@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/core/scaffold/landscape.js

@@ -9,6 +9,7 @@
  * The two change for different reasons: a new artifact edits the first, better
  * advice to a new fleet edits the second.
  */
+import { LEGACY_LANDSCAPE_STUBS } from "./legacy.js";
 /**
  * The fleet map, empty but valid.
  *
@@ -38,6 +39,20 @@
  * The `views` block below has a deliberate second copy: `core/c4/seed/template.ts` emits the
  * same two views into a seeded landscape (two strikes; extract on a third), and test/seed.test.ts
  * compares the two blocks byte for byte — comments included — so whichever copy drifts fails.
+ *
+ * The seven RELATIONSHIP kinds are scaffolded for the element kinds' reason:
+ * they are vocabulary, not a guess about this fleet. Declared here, every
+ * extending model and every adoption borrows them, so the first edge anybody
+ * draws can say what it carries and which way it points. A real fleet drawn
+ * without them ended with every arrow pointing into its broker and its stores,
+ * because deployment configuration says only that two things are connected. A
+ * declaration here also keeps a feature archivable: the archive copies a
+ * delta's edge into this file and never a declaration, so a kind this file
+ * lacks refuses the merge (`merge-failed`). A `legend` view is NOT scaffolded:
+ * a view names only elements the model declares, this model is empty, and an
+ * invented example would be a box every fleet check grades. The comment says
+ * when to write one. The kinds block has the same deliberate second copy in
+ * `core/c4/seed/template.ts`, pinned the same way by test/seed.test.ts.
  */
 export const LANDSCAPE_STUB = `// The fleet map: every service in services/ appears here, and every call
 // between two of them is an edge. This file is written by hand — loam never
@@ -54,16 +69,37 @@ export const LANDSCAPE_STUB = `// The fleet map: every service in services/ appe
 // and give each call the operationId it uses, so requirements, C4 and OpenAPI
 // can be cross-checked:
 //
-//   checkoutWeb -> paymentService 'Authorizes' {
+//   checkoutWeb -[calls]-> paymentService 'Authorizes' {
 //     metadata { op 'authorizePayment' }
 //   }
 //
+// Every edge says what it carries with one of the relationship kinds declared
+// below, and points the way the evidence says — never a guess:
+//
+//   checkoutWeb -[calls]-> orderService            a synchronous request
+//   orderService -[publishes]-> kafka.orderEvents   producer to topic
+//   kafka.orderEvents -[delivers]-> paymentService  topic to consumer
+//   paymentService -[reads]-> ordersDb              always service to store; the
+//                                                   style puts the head on the reader
+//   orderService -[connects]-> kafka                no direction established yet
+//
+// Configuration that only names an address says two things are connected and
+// nothing more: that is \`connects\`, and adopting the service from its code
+// turns it into the real kind. Once the map has a real edge of each kind, add
+// a \`legend\` view that draws one of each. \`loam instructions loam-drawing\`
+// has the whole convention.
+//
 // The \`views\` block at the bottom is for LikeC4's own tooling — loam reads
 // the model and never a view. Render with \`npx likec4 start\` from the docs
-// repo root, which likec4.config.json scopes to this directory. (A service
-// model or a feature delta renders from its OWN directory, e.g.
-// \`npx likec4 start services/<id>\`: each declares its own \`specification\`
-// block, so the renderer can only be given one of them at a time.) Keep views
+// repo root, which likec4.config.json scopes to this directory. A service's
+// \`services/<id>/model.likec4\` EXTENDS this map: it declares no
+// \`specification\` block of its own, so it belongs to THIS project and renders
+// with it, containers and all. A model that declares its own \`specification\`
+// stands alone instead — it renders only from its own directory
+// (\`npx likec4 start services/<id>\`), and the \`exclude\` list in the root
+// likec4.config.json has to cover that directory or its declarations collide
+// with this file's. \`loam subsystem sync\` maintains both, so neither is
+// hand-edited. Keep views
 // scoped, because computing one is superlinear in the number of edges — the
 // \`fleet\` view below stays affordable precisely because it excludes the
 // platform hubs.
@@ -96,6 +132,48 @@ specification {
   // without losing "who depends on the Identity Provider", which the platform
   // view answers.
   tag platform
+
+  // One kind per kind of traffic, each with one direction. The style is the
+  // picture: amber for messages, green for data at rest, gray and dashed for
+  // a connection nobody has given a direction yet. Never tag a kind: LikeC4
+  // copies a kind's tags onto every edge of it.
+  relationship publishes {
+    color amber
+    line solid
+    head normal
+  }
+  relationship delivers {
+    color amber
+    line solid
+    head normal
+  }
+  relationship reads {
+    color green
+    head none
+    tail normal
+  }
+  relationship writes {
+    color green
+    head normal
+  }
+  relationship readsWrites {
+    color green
+    head normal
+    tail normal
+  }
+  relationship calls {
+    color secondary
+    line solid
+    head normal
+  }
+  relationship connects {
+    color gray
+    line dashed
+    head none
+    // A marker at the source: an edge with no arrowhead at either end is laid
+    // out unconstrained, and enough of them flatten a view into one band.
+    tail odot
+  }
 }
 
 model {
@@ -115,17 +193,47 @@ views {
 }
 `;
 /**
- * Whether the fleet map is still the scaffold's own bytes — the sentinel
+ * The one thing loam itself ever writes ABOVE the stub: `core/docs.ts`'s
+ * `landscapePreamble`, spliced in as `${preamble.trimEnd()}\n//\n` — comment
+ * lines, closed by a bare `//` that separates the caller's sentence from the
+ * scaffold's own opening paragraph. `migrate-openspec` is the only caller.
+ *
+ * Matched as a SHAPE rather than as the migrator's exact sentence because the
+ * preamble is a parameter, and because the alternative is a second copy of that
+ * sentence in a package `core/scaffold/` must not import from
+ * (`commands/migrate-openspec/materialize/target.ts`). The shape is tight where
+ * it has to be: the closing bare `//` is what a hand-written note above the map
+ * does not have.
+ */
+const LOAM_PREAMBLE = /^(?:\/\/[^\n]*\n)*\/\/\n$/;
+/**
+ * Whether the fleet map is still a scaffold's own bytes — the sentinel
  * doctrine of core/coherence/authoring/sentinels.ts: the writer above and this
- * checker read ONE string, so they cannot drift apart. `endsWith`, not
- * equality, because `migrate-openspec` prepends a `landscapePreamble` to the
- * identical stub; CRLF-normalised because a checkout under core.autocrlf is
- * still untouched. A hand-edit inside the stub body breaks the suffix match —
- * the safe failure mode is a false "authored", which merely drops one teaching
- * step from `loam status`'s empty-fleet ladder (core/status/fleet/next.ts).
