@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/core/repo/tree/render/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../../../../src/core/repo/tree/render/body.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAa,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAiB3C,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,QAAgB;IAC7D,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;QACpD,UAAU,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9C,gBAAgB,EAAE,CAAC,EAAU,EAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAkB,EAAE,GAAmB;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC3E,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9G,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO;QACL,KAAK;QACL,EAAE,EAAE,IAAI;QACR,UAAU,EACR,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,wBAAwB,MAAM,8CAA8C;KACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,GAAkB,EAAE,GAAmB,EAAE,MAAc;IAC1E,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,UAAU,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,KAAK,MAAM,EAAE,IAAI,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW,EAAE,EAAE,CAAC,CAAC;IACnF,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,SAAS,eAAe,CAAC,GAAkB,EAAE,GAAmB;IAC9D,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;SACzF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,kFAAkF;AAClF,SAAS,oBAAoB,CAAC,GAAkB,EAAE,GAAmB;IACnE,OAAO,aAAa,CAClB,GAAG,EACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,GAAkB,EAAE,GAAmB;IAC7D,OAAO,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAkB,EAAE,QAAyB;IAClE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,GAAkB,EAAE,GAAmB;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACzD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,cAAc,CAAC,GAAkB,EAAE,GAAmB;IAC7D,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC;YAAE,SAAS;QAChF,IAAI,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,GAAkB,EAAE,OAAiB;IAC3D,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;AAC7E,CAAC;AAED,qEAAqE;AACrE,SAAS,aAAa,CAAC,OAAiB;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC,CAAC;YACX,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAkB,EAAE,QAAgB,EAAE,OAA4B;IACrF,MAAM,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACvB,IAAe,EACf,QAAgB,EAChB,OAA+B;IAE/B,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,SAAS,SAAS,CAAC,IAAe,EAAE,GAAmB;IACrD,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * What one subsystem's generated view SHOWS: which boxes it draws around the\n * services beneath a directory, and the one thing it may say about the map.\n *\n * Split from `../views.ts` when that file crossed the 400-line limit: the file\n * render (header, view ids, staleness comparison) and the body render (the\n * boxes) are two subjects, and the seam is exactly where the second one\n * consults the LANDSCAPE. Everything here reads element ids and nothing else —\n * no view is ever parsed (docs/DESIGN.md rule 26), and the generated file\n * stays a pure function of the tree plus the committed map.\n */\nimport { type Elem } from \"../../../c4/likec4.js\";\nimport { serviceResolver } from \"../../../c4/resolve/service.js\";\nimport { servicesUnder, withinSubsystem } from \"../find.js\";\nimport type { FleetTree, SubsystemEntry, WalkedService } from \"../walk.js\";\nimport { subsystemLabel } from \"./text.js\";\n\n/**\n * Everything a view's body needs from the landscape, resolved ONCE: the\n * element standing for each service, every element id the map declares, and\n * whether an element is a service's own box. A record rather than four\n * threaded parameters because the body render recurses down the subsystem\n * subtree and would otherwise sit on the parameter limit at every hop\n * (`docs/CODE-STYLE.md`'s own prescription).\n */\nexport interface RenderContext {\n  tree: FleetTree;\n  elementOf: Map<string, string>;\n  elementIds: ReadonlySet<string>;\n  isServiceElement: (id: string) => boolean;\n}\n\nexport function renderContext(tree: FleetTree, elements: Elem[]): RenderContext {\n  const known: ReadonlySet<string> = new Set(tree.services.map((s) => s.id));\n  const resolve = serviceResolver(elements, known);\n  return {\n    tree,\n    elementOf: elementByService(tree, elements, resolve),\n    elementIds: new Set(elements.map((e) => e.id)),\n    isServiceElement: (id: string): boolean => known.has(resolve(id)),\n  };\n}\n\n/** A view's body lines, the one comment the render may write above it, and its subject. */\nexport interface ViewBody {\n  lines: string[];\n  disclosure: string | null;\n  /**\n   * The element this view is declared `of`, or null when the map holds none\n   * that owns exactly this subsystem. It is computed here rather than by the\n   * file render because `owningAncestor` below already decides it — the same\n   * answer decides which of the three body shapes applies, and two callers\n   * deriving it separately could draw the boundary of one element while\n   * declaring the view of another.\n   */\n  of: string | null;\n}\n\n/**\n * Three shapes, and which one applies is a fact about the landscape rather\n * than a setting:\n *\n *  1. **The model draws this group.** Some ancestor element holds exactly this\n *     subsystem's members and nothing else, so the view includes it beside the\n *     leaves and the renderer nests them inside the box the AUTHOR drew, with\n *     the author's own title. Measured: including the ancestor alone renders\n *     one empty box and the leaves alone render flat — both lines are needed.\n *  2. **The model is flat.** No member element is nested at all, so there is\n *     no authored box to agree with, and the view wraps the members in a\n *     `group '<title>'` of its own — a real named box in the renderer, derived\n *     from the DIRECTORY the services already sit in, mirroring the subtree so\n *     a parent subsystem shows its children as boxes rather than as one pile.\n *     Nothing is invented: the grouping is the tree, and the tree is what this\n *     file has always mirrored.\n *  3. **The model nests them, differently.** The members ARE nested but no\n *     ancestor owns exactly them — the directory tree and the map disagree\n *     about this group. loam draws no box (a synthetic one would silently\n *     replace the author's boundary with the folder's, and the picture would\n *     look the same whether or not the two agree) and writes ONE comment line\n *     saying so, outside the view body. That comment is the whole of loam's\n *     answer to the drift: it grades nothing, it fails nothing, and it appears\n *     in the diff of the very commit that caused it — placement stays a fact\n *     nothing branches on.\n */\nexport function viewBody(ctx: RenderContext, sub: SubsystemEntry): ViewBody {\n  const members = memberElements(ctx, sub);\n  if (members.length === 0) return { lines: [], disclosure: null, of: null };\n  if (members.every((id) => !id.includes(\".\"))) {\n    return { lines: [...groupedBody(ctx, sub, \"    \"), ...boundaryLines(members)], disclosure: null, of: null };\n  }\n  const includes = [...ownedAncestors(ctx, sub), ...members].map((id) => `    include ${id}`);\n  const lines = [...includes, ...boundaryLines(members)];\n  const owner = owningAncestor(ctx, sub);\n  if (owner !== null) return { lines, disclosure: null, of: owner };\n  const shared = sharedAncestor(ctx, members);\n  return {\n    lines,\n    of: null,\n    disclosure:\n      shared === null\n        ? \"model: no boundary — these members do not share a containing element.\"\n        : `model: no boundary — ${shared} also holds services outside this subsystem.`,\n  };\n}\n\n/**\n * What this group TOUCHES: for each member, every edge it has in either\n * direction, so the view answers \"what does payments talk to\" and not only\n * \"who is in payments\".\n *\n * **The measured trap, and it is why these lines are appended by the caller of\n * `groupedBody` rather than inside it:** placed INSIDE the `group { }` block of\n * the flat-map body shape, this exact predicate parses and validates with ZERO\n * errors and draws a false picture. Measured at likec4 1.59.2 on a flat map of\n * `alpha, beta` grouped and `outsider, store` outside it: at view level the two\n * neighbours are drawn with no parent, correctly outside the box; moved inside\n * the `group { }`, both are drawn as CHILDREN of that group — the diagram then\n * claims `outsider` and `store` are part of the subsystem. A maintainer tidying\n * the body by moving these lines next to the includes they refer to would ship\n * that, and nothing anywhere would report it. They belong at view level, always.\n *\n * The WILDCARD is correct here, and that is not an inconsistency with the\n * per-service views, which measure it as a defect (`./service/peers.ts`): at\n * subsystem altitude a counterpart collapsing to its own group box is exactly\n * the sentence \"payments touches identity\", and — once those group boxes are\n * themselves views' subjects (`of <ancestor>`) — it is a click-through into\n * that subsystem. At service altitude the same collapse is a lie about who\n * calls whom.\n *\n * MEMBERS only, never `ownedAncestors`: `-> *` on an authored container pulls\n * in every edge any descendant of it has, and in the `// model: no boundary`\n * shape that container also holds services outside this subsystem — the view\n * would draw traffic that is nobody-here's. Measured at 58 services in 11\n * groups: 13-15 nodes and 31-39 edges per subsystem view, of which 11-12 nodes\n * carry drill-down — the members into their own service views, the neighbouring\n * group boxes into THEIR subsystem views.