@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.2

package/dist/core/c4/splice/delta-blocks.js

@@ -0,0 +1,139 @@
+/**
+ * What a delta may declare that the landscape merge cannot carry.
+ *
+ * `planLandscapeMerge` splices out of the delta's `model { }` block and nothing
+ * else. That is correct — the living landscape is a model plus the views its own
+ * authors chose — but it used to be SILENT: a delta declaring `deployment { }`
+ * or a `dynamic view` archived at exit 0, reported `+N element(s), +M
+ * relationship(s)` exactly as usual, and the block was simply gone. The merge's
+ * own parse net cannot catch it either, because a landscape missing a deployment
+ * model is perfectly legal — there is nothing to fail on. Nobody finds out until
+ * somebody goes looking for a diagram that was archived months ago.
+ *
+ * So the loss is made a refusal, which is the same doctrine as the merge's other
+ * mechanical refusals (an unlocatable declaration, two statements on one line):
+ * the input cannot be spliced as authored, `--approve` deliberately does not
+ * override it — that flag overrides loam's JUDGMENT about coherence, never its
+ * ability to carry an axis — and nothing is written.
+ *
+ * ## Why views are graded and not simply banned
+ *
+ * `loam new` scaffolds a `views { view <feat> { include * } }` block into every
+ * delta.likec4 (commands/new/templates.ts), so refusing the block outright would
+ * refuse loam's own scaffold on its first archive. It is there to be RENDERED
+ * while the feature is in flight, and it is meant not to travel.
+ *
+ * The line drawn here is recoverability, and it is the only line that survives
+ * the scaffold:
+ *
+ *  - A static `view` is a rendering OF the model. Once the merge lands, the
+ *    whole model is in landscape.likec4, so the author can restate the view
+ *    there at any time from information that still exists. Dropping it loses a
+ *    convenience.
+ *  - A `dynamic view`'s ordered steps, and a `deployment { }` block's topology,
+ *    exist in NO other document the fleet keeps. When the merge drops those,
+ *    the information is gone. That is what gets refused. Rule 26 sharpens the
+ *    stakes rather than the rule: a `dynamic view`'s steps are now something
+ *    loam READS, so dropping one silently would discard checked content, not
+ *    merely a convenience.
+ *
+ * A residual is accepted knowingly: a delta carrying a SECOND static view still
+ * loses it without a word. Refusing that would mean telling an author with two
+ * preview views to delete one, which is a false refusal on a harmless file, and
+ * the loss there is recoverable by the argument above.
+ *
+ * ## The dynamic-view refusal is unchanged; its ADVICE moved
+ *
+ * A `dynamic view` still cannot ride inside `delta.likec4`, and the reason is
+ * mechanical rather than a policy about where flows belong: this document
+ * re-declares the landscape's own identifiers to anchor its new edges and
+ * carries its own `specification` block because LikeC4 parses it standalone, so
+ * it cannot be staged beside the map in one project — a duplicate specification
+ * is an error blamed on both files, and a re-declared element is a duplicate id.
+ * What changed is where the refusal sends the author. It used to say
+ * `architecture/landscape.likec4`, which was the only honest answer while the
+ * axis had no feature-delta path: a flow could not ship with the change that
+ * made it true. `features/<FEAT>/usecases/<name>.likec4` is that path
+ * (`core/usecases/delta/flows.ts`), and it is a views-only document — which is
+ * exactly why it stages beside the map when this one cannot.
+ */
+import { maskSource, matchBrace } from "../source-mask.js";
+import { LandscapeSpliceError } from "./contract.js";
+/**
+ * Top-level blocks a delta can declare. `specification` and `model` are absent
+ * on purpose: the specification is re-declared in every delta because LikeC4
+ * parses each one standalone, and the model is the thing being spliced.
+ */
+const TOP_LEVEL_BLOCK = /\b(deployment|global|views)\s*\{/g;
+/** A `dynamic view` / `deployment view` inside a views block — the irrecoverable kinds. */
+const AUTHORED_VIEW = /\b(dynamic|deployment)\s+view\b/;
+function refuse(block, detail, home) {
+    throw new LandscapeSpliceError(`delta.likec4 declares ${detail}, and the landscape merge splices only what is inside \`model { }\` — ` +
+        `archiving would drop it silently, so nothing was written. Move the ${block} into ` +
+        `${home} and re-run the archive.`);
+}
+/** Where the living documents keep what this delta cannot carry. */
+const LANDSCAPE_HOME = "architecture/landscape.likec4, where the living documents keep it,";
+/** Where a FEATURE keeps TOPOLOGY — the third whole-file slot, added with the deployment axis. */
+const DEPLOYMENT_HOME = "features/<FEAT>/deployment/<name>.likec4 — a document of its own, which `loam archive` copies into " +
+    "architecture/ and `loam unarchive` takes back; say `extend` in it to add to a region the living map " +
+    "already declares —";
+/** Where a FEATURE keeps a flow — a slot of its own, not the living tree. See the header. */
+const FLOW_HOME = "features/<FEAT>/usecases/<name>.likec4 — a views-only document of its own, which `loam archive` copies into " +
+    "architecture/usecases/ and `loam unarchive` takes back —";
+/**
+ * Refuse a delta whose non-model blocks the merge would discard.
+ *
+ * Runs over MASKED source, so a `deployment {` written inside a comment or a
+ * description string cannot trigger it — the same masking discipline
+ * `scanModel` splices under, and for the same reason: this refuses an archive,
+ * and a refusal a comment can provoke is worse than the silence it replaced.
+ *
+ * Brace depth is tracked in one forward pass rather than recounted per match:
+ * only a block at depth 0 is a top-level declaration, and `deployment` at depth
+ * 1 is an ordinary `specification { deploymentNode … }` or a view predicate.
+ */
+export function assertMergeableDelta(deltaText) {
+    const { code } = maskSource(deltaText);
+    let depth = 0;
+    let cursor = 0;
+    for (const m of code.matchAll(TOP_LEVEL_BLOCK)) {
+        for (; cursor < m.index; cursor += 1) {
+            if (code[cursor] === "{")
+                depth += 1;
+            else if (code[cursor] === "}")
+                depth -= 1;
+        }
+        if (depth !== 0)
+            continue;
+        const block = m[1];
+        if (block !== "views") {
+            refuse(`\`${block} { }\` block`, `a top-level \`${block} { }\` block`, 
+            // The refusal is unchanged and always will be — this document
+            // re-declares the landscape's identifiers and carries its own
+            // `specification`, so it cannot be staged beside the map in one project.
+            // What changed is where it sends the author: a feature introducing
+            // topology WITH the change that makes it true now has a slot of its
+            // own, and pointing at the living landscape was the advice that made
+            // the axis's headline case a two-pull-request job. `global { }` has no
+            // such slot and keeps the living home.
