import { serve } from "./serve.js";
+import { MCP_TOOLS } from "../../core/mcp/tools.js";
+import { MCP_AUTHOR_TOOLS } from "../../core/mcp/author-tools.js";
+export function registerMcp(program) {
+    program
+        .command("mcp")
+        .description("Serve loam commands as MCP tools over stdio (JSON-RPC 2.0)")
+        .option("--author", "opt in to safe authoring tools; vouch and committing archive stay excluded")
+        // Declared for the uniform surface every command owes (`--json` is
+        // mandatory, test/agents.test.ts), and it is not inert: it governs the one
+        // pre-loop surface this command has — a usage error like `loam mcp --bogus`
+        // aborts before the action runs, and cli.ts's catch reads raw argv to
+        // decide whether that refusal is an envelope. Once the loop runs, stdout
+        // is JSON-RPC frames either way; there is no human rendering to switch off.
+        .option("--json", "emit the machine contract instead of the human view")
+        .action(async (opts) => {
+        // No docs-repo gate at startup, deliberately (the add-command preamble
+        // decision): a launch-time refusal would print a non-JSON-RPC line into
+        // the client's protocol stream and kill the handshake with nothing a
+        // client can parse. Every tool call flows through the same command path
+        // the CLI uses, so a missing or broken loam.json arrives as the ordinary
+        // `no-config`/`config-invalid` envelope in a tool result — readable, and
+        // actionable, by the agent on the other end. The server serves the
+        // repository it was started in (each call resolves loam.json through
+        // process.cwd()) and never changes directory.
+        const tools = opts.author ? [...MCP_TOOLS, ...MCP_AUTHOR_TOOLS] : MCP_TOOLS;
+        const run = opts.author
+            ? (argv) => runToolArgv(argv, true)
+            : runToolArgv;
+        await serve({ input: process.stdin, output: process.stdout, log: process.stderr }, run, tools);
+    });
+}
+//# sourceMappingURL=mcp.js.map

package/dist/commands/mcp/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/commands/mcp/mcp.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMlE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,UAAU,EAAE,4EAA4E,CAAC;QACjG,mEAAmE;QACnE,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,4EAA4E;SAC3E,MAAM,CAAC,QAAQ,EAAE,qDAAqD,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE;QACjC,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,mEAAmE;QACnE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;YACrB,CAAC,CAAC,CAAC,IAAuB,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;YACtD,CAAC,CAAC,WAAW,CAAC;QAChB,MAAM,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;AACP,CAAC","sourcesContent":["/**\n * `loam mcp` — serve the read surface, plus bounded writers under `--author`.\n *\n * The action wires the real stdio triple into the serve loop and waits for\n * stdin EOF; everything with a decision in it lives in `./serve.ts`,\n * `./dispatch.ts` and `src/core/mcp/`. This module carries the one command\n * registration of the package (test/agents.test.ts counts registrations by\n * their literal spelling, so the sibling modules must never spell one).\n */\nimport type { Command } from \"commander\";\nimport { runToolArgv } from \"./dispatch.js\";\nimport { serve } from \"./serve.js\";\nimport { MCP_TOOLS } from \"../../core/mcp/tools.js\";\nimport { MCP_AUTHOR_TOOLS } from \"../../core/mcp/author-tools.js\";\n\ninterface McpOptions {\n  author?: boolean;\n}\n\nexport function registerMcp(program: Command): void {\n  program\n    .command(\"mcp\")\n    .description(\"Serve loam commands as MCP tools over stdio (JSON-RPC 2.0)\")\n    .option(\"--author\", \"opt in to safe authoring tools; vouch and committing archive stay excluded\")\n    // Declared for the uniform surface every command owes (`--json` is\n    // mandatory, test/agents.test.ts), and it is not inert: it governs the one\n    // pre-loop surface this command has — a usage error like `loam mcp --bogus`\n    // aborts before the action runs, and cli.ts's catch reads raw argv to\n    // decide whether that refusal is an envelope. Once the loop runs, stdout\n    // is JSON-RPC frames either way; there is no human rendering to switch off.