@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/commands/validate/service/events/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/events/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAIN,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAqB,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAoB,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAyB1D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAe;IACrD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAC9F,IAAI,CAAC;IACP,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,0EAA0E;IAC1E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9C,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,UAAU,GACd,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/B,MAAM,KAAK,GAA8E,EAAE,CAAC;YAC5F,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACT,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjG,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,WAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,UAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAChG,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,sEAAsE;QACtE,4DAA4D;QAC5D,EAAE;QACF,gEAAgE;QAChE,MAAM,QAAQ,GAAG;YACf,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACvF,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,wBAAwB,KAAK,CAAC,QAAQ,SAAS,QAAQ,CAAC,MAAM,2CAA2C;oBACzG,oGAAoG;gBACtG,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,2EAA2E;QAC3E,8EAA8E;QAC9E,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,OAAO,gFAAgF;YACnG,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,yDAAyD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8GAA8G;aACpN,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,qCAAqC,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oIAAoI;aAC5O,CAAC,CAAC;QACL,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAC9F,4EAA4E;oBAC5E,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,4BAA4B,MAAM,CAAC,YAAY,CAAC,MAAM,iCAAiC;oBACjG,6FAA6F;oBAC7F,+BAA+B;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,6EAA6E;QAC7E,yEAAyE;QACzE,yDAAyD;QACzD,sEAAsE;QACtE,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,CAAC,SAAmC,EAAE,OAAe,EAAW,EAAE,CACjF,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,SAAmC,EAAU,EAAE,CAC7D,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,oBAAoB,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,OAAO,EAAE,GAAG;oBACpH,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,UAAU,OAAO,uDAAuD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;aACnI,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,UAAU,OAAO,uDAAuD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;aACrL,CAAC,CAAC;QACL,CAAC;QACD,qEAAqE;QACrE,2EAA2E;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/F,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,yFAAyF;aAC/J,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACxI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7E,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SAC9E,CAAC;KACH,CAAC,IAAI,EAAE,CAAC;IACT,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAElH,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,6CAA6C;IAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC1D,IAAI,WAAW,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,OAAO,kBAAkB,WAAW,4CAA4C;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The async contract axis — AsyncAPI messages on the landscape spine.\n *\n * The HTTP spine (`./spine.js`) and this one are mirror images, and the mirror\n * is the whole reason this is a second axis rather than a second `metadata`\n * key. On the HTTP axis the PROVIDER owns the contract: an edge names an\n * operation and the target's openapi.yaml settles it, locally, in one file.\n * Here the PRODUCER owns the message and the consumer joins to it from another\n * repository — so \"is this message declared\" is local, while \"does anybody\n * publish it\" is a fleet question with no local answer at all. That second\n * question is the only check on either spine that reads other services'\n * contracts; it lives in `./message-producers.js`, and this axis only decides\n * when it is worth paying for — exactly when something actually consumes.\n */\nimport { existsSync } from \"node:fs\";\nimport {\n  type DeclaredService,\n  type PathableService,\n  type RawServiceId,\n} from \"../../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../../core/c4/likec4.js\";\nimport { type ServicePaths } from \"../../../../core/repo/paths.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { type Requirement } from \"../../../../core/document/spec.js\";\nimport { readAsyncapi, slotsOf } from \"../../../../core/asyncapi/read.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { producerFindings } from \"./message-producers.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\n\n/** What the service target hands the event axis. */\nexport interface EventAxis {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** `service` widened for `===` against the resolver's DOCUMENT text — see service.ts. */\n  me: string;\n  paths: ServicePaths;\n  /** Every requirement the living spec declares; `event.messages-unlinked` counts what is written. */\n  reqs: Requirement[];\n  /** The ones that still govern something — a REMOVED requirement links nothing. */\n  livingReqs: Requirement[];\n  /** arch.spec.md's requirements, which carry as many event links as spec.md's do. */\n  archReqs: Requirement[];\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  /** Service directories that exist — the fleet the producer question is asked over. */\n  known: ReadonlySet<RawServiceId>;\n  fleet?: FleetContext;\n}\n\nexport async function eventAxisFindings(axis: EventAxis): Promise<Finding[]> {\n  const { docsDir, service, me, paths, reqs, livingReqs, archReqs, land, landSvcOf, known, fleet } =\n    axis;\n  const findings: Finding[] = [];\n\n  // Where this axis started, so the closing ok-finding can be \"nothing here\n  // broke\" rather than a second, independently-computed claim about the same\n  // facts. A positive finding derived from the same walk cannot disagree with it.