\n */\nfunction boundaryLines(members: readonly string[]): string[] {\n  return [\"\", ...members.map((id) => `    include ${id} -> *, * -> ${id}`)];\n}\n\n/**\n * The flat-model body: this subsystem as a box, its child subsystems as boxes\n * inside it, its own services as leaves. Recursive, and the recursion is the\n * point — a parent subsystem's view is otherwise one undifferentiated pile of\n * every service beneath it.\n *\n * An empty child renders an empty named box, which is what the tree says: the\n * group exists and holds nothing yet.\n */\nfunction groupedBody(ctx: RenderContext, sub: SubsystemEntry, indent: string): string[] {\n  const inner = `${indent}  `;\n  const out = [`${indent}group '${subsystemLabel(sub)}' {`];\n  for (const child of childSubsystems(ctx, sub)) out.push(...groupedBody(ctx, child, inner));\n  for (const id of directMemberElements(ctx, sub)) out.push(`${inner}include ${id}`);\n  out.push(`${indent}}`);\n  return out;\n}\n\n/** The child subsystems one level down, ordered by name. */\nfunction childSubsystems(ctx: RenderContext, sub: SubsystemEntry): SubsystemEntry[] {\n  return ctx.tree.subsystems\n    .filter((c) => c.path.length === sub.path.length + 1 && withinSubsystem(sub.path, c.path))\n    .sort((a, b) => (a.name < b.name ? -1 : 1));\n}\n\n/** The drawn elements of the services filed in THIS directory, not in a child. */\nfunction directMemberElements(ctx: RenderContext, sub: SubsystemEntry): string[] {\n  return drawnElements(\n    ctx,\n    membersOf(ctx.tree, sub).filter((s) => s.subsystem.length === sub.path.length),\n  );\n}\n\n/** The drawn elements of every service beneath this subsystem, ordered by service id. */\nfunction memberElements(ctx: RenderContext, sub: SubsystemEntry): string[] {\n  return drawnElements(ctx, membersOf(ctx.tree, sub));\n}\n\n/**\n * The element ids these services resolve to. A service the map does not draw\n * is omitted rather than invented: the omission is already an error\n * (`landscape.service-unmodelled`), and rendering only what the committed\n * documents resolve keeps the output a function of committed bytes alone.\n */\nfunction drawnElements(ctx: RenderContext, services: WalkedService[]): string[] {\n  return services.map((s) => ctx.elementOf.get(s.id)).filter((id): id is string => id !== undefined);\n}\n\n/**\n * The boxes a nested-model view draws: this subsystem's own owning ancestor\n * when it has one, plus the owning ancestor of every subsystem beneath it — so\n * a parent view keeps its children's boundaries instead of flattening them\n * into one box. Sorted and de-duplicated, because two subsystems resolve to\n * one element only in a tree that already reports a collision.\n */\nfunction ownedAncestors(ctx: RenderContext, sub: SubsystemEntry): string[] {\n  const found = new Set<string>();\n  for (const candidate of ctx.tree.subsystems) {\n    if (!withinSubsystem(sub.path, candidate.path)) continue;\n    const owner = owningAncestor(ctx, candidate);\n    if (owner !== null) found.add(owner);\n  }\n  return [...found].sort();\n}\n\n/**\n * The deepest ancestor element that holds exactly this subsystem's members —\n * or null when no element does.\n *\n * \"Exactly\" is the whole guard, and dropping it was measured on loam's own\n * `examples/docs`: the members' longest common ancestor there is a group of\n * five services while the subsystem holds two, so an unguarded include would\n * generate a box labelled for the group with two of its five children drawn\n * inside it — a diagram asserting something false, in a file the reader is\n * told not to edit. Tightness is judged over ELEMENTS rather than over\n * documented services: mid-adoption a group commonly holds systems no\n * `services/<id>/` exists for yet, and counting only the documented ones would\n * draw that same false box for the whole of an adoption.\n *\n * An ancestor that is itself a service's element is refused separately: one\n * service's box containing another's is a picture of nothing.\n */\nfunction owningAncestor(ctx: RenderContext, sub: SubsystemEntry): string | null {\n  const members = memberElements(ctx, sub);\n  if (members.length === 0) return null;\n  const owned = new Set(members);\n  for (const candidate of ancestorChain(members)) {\n    if (!ctx.elementIds.has(candidate) || ctx.isServiceElement(candidate)) continue;\n    if (ownsExactly(ctx, candidate, owned)) return candidate;\n  }\n  return null;\n}\n\n/** The deepest common ancestor the map declares at all — the disclosure's subject. */\nfunction sharedAncestor(ctx: RenderContext, members: string[]): string | null {\n  return ancestorChain(members).find((id) => ctx.elementIds.has(id)) ?? null;\n}\n\n/** The common proper ancestors of every member id, deepest first. */\nfunction ancestorChain(members: string[]): string[] {\n  const segments = members.map((id) => id.split(\".\"));\n  let common = Math.min(...segments.map((s) => s.length - 1));\n  for (let i = 0; i < common; i++) {\n    if (!segments.every((s) => s[i] === segments[0]![i])) {\n      common = i;\n      break;\n    }\n  }\n  const out: string[] = [];\n  for (let depth = common; depth > 0; depth--) out.push(segments[0]!.slice(0, depth).join(\".\"));\n  return out;\n}\n\n/**\n * Does every element beneath `ancestor` belong to this subsystem — as a\n * member, as one of a member's own containers, or as a container of one?\n */\nfunction ownsExactly(ctx: RenderContext, ancestor: string, members: ReadonlySet<string>): boolean {\n  const prefix = `${ancestor}.`;\n  for (const id of ctx.elementIds) {\n    if (!id.startsWith(prefix)) continue;\n    const claimed = [...members].some((m) => id === m || id.startsWith(`${m}.`) || m.startsWith(`${id}.`));\n    if (!claimed) return false;\n  }\n  return true;\n}\n\n/**\n * The landscape element standing for each service id: for every element,\n * resolve it through the shared join, and let the SHALLOWEST element win\n * (document order breaking ties). Shallowest, because `serviceResolver`\n * resolves a service's own containers to the service too, and a view should\n * include the service-level box, not whichever nested container happened to be\n * declared first.\n */\nfunction elementByService(\n  tree: FleetTree,\n  elements: Elem[],\n  resolve: (id: string) => string,\n): Map<string, string> {\n  const known: ReadonlySet<string> = new Set(tree.services.map((s) => s.id));\n  const depth = (id: string): number => id.split(\".\").length;\n  const out = new Map<string, string>();\n  for (const e of elements) {\n    const service = resolve(e.id);\n    if (!known.has(service)) continue;\n    const held = out.get(service);\n    if (held === undefined || depth(e.id) < depth(held)) out.set(service, e.id);\n  }\n  return out;\n}\n\n/** Services beneath this subsystem at any depth, ordered by id — the transitive membership. */\nfunction membersOf(tree: FleetTree, sub: SubsystemEntry): WalkedService[] {\n  return [...servicesUnder(tree, sub)].sort((a, b) => (a.id < b.id ? -1 : 1));\n}\n"]}

package/dist/core/repo/tree/render/projects.js

@@ -0,0 +1,182 @@
+/**
+ * The renderer's project file for ONE service — `services/<…>/<id>/likec4.config.json`
+ * — the second thing under `services/` that exists only to be rendered.
+ *
+ * Why it exists, and WHICH MODELS IT IS FOR. A model that STANDS ALONE declares
+ * its own `specification` block, so it is parsed alone and the root project must
+ * exclude its directory — a renderer merging it into the map reports every kind
+ * and element it declares as a duplicate, blamed on both files. The cost of that
+ * exclusion went unstated for a release: an adopted service's model — the
+ * artifact `loam adopt` spends the most effort on — was a box on the fleet map
+ * with nothing renderable inside it from the docs root, and the documented way
+ * to see it was one renderer invocation per service directory. Measured at the
+ * 1.59.2 pin: a `likec4.config.json` INSIDE a service directory is registered as
+ * a project of its own even though the root excludes the directory (the root's
+ * `exclude` does not hide a nested project file), the workspace then loads
+ * `fleet` plus one project per service with zero errors, and each service
+ * project carries LikeC4's own `index` view of the containers beside whatever
+ * view the model authors. One two-key file per such directory is therefore what
+ * makes that model renderable from the same root, in the same renderer, beside
+ * the map.
+ *
+ * A model that EXTENDS the map is owed NO file, and that is the same
+ * measurement read the other way: it declares no kinds, it lives in the ROOT
+ * project beside the map, and a nested project file beside it TAKES it out of
+ * there — measured at the 1.59.2 pin, the workspace loads two projects and, where
+ * the nested one claims the model, it holds it alone (the map's kinds are not in
+ * there with it, so it does not resolve) and `export json --project fleet` loses
+ * the service's containers. So the survey below takes the shape as a predicate, the writer
+ * creates a file only for the standalone half and removes one beside the
+ * extending half, and `service.likec4-config-stray` grades what is left.
+ *
+ * NEVER COMPARED, NEVER REWRITTEN — the root config's ownership rule
+ * (`core/docs.ts`: written once, never re-read, the team owns it), NOT the
+ * generated views file's. The bytes are a function of the service id alone,
+ * which SCHEMA.md defines as the identity no verb ever changes, so nothing can
+ * make the file stale; a compare would only fight the per-project keys LikeC4
+ * lets a team add (`title`, styles, a contact), and would restale every service
+ * on any change to this rule. Presence is the one question loam owes the file,
+ * and presence needs no parse: rule 26 stands, and loam still reads none of it.