+ * checker read ONE string, so they cannot drift apart. CRLF-normalised because
+ * a checkout under core.autocrlf is still untouched. Every generation loam ever
+ * wrote counts, not just the current one — see `LEGACY_LANDSCAPE_STUBS`. A
+ * hand-edit inside the stub body breaks the match — the safe failure mode is a
+ * false "authored", which merely drops one teaching step from `loam status`'s
+ * empty-fleet ladder (core/status/fleet/next.ts).
+ *
+ * ANCHORED AT BOTH ENDS, past a preamble loam wrote itself. This was a bare
+ * `endsWith`, so anything a person put ABOVE the stub was invisible to the
+ * guard: `loam seed` overwrote a two-line "OWNED BY THE ARCHITECTURE GUILD — do
+ * not regenerate" header while printing "replaced the scaffold's untouched
+ * stub", against its own promise that "Seed never overwrites human work"
+ * (`commands/seed/commit.ts`; verification 2026-09-04, second pass). The suffix
+ * match existed for the migration preamble alone, so that is now the only
+ * prefix accepted, and everything else above the stub makes the file authored.
  */
 export function isLandscapeStub(content) {
     const normal = (s) => s.replace(/\r\n/g, "\n").trimEnd();
-    return normal(content).endsWith(normal(LANDSCAPE_STUB));
+    const seen = normal(content);
+    return [LANDSCAPE_STUB, ...LEGACY_LANDSCAPE_STUBS].some((stub) => {
+        const body = normal(stub);
+        if (!seen.endsWith(body))
+            return false;
+        const prefix = seen.slice(0, seen.length - body.length);
+        return prefix === "" || LOAM_PREAMBLE.test(prefix);
+    });
 }
 //# sourceMappingURL=landscape.js.map

package/dist/core/scaffold/landscape.js.map

@@ -1 +1 @@
-{"version":3,"file":"landscape.js","sourceRoot":"","sources":["../../../src/core/scaffold/landscape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0E7B,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;AAC1D,CAAC","sourcesContent":["/**\n * The bytes a brand-new docs repo's fleet map starts with, and the one\n * question anybody asks of them afterwards: has a human touched this yet?\n *\n * Split out of `../docs.ts` when the README joined the scaffold and the file\n * reached its line limit, and the seam was already there: `docs.ts` says what\n * a docs repo is MADE OF — which directories, which files, in what order —\n * while this package holds the CONTENT of the authored templates it lays down.\n * The two change for different reasons: a new artifact edits the first, better\n * advice to a new fleet edits the second.\n */\n\n/**\n * The fleet map, empty but valid.\n *\n * Nobody writes this file automatically — `adopt` deliberately does not touch\n * it, because who calls whom is a human judgement and a generated landscape\n * would be a guess presented as the map. But \"nobody writes it\" used to mean\n * \"it is simply absent\", and an absent landscape is the one artifact whose\n * absence silences the fleet-wide checks entirely: every cross-service breach\n * `validate` exists to find is invisible on a repo with no landscape.\n *\n * So the scaffold lays down the empty map instead: the four element kinds a\n * fleet actually uses are declared, the model is empty, and the comments say\n * what to add and why. The first `loam adopt` then has somewhere to be drawn.\n *\n * A `views` block IS scaffolded — reversing the decision this comment used to\n * record, which was: no views, because computing one is superlinear in edge\n * count and a scaffolded `include *` handed every repo a fleet-sized bill for\n * the first tool that renders. That cost was real and still is; what changed\n * is the shape of the block. A fleet map stops being readable at the third\n * service unless platform infrastructure is split out, and the split's\n * `exclude element.tag = #platform` is exactly the\n * pruning that keeps the fleet view's render affordable — the scaffold now\n * pays the old objection instead of ignoring it. loam itself still reads\n * elements and relationships and never a view. The platform view's predicate\n * is scaffolded because it is the line users mistype: the obvious spelling\n * draws boxes with no edges.\n * The `views` block below has a deliberate second copy: `core/c4/seed/template.ts` emits the\n * same two views into a seeded landscape (two strikes; extract on a third), and test/seed.test.ts\n * compares the two blocks byte for byte — comments included — so whichever copy drifts fails.\n */\nexport const LANDSCAPE_STUB = `// The fleet map: every service in services/ appears here, and every call\n// between two of them is an edge. This file is written by hand — loam never\n// guesses it, because \"who calls whom\" is the one fact no generator can read\n// off a repository.\n//\n// After \\`loam adopt --service <id>\\`, add the service here:\n//\n//   paymentService = softwareSystem 'payment-service' {\n//     description 'Owns payment authorization/capture'\n//     metadata { service 'payment-service' }   // binds the box to services/<id>/\n//   }\n//\n// and give each call the operationId it uses, so requirements, C4 and OpenAPI\n// can be cross-checked:\n//\n//   checkoutWeb -> paymentService 'Authorizes' {\n//     metadata { op 'authorizePayment' }\n//   }\n//\n// The \\`views\\` block at the bottom is for LikeC4's own tooling — loam reads\n// the model and never a view. Render with \\`npx likec4 start\\` from the docs\n// repo root, which likec4.config.json scopes to this directory. (A service\n// model or a feature delta renders from its OWN directory, e.g.\n// \\`npx likec4 start services/<id>\\`: each declares its own \\`specification\\`\n// block, so the renderer can only be given one of them at a time.) Keep views\n// scoped, because computing one is superlinear in the number of edges — the\n// \\`fleet\\` view below stays affordable precisely because it excludes the\n// platform hubs.\n//\n// One shape is worth getting right before the fleet is drawn: a shared broker.\n// Kafka as a single element becomes the node every service points at, and any\n// view over it is a star nobody can read. Model the TOPIC instead — a \\`topic\\`\n// nested inside the broker's element, edges pointing at \\`kafka.<topic>\\` — which\n// splits one hub of degree sixty into a dozen small ones and is the truer model\n// besides. Tag the KIND, not just the broker: LikeC4 does not inherit tags, so a\n// topic under an \\`#external\\` broker is not external itself and \\`validate\\` asks\n// for a services/ directory nobody owes.