+            block === "deployment" ? DEPLOYMENT_HOME : LANDSCAPE_HOME);
+        }
+        const open = m.index + m[0].length - 1;
+        const close = matchBrace(code, open);
+        const inner = code.slice(open + 1, close === -1 ? code.length : close);
+        const authored = AUTHORED_VIEW.exec(inner);
+        if (authored !== null) {
+            const kind = authored[1];
+            refuse(`\`${kind} view\``, `a \`${kind} view\` in its \`views { }\` block — a view of that kind describes ordering or topology ` +
+                `recorded in no other document, unlike the static preview view \`loam new\` scaffolds`, 
+            // A deployment view is topology and belongs in the living map; a dynamic
+            // view is a flow, and a flow now has a feature slot of its own. Sending
+            // an author to the living landscape for one they are introducing WITH
+            // this change was the advice that made the axis's headline case a
+            // two-pull-request job.
+            kind === "dynamic" ? FLOW_HOME : DEPLOYMENT_HOME);
+        }
+    }
+}
+//# sourceMappingURL=delta-blocks.js.map

package/dist/core/c4/splice/delta-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delta-blocks.js","sourceRoot":"","sources":["../../../../src/core/c4/splice/delta-blocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,2FAA2F;AAC3F,MAAM,aAAa,GAAG,iCAAiC,CAAC;AAExD,SAAS,MAAM,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY;IACzD,MAAM,IAAI,oBAAoB,CAC5B,yBAAyB,MAAM,wEAAwE;QACrG,sEAAsE,KAAK,QAAQ;QACnF,GAAG,IAAI,0BAA0B,CACpC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,cAAc,GAAG,oEAAoE,CAAC;AAE5F,kGAAkG;AAClG,MAAM,eAAe,GACnB,qGAAqG;IACrG,sGAAsG;IACtG,oBAAoB,CAAC;AAEvB,6FAA6F;AAC7F,MAAM,SAAS,GACb,8GAA8G;IAC9G,0DAA0D,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;iBAChC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,KAAK,CAAC;YAAE,SAAS;QAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,CACJ,KAAK,KAAK,cAAc,EACxB,iBAAiB,KAAK,cAAc;YACpC,8DAA8D;YAC9D,8DAA8D;YAC9D,yEAAyE;YACzE,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,uEAAuE;YACvE,uCAAuC;YACvC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC1B,MAAM,CACJ,KAAK,IAAI,SAAS,EAClB,OAAO,IAAI,0FAA0F;gBACnG,sFAAsF;YACxF,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,kEAAkE;YAClE,wBAAwB;YACxB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * What a delta may declare that the landscape merge cannot carry.\n *\n * `planLandscapeMerge` splices out of the delta's `model { }` block and nothing\n * else. That is correct — the living landscape is a model plus the views its own\n * authors chose — but it used to be SILENT: a delta declaring `deployment { }`\n * or a `dynamic view` archived at exit 0, reported `+N element(s), +M\n * relationship(s)` exactly as usual, and the block was simply gone. The merge's\n * own parse net cannot catch it either, because a landscape missing a deployment\n * model is perfectly legal — there is nothing to fail on. Nobody finds out until\n * somebody goes looking for a diagram that was archived months ago.\n *\n * So the loss is made a refusal, which is the same doctrine as the merge's other\n * mechanical refusals (an unlocatable declaration, two statements on one line):\n * the input cannot be spliced as authored, `--approve` deliberately does not\n * override it — that flag overrides loam's JUDGMENT about coherence, never its\n * ability to carry an axis — and nothing is written.\n *\n * ## Why views are graded and not simply banned\n *\n * `loam new` scaffolds a `views { view <feat> { include * } }` block into every\n * delta.likec4 (commands/new/templates.ts), so refusing the block outright would\n * refuse loam's own scaffold on its first archive. It is there to be RENDERED\n * while the feature is in flight, and it is meant not to travel.\n *\n * The line drawn here is recoverability, and it is the only line that survives\n * the scaffold:\n *\n *  - A static `view` is a rendering OF the model. Once the merge lands, the\n *    whole model is in landscape.likec4, so the author can restate the view\n *    there at any time from information that still exists. Dropping it loses a\n *    convenience.\n *  - A `dynamic view`'s ordered steps, and a `deployment { }` block's topology,\n *    exist in NO other document the fleet keeps. When the merge drops those,\n *    the information is gone. That is what gets refused. Rule 26 sharpens the\n *    stakes rather than the rule: a `dynamic view`'s steps are now something\n *    loam READS, so dropping one silently would discard checked content, not\n *    merely a convenience.\n *\n * A residual is accepted knowingly: a delta carrying a SECOND static view still\n * loses it without a word. Refusing that would mean telling an author with two\n * preview views to delete one, which is a false refusal on a harmless file, and\n * the loss there is recoverable by the argument above.\n *\n * ## The dynamic-view refusal is unchanged; its ADVICE moved\n *\n * A `dynamic view` still cannot ride inside `delta.likec4`, and the reason is\n * mechanical rather than a policy about where flows belong: this document\n * re-declares the landscape's own identifiers to anchor its new edges and\n * carries its own `specification` block because LikeC4 parses it standalone, so\n * it cannot be staged beside the map in one project — a duplicate specification\n * is an error blamed on both files, and a re-declared element is a duplicate id.\n * What changed is where the refusal sends the author. It used to say\n * `architecture/landscape.likec4`, which was the only honest answer while the\n * axis had no feature-delta path: a flow could not ship with the change that\n * made it true. `features/<FEAT>/usecases/<name>.likec4` is that path\n * (`core/usecases/delta/flows.ts`), and it is a views-only document — which is\n * exactly why it stages beside the map when this one cannot.