\n    .option(\"--json\", \"emit the machine contract instead of the human view\")\n    .action(async (opts: McpOptions) => {\n      // No docs-repo gate at startup, deliberately (the add-command preamble\n      // decision): a launch-time refusal would print a non-JSON-RPC line into\n      // the client's protocol stream and kill the handshake with nothing a\n      // client can parse. Every tool call flows through the same command path\n      // the CLI uses, so a missing or broken loam.json arrives as the ordinary\n      // `no-config`/`config-invalid` envelope in a tool result — readable, and\n      // actionable, by the agent on the other end. The server serves the\n      // repository it was started in (each call resolves loam.json through\n      // process.cwd()) and never changes directory.\n      const tools = opts.author ? [...MCP_TOOLS, ...MCP_AUTHOR_TOOLS] : MCP_TOOLS;\n      const run = opts.author\n        ? (argv: readonly string[]) => runToolArgv(argv, true)\n        : runToolArgv;\n      await serve({ input: process.stdin, output: process.stdout, log: process.stderr }, run, tools);\n    });\n}\n"]}

package/dist/commands/mcp/serve.js

@@ -0,0 +1,55 @@
+import { frame, splitFrames } from "../../core/mcp/framing.js";
+import { INTERNAL_ERROR, errorResponse, resultResponse, routeLine, toolReply, } from "../../core/mcp/protocol.js";
+import { MCP_TOOLS } from "../../core/mcp/tools.js";
+export async function serve(io, runTool, tools = MCP_TOOLS) {
+    // One startup line, to stderr only — a client is entitled to a stdout that
+    // has never carried anything but frames, from the very first byte.
+    io.log.write(`loam mcp: serving ${process.cwd()} over stdio\n`);
+    // Decode at the stream, not per chunk: a UTF-8 code point split across two
+    // chunks would corrupt if each chunk were stringified on its own.
+    io.input.setEncoding("utf8");
+    let rest = "";
+    for await (const chunk of io.input) {
+        const split = splitFrames(rest + String(chunk));
+        rest = split.rest;
+        for (const line of split.lines)
+            await handleLine(line, io, runTool, tools);
+    }
+    // A final frame the client sent without a trailing newline is still a frame:
+    // EOF terminates it exactly as the delimiter would have.
+    if (rest.trim() !== "")
+        await handleLine(rest, io, runTool, tools);
+}
+async function handleLine(line, io, runTool, tools) {
+    const outcome = routeLine(line, tools);
+    if (outcome.kind === "ignore")
+        return;
+    if (outcome.kind === "reply") {
+        io.output.write(frame(outcome.response));
+        return;
+    }
+    await handleCall(outcome, io, runTool);
+}
+/** One tools/call, contained: whatever this call does, the loop survives it. */
+async function handleCall(call, io, runTool) {
+    try {
+        const run = await runTool(call.argv);
+        if (run.stderr.trim() !== "") {
+            // A command's diagnostics are server-side logging, never protocol bytes.
+            io.log.write(`loam mcp: ${call.toolName} stderr: ${run.stderr.trim()}\n`);
+        }
+        const reply = toolReply(run);
+        io.output.write(frame(reply.kind === "result"
+            ? resultResponse(call.id, reply.result)
+            : errorResponse(call.id, reply.code, reply.message)));
+    }
+    catch (err) {
+        // The dispatcher already converts everything it can into an envelope, so
+        // reaching here means the failure was outside it (or in the wrapping
+        // itself). It becomes a JSON-RPC error for THIS id — the caller learns
+        // which call died, with the reason — and the loop reads the next frame.