\n//\n//   specification {\n//     element topic {\n//       #external\n//       style { shape queue }\n//     }\n//   }\n\nspecification {\n  element person\n  element softwareSystem\n  element container\n  element database\n\n  // Ubiquitous infrastructure — logging Kafka, auth, service discovery — takes\n  // one inbound edge per service, and by the third service the fleet view is a\n  // hairball. Tag those elements #platform: the fleet view excludes them\n  // without losing \"who depends on the Identity Provider\", which the platform\n  // view answers.\n  tag platform\n}\n\nmodel {\n}\n\nviews {\n  view fleet {\n    include *\n    exclude element.tag = #platform\n  }\n  // The obvious spelling — \\`include element.tag = #platform\\` — draws the\n  // platform boxes with NO edges and no consumers. The predicate that works is\n  // the relationship form below.\n  view platform {\n    include * -> element.tag = #platform\n  }\n}\n`;\n\n/**\n * Whether the fleet map is still the scaffold's own bytes — the sentinel\n * doctrine of core/coherence/authoring/sentinels.ts: the writer above and this\n * checker read ONE string, so they cannot drift apart. `endsWith`, not\n * equality, because `migrate-openspec` prepends a `landscapePreamble` to the\n * identical stub; CRLF-normalised because a checkout under core.autocrlf is\n * still untouched. A hand-edit inside the stub body breaks the suffix match —\n * the safe failure mode is a false \"authored\", which merely drops one teaching\n * step from `loam status`'s empty-fleet ladder (core/status/fleet/next.ts).\n */\nexport function isLandscapeStub(content: string): boolean {\n  const normal = (s: string): string => s.replace(/\\r\\n/g, \"\\n\").trimEnd();\n  return normal(content).endsWith(normal(LANDSCAPE_STUB));\n}\n"]}
+{"version":3,"file":"landscape.js","sourceRoot":"","sources":["../../../src/core/scaffold/landscape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyI7B,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,cAAc,EAAE,GAAG,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * The bytes a brand-new docs repo's fleet map starts with, and the one\n * question anybody asks of them afterwards: has a human touched this yet?\n *\n * Split out of `../docs.ts` when the README joined the scaffold and the file\n * reached its line limit, and the seam was already there: `docs.ts` says what\n * a docs repo is MADE OF — which directories, which files, in what order —\n * while this package holds the CONTENT of the authored templates it lays down.\n * The two change for different reasons: a new artifact edits the first, better\n * advice to a new fleet edits the second.\n */\n\nimport { LEGACY_LANDSCAPE_STUBS } from \"./legacy.js\";\n\n/**\n * The fleet map, empty but valid.\n *\n * Nobody writes this file automatically — `adopt` deliberately does not touch\n * it, because who calls whom is a human judgement and a generated landscape\n * would be a guess presented as the map. But \"nobody writes it\" used to mean\n * \"it is simply absent\", and an absent landscape is the one artifact whose\n * absence silences the fleet-wide checks entirely: every cross-service breach\n * `validate` exists to find is invisible on a repo with no landscape.\n *\n * So the scaffold lays down the empty map instead: the four element kinds a\n * fleet actually uses are declared, the model is empty, and the comments say\n * what to add and why. The first `loam adopt` then has somewhere to be drawn.\n *\n * A `views` block IS scaffolded — reversing the decision this comment used to\n * record, which was: no views, because computing one is superlinear in edge\n * count and a scaffolded `include *` handed every repo a fleet-sized bill for\n * the first tool that renders. That cost was real and still is; what changed\n * is the shape of the block. A fleet map stops being readable at the third\n * service unless platform infrastructure is split out, and the split's\n * `exclude element.tag = #platform` is exactly the\n * pruning that keeps the fleet view's render affordable — the scaffold now\n * pays the old objection instead of ignoring it. loam itself still reads\n * elements and relationships and never a view. The platform view's predicate\n * is scaffolded because it is the line users mistype: the obvious spelling\n * draws boxes with no edges.\n * The `views` block below has a deliberate second copy: `core/c4/seed/template.ts` emits the\n * same two views into a seeded landscape (two strikes; extract on a third), and test/seed.test.ts\n * compares the two blocks byte for byte — comments included — so whichever copy drifts fails.\n *\n * The seven RELATIONSHIP kinds are scaffolded for the element kinds' reason:\n * they are vocabulary, not a guess about this fleet. Declared here, every\n * extending model and every adoption borrows them, so the first edge anybody\n * draws can say what it carries and which way it points. A real fleet drawn\n * without them ended with every arrow pointing into its broker and its stores,\n * because deployment configuration says only that two things are connected. A\n * declaration here also keeps a feature archivable: the archive copies a\n * delta's edge into this file and never a declaration, so a kind this file\n * lacks refuses the merge (`merge-failed`). A `legend` view is NOT scaffolded:\n * a view names only elements the model declares, this model is empty, and an\n * invented example would be a box every fleet check grades. The comment says\n * when to write one. The kinds block has the same deliberate second copy in\n * `core/c4/seed/template.ts`, pinned the same way by test/seed.test.ts.\n */\nexport const LANDSCAPE_STUB = `// The fleet map: every service in services/ appears here, and every call\n// between two of them is an edge. This file is written by hand — loam never\n// guesses it, because \"who calls whom\" is the one fact no generator can read\n// off a repository.\n//\n// After \\`loam adopt --service <id>\\`, add the service here:\n//\n//   paymentService = softwareSystem 'payment-service' {\n//     description 'Owns payment authorization/capture'\n//     metadata { service 'payment-service' }   // binds the box to services/<id>/\n//   }\n//\n// and give each call the operationId it uses, so requirements, C4 and OpenAPI\n// can be cross-checked:\n//\n//   checkoutWeb -[calls]-> paymentService 'Authorizes' {\n//     metadata { op 'authorizePayment' }\n//   }\n//\n// Every edge says what it carries with one of the relationship kinds declared\n// below, and points the way the evidence says — never a guess:\n//\n//   checkoutWeb -[calls]-> orderService            a synchronous request\n//   orderService -[publishes]-> kafka.orderEvents   producer to topic\n//   kafka.orderEvents -[delivers]-> paymentService  topic to consumer\n//   paymentService -[reads]-> ordersDb              always service to store; the\n//                                                   style puts the head on the reader\n//   orderService -[connects]-> kafka                no direction established yet\n//\n// Configuration that only names an address says two things are connected and\n// nothing more: that is \\`connects\\`, and adopting the service from its code\n// turns it into the real kind. Once the map has a real edge of each kind, add\n// a \\`legend\\` view that draws one of each. \\`loam instructions loam-drawing\\`\n// has the whole convention.