\n  const eventFindingsAt = findings.length;\n  const events = await readAsyncapi(paths.asyncapi, fleet);\n  const sentHere = new Set(events.sent);\n  const receivedHere = new Set(events.received);\n\n  // Every edge that binds THIS service to a message: `publishes` binds the\n  // edge's source (a service produces what it declares an `action: send` for),\n  // `consumes` binds its target. One edge may legitimately carry both — a relay\n  // that reads one topic and writes another is a single arrow in most fleet maps.\n  const eventEdges =\n    land === null || land.errors.length > 0\n      ? []\n      : land.relationships.flatMap((r) => {\n          const bound: { direction: \"publishes\" | \"consumes\"; message: string; other: string }[] = [];\n          if (r.publishes !== undefined && landSvcOf!(r.source) === me) {\n            bound.push({ direction: \"publishes\", message: r.publishes, other: landSvcOf!(r.target) });\n          }\n          if (r.consumes !== undefined && landSvcOf!(r.target) === me) {\n            bound.push({ direction: \"consumes\", message: r.consumes, other: landSvcOf!(r.source) });\n          }\n          return bound;\n        });\n  // Both requirement namespaces, and a REMOVED requirement links nothing —\n  // the `livingReqs` rule the API axis already follows, applied to the pair.\n  const eventLinks = [...livingReqs, ...archReqs.filter((r) => r.kind !== \"REMOVED\")].flatMap((r) => [\n    ...r.publishes.map((m) => ({ direction: \"publishes\" as const, message: m, requirement: r.name })),\n    ...r.consumes.map((m) => ({ direction: \"consumes\" as const, message: m, requirement: r.name })),\n  ]);\n\n  if (!existsSync(paths.asyncapi)) {\n    // Deliberately TWO grades, not the three `service.no-openapi` uses. Its\n    // middle grade — warn when the landscape cannot prove nobody calls this\n    // service — rests on HTTP being the default: most services expose one, so\n    // \"I could not look\" is worth saying. An event contract is genuinely\n    // optional; most services in a legacy fleet touch no topic at all. Warning\n    // every one of them the moment a landscape fails to parse would put a\n    // finding on the whole fleet that names a file nobody owes.\n    //\n    // So: something already joins into the absent file, or silence.\n    const dangling = [\n      ...new Set([...eventEdges.map((e) => e.message), ...eventLinks.map((e) => e.message)]),\n    ].sort();\n    if (dangling.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"service.no-asyncapi\",\n        subject: service,\n        message:\n          `No async contract at ${paths.asyncapi}, and ${dangling.length} message link(s) already point into it — ` +\n          `every landscape edge and requirement naming one of them resolves to nothing until the file is back`,\n        details: dangling,\n      });\n    }\n  } else if (events.unreadable) {\n    // The openapi.invalid discipline: a contract that EXISTS but does not read\n    // is a broken source of truth, not an empty one. Grading the links against\n    // an empty message set would turn one file into one `spine.message-undefined`\n    // per edge, every one of them pointing at the landscape.\n    findings.push({\n      severity: \"error\",\n      code: \"asyncapi.invalid\",\n      subject: service,\n      message: `${service}: asyncapi.yaml does not parse — the event spine is unchecked for this service`,\n      ...(events.error === undefined ? {} : { details: [events.error] }),\n    });\n  } else {\n    // Feature-only bookkeeping published to the fleet — the openapi axis's\n    // `openapi.remove-marker-living` discipline, one code for every depth the\n    // reader collects markers at (slots and inline channel messages alike).\n    if (events.markers.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"asyncapi.remove-marker-living\",\n        subject: service,\n        message: `${service}: living asyncapi.yaml carries x-loam-remove: true at ${events.markers.join(\", \")} — removal markers are valid only in feature deltas; retire a slot through a feature's asyncapi.yaml instead`,\n      });\n    }\n    for (const name of events.duplicateNames) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.duplicate-message\",\n        subject: service,\n        message: `${service}: asyncapi.yaml declares message '${name}' in ${slotsOf(events, name).join(\" and \")} — every join on the name (an edge's metadata { publishes }, a requirement's Publishes: line) picks one of those slots arbitrarily`,\n      });\n    }\n    // The contract-depth probes. Form validated and depth did not: a payload\n    // of bare `type: object` and a `$ref` to nothing both read as cleanly as\n    // a full schema, while a reader still cannot rebuild the payload from the\n    // green contract. Presence probes only — a non-JSON schemaFormat\n    // is skipped, so Avro stays a document change.\n    const empties = events.messages.filter((m) => m.payloadEmpty === true).map((m) => m.name);\n    if (empties.