\n */\nimport { maskSource, matchBrace } from \"../source-mask.js\";\nimport { LandscapeSpliceError } from \"./contract.js\";\n\n/**\n * Top-level blocks a delta can declare. `specification` and `model` are absent\n * on purpose: the specification is re-declared in every delta because LikeC4\n * parses each one standalone, and the model is the thing being spliced.\n */\nconst TOP_LEVEL_BLOCK = /\\b(deployment|global|views)\\s*\\{/g;\n\n/** A `dynamic view` / `deployment view` inside a views block — the irrecoverable kinds. */\nconst AUTHORED_VIEW = /\\b(dynamic|deployment)\\s+view\\b/;\n\nfunction refuse(block: string, detail: string, home: string): never {\n  throw new LandscapeSpliceError(\n    `delta.likec4 declares ${detail}, and the landscape merge splices only what is inside \\`model { }\\` — ` +\n      `archiving would drop it silently, so nothing was written. Move the ${block} into ` +\n      `${home} and re-run the archive.`,\n  );\n}\n\n/** Where the living documents keep what this delta cannot carry. */\nconst LANDSCAPE_HOME = \"architecture/landscape.likec4, where the living documents keep it,\";\n\n/** Where a FEATURE keeps TOPOLOGY — the third whole-file slot, added with the deployment axis. */\nconst DEPLOYMENT_HOME =\n  \"features/<FEAT>/deployment/<name>.likec4 — a document of its own, which `loam archive` copies into \" +\n  \"architecture/ and `loam unarchive` takes back; say `extend` in it to add to a region the living map \" +\n  \"already declares —\";\n\n/** Where a FEATURE keeps a flow — a slot of its own, not the living tree. See the header. */\nconst FLOW_HOME =\n  \"features/<FEAT>/usecases/<name>.likec4 — a views-only document of its own, which `loam archive` copies into \" +\n  \"architecture/usecases/ and `loam unarchive` takes back —\";\n\n/**\n * Refuse a delta whose non-model blocks the merge would discard.\n *\n * Runs over MASKED source, so a `deployment {` written inside a comment or a\n * description string cannot trigger it — the same masking discipline\n * `scanModel` splices under, and for the same reason: this refuses an archive,\n * and a refusal a comment can provoke is worse than the silence it replaced.\n *\n * Brace depth is tracked in one forward pass rather than recounted per match:\n * only a block at depth 0 is a top-level declaration, and `deployment` at depth\n * 1 is an ordinary `specification { deploymentNode … }` or a view predicate.\n */\nexport function assertMergeableDelta(deltaText: string): void {\n  const { code } = maskSource(deltaText);\n  let depth = 0;\n  let cursor = 0;\n  for (const m of code.matchAll(TOP_LEVEL_BLOCK)) {\n    for (; cursor < m.index; cursor += 1) {\n      if (code[cursor] === \"{\") depth += 1;\n      else if (code[cursor] === \"}\") depth -= 1;\n    }\n    if (depth !== 0) continue;\n    const block = m[1]!;\n    if (block !== \"views\") {\n      refuse(\n        `\\`${block} { }\\` block`,\n        `a top-level \\`${block} { }\\` block`,\n        // The refusal is unchanged and always will be — this document\n        // re-declares the landscape's identifiers and carries its own\n        // `specification`, so it cannot be staged beside the map in one project.\n        // What changed is where it sends the author: a feature introducing\n        // topology WITH the change that makes it true now has a slot of its\n        // own, and pointing at the living landscape was the advice that made\n        // the axis's headline case a two-pull-request job. `global { }` has no\n        // such slot and keeps the living home.\n        block === \"deployment\" ? DEPLOYMENT_HOME : LANDSCAPE_HOME,\n      );\n    }\n    const open = m.index + m[0].length - 1;\n    const close = matchBrace(code, open);\n    const inner = code.slice(open + 1, close === -1 ? code.length : close);\n    const authored = AUTHORED_VIEW.exec(inner);\n    if (authored !== null) {\n      const kind = authored[1]!;\n      refuse(\n        `\\`${kind} view\\``,\n        `a \\`${kind} view\\` in its \\`views { }\\` block — a view of that kind describes ordering or topology ` +\n          `recorded in no other document, unlike the static preview view \\`loam new\\` scaffolds`,\n        // A deployment view is topology and belongs in the living map; a dynamic\n        // view is a flow, and a flow now has a feature slot of its own. Sending\n        // an author to the living landscape for one they are introducing WITH\n        // this change was the advice that made the axis's headline case a\n        // two-pull-request job.\n        kind === \"dynamic\" ? FLOW_HOME : DEPLOYMENT_HOME,\n      );\n    }\n  }\n}\n"]}

package/dist/core/c4/splice/identity/edges.js

@@ -0,0 +1,36 @@
+/**
+ * The order of loam-inserted relationships that share a landing region:
+ * (source title, target title, the three spine keys, title) as one comparable
+ * string. Titles, not ids — the namespaces differ. The same edge must sort
+ * identically as today's addition and as a statement in the next archive's
+ * scan, so every field is one BOTH `Rel` and `ScannedRel` carry.
+ */
+export function relSortKey(els, r) {
+    const spine = [r.op ?? "", r.publishes ?? "", r.consumes ?? ""];
+    return JSON.stringify([titleOf(els, r.source), titleOf(els, r.target), ...spine, r.title ?? ""]);
+}
+/**
+ * What makes two edges the same edge. Endpoints are compared by TITLE, which is
+ * stable across the delta's and the landscape's id namespaces.
+ *
+ * An edge carrying a SPINE KEY — `op`, `publishes` or `consumes` — IS that call
+ * or that message, whatever it is titled: retitling it must not merge a second
+ * copy. An edge with none has only its title. Separate namespaces, because they
+ * are separate things: an op-less edge titled `authorizePayment` is not the edge
+ * whose operationId is authorizePayment, and keying on `op ?? title` quietly
+ * merged only one of them.
+ *
+ * ALL THREE keys, not just `op`. While the other two were out, a delta edge differing from a
+ * living one only by `metadata { publishes 'x' }` hashed the same, counted as already present,
+ * and was dropped — `+0 relationship(s)` at exit 0 over a binding that never reached the map.