\n//\n// The \\`views\\` block at the bottom is for LikeC4's own tooling — loam reads\n// the model and never a view. Render with \\`npx likec4 start\\` from the docs\n// repo root, which likec4.config.json scopes to this directory. A service's\n// \\`services/<id>/model.likec4\\` EXTENDS this map: it declares no\n// \\`specification\\` block of its own, so it belongs to THIS project and renders\n// with it, containers and all. A model that declares its own \\`specification\\`\n// stands alone instead — it renders only from its own directory\n// (\\`npx likec4 start services/<id>\\`), and the \\`exclude\\` list in the root\n// likec4.config.json has to cover that directory or its declarations collide\n// with this file's. \\`loam subsystem sync\\` maintains both, so neither is\n// hand-edited. Keep views\n// scoped, because computing one is superlinear in the number of edges — the\n// \\`fleet\\` view below stays affordable precisely because it excludes the\n// platform hubs.\n//\n// One shape is worth getting right before the fleet is drawn: a shared broker.\n// Kafka as a single element becomes the node every service points at, and any\n// view over it is a star nobody can read. Model the TOPIC instead — a \\`topic\\`\n// nested inside the broker's element, edges pointing at \\`kafka.<topic>\\` — which\n// splits one hub of degree sixty into a dozen small ones and is the truer model\n// besides. Tag the KIND, not just the broker: LikeC4 does not inherit tags, so a\n// topic under an \\`#external\\` broker is not external itself and \\`validate\\` asks\n// for a services/ directory nobody owes.\n//\n//   specification {\n//     element topic {\n//       #external\n//       style { shape queue }\n//     }\n//   }\n\nspecification {\n  element person\n  element softwareSystem\n  element container\n  element database\n\n  // Ubiquitous infrastructure — logging Kafka, auth, service discovery — takes\n  // one inbound edge per service, and by the third service the fleet view is a\n  // hairball. Tag those elements #platform: the fleet view excludes them\n  // without losing \"who depends on the Identity Provider\", which the platform\n  // view answers.\n  tag platform\n\n  // One kind per kind of traffic, each with one direction. The style is the\n  // picture: amber for messages, green for data at rest, gray and dashed for\n  // a connection nobody has given a direction yet. Never tag a kind: LikeC4\n  // copies a kind's tags onto every edge of it.\n  relationship publishes {\n    color amber\n    line solid\n    head normal\n  }\n  relationship delivers {\n    color amber\n    line solid\n    head normal\n  }\n  relationship reads {\n    color green\n    head none\n    tail normal\n  }\n  relationship writes {\n    color green\n    head normal\n  }\n  relationship readsWrites {\n    color green\n    head normal\n    tail normal\n  }\n  relationship calls {\n    color secondary\n    line solid\n    head normal\n  }\n  relationship connects {\n    color gray\n    line dashed\n    head none\n    // A marker at the source: an edge with no arrowhead at either end is laid\n    // out unconstrained, and enough of them flatten a view into one band.\n    tail odot\n  }\n}\n\nmodel {\n}\n\nviews {\n  view fleet {\n    include *\n    exclude element.tag = #platform\n  }\n  // The obvious spelling — \\`include element.tag = #platform\\` — draws the\n  // platform boxes with NO edges and no consumers. The predicate that works is\n  // the relationship form below.\n  view platform {\n    include * -> element.tag = #platform\n  }\n}\n`;\n\n/**\n * The one thing loam itself ever writes ABOVE the stub: `core/docs.ts`'s\n * `landscapePreamble`, spliced in as `${preamble.trimEnd()}\\n//\\n` — comment\n * lines, closed by a bare `//` that separates the caller's sentence from the\n * scaffold's own opening paragraph. `migrate-openspec` is the only caller.\n *\n * Matched as a SHAPE rather than as the migrator's exact sentence because the\n * preamble is a parameter, and because the alternative is a second copy of that\n * sentence in a package `core/scaffold/` must not import from\n * (`commands/migrate-openspec/materialize/target.ts`). The shape is tight where\n * it has to be: the closing bare `//` is what a hand-written note above the map\n * does not have.\n */\nconst LOAM_PREAMBLE = /^(?:\\/\\/[^\\n]*\\n)*\\/\\/\\n$/;\n\n/**\n * Whether the fleet map is still a scaffold's own bytes — the sentinel\n * doctrine of core/coherence/authoring/sentinels.ts: the writer above and this\n * checker read ONE string, so they cannot drift apart. CRLF-normalised because\n * a checkout under core.autocrlf is still untouched. Every generation loam ever\n * wrote counts, not just the current one — see `LEGACY_LANDSCAPE_STUBS`. A\n * hand-edit inside the stub body breaks the match — the safe failure mode is a\n * false \"authored\", which merely drops one teaching step from `loam status`'s\n * empty-fleet ladder (core/status/fleet/next.ts).\n *\n * ANCHORED AT BOTH ENDS, past a preamble loam wrote itself. This was a bare\n * `endsWith`, so anything a person put ABOVE the stub was invisible to the\n * guard: `loam seed` overwrote a two-line \"OWNED BY THE ARCHITECTURE GUILD — do\n * not regenerate\" header while printing \"replaced the scaffold's untouched\n * stub\", against its own promise that \"Seed never overwrites human work\"\n * (`commands/seed/commit.ts`; verification 2026-09-04, second pass). The suffix\n * match existed for the migration preamble alone, so that is now the only\n * prefix accepted, and everything else above the stub makes the file authored.\n */\nexport function isLandscapeStub(content: string): boolean {\n  const normal = (s: string): string => s.replace(/\\r\\n/g, \"\\n\").trimEnd();\n  const seen = normal(content);\n  return [LANDSCAPE_STUB, ...LEGACY_LANDSCAPE_STUBS].some((stub) => {\n    const body = normal(stub);\n    if (!seen.endsWith(body)) return false;\n    const prefix = seen.slice(0, seen.length - body.length);\n    return prefix === \"\" || LOAM_PREAMBLE.test(prefix);\n  });\n}\n"]}

package/dist/core/scaffold/legacy.js

@@ -0,0 +1,271 @@
+/**
+ * Every fleet map an earlier loam scaffolded, frozen, so `isLandscapeStub` in
+ * ./landscape.ts can still tell an untouched old scaffold from a hand-drawn map.