+ *
+ * REMOVED IN EXACTLY ONE STATE: beside a model that EXTENDS the map. That is a
+ * correction, and it is measured rather than reasoned. The design note said a
+ * nested project beside an extending model was registered EMPTY and therefore
+ * harmless; on likec4 1.59.2 two agents measured the opposite (verification
+ * 2026-09-04, W1) — the nested project CLAIMS the model, the workspace loads
+ * "2 projects", the model is Invalid inside its own one (`Could not resolve
+ * reference to Element named 'svc_svc_a'`, because the map is not in there with
+ * it), and `export json --project fleet` drops the service's containers. So the
+ * file is not a leftover, it is a working renderer taken away from the fleet,
+ * and `loam subsystem sync` deletes it — which is what SCHEMA, the message and
+ * `/loam-adopt` step 5 had been promising all along.
+ *
+ * THE EXPORT LOSS IS THE WORSE HALF, NOT THE CERTAIN ONE, and the finding's
+ * message says so since it was re-measured (re-verification 2026-09-04, area C
+ * item 7). Same pin, two fleets: on the seeded fleet above the containers went
+ * and came back when the file was deleted; on `examples/docs` a stray beside the
+ * extending order-service left `export json --project fleet` byte-identical —
+ * 33 elements, every `marketplace.orderService.*` child present — because there
+ * the ROOT project kept the model. What is true in every state measured is the
+ * second project itself: the docs root stops being a one-project workspace, and
+ * `likec4 validate .` goes from ✓ Valid to ✗ Invalid ("Specify exact project,
+ * known: [order-service, fleet]"). A message that asserted the export loss
+ * unconditionally was refutable on the repository's own example fleet.
+ *
+ * A leftover beside a model that is GONE stays. That one really is the team's:
+ * a nested project holding no `.likec4` file is silently absent from the
+ * renderer's project list (measured), so it costs nothing, and a survey that
+ * deleted files in directories it found no model in would be a writer acting on
+ * an absence.
+ *
+ * THE NAME. LikeC4's project-name grammar (measured at the pin) refuses an
+ * empty name, the word `default`, and the bytes `.`, `@` and `#`; loam's
+ * service-id grammar admits `.`. So every `.` becomes `-`, and a name that
+ * would then equal the ROOT project's (`fleet` — a nested project of that name
+ * is silently registered as `fleet-1`) or LikeC4's reserved `default` is
+ * prefixed `service-`. Readable and typeable after `--project`, and NOT
+ * injective: an id spelled a.b beside a service literally named a-b, or
+ * `service-fleet` beside `fleet`, share a name and the renderer suffixes the
+ * later one `-1`. That is disclosed rather than escaped away, because the
+ * picker shows the `title` (measured: `title ?? id`), which is ALWAYS the id
+ * verbatim, and a collision costs one suffixed label rather than the blanked
+ * workspace that made `subsystemViewId` injective. The root's name arrives as
+ * a parameter, like every spelling this package needs from `repo/`: `render/`
+ * cannot import `repo/paths.ts` (`stale.ts` records the cycle), and a second
+ * copy of the word `fleet` here would be the drift the injection prevents.
+ *
+ * A DIRECTORY THAT IS NOT A LEGAL SERVICE ID IS OWED NO FILE. The tree walk
+ * enumerates every directory on purpose — the fleet is never reported smaller
+ * than it is — and `service.id-invalid` names the illegal ones. Folding only
+ * `.` is right for every LEGAL id, whose remaining bytes LikeC4 accepts; a
+ * name like `pay@1` would produce a project file the renderer silently drops
+ * (measured: zero errors, the project simply absent from the list), and
+ * because the file is create-only the grade below would then be silent
+ * forever while the model stayed unrendered — the exact state this file
+ * exists to remove, with a label saying it was fixed. So the survey skips
+ * such a service: the writer creates nothing, the grader says nothing, and
+ * `service.id-invalid`'s own repair — the rename — is what earns the file on
+ * the first sync after it.
+ *
+ * NO MODEL, NO FILE: a service directory without `model.likec4` — one an
+ * archive materialised, a spec-only baseline — is owed nothing, and gets its
+ * file on the first `loam subsystem sync` after the model lands. A feature's
+ * `delta.likec4` is deliberately out of scope: the directory is transient and
+ * `loam archive` moves it where a project file would still be registered, so
+ * every shipped feature would keep a dead project in the list forever.
+ */
+import { existsSync } from "node:fs";
+import { dirNameHazard } from "../../../kernel/ids/service.js";
+/** LikeC4's own reserved project name; a file naming it is refused outright. */
+const LIKEC4_RESERVED_PROJECT = "default";
+/**
+ * The project name for a service id — the id itself for every id made of
+ * letters, digits, `_` and `-`, which is nearly all of them.
+ */
+export function serviceProjectName(id, rootProject) {
+    const folded = id.replace(/\./g, "-");
+    return folded === rootProject || folded === LIKEC4_RESERVED_PROJECT ? `service-${folded}` : folded;
+}
+/**
+ * The exact bytes of a service's project file: two keys, two-space JSON, LF,
+ * one trailing newline — the root file's own serialisation. `title` is the id
+ * verbatim, always, so whatever the renderer labels a project with is the
+ * service's real identity even where `name` had to bend.
+ */
+export function renderServiceProject(id, rootProject) {
+    return `${JSON.stringify({ name: serviceProjectName(id, rootProject), title: id }, null, 2)}\n`;
+}
+/**
+ * ONE predicate for the writer (`subsystem sync`) and the grader
+ * (`validate --all`), on `viewsState`'s precedent — two private spellings of
+ * "is this model a project" would be two chances to answer differently about
+ * one file, and a grader naming a gap the writer would not fill is a loop no
+ * command can clear. Both the gaps AND the count live here for the same
+ * reason: a caller re-deriving "has a model" beside this function is the
+ * second spelling in another coat.
+ *
+ * Structural over `{ id, dir }` so a walked service and a full entry both fit,
+ * and the two file spellings arrive injected (`repo/paths.ts`'s
+ * `serviceRenderPaths`) for the package reason the banner gives. Sorted by id,
+ * plain lexicographic like every list this package emits, so the writer's
+ * report and the grader's findings come out in one stable order.
+ */
+export function surveyProjects(services, pathsOf, isStandalone) {
+    const models = [];
+    for (const service of services) {
+        // The banner's rule: a name the renderer would refuse earns no file, and
+        // `service.id-invalid` — not this survey — is what names the repair.
+        if (dirNameHazard(service.id) !== null)
+            continue;
+        const paths = pathsOf(service.dir);
+        if (!existsSync(paths.model))
+            continue;
+        models.push({
+            service,
+            path: paths.project,
+            // INJECTED rather than read here, and the reason is this package's
+            // standing one: `render/` may not import `c4/` (see `./stale.ts` on the
+            // cycle), and the shape is a fact about the model's GRAMMAR that
+            // `c4/service-model/shape.ts` owns. A predicate crossing the boundary
+            // keeps one scanner for the writer and the grader alike.
+            standalone: isStandalone(paths.model),
+            configured: existsSync(paths.project),
+        });
+    }
+    models.sort((a, b) => (a.service.id < b.service.id ? -1 : a.service.id > b.service.id ? 1 : 0));
+    return {
+        // A model that EXTENDS the map is owed no project file: it belongs to the
+        // root project, and a nested project file beside it CLAIMS it — the model
+        // then parses alone, where the map's kinds are not, and the fleet project
+        // loses the service's interior. So the gap set narrowed to the standalone
+        // shape, and `strays` below is the grade's and the writer's other direction.
+        gaps: models.filter((m) => m.standalone && !m.configured).map(({ service, path }) => ({ service, path })),
+        // The other direction, and the one the banner's correction is about: the
+        // nested project claims the model and the fleet project loses the service's
+        // interior, so the file is removed rather than tolerated.
