@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/core/provenance/gitq/moves.js

@@ -1,16 +1,15 @@
 /**
  * The subsystem surface's git questions, beside the provenance ones
- * (`../git.ts`) whose timeout and capped stdout reader they share. A package
- * of their own because `git.ts` sits against the 300-line limit and these
- * three are one subject: what a `subsystem move` must know before renaming
- * (`gitDirtyPaths`), what `subsystem history` asks after (`gitRenameHops`),
- * and the ONE write the roadmap blesses (`gitStageRenames` — "move stages
- * renames without committing"). The doctrine is unchanged: every way git can
- * decline reads as "git will not say", never as an error a caller must
- * handle.
+ * (`../git.ts`) whose `gitText` — one spawn, its timeout and its capped
+ * stdout reader — they ask through. A package of their own because `git.ts`
+ * sat against the then 300-line limit and these three are one subject: what a
+ * `subsystem move` must know before renaming (`gitDirtyPaths`), what
+ * `subsystem history` asks after (`gitRenameHops`), and the ONE write the
+ * roadmap blesses (`gitStageRenames` — "move stages renames without
+ * committing"). The doctrine is unchanged: every way git can decline reads as
+ * "git will not say", never as an error a caller must handle.
  */
-import { spawn } from "node:child_process";
-import { collectStdout, GIT_TIMEOUT_MS } from "../git.js";
+import { gitText } from "../git.js";
 /**
  * Which of these repo-relative paths carry UNCOMMITTED work — anything
  * `git status --porcelain` reports beneath them, untracked files included: an
@@ -28,35 +27,23 @@ import { collectStdout, GIT_TIMEOUT_MS } from "../git.js";
 export async function gitDirtyPaths(repoDir, rels) {
     if (rels.length === 0)
         return [];
-    return new Promise((done) => {
-        const child = spawn("git", ["status", "--porcelain", "-z", "--", ...rels], {
-            cwd: repoDir,
-            stdio: ["ignore", "pipe", "ignore"],
-            timeout: GIT_TIMEOUT_MS,
-        });
-        const out = collectStdout(child);
-        child.on("error", () => done(null));
-        child.on("close", (code) => {
-            if (code !== 0 || out.overflowed()) {
-                done(null);
-                return;
-            }
-            const tokens = out.text().split("\0").filter((t) => t !== "");
-            const paths = [];
-            for (let i = 0; i < tokens.length; i += 1) {
-                const entry = tokens[i];
-                // "XY <path>" — two status letters and a space. A rename/copy entry's
-                // ORIGINAL path follows as its own NUL token; take it too.
-                paths.push(entry.slice(3));
-                if (entry.startsWith("R") || entry.startsWith("C")) {
-                    i += 1;
-                    if (tokens[i] !== undefined)
-                        paths.push(tokens[i]);
-                }
-            }
-            done(paths);
-        });
-    });
+    const a = await gitText(repoDir, ["status", "--porcelain", "-z", "--", ...rels]);
+    if (a.code !== 0 || a.overflowed)
+        return null;
+    const tokens = a.out.split("\0").filter((t) => t !== "");
+    const paths = [];
+    for (let i = 0; i < tokens.length; i += 1) {
+        const entry = tokens[i];
+        // "XY <path>" — two status letters and a space. A rename/copy entry's
+        // ORIGINAL path follows as its own NUL token; take it too.
+        paths.push(entry.slice(3));
+        if (entry.startsWith("R") || entry.startsWith("C")) {
+            i += 1;
+            if (tokens[i] !== undefined)
+                paths.push(tokens[i]);
+        }
+    }
+    return paths;
 }
 /**
  * How this file moved over time, OLDEST hop first — or null when git will not
@@ -74,30 +61,22 @@ export async function gitDirtyPaths(repoDir, rels) {
  * fewer hops, never a wrong pairing.
  */
 export async function gitRenameHops(repoDir, rel) {
-    return new Promise((done) => {
-        const child = spawn("git", ["log", "--follow", "--diff-filter=R", "--name-status", "-z", "--format=%H", "--", rel], { cwd: repoDir, stdio: ["ignore", "pipe", "ignore"], timeout: GIT_TIMEOUT_MS });
-        const out = collectStdout(child);
-        child.on("error", () => done(null));
-        child.on("close", (code) => {
-            if (code !== 0 || out.overflowed()) {
-                done(null);
-                return;
-            }
-            const tokens = out.text().split("\0").map((t) => (t.startsWith("\n") ? t.slice(1) : t));
-            const hops = [];
-            let commit = "";
-            for (let i = 0; i < tokens.length; i += 1) {
-                const token = tokens[i];
-                if (/^[0-9a-f]{40}$/.test(token))
-                    commit = token;
-                else if (/^R\d*$/.test(token) && tokens[i + 1] !== undefined && tokens[i + 2] !== undefined) {
-                    hops.push({ commit, from: tokens[i + 1], to: tokens[i + 2] });
-                    i += 2;
-                }
-            }
-            done(hops.reverse());
-        });
-    });
+    const a = await gitText(repoDir, ["log", "--follow", "--diff-filter=R", "--name-status", "-z", "--format=%H", "--", rel]);
+    if (a.code !== 0 || a.overflowed)
+        return null;
+    const tokens = a.out.split("\0").map((t) => (t.startsWith("\n") ? t.slice(1) : t));
+    const hops = [];
+    let commit = "";
+    for (let i = 0; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (/^[0-9a-f]{40}$/.test(token))
+            commit = token;
+        else if (/^R\d*$/.test(token) && tokens[i + 1] !== undefined && tokens[i + 2] !== undefined) {
+            hops.push({ commit, from: tokens[i + 1], to: tokens[i + 2] });
+            i += 2;
+        }
+    }
+    return hops.reverse();
 }
 /**
  * Was the rename record that produced a hop into `dest` at `commit` a GUESS?
@@ -113,49 +92,35 @@ export async function gitRenameHops(repoDir, rel) {
  * because repeating a maybe-phantom hop is worse than answering nothing.
  */
 export async function gitRenamePairingAmbiguous(repoDir, commit, dest) {
-    return new Promise((done) => {
-        const child = spawn("git", ["diff-tree", "-r", "-M", "-z", commit], {
-            cwd: repoDir,
-            stdio: ["ignore", "pipe", "ignore"],
-            timeout: GIT_TIMEOUT_MS,
+    const a = await gitText(repoDir, ["diff-tree", "-r", "-M", "-z", commit]);
+    if (a.code !== 0 || a.overflowed)
+        return null;
+    // `-z` raw form: `:<mode> <mode> <sha> <sha> <status>` NUL, then one
+    // path token — two for a rename/copy. The leading token is the commit.
+    const tokens = a.out.split("\0").filter((t) => t !== "");
+    const entries = [];
+    for (let i = 0; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (!token.startsWith(":"))
+            continue;
+        const fields = token.slice(1).split(" ");
+        const status = fields[4] ?? "";
+        const paths = status.startsWith("R") || status.startsWith("C") ? [tokens[i + 1], tokens[i + 2]] : [tokens[i + 1]];
+        entries.push({
+            srcSha: fields[2] ?? "",
+            dstSha: fields[3] ?? "",
+            status,
+            paths: paths.filter((p) => p !== undefined),
         });
-        const out = collectStdout(child);
-        child.on("error", () => done(null));
-        child.on("close", (code) => {
-            if (code !== 0 || out.overflowed()) {
-                done(null);
-                return;
-            }
-            // `-z` raw form: `:<mode> <mode> <sha> <sha> <status>` NUL, then one
-            // path token — two for a rename/copy. The leading token is the commit.
-            const tokens = out.text().split("\0").filter((t) => t !== "");
-            const entries = [];
-            for (let i = 0; i < tokens.length; i += 1) {
-                const token = tokens[i];
-                if (!token.startsWith(":"))
-                    continue;
-                const fields = token.slice(1).split(" ");
-                const status = fields[4] ?? "";
-                const paths = status.startsWith("R") || status.startsWith("C") ? [tokens[i + 1], tokens[i + 2]] : [tokens[i + 1]];
-                entries.push({
-                    srcSha: fields[2] ?? "",
-                    dstSha: fields[3] ?? "",
-                    status,
-                    paths: paths.filter((p) => p !== undefined),
-                });
-                i += paths.length;
-            }
-            const own = entries.find((e) => e.status.startsWith("R") && e.paths[1] === dest);
-            if (own === undefined) {
-                // The hop's own rename is not in the commit's record — an answer this
-                // check cannot ground is an answer git will not give.
-                done(null);
-                return;
-            }
-            const twins = entries.filter((e) => e.srcSha === own.dstSha || e.dstSha === own.dstSha);
-            done(twins.length > 1);
-        });
-    });
+        i += paths.length;
+    }
+    const own = entries.find((e) => e.status.startsWith("R") && e.paths[1] === dest);
+    // The hop's own rename is not in the commit's record — an answer this
+    // check cannot ground is an answer git will not give.