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.payload-undescribed\",\n        subject: service,\n        message:\n          `${service}: ${empties.length} message(s) declare no payload shape (${empties.join(\", \")}) — ` +\n          `the name joins the spine, but nothing defines what a consumer would read; ` +\n          `declare properties, or a schemaFormat for a non-JSON schema`,\n      });\n    }\n    if (events.danglingRefs.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.ref-unresolved\",\n        subject: service,\n        message:\n          `${service}: asyncapi.yaml contains ${events.danglingRefs.length} internal $ref(s) that resolve ` +\n          `to nothing in the document — whatever they were meant to carry is silently absent from the ` +\n          `spine's view of this contract`,\n        details: events.danglingRefs,\n      });\n    }\n    // Local resolution, both directions and both sources of a claim. An edge and\n    // a requirement making the same broken claim get the same sentence under\n    // different codes, matching how `spine.op-undefined` and\n    // `spec-api.op-undefined` split the HTTP axis: one is the fleet map's\n    // mistake, the other is this document's, and the fix is in a different file.\n    const declares = (direction: \"publishes\" | \"consumes\", message: string): boolean =>\n      direction === \"publishes\" ? sentHere.has(message) : receivedHere.has(message);\n    const action = (direction: \"publishes\" | \"consumes\"): string =>\n      direction === \"publishes\" ? \"send\" : \"receive\";\n    for (const e of eventEdges) {\n      if (declares(e.direction, e.message)) continue;\n      findings.push({\n        severity: \"error\",\n        code: \"spine.message-undefined\",\n        subject: service,\n        message:\n          `${service}: landscape edge ${e.direction === \"publishes\" ? `${service} → ${e.other}` : `${e.other} → ${service}`} ` +\n          `${e.direction} '${e.message}', but ${service}'s asyncapi.yaml declares no operation with action: ${action(e.direction)} for it`,\n      });\n    }\n    for (const e of eventLinks) {\n      if (declares(e.direction, e.message)) continue;\n      findings.push({\n        severity: \"error\",\n        code: \"spec-event.message-undefined\",\n        subject: service,\n        message: `${service}: requirement '${e.requirement}' ${e.direction} '${e.message}', but ${service}'s asyncapi.yaml declares no operation with action: ${action(e.direction)} for it`,\n      });\n    }\n    // The migration-debt case, `api.ops-unlinked`'s twin: a contract and\n    // requirements that never name each other leave this axis vacuously green.\n    if (events.messages.length > 0 && reqs.length + archReqs.length > 0 && eventLinks.length === 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"event.messages-unlinked\",\n        subject: service,\n        message: `${service}: asyncapi.yaml declares ${events.messages.length} message(s) but no requirement links any — the event axis is unchecked for this service`,\n      });\n    }\n    // `api.ungoverned`'s event twin, and the per-message half the check above\n    // cannot see: `event.messages-unlinked` fires only when ZERO links exist,\n    // so a contract with five declared messages and three governed ones\n    // reported nothing about the other two. The join is against requirement\n    // lines ONLY, deliberately ignoring landscape edges — an edge is a claim\n    // about traffic, a requirement is governance — exactly as the API axis\n    // ignores inbound edges when grading coverage.\n    const governed = new Set(eventLinks.map((e) => e.message));\n    const orphans = [...new Set(events.messages.map((m) => m.name))].filter((name) => !governed.has(name));\n    if (orphans.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"event.ungoverned\",\n        subject: service,\n        message: `${service}: ${orphans.length} message(s) not governed by any requirement's Publishes:/Consumes: line — ${orphans.join(\", \")}`,\n      });\n    }\n  }\n\n  // The consumed-message list is the handover to the fleet question in\n  // ./message-producers.js — a fleet where nothing consumes walks nothing.\n  const consumed = [\n    ...new Set([\n      ...eventEdges.filter((e) => e.direction === \"consumes\").map((e) => e.message),\n      ...eventLinks.filter((e) => e.direction === \"consumes\").map((e) => e.message),\n    ]),\n  ].sort();\n  findings.push(...(await producerFindings({ docsDir, service, land, landSvcOf, known, events, consumed, fleet })));\n\n  // Positive confirmation, on the same rule `spine.resolved` follows: claimed\n  // only where the axis actually checked something. A service that touches no\n  // topic says nothing here — an \"event axis clean\" on every worker in the fleet\n  // would be a green tick for work nobody did.\n  const eventChecks = eventEdges.length + eventLinks.length;\n  if (eventChecks > 0 && findings.length === eventFindingsAt) {\n    findings.push({\n      severity: \"ok\",\n      code: \"event.covered\",\n      message: `${service}: event spine (${eventChecks} message link(s) resolve to asyncapi.yaml)`,\n    });\n  }\n\n  return findings;\n}\n"]}