+        strays: models.filter((m) => !m.standalone && m.configured).map(({ service, path }) => ({ service, path })),
+        models,
+        modelled: models.length,
+        standalone: models.filter((m) => m.standalone).length,
+    };
+}
+//# sourceMappingURL=projects.js.map

package/dist/core/repo/tree/render/projects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../../../../src/core/repo/tree/render/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU,EAAE,WAAmB;IAChE,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACrG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,WAAmB;IAClE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAClG,CAAC;AA2ED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAsB,EACtB,OAAgE,EAChE,YAA4C;IAE5C,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,OAAO;YACP,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,mEAAmE;YACnE,wEAAwE;YACxE,iEAAiE;YACjE,sEAAsE;YACtE,yDAAyD;YACzD,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC;YACrC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO;QACL,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACzG,yEAAyE;QACzE,4EAA4E;QAC5E,0DAA0D;QAC1D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM;KACtD,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The renderer's project file for ONE service — `services/<…>/<id>/likec4.config.json`\n * — the second thing under `services/` that exists only to be rendered.\n *\n * Why it exists, and WHICH MODELS IT IS FOR. A model that STANDS ALONE declares\n * its own `specification` block, so it is parsed alone and the root project must\n * exclude its directory — a renderer merging it into the map reports every kind\n * and element it declares as a duplicate, blamed on both files. The cost of that\n * exclusion went unstated for a release: an adopted service's model — the\n * artifact `loam adopt` spends the most effort on — was a box on the fleet map\n * with nothing renderable inside it from the docs root, and the documented way\n * to see it was one renderer invocation per service directory. Measured at the\n * 1.59.2 pin: a `likec4.config.json` INSIDE a service directory is registered as\n * a project of its own even though the root excludes the directory (the root's\n * `exclude` does not hide a nested project file), the workspace then loads\n * `fleet` plus one project per service with zero errors, and each service\n * project carries LikeC4's own `index` view of the containers beside whatever\n * view the model authors. One two-key file per such directory is therefore what\n * makes that model renderable from the same root, in the same renderer, beside\n * the map.\n *\n * A model that EXTENDS the map is owed NO file, and that is the same\n * measurement read the other way: it declares no kinds, it lives in the ROOT\n * project beside the map, and a nested project file beside it TAKES it out of\n * there — measured at the 1.59.2 pin, the workspace loads two projects and, where\n * the nested one claims the model, it holds it alone (the map's kinds are not in\n * there with it, so it does not resolve) and `export json --project fleet` loses\n * the service's containers. So the survey below takes the shape as a predicate, the writer\n * creates a file only for the standalone half and removes one beside the\n * extending half, and `service.likec4-config-stray` grades what is left.\n *\n * NEVER COMPARED, NEVER REWRITTEN — the root config's ownership rule\n * (`core/docs.ts`: written once, never re-read, the team owns it), NOT the\n * generated views file's. The bytes are a function of the service id alone,\n * which SCHEMA.md defines as the identity no verb ever changes, so nothing can\n * make the file stale; a compare would only fight the per-project keys LikeC4\n * lets a team add (`title`, styles, a contact), and would restale every service\n * on any change to this rule. Presence is the one question loam owes the file,\n * and presence needs no parse: rule 26 stands, and loam still reads none of it.\n *\n * REMOVED IN EXACTLY ONE STATE: beside a model that EXTENDS the map. That is a\n * correction, and it is measured rather than reasoned. The design note said a\n * nested project beside an extending model was registered EMPTY and therefore\n * harmless; on likec4 1.59.2 two agents measured the opposite (verification\n * 2026-09-04, W1) — the nested project CLAIMS the model, the workspace loads\n * \"2 projects\", the model is Invalid inside its own one (`Could not resolve\n * reference to Element named 'svc_svc_a'`, because the map is not in there with\n * it), and `export json --project fleet` drops the service's containers. So the\n * file is not a leftover, it is a working renderer taken away from the fleet,\n * and `loam subsystem sync` deletes it — which is what SCHEMA, the message and\n * `/loam-adopt` step 5 had been promising all along.\n *\n * THE EXPORT LOSS IS THE WORSE HALF, NOT THE CERTAIN ONE, and the finding's\n * message says so since it was re-measured (re-verification 2026-09-04, area C\n * item 7). Same pin, two fleets: on the seeded fleet above the containers went\n * and came back when the file was deleted; on `examples/docs` a stray beside the\n * extending order-service left `export json --project fleet` byte-identical —\n * 33 elements, every `marketplace.orderService.*` child present — because there\n * the ROOT project kept the model. What is true in every state measured is the\n * second project itself: the docs root stops being a one-project workspace, and\n * `likec4 validate .` goes from ✓ Valid to ✗ Invalid (\"Specify exact project,\n * known: [order-service, fleet]\"). A message that asserted the export loss\n * unconditionally was refutable on the repository's own example fleet.\n *\n * A leftover beside a model that is GONE stays. That one really is the team's:\n * a nested project holding no `.likec4` file is silently absent from the\n * renderer's project list (measured), so it costs nothing, and a survey that\n * deleted files in directories it found no model in would be a writer acting on\n * an absence.\n *\n * THE NAME. LikeC4's project-name grammar (measured at the pin) refuses an\n * empty name, the word `default`, and the bytes `.`, `@` and `#`; loam's\n * service-id grammar admits `.`. So every `.` becomes `-`, and a name that\n * would then equal the ROOT project's (`fleet` — a nested project of that name\n * is silently registered as `fleet-1`) or LikeC4's reserved `default` is\n * prefixed `service-`. Readable and typeable after `--project`, and NOT\n * injective: an id spelled a.b beside a service literally named a-b, or\n * `service-fleet` beside `fleet`, share a name and the renderer suffixes the\n * later one `-1`. That is disclosed rather than escaped away, because the\n * picker shows the `title` (measured: `title ?? id`), which is ALWAYS the id\n * verbatim, and a collision costs one suffixed label rather than the blanked\n * workspace that made `subsystemViewId` injective. The root's name arrives as\n * a parameter, like every spelling this package needs from `repo/`: `render/`\n * cannot import `repo/paths.ts` (`stale.ts` records the cycle), and a second\n * copy of the word `fleet` here would be the drift the injection prevents.\n *\n * A DIRECTORY THAT IS NOT A LEGAL SERVICE ID IS OWED NO FILE. The tree walk\n * enumerates every directory on purpose — the fleet is never reported smaller\n * than it is — and `service.id-invalid` names the illegal ones. Folding only\n * `.` is right for every LEGAL id, whose remaining bytes LikeC4 accepts; a\n * name like `pay@1` would produce a project file the renderer silently drops\n * (measured: zero errors, the project simply absent from the list), and\n * because the file is create-only the grade below would then be silent\n * forever while the model stayed unrendered — the exact state this file\n * exists to remove, with a label saying it was fixed. So the survey skips\n * such a service: the writer creates nothing, the grader says nothing, and\n * `service.id-invalid`'s own repair — the rename — is what earns the file on\n * the first sync after it.\n *\n * NO MODEL, NO FILE: a service directory without `model.likec4` — one an\n * archive materialised, a spec-only baseline — is owed nothing, and gets its\n * file on the first `loam subsystem sync` after the model lands. A feature's\n * `delta.likec4` is deliberately out of scope: the directory is transient and\n * `loam archive` moves it where a project file would still be registered, so\n * every shipped feature would keep a dead project in the list forever.\n */\nimport { existsSync } from \"node:fs\";\nimport type { ServiceDir } from \"../../../kernel/ids/dirs.js\";\nimport { dirNameHazard } from \"../../../kernel/ids/service.js\";\n\n/** LikeC4's own reserved project name; a file naming it is refused outright. */\nconst LIKEC4_RESERVED_PROJECT = \"default\";\n\n/**\n * The project name for a service id — the id itself for every id made of\n * letters, digits, `_` and `-`, which is nearly all of them.\n */\nexport function serviceProjectName(id: string, rootProject: string): string {\n  const folded = id.replace(/\\./g, \"-\");\n  return folded === rootProject || folded === LIKEC4_RESERVED_PROJECT ? `service-${folded}` : folded;\n}\n\n/**\n * The exact bytes of a service's project file: two keys, two-space JSON, LF,\n * one trailing newline — the root file's own serialisation. `title` is the id\n * verbatim, always, so whatever the renderer labels a project with is the\n * service's real identity even where `name` had to bend.\n */\nexport function renderServiceProject(id: string, rootProject: string): string {\n  return `${JSON.stringify({ name: serviceProjectName(id, rootProject), title: id }, null, 2)}\\n`;\n}\n\n/**\n * A service whose model has no project file beside it, and where the file\n * goes. The SERVICE travels whole — a walked service or a full entry,\n * whichever the caller surveyed — rather than its id: the grader spells the\n * finding's path from the entry's own placement, and a join back by id would\n * name the wrong directory the moment two services share a leaf name under\n * different subsystems (`subsystem.name-collision` — a broken tree the walk\n * still enumerates in full, and one this grade is emitted on by design).