+    if (own === undefined)
+        return null;
+    const twins = entries.filter((e) => e.srcSha === own.dstSha || e.dstSha === own.dstSha);
+    return twins.length > 1;
 }
 /**
  * Best-effort `git add -A` over these repo-relative paths — the ONE write
@@ -169,14 +134,6 @@ export async function gitRenamePairingAmbiguous(repoDir, commit, dest) {
 export async function gitStageRenames(repoDir, rels) {
     if (rels.length === 0)
         return;
-    return new Promise((done) => {
-        const child = spawn("git", ["add", "-A", "--", ...rels], {
-            cwd: repoDir,
-            stdio: ["ignore", "ignore", "ignore"],
-            timeout: GIT_TIMEOUT_MS,
-        });
-        child.on("error", () => done());
-        child.on("close", () => done());
-    });
+    await gitText(repoDir, ["add", "-A", "--", ...rels]);
 }
 //# sourceMappingURL=moves.js.map

package/dist/core/provenance/gitq/moves.js.map

@@ -1 +1 @@
-{"version":3,"file":"moves.js","sourceRoot":"","sources":["../../../../src/core/provenance/gitq/moves.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,IAAc;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,IAAI,OAAO,CAAkB,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE;YACzE,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACX,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;gBACzB,sEAAsE;gBACtE,2DAA2D;gBAC3D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnD,CAAC,IAAI,CAAC,CAAC;oBACP,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;wBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AASD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,GAAW;IAC9D,OAAO,IAAI,OAAO,CAAqB,CAAC,IAAI,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,KAAK,CACjB,KAAK,EACL,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,EACvF,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAC/E,CAAC;QACF,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACX,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,MAAM,IAAI,GAAgB,EAAE,CAAC;YAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;gBACzB,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,MAAM,GAAG,KAAK,CAAC;qBAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC5F,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,CAAC,CAAC;oBAChE,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;YACH,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,MAAc,EACd,IAAY;IAEZ,OAAO,IAAI,OAAO,CAAiB,CAAC,IAAI,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;YAClE,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACX,OAAO;YACT,CAAC;YACD,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9D,MAAM,OAAO,GAA0E,EAAE,CAAC;YAC1F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACzC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAClH,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;oBACvB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;oBACvB,MAAM;oBACN,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;iBACzD,CAAC,CAAC;gBACH,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC;YACpB,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACjF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,sEAAsE;gBACtE,sDAAsD;gBACtD,IAAI,CAAC,IAAI,CAAC,CAAC;gBACX,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;YACxF,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAAc;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,OAAO,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE;YACvD,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;YACrC,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * The subsystem surface's git questions, beside the provenance ones\n * (`../git.ts`) whose timeout and capped stdout reader they share. A package\n * of their own because `git.ts` sits against the 300-line limit and these\n * three are one subject: what a `subsystem move` must know before renaming\n * (`gitDirtyPaths`), what `subsystem history` asks after (`gitRenameHops`),\n * and the ONE write the roadmap blesses (`gitStageRenames` — \"move stages\n * renames without committing\"). The doctrine is unchanged: every way git can\n * decline reads as \"git will not say\", never as an error a caller must\n * handle.\n */\nimport { spawn } from \"node:child_process\";\nimport { collectStdout, GIT_TIMEOUT_MS } from \"../git.js\";\n\n/**\n * Which of these repo-relative paths carry UNCOMMITTED work — anything\n * `git status --porcelain` reports beneath them, untracked files included: an\n * untracked file is exactly a change no commit records. Null for every way\n * git declines (not a repository, not installed, a timeout, a non-zero exit),\n * and the one caller — `subsystem move`'s only refusal — treats null as\n * \"proceed\": a refusal needs positive evidence, and a fleet that does not use\n * git must not be refused a move over it.\n *\n * `-z` for the same reason `gitTrackedFiles` uses it: line output QUOTES\n * paths with spaces or non-ASCII bytes. A rename entry (`R ` when something\n * is already staged) carries a second NUL-separated path; both belong in the\n * answer.\n */\nexport async function gitDirtyPaths(repoDir: string, rels: string[]): Promise<string[] | null> {\n  if (rels.length === 0) return [];\n  return new Promise<string[] | null>((done) => {\n    const child = spawn(\"git\", [\"status\", \"--porcelain\", \"-z\", \"--\", ...rels], {\n      cwd: repoDir,\n      stdio: [\"ignore\", \"pipe\", \"ignore\"],\n      timeout: GIT_TIMEOUT_MS,\n    });\n    const out = collectStdout(child);\n    child.on(\"error\", () => done(null));\n    child.on(\"close\", (code) => {\n      if (code !== 0 || out.overflowed()) {\n        done(null);\n        return;\n      }\n      const tokens = out.text().split(\"\\0\").filter((t) => t !== \"\");\n      const paths: string[] = [];\n      for (let i = 0; i < tokens.length; i += 1) {\n        const entry = tokens[i]!;\n        // \"XY <path>\" — two status letters and a space. A rename/copy entry's\n        // ORIGINAL path follows as its own NUL token; take it too.\n        paths.push(entry.slice(3));\n        if (entry.startsWith(\"R\") || entry.startsWith(\"C\")) {\n          i += 1;\n          if (tokens[i] !== undefined) paths.push(tokens[i]!);\n        }\n      }\n      done(paths);\n    });\n  });\n}\n\n/** One hop of a path's rename history: the commit, and the path either side of it. */\nexport interface RenameHop {\n  commit: string;\n  from: string;\n  to: string;\n}\n\n/**\n * How this file moved over time, OLDEST hop first — or null when git will not\n * say. The question follows one FILE deliberately: `git log --follow` is\n * defined for a single file and prints NOTHING for a directory path, so\n * `subsystem history` follows a representative file inside the directory it\n * is asked about (a service's spec.md, a subsystem's marker) and reads each\n * hop's directories off the file's own rename record. An empty array is git\n * ANSWERING \"never renamed\"; null is git declining — the caller renders the\n * two differently and exits 0 for both, per the doctrine above.\n *\n * Output shape under `-z --format=%H`: `<hash>\\0\\nR<score>\\0<old>\\0<new>\\0…`,\n * newest commit first — the token walk below is anchored on the two shapes a\n * token can have (a 40-hex hash, an R-status) so an unexpected shape yields\n * fewer hops, never a wrong pairing.\n */\nexport async function gitRenameHops(repoDir: string, rel: string): Promise<RenameHop[] | null> {\n  return new Promise<RenameHop[] | null>((done) => {\n    const child = spawn(\n      \"git\",\n      [\"log\", \"--follow\", \"--diff-filter=R\", \"--name-status\", \"-z\", \"--format=%H\", \"--\", rel],\n      { cwd: repoDir, stdio: [\"ignore\", \"pipe\", \"ignore\"], timeout: GIT_TIMEOUT_MS },\n    );\n    const out = collectStdout(child);\n    child.on(\"error\", () => done(null));\n    child.on(\"close\", (code) => {\n      if (code !== 0 || out.overflowed()) {\n        done(null);\n        return;\n      }\n      const tokens = out.text().split(\"\\0\").map((t) => (t.startsWith(\"\\n\") ? t.slice(1) : t));\n      const hops: RenameHop[] = [];\n      let commit = \"\";\n      for (let i = 0; i < tokens.length; i += 1) {\n        const token = tokens[i]!;\n        if (/^[0-9a-f]{40}$/.test(token)) commit = token;\n        else if (/^R\\d*$/.test(token) && tokens[i + 1] !== undefined && tokens[i + 2] !== undefined) {\n          hops.push({ commit, from: tokens[i + 1]!, to: tokens[i + 2]! });\n          i += 2;\n        }\n      }\n      done(hops.reverse());\n    });\n  });\n}\n\n/**\n * Was the rename record that produced a hop into `dest` at `commit` a GUESS?\n * `git log --follow` pairs old and new paths by CONTENT similarity, and two\n * identical files moved (or one moved while its twin is created or deleted)\n * in the same commit give it a coin to flip — subsystem markers are routinely\n * byte-identical (often empty), so a multi-directory move can report a hop\n * from a directory the followed file never occupied. The cross-check asks the\n * commit itself: if two or more of its diff entries carry the same blob as\n * the one `dest` received, the pairing chose between equals and the hop is\n * not evidence. `false` = unambiguous; `true` = a guess; null = git will not\n * say — and the caller must treat BOTH non-false answers as \"will not say\",\n * because repeating a maybe-phantom hop is worse than answering nothing.\n */\nexport async function gitRenamePairingAmbiguous(\n  repoDir: string,\n  commit: string,\n  dest: string,\n): Promise<boolean | null> {\n  return new Promise<boolean | null>((done) => {\n    const child = spawn(\"git\", [\"diff-tree\", \"-r\", \"-M\", \"-z\", commit], {\n      cwd: repoDir,\n      stdio: [\"ignore\", \"pipe\", \"ignore\"],\n      timeout: GIT_TIMEOUT_MS,\n    });\n    const out = collectStdout(child);\n    child.on(\"error\", () => done(null));\n    child.on(\"close\", (code) => {\n      if (code !== 0 || out.overflowed()) {\n        done(null);\n        return;\n      }\n      // `-z` raw form: `:<mode> <mode> <sha> <sha> <status>` NUL, then one\n      // path token — two for a rename/copy. The leading token is the commit.\n      const tokens = out.text().split(\"\\0\").filter((t) => t !== \"\");\n      const entries: { srcSha: string; dstSha: string; status: string; paths: string[] }[] = [];\n      for (let i = 0; i < tokens.length; i += 1) {\n        const token = tokens[i]!;\n        if (!token.startsWith(\":\")) continue;\n        const fields = token.slice(1).split(\" \");\n        const status = fields[4] ?? \"\";\n        const paths = status.startsWith(\"R\") || status.startsWith(\"C\") ? [tokens[i + 1], tokens[i + 2]] : [tokens[i + 1]];\n        entries.push({\n          srcSha: fields[2] ?? \"\",\n          dstSha: fields[3] ?? \"\",\n          status,\n          paths: paths.filter((p): p is string => p !== undefined),\n        });\n        i += paths.length;\n      }\n      const own = entries.find((e) => e.status.startsWith(\"R\") && e.paths[1] === dest);\n      if (own === undefined) {\n        // The hop's own rename is not in the commit's record — an answer this\n        // check cannot ground is an answer git will not give.\n        done(null);\n        return;\n      }\n      const twins = entries.filter((e) => e.srcSha === own.dstSha || e.dstSha === own.dstSha);\n      done(twins.length > 1);\n    });\n  });\n}\n\n/**\n * Best-effort `git add -A` over these repo-relative paths — the ONE write\n * (module banner): after a `subsystem move` lands its renames, staging the\n * delete-side and add-side together is what lets git record the pair as a\n * rename, which is what keeps `subsystem history` answerable after the user\n * commits. Failure-silent in every direction: a fleet without git, an index\n * lock, a timeout — the move already succeeded, and nothing here may turn it\n * into an error.\n */\nexport async function gitStageRenames(repoDir: string, rels: string[]): Promise<void> {\n  if (rels.length === 0) return;\n  return new Promise<void>((done) => {\n    const child = spawn(\"git\", [\"add\", \"-A\", \"--\", ...rels], {\n      cwd: repoDir,\n      stdio: [\"ignore\", \"ignore\", \"ignore\"],\n      timeout: GIT_TIMEOUT_MS,\n    });\n    child.on(\"error\", () => done());\n    child.on(\"close\", () => done());\n  });\n}\n"]}