+        const detail = err instanceof Error ? err.message : String(err);
+        io.output.write(frame(errorResponse(call.id, INTERNAL_ERROR, `${call.toolName} failed: ${detail}`)));
+    }
+}
+//# sourceMappingURL=serve.js.map

package/dist/commands/mcp/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../../src/commands/mcp/serve.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,aAAa,EACb,cAAc,EACd,SAAS,EACT,SAAS,GACV,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAgB,MAAM,yBAAyB,CAAC;AAWlE,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,EAAW,EACX,OAAmB,EACnB,KAAK,GAAuB,SAAS;IAErC,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAChE,2EAA2E;IAC3E,kEAAkE;IAClE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IACD,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,EAAW,EACX,OAAmB,EACnB,KAAyB;IAEzB,MAAM,OAAO,GAAiB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,UAAU,CACvB,IAA6C,EAC7C,EAAW,EACX,OAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7B,yEAAyE;YACzE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,QAAQ,YAAY,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CACnB,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;AACH,CAAC","sourcesContent":["/**\n * The MCP stdio loop: read newline-delimited JSON-RPC frames from `input`,\n * answer on `output`, log on `log`. Streams are injected so the tests drive\n * a whole session in-process with PassThrough pairs; `loam mcp` passes the\n * real stdio triple.\n *\n * Two invariants everything else leans on:\n *\n * - `output` carries protocol frames and NOTHING else — every byte goes\n *   through `frame()`. Command output cannot leak here: the dispatcher hooks\n *   console and commander's own writers, and no command in src/ writes to\n *   process.stdout directly (verified at implementation time; the dispatcher\n *   comment records the guarantee it needs). Logging — the startup line, a\n *   tool's captured stderr — goes to `log`, which MCP permits.\n *\n * - Frames are handled STRICTLY SEQUENTIALLY: each one is awaited before the\n *   next is looked at. This is not an optimization opportunity — the\n *   dispatcher's console capture is process-global, so two overlapping calls\n *   would interleave their captured output into each other's envelopes.\n *\n * The loop ends when `input` ends: per the MCP stdio lifecycle the client\n * closes stdin to shut the server down, so EOF resolves this promise, the\n * action resolves, and cli.ts — the only process-exit decider — lets the\n * process drain to exit 0. No signal handling, no exit call here.\n */\nimport type { Readable, Writable } from \"node:stream\";\nimport { frame, splitFrames } from \"../../core/mcp/framing.js\";\nimport {\n  INTERNAL_ERROR,\n  errorResponse,\n  resultResponse,\n  routeLine,\n  toolReply,\n} from \"../../core/mcp/protocol.js\";\nimport type { RouteOutcome } from \"../../core/mcp/protocol.js\";\nimport type { DispatchResult } from \"./dispatch.js\";\nimport { MCP_TOOLS, type McpTool } from \"../../core/mcp/tools.js\";\n\nexport interface ServeIo {\n  readonly input: Readable;\n  readonly output: Writable;\n  readonly log: Writable;\n}\n\n/** The dispatcher, as a parameter: serve() stays testable with a stub and owns no registration. */\nexport type ToolRunner = (argv: readonly string[]) => Promise<DispatchResult>;\n\nexport async function serve(\n  io: ServeIo,\n  runTool: ToolRunner,\n  tools: readonly McpTool[] = MCP_TOOLS,\n): Promise<void> {\n  // One startup line, to stderr only — a client is entitled to a stdout that\n  // has never carried anything but frames, from the very first byte.\n  io.log.write(`loam mcp: serving ${process.cwd()} over stdio\\n`);\n  // Decode at the stream, not per chunk: a UTF-8 code point split across two\n  // chunks would corrupt if each chunk were stringified on its own.\n  io.input.setEncoding(\"utf8\");\n  let rest = \"\";\n  for await (const chunk of io.input) {\n    const split = splitFrames(rest + String(chunk));\n    rest = split.rest;\n    for (const line of split.lines) await handleLine(line, io, runTool, tools);\n  }\n  // A final frame the client sent without a trailing newline is still a frame:\n  // EOF terminates it exactly as the delimiter would have.