\n */\nexport interface ProjectGap<T> {\n  service: T;\n  /** Absolute path of the file `loam subsystem sync` will create. */\n  path: string;\n}\n\n/**\n * One surveyed model: everything the writer and the four renderer grades ask\n * about a single `model.likec4`, answered in one walk.\n *\n * The SHAPE is on here rather than re-derived per grade because it decides\n * opposite things for the two of them: a model that stands alone is owed a\n * project file and must be excluded from the root project, and a model that\n * extends the map is owed neither and must NOT be excluded. Two readers of the\n * same bytes would be two chances to answer that backwards, and backwards is\n * not a warning — it is a renderer that shows nothing.\n */\nexport interface SurveyedModel<T> {\n  service: T;\n  /** Absolute path of the per-service project file, whether or not it exists. */\n  path: string;\n  /** True when the model declares its own element kinds — the caller's byte scan, injected. */\n  standalone: boolean;\n  /** True when a `likec4.config.json` already sits beside the model. */\n  configured: boolean;\n}\n\n/** What one survey of the tree found: the gaps, the models behind them, and the domain they were counted against. */\nexport interface ProjectSurvey<T> {\n  /** Every service owed a file and lacking one, sorted by id. */\n  gaps: ProjectGap<T>[];\n  /**\n   * Every service owed NO file that has one anyway — an extending model with a\n   * `likec4.config.json` beside it, sorted by id. The mirror of `gaps`, and the\n   * same shape, because the writer does the same thing with it: `subsystem sync`\n   * plans a delete where it plans a create, and `service.likec4-config-stray`\n   * grades what is left. One predicate for both, so the grader can never name a\n   * stray the writer would decline to remove.\n   */\n  strays: ProjectGap<T>[];\n  /** Every model the survey considered, sorted by id — the four renderer grades walk this. */\n  models: SurveyedModel<T>[];\n  /**\n   * Every service the survey considered at all — a model on disk, a legal id\n   * — file or no file, whichever shape the model has. It is what the\n   * root-missing note is owed to: without the root project file NOTHING under\n   * `services/` is written, and the count a person needs there is how many\n   * models the run walked past.\n   */\n  modelled: number;\n  /**\n   * The subset of those whose model STANDS ALONE — the only services owed a\n   * project file at all, and therefore the domain `gaps` was drawn from.\n   *\n   * Apart from `modelled` because the two stopped meaning the same thing when a\n   * model could extend the map, and one subtraction rested on their being\n   * equal: `modelled - gaps.length` was \"already had a file\", and it counted\n   * every extending model as one — a fleet that had just migrated reported N\n   * services holding a file that must not exist. `standalone - gaps.length` is\n   * the same subtraction over the domain that is actually owed the file.\n   */\n  standalone: number;\n}\n\n/**\n * ONE predicate for the writer (`subsystem sync`) and the grader\n * (`validate --all`), on `viewsState`'s precedent — two private spellings of\n * \"is this model a project\" would be two chances to answer differently about\n * one file, and a grader naming a gap the writer would not fill is a loop no\n * command can clear. Both the gaps AND the count live here for the same\n * reason: a caller re-deriving \"has a model\" beside this function is the\n * second spelling in another coat.\n *\n * Structural over `{ id, dir }` so a walked service and a full entry both fit,\n * and the two file spellings arrive injected (`repo/paths.ts`'s\n * `serviceRenderPaths`) for the package reason the banner gives. Sorted by id,\n * plain lexicographic like every list this package emits, so the writer's\n * report and the grader's findings come out in one stable order.\n */\nexport function surveyProjects<T extends { id: string; dir: ServiceDir }>(\n  services: readonly T[],\n  pathsOf: (dir: ServiceDir) => { model: string; project: string },\n  isStandalone: (modelPath: string) => boolean,\n): ProjectSurvey<T> {\n  const models: SurveyedModel<T>[] = [];\n  for (const service of services) {\n    // The banner's rule: a name the renderer would refuse earns no file, and\n    // `service.id-invalid` — not this survey — is what names the repair.\n    if (dirNameHazard(service.id) !== null) continue;\n    const paths = pathsOf(service.dir);\n    if (!existsSync(paths.model)) continue;\n    models.push({\n      service,\n      path: paths.project,\n      // INJECTED rather than read here, and the reason is this package's\n      // standing one: `render/` may not import `c4/` (see `./stale.ts` on the\n      // cycle), and the shape is a fact about the model's GRAMMAR that\n      // `c4/service-model/shape.ts` owns. A predicate crossing the boundary\n      // keeps one scanner for the writer and the grader alike.\n      standalone: isStandalone(paths.model),\n      configured: existsSync(paths.project),\n    });\n  }\n  models.sort((a, b) => (a.service.id < b.service.id ? -1 : a.service.id > b.service.id ? 1 : 0));\n  return {\n    // A model that EXTENDS the map is owed no project file: it belongs to the\n    // root project, and a nested project file beside it CLAIMS it — the model\n    // then parses alone, where the map's kinds are not, and the fleet project\n    // loses the service's interior. So the gap set narrowed to the standalone\n    // shape, and `strays` below is the grade's and the writer's other direction.\n    gaps: models.filter((m) => m.standalone && !m.configured).map(({ service, path }) => ({ service, path })),\n    // The other direction, and the one the banner's correction is about: the\n    // nested project claims the model and the fleet project loses the service's\n    // interior, so the file is removed rather than tolerated.\n    strays: models.filter((m) => !m.standalone && m.configured).map(({ service, path }) => ({ service, path })),\n    models,\n    modelled: models.length,\n    standalone: models.filter((m) => m.standalone).length,\n  };\n}\n"]}

package/dist/core/repo/tree/render/service/header.js

@@ -0,0 +1,125 @@
+/**
+ * The one line that says a file under `architecture/` is LOAM'S — the opening
+ * comment both generated views files carry, and the predicate that reads it
+ * back off a file on disk.
+ *
+ * WHY A MARK EXISTS AT ALL. `architecture/subsystems.likec4` and
+ * `architecture/services.likec4` are filenames loam RESERVES inside a directory
+ * the team owns, and `loam subsystem sync` rewrites them wholesale. A docs repo
+ * that already kept a hand-authored diagram at one of those paths — plausible
+ * for `services.likec4` in particular, which loam reserved only now — would
+ * have lost it on the first sync after the upgrade, with no warning and nothing
+ * to restore it from. That is the one promise the rest of the tree keeps
+ * everywhere: authored bytes stay authored, which is what archive's verbatim
+ * splice is for. So the writer asks the file itself who wrote it, and refuses
+ * every path where the answer is not loam.
+ *
+ * IT LIVES HERE, in the leaf package, for the reason `./view-id.ts` does: the
+ * parent (`../views.ts`) may import a child and never the reverse, so the one
+ * spelling BOTH generated files must open with has to sit below both. Two
+ * literals for one mark is how the day comes that a file loam wrote is not
+ * recognised as loam's and the writer refuses to regenerate its own output.
+ *
+ * SO DOES THE READ, AND SO DOES THE SENTENCE, and that is the correction this
+ * module carries. The guard first shipped inside `loam subsystem sync` alone,
+ * and there are FOUR other writers of exactly these two paths: the shared commit
+ * window behind `subsystem new`, `rm`, `move` and `rename`
+ * (`commands/subsystem/txn/txn.ts`) and `loam seed`
+ * (`commands/seed/plan.ts`). Reproduced before this module grew: with a
+ * hand-authored `architecture/services.likec4` in the tree, `loam subsystem new
+ * platform` printed "architecture/services.likec4 updated" and destroyed it —
+ * the file's digest changed and its first line became loam's header. A guard
+ * that lives in one of five writers is not a guard. So the reader
+ * (`readGeneratedFile`, `authoredGeneratedPaths`) and the refusal sentence
+ * (`authoredRefusal`) sit beside the mark itself, below every writer, and a
+ * sixth writer added tomorrow has one place to reach for rather than a fourth
+ * spelling to invent.
+ */
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+/**
+ * The first bytes of every generated views file. Part of the content-compare
+ * contract, so it is not prose that may be reworded: the rest of each header is,
+ * and deliberately, because only this much identifies the owner.
+ */
+export const GENERATED_MARK = "// generated by loam";
+/**
+ * Was the text now at a generated path written by loam?
+ *
+ * A LEADING BYTE-ORDER MARK is stripped first, and that is not tidiness: a
+ * Windows editor that opens a generated file and saves it back adds one without
+ * changing a single fact in the file, and without this the writer would call its
+ * own output authored and refuse to regenerate it for good — a refusal no
+ * re-running could ever clear. CRLF needs no such treatment, for the reason
+ * `viewsAgree` records one file over: the mark is the head of the first line and
+ * the line ending is behind it.
+ *
+ * The test is the MARK and not the whole header, because the header's remaining
+ * lines differ between the two files and are prose. It is also deliberately not
+ * a test of the whole file: a hand EDIT of a generated file keeps the header, and
+ * that file is loam's to repair — `subsystem.views-stale` names it and one sync
+ * puts it back. Only a file that never carried the mark is somebody else's.
+ */
+export function isGenerated(text) {
+    return text.replace(/^\uFEFF/, "").startsWith(GENERATED_MARK);
+}
+/**
+ * Read one generated path and answer both questions about it at once \u2014 what it
+ * says, and whether loam may write it.
+ *
+ * ONE READ, because the only caller that needs the text is the one that also
+ * compares it (`subsystem sync`'s `planFile`), and asking the disk twice for the
+ * same small file so that two helpers could each own half the answer is how the
+ * two halves come to disagree about which file they were talking about.