+{"version":3,"file":"moves.js","sourceRoot":"","sources":["../../../../src/core/provenance/gitq/moves.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,IAAc;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,sEAAsE;QACtE,2DAA2D;QAC3D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,GAAW;IAC9D,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1H,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,GAAG,KAAK,CAAC;aAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,CAAC,CAAC;YAChE,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,MAAc,EACd,IAAY;IAEZ,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAA0E,EAAE,CAAC;IAC1F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClH,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;YACvB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;YACvB,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SACzD,CAAC,CAAC;QACH,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC;IACpB,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACjF,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAAc;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC","sourcesContent":["/**\n * The subsystem surface's git questions, beside the provenance ones\n * (`../git.ts`) whose `gitText` — one spawn, its timeout and its capped\n * stdout reader — they ask through. A package of their own because `git.ts`\n * sat against the then 300-line limit and these three are one subject: what a\n * `subsystem move` must know before renaming (`gitDirtyPaths`), what\n * `subsystem history` asks after (`gitRenameHops`), and the ONE write the\n * roadmap blesses (`gitStageRenames` — \"move stages renames without\n * committing\"). The doctrine is unchanged: every way git can decline reads as\n * \"git will not say\", never as an error a caller must handle.\n */\nimport { gitText } from \"../git.js\";\n\n/**\n * Which of these repo-relative paths carry UNCOMMITTED work — anything\n * `git status --porcelain` reports beneath them, untracked files included: an\n * untracked file is exactly a change no commit records. Null for every way\n * git declines (not a repository, not installed, a timeout, a non-zero exit),\n * and the one caller — `subsystem move`'s only refusal — treats null as\n * \"proceed\": a refusal needs positive evidence, and a fleet that does not use\n * git must not be refused a move over it.\n *\n * `-z` for the same reason `gitTrackedFiles` uses it: line output QUOTES\n * paths with spaces or non-ASCII bytes. A rename entry (`R ` when something\n * is already staged) carries a second NUL-separated path; both belong in the\n * answer.\n */\nexport async function gitDirtyPaths(repoDir: string, rels: string[]): Promise<string[] | null> {\n  if (rels.length === 0) return [];\n  const a = await gitText(repoDir, [\"status\", \"--porcelain\", \"-z\", \"--\", ...rels]);\n  if (a.code !== 0 || a.overflowed) return null;\n  const tokens = a.out.split(\"\\0\").filter((t) => t !== \"\");\n  const paths: string[] = [];\n  for (let i = 0; i < tokens.length; i += 1) {\n    const entry = tokens[i]!;\n    // \"XY <path>\" — two status letters and a space. A rename/copy entry's\n    // ORIGINAL path follows as its own NUL token; take it too.\n    paths.push(entry.slice(3));\n    if (entry.startsWith(\"R\") || entry.startsWith(\"C\")) {\n      i += 1;\n      if (tokens[i] !== undefined) paths.push(tokens[i]!);\n    }\n  }\n  return paths;\n}\n\n/** One hop of a path's rename history: the commit, and the path either side of it. */\nexport interface RenameHop {\n  commit: string;\n  from: string;\n  to: string;\n}\n\n/**\n * How this file moved over time, OLDEST hop first — or null when git will not\n * say. The question follows one FILE deliberately: `git log --follow` is\n * defined for a single file and prints NOTHING for a directory path, so\n * `subsystem history` follows a representative file inside the directory it\n * is asked about (a service's spec.md, a subsystem's marker) and reads each\n * hop's directories off the file's own rename record. An empty array is git\n * ANSWERING \"never renamed\"; null is git declining — the caller renders the\n * two differently and exits 0 for both, per the doctrine above.\n *\n * Output shape under `-z --format=%H`: `<hash>\\0\\nR<score>\\0<old>\\0<new>\\0…`,\n * newest commit first — the token walk below is anchored on the two shapes a\n * token can have (a 40-hex hash, an R-status) so an unexpected shape yields\n * fewer hops, never a wrong pairing.\n */\nexport async function gitRenameHops(repoDir: string, rel: string): Promise<RenameHop[] | null> {\n  const a = await gitText(repoDir, [\"log\", \"--follow\", \"--diff-filter=R\", \"--name-status\", \"-z\", \"--format=%H\", \"--\", rel]);\n  if (a.code !== 0 || a.overflowed) return null;\n  const tokens = a.out.split(\"\\0\").map((t) => (t.startsWith(\"\\n\") ? t.slice(1) : t));\n  const hops: RenameHop[] = [];\n  let commit = \"\";\n  for (let i = 0; i < tokens.length; i += 1) {\n    const token = tokens[i]!;\n    if (/^[0-9a-f]{40}$/.test(token)) commit = token;\n    else if (/^R\\d*$/.test(token) && tokens[i + 1] !== undefined && tokens[i + 2] !== undefined) {\n      hops.push({ commit, from: tokens[i + 1]!, to: tokens[i + 2]! });\n      i += 2;\n    }\n  }\n  return hops.reverse();\n}\n\n/**\n * Was the rename record that produced a hop into `dest` at `commit` a GUESS?\n * `git log --follow` pairs old and new paths by CONTENT similarity, and two\n * identical files moved (or one moved while its twin is created or deleted)\n * in the same commit give it a coin to flip — subsystem markers are routinely\n * byte-identical (often empty), so a multi-directory move can report a hop\n * from a directory the followed file never occupied. The cross-check asks the\n * commit itself: if two or more of its diff entries carry the same blob as\n * the one `dest` received, the pairing chose between equals and the hop is\n * not evidence. `false` = unambiguous; `true` = a guess; null = git will not\n * say — and the caller must treat BOTH non-false answers as \"will not say\",\n * because repeating a maybe-phantom hop is worse than answering nothing.\n */\nexport async function gitRenamePairingAmbiguous(\n  repoDir: string,\n  commit: string,\n  dest: string,\n): Promise<boolean | null> {\n  const a = await gitText(repoDir, [\"diff-tree\", \"-r\", \"-M\", \"-z\", commit]);\n  if (a.code !== 0 || a.overflowed) return null;\n  // `-z` raw form: `:<mode> <mode> <sha> <sha> <status>` NUL, then one\n  // path token — two for a rename/copy. The leading token is the commit.\n  const tokens = a.out.split(\"\\0\").filter((t) => t !== \"\");\n  const entries: { srcSha: string; dstSha: string; status: string; paths: string[] }[] = [];\n  for (let i = 0; i < tokens.length; i += 1) {\n    const token = tokens[i]!;\n    if (!token.startsWith(\":\")) continue;\n    const fields = token.slice(1).split(\" \");\n    const status = fields[4] ?? \"\";\n    const paths = status.startsWith(\"R\") || status.startsWith(\"C\") ? [tokens[i + 1], tokens[i + 2]] : [tokens[i + 1]];\n    entries.push({\n      srcSha: fields[2] ?? \"\",\n      dstSha: fields[3] ?? \"\",\n      status,\n      paths: paths.filter((p): p is string => p !== undefined),\n    });\n    i += paths.length;\n  }\n  const own = entries.find((e) => e.status.startsWith(\"R\") && e.paths[1] === dest);\n  // The hop's own rename is not in the commit's record — an answer this\n  // check cannot ground is an answer git will not give.\n  if (own === undefined) return null;\n  const twins = entries.filter((e) => e.srcSha === own.dstSha || e.dstSha === own.dstSha);\n  return twins.length > 1;\n}\n\n/**\n * Best-effort `git add -A` over these repo-relative paths — the ONE write\n * (module banner): after a `subsystem move` lands its renames, staging the\n * delete-side and add-side together is what lets git record the pair as a\n * rename, which is what keeps `subsystem history` answerable after the user\n * commits. Failure-silent in every direction: a fleet without git, an index\n * lock, a timeout — the move already succeeded, and nothing here may turn it\n * into an error.\n */\nexport async function gitStageRenames(repoDir: string, rels: string[]): Promise<void> {\n  if (rels.length === 0) return;\n  await gitText(repoDir, [\"add\", \"-A\", \"--\", ...rels]);\n}\n"]}

package/dist/core/provenance/gitq/vouched-ancestor.js

@@ -27,7 +27,7 @@
  * timeout.
  */
 import { declineDetail, gitText } from "../git.js";
-import { contentDigest } from "../stamp.js";
+import { contentDigest } from "../../document/frontmatter.js";
 /**
  * How many commits touching the file the ancestor search will read before
  * declaring the vouched state unreachable. Past it the answer is `none` — a
@@ -54,7 +54,7 @@ async function gitPlain(docsDir, args) {
 }
 /**
  * The bytes this commit's blob would carry on a CRLF checkout. The stamped
- * `content_digest` is byte-exact over the WORKING-TREE file (stamp.ts), while
+ * `content_digest` is byte-exact over the WORKING-TREE file (document/frontmatter.ts), while
  * `git show` hands back the BLOB — and on a Windows checkout with
  * `core.autocrlf=true` the blob is LF where every working-tree byte is CRLF,
  * so the exact digest of the blob would never equal a stamp taken over the

package/dist/core/provenance/gitq/vouched-ancestor.js.map

@@ -1 +1 @@
-{"version":3,"file":"vouched-ancestor.js","sourceRoot":"","sources":["../../../../src/core/provenance/gitq/vouched-ancestor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,aAAa,EAAE,OAAO,EAAkB,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC;;;;;;;;;GASG;AACH,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAc;IACrD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,GAAW,EACX,aAAqB;IAErB,qEAAqE;IACrE,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,yCAAyC,EAAE,CAAC;IACtF,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEhC,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG;KACjE,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1D,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,KAAK,CAAC,UAAU;oBACtB,CAAC,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B;oBAClE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;aACzB,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,SAAS;QAC/B,IACE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,aAAa;YAC1C,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa,EAC7D,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EACJ,OAAO,CAAC,MAAM,GAAG,iBAAiB;YAChC,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,2DAA2D,iBAAiB,mFAAmF;KACtK,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,GAAW;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,MAAM,iDAAiD,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,yCAAyC,EAAE,CAAC;IACtF,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE;QACrC,qBAAqB,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG;KACnF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;AAC1C,CAAC","sourcesContent":["/**\n * Doc-body ancestry in the DOCS repo — the two git questions behind\n * `loam vouch --pack`'s body delta: which commit last held the body a person\n * vouched for (`findVouchedAncestor`), and what the file's diff from that\n * commit to the working tree says (`bodyDiffText`). Read-only throughout:\n * `rev-parse`/`log`/`show`/`diff`, no checkout, no temp writes.