\n  if (rest.trim() !== \"\") await handleLine(rest, io, runTool, tools);\n}\n\nasync function handleLine(\n  line: string,\n  io: ServeIo,\n  runTool: ToolRunner,\n  tools: readonly McpTool[],\n): Promise<void> {\n  const outcome: RouteOutcome = routeLine(line, tools);\n  if (outcome.kind === \"ignore\") return;\n  if (outcome.kind === \"reply\") {\n    io.output.write(frame(outcome.response));\n    return;\n  }\n  await handleCall(outcome, io, runTool);\n}\n\n/** One tools/call, contained: whatever this call does, the loop survives it. */\nasync function handleCall(\n  call: Extract<RouteOutcome, { kind: \"call\" }>,\n  io: ServeIo,\n  runTool: ToolRunner,\n): Promise<void> {\n  try {\n    const run = await runTool(call.argv);\n    if (run.stderr.trim() !== \"\") {\n      // A command's diagnostics are server-side logging, never protocol bytes.\n      io.log.write(`loam mcp: ${call.toolName} stderr: ${run.stderr.trim()}\\n`);\n    }\n    const reply = toolReply(run);\n    io.output.write(frame(\n      reply.kind === \"result\"\n        ? resultResponse(call.id, reply.result)\n        : errorResponse(call.id, reply.code, reply.message),\n    ));\n  } catch (err) {\n    // The dispatcher already converts everything it can into an envelope, so\n    // reaching here means the failure was outside it (or in the wrapping\n    // itself). It becomes a JSON-RPC error for THIS id — the caller learns\n    // which call died, with the reason — and the loop reads the next frame.\n    const detail = err instanceof Error ? err.message : String(err);\n    io.output.write(frame(errorResponse(call.id, INTERNAL_ERROR, `${call.toolName} failed: ${detail}`)));\n  }\n}\n"]}

package/dist/commands/migrate-openspec/materialize/active.js

@@ -0,0 +1,170 @@
+/**
+ * Each active OpenSpec change as a staged loam feature: its intent, the
+ * authored artifacts a disposition kept, a verbatim copy of the source change
+ * tree, and one delta `spec.md` per service its requirements routed to.
+ *
+ * This is the phase that resolves RENAMED pairs, and the reason it is the
+ * longest: a rename is the only place where the living corpus, the delta and
+ * the human's identity decision all have to agree, and every disagreement
+ * between them is a refusal rather than a guess. `./feature.js` holds the file
+ * shapes this emits; `./living.js` is the same corpus read for the other half.
+ */
+import { join } from "node:path";
+import { parseRequirements } from "../../../core/document/parse.js";
+import {} from "../../../core/document/spec.js";
+import { ownValue } from "../../../core/kernel/records.js";
+import {} from "../../../core/openspec/model/mapping.js";
+import { isOpenSpecArtifactDisposition } from "../../../core/openspec/model/model.js";
+import { planWrite } from "../../../core/staging/writes.js";
+import { selectedServices } from "../openspec/decisions.js";
+import { OpenSpecCommandError } from "../openspec/error.js";
+import { safeArtifactRelative } from "../openspec/paths.js";
+import { readSourceArtifact } from "../openspec/read.js";
+import { featureSlug, migrationFrontmatter, renderAuthoredBundle, serializeDeltaRequirements, } from "./feature.js";
+import { assertMaterializedRequirementIds, requirementWithCapability } from "./stage.js";
+export async function materializeActiveChanges(inventory, mapping, target, livingByCapability) {
+    const writes = [];
+    const inventoryArtifactsByPath = new Map(inventory.artifacts.map((artifact) => [artifact.path, artifact]));
+    for (const change of inventory.changes.active) {
+        const decision = inventory.changeDecisions.find((item) => item.change === change.id);
+        const feature = ownValue(mapping.changes, change.id)?.feature ?? null;
+        if (decision === undefined || feature === null)
+            continue; // readiness prevents this on --apply
+        const featureDir = join(target, "features", `${feature}-${featureSlug(decision.title, change.id)}`);
+        // Preserve the complete authored source change tree, including metadata,
+        // rename syntax, custom artifacts, and original delta section ordering.