+ *
+ * Moved out of ./landscape.ts when that file neared its line limit, along the
+ * seam the two halves already had: ./landscape.ts holds the stub loam writes
+ * NOW and the predicate that reads it, this module holds what loam wrote
+ * before. The first changes whenever the advice to a new fleet improves; this
+ * one only ever grows by one entry, when that happens.
+ */
+/**
+ * Stubs earlier versions of loam wrote, FROZEN — never re-derived from
+ * `LANDSCAPE_STUB` in ./landscape.ts, or an edit to it would silently rewrite
+ * history.
+ *
+ * `isLandscapeStub` is a suffix match on the exact bytes, and `loam seed`
+ * refuses (`seed-landscape-edited`) on a map it judges authored. So editing
+ * the stub reclassifies every untouched older scaffold as hand-edited, in
+ * repositories nobody has touched — the teaching step disappears from `loam
+ * status` and `seed` refuses a map its own scaffold wrote. Each entry is one
+ * shipped generation of the file, OLDEST FIRST, appended when
+ * `LANDSCAPE_STUB`'s text changes — every generation loam ever wrote is here,
+ * not just the previous one, since a repository scaffolded two releases ago is
+ * as untouched as one scaffolded yesterday.
+ *
+ * Generation 1 (v0.1.0-beta.1, .2): the stub lived in core/docs.ts, carried no
+ * `views` block at all ("on purpose: loam reads the model and never a view")
+ * and no `tag platform`.
+ * Generation 2 (v0.1.0-beta.3): the same file with the render paragraph
+ * rewritten — still no `views` block, still no `tag platform`.
+ * Generation 3 (v0.2.0-alpha.1 through .5): the `views` paragraph taught the
+ * retired shape — that a service model "renders from its OWN directory" and
+ * "each declares its own `specification` block" — which was written before an
+ * extending model belonged to the root project.
+ * Generation 4 (v0.2.0-alpha.6 through .11): the extending shape's render
+ * paragraph and the shared-broker advice, with no relationship kinds — every
+ * edge a plain `->`, which is how a fleet drawn from deployment configuration
+ * ended with every arrow pointing into its broker and its stores.
+ */
+export const LEGACY_LANDSCAPE_STUBS = [
+    `// The fleet map: every service in services/ appears here, and every call
+// between two of them is an edge. This file is written by hand — loam never
+// guesses it, because "who calls whom" is the one fact no generator can read
+// off a repository.
+//
+// After \`loam adopt --service <id>\`, add the service here:
+//
+//   paymentService = softwareSystem 'payment-service' {
+//     description 'Owns payment authorization/capture'
+//     metadata { service 'payment-service' }   // binds the box to services/<id>/
+//   }
+//
+// and give each call the operationId it uses, so requirements, C4 and OpenAPI
+// can be cross-checked:
+//
+//   checkoutWeb -> paymentService 'Authorizes' {
+//     metadata { op 'authorizePayment' }
+//   }
+//
+// There is no \`views\` block, on purpose: loam reads the model and never a
+// view, so it would draw nothing. Add views here if you want diagrams, and
+// render them with LikeC4's own tooling (\`npx likec4 start\`) — but scope them,
+// because computing a view is superlinear in the number of edges and an
+// \`include *\` over a whole fleet takes minutes.
+
+specification {
+  element person
+  element softwareSystem
+  element container
+  element database
+}
+
+model {
+}
+`,
+    `// The fleet map: every service in services/ appears here, and every call
+// between two of them is an edge. This file is written by hand — loam never
+// guesses it, because "who calls whom" is the one fact no generator can read
+// off a repository.
+//
+// After \`loam adopt --service <id>\`, add the service here:
+//
+//   paymentService = softwareSystem 'payment-service' {
+//     description 'Owns payment authorization/capture'
+//     metadata { service 'payment-service' }   // binds the box to services/<id>/
+//   }
+//
+// and give each call the operationId it uses, so requirements, C4 and OpenAPI
+// can be cross-checked:
+//
+//   checkoutWeb -> paymentService 'Authorizes' {
+//     metadata { op 'authorizePayment' }
+//   }
+//
+// There is no \`views\` block, on purpose: loam reads the model and never a
+// view, so it would draw nothing. Add views here if you want diagrams, and
+// render them with LikeC4's own tooling — \`npx likec4 start\` from the docs
+// repo root, which likec4.config.json scopes to this directory. (A service
+// model or a feature delta renders from its OWN directory, e.g.
+// \`npx likec4 start services/<id>\`: each declares its own \`specification\`
+// block, so the renderer can only be given one of them at a time.) Scope your
+// views, because computing one is superlinear in the number of edges and an
+// \`include *\` over a whole fleet takes minutes.
+
+specification {
+  element person
+  element softwareSystem
+  element container
+  element database
+}
+
+model {
+}
+`,
+    `// The fleet map: every service in services/ appears here, and every call
+// between two of them is an edge. This file is written by hand — loam never
+// guesses it, because "who calls whom" is the one fact no generator can read
+// off a repository.
+//
+// After \`loam adopt --service <id>\`, add the service here:
+//
+//   paymentService = softwareSystem 'payment-service' {
+//     description 'Owns payment authorization/capture'
+//     metadata { service 'payment-service' }   // binds the box to services/<id>/
+//   }
+//
+// and give each call the operationId it uses, so requirements, C4 and OpenAPI
+// can be cross-checked:
+//
+//   checkoutWeb -> paymentService 'Authorizes' {
+//     metadata { op 'authorizePayment' }
+//   }
+//
+// The \`views\` block at the bottom is for LikeC4's own tooling — loam reads
+// the model and never a view. Render with \`npx likec4 start\` from the docs
+// repo root, which likec4.config.json scopes to this directory. (A service
+// model or a feature delta renders from its OWN directory, e.g.
+// \`npx likec4 start services/<id>\`: each declares its own \`specification\`
+// block, so the renderer can only be given one of them at a time.) Keep views
+// scoped, because computing one is superlinear in the number of edges — the
+// \`fleet\` view below stays affordable precisely because it excludes the
+// platform hubs.
+//
+// One shape is worth getting right before the fleet is drawn: a shared broker.