\n *\n * The mechanics are `core/diff/base-git.ts`'s to the letter — literally so:\n * both import the one `gitText`/`GitAnswer`/`declineDetail` set from\n * `../git.js`, so a hardening lands in both or in neither — but the doctrine\n * is deliberately the OPPOSITE consequence. `loam diff` REFUSES when git\n * cannot answer, because a silently empty base would report the whole fleet\n * as added — a lie with a green exit code. The pack DEGRADES to \"full read\"\n * instead: its output is a reading list, and for a reading list the\n * conservative direction — read more, never less — is always honest, the same\n * direction as provenance's existing hash-everything fallback. The shared\n * helpers carry no verdict, so neither module can borrow the other's\n * consequence by accident; each spells its own at its own call sites.\n *\n * The walk is BOUNDED at `ANCESTOR_WALK_CAP` commits. A vouched commit pushed\n * past the cap by a very active docs repo degrades a legitimate incremental\n * read to a full read — safe direction, and the `none` reason names the cap\n * so the human understands why. Within the walk, one commit whose version of\n * the file is absent (git answering \"not here\") is skipped; a git that stops\n * answering mid-walk (spawn error, kill, timeout, output cap) aborts the whole\n * search as `no-git` rather than letting 200 futile spawns each wait out the\n * timeout.\n */\nimport { declineDetail, gitText, type GitAnswer } from \"../git.js\";\nimport { contentDigest } from \"../stamp.js\";\n\n/**\n * How many commits touching the file the ancestor search will read before\n * declaring the vouched state unreachable. Past it the answer is `none` — a\n * full read — with a reason that names the cap.\n */\nconst ANCESTOR_WALK_CAP = 200;\n\n/**\n * How much diff text the pack will print. A body diff past this is not a\n * reading list any more — the honest answer is \"read the file\", as `failed`.\n */\nconst MAX_DIFF_TEXT_CHARS = 1024 * 1024;\n\n/**\n * The shared `gitText` (`../git.js`) with colour forced off. base-git's three\n * questions (`rev-parse`/`ls-tree`/`show`) never colour, but this module runs\n * `log` and `diff`, and a user's `color.ui = always` forces SGR escape\n * sequences into their output even on a pipe — which would put terminal codes\n * inside the `--json` payload's diff text and make the 40-hex-anchored log\n * walk silently match nothing on exactly that machine. The flag lives here,\n * not in the shared helper, because it is this module's need, not a property\n * of asking git a question.\n */\nasync function gitPlain(docsDir: string, args: string[]): Promise<GitAnswer> {\n  return gitText(docsDir, [\"-c\", \"color.ui=false\", ...args]);\n}\n\n/**\n * The bytes this commit's blob would carry on a CRLF checkout. The stamped\n * `content_digest` is byte-exact over the WORKING-TREE file (stamp.ts), while\n * `git show` hands back the BLOB — and on a Windows checkout with\n * `core.autocrlf=true` the blob is LF where every working-tree byte is CRLF,\n * so the exact digest of the blob would never equal a stamp taken over the\n * same content and every vouched ancestor would be invisible on exactly those\n * machines. Same hazard, same direction as `core/verify/pins/pin.ts`'s\n * `pinnedDigest`, resolved the inverse way because the stamp's recipe is\n * published and cannot be re-normalized after the fact: instead of\n * normalizing both sides, the search hashes each candidate twice — as the\n * blob is, and as its CRLF checkout rendering — and a match on either is a\n * match. Only lone LFs are rewritten, so a blob that already carries CRLFs\n * (committed without the clean filter, hence byte-identical on disk) is\n * covered by the exact hash.\n */\nfunction checkoutRendering(text: string): string {\n  return text.replace(/(?<!\\r)\\n/g, \"\\r\\n\");\n}\n\nexport type AncestorSearch =\n  | {\n      kind: \"found\";\n      commit: string;\n      /** The file exactly as that commit holds it — what the section delta reads. */\n      text: string;\n    }\n  /** The walk completed and nothing matched — the honest verdict is a full read. */\n  | { kind: \"none\"; reason: string }\n  /** Git declined somewhere the walk could not continue past — also a full read. */\n  | { kind: \"no-git\"; detail: string };\n\n/**\n * The last commit in the docs repo's history whose version of `rel` (a\n * docs-relative, `/`-separated path) has a body hashing to the stamped\n * `content_digest` — newest first, because the reading list wants the\n * SHORTEST honest diff, and any older commit holding the same bytes yields\n * the same one.\n */\nexport async function findVouchedAncestor(\n  docsDir: string,\n  rel: string,\n  stampedDigest: string,\n): Promise<AncestorSearch> {\n  // Belt to the callers' braces: `rel` is derived from loam's own path\n  // spelling, never argv, but every spelled pathspec below rides an argv, so\n  // an option-shaped or empty value is refused here rather than parsed by\n  // git as a flag. Same reason base-git.ts refuses option-shaped refs.\n  if (rel.trim() === \"\" || rel.startsWith(\"-\")) {\n    return { kind: \"no-git\", detail: `'${rel}' is not a path git can be asked about.` };\n  }\n  // `--show-prefix` first, and not decoration (base-git.ts proved this): a\n  // docs repo checked out as a subdirectory of a larger repository answers\n  // `show` only under that prefix, and a walk whose paths all miss would\n  // report \"no vouched ancestor\" about a history that holds one.\n  const where = await gitPlain(docsDir, [\"rev-parse\", \"--show-prefix\"]);\n  if (where.spawnError !== undefined || where.code !== 0) {\n    return { kind: \"no-git\", detail: declineDetail(where) };\n  }\n  const prefix = where.out.trim();\n\n  // The pathspec is cwd-relative (no prefix — `log` resolves it against the\n  // cwd, unlike `show`'s repo-root spelling below). `-n` is the walk's bound.\n  const log = await gitPlain(docsDir, [\n    \"log\", \"-n\", String(ANCESTOR_WALK_CAP), \"--format=%H\", \"--\", rel,\n  ]);\n  if (log.spawnError !== undefined || log.code !== 0 || log.overflowed) {\n    return { kind: \"no-git\", detail: declineDetail(log) };\n  }\n  // Only shas shaped like shas walk on — an unexpected line yields a shorter\n  // walk, never a malformed argv (the gitq/moves.ts token-anchoring rule).\n  const commits = log.out.split(\"\\n\").map((l) => l.trim()).filter((l) => /^[0-9a-f]{40}$/.test(l));\n  // Sequential on purpose: newest-first order is the answer's definition, and\n  // the walk stops at the first match — a fan-out would read history it does\n  // not need and could answer with an older commit than the newest match.\n  for (const commit of commits) {\n    const shown = await gitPlain(docsDir, [\"show\", `${commit}:${prefix}${rel}`]);\n    if (shown.spawnError !== undefined || shown.code === null) {\n      // Git stopped answering (not installed mid-walk, killed, timed out, or\n      // the output cap fired on a monstrous version). Abort rather than walk\n      // on: each further spawn could wait out the whole timeout, and a \"none\"\n      // built over commits nobody read would claim the history was searched.\n      return {\n        kind: \"no-git\",\n        detail: shown.overflowed\n          ? `the file at ${commit.slice(0, 12)} exceeds the git output cap.`\n          : declineDetail(shown),\n      };\n    }\n    // A real non-zero exit is git ANSWERING — the file is absent at this\n    // commit (renamed since, or the commit only deleted it). Skip it.\n    if (shown.code !== 0) continue;\n    if (\n      contentDigest(shown.out) === stampedDigest ||\n      contentDigest(checkoutRendering(shown.out)) === stampedDigest\n    ) {\n      return { kind: \"found\", commit, text: shown.out };\n    }\n  }\n  return {\n    kind: \"none\",\n    reason:\n      commits.length < ANCESTOR_WALK_CAP\n        ? \"body has no vouched ancestor in history\"\n        : `body has no vouched ancestor in history — only the last ${ANCESTOR_WALK_CAP} commits touching the file were walked, and the vouched state may lie beyond them`,\n  };\n}\n\nexport type BodyDiff =\n  | { kind: \"ok\"; diff: string }\n  /** No diff to print — the honest degrade is a full read, with this reason. */\n  | { kind: \"failed\"; reason: string };\n\n/**\n * The file's diff from its last vouched state: `git diff <commit> -- <rel>`,\n * commit-to-working-tree, in the docs repo. The output is git's own — when a\n * hand edit touched the frontmatter after the vouch, its hunks ride along,\n * which is why the pack's prose says \"the file's diff\", never \"the body's\".\n */\nexport async function bodyDiffText(docsDir: string, commit: string, rel: string): Promise<BodyDiff> {\n  // The commit came out of `findVouchedAncestor`'s own regex-vetted walk, but\n  // this function is exported API: re-vet, so no future caller can place an\n  // option-shaped string in the one argv slot that is not behind `--`.\n  if (!/^[0-9a-f]{40}$/.test(commit)) {\n    return { kind: \"failed\", reason: `'${commit}' is not a commit this diff can be asked about.` };\n  }\n  if (rel.trim() === \"\" || rel.startsWith(\"-\")) {\n    return { kind: \"failed\", reason: `'${rel}' is not a path git can be asked about.` };\n  }\n  // `--no-optional-locks`: a commit-to-worktree diff may opportunistically\n  // refresh `.git/index`'s stat cache, which is a WRITE — small, benign, and\n  // exactly what a command documented as \"writes nothing\" must not do. The\n  // global flag tells git to skip any operation that would take a lock it\n  // does not strictly need. `--no-ext-diff --no-textconv` close the rest of\n  // the config surface: `diff.external` / a `.gitattributes` diff driver make\n  // `git diff` EXECUTE a user-configured program instead of printing a diff —\n  // an arbitrary write hazard on a read-only path, and output no machine\n  // consumer of `body.diff` could parse. The pack's diff is a machine\n  // artifact, not a terminal rendering; git's own plumbing flags say so.\n  const answer = await gitPlain(docsDir, [\n    \"--no-optional-locks\", \"diff\", \"--no-ext-diff\", \"--no-textconv\", commit, \"--\", rel,\n  ]);\n  if (answer.spawnError !== undefined || answer.code !== 0 || answer.overflowed) {\n    return { kind: \"failed\", reason: declineDetail(answer) };\n  }\n  if (answer.out.length > MAX_DIFF_TEXT_CHARS) {\n    return { kind: \"failed\", reason: \"the body diff exceeds the pack's print cap — read the file\" };\n  }\n  return { kind: \"ok\", diff: answer.out };\n}\n"]}