+ */
+export function relKey(els, r) {
+    const src = titleOf(els, r.source);
+    const tgt = titleOf(els, r.target);
+    const spine = [r.op ?? "", r.publishes ?? "", r.consumes ?? ""];
+    return JSON.stringify(spine.some((v) => v !== "") ? ["spine", src, tgt, ...spine] : ["title", src, tgt, r.title ?? ""]);
+}
+export function titleOf(elements, id) {
+    return elements.find((e) => e.id === id)?.title ?? id;
+}
+//# sourceMappingURL=edges.js.map

package/dist/core/c4/splice/identity/edges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edges.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/edges.ts"],"names":[],"mappings":"AAoBA;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,CAAyG;IAEzG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,CAAM;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,EAAU;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * How the landscape merge decides that two relationships are the SAME EDGE,\n * and in what order equal ones are written.\n *\n * A subject of its own, and not a corner of placement: everything in\n * `../placement.ts` answers *where in the text* a statement goes, in byte\n * offsets, while everything here answers *which statement this is*, as a\n * comparable string. The merge asks the identity question first and the\n * placement question second, and getting the first one wrong is the failure\n * mode that is silent — a delta edge that hashes the same as a living one is\n * counted as already present and dropped at exit 0, with `+0 relationship(s)`\n * printed over a binding that never reached the map.\n *\n * Both keys are built from fields BOTH `Rel` and `ScannedRel` carry, because\n * the same edge must key identically as today's addition and as a statement in\n * the next archive's scan of the file it was written into. A field only one of\n * them has would make the merge disagree with itself one archive later.\n */\nimport type { Elem, Rel } from \"../../likec4.js\";\n\n/**\n * The order of loam-inserted relationships that share a landing region:\n * (source title, target title, the three spine keys, title) as one comparable\n * string. Titles, not ids — the namespaces differ. The same edge must sort\n * identically as today's addition and as a statement in the next archive's\n * scan, so every field is one BOTH `Rel` and `ScannedRel` carry.\n */\nexport function relSortKey(\n  els: Elem[],\n  r: { source: string; target: string; title?: string; op?: string; publishes?: string; consumes?: string },\n): string {\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify([titleOf(els, r.source), titleOf(els, r.target), ...spine, r.title ?? \"\"]);\n}\n\n/**\n * What makes two edges the same edge. Endpoints are compared by TITLE, which is\n * stable across the delta's and the landscape's id namespaces.\n *\n * An edge carrying a SPINE KEY — `op`, `publishes` or `consumes` — IS that call\n * or that message, whatever it is titled: retitling it must not merge a second\n * copy. An edge with none has only its title. Separate namespaces, because they\n * are separate things: an op-less edge titled `authorizePayment` is not the edge\n * whose operationId is authorizePayment, and keying on `op ?? title` quietly\n * merged only one of them.\n *\n * ALL THREE keys, not just `op`. While the other two were out, a delta edge differing from a\n * living one only by `metadata { publishes 'x' }` hashed the same, counted as already present,\n * and was dropped — `+0 relationship(s)` at exit 0 over a binding that never reached the map.\n */\nexport function relKey(els: Elem[], r: Rel): string {\n  const src = titleOf(els, r.source);\n  const tgt = titleOf(els, r.target);\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify(spine.some((v) => v !== \"\") ? [\"spine\", src, tgt, ...spine] : [\"title\", src, tgt, r.title ?? \"\"]);\n}\n\nexport function titleOf(elements: Elem[], id: string): string {\n  return elements.find((e) => e.id === id)?.title ?? id;\n}\n"]}

package/dist/core/c4/splice/landscape-merge.js

@@ -0,0 +1,269 @@
+import { loadSource } from "../likec4.js";
+import { elementService, serviceOf } from "../resolve/service.js";
+import { scanModel } from "../source-scan.js";
+import { spliceSource } from "./authored-source.js";
+import { LandscapeSpliceError } from "./contract.js";
+import { assertMergeableDelta } from "./delta-blocks.js";
+import { relKey, relSortKey } from "./identity/edges.js";
+import { elementSpot, nestedInsert, relSpot, topStatements, } from "./placement.js";
+/* ------------------------------------------------------------------ */
+/* Merging                                                             */
+/* ------------------------------------------------------------------ */
+/**
+ * Plan the merge of the feature's new elements + relationships into the living
+ * landscape's `model { ... }` block (preserving the rest of the file).
+ *
+ * The additions are SPLICED from delta.likec4 as authored — byte for byte,
+ * technology, style, icons, links, metadata, nested children and all — never
+ * re-serialized from the parsed model: a rebuild keeps only the fields loam
+ * models, and every field it forgets is authored detail destroyed. The one
+ * edit on the way over is dropping the feature's own tag — the additions are
+ * baseline now (SCHEMA.md documents the drop as why unarchive restores bytes
+ * instead of recomputing) — and a construct the strip empties goes with it.
+ *
+ * Placement is deterministic and SERVICE-GROUPED (the spot* helpers in
+ * placement.ts):
+ * a top-level addition lands beside what already belongs to its service, so
+ * two concurrent archives touching different services usually splice on
+ * different lines and git merges their PRs — the single shared append point
+ * every archive used to hit made two concurrent archives conflict BY
+ * CONSTRUCTION. A NESTED element lands inside its parent's block — inside the
+ * living parent when the landscape already has it, riding verbatim inside the
+ * spliced parent when the parent is new from the same delta — never as a flat
+ * dotted id at top level, which LikeC4 rejects. The additions carry no marker
+ * comment: which archive added what is the git history's to say.
+ *
+ * Existence is checked semantically against the parsed landscape (by element
+ * id/title and by edge identity), so re-archiving is idempotent and title
+ * strings appearing elsewhere in the source cause no false skips. Assumes the
+ * delta reuses the landscape's element identifiers for existing services. A
+ * title match whose two sides are BOTH bound to different services is not an
+ * existence hit but a collision, and refuses the archive (see the guard).
+ *
+ * Splicing is text surgery, so the computed result is PARSED before it is
+ * returned: a merged landscape LikeC4 rejects refuses the archive at plan time
+ * (merge-failed, nothing written — the unparseable-delta discipline) instead
+ * of landing in the living docs.
+ */
+export async function planLandscapeMerge(merge) {
+    const { landscapeText: text, deltaText, deltaElements, newEls, newRels, featureId } = merge;
+    // First, and before the early return for "nothing to add": a block this merge
+    // cannot carry is lost whether or not the delta also has tagged elements to
+    // splice. See delta-blocks.ts.
+    assertMergeableDelta(deltaText);
+    const land = await loadSource(text);
+    if (land.errors.length > 0) {
+        throw new LandscapeSpliceError(`landscape.likec4 has ${land.errors.length} error(s) — fix it before archiving`);
+    }
+    const haveIds = new Set(land.elements.map((e) => e.id));
+    // The title join needs the matched element back, not just membership: the
+    // cross-service guard below compares service BINDINGS across the join.
+    const byTitle = new Map();
+    const seeTitle = (el) => {
+        byTitle.set(el.title, [...(byTitle.get(el.title) ?? []), el]);
+    };
+    for (const el of land.elements)
+        seeTitle(el);
+    const addedEls = [];
+    for (const e of newEls) {
+        if (haveIds.has(e.id))
+            continue;
+        const sameTitle = byTitle.get(e.title);
+        if (sameTitle !== undefined) {
+            // A title match is the id-less fallback join, and skipping on it is only
+            // safe when the two sides could be the same box. When both sides carry an
+            // explicit `metadata { service }` binding and every binding disagrees,
+            // they are provably DIFFERENT services' boxes sharing a title ('API',
+            // 'Database') — the skip would silently drop the addition, and any delta
+            // edge into it would then refuse the whole archive at the parse net
+            // below with a message about nothing. Refuse here instead, at plan time,
+            // naming both sides.
+            if (e.service !== undefined && sameTitle.every((m) => m.service !== undefined && m.service !== e.service)) {
+                const m = sameTitle[0];
+                throw new LandscapeSpliceError(`the delta's '${e.id}' (bound to service '${e.service}') shares the title '${e.title}' with '${m.id}' (bound to service '${m.service}') — a title join across services would silently drop the addition; ` +
+                    `retitle one of them, or reuse the id '${m.id}' if they really are the same element`);
+            }
+            // KNOWN (narrowed by the guard above): with EITHER side unbound the title
+            // join stays trusting — the unbound title-fallback is the legal legacy
+            // pattern — so a cross-service collision hiding behind an unbound element
+            // is still silently skipped here. Scoping titles per service is backlog.
+            continue;
+        }
+        haveIds.add(e.id);
+        seeTitle(e);
+        addedEls.push(e);
+    }
+    // Edges are matched by COUNT, not by membership: two edges the model cannot tell
+    // apart are still two edges, and dropping the second one silently loses a call
+    // the author drew. An edge already in the landscape consumes one delta edge of
+    // the same identity, which is what keeps re-archiving idempotent.