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/events/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAIN,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC5G,OAAO,EAAqB,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAoB,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAyB1D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAe;IACrD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAC9F,IAAI,CAAC;IACP,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,0EAA0E;IAC1E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9C,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC;IACjF,MAAM,UAAU,GAAG,CAAC,QAAQ;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/B,SAAS,CAAC,CAAC,CAAC;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;aACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAC3F,CAAC;IACN,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,gFAAgF;IAChF,+EAA+E;IAC/E,MAAM,QAAQ,GAAwB,KAAK,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACpC,IAAI,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAAE,SAAS;gBACtG,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjG,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,WAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,UAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAChG,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,sEAAsE;QACtE,4DAA4D;QAC5D,EAAE;QACF,gEAAgE;QAChE,MAAM,QAAQ,GAAG;YACf,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACvF,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,wBAAwB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,QAAQ,CAAC,MAAM,2CAA2C;oBAC5H,oGAAoG;gBACtG,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,2EAA2E;QAC3E,8EAA8E;QAC9E,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,OAAO,oJAAoJ;YACvK,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,yDAAyD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8GAA8G;aACpN,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,qCAAqC,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oIAAoI;aAC5O,CAAC,CAAC;QACL,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAC9F,4EAA4E;oBAC5E,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,4BAA4B,MAAM,CAAC,YAAY,CAAC,MAAM,iCAAiC;oBACjG,6FAA6F;oBAC7F,+BAA+B;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,6EAA6E;QAC7E,yEAAyE;QACzE,yDAAyD;QACzD,sEAAsE;QACtE,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,CAAC,SAAmC,EAAE,OAAe,EAAW,EAAE,CACjF,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,SAAmC,EAAU,EAAE,CAC7D,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,oBAAoB,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,OAAO,EAAE,GAAG;oBACpH,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,UAAU,OAAO,uDAAuD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;aACnI,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,UAAU,OAAO,uDAAuD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;aACrL,CAAC,CAAC;QACL,CAAC;QACD,qEAAqE;QACrE,2EAA2E;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/F,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,yFAAyF;aAC/J,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACxI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7E,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SAC9E,CAAC;KACH,CAAC,IAAI,EAAE,CAAC;IACT,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAElH,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,6CAA6C;IAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC1D,IAAI,WAAW,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,OAAO,kBAAkB,WAAW,4CAA4C;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The async contract axis — AsyncAPI messages on the landscape spine.\n *\n * The HTTP spine (`./spine.js`) and this one are mirror images, and the mirror\n * is the whole reason this is a second axis rather than a second `metadata`\n * key. On the HTTP axis the PROVIDER owns the contract: an edge names an\n * operation and the target's openapi.yaml settles it, locally, in one file.\n * Here the PRODUCER owns the message and the consumer joins to it from another\n * repository — so \"is this message declared\" is local, while \"does anybody\n * publish it\" is a fleet question with no local answer at all. That second\n * question is the only check on either spine that reads other services'\n * contracts; it lives in `./message-producers.js`, and this axis only decides\n * when it is worth paying for — exactly when something actually consumes.\n */\nimport { existsSync } from \"node:fs\";\nimport {\n  type DeclaredService,\n  type PathableService,\n  type RawServiceId,\n} from \"../../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../../core/c4/likec4.js\";\nimport { eventKeys, infrastructureKind, unboundSentence } from \"../../../../core/c4/direction/direction.js\";\nimport { type ServicePaths } from \"../../../../core/repo/paths.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { type Requirement } from \"../../../../core/document/spec.js\";\nimport { readAsyncapi, slotsOf } from \"../../../../core/asyncapi/read.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { repoPath } from \"../../../../core/envelope/json.js\";\nimport { producerFindings } from \"./message-producers.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\n\n/** What the service target hands the event axis. */\nexport interface EventAxis {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** `service` widened for `===` against the resolver's DOCUMENT text — see service.ts. */\n  me: string;\n  paths: ServicePaths;\n  /** Every requirement the living spec declares; `event.messages-unlinked` counts what is written. */\n  reqs: Requirement[];\n  /** The ones that still govern something — a REMOVED requirement links nothing. */\n  livingReqs: Requirement[];\n  /** arch.spec.md's requirements, which carry as many event links as spec.md's do. */\n  archReqs: Requirement[];\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  /** Service directories that exist — the fleet the producer question is asked over. */\n  known: ReadonlySet<RawServiceId>;\n  fleet: FleetContext;\n}\n\nexport async function eventAxisFindings(axis: EventAxis): Promise<Finding[]> {\n  const { docsDir, service, me, paths, reqs, livingReqs, archReqs, land, landSvcOf, known, fleet } =\n    axis;\n  const findings: Finding[] = [];\n\n  // Where this axis started, so the closing ok-finding can be \"nothing here\n  // broke\" rather than a second, independently-computed claim about the same\n  // facts. A positive finding derived from the same walk cannot disagree with it.