+ *
+ * ABSENT IS NOT AUTHORED. There is nothing to lose at a path that holds
+ * nothing, and a fleet being scaffolded must still get its first generated file
+ * \u2014 a guard that refused an absent file would refuse every repository forever.
+ */
+export async function readGeneratedFile(path) {
+    if (!existsSync(path))
+        return { text: null, authored: false };
+    const text = await readFile(path, "utf8");
+    return { text, authored: !isGenerated(text) };
+}
+/**
+ * Which of these generated paths hold a file loam did not write \u2014 the question
+ * every writer that rewrites the PAIR wholesale asks before it stages anything.
+ *
+ * The paths come back in the order they were given, so a caller's message names
+ * the files in a stable order rather than in whichever order the reads finished.
+ */
+export async function authoredGeneratedPaths(paths) {
+    // Independent reads of at most two small files: `Promise.all`, per the house
+    // rule, and the order of the input is preserved by the map rather than by the
+    // scheduler.
+    const reads = await Promise.all(paths.map(async (path) => ({ path, read: await readGeneratedFile(path) })));
+    return reads.filter((r) => r.read.authored).map((r) => r.path);
+}
+/**
+ * The one sentence a refusal owes about ONE authored file, composed here and
+ * parameterised by the file, because FIVE writers refuse for this reason and a
+ * reader who met the sentence from `loam subsystem sync` must recognise it
+ * verbatim from `loam subsystem new`, `rm`, `move`, `rename` and `loam seed`.
+ *
+ * It names three things a person cannot get anywhere else: which file was left
+ * alone, WHY loam thinks the file is not its own (the mark it looked for), and
+ * the fact that nothing was written to it. The last clause closes the loop the
+ * refusal otherwise leaves open \u2014 `loam validate --all` will keep reporting
+ * `subsystem.views-stale` for that path and keep naming `loam subsystem sync` as
+ * the repair, so a person who is not told why the writers decline would be sent
+ * back and forth between the two forever.
+ *
+ * It deliberately does NOT name a command to re-run. It used to say "re-run
+ * `loam subsystem sync`", which was true of the one caller it then had and wrong
+ * for the four that were added: the command to re-run is the one the person
+ * typed, and the sentence a caller appends says what that command did instead.
+ */
+export function authoredRefusal(file) {
+    return (`${file} left as it is \u2014 its first line is not \`${GENERATED_MARK}\`, so it is an AUTHORED file standing at a ` +
+        "path loam generates and rewrites wholesale. Nothing was written to it and not one of its bytes changed. " +
+        "Rename it to something loam does not reserve (every other `.likec4` under architecture/ renders in the same " +
+        "project, so the diagram is not lost) or delete it, then re-run. Until then `loam validate --all` reports " +
+        "`subsystem.views-stale` for that path and every loam command that writes the file keeps refusing.");
+}
+//# sourceMappingURL=header.js.map

package/dist/core/repo/tree/render/service/header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header.js","sourceRoot":"","sources":["../../../../../../src/core/repo/tree/render/service/header.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAChE,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAwB;IACnE,6EAA6E;IAC7E,8EAA8E;IAC9E,aAAa;IACb,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAC3E,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,CACL,GAAG,IAAI,iDAAiD,cAAc,8CAA8C;QACpH,0GAA0G;QAC1G,8GAA8G;QAC9G,2GAA2G;QAC3G,mGAAmG,CACpG,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The one line that says a file under `architecture/` is LOAM'S — the opening\n * comment both generated views files carry, and the predicate that reads it\n * back off a file on disk.\n *\n * WHY A MARK EXISTS AT ALL. `architecture/subsystems.likec4` and\n * `architecture/services.likec4` are filenames loam RESERVES inside a directory\n * the team owns, and `loam subsystem sync` rewrites them wholesale. A docs repo\n * that already kept a hand-authored diagram at one of those paths — plausible\n * for `services.likec4` in particular, which loam reserved only now — would\n * have lost it on the first sync after the upgrade, with no warning and nothing\n * to restore it from. That is the one promise the rest of the tree keeps\n * everywhere: authored bytes stay authored, which is what archive's verbatim\n * splice is for. So the writer asks the file itself who wrote it, and refuses\n * every path where the answer is not loam.\n *\n * IT LIVES HERE, in the leaf package, for the reason `./view-id.ts` does: the\n * parent (`../views.ts`) may import a child and never the reverse, so the one\n * spelling BOTH generated files must open with has to sit below both. Two\n * literals for one mark is how the day comes that a file loam wrote is not\n * recognised as loam's and the writer refuses to regenerate its own output.\n *\n * SO DOES THE READ, AND SO DOES THE SENTENCE, and that is the correction this\n * module carries. The guard first shipped inside `loam subsystem sync` alone,\n * and there are FOUR other writers of exactly these two paths: the shared commit\n * window behind `subsystem new`, `rm`, `move` and `rename`\n * (`commands/subsystem/txn/txn.ts`) and `loam seed`\n * (`commands/seed/plan.ts`). Reproduced before this module grew: with a\n * hand-authored `architecture/services.likec4` in the tree, `loam subsystem new\n * platform` printed \"architecture/services.likec4 updated\" and destroyed it —\n * the file's digest changed and its first line became loam's header. A guard\n * that lives in one of five writers is not a guard. So the reader\n * (`readGeneratedFile`, `authoredGeneratedPaths`) and the refusal sentence\n * (`authoredRefusal`) sit beside the mark itself, below every writer, and a\n * sixth writer added tomorrow has one place to reach for rather than a fourth\n * spelling to invent.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\n\n/**\n * The first bytes of every generated views file. Part of the content-compare\n * contract, so it is not prose that may be reworded: the rest of each header is,\n * and deliberately, because only this much identifies the owner.\n */\nexport const GENERATED_MARK = \"// generated by loam\";\n\n/**\n * Was the text now at a generated path written by loam?\n *\n * A LEADING BYTE-ORDER MARK is stripped first, and that is not tidiness: a\n * Windows editor that opens a generated file and saves it back adds one without\n * changing a single fact in the file, and without this the writer would call its\n * own output authored and refuse to regenerate it for good — a refusal no\n * re-running could ever clear. CRLF needs no such treatment, for the reason\n * `viewsAgree` records one file over: the mark is the head of the first line and\n * the line ending is behind it.\n *\n * The test is the MARK and not the whole header, because the header's remaining\n * lines differ between the two files and are prose. It is also deliberately not\n * a test of the whole file: a hand EDIT of a generated file keeps the header, and\n * that file is loam's to repair — `subsystem.views-stale` names it and one sync\n * puts it back. Only a file that never carried the mark is somebody else's.\n */\nexport function isGenerated(text: string): boolean {\n  return text.replace(/^\\uFEFF/, \"\").startsWith(GENERATED_MARK);\n}\n\n/** What a writer of a generated path learns by reading it, in one read. */\nexport interface GeneratedFileRead {\n  /** The bytes as text, or null when nothing stands at the path. */\n  text: string | null;\n  /** SOMEBODY ELSE wrote this: a file is there and its first line is not the mark. */\n  authored: boolean;\n}\n\n/**\n * Read one generated path and answer both questions about it at once \\u2014 what it\n * says, and whether loam may write it.\n *\n * ONE READ, because the only caller that needs the text is the one that also\n * compares it (`subsystem sync`'s `planFile`), and asking the disk twice for the\n * same small file so that two helpers could each own half the answer is how the\n * two halves come to disagree about which file they were talking about.\n *\n * ABSENT IS NOT AUTHORED. There is nothing to lose at a path that holds\n * nothing, and a fleet being scaffolded must still get its first generated file\n * \\u2014 a guard that refused an absent file would refuse every repository forever.\n */\nexport async function readGeneratedFile(path: string): Promise<GeneratedFileRead> {\n  if (!existsSync(path)) return { text: null, authored: false };\n  const text = await readFile(path, \"utf8\");\n  return { text, authored: !isGenerated(text) };\n}\n\n/**\n * Which of these generated paths hold a file loam did not write \\u2014 the question\n * every writer that rewrites the PAIR wholesale asks before it stages anything.\n *\n * The paths come back in the order they were given, so a caller's message names\n * the files in a stable order rather than in whichever order the reads finished.\n */\nexport async function authoredGeneratedPaths(paths: readonly string[]): Promise<string[]> {\n  // Independent reads of at most two small files: `Promise.all`, per the house\n  // rule, and the order of the input is preserved by the map rather than by the\n  // scheduler.\n  const reads = await Promise.all(\n    paths.map(async (path) => ({ path, read: await readGeneratedFile(path) })),\n  );\n  return reads.filter((r) => r.read.authored).map((r) => r.path);\n}\n\n/**\n * The one sentence a refusal owes about ONE authored file, composed here and\n * parameterised by the file, because FIVE writers refuse for this reason and a\n * reader who met the sentence from `loam subsystem sync` must recognise it\n * verbatim from `loam subsystem new`, `rm`, `move`, `rename` and `loam seed`.\n *\n * It names three things a person cannot get anywhere else: which file was left\n * alone, WHY loam thinks the file is not its own (the mark it looked for), and\n * the fact that nothing was written to it. The last clause closes the loop the\n * refusal otherwise leaves open \\u2014 `loam validate --all` will keep reporting\n * `subsystem.views-stale` for that path and keep naming `loam subsystem sync` as\n * the repair, so a person who is not told why the writers decline would be sent\n * back and forth between the two forever.\n *\n * It deliberately does NOT name a command to re-run. It used to say \"re-run\n * `loam subsystem sync`\", which was true of the one caller it then had and wrong\n * for the four that were added: the command to re-run is the one the person\n * typed, and the sentence a caller appends says what that command did instead.\n */\nexport function authoredRefusal(file: string): string {\n  return (\n    `${file} left as it is \\u2014 its first line is not \\`${GENERATED_MARK}\\`, so it is an AUTHORED file standing at a ` +\n    \"path loam generates and rewrites wholesale. Nothing was written to it and not one of its bytes changed. \" +\n    \"Rename it to something loam does not reserve (every other `.likec4` under architecture/ renders in the same \" +\n    \"project, so the diagram is not lost) or delete it, then re-run. Until then `loam validate --all` reports \" +\n    \"`subsystem.views-stale` for that path and every loam command that writes the file keeps refusing.\"\n  );\n}\n"]}

package/dist/core/repo/tree/render/service/peers.js

@@ -0,0 +1,28 @@
+/**
+ * Every element on the far side of an edge touching this service, sorted and
+ * de-duplicated.