+        for (const artifactPath of change.artifacts) {
+            const segments = safeArtifactRelative(artifactPath, `changes/${change.id}/`, `OpenSpec change '${change.id}'`);
+            writes.push(planWrite(join(featureDir, "legacy", "openspec", ...segments), await readSourceArtifact(inventory.root, artifactPath)));
+        }
+        const authored = [];
+        for (const artifactDecision of inventory.artifactDecisions) {
+            const artifact = inventoryArtifactsByPath.get(artifactDecision.path);
+            if (artifact?.changeId !== change.id)
+                continue;
+            const disposition = ownValue(mapping.artifacts, artifactDecision.path);
+            if (disposition === undefined)
+                continue; // readiness prevents this on --apply
+            // The mapping holds the authored string; everything below compares it
+            // against disposition literals, so this is where the value has to become
+            // one of them or stop being routed. `mapping.invalid-artifact-disposition`
+            // already refuses an unknown one, so readiness prevents this too — but a
+            // silent skip is the right failure for a value nothing here can act on.
+            if (!isOpenSpecArtifactDisposition(disposition))
+                continue;
+            authored.push({
+                path: artifactDecision.path,
+                kind: artifactDecision.kind,
+                disposition,
+                raw: await readSourceArtifact(inventory.root, artifactDecision.path),
+            });
+        }
+        const convertedProposals = authored.filter((artifact) => artifact.kind === "proposal" && artifact.disposition === "convert-to-intent");
+        const retainedProposals = authored.filter((artifact) => artifact.kind === "proposal" && artifact.disposition !== "convert-to-intent");
+        const intentBody = convertedProposals.length > 0
+            ? renderAuthoredBundle("## Migrated OpenSpec proposal", convertedProposals)
+            : "No proposal was converted into this intent. Review the retained OpenSpec artifacts and migration-plan.json before promotion.\n";
+        writes.push(planWrite(join(featureDir, "intent.md"), `${migrationFrontmatter(feature, decision.title)}\n\n# ${decision.title}\n\n<!-- Staged from OpenSpec change '${change.id}'. This feature is deliberately not validation-green yet. -->\n\n${intentBody}`));
+        if (retainedProposals.length > 0) {
+            writes.push(planWrite(join(featureDir, "legacy", "proposal.md"), renderAuthoredBundle("# Retained OpenSpec proposal", retainedProposals)));
+        }
+        const tasks = authored.filter((artifact) => artifact.kind === "tasks");
+        if (tasks.length > 0) {
+            writes.push(planWrite(join(featureDir, "legacy", "tasks.md"), renderAuthoredBundle("# OpenSpec task checklist", tasks)));
+        }
+        const reviewedDesigns = authored.filter((artifact) => artifact.kind === "change-design" && artifact.disposition === "review-as-feature-adr");
+        if (reviewedDesigns.length > 0) {
+            writes.push(planWrite(join(featureDir, "adrs", "openspec-design.md"), renderAuthoredBundle("# OpenSpec design (review required)", reviewedDesigns)));
+        }
+        const retainedDesigns = authored.filter((artifact) => artifact.kind === "change-design" && artifact.disposition !== "review-as-feature-adr");
+        if (retainedDesigns.length > 0) {
+            writes.push(planWrite(join(featureDir, "legacy", "design.md"), renderAuthoredBundle("# Retained OpenSpec design", retainedDesigns)));
+        }
+        if (change.metadata.skipSpecs)
+            continue;
+        const deltaByService = new Map();
+        const changeRenames = inventory.renamed.filter((item) => item.scope === "active" && item.changeId === change.id);
+        const materializedRenameKeys = new Set();
+        const addDelta = (service, requirement, origin) => {
+            const existing = deltaByService.get(service) ?? [];
+            const collision = existing.find((item) => item.name === requirement.name
+                || (item.id !== undefined && requirement.id !== undefined && item.id === requirement.id));
+            if (collision !== undefined) {
+                const identity = requirement.id === undefined ? requirement.name : requirement.id;
+                throw new OpenSpecCommandError("invalid-option", `Active change '${change.id}' produces colliding requirement '${identity}' in service '${service}' while materializing ${origin}.`);
+            }
+            existing.push(requirement);