\n  const eventFindingsAt = findings.length;\n  const events = await readAsyncapi(paths.asyncapi, fleet);\n  const sentHere = new Set(events.sent);\n  const receivedHere = new Set(events.received);\n\n  // Every edge that binds THIS service to a message: `publishes` binds the\n  // edge's source (a service produces what it declares an `action: send` for),\n  // `consumes` binds its target — `eventKeys` is where that rule is written,\n  // once, for this scope and the feature gate alike. One edge may legitimately\n  // carry both: a producer drawn straight to its consumer is a single arrow.\n  const readable = land !== null && land.errors.length === 0 && landSvcOf !== null;\n  const eventEdges = !readable\n    ? []\n    : land.relationships.flatMap((r) =>\n        eventKeys(r)\n          .filter((k) => landSvcOf(k.bound) === me)\n          .map((k) => ({ direction: k.direction, message: k.message, other: landSvcOf(k.other) })),\n      );\n  // The edges the filter above drops that THIS service drew the wrong way\n  // round: a key bound to infrastructure (a topic, which neither publishes nor\n  // consumes) while this service sits at the other end. It used to fall out of\n  // `eventEdges` without a word, so a consume edge drawn from the consumer to\n  // the topic graded nothing and said nothing. A key bound to an `#external`\n  // system is NOT this case — an outside producer or consumer, which the\n  // drawing states correctly (core/c4/direction/direction.ts says why). Raised on\n  // the service at the unbound end, because it is the one with a drawing to fix.\n  const knownIds: ReadonlySet<string> = known;\n  if (readable) {\n    const infraKindOf = infrastructureKind(land.elements);\n    for (const r of land.relationships) {\n      for (const key of eventKeys(r)) {\n        const kind = infraKindOf(key.bound);\n        if (kind === undefined || landSvcOf(key.other) !== me || knownIds.has(landSvcOf(key.bound))) continue;\n        findings.push({\n          severity: \"warn\",\n          code: \"spine.message-unbound\",\n          subject: service,\n          message: `${service}: landscape ${unboundSentence(r, key, kind)}`,\n        });\n      }\n    }\n  }\n  // Both requirement namespaces, and a REMOVED requirement links nothing —\n  // the `livingReqs` rule the API axis already follows, applied to the pair.\n  const eventLinks = [...livingReqs, ...archReqs.filter((r) => r.kind !== \"REMOVED\")].flatMap((r) => [\n    ...r.publishes.map((m) => ({ direction: \"publishes\" as const, message: m, requirement: r.name })),\n    ...r.consumes.map((m) => ({ direction: \"consumes\" as const, message: m, requirement: r.name })),\n  ]);\n\n  if (!existsSync(paths.asyncapi)) {\n    // Deliberately TWO grades, not the three `service.no-openapi` uses. Its\n    // middle grade — warn when the landscape cannot prove nobody calls this\n    // service — rests on HTTP being the default: most services expose one, so\n    // \"I could not look\" is worth saying. An event contract is genuinely\n    // optional; most services in a legacy fleet touch no topic at all. Warning\n    // every one of them the moment a landscape fails to parse would put a\n    // finding on the whole fleet that names a file nobody owes.\n    //\n    // So: something already joins into the absent file, or silence.\n    const dangling = [\n      ...new Set([...eventEdges.map((e) => e.message), ...eventLinks.map((e) => e.message)]),\n    ].sort();\n    if (dangling.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"service.no-asyncapi\",\n        subject: service,\n        message:\n          `No async contract at ${repoPath(docsDir, paths.asyncapi)}, and ${dangling.length} message link(s) already point into it — ` +\n          `every landscape edge and requirement naming one of them resolves to nothing until the file is back`,\n        details: dangling,\n      });\n    }\n  } else if (events.unreadable) {\n    // The openapi.invalid discipline: a contract that EXISTS but does not read\n    // is a broken source of truth, not an empty one. Grading the links against\n    // an empty message set would turn one file into one `spine.message-undefined`\n    // per edge, every one of them pointing at the landscape.\n    findings.push({\n      severity: \"error\",\n      code: \"asyncapi.invalid\",\n      subject: service,\n      message: `${service}: asyncapi.yaml does not read as AsyncAPI 3.0 (it does not parse, or it declares an older version) — the event spine is unchecked for this service`,\n      ...(events.error === undefined ? {} : { details: [events.error] }),\n    });\n  } else {\n    // Feature-only bookkeeping published to the fleet — the openapi axis's\n    // `openapi.remove-marker-living` discipline, one code for every depth the\n    // reader collects markers at (slots and inline channel messages alike).\n    if (events.markers.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"asyncapi.remove-marker-living\",\n        subject: service,\n        message: `${service}: living asyncapi.yaml carries x-loam-remove: true at ${events.markers.join(\", \")} — removal markers are valid only in feature deltas; retire a slot through a feature's asyncapi.yaml instead`,\n      });\n    }\n    for (const name of events.duplicateNames) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.duplicate-message\",\n        subject: service,\n        message: `${service}: asyncapi.yaml declares message '${name}' in ${slotsOf(events, name).join(\" and \")} — every join on the name (an edge's metadata { publishes }, a requirement's Publishes: line) picks one of those slots arbitrarily`,\n      });\n    }\n    // The contract-depth probes. Form validated and depth did not: a payload\n    // of bare `type: object` and a `$ref` to nothing both read as cleanly as\n    // a full schema, while a reader still cannot rebuild the payload from the\n    // green contract. Presence probes only — a non-JSON schemaFormat\n    // is skipped, so Avro stays a document change.