+    const have = new Map();
+    for (const r of land.relationships) {
+        const k = relKey(land.elements, r);
+        have.set(k, (have.get(k) ?? 0) + 1);
+    }
+    const addedRels = [];
+    for (const r of newRels) {
+        const k = relKey(deltaElements, r);
+        const n = have.get(k) ?? 0;
+        if (n > 0) {
+            have.set(k, n - 1);
+            continue;
+        }
+        addedRels.push(r);
+    }
+    if (addedEls.length === 0 && addedRels.length === 0)
+        return { content: null, addedEls, addedRels };
+    const scan = scanModel(deltaText);
+    if (scan === null) {
+        throw new LandscapeSpliceError("delta.likec4 has no model block — nothing to splice the additions from");
+    }
+    // Everything below either locates a declaration's authored bytes or refuses.
+    // `spliced` remembers the delta ranges already carried over, so a child whose
+    // parent is itself new is recognised as riding inside the parent's text and
+    // is never inserted twice.
+    const byId = new Map(scan.elements.map((e) => [e.id, e]));
+    const spliced = [];
+    const rides = (start, end) => spliced.some((r) => start >= r.start && end <= r.end);
+    // The living model, scanned on MASKED source (scanModel) and RE-SCANNED
+    // after every splice: each addition lands in the text exactly as the
+    // previous one left it, so an archive of N additions produces the same
+    // bytes as N single-addition archives run back to back. Placement then
+    // composes per statement — the unit the order-independence argument below
+    // is stated in — instead of per archive, where a batch computed against a
+    // stale layout could interleave with itself. Masking matters — a `model {`
+    // spelled inside a comment or string above the real block must not capture
+    // the match, or every top-level addition lands inside the comment (legal
+    // LikeC4, so the parse net below would pass a landscape containing none of
+    // the architecture).
+    let content = text;
+    // Service binding for placement: living elements first (they win a shared
+    // id), the delta's after — a spliced statement's id resolves to its service
+    // the moment its bytes land in the scan.
+    const bindEls = [...land.elements, ...deltaElements.filter((d) => !land.elements.some((l) => l.id === d.id))];
+    let livingScan = scanModel(content);
+    let stmts = livingScan === null ? [] : topStatements(livingScan, bindEls);
+    const rescan = () => {
+        livingScan = scanModel(content);
+        stmts = livingScan === null ? [] : topStatements(livingScan, bindEls);
+    };
+    const requireModel = () => {
+        if (livingScan === null)
+            throw new LandscapeSpliceError("landscape.likec4 has no model block");
+        return livingScan;
+    };
+    // Built fresh at every use, never captured: `content` and `stmts` are rebound
+    // by each rescan, and a region assembled before a splice describes a document
+    // that no longer exists.
+    const modelRegion = () => ({ text: content, stmts, close: requireModel().close });
+    const applyAt = (at, insert) => {
+        content = content.slice(0, at) + insert + content.slice(at);
+        rescan();
+    };
+    const applyTop = (spot, block) => {
+        // A bare spot shares its line with other text (the closing brace, or a
+        // statement the block displaces) — it brings its own newlines; a
+        // line-start spot slots between lines.
+        applyAt(spot.at, spot.bare ? `\n${block}\n` : `${block}\n`);
+    };
+    // Placement walks the scanned statement layout, so a declaration the scan
+    // cannot see is one placement would blindly splice around — LikeC4 accepts
+    // two declarations on one line, but scanModel's statement head runs to the
+    // end of the line, so the second rides invisibly inside the first: an
+    // element bound to its service would miss its neighborhood, and a bodyless
+    // parent gaining a body could wrap the wrong declaration. Refuse
+    // mechanically (the parse-net discipline) instead of splicing blind.
+    if (livingScan !== null) {
+        const seen = new Set(livingScan.elements.map((e) => e.id));
+        const invisible = land.elements.find((e) => !seen.has(e.id));
+        if (invisible !== undefined) {
+            throw new LandscapeSpliceError(`landscape.likec4 declares '${invisible.id}' in a form placement cannot locate — most often two declarations sharing one line; give each its own line, then re-run`);
+        }
+        if (livingScan.rels.length < land.relationships.length) {
+            throw new LandscapeSpliceError(`landscape.likec4 declares ${land.relationships.length} relationship(s) but placement can locate only ${livingScan.rels.length} — most often two statements sharing one line; give each its own line, then re-run`);
+        }
+    }
+    const livingParentOf = (parentId) => {
+        if (livingScan === null)
+            return null;
+        const direct = livingScan.elements.find((e) => e.id === parentId);
+        if (direct !== undefined)
+            return direct;
+        // The delta may spell an existing element under its own id; the title is
+        // the stable cross-namespace name (the same rule the existence check uses).
+        const title = deltaElements.find((e) => e.id === parentId)?.title;
+        const livingId = title === undefined ? undefined : land.elements.find((e) => e.title === title)?.id;
+        if (livingId === undefined)
+            return null;
+        return livingScan.elements.find((e) => e.id === livingId) ?? null;
+    };
+    // Ancestors first: a spliced parent covers its children before they are seen.
+    const depth = (id) => id.split(".").length;
+    const sortedEls = [...addedEls].sort((a, b) => depth(a.id) - depth(b.id) || (byId.get(a.id)?.start ?? 0) - (byId.get(b.id)?.start ?? 0));
+    for (const e of sortedEls) {
+        const src = byId.get(e.id);
+        if (src === undefined) {
+            throw new LandscapeSpliceError(`cannot locate '${e.id}' in delta.likec4 — the landscape merge splices authored source, and this declaration was not found`);
+        }
+        if (rides(src.start, src.end))
+            continue;
+        const dot = e.id.lastIndexOf(".");
+        if (dot === -1) {
+            const spot = elementSpot(modelRegion(), e.id, elementService(e));
+            applyTop(spot, spliceSource(deltaText, src, featureId, "  "));
+            spliced.push({ start: src.start, end: src.end });
+            continue;
+        }
+        const parentId = e.id.slice(0, dot);
+        const parent = livingParentOf(parentId);
+        if (parent === null) {
+            throw new LandscapeSpliceError(`'${e.id}' nests under '${parentId}', which is neither in the living landscape nor added by this delta — there is nowhere to insert it`);
+        }
+        const nested = nestedInsert(content, parent, spliceSource(deltaText, src, featureId, parent.indent + "  "));
+        applyAt(nested.at, nested.insert);
+        spliced.push({ start: src.start, end: src.end });
+    }
+    // Relationships: match each parsed addition back to its statement in the
+    // delta source — full identity (endpoints, title, all three spine keys,
+    // tags), consumed one statement per addition so duplicates stay duplicates.