+{"version":3,"file":"vouched-ancestor.js","sourceRoot":"","sources":["../../../../src/core/provenance/gitq/vouched-ancestor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,aAAa,EAAE,OAAO,EAAkB,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC;;;;;;;;;GASG;AACH,KAAK,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAc;IACrD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,GAAW,EACX,aAAqB;IAErB,qEAAqE;IACrE,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,yCAAyC,EAAE,CAAC;IACtF,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEhC,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE;QAClC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG;KACjE,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1D,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,KAAK,CAAC,UAAU;oBACtB,CAAC,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B;oBAClE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;aACzB,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,SAAS;QAC/B,IACE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,aAAa;YAC1C,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa,EAC7D,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EACJ,OAAO,CAAC,MAAM,GAAG,iBAAiB;YAChC,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,2DAA2D,iBAAiB,mFAAmF;KACtK,CAAC;AACJ,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,GAAW;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,MAAM,iDAAiD,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,yCAAyC,EAAE,CAAC;IACtF,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE;QACrC,qBAAqB,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG;KACnF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;AAC1C,CAAC","sourcesContent":["/**\n * Doc-body ancestry in the DOCS repo — the two git questions behind\n * `loam vouch --pack`'s body delta: which commit last held the body a person\n * vouched for (`findVouchedAncestor`), and what the file's diff from that\n * commit to the working tree says (`bodyDiffText`). Read-only throughout:\n * `rev-parse`/`log`/`show`/`diff`, no checkout, no temp writes.\n *\n * The mechanics are `core/diff/base-git.ts`'s to the letter — literally so:\n * both import the one `gitText`/`GitAnswer`/`declineDetail` set from\n * `../git.js`, so a hardening lands in both or in neither — but the doctrine\n * is deliberately the OPPOSITE consequence. `loam diff` REFUSES when git\n * cannot answer, because a silently empty base would report the whole fleet\n * as added — a lie with a green exit code. The pack DEGRADES to \"full read\"\n * instead: its output is a reading list, and for a reading list the\n * conservative direction — read more, never less — is always honest, the same\n * direction as provenance's existing hash-everything fallback. The shared\n * helpers carry no verdict, so neither module can borrow the other's\n * consequence by accident; each spells its own at its own call sites.\n *\n * The walk is BOUNDED at `ANCESTOR_WALK_CAP` commits. A vouched commit pushed\n * past the cap by a very active docs repo degrades a legitimate incremental\n * read to a full read — safe direction, and the `none` reason names the cap\n * so the human understands why. Within the walk, one commit whose version of\n * the file is absent (git answering \"not here\") is skipped; a git that stops\n * answering mid-walk (spawn error, kill, timeout, output cap) aborts the whole\n * search as `no-git` rather than letting 200 futile spawns each wait out the\n * timeout.\n */\nimport { declineDetail, gitText, type GitAnswer } from \"../git.js\";\nimport { contentDigest } from \"../../document/frontmatter.js\";\n\n/**\n * How many commits touching the file the ancestor search will read before\n * declaring the vouched state unreachable. Past it the answer is `none` — a\n * full read — with a reason that names the cap.\n */\nconst ANCESTOR_WALK_CAP = 200;\n\n/**\n * How much diff text the pack will print. A body diff past this is not a\n * reading list any more — the honest answer is \"read the file\", as `failed`.\n */\nconst MAX_DIFF_TEXT_CHARS = 1024 * 1024;\n\n/**\n * The shared `gitText` (`../git.js`) with colour forced off. base-git's three\n * questions (`rev-parse`/`ls-tree`/`show`) never colour, but this module runs\n * `log` and `diff`, and a user's `color.ui = always` forces SGR escape\n * sequences into their output even on a pipe — which would put terminal codes\n * inside the `--json` payload's diff text and make the 40-hex-anchored log\n * walk silently match nothing on exactly that machine. The flag lives here,\n * not in the shared helper, because it is this module's need, not a property\n * of asking git a question.\n */\nasync function gitPlain(docsDir: string, args: string[]): Promise<GitAnswer> {\n  return gitText(docsDir, [\"-c\", \"color.ui=false\", ...args]);\n}\n\n/**\n * The bytes this commit's blob would carry on a CRLF checkout. The stamped\n * `content_digest` is byte-exact over the WORKING-TREE file (document/frontmatter.ts), while\n * `git show` hands back the BLOB — and on a Windows checkout with\n * `core.autocrlf=true` the blob is LF where every working-tree byte is CRLF,\n * so the exact digest of the blob would never equal a stamp taken over the\n * same content and every vouched ancestor would be invisible on exactly those\n * machines. Same hazard, same direction as `core/verify/pins/pin.ts`'s\n * `pinnedDigest`, resolved the inverse way because the stamp's recipe is\n * published and cannot be re-normalized after the fact: instead of\n * normalizing both sides, the search hashes each candidate twice — as the\n * blob is, and as its CRLF checkout rendering — and a match on either is a\n * match. Only lone LFs are rewritten, so a blob that already carries CRLFs\n * (committed without the clean filter, hence byte-identical on disk) is\n * covered by the exact hash.\n */\nfunction checkoutRendering(text: string): string {\n  return text.replace(/(?<!\\r)\\n/g, \"\\r\\n\");\n}\n\nexport type AncestorSearch =\n  | {\n      kind: \"found\";\n      commit: string;\n      /** The file exactly as that commit holds it — what the section delta reads. */\n      text: string;\n    }\n  /** The walk completed and nothing matched — the honest verdict is a full read. */\n  | { kind: \"none\"; reason: string }\n  /** Git declined somewhere the walk could not continue past — also a full read. */\n  | { kind: \"no-git\"; detail: string };\n\n/**\n * The last commit in the docs repo's history whose version of `rel` (a\n * docs-relative, `/`-separated path) has a body hashing to the stamped\n * `content_digest` — newest first, because the reading list wants the\n * SHORTEST honest diff, and any older commit holding the same bytes yields\n * the same one.\n */\nexport async function findVouchedAncestor(\n  docsDir: string,\n  rel: string,\n  stampedDigest: string,\n): Promise<AncestorSearch> {\n  // Belt to the callers' braces: `rel` is derived from loam's own path\n  // spelling, never argv, but every spelled pathspec below rides an argv, so\n  // an option-shaped or empty value is refused here rather than parsed by\n  // git as a flag. Same reason base-git.ts refuses option-shaped refs.\n  if (rel.trim() === \"\" || rel.startsWith(\"-\")) {\n    return { kind: \"no-git\", detail: `'${rel}' is not a path git can be asked about.` };\n  }\n  // `--show-prefix` first, and not decoration (base-git.ts proved this): a\n  // docs repo checked out as a subdirectory of a larger repository answers\n  // `show` only under that prefix, and a walk whose paths all miss would\n  // report \"no vouched ancestor\" about a history that holds one.\n  const where = await gitPlain(docsDir, [\"rev-parse\", \"--show-prefix\"]);\n  if (where.spawnError !== undefined || where.code !== 0) {\n    return { kind: \"no-git\", detail: declineDetail(where) };\n  }\n  const prefix = where.out.trim();\n\n  // The pathspec is cwd-relative (no prefix — `log` resolves it against the\n  // cwd, unlike `show`'s repo-root spelling below). `-n` is the walk's bound.\n  const log = await gitPlain(docsDir, [\n    \"log\", \"-n\", String(ANCESTOR_WALK_CAP), \"--format=%H\", \"--\", rel,\n  ]);\n  if (log.spawnError !== undefined || log.code !== 0 || log.overflowed) {\n    return { kind: \"no-git\", detail: declineDetail(log) };\n  }\n  // Only shas shaped like shas walk on — an unexpected line yields a shorter\n  // walk, never a malformed argv (the gitq/moves.ts token-anchoring rule).\n  const commits = log.out.split(\"\\n\").map((l) => l.trim()).filter((l) => /^[0-9a-f]{40}$/.test(l));\n  // Sequential on purpose: newest-first order is the answer's definition, and\n  // the walk stops at the first match — a fan-out would read history it does\n  // not need and could answer with an older commit than the newest match.\n  for (const commit of commits) {\n    const shown = await gitPlain(docsDir, [\"show\", `${commit}:${prefix}${rel}`]);\n    if (shown.spawnError !== undefined || shown.code === null) {\n      // Git stopped answering (not installed mid-walk, killed, timed out, or\n      // the output cap fired on a monstrous version). Abort rather than walk\n      // on: each further spawn could wait out the whole timeout, and a \"none\"\n      // built over commits nobody read would claim the history was searched.\n      return {\n        kind: \"no-git\",\n        detail: shown.overflowed\n          ? `the file at ${commit.slice(0, 12)} exceeds the git output cap.`\n          : declineDetail(shown),\n      };\n    }\n    // A real non-zero exit is git ANSWERING — the file is absent at this\n    // commit (renamed since, or the commit only deleted it). Skip it.\n    if (shown.code !== 0) continue;\n    if (\n      contentDigest(shown.out) === stampedDigest ||\n      contentDigest(checkoutRendering(shown.out)) === stampedDigest\n    ) {\n      return { kind: \"found\", commit, text: shown.out };\n    }\n  }\n  return {\n    kind: \"none\",\n    reason:\n      commits.length < ANCESTOR_WALK_CAP\n        ? \"body has no vouched ancestor in history\"\n        : `body has no vouched ancestor in history — only the last ${ANCESTOR_WALK_CAP} commits touching the file were walked, and the vouched state may lie beyond them`,\n  };\n}\n\nexport type BodyDiff =\n  | { kind: \"ok\"; diff: string }\n  /** No diff to print — the honest degrade is a full read, with this reason. */\n  | { kind: \"failed\"; reason: string };\n\n/**\n * The file's diff from its last vouched state: `git diff <commit> -- <rel>`,\n * commit-to-working-tree, in the docs repo. The output is git's own — when a\n * hand edit touched the frontmatter after the vouch, its hunks ride along,\n * which is why the pack's prose says \"the file's diff\", never \"the body's\".\n */\nexport async function bodyDiffText(docsDir: string, commit: string, rel: string): Promise<BodyDiff> {\n  // The commit came out of `findVouchedAncestor`'s own regex-vetted walk, but\n  // this function is exported API: re-vet, so no future caller can place an\n  // option-shaped string in the one argv slot that is not behind `--`.\n  if (!/^[0-9a-f]{40}$/.test(commit)) {\n    return { kind: \"failed\", reason: `'${commit}' is not a commit this diff can be asked about.` };\n  }\n  if (rel.trim() === \"\" || rel.startsWith(\"-\")) {\n    return { kind: \"failed\", reason: `'${rel}' is not a path git can be asked about.` };\n  }\n  // `--no-optional-locks`: a commit-to-worktree diff may opportunistically\n  // refresh `.git/index`'s stat cache, which is a WRITE — small, benign, and\n  // exactly what a command documented as \"writes nothing\" must not do. The\n  // global flag tells git to skip any operation that would take a lock it\n  // does not strictly need. `--no-ext-diff --no-textconv` close the rest of\n  // the config surface: `diff.external` / a `.gitattributes` diff driver make\n  // `git diff` EXECUTE a user-configured program instead of printing a diff —\n  // an arbitrary write hazard on a read-only path, and output no machine\n  // consumer of `body.diff` could parse. The pack's diff is a machine\n  // artifact, not a terminal rendering; git's own plumbing flags say so.\n  const answer = await gitPlain(docsDir, [\n    \"--no-optional-locks\", \"diff\", \"--no-ext-diff\", \"--no-textconv\", commit, \"--\", rel,\n  ]);\n  if (answer.spawnError !== undefined || answer.code !== 0 || answer.overflowed) {\n    return { kind: \"failed\", reason: declineDetail(answer) };\n  }\n  if (answer.out.length > MAX_DIFF_TEXT_CHARS) {\n    return { kind: \"failed\", reason: \"the body diff exceeds the pack's print cap — read the file\" };\n  }\n  return { kind: \"ok\", diff: answer.out };\n}\n"]}

package/dist/core/provenance/sources.js

@@ -10,7 +10,7 @@ import { listField, stringField } from "../document/frontmatter.js";
 import { resolveInside } from "../kernel/path-safety.js";
 import { decodeSourceIndex, movedSources, sourcesDigest } from "./stamp.js";
 import { gitTrackedFiles } from "./git.js";
-export async function sourceFindings(fm, service, label, repoDir) {
+export async function sourceFindings(fm, service, label, repo) {
     const sources = listField(fm, "sources");
     if (sources.length === 0) {
         return [
@@ -22,8 +22,9 @@ export async function sourceFindings(fm, service, label, repoDir) {
         ];
     }
     // Someone else's repository: the paths describe a tree loam is not standing in.