\n    const empties = events.messages.filter((m) => m.payloadEmpty === true).map((m) => m.name);\n    if (empties.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.payload-undescribed\",\n        subject: service,\n        message:\n          `${service}: ${empties.length} message(s) declare no payload shape (${empties.join(\", \")}) — ` +\n          `the name joins the spine, but nothing defines what a consumer would read; ` +\n          `declare properties, or a schemaFormat for a non-JSON schema`,\n      });\n    }\n    if (events.danglingRefs.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.ref-unresolved\",\n        subject: service,\n        message:\n          `${service}: asyncapi.yaml contains ${events.danglingRefs.length} internal $ref(s) that resolve ` +\n          `to nothing in the document — whatever they were meant to carry is silently absent from the ` +\n          `spine's view of this contract`,\n        details: events.danglingRefs,\n      });\n    }\n    // Local resolution, both directions and both sources of a claim. An edge and\n    // a requirement making the same broken claim get the same sentence under\n    // different codes, matching how `spine.op-undefined` and\n    // `spec-api.op-undefined` split the HTTP axis: one is the fleet map's\n    // mistake, the other is this document's, and the fix is in a different file.\n    const declares = (direction: \"publishes\" | \"consumes\", message: string): boolean =>\n      direction === \"publishes\" ? sentHere.has(message) : receivedHere.has(message);\n    const action = (direction: \"publishes\" | \"consumes\"): string =>\n      direction === \"publishes\" ? \"send\" : \"receive\";\n    for (const e of eventEdges) {\n      if (declares(e.direction, e.message)) continue;\n      findings.push({\n        severity: \"error\",\n        code: \"spine.message-undefined\",\n        subject: service,\n        message:\n          `${service}: landscape edge ${e.direction === \"publishes\" ? `${service} → ${e.other}` : `${e.other} → ${service}`} ` +\n          `${e.direction} '${e.message}', but ${service}'s asyncapi.yaml declares no operation with action: ${action(e.direction)} for it`,\n      });\n    }\n    for (const e of eventLinks) {\n      if (declares(e.direction, e.message)) continue;\n      findings.push({\n        severity: \"error\",\n        code: \"spec-event.message-undefined\",\n        subject: service,\n        message: `${service}: requirement '${e.requirement}' ${e.direction} '${e.message}', but ${service}'s asyncapi.yaml declares no operation with action: ${action(e.direction)} for it`,\n      });\n    }\n    // The migration-debt case, `api.ops-unlinked`'s twin: a contract and\n    // requirements that never name each other leave this axis vacuously green.\n    if (events.messages.length > 0 && reqs.length + archReqs.length > 0 && eventLinks.length === 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"event.messages-unlinked\",\n        subject: service,\n        message: `${service}: asyncapi.yaml declares ${events.messages.length} message(s) but no requirement links any — the event axis is unchecked for this service`,\n      });\n    }\n    // `api.ungoverned`'s event twin, and the per-message half the check above\n    // cannot see: `event.messages-unlinked` fires only when ZERO links exist,\n    // so a contract with five declared messages and three governed ones\n    // reported nothing about the other two. The join is against requirement\n    // lines ONLY, deliberately ignoring landscape edges — an edge is a claim\n    // about traffic, a requirement is governance — exactly as the API axis\n    // ignores inbound edges when grading coverage.\n    const governed = new Set(eventLinks.map((e) => e.message));\n    const orphans = [...new Set(events.messages.map((m) => m.name))].filter((name) => !governed.has(name));\n    if (orphans.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"event.ungoverned\",\n        subject: service,\n        message: `${service}: ${orphans.length} message(s) not governed by any requirement's Publishes:/Consumes: line — ${orphans.join(\", \")}`,\n      });\n    }\n  }\n\n  // The consumed-message list is the handover to the fleet question in\n  // ./message-producers.js — a fleet where nothing consumes walks nothing.\n  const consumed = [\n    ...new Set([\n      ...eventEdges.filter((e) => e.direction === \"consumes\").map((e) => e.message),\n      ...eventLinks.filter((e) => e.direction === \"consumes\").map((e) => e.message),\n    ]),\n  ].sort();\n  findings.push(...(await producerFindings({ docsDir, service, land, landSvcOf, known, events, consumed, fleet })));\n\n  // Positive confirmation, on the same rule `spine.resolved` follows: claimed\n  // only where the axis actually checked something. A service that touches no\n  // topic says nothing here — an \"event axis clean\" on every worker in the fleet\n  // would be a green tick for work nobody did.\n  const eventChecks = eventEdges.length + eventLinks.length;\n  if (eventChecks > 0 && findings.length === eventFindingsAt) {\n    findings.push({\n      severity: \"ok\",\n      code: \"event.covered\",\n      message: `${service}: event spine (${eventChecks} message link(s) resolve to asyncapi.yaml)`,\n    });\n  }\n\n  return findings;\n}\n"]}