+// Kafka as a single element becomes the node every service points at, and any
+// view over it is a star nobody can read. Model the TOPIC instead — a \`topic\`
+// nested inside the broker's element, edges pointing at \`kafka.<topic>\` — which
+// splits one hub of degree sixty into a dozen small ones and is the truer model
+// besides. Tag the KIND, not just the broker: LikeC4 does not inherit tags, so a
+// topic under an \`#external\` broker is not external itself and \`validate\` asks
+// for a services/ directory nobody owes.
+//
+//   specification {
+//     element topic {
+//       #external
+//       style { shape queue }
+//     }
+//   }
+
+specification {
+  element person
+  element softwareSystem
+  element container
+  element database
+
+  // Ubiquitous infrastructure — logging Kafka, auth, service discovery — takes
+  // one inbound edge per service, and by the third service the fleet view is a
+  // hairball. Tag those elements #platform: the fleet view excludes them
+  // without losing "who depends on the Identity Provider", which the platform
+  // view answers.
+  tag platform
+}
+
+model {
+}
+
+views {
+  view fleet {
+    include *
+    exclude element.tag = #platform
+  }
+  // The obvious spelling — \`include element.tag = #platform\` — draws the
+  // platform boxes with NO edges and no consumers. The predicate that works is
+  // the relationship form below.
+  view platform {
+    include * -> element.tag = #platform
+  }
+}
+`,
+    `// The fleet map: every service in services/ appears here, and every call
+// between two of them is an edge. This file is written by hand — loam never
+// guesses it, because "who calls whom" is the one fact no generator can read
+// off a repository.
+//
+// After \`loam adopt --service <id>\`, add the service here:
+//
+//   paymentService = softwareSystem 'payment-service' {
+//     description 'Owns payment authorization/capture'
+//     metadata { service 'payment-service' }   // binds the box to services/<id>/
+//   }
+//
+// and give each call the operationId it uses, so requirements, C4 and OpenAPI
+// can be cross-checked:
+//
+//   checkoutWeb -> paymentService 'Authorizes' {
+//     metadata { op 'authorizePayment' }
+//   }
+//
+// The \`views\` block at the bottom is for LikeC4's own tooling — loam reads
+// the model and never a view. Render with \`npx likec4 start\` from the docs
+// repo root, which likec4.config.json scopes to this directory. A service's
+// \`services/<id>/model.likec4\` EXTENDS this map: it declares no
+// \`specification\` block of its own, so it belongs to THIS project and renders
+// with it, containers and all. A model that declares its own \`specification\`
+// stands alone instead — it renders only from its own directory
+// (\`npx likec4 start services/<id>\`), and the \`exclude\` list in the root
+// likec4.config.json has to cover that directory or its declarations collide
+// with this file's. \`loam subsystem sync\` maintains both, so neither is
+// hand-edited. Keep views
+// scoped, because computing one is superlinear in the number of edges — the
+// \`fleet\` view below stays affordable precisely because it excludes the
+// platform hubs.
+//
+// One shape is worth getting right before the fleet is drawn: a shared broker.
+// Kafka as a single element becomes the node every service points at, and any
+// view over it is a star nobody can read. Model the TOPIC instead — a \`topic\`
+// nested inside the broker's element, edges pointing at \`kafka.<topic>\` — which
+// splits one hub of degree sixty into a dozen small ones and is the truer model
+// besides. Tag the KIND, not just the broker: LikeC4 does not inherit tags, so a
+// topic under an \`#external\` broker is not external itself and \`validate\` asks
+// for a services/ directory nobody owes.
+//
+//   specification {
+//     element topic {
+//       #external
+//       style { shape queue }
+//     }
+//   }
+
+specification {
+  element person
+  element softwareSystem
+  element container
+  element database
+
+  // Ubiquitous infrastructure — logging Kafka, auth, service discovery — takes
+  // one inbound edge per service, and by the third service the fleet view is a
+  // hairball. Tag those elements #platform: the fleet view excludes them
+  // without losing "who depends on the Identity Provider", which the platform
+  // view answers.
+  tag platform
+}
+
+model {
+}
+
+views {
+  view fleet {
+    include *
+    exclude element.tag = #platform
+  }
+  // The obvious spelling — \`include element.tag = #platform\` — draws the
+  // platform boxes with NO edges and no consumers. The predicate that works is
+  // the relationship form below.
+  view platform {
+    include * -> element.tag = #platform
+  }
+}
+`,
+];
+//# sourceMappingURL=legacy.js.map

package/dist/core/scaffold/legacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy.js","sourceRoot":"","sources":["../../../src/core/scaffold/legacy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCD;IACC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCD;IACC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0ED;IACC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+ED;CACA,CAAC","sourcesContent":["/**\n * Every fleet map an earlier loam scaffolded, frozen, so `isLandscapeStub` in\n * ./landscape.ts can still tell an untouched old scaffold from a hand-drawn map.\n *\n * Moved out of ./landscape.ts when that file neared its line limit, along the\n * seam the two halves already had: ./landscape.ts holds the stub loam writes\n * NOW and the predicate that reads it, this module holds what loam wrote\n * before. The first changes whenever the advice to a new fleet improves; this\n * one only ever grows by one entry, when that happens.\n */\n\n/**\n * Stubs earlier versions of loam wrote, FROZEN — never re-derived from\n * `LANDSCAPE_STUB` in ./landscape.ts, or an edit to it would silently rewrite\n * history.\n *\n * `isLandscapeStub` is a suffix match on the exact bytes, and `loam seed`\n * refuses (`seed-landscape-edited`) on a map it judges authored. So editing\n * the stub reclassifies every untouched older scaffold as hand-edited, in\n * repositories nobody has touched — the teaching step disappears from `loam\n * status` and `seed` refuses a map its own scaffold wrote. Each entry is one\n * shipped generation of the file, OLDEST FIRST, appended when\n * `LANDSCAPE_STUB`'s text changes — every generation loam ever wrote is here,\n * not just the previous one, since a repository scaffolded two releases ago is\n * as untouched as one scaffolded yesterday.\n *\n * Generation 1 (v0.1.0-beta.1, .2): the stub lived in core/docs.ts, carried no\n * `views` block at all (\"on purpose: loam reads the model and never a view\")\n * and no `tag platform`.\n * Generation 2 (v0.1.0-beta.3): the same file with the render paragraph\n * rewritten — still no `views` block, still no `tag platform`.