-    if (repoDir === undefined)
+    if (repo === undefined)
         return [];
+    const repoDir = repo.dir;
     // Before existence: a pattern entry would "not exist" as a literal path, and
     // grading it missing would send the author fixing the wrong thing.
     const patterns = patternSources(sources);
@@ -76,7 +77,7 @@ export async function sourceFindings(fm, service, label, repoDir) {
     const findings = [
         resolved,
         ...skippedFindings(skipped, label),
-        ...(await walkFindings(repoDir, files, label)),
+        ...(await walkFindings(repo, files, label)),
     ];
     // The paths are there; the question staleness answers is whether what is AT
     // them is still what somebody read.
@@ -154,10 +155,26 @@ function topLevel(path) {
  * owes, and the hand-back says so in one sentence, or the walk stopped early.
  * The ratio still rides along in the message as a dial, where it informs
  * without grading.
+ *
+ * Two kinds of tracked file are NOT the service, and the denominator leaves
+ * them out — both by a rule that needs no list of what source looks like:
+ *
+ *   - loam's OWN files: `loam.json` and the agent files `loam init` recorded in
+ *     it (`SourcesRepo.loamOwned`). loam wrote them and knows they hold nothing
+ *     a spec owes; counting them made the warning fire in every service repo
+ *     straight after a fresh vouch, with no honest way to clear it — listing
+ *     loam.json in `sources` would stale the digest on every `loam init`.
+ *   - `.gitignore`, at any depth: it is the file that DEFINES this check's
+ *     denominator — what git considers the repository's own — so it is the
+ *     measuring instrument, not a part of the service anybody could owe a
+ *     reading of. The line is deliberately that narrow: `package.json`, a
+ *     README or `.github/` are the author's call (they can hold what a spec
+ *     owes), so they stay in and are answered in the hand-back as before.
  */
-async function walkFindings(repoDir, covered, label) {
-    const tracked = await gitTrackedFiles(repoDir);
-    if (tracked === null || tracked.length === 0)
+async function walkFindings(repo, covered, label) {
+    const owned = new Set(repo.loamOwned);
+    const tracked = (await gitTrackedFiles(repo.dir))?.filter((p) => !owned.has(p) && p !== ".gitignore" && !p.endsWith("/.gitignore"));
+    if (tracked === undefined || tracked.length === 0)
         return [];
     // The honest intersection, not "every file under a directory somebody
     // touched": reading one file in src/ does not make the other four hundred

package/dist/core/provenance/sources.js.map

@@ -1 +1 @@
-{"version":3,"file":"sources.js","sourceRoot":"","sources":["../../../src/core/provenance/sources.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoB,MAAM,4BAA4B,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAe,EACf,OAAe,EACf,KAAa,EACb,OAA2B;IAE3B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL;gBACE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,KAAK,mGAAmG;aACrH;SACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAErC,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,QAAQ,CAAC,MAAM,kCAAkC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mHAAmH;gBAC7M,OAAO,EAAE,QAAQ;gBACjB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,MAAM,CAAC,MAAM,wCAAwC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;gBACxL,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrF,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAY;QACxB,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,oBAAoB;KACzD,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAc;QAC1B,QAAQ;QACR,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC;QAClC,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KAC/C,CAAC;IAEF,4EAA4E;IAC5E,oCAAoC;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,GAAG,QAAQ;YACX;gBACE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,GAAG,KAAK,8IAA8I,OAAO,KAAK;aAC5K;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,gBAAgB,CAAC;IACnE,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,QAAQ;YACX;gBACE,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG,KAAK,6BAA6B,KAAK,KAAK,KAAK,CAAC,MAAM,oBAAoB,MAAM,GAAG;aAClG;SACF,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,oCAAoC;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,OAAO;QACL,GAAG,QAAQ;QACX;YACE,yEAAyE;YACzE,2EAA2E;YAC3E,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,KAAK,2BAA2B,KAAK,GAAG,KAAK,CAAC,OAAO,wCAAwC,OAAO,wDAAwD,OAAO,IAAI;YACnL,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO;YAC/B,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,OAAiB,EAAE,KAAa;IAC3E,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExD,sEAAsE;IACtE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC;IAE5E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL;gBACE,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,KAAK,qEAAqE,KAAK,GAAG;aAC/F;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EACL,GAAG,KAAK,mBAAmB,KAAK,SAAS,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,wCAAwC;gBACzG,iHAAiH;gBACjH,+CAA+C;YACjD,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAwB,EAAE,KAAa;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,uGAAuG;YAC3I,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACtD,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,OAAiB;IAC9C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAAiB;IAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAiB;IAC9D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * The `sources` list: vetting the entries an author wrote — patterns, escapes,\n * missing paths, the refusal vocabulary `loam vouch` and `loam validate` share\n * — and grading the vetted list against the service repo: resolved, unvouched,\n * current, stale, and whether the walk reached the whole repository. Vetting\n * and grading are one doctrine about one field, so they live in one file.\n */\nimport { existsSync } from \"node:fs\";\nimport { listField, stringField, type Frontmatter } from \"../document/frontmatter.js\";\nimport type { Finding } from \"../vocabulary/report.js\";\nimport { resolveInside } from \"../kernel/path-safety.js\";\nimport { decodeSourceIndex, movedSources, sourcesDigest } from \"./stamp.js\";\nimport type { SkippedSource } from \"./walk.js\";\nimport { gitTrackedFiles } from \"./git.js\";\n\nexport async function sourceFindings(\n  fm: Frontmatter,\n  service: string,\n  label: string,\n  repoDir: string | undefined,\n): Promise<Finding[]> {\n  const sources = listField(fm, \"sources\");\n  if (sources.length === 0) {\n    return [\n      {\n        severity: \"warn\",\n        code: \"sources.absent\",\n        message: `${label} names no sources — nothing ties it to the code, so nothing can tell you when it goes out of date`,\n      },\n    ];\n  }\n  // Someone else's repository: the paths describe a tree loam is not standing in.\n  if (repoDir === undefined) return [];\n\n  // Before existence: a pattern entry would \"not exist\" as a literal path, and\n  // grading it missing would send the author fixing the wrong thing.\n  const patterns = patternSources(sources);\n  if (patterns.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-missing\",\n        message: `${label}: ${patterns.length} source(s) are glob patterns — ${patterns.join(\", \")}. Patterns are no longer supported: name files or directories (a directory already covers everything beneath it).`,\n        details: patterns,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n\n  const unsafe = unsafeSources(repoDir, sources);\n  if (unsafe.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-outside\",\n        message: `${label}: ${unsafe.length} source(s) escape the service repo — ${unsafe.join(\", \")}. Sources must be relative paths contained by this repository, including through symlinks.`,\n        details: unsafe,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n\n  const missing = missingSources(repoDir, sources);\n  if (missing.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-missing\",\n        message: `${label}: ${missing.length} source(s) do not exist — ${missing.join(\", \")}`,\n        details: missing,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n  const resolved: Finding = {\n    severity: \"ok\",\n    code: \"sources.resolved\",\n    message: `${label}: ${sources.length} source(s) resolve`,\n  };\n\n  // The walk happens here rather than inside the staleness branch below, even\n  // though only staleness needs the hashes: what the walk REFUSED to follow is\n  // a hole in the tie to the code whether or not anybody has vouched yet, and\n  // an unvouched service is exactly where a reader is about to decide the\n  // sources list is honest.\n  const { digest, files, index, skipped } = await sourcesDigest(repoDir, sources);\n  const findings: Finding[] = [\n    resolved,\n    ...skippedFindings(skipped, label),\n    ...(await walkFindings(repoDir, files, label)),\n  ];\n\n  // The paths are there; the question staleness answers is whether what is AT\n  // them is still what somebody read.\n  const stamped = stringField(fm, \"sources_digest\");\n  if (stamped === undefined) {\n    return [\n      ...findings,\n      {\n        severity: \"warn\",\n        code: \"sources.unvouched\",\n        message: `${label}: no sources_digest — nobody has vouched for this against the code, so nothing can tell you when it goes stale. Run \\`loam vouch --service ${service}\\`.`,\n      },\n    ];\n  }\n\n  const since = stringField(fm, \"last_verified\") ?? \"it was stamped\";\n  if (digest === stamped) {\n    return [\n      ...findings,\n      {\n        severity: \"ok\",\n        code: \"sources.current\",\n        message: `${label}: sources unchanged since ${since} (${files.length} file(s), digest ${digest})`,\n      },\n    ];\n  }\n\n  // What MOVED, when the stamp recorded enough to say. Repeating the frontmatter's\n  // own `sources` entries back at a reader — which is all this finding could do\n  // before `sources_files` existed — answers a question nobody asked: they wrote\n  // that list, and \"one of these five directories changed somehow\" is where the\n  // search starts, not where it ends.\n  const moved = movedSources(decodeSourceIndex(stringField(fm, \"sources_files\")), index);\n  return [\n    ...findings,\n    {\n      // A warning, not an error: the doc may still be right, and only a person\n      // can say. What loam knows is that nobody has looked since the code moved.\n      severity: \"warn\",\n      code: \"sources.stale\",\n      message: `${label}: sources changed since ${since}${moved.summary} — run \\`loam vouch --pack --service ${service}\\` for the reading list, then \\`loam vouch --service ${service}\\``,\n      details: moved.paths ?? sources,\n      text: { detailPrefix: \"- \" },\n    },\n  ];\n}\n\n/** The first path segment — the top-level directory, or a root file's own name. */\nfunction topLevel(path: string): string {\n  const cut = path.indexOf(\"/\");\n  return cut === -1 ? path : path.slice(0, cut);\n}\n\n/**\n * Was the service WALKED, or only the part somebody wrote about?\n *\n * Every other check loam owns is computed from the documents, so a corpus can\n * agree with itself perfectly while describing a third of a service — the\n * failure `UNCHECKED` names as COMPLETENESS and then, correctly, declines to\n * grade. This is the one measurement that escapes that circle, because it\n * compares the document's `sources` against the REPOSITORY: a top-level path\n * git tracks and no source reaches into is a part of the service nobody opened.\n *\n * git is the denominator on purpose. The alternative is walking the tree and\n * excluding what does not look like source, which means a hand-maintained list\n * of build directories that is wrong for the first language nobody thought of —\n * and a check that is wrong for a whole ecosystem is a warning that ecosystem\n * learns to ignore. `git ls-files` already answers \"what does this repository\n * consider its own\", it is the author's own answer, and `node_modules` and\n * `target/` fall out of it for free. Where git cannot answer — not a\n * repository, not installed, a timeout — there is no denominator and therefore\n * no finding: proving nothing and saying nothing is the same doctrine\n * `sources.unverifiable-from-here` follows.