package/dist/commands/validate/service/events/message-producers.js

@@ -11,7 +11,7 @@ import {} from "../../../../core/vocabulary/report.js";
 import { producersByMessage } from "../../../../core/asyncapi/producers.js";
 import {} from "../../../../core/asyncapi/model.js";
 import { FleetContext } from "../../../../core/fleet-context.js";
-import { externalProducerOf } from "../../checks/fleet-shape.js";
+import { externalProducerOf } from "../../../../core/c4/resolve/external.js";
 // The fleet question, and the one check on either spine that a single
 // repository cannot answer: a consumer joins to a message whose schema lives
 // in the producer's contract, in the producer's repo. Paid only when something

package/dist/commands/validate/service/events/message-producers.js.map

@@ -1 +1 @@
-{"version":3,"file":"message-producers.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/events/message-producers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAiE,MAAM,wCAAwC,CAAC;AACvH,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAoB,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAwBjE,sEAAsE;AACtE,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAuB;IAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACpF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACnD,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,mCAAmC;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,qEAAqE;YACrE,kEAAkE;YAClE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAChE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;gBAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,OAAO;wBAChB,OAAO,EACL,GAAG,OAAO,eAAe,OAAO,WAAW,GAAG,sCAAsC;4BACpF,uFAAuF;4BACvF,wFAAwF;4BACxF,aAAa;qBAChB,CAAC,CAAC;gBACL,CAAC;gBACD,mEAAmE;gBACnE,sEAAsE;YACxE,CAAC;iBAAM,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,OAAO,oJAAoJ;iBAC9L,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,OAAO,YAAY,GAAG,CAAC,MAAM,gCAAgC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,4HAA4H;aAC1O,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The fleet question the event axis asks: who produces what this service\n * consumes. Split out of `./events.js` along the seam its own header always\n * named — the local axis grades one service's files, while this is the only\n * check on either spine that reads OTHER services' contracts, and the two\n * subjects share nothing but the consumed-message list the axis hands over.\n */\nimport { type DeclaredService, type PathableService, type RawServiceId } from \"../../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../../core/c4/likec4.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { producersByMessage } from \"../../../../core/asyncapi/producers.js\";\nimport { type AsyncapiDoc } from \"../../../../core/asyncapi/model.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { externalProducerOf } from \"../../checks/fleet-shape.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\n\n/**\n * What the producer question is asked over. One record rather than a parameter\n * list: everything here is already bound together as one service's view of the\n * fleet, and the 4-parameter limit says so too.\n */\nexport interface ProducerQuestion {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  /** Service directories that exist — the fleet the producer question is asked over. */\n  known: ReadonlySet<RawServiceId>;\n  /** This service's own parsed contract — the local-shape half of the external answer. */\n  events: AsyncapiDoc;\n  /** The deduped message names this service consumes, from edges and requirement lines alike. */\n  consumed: readonly string[];\n  fleet?: FleetContext;\n}\n\n// The fleet question, and the one check on either spine that a single\n// repository cannot answer: a consumer joins to a message whose schema lives\n// in the producer's contract, in the producer's repo. Paid only when something\n// actually consumes — a fleet where nobody has adopted the axis walks nothing.\nexport async function producerFindings(input: ProducerQuestion): Promise<Finding[]> {\n  const { docsDir, service, land, landSvcOf, known, events, consumed, fleet } = input;\n  const findings: Finding[] = [];\n  if (consumed.length === 0) return findings;\n  const producers = await producersByMessage(docsDir, [...known], fleet);\n  for (const message of consumed) {\n    const who = producers.byMessage.get(message) ?? [];\n    // \"Nobody produces this\" is an argument from absence, and it is only\n    // sound over a fleet loam could actually read. One unreadable contract\n    // anywhere suspends it — that service may be the producer, and the\n    // alternative is blaming every consumer for somebody else's broken YAML.\n    // The external answer and the contested answer below rest on positive\n    // evidence and need no such guard.\n    if (who.length === 0) {\n      // A message produced OUTSIDE the fleet used to be inexpressible: the\n      // landscape said the producer was #external, and this error fired\n      // anyway — so honesty cost a red build, and the exit ramp people took\n      // was deleting the link. The landscape already carries the answer; an\n      // external producer shifts the contract question to the one file that\n      // can settle it, this service's own asyncapi.yaml.\n      const ext = externalProducerOf(message, land, landSvcOf, known);\n      if (ext !