+            deltaByService.set(service, existing);
+        };
+        for (const spec of change.specs) {
+            const requirements = parseRequirements(await readSourceArtifact(inventory.root, spec.path))
+                .filter((requirement) => requirement.kind !== "BASE");
+            for (const parsed of requirements) {
+                const matchingRenames = changeRenames.filter((rename) => rename.capability === spec.capability
+                    && rename.from !== null
+                    && rename.to !== null
+                    && (parsed.name === rename.from || parsed.name === rename.to));
+                if (matchingRenames.length > 1) {
+                    throw new OpenSpecCommandError("invalid-option", `Active change '${change.id}' requirement '${parsed.name}' matches multiple RENAMED pairs.`);
+                }
+                const rename = matchingRenames[0];
+                let requirement = parsed;
+                let routingName = parsed.name;
+                if (rename !== undefined && rename.from !== null && rename.to !== null && rename.requirementId !== null) {
+                    if (parsed.kind !== "MODIFIED") {
+                        throw new OpenSpecCommandError("invalid-option", `Active change '${change.id}' combines RENAMED '${rename.from}' → '${rename.to}' with ${parsed.kind} '${parsed.name}'; review the conflicting delta before --apply.`);
+                    }
+                    if (parsed.id !== undefined && parsed.id !== rename.requirementId) {
+                        throw new OpenSpecCommandError("invalid-option", `Active change '${change.id}' MODIFIED requirement '${parsed.name}' has Requirement-ID '${parsed.id}', but its RENAMED source resolves to '${rename.requirementId}'.`);
+                    }
+                    const annotation = `OpenSpec-Living-Source: ${rename.capability} :: ${rename.from}`;
+                    requirement = {
+                        ...parsed,
+                        id: rename.requirementId,
+                        name: rename.to,
+                        text: parsed.text.includes(annotation) ? parsed.text : [...parsed.text, "", annotation],
+                        section: "## MODIFIED Requirements",
+                    };
+                    routingName = rename.from;
+                    materializedRenameKeys.add(rename.key);
+                }
+                // Every delta kind uniformly: REMOVED is harmless (every check exempts
+                // it), and a MODIFIED body MUST carry the line or its wholesale
+                // replace would strip the one the living side was staged with.
+                const withCapability = requirementWithCapability(requirement, spec.capability);
+                for (const service of selectedServices(mapping, spec.capability, routingName)) {
+                    addDelta(service, withCapability, spec.path);
+                }
+            }
+        }
+        for (const rename of changeRenames) {
+            if (materializedRenameKeys.has(rename.key))
+                continue;
+            if (rename.from === null || rename.to === null || rename.requirementId === null)
+                continue;
+            const source = (livingByCapability.get(rename.capability) ?? [])
+                .filter((requirement) => requirement.name === rename.from)[0];
+            if (source === undefined)
+                continue; // readiness prevents this on --apply
+            const annotation = `OpenSpec-Living-Source: ${rename.capability} :: ${rename.from}`;
+            const text = source.text.includes(annotation) ? source.text : [...source.text, "", annotation];
+            const modified = {
+                ...source,
+                kind: "MODIFIED",
+                id: rename.requirementId,
+                name: rename.to,
+                text,
+                section: "## MODIFIED Requirements",
+            };
+            for (const service of selectedServices(mapping, rename.capability, rename.from)) {
+                addDelta(service, requirementWithCapability(modified, rename.capability), rename.path);
+            }
+        }
+        for (const [service, requirements] of [...deltaByService].sort(([a], [b]) => a.localeCompare(b))) {
+            assertMaterializedRequirementIds(`Active change '${change.id}' mapped to service '${service}'`, requirements);
+            writes.push(planWrite(join(featureDir, "specs", service, "spec.md"), serializeDeltaRequirements(requirements)));
+        }
+    }
+    return writes;
+}
+//# sourceMappingURL=active.js.map