\n *\n * TOP-LEVEL granularity, not a percentage threshold. A ratio needs a line\n * drawn somewhere, and an invented threshold is exactly the number this\n * codebase refuses to write into other people's dashboards; a named directory\n * needs no threshold and is answerable — either it holds nothing this document\n * owes, and the hand-back says so in one sentence, or the walk stopped early.\n * The ratio still rides along in the message as a dial, where it informs\n * without grading.\n */\nasync function walkFindings(repoDir: string, covered: string[], label: string): Promise<Finding[]> {\n  const tracked = await gitTrackedFiles(repoDir);\n  if (tracked === null || tracked.length === 0) return [];\n\n  // The honest intersection, not \"every file under a directory somebody\n  // touched\": reading one file in src/ does not make the other four hundred\n  // read, and a coverage number that says it does is worse than none.\n  const coveredSet = new Set(covered);\n  const hit = tracked.filter((p) => coveredSet.has(p)).length;\n  const ratio = `${String(hit)} of ${String(tracked.length)} tracked file(s)`;\n\n  const touched = new Set(covered.map(topLevel));\n  const untouched = [...new Set(tracked.map(topLevel))].filter((t) => !touched.has(t)).sort();\n  if (untouched.length === 0) {\n    return [\n      {\n        severity: \"ok\",\n        code: \"sources.walked\",\n        message: `${label}: sources reach into every top-level path this repository tracks (${ratio})`,\n      },\n    ];\n  }\n  return [\n    {\n      severity: \"warn\",\n      code: \"sources.unwalked\",\n      message:\n        `${label}: sources cover ${ratio}, and ${String(untouched.length)} top-level path(s) were never opened. ` +\n        `Either they hold nothing this document owes — say which, and why, in the hand-back — or the walk stopped early ` +\n        `and the baseline describes part of a service.`,\n      details: untouched,\n      text: { detailPrefix: \"- \" },\n    },\n  ];\n}\n\n/**\n * The paths the digest walk would not follow. Never silent: a symlink dropped\n * on the floor is a file whose content nobody is watching, while the document\n * beside it says `verified` — the digest cannot go stale over bytes it never\n * hashed, so the one thing the stamp promises is quietly untrue for them.\n *\n * A warning, not an error, and for the same reason staleness is: the doc may be\n * perfectly right about the code behind that link. What loam can say is that it\n * is not watching it.\n */\nfunction skippedFindings(skipped: SkippedSource[], label: string): Finding[] {\n  if (skipped.length === 0) return [];\n  return [\n    {\n      severity: \"warn\",\n      code: \"sources.skipped\",\n      message: `${label}: ${skipped.length} path(s) under the listed sources were not hashed — the digest says nothing about what is behind them`,\n      details: skipped.map((s) => `${s.path} — ${s.reason}`),\n      text: { detailPrefix: \"- \" },\n    },\n  ];\n}\n\n/** The characters that made an entry a pattern under the glob dialect loam no longer ships. */\nconst PATTERN_CHARS = /[*?[]/;\n\n/**\n * The `sources` entries that look like glob patterns — anything containing\n * `*`, `?` or `[`. Patterns are refused loudly everywhere sources are consumed\n * (`loam vouch` refuses the run, `loam validate` grades an error), never\n * resolved: the glob dialect loam used to ship silently differed from the\n * gitignore/minimatch conventions authors assume — bracket classes literal,\n * its own `**` handling — so a pattern quietly digested a different file set\n * than intended, corrupting the staleness signal in both directions. A\n * directory already means \"everything beneath it\", so the fix is to name one.\n *\n * The cost accepted with the rule: a real file with `[` in its name (a Next.js\n * route, say) cannot be listed on its own — its parent directory covers it.\n */\nexport function patternSources(sources: string[]): string[] {\n  return sources.filter((s) => PATTERN_CHARS.test(s.trim()));\n}\n\n/** The `sources` entries that resolve to nothing in this repo. */\nexport function missingSources(repoDir: string, sources: string[]): string[] {\n  return sources.filter((s) => !sourceExists(repoDir, s));\n}\n\n/** Entries that are absolute, traverse upward, or escape through a symlink. */\nexport function unsafeSources(repoDir: string, sources: string[]): string[] {\n  return sources.filter((source) => {\n    const cleaned = source.trim();\n    if (cleaned.length === 0) return false;\n    try {\n      resolveInside(repoDir, cleaned, `source '${source}'`);\n      return false;\n    } catch {\n      return true;\n    }\n  });\n}\n\n/** Does a `sources` entry point at something real? Literal paths only, checked exactly. */\nfunction sourceExists(repoDir: string, source: string): boolean {\n  const cleaned = source.trim();\n  if (cleaned.length === 0) return false;\n  try {\n    return existsSync(resolveInside(repoDir, cleaned, `source '${source}'`));\n  } catch {\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"sources.js","sourceRoot":"","sources":["../../../src/core/provenance/sources.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoB,MAAM,4BAA4B,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAgB3C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAe,EACf,OAAe,EACf,KAAa,EACb,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL;gBACE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,KAAK,mGAAmG;aACrH;SACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;IAEzB,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,QAAQ,CAAC,MAAM,kCAAkC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mHAAmH;gBAC7M,OAAO,EAAE,QAAQ;gBACjB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,MAAM,CAAC,MAAM,wCAAwC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;gBACxL,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrF,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAY;QACxB,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,oBAAoB;KACzD,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAc;QAC1B,QAAQ;QACR,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC;QAClC,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;KAC5C,CAAC;IAEF,4EAA4E;IAC5E,oCAAoC;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,GAAG,QAAQ;YACX;gBACE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,GAAG,KAAK,8IAA8I,OAAO,KAAK;aAC5K;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,gBAAgB,CAAC;IACnE,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,QAAQ;YACX;gBACE,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG,KAAK,6BAA6B,KAAK,KAAK,KAAK,CAAC,MAAM,oBAAoB,MAAM,GAAG;aAClG;SACF,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,oCAAoC;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,OAAO;QACL,GAAG,QAAQ;QACX;YACE,yEAAyE;YACzE,2EAA2E;YAC3E,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,KAAK,2BAA2B,KAAK,GAAG,KAAK,CAAC,OAAO,wCAAwC,OAAO,wDAAwD,OAAO,IAAI;YACnL,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO;YAC/B,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,KAAK,UAAU,YAAY,CAAC,IAAiB,EAAE,OAAiB,EAAE,KAAa;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CACzE,CAAC;IACF,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE7D,sEAAsE;IACtE,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC;IAE5E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL;gBACE,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,KAAK,qEAAqE,KAAK,GAAG;aAC/F;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EACL,GAAG,KAAK,mBAAmB,KAAK,SAAS,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,wCAAwC;gBACzG,iHAAiH;gBACjH,+CAA+C;YACjD,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAwB,EAAE,KAAa;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,uGAAuG;YAC3I,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACtD,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,OAAiB;IAC9C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAAiB;IAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAiB;IAC9D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * The `sources` list: vetting the entries an author wrote — patterns, escapes,\n * missing paths, the refusal vocabulary `loam vouch` and `loam validate` share\n * — and grading the vetted list against the service repo: resolved, unvouched,\n * current, stale, and whether the walk reached the whole repository. Vetting\n * and grading are one doctrine about one field, so they live in one file.\n */\nimport { existsSync } from \"node:fs\";\nimport { listField, stringField, type Frontmatter } from \"../document/frontmatter.js\";\nimport type { Finding } from \"../vocabulary/report.js\";\nimport { resolveInside } from \"../kernel/path-safety.js\";\nimport { decodeSourceIndex, movedSources, sourcesDigest } from \"./stamp.js\";\nimport type { SkippedSource } from \"./walk.js\";\nimport { gitTrackedFiles } from \"./git.js\";\n\n/**\n * The service repository `sources` resolve against, as the walk check needs\n * it: where it is, and which files in it are loam's own.\n */\nexport interface SourcesRepo {\n  dir: string;\n  /**\n   * Repo-relative paths loam wrote and owns there — its `loam.json` and the\n   * agent files `loam init` recorded in it. No `sources` list owes a reading of\n   * them, so `walkFindings` leaves them out of its denominator.\n   */\n  loamOwned: readonly string[];\n}\n\nexport async function sourceFindings(\n  fm: Frontmatter,\n  service: string,\n  label: string,\n  repo: SourcesRepo | undefined,\n): Promise<Finding[]> {\n  const sources = listField(fm, \"sources\");\n  if (sources.length === 0) {\n    return [\n      {\n        severity: \"warn\",\n        code: \"sources.absent\",\n        message: `${label} names no sources — nothing ties it to the code, so nothing can tell you when it goes out of date`,\n      },\n    ];\n  }\n  // Someone else's repository: the paths describe a tree loam is not standing in.\n  if (repo === undefined) return [];\n  const repoDir = repo.dir;\n\n  // Before existence: a pattern entry would \"not exist\" as a literal path, and\n  // grading it missing would send the author fixing the wrong thing.\n  const patterns = patternSources(sources);\n  if (patterns.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-missing\",\n        message: `${label}: ${patterns.length} source(s) are glob patterns — ${patterns.join(\", \")}. Patterns are no longer supported: name files or directories (a directory already covers everything beneath it).`,\n        details: patterns,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n\n  const unsafe = unsafeSources(repoDir, sources);\n  if (unsafe.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-outside\",\n        message: `${label}: ${unsafe.length} source(s) escape the service repo — ${unsafe.join(\", \")}. Sources must be relative paths contained by this repository, including through symlinks.`,\n        details: unsafe,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n\n  const missing = missingSources(repoDir, sources);\n  if (missing.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-missing\",\n        message: `${label}: ${missing.length} source(s) do not exist — ${missing.join(\", \")}`,\n        details: missing,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n  const resolved: Finding = {\n    severity: \"ok\",\n    code: \"sources.resolved\",\n    message: `${label}: ${sources.length} source(s) resolve`,\n  };\n\n  // The walk happens here rather than inside the staleness branch below, even\n  // though only staleness needs the hashes: what the walk REFUSED to follow is\n  // a hole in the tie to the code whether or not anybody has vouched yet, and\n  // an unvouched service is exactly where a reader is about to decide the\n  // sources list is honest.\n  const { digest, files, index, skipped } = await sourcesDigest(repoDir, sources);\n  const findings: Finding[] = [\n    resolved,\n    ...skippedFindings(skipped, label),\n    ...