\n * Generation 3 (v0.2.0-alpha.1 through .5): the `views` paragraph taught the\n * retired shape — that a service model \"renders from its OWN directory\" and\n * \"each declares its own `specification` block\" — which was written before an\n * extending model belonged to the root project.\n * Generation 4 (v0.2.0-alpha.6 through .11): the extending shape's render\n * paragraph and the shared-broker advice, with no relationship kinds — every\n * edge a plain `->`, which is how a fleet drawn from deployment configuration\n * ended with every arrow pointing into its broker and its stores.\n */\nexport const LEGACY_LANDSCAPE_STUBS: readonly string[] = [\n  `// The fleet map: every service in services/ appears here, and every call\n// between two of them is an edge. This file is written by hand — loam never\n// guesses it, because \"who calls whom\" is the one fact no generator can read\n// off a repository.\n//\n// After \\`loam adopt --service <id>\\`, add the service here:\n//\n//   paymentService = softwareSystem 'payment-service' {\n//     description 'Owns payment authorization/capture'\n//     metadata { service 'payment-service' }   // binds the box to services/<id>/\n//   }\n//\n// and give each call the operationId it uses, so requirements, C4 and OpenAPI\n// can be cross-checked:\n//\n//   checkoutWeb -> paymentService 'Authorizes' {\n//     metadata { op 'authorizePayment' }\n//   }\n//\n// There is no \\`views\\` block, on purpose: loam reads the model and never a\n// view, so it would draw nothing. Add views here if you want diagrams, and\n// render them with LikeC4's own tooling (\\`npx likec4 start\\`) — but scope them,\n// because computing a view is superlinear in the number of edges and an\n// \\`include *\\` over a whole fleet takes minutes.\n\nspecification {\n  element person\n  element softwareSystem\n  element container\n  element database\n}\n\nmodel {\n}\n`,\n  `// The fleet map: every service in services/ appears here, and every call\n// between two of them is an edge. This file is written by hand — loam never\n// guesses it, because \"who calls whom\" is the one fact no generator can read\n// off a repository.\n//\n// After \\`loam adopt --service <id>\\`, add the service here:\n//\n//   paymentService = softwareSystem 'payment-service' {\n//     description 'Owns payment authorization/capture'\n//     metadata { service 'payment-service' }   // binds the box to services/<id>/\n//   }\n//\n// and give each call the operationId it uses, so requirements, C4 and OpenAPI\n// can be cross-checked:\n//\n//   checkoutWeb -> paymentService 'Authorizes' {\n//     metadata { op 'authorizePayment' }\n//   }\n//\n// There is no \\`views\\` block, on purpose: loam reads the model and never a\n// view, so it would draw nothing. Add views here if you want diagrams, and\n// render them with LikeC4's own tooling — \\`npx likec4 start\\` from the docs\n// repo root, which likec4.config.json scopes to this directory. (A service\n// model or a feature delta renders from its OWN directory, e.g.\n// \\`npx likec4 start services/<id>\\`: each declares its own \\`specification\\`\n// block, so the renderer can only be given one of them at a time.) Scope your\n// views, because computing one is superlinear in the number of edges and an\n// \\`include *\\` over a whole fleet takes minutes.\n\nspecification {\n  element person\n  element softwareSystem\n  element container\n  element database\n}\n\nmodel {\n}\n`,\n  `// The fleet map: every service in services/ appears here, and every call\n// between two of them is an edge. This file is written by hand — loam never\n// guesses it, because \"who calls whom\" is the one fact no generator can read\n// off a repository.\n//\n// After \\`loam adopt --service <id>\\`, add the service here:\n//\n//   paymentService = softwareSystem 'payment-service' {\n//     description 'Owns payment authorization/capture'\n//     metadata { service 'payment-service' }   // binds the box to services/<id>/\n//   }\n//\n// and give each call the operationId it uses, so requirements, C4 and OpenAPI\n// can be cross-checked:\n//\n//   checkoutWeb -> paymentService 'Authorizes' {\n//     metadata { op 'authorizePayment' }\n//   }\n//\n// The \\`views\\` block at the bottom is for LikeC4's own tooling — loam reads\n// the model and never a view. Render with \\`npx likec4 start\\` from the docs\n// repo root, which likec4.config.json scopes to this directory. (A service\n// model or a feature delta renders from its OWN directory, e.g.\n// \\`npx likec4 start services/<id>\\`: each declares its own \\`specification\\`\n// block, so the renderer can only be given one of them at a time.) Keep views\n// scoped, because computing one is superlinear in the number of edges — the\n// \\`fleet\\` view below stays affordable precisely because it excludes the\n// platform hubs.\n//\n// One shape is worth getting right before the fleet is drawn: a shared broker.\n// Kafka as a single element becomes the node every service points at, and any\n// view over it is a star nobody can read. Model the TOPIC instead — a \\`topic\\`\n// nested inside the broker's element, edges pointing at \\`kafka.<topic>\\` — which\n// splits one hub of degree sixty into a dozen small ones and is the truer model\n// besides. Tag the KIND, not just the broker: LikeC4 does not inherit tags, so a\n// topic under an \\`#external\\` broker is not external itself and \\`validate\\` asks\n// for a services/ directory nobody owes.\n//\n//   specification {\n//     element topic {\n//       #external\n//       style { shape queue }\n//     }\n//   }\n\nspecification {\n  element person\n  element softwareSystem\n  element container\n  element database\n\n  // Ubiquitous infrastructure — logging Kafka, auth, service discovery — takes\n  // one inbound edge per service, and by the third service the fleet view is a\n  // hairball. Tag those elements #platform: the fleet view excludes them\n  // without losing \"who depends on the Identity Provider\", which the platform\n  // view answers.\n  tag platform\n}\n\nmodel {\n}\n\nviews {\n  view fleet {\n    include *\n    exclude element.tag = #platform\n  }\n  // The obvious spelling — \\`include element.tag = #platform\\` — draws the\n  // platform boxes with NO edges and no consumers. The predicate that works is\n  // the relationship form below.\n  view platform {\n    include * -> element.tag = #platform\n  }\n}\n`,\n  `// The fleet map: every service in services/ appears here, and every call\n// between two of them is an edge. This file is written by hand — loam never\n// guesses it, because \"who calls whom\" is the one fact no generator can read\n// off a repository.