+    // The spine keys earn their place here the same way they do in `relKey`:
+    // without them two additions differing only by `publishes` share one pool
+    // entry, and `shift()` hands the second one the first one's authored bytes.
+    const relKeyOf = (r) => JSON.stringify([r.source, r.target, r.title ?? "", r.op ?? "", r.publishes ?? "", r.consumes ?? "", [...r.tags].sort()]);
+    const pool = new Map();
+    for (const s of scan.rels) {
+        const k = relKeyOf(s);
+        pool.set(k, [...(pool.get(k) ?? []), s]);
+    }
+    for (const r of addedRels) {
+        const s = pool.get(relKeyOf(r))?.shift();
+        if (s === undefined) {
+            throw new LandscapeSpliceError(`cannot locate the '${r.source} -> ${r.target}' relationship in delta.likec4 — the landscape merge splices authored source, and no matching declaration was found`);
+        }
+        if (rides(s.start, s.end))
+            continue;
+        const key = relSortKey(deltaElements, r);
+        // Deliberately no `known` fleet set: this resolves only the anchor a new
+        // relationship lands after (placement.ts's reason — cosmetic grouping,
+        // safety-netted by the re-parse below), never which service a check
+        // grades.
+        const spot = relSpot(modelRegion(), serviceOf(deltaElements, r.source), key);
+        applyTop(spot, spliceSource(deltaText, s, featureId, "  "));
+    }
+    // The safety net: prove the computed landscape parses before anything is
+    // written. Splice bugs — and legal inputs the living document cannot absorb,
+    // like a kind its specification never declares — refuse here, at plan time,
+    // instead of corrupting the one file the whole fleet reads.
+    const check = await loadSource(content);
+    if (check.errors.length > 0) {
+        const detail = check.errors
+            .slice(0, 3)
+            .map((e) => (typeof e.line === "number" ? `L${e.line}: ${e.message}` : e.message))
+            .join("; ");
+        throw new LandscapeSpliceError(`the merged landscape would not parse (${check.errors.length} error(s): ${detail}) — nothing was written. ` +
+            `The delta's additions do not fit the living landscape as authored — most often an element kind or tag ` +
+            `its specification block does not declare; fix the landscape's specification or the delta, then re-run`);
+    }
+    return { content, addedEls, addedRels };
+}
+//# sourceMappingURL=landscape-merge.js.map

package/dist/core/c4/splice/landscape-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"landscape-merge.js","sourceRoot":"","sources":["../../../../src/core/c4/splice/landscape-merge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,SAAS,EAA2D,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAkD,MAAM,eAAe,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,YAAY,EACZ,OAAO,EACP,aAAa,GAGd,MAAM,gBAAgB,CAAC;AAExB,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA4B;IACnE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5F,8EAA8E;IAC9E,4EAA4E;IAC5E,+BAA+B;IAC/B,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,IAAI,CAAC,MAAM,CAAC,MAAM,qCAAqC,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,EAAQ,EAAQ,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAW,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,qBAAqB;YACrB,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1G,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;gBACxB,MAAM,IAAI,oBAAoB,CAC5B,gBAAgB,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,OAAO,wBAAwB,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,OAAO,sEAAsE;oBACxM,yCAAyC,CAAC,CAAC,EAAE,uCAAuC,CACvF,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClB,QAAQ,CAAC,CAAC,CAAC,CAAC;QACZ,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,iFAAiF;IACjF,+EAA+E;IAC/E,+EAA+E;IAC/E,kEAAkE;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,SAAS,GAAU,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAEnG,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,oBAAoB,CAAC,wEAAwE,CAAC,CAAC;IAC3G,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,2BAA2B;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,GAAW,EAAW,EAAE,CACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAExD,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,qBAAqB;IACrB,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,0EAA0E;IAC1E,4EAA4E;IAC5E,yCAAyC;IACzC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9G,IAAI,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,KAAK,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,GAAiB,EAAE;QACtC,IAAI,UAAU,KAAK,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;QAC/F,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,yBAAyB;IACzB,MAAM,WAAW,GAAG,GAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,MAAc,EAAQ,EAAE;QACnD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC;IACX,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,IAAU,EAAE,KAAa,EAAQ,EAAE;QACnD,uEAAuE;QACvE,iEAAiE;QACjE,uCAAuC;QACvC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC;IAEF,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,iEAAiE;IACjE,qEAAqE;IACrE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,oBAAoB,CAC5B,8BAA8B,SAAS,CAAC,EAAE,yHAAyH,CACpK,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,IAAI,oBAAoB,CAC5B,6BAA6B,IAAI,CAAC,aAAa,CAAC,MAAM,kDAAkD,UAAU,CAAC,IAAI,CAAC,MAAM,oFAAoF,CACnN,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAyB,EAAE;QACjE,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QAClE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,KAAK,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;QACpG,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IACpE,CAAC,CAAC;IAEF,8EAA8E;IAC9E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CACnG,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,CAAC,CAAC,EAAE,qGAAqG,CAC5H,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACxC,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAoB,CAC5B,IAAI,CAAC,CAAC,EAAE,kBAAkB,QAAQ,qGAAqG,CACxI,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;QAC5G,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,CAAC,CAAmB,EAAU,EAAE,CAC/C,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3H,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAoB,CAC5B,sBAAsB,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM,qHAAqH,CACnK,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACzC,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,UAAU;QACV,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7E,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;aACxB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;aACjF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,oBAAoB,CAC5B,yCAAyC,KAAK,CAAC,MAAM,CAAC,MAAM,cAAc,MAAM,2BAA2B;YACzG,wGAAwG;YACxG,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC","sourcesContent":["\nimport { loadSource, type Elem, type Rel } from \"../likec4.js\";\nimport { elementService, serviceOf } from \"../resolve/service.js\";\nimport { scanModel, type ScannedElement, type ScannedModel, type ScannedRel } from \"../source-scan.js\";\nimport { spliceSource } from \"./authored-source.js\";\nimport { LandscapeSpliceError, type LandscapeMergeRequest, type LandscapePlan } from \"./contract.js\";\nimport { assertMergeableDelta } from \"./delta-blocks.js\";\nimport { relKey, relSortKey } from \"./identity/edges.js\";\nimport {\n  elementSpot,\n  nestedInsert,\n  relSpot,\n  topStatements,\n  type ModelRegion,\n  type Spot,\n} from \"./placement.js\";\n\n/* ------------------------------------------------------------------ */\n/* Merging                                                             */\n/* ------------------------------------------------------------------ */\n\n/**\n * Plan the merge of the feature's new elements + relationships into the living\n * landscape's `model { ... }` block (preserving the rest of the file).