(await walkFindings(repo, files, label)),\n  ];\n\n  // The paths are there; the question staleness answers is whether what is AT\n  // them is still what somebody read.\n  const stamped = stringField(fm, \"sources_digest\");\n  if (stamped === undefined) {\n    return [\n      ...findings,\n      {\n        severity: \"warn\",\n        code: \"sources.unvouched\",\n        message: `${label}: no sources_digest — nobody has vouched for this against the code, so nothing can tell you when it goes stale. Run \\`loam vouch --service ${service}\\`.`,\n      },\n    ];\n  }\n\n  const since = stringField(fm, \"last_verified\") ?? \"it was stamped\";\n  if (digest === stamped) {\n    return [\n      ...findings,\n      {\n        severity: \"ok\",\n        code: \"sources.current\",\n        message: `${label}: sources unchanged since ${since} (${files.length} file(s), digest ${digest})`,\n      },\n    ];\n  }\n\n  // What MOVED, when the stamp recorded enough to say. Repeating the frontmatter's\n  // own `sources` entries back at a reader — which is all this finding could do\n  // before `sources_files` existed — answers a question nobody asked: they wrote\n  // that list, and \"one of these five directories changed somehow\" is where the\n  // search starts, not where it ends.\n  const moved = movedSources(decodeSourceIndex(stringField(fm, \"sources_files\")), index);\n  return [\n    ...findings,\n    {\n      // A warning, not an error: the doc may still be right, and only a person\n      // can say. What loam knows is that nobody has looked since the code moved.\n      severity: \"warn\",\n      code: \"sources.stale\",\n      message: `${label}: sources changed since ${since}${moved.summary} — run \\`loam vouch --pack --service ${service}\\` for the reading list, then \\`loam vouch --service ${service}\\``,\n      details: moved.paths ?? sources,\n      text: { detailPrefix: \"- \" },\n    },\n  ];\n}\n\n/** The first path segment — the top-level directory, or a root file's own name. */\nfunction topLevel(path: string): string {\n  const cut = path.indexOf(\"/\");\n  return cut === -1 ? path : path.slice(0, cut);\n}\n\n/**\n * Was the service WALKED, or only the part somebody wrote about?\n *\n * Every other check loam owns is computed from the documents, so a corpus can\n * agree with itself perfectly while describing a third of a service — the\n * failure `UNCHECKED` names as COMPLETENESS and then, correctly, declines to\n * grade. This is the one measurement that escapes that circle, because it\n * compares the document's `sources` against the REPOSITORY: a top-level path\n * git tracks and no source reaches into is a part of the service nobody opened.\n *\n * git is the denominator on purpose. The alternative is walking the tree and\n * excluding what does not look like source, which means a hand-maintained list\n * of build directories that is wrong for the first language nobody thought of —\n * and a check that is wrong for a whole ecosystem is a warning that ecosystem\n * learns to ignore. `git ls-files` already answers \"what does this repository\n * consider its own\", it is the author's own answer, and `node_modules` and\n * `target/` fall out of it for free. Where git cannot answer — not a\n * repository, not installed, a timeout — there is no denominator and therefore\n * no finding: proving nothing and saying nothing is the same doctrine\n * `sources.unverifiable-from-here` follows.\n *\n * TOP-LEVEL granularity, not a percentage threshold. A ratio needs a line\n * drawn somewhere, and an invented threshold is exactly the number this\n * codebase refuses to write into other people's dashboards; a named directory\n * needs no threshold and is answerable — either it holds nothing this document\n * owes, and the hand-back says so in one sentence, or the walk stopped early.\n * The ratio still rides along in the message as a dial, where it informs\n * without grading.\n *\n * Two kinds of tracked file are NOT the service, and the denominator leaves\n * them out — both by a rule that needs no list of what source looks like:\n *\n *   - loam's OWN files: `loam.json` and the agent files `loam init` recorded in\n *     it (`SourcesRepo.loamOwned`). loam wrote them and knows they hold nothing\n *     a spec owes; counting them made the warning fire in every service repo\n *     straight after a fresh vouch, with no honest way to clear it — listing\n *     loam.json in `sources` would stale the digest on every `loam init`.\n *   - `.gitignore`, at any depth: it is the file that DEFINES this check's\n *     denominator — what git considers the repository's own — so it is the\n *     measuring instrument, not a part of the service anybody could owe a\n *     reading of. The line is deliberately that narrow: `package.json`, a\n *     README or `.github/` are the author's call (they can hold what a spec\n *     owes), so they stay in and are answered in the hand-back as before.\n */\nasync function walkFindings(repo: SourcesRepo, covered: string[], label: string): Promise<Finding[]> {\n  const owned = new Set(repo.loamOwned);\n  const tracked = (await gitTrackedFiles(repo.dir))?.filter(\n    (p) => !owned.has(p) && p !== \".gitignore\" && !p.endsWith(\"/.gitignore\"),\n  );\n  if (tracked === undefined || tracked.length === 0) return [];\n\n  // The honest intersection, not \"every file under a directory somebody\n  // touched\": reading one file in src/ does not make the other four hundred\n  // read, and a coverage number that says it does is worse than none.\n  const coveredSet = new Set(covered);\n  const hit = tracked.filter((p) => coveredSet.has(p)).length;\n  const ratio = `${String(hit)} of ${String(tracked.length)} tracked file(s)`;\n\n  const touched = new Set(covered.map(topLevel));\n  const untouched = [...new Set(tracked.map(topLevel))].filter((t) => !touched.has(t)).sort();\n  if (untouched.length === 0) {\n    return [\n      {\n        severity: \"ok\",\n        code: \"sources.walked\",\n        message: `${label}: sources reach into every top-level path this repository tracks (${ratio})`,\n      },\n    ];\n  }\n  return [\n    {\n      severity: \"warn\",\n      code: \"sources.unwalked\",\n      message:\n        `${label}: sources cover ${ratio}, and ${String(untouched.length)} top-level path(s) were never opened. ` +\n        `Either they hold nothing this document owes — say which, and why, in the hand-back — or the walk stopped early ` +\n        `and the baseline describes part of a service.`,\n      details: untouched,\n      text: { detailPrefix: \"- \" },\n    },\n  ];\n}\n\n/**\n * The paths the digest walk would not follow. Never silent: a symlink dropped\n * on the floor is a file whose content nobody is watching, while the document\n * beside it says `verified` — the digest cannot go stale over bytes it never\n * hashed, so the one thing the stamp promises is quietly untrue for them.\n *\n * A warning, not an error, and for the same reason staleness is: the doc may be\n * perfectly right about the code behind that link. What loam can say is that it\n * is not watching it.\n */\nfunction skippedFindings(skipped: SkippedSource[], label: string): Finding[] {\n  if (skipped.length === 0) return [];\n  return [\n    {\n      severity: \"warn\",\n      code: \"sources.skipped\",\n      message: `${label}: ${skipped.length} path(s) under the listed sources were not hashed — the digest says nothing about what is behind them`,\n      details: skipped.map((s) => `${s.path} — ${s.reason}`),\n      text: { detailPrefix: \"- \" },\n    },\n  ];\n}\n\n/** The characters that made an entry a pattern under the glob dialect loam no longer ships. */\nconst PATTERN_CHARS = /[*?[]/;\n\n/**\n * The `sources` entries that look like glob patterns — anything containing\n * `*`, `?` or `[`. Patterns are refused loudly everywhere sources are consumed\n * (`loam vouch` refuses the run, `loam validate` grades an error), never\n * resolved: the glob dialect loam used to ship silently differed from the\n * gitignore/minimatch conventions authors assume — bracket classes literal,\n * its own `**` handling — so a pattern quietly digested a different file set\n * than intended, corrupting the staleness signal in both directions. A\n * directory already means \"everything beneath it\", so the fix is to name one.\n *\n * The cost accepted with the rule: a real file with `[` in its name (a Next.js\n * route, say) cannot be listed on its own — its parent directory covers it.\n */\nexport function patternSources(sources: string[]): string[] {\n  return sources.filter((s) => PATTERN_CHARS.test(s.trim()));\n}\n\n/** The `sources` entries that resolve to nothing in this repo. */\nexport function missingSources(repoDir: string, sources: string[]): string[] {\n  return sources.filter((s) => !sourceExists(repoDir, s));\n}\n\n/** Entries that are absolute, traverse upward, or escape through a symlink. */\nexport function unsafeSources(repoDir: string, sources: string[]): string[] {\n  return sources.filter((source) => {\n    const cleaned = source.trim();\n    if (cleaned.length === 0) return false;\n    try {\n      resolveInside(repoDir, cleaned, `source '${source}'`);\n      return false;\n    } catch {\n      return true;\n    }\n  });\n}\n\n/** Does a `sources` entry point at something real? Literal paths only, checked exactly. */\nfunction sourceExists(repoDir: string, source: string): boolean {\n  const cleaned = source.trim();\n  if (cleaned.length === 0) return false;\n  try {\n    return existsSync(resolveInside(repoDir, cleaned, `source '${source}'`));\n  } catch {\n    return false;\n  }\n}\n"]}

package/dist/core/provenance/stamp.js

@@ -1,12 +1,13 @@
 /**
  * The stamp vocabulary: what `loam vouch` computes for a frontmatter stamp and
  * what a later check reads back out of one — `sources_digest` and the per-file
- * `sources_files` index beside it, the document's own `content_digest`, and
- * the local calendar day `last_verified` carries.
+ * `sources_files` index beside it, and the local calendar day `last_verified`
+ * carries. The document's own `content_digest` lived here too; it moved to
+ * core/document/frontmatter.ts, beside the body cut it hashes, when the fleet
+ * enumeration needed it (`contentDigest`'s docblock says why).
  */
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
-import { rawBody } from "../document/frontmatter.js";
 import { collectSources } from "./walk.js";
 /**
  * The local calendar day, for the two commands that date a stamp. A vouch or a
@@ -20,7 +21,7 @@ export function today(now) {
     return `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;
 }
 /* ------------------------------------------------------------------ */
-/* The content digest                                                  */
+/* The sources digest                                                  */
 /* ------------------------------------------------------------------ */
 /** How much of the sha256 is written into the document. */
 const DIGEST_LENGTH = 16;
@@ -100,19 +101,6 @@ export async function expandSourceFiles(repoDir, sources, label) {
 export function emptySourcesMessage(label, sources) {
     return `${label}: the sources listed match no files — ${sources.join(", ")}. A digest over nothing would read as current forever.`;
 }
-/**
- * The stamp `loam vouch` writes into `content_digest`: sha256 of the
- * document's own BODY — every byte after the frontmatter block (below the
- * closing `---` line and its newline; `rawBody` is the one definition of that
- * cut) — first 16 hex characters, the sources recipe's length.
- *
- * Byte-exact, no normalization. Body-only is load-bearing: vouch itself
- * rewrites the frontmatter as it stamps, and a later frontmatter-only edit
- * (another vouch, a corrected owner) must not read as the document moving.
- */
-export function contentDigest(source) {
-    return createHash("sha256").update(rawBody(source), "utf8").digest("hex").slice(0, DIGEST_LENGTH);
-}
 /* ------------------------------------------------------------------ */
 /* The per-file index: what `sources.stale` names                      */
 /* ------------------------------------------------------------------ */