\n//\n// After \\`loam adopt --service <id>\\`, add the service here:\n//\n//   paymentService = softwareSystem 'payment-service' {\n//     description 'Owns payment authorization/capture'\n//     metadata { service 'payment-service' }   // binds the box to services/<id>/\n//   }\n//\n// and give each call the operationId it uses, so requirements, C4 and OpenAPI\n// can be cross-checked:\n//\n//   checkoutWeb -> paymentService 'Authorizes' {\n//     metadata { op 'authorizePayment' }\n//   }\n//\n// The \\`views\\` block at the bottom is for LikeC4's own tooling — loam reads\n// the model and never a view. Render with \\`npx likec4 start\\` from the docs\n// repo root, which likec4.config.json scopes to this directory. A service's\n// \\`services/<id>/model.likec4\\` EXTENDS this map: it declares no\n// \\`specification\\` block of its own, so it belongs to THIS project and renders\n// with it, containers and all. A model that declares its own \\`specification\\`\n// stands alone instead — it renders only from its own directory\n// (\\`npx likec4 start services/<id>\\`), and the \\`exclude\\` list in the root\n// likec4.config.json has to cover that directory or its declarations collide\n// with this file's. \\`loam subsystem sync\\` maintains both, so neither is\n// hand-edited. Keep views\n// scoped, because computing one is superlinear in the number of edges — the\n// \\`fleet\\` view below stays affordable precisely because it excludes the\n// platform hubs.\n//\n// One shape is worth getting right before the fleet is drawn: a shared broker.\n// Kafka as a single element becomes the node every service points at, and any\n// view over it is a star nobody can read. Model the TOPIC instead — a \\`topic\\`\n// nested inside the broker's element, edges pointing at \\`kafka.<topic>\\` — which\n// splits one hub of degree sixty into a dozen small ones and is the truer model\n// besides. Tag the KIND, not just the broker: LikeC4 does not inherit tags, so a\n// topic under an \\`#external\\` broker is not external itself and \\`validate\\` asks\n// for a services/ directory nobody owes.\n//\n//   specification {\n//     element topic {\n//       #external\n//       style { shape queue }\n//     }\n//   }\n\nspecification {\n  element person\n  element softwareSystem\n  element container\n  element database\n\n  // Ubiquitous infrastructure — logging Kafka, auth, service discovery — takes\n  // one inbound edge per service, and by the third service the fleet view is a\n  // hairball. Tag those elements #platform: the fleet view excludes them\n  // without losing \"who depends on the Identity Provider\", which the platform\n  // view answers.\n  tag platform\n}\n\nmodel {\n}\n\nviews {\n  view fleet {\n    include *\n    exclude element.tag = #platform\n  }\n  // The obvious spelling — \\`include element.tag = #platform\\` — draws the\n  // platform boxes with NO edges and no consumers. The predicate that works is\n  // the relationship form below.\n  view platform {\n    include * -> element.tag = #platform\n  }\n}\n`,\n];\n"]}

package/dist/core/staging/commit.js

@@ -15,7 +15,8 @@
  */
 import { existsSync } from "node:fs";
 import { link, mkdir, readFile, rename, rm, rmdir, unlink, writeFile } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
+import { isPathInside, withoutNamespacePrefix } from "../kernel/path-safety.js";
 import { sameBytes, toBytes } from "./writes.js";
 /**
  * The target changed between the pre-image staging read and the swap.
@@ -47,9 +48,7 @@ export async function stageWrites(writes) {
     const staged = [];
     try {
         for (const [i, write] of writes.entries()) {
-            // mkdir(recursive) reports the topmost directory it had to create — the
-            // handle a rollback needs to put the tree back the way it found it.
-            const createdDir = (await mkdir(dirname(write.path), { recursive: true })) ?? null;
+            const createdDir = await mkdirReportingCreated(dirname(write.path));
             const before = existsSync(write.path) ? await readFile(write.path) : null;
             const content = toBytes(write.content);
             let tmp = null;
@@ -140,6 +139,21 @@ export async function rollbackStaged(staged) {
     await discardStaged(staged);
     return failures;
 }
+/**
+ * `mkdir -p`, reporting the topmost directory it had to create — the handle a
+ * rollback needs to put the tree back the way it found it — or null when every
+ * one already existed.
+ *
+ * The report is never handed on raw. On Windows, Node spells it with a `\\?\`
+ * prefix that no other path loam holds carries, and a rollback comparing the
+ * two spellings found nothing to prune (`withoutNamespacePrefix` has the
+ * measurement). Every caller that keeps a created directory for its rollback
+ * takes it from here, so the plain spelling is decided once.
+ */
+export async function mkdirReportingCreated(dir) {
+    const created = await mkdir(dir, { recursive: true });
+    return created === undefined ? null : withoutNamespacePrefix(created);
+}
 /** Write `content` to `path` through a temp file in the same directory. */
 export async function atomicWrite(path, content) {
     const tmp = tempPath(path, 0);
@@ -169,20 +183,11 @@ async function discardStaged(staged) {
             await quietRm(s.tmp);
     const roots = staged.filter((s) => s.createdDir !== null).map((s) => resolve(s.createdDir));
     for (const s of [...staged].reverse()) {
-        const root = roots.find((candidate) => contains(candidate, s.write.path));
+        const root = roots.find((candidate) => isPathInside(candidate, s.write.path));
         if (root !== undefined)
             await quietPruneEmptyParents(dirname(s.write.path), root);
     }
 }
-function contains(parent, candidate) {
-    const rel = relative(parent, resolve(candidate));
-    return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
-}
-/**
- * Undo the directories a write had to create, from `start` up to and including
- * `boundary`. Remove only directories that are still EMPTY: anything else in
- * there arrived after we made it, and belongs to whoever put it there.
- */
 /** Remove `dir` if it is empty. Best effort — a directory left standing is noise, not corruption. */
 export async function quietRmdir(dir) {
     try {
@@ -192,10 +197,16 @@ export async function quietRmdir(dir) {
         // Not empty, or not ours.
     }
 }
+/**
+ * Undo the directories a write had to create, from `start` up to and including
+ * `boundary` — or, for unarchive, the ones a restore's deletes left empty.
+ * Remove only directories that are still EMPTY: anything else in there arrived
+ * after we made it, and belongs to whoever put it there.
+ */
 export async function quietPruneEmptyParents(start, boundary) {
     let cursor = resolve(start);
     const root = resolve(boundary);
-    while (contains(root, cursor)) {
+    while (isPathInside(root, cursor)) {
         try {
             await rmdir(cursor);
         }