+ *
+ * "Touching" is the subject OR any descendant of it: an edge into
+ * `svc.api` is an edge into the service, and the view that hid it would be
+ * lying about the service's surface. The far endpoint is dropped when it is
+ * itself the subject or one of its descendants — that is INTERIOR, already
+ * drawn by the view's own `include *`, and naming it again would put a second
+ * include line in the file for a node that is already there.
+ *
+ * Sorted and de-duplicated because the generated file is a pure function of
+ * committed bytes: document order is the parse's, not the author's, and two
+ * edges between the same pair must not emit the same include twice.
+ */
+export function peersOf(fqn, relationships) {
+    const prefix = `${fqn}.`;
+    const own = (id) => id === fqn || id.startsWith(prefix);
+    const found = new Set();
+    for (const rel of relationships) {
+        if (own(rel.source) && !own(rel.target))
+            found.add(rel.target);
+        if (own(rel.target) && !own(rel.source))
+            found.add(rel.source);
+    }
+    return [...found].sort();
+}
+//# sourceMappingURL=peers.js.map

package/dist/core/repo/tree/render/service/peers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"peers.js","sourceRoot":"","sources":["../../../../../../src/core/repo/tree/render/service/peers.ts"],"names":[],"mappings":"AAoCA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,aAA6B;IAChE,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["/**\n * The NEIGHBOUR SET of one service: every element the map draws an edge to or\n * from, computed by loam rather than asked of the renderer.\n *\n * This module exists because of a measurement, and the measurement is the whole\n * reason the per-service view is not three wildcard lines. At likec4 1.59.2, on\n * a 120-service map whose services are nested in `group` boxes, the obvious\n * recipe\n *\n *     include *\n *     include <fqn> -> *\n *     include * -> <fqn>\n *\n * drew the GROUP BOXES as the counterparts — `growth`, `catalog`, `support`,\n * `notifications` — instead of the peer services, and NONE of them carried\n * drill-down. LikeC4 resolves a counterpart at the highest ancestor that is not\n * also an ancestor of the subject, so on any map that groups its services —\n * which is exactly what a fleet past about thirty services needs at fleet\n * level — the wildcard form says \"payments/service-0 talks to the growth group\"\n * and navigates nowhere. It looks perfect on a five-service FLAT fixture, which\n * is how it would have shipped.\n *\n * Re-measured here at 1.59.2 on the 58-service / 11-group fleet, subject\n * `payments.svc0` with 8 real peers: the wildcard recipe draws 10 nodes of which\n * four are group boxes; naming the peers draws 11 — the subject, its `api`, its\n * `db` and all 8 peers, each at its own level, each carrying `navigateTo` into\n * that peer's own generated view (6 of the 8 are services and have one; the\n * customer and the broker are not).\n *\n * The counterpart is taken AS THE MAP DECLARES IT — an edge landing on\n * `kafka.orderEvents` names the topic, not the broker — because that is the\n * truer picture and it is the one the map already draws. Anything the render\n * substituted here would be loam re-drawing somebody's architecture.\n */\nimport type { Rel } from \"../../../../c4/likec4.js\";\n\n/**\n * Every element on the far side of an edge touching this service, sorted and\n * de-duplicated.\n *\n * \"Touching\" is the subject OR any descendant of it: an edge into\n * `svc.api` is an edge into the service, and the view that hid it would be\n * lying about the service's surface. The far endpoint is dropped when it is\n * itself the subject or one of its descendants — that is INTERIOR, already\n * drawn by the view's own `include *`, and naming it again would put a second\n * include line in the file for a node that is already there.\n *\n * Sorted and de-duplicated because the generated file is a pure function of\n * committed bytes: document order is the parse's, not the author's, and two\n * edges between the same pair must not emit the same include twice.\n */\nexport function peersOf(fqn: string, relationships: readonly Rel[]): string[] {\n  const prefix = `${fqn}.`;\n  const own = (id: string): boolean => id === fqn || id.startsWith(prefix);\n  const found = new Set<string>();\n  for (const rel of relationships) {\n    if (own(rel.source) && !own(rel.target)) found.add(rel.target);\n    if (own(rel.target) && !own(rel.source)) found.add(rel.source);\n  }\n  return [...found].sort();\n}\n"]}

package/dist/core/repo/tree/render/service/view-id.js

@@ -0,0 +1,67 @@
+/**
+ * The identifier loam mints for a per-service overview view, and the ONE
+ * encoder every generated view id is spelled through.
+ *
+ * The encoder lives HERE, in the child package, rather than beside the
+ * subsystem render that has used it since it was written — and the direction is
+ * forced rather than chosen. `../views.ts` imports this package to compose the
+ * per-service file, so an import the other way would be the package cycle
+ * `scripts/package-graph.mjs` refuses; that script's own advice for exactly this
+ * shape is "move the helper; do not import the weight", and an id encoder is the
+ * leaf while the two renders are the weight. One copy is also the point: the
+ * injectivity argument below holds across BOTH prefixes only while they share an
+ * encoder, and a second spelling would be a second chance to collide.
+ *
+ * INJECTIVITY is a correctness rule and not tidiness. The renderer refuses the
+ * whole `architecture/` project over a duplicate view id, and the naive folding
+ * (every non-identifier byte and the join separator alike becoming `_`) collided
+ * three DISTINCT healthy names onto one identifier — `a_b`, and `b` under `a`,
+ * both rendering `subsystem_a_b` — so `validate --all` was green while the
+ * renderer refused the fleet map, and `subsystem.name-collision` never fired
+ * because the flat namespace really was intact.
+ *
+ * Hence the encoding: an identifier byte (`[A-Za-z0-9]`) passes through, any
+ * other byte becomes `_` + two lowercase hex digits (`.` → `_2e`, `-` → `_2d`,
+ * `_` itself → `_5f` — the underscore must be escaped precisely because it is
+ * BOTH legal in a name and the separator between path segments). Underscore runs
+ * then decode uniquely — one is an escape, two a separator, three a separator
+ * followed by an escape — so no two distinct legal names share an identifier. A
+ * name `subsystem.name-invalid` already flagged may hold a code point above 0xff
+ * whose longer hex could in principle re-collide; it is deterministic still, and
+ * that directory is already an error finding by name.
+ *
+ * The prefix is EXPORTED, with the minting function, because the collision check
+ * (`subsystem.view-id-collision`) has to ask the generator what it mints rather
+ * than re-derive it. A check carrying its own copy of the escaping goes quiet the
+ * day the encoding changes, and going quiet is the failure that whole family
+ * exists to prevent.
+ */
+/**
+ * The reserved prefix for a generated per-service overview. Distinct from
+ * `subsystem_` so the two generated files can never mint the same id for
+ * different subjects, and it cannot match the shape LikeC4 mints for an unnamed
+ * view (`^view_[0-9a-z]+$`, `core/c4/parsed/view-ids.ts`), so a generated id is
+ * never mistaken for a synthesized one.
+ */
+export const SERVICE_VIEW_PREFIX = "service_";
+/** One name, folded to identifier bytes injectively — the banner argues why this shape. */
+export function escapeViewIdSegment(name) {
+    return [...name]
+        .map((ch) => (/[A-Za-z0-9]/.test(ch) ? ch : `_${ch.codePointAt(0).toString(16).padStart(2, "0")}`))
+        .join("");
+}
+/**
+ * The view id for one service, from its `services/<id>/` DIRECTORY name.