\n *\n * The additions are SPLICED from delta.likec4 as authored — byte for byte,\n * technology, style, icons, links, metadata, nested children and all — never\n * re-serialized from the parsed model: a rebuild keeps only the fields loam\n * models, and every field it forgets is authored detail destroyed. The one\n * edit on the way over is dropping the feature's own tag — the additions are\n * baseline now (SCHEMA.md documents the drop as why unarchive restores bytes\n * instead of recomputing) — and a construct the strip empties goes with it.\n *\n * Placement is deterministic and SERVICE-GROUPED (the spot* helpers in\n * placement.ts):\n * a top-level addition lands beside what already belongs to its service, so\n * two concurrent archives touching different services usually splice on\n * different lines and git merges their PRs — the single shared append point\n * every archive used to hit made two concurrent archives conflict BY\n * CONSTRUCTION. A NESTED element lands inside its parent's block — inside the\n * living parent when the landscape already has it, riding verbatim inside the\n * spliced parent when the parent is new from the same delta — never as a flat\n * dotted id at top level, which LikeC4 rejects. The additions carry no marker\n * comment: which archive added what is the git history's to say.\n *\n * Existence is checked semantically against the parsed landscape (by element\n * id/title and by edge identity), so re-archiving is idempotent and title\n * strings appearing elsewhere in the source cause no false skips. Assumes the\n * delta reuses the landscape's element identifiers for existing services. A\n * title match whose two sides are BOTH bound to different services is not an\n * existence hit but a collision, and refuses the archive (see the guard).\n *\n * Splicing is text surgery, so the computed result is PARSED before it is\n * returned: a merged landscape LikeC4 rejects refuses the archive at plan time\n * (merge-failed, nothing written — the unparseable-delta discipline) instead\n * of landing in the living docs.\n */\nexport async function planLandscapeMerge(merge: LandscapeMergeRequest): Promise<LandscapePlan> {\n  const { landscapeText: text, deltaText, deltaElements, newEls, newRels, featureId } = merge;\n  // First, and before the early return for \"nothing to add\": a block this merge\n  // cannot carry is lost whether or not the delta also has tagged elements to\n  // splice. See delta-blocks.ts.\n  assertMergeableDelta(deltaText);\n  const land = await loadSource(text);\n  if (land.errors.length > 0) {\n    throw new LandscapeSpliceError(`landscape.likec4 has ${land.errors.length} error(s) — fix it before archiving`);\n  }\n  const haveIds = new Set(land.elements.map((e) => e.id));\n  // The title join needs the matched element back, not just membership: the\n  // cross-service guard below compares service BINDINGS across the join.\n  const byTitle = new Map<string, Elem[]>();\n  const seeTitle = (el: Elem): void => {\n    byTitle.set(el.title, [...(byTitle.get(el.title) ?? []), el]);\n  };\n  for (const el of land.elements) seeTitle(el);\n  const addedEls: Elem[] = [];\n  for (const e of newEls) {\n    if (haveIds.has(e.id)) continue;\n    const sameTitle = byTitle.get(e.title);\n    if (sameTitle !== undefined) {\n      // A title match is the id-less fallback join, and skipping on it is only\n      // safe when the two sides could be the same box. When both sides carry an\n      // explicit `metadata { service }` binding and every binding disagrees,\n      // they are provably DIFFERENT services' boxes sharing a title ('API',\n      // 'Database') — the skip would silently drop the addition, and any delta\n      // edge into it would then refuse the whole archive at the parse net\n      // below with a message about nothing. Refuse here instead, at plan time,\n      // naming both sides.\n      if (e.service !== undefined && sameTitle.every((m) => m.service !== undefined && m.service !== e.service)) {\n        const m = sameTitle[0]!;\n        throw new LandscapeSpliceError(\n          `the delta's '${e.id}' (bound to service '${e.service}') shares the title '${e.title}' with '${m.id}' (bound to service '${m.service}') — a title join across services would silently drop the addition; ` +\n            `retitle one of them, or reuse the id '${m.id}' if they really are the same element`,\n        );\n      }\n      // KNOWN (narrowed by the guard above): with EITHER side unbound the title\n      // join stays trusting — the unbound title-fallback is the legal legacy\n      // pattern — so a cross-service collision hiding behind an unbound element\n      // is still silently skipped here. Scoping titles per service is backlog.\n      continue;\n    }\n    haveIds.add(e.id);\n    seeTitle(e);\n    addedEls.push(e);\n  }\n\n  // Edges are matched by COUNT, not by membership: two edges the model cannot tell\n  // apart are still two edges, and dropping the second one silently loses a call\n  // the author drew. An edge already in the landscape consumes one delta edge of\n  // the same identity, which is what keeps re-archiving idempotent.\n  const have = new Map<string, number>();\n  for (const r of land.relationships) {\n    const k = relKey(land.elements, r);\n    have.set(k, (have.get(k) ?? 0) + 1);\n  }\n  const addedRels: Rel[] = [];\n  for (const r of newRels) {\n    const k = relKey(deltaElements, r);\n    const n = have.get(k) ?? 0;\n    if (n > 0) {\n      have.set(k, n - 1);\n      continue;\n    }\n    addedRels.push(r);\n  }\n\n  if (addedEls.length === 0 && addedRels.length === 0) return { content: null, addedEls, addedRels };\n\n  const scan = scanModel(deltaText);\n  if (scan === null) {\n    throw new LandscapeSpliceError(\"delta.likec4 has no model block — nothing to splice the additions from\");\n  }\n\n  // Everything below either locates a declaration's authored bytes or refuses.\n  // `spliced` remembers the delta ranges already carried over, so a child whose\n  // parent is itself new is recognised as riding inside the parent's text and\n  // is never inserted twice.\n  const byId = new Map(scan.elements.map((e) => [e.id, e]));\n  const spliced: Array<{ start: number; end: number }> = [];\n  const rides = (start: number, end: number): boolean =>\n    spliced.some((r) => start >= r.start && end <= r.end);\n\n  // The living model, scanned on MASKED source (scanModel) and RE-SCANNED\n  // after every splice: each addition lands in the text exactly as the\n  // previous one left it, so an archive of N additions produces the same\n  // bytes as N single-addition archives run back to back. Placement then\n  // composes per statement — the unit the order-independence argument below\n  // is stated in — instead of per archive, where a batch computed against a\n  // stale layout could interleave with itself. Masking matters — a `model {`\n  // spelled inside a comment or string above the real block must not capture\n  // the match, or every top-level addition lands inside the comment (legal\n  // LikeC4, so the parse net below would pass a landscape containing none of\n  // the architecture).