+ *
+ * The directory id rather than the map element's title or its fqn, for the same
+ * reason the title uses it: it is the name every loam command already addresses
+ * the service by, a directory name cannot hold a `/` or a `.`, and it cannot
+ * drift when somebody renames a box on the map. Two services cannot share a
+ * directory id — the walk's flat namespace already refuses that as
+ * `subsystem.name-collision` — so injectivity of the encoder is injectivity of
+ * the whole id.
+ */
+export function serviceViewId(id) {
+    return `${SERVICE_VIEW_PREFIX}${escapeViewIdSegment(id)}`;
+}
+//# sourceMappingURL=view-id.js.map

package/dist/core/repo/tree/render/service/view-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-id.js","sourceRoot":"","sources":["../../../../../../src/core/repo/tree/render/service/view-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE9C,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,CAAC,GAAG,IAAI,CAAC;SACb,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;SACnG,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,GAAG,mBAAmB,GAAG,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * The identifier loam mints for a per-service overview view, and the ONE\n * encoder every generated view id is spelled through.\n *\n * The encoder lives HERE, in the child package, rather than beside the\n * subsystem render that has used it since it was written — and the direction is\n * forced rather than chosen. `../views.ts` imports this package to compose the\n * per-service file, so an import the other way would be the package cycle\n * `scripts/package-graph.mjs` refuses; that script's own advice for exactly this\n * shape is \"move the helper; do not import the weight\", and an id encoder is the\n * leaf while the two renders are the weight. One copy is also the point: the\n * injectivity argument below holds across BOTH prefixes only while they share an\n * encoder, and a second spelling would be a second chance to collide.\n *\n * INJECTIVITY is a correctness rule and not tidiness. The renderer refuses the\n * whole `architecture/` project over a duplicate view id, and the naive folding\n * (every non-identifier byte and the join separator alike becoming `_`) collided\n * three DISTINCT healthy names onto one identifier — `a_b`, and `b` under `a`,\n * both rendering `subsystem_a_b` — so `validate --all` was green while the\n * renderer refused the fleet map, and `subsystem.name-collision` never fired\n * because the flat namespace really was intact.\n *\n * Hence the encoding: an identifier byte (`[A-Za-z0-9]`) passes through, any\n * other byte becomes `_` + two lowercase hex digits (`.` → `_2e`, `-` → `_2d`,\n * `_` itself → `_5f` — the underscore must be escaped precisely because it is\n * BOTH legal in a name and the separator between path segments). Underscore runs\n * then decode uniquely — one is an escape, two a separator, three a separator\n * followed by an escape — so no two distinct legal names share an identifier. A\n * name `subsystem.name-invalid` already flagged may hold a code point above 0xff\n * whose longer hex could in principle re-collide; it is deterministic still, and\n * that directory is already an error finding by name.\n *\n * The prefix is EXPORTED, with the minting function, because the collision check\n * (`subsystem.view-id-collision`) has to ask the generator what it mints rather\n * than re-derive it. A check carrying its own copy of the escaping goes quiet the\n * day the encoding changes, and going quiet is the failure that whole family\n * exists to prevent.\n */\n\n/**\n * The reserved prefix for a generated per-service overview. Distinct from\n * `subsystem_` so the two generated files can never mint the same id for\n * different subjects, and it cannot match the shape LikeC4 mints for an unnamed\n * view (`^view_[0-9a-z]+$`, `core/c4/parsed/view-ids.ts`), so a generated id is\n * never mistaken for a synthesized one.\n */\nexport const SERVICE_VIEW_PREFIX = \"service_\";\n\n/** One name, folded to identifier bytes injectively — the banner argues why this shape. */\nexport function escapeViewIdSegment(name: string): string {\n  return [...name]\n    .map((ch) => (/[A-Za-z0-9]/.test(ch) ? ch : `_${ch.codePointAt(0)!.toString(16).padStart(2, \"0\")}`))\n    .join(\"\");\n}\n\n/**\n * The view id for one service, from its `services/<id>/` DIRECTORY name.\n *\n * The directory id rather than the map element's title or its fqn, for the same\n * reason the title uses it: it is the name every loam command already addresses\n * the service by, a directory name cannot hold a `/` or a `.`, and it cannot\n * drift when somebody renames a box on the map. Two services cannot share a\n * directory id — the walk's flat namespace already refuses that as\n * `subsystem.name-collision` — so injectivity of the encoder is injectivity of\n * the whole id.\n */\nexport function serviceViewId(id: string): string {\n  return `${SERVICE_VIEW_PREFIX}${escapeViewIdSegment(id)}`;\n}\n"]}

package/dist/core/repo/tree/render/service/views.js

@@ -0,0 +1,78 @@
+import { GENERATED_MARK } from "./header.js";
+import { peersOf } from "./peers.js";
+import { serviceViewId } from "./view-id.js";
+/**
+ * The global style group these views reference when the map declares one, the
+ * exact counterpart of `SUBSYSTEM_STYLE_GROUP` and reserved on the same terms:
+ * presence of the DECLARATION is the whole opt-in, because referencing an
+ * undeclared style id is a parse error that blanks the entire `architecture/`
+ * project in the renderer. The name mirrors the file it styles.
+ */
+export const SERVICE_STYLE_GROUP = "services";
+/**
+ * The header every generated file opens with — stable bytes, part of the
+ * content-compare contract, naming the regenerator so a reader who found the
+ * file before the docs knows what owns it. `loam subsystem sync` regenerates
+ * BOTH generated files, which is why one command is named here and why one
+ * finding code (`subsystem.views-stale`) honestly covers both.
+ *
+ * It OPENS with the shared `GENERATED_MARK` rather than spelling it, because
+ * the same bytes are what `loam subsystem sync` reads back off disk to decide
+ * whether the file at this reserved path is loam's to rewrite at all
+ * (`./header.js`). A second literal here is how a file loam wrote stops being
+ * recognised as loam's.
+ */
+const HEADER = `${GENERATED_MARK} — one overview view per service under services/, drawn from the fleet map.\n` +
+    "// Do not edit: `loam subsystem sync` regenerates this file from the directories and the map,\n" +
+    "// and `loam validate --all` reports `subsystem.views-stale` when it drifts.\n" +
+    "// A navigation aid, not the fleet's architecture: author your own diagrams elsewhere.\n";
+/**
+ * Render the whole file, or null when no service resolves to a map element —
+ * the file must then be ABSENT, so a fleet whose map draws nothing never
+ * carries a generated artifact that says nothing.
+ *
+ * Services sorted by id and peers sorted by id, one `include` per line: the
+ * output is byte-reproducible on any machine from the same committed bytes (no
+ * timestamps, no absolute paths, no readdir-order dependence), and two
+ * concurrent changes to different services touch different lines, so git merges
+ * the file without intervention.
+ */
+export function renderServiceViews(input) {
+    if (input.subjects.length === 0)
+        return null;
+    const lines = [HEADER, ...(input.disclosure === null ? [] : [input.disclosure]), "views {"];
+    const subjects = [...input.subjects].sort((a, b) => (a.id < b.id ? -1 : 1));
+    for (const [i, subject] of subjects.entries()) {
+        if (i > 0)
+            lines.push("");
+        lines.push(...viewLines(subject, peersOf(subject.fqn, input.relationships), input.styled));
+    }
+    lines.push("}");
+    return lines.join("\n") + "\n";
+}
+/**
+ * One view, in the order the parser demands: metadata FIRST, and that is a hard
+ * constraint rather than a taste — measured, an `include` line followed by
+ * `title` is a parse error ("Expecting token of type '}' but found `title`"),
+ * and one parse error in this file blanks the whole `architecture/` project in
+ * the renderer. `global style` sits after `title` and before anything that
+ * includes, where the same pin measured it parsing with zero errors.
+ */
+function viewLines(subject, peers, styled) {
+    const { fqn } = subject;
+    const out = [`  view ${serviceViewId(subject.id)} of ${fqn} {`, `    title '${subject.title}'`];
+    if (styled)
+        out.push(`    global style ${SERVICE_STYLE_GROUP}`);
+    out.push("    include *");
+    for (const peer of peers)
+        out.push(`    include ${peer}`);
+    out.push("    exclude * -> *", `    include -> ${fqn}`, `    include ${fqn} ->`);
+    // The interior wiring, last. Measured: `include <fqn>.* -> <fqn>.*` on a
+    // CHILDLESS element is legal — `likec4 validate` reports valid and the export
+    // carries zero errors — so one generated line serves both model shapes: an
+    // EXTENDING model's containers live in the root project and are drawn, a
+    // STANDALONE model's are not in this project and the line matches nothing.
+    out.push(`    include ${fqn}.* -> ${fqn}.*`, "  }");
+    return out;
+}
+//# sourceMappingURL=views.js.map