\n  let content = text;\n  // Service binding for placement: living elements first (they win a shared\n  // id), the delta's after — a spliced statement's id resolves to its service\n  // the moment its bytes land in the scan.\n  const bindEls = [...land.elements, ...deltaElements.filter((d) => !land.elements.some((l) => l.id === d.id))];\n  let livingScan = scanModel(content);\n  let stmts = livingScan === null ? [] : topStatements(livingScan, bindEls);\n  const rescan = (): void => {\n    livingScan = scanModel(content);\n    stmts = livingScan === null ? [] : topStatements(livingScan, bindEls);\n  };\n  const requireModel = (): ScannedModel => {\n    if (livingScan === null) throw new LandscapeSpliceError(\"landscape.likec4 has no model block\");\n    return livingScan;\n  };\n  // Built fresh at every use, never captured: `content` and `stmts` are rebound\n  // by each rescan, and a region assembled before a splice describes a document\n  // that no longer exists.\n  const modelRegion = (): ModelRegion => ({ text: content, stmts, close: requireModel().close });\n  const applyAt = (at: number, insert: string): void => {\n    content = content.slice(0, at) + insert + content.slice(at);\n    rescan();\n  };\n  const applyTop = (spot: Spot, block: string): void => {\n    // A bare spot shares its line with other text (the closing brace, or a\n    // statement the block displaces) — it brings its own newlines; a\n    // line-start spot slots between lines.\n    applyAt(spot.at, spot.bare ? `\\n${block}\\n` : `${block}\\n`);\n  };\n\n  // Placement walks the scanned statement layout, so a declaration the scan\n  // cannot see is one placement would blindly splice around — LikeC4 accepts\n  // two declarations on one line, but scanModel's statement head runs to the\n  // end of the line, so the second rides invisibly inside the first: an\n  // element bound to its service would miss its neighborhood, and a bodyless\n  // parent gaining a body could wrap the wrong declaration. Refuse\n  // mechanically (the parse-net discipline) instead of splicing blind.\n  if (livingScan !== null) {\n    const seen = new Set(livingScan.elements.map((e) => e.id));\n    const invisible = land.elements.find((e) => !seen.has(e.id));\n    if (invisible !== undefined) {\n      throw new LandscapeSpliceError(\n        `landscape.likec4 declares '${invisible.id}' in a form placement cannot locate — most often two declarations sharing one line; give each its own line, then re-run`,\n      );\n    }\n    if (livingScan.rels.length < land.relationships.length) {\n      throw new LandscapeSpliceError(\n        `landscape.likec4 declares ${land.relationships.length} relationship(s) but placement can locate only ${livingScan.rels.length} — most often two statements sharing one line; give each its own line, then re-run`,\n      );\n    }\n  }\n\n  const livingParentOf = (parentId: string): ScannedElement | null => {\n    if (livingScan === null) return null;\n    const direct = livingScan.elements.find((e) => e.id === parentId);\n    if (direct !== undefined) return direct;\n    // The delta may spell an existing element under its own id; the title is\n    // the stable cross-namespace name (the same rule the existence check uses).\n    const title = deltaElements.find((e) => e.id === parentId)?.title;\n    const livingId = title === undefined ? undefined : land.elements.find((e) => e.title === title)?.id;\n    if (livingId === undefined) return null;\n    return livingScan.elements.find((e) => e.id === livingId) ?? null;\n  };\n\n  // Ancestors first: a spliced parent covers its children before they are seen.\n  const depth = (id: string): number => id.split(\".\").length;\n  const sortedEls = [...addedEls].sort(\n    (a, b) => depth(a.id) - depth(b.id) || (byId.get(a.id)?.start ?? 0) - (byId.get(b.id)?.start ?? 0),\n  );\n  for (const e of sortedEls) {\n    const src = byId.get(e.id);\n    if (src === undefined) {\n      throw new LandscapeSpliceError(\n        `cannot locate '${e.id}' in delta.likec4 — the landscape merge splices authored source, and this declaration was not found`,\n      );\n    }\n    if (rides(src.start, src.end)) continue;\n    const dot = e.id.lastIndexOf(\".\");\n    if (dot === -1) {\n      const spot = elementSpot(modelRegion(), e.id, elementService(e));\n      applyTop(spot, spliceSource(deltaText, src, featureId, \"  \"));\n      spliced.push({ start: src.start, end: src.end });\n      continue;\n    }\n    const parentId = e.id.slice(0, dot);\n    const parent = livingParentOf(parentId);\n    if (parent === null) {\n      throw new LandscapeSpliceError(\n        `'${e.id}' nests under '${parentId}', which is neither in the living landscape nor added by this delta — there is nowhere to insert it`,\n      );\n    }\n    const nested = nestedInsert(content, parent, spliceSource(deltaText, src, featureId, parent.indent + \"  \"));\n    applyAt(nested.at, nested.insert);\n    spliced.push({ start: src.start, end: src.end });\n  }\n\n  // Relationships: match each parsed addition back to its statement in the\n  // delta source — full identity (endpoints, title, all three spine keys,\n  // tags), consumed one statement per addition so duplicates stay duplicates.\n  // The spine keys earn their place here the same way they do in `relKey`:\n  // without them two additions differing only by `publishes` share one pool\n  // entry, and `shift()` hands the second one the first one's authored bytes.\n  const relKeyOf = (r: Rel | ScannedRel): string =>\n    JSON.stringify([r.source, r.target, r.title ?? \"\", r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\", [...r.tags].sort()]);\n  const pool = new Map<string, ScannedRel[]>();\n  for (const s of scan.rels) {\n    const k = relKeyOf(s);\n    pool.set(k, [...(pool.get(k) ?? []), s]);\n  }\n  for (const r of addedRels) {\n    const s = pool.get(relKeyOf(r))?.shift();\n    if (s === undefined) {\n      throw new LandscapeSpliceError(\n        `cannot locate the '${r.source} -> ${r.target}' relationship in delta.likec4 — the landscape merge splices authored source, and no matching declaration was found`,\n      );\n    }\n    if (rides(s.start, s.end)) continue;\n    const key = relSortKey(deltaElements, r);\n    // Deliberately no `known` fleet set: this resolves only the anchor a new\n    // relationship lands after (placement.ts's reason — cosmetic grouping,\n    // safety-netted by the re-parse below), never which service a check\n    // grades.\n    const spot = relSpot(modelRegion(), serviceOf(deltaElements, r.source), key);\n    applyTop(spot, spliceSource(deltaText, s, featureId, \"  \"));\n  }\n\n  // The safety net: prove the computed landscape parses before anything is\n  // written. Splice bugs — and legal inputs the living document cannot absorb,\n  // like a kind its specification never declares — refuse here, at plan time,\n  // instead of corrupting the one file the whole fleet reads.\n  const check = await loadSource(content);\n  if (check.errors.length > 0) {\n    const detail = check.errors\n      .slice(0, 3)\n      .map((e) => (typeof e.line === \"number\" ? `L${e.line}: ${e.message}` : e.message))\n      .join(\"; \");\n    throw new LandscapeSpliceError(\n      `the merged landscape would not parse (${check.errors.length} error(s): ${detail}) — nothing was written. ` +\n        `The delta's additions do not fit the living landscape as authored — most often an element kind or tag ` +\n        `its specification block does not declare; fix the landscape's specification or the delta, then re-run`,\n    );\n  }\n\n  return { content, addedEls, addedRels };\n}\n"]}