== null) {\n        const local = events.messages.find((m) => m.name === message);\n        if (local === undefined || local.payloadEmpty === true) {\n          findings.push({\n            severity: \"warn\",\n            code: \"spine.message-external\",\n            subject: service,\n            message:\n              `${service}: consumes '${message}' from '${ext}', a system outside the fleet — the ` +\n              `producer declares no contract here, so the only payload definition is this service's ` +\n              `own asyncapi.yaml, and it currently defines no shape for it; declare the message with ` +\n              `its payload`,\n          });\n        }\n        // A carried contract closes the question: the landscape states the\n        // external dependency, the consumer owns the schema — nothing to say.\n      } else if (producers.unreadable.length === 0) {\n        findings.push({\n          severity: \"error\",\n          code: \"spine.message-unproduced\",\n          subject: service,\n          message: `${service}: consumes '${message}', but no service in the fleet and no #external element declares it is sent — the message has no producer anywhere, so nothing defines its payload`,\n        });\n      }\n    } else if (who.length > 1) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.message-contested\",\n        subject: service,\n        message: `${service}: consumes '${message}', which ${who.length} services declare they send (${who.join(\", \")}) — every consumer's join picks one of them arbitrarily, so the payload this service reads is whichever one happens to win`,\n      });\n    }\n  }\n  return findings;\n}\n"]}
+{"version":3,"file":"message-producers.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/events/message-producers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAiE,MAAM,wCAAwC,CAAC;AACvH,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAoB,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAwB7E,sEAAsE;AACtE,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAuB;IAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACpF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACnD,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,mCAAmC;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,qEAAqE;YACrE,kEAAkE;YAClE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAChE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;gBAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,OAAO;wBAChB,OAAO,EACL,GAAG,OAAO,eAAe,OAAO,WAAW,GAAG,sCAAsC;4BACpF,uFAAuF;4BACvF,wFAAwF;4BACxF,aAAa;qBAChB,CAAC,CAAC;gBACL,CAAC;gBACD,mEAAmE;gBACnE,sEAAsE;YACxE,CAAC;iBAAM,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,OAAO,oJAAoJ;iBAC9L,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,OAAO,YAAY,GAAG,CAAC,MAAM,gCAAgC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,4HAA4H;aAC1O,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The fleet question the event axis asks: who produces what this service\n * consumes. Split out of `./events.js` along the seam its own header always\n * named — the local axis grades one service's files, while this is the only\n * check on either spine that reads OTHER services' contracts, and the two\n * subjects share nothing but the consumed-message list the axis hands over.\n */\nimport { type DeclaredService, type PathableService, type RawServiceId } from \"../../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../../core/c4/likec4.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { producersByMessage } from \"../../../../core/asyncapi/producers.js\";\nimport { type AsyncapiDoc } from \"../../../../core/asyncapi/model.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { externalProducerOf } from \"../../../../core/c4/resolve/external.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\n\n/**\n * What the producer question is asked over. One record rather than a parameter\n * list: everything here is already bound together as one service's view of the\n * fleet, and the 4-parameter limit says so too.\n */\nexport interface ProducerQuestion {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  /** Service directories that exist — the fleet the producer question is asked over. */\n  known: ReadonlySet<RawServiceId>;\n  /** This service's own parsed contract — the local-shape half of the external answer. */\n  events: AsyncapiDoc;\n  /** The deduped message names this service consumes, from edges and requirement lines alike. */\n  consumed: readonly string[];\n  fleet: FleetContext;\n}\n\n// The fleet question, and the one check on either spine that a single\n// repository cannot answer: a consumer joins to a message whose schema lives\n// in the producer's contract, in the producer's repo. Paid only when something\n// actually consumes — a fleet where nobody has adopted the axis walks nothing.\nexport async function producerFindings(input: ProducerQuestion): Promise<Finding[]> {\n  const { docsDir, service, land, landSvcOf, known, events, consumed, fleet } = input;\n  const findings: Finding[] = [];\n  if (consumed.length === 0) return findings;\n  const producers = await producersByMessage(docsDir, [...known], fleet);\n  for (const message of consumed) {\n    const who = producers.byMessage.get(message) ?? [];\n    // \"Nobody produces this\" is an argument from absence, and it is only\n    // sound over a fleet loam could actually read. One unreadable contract\n    // anywhere suspends it — that service may be the producer, and the\n    // alternative is blaming every consumer for somebody else's broken YAML.\n    // The external answer and the contested answer below rest on positive\n    // evidence and need no such guard.\n    if (who.length === 0) {\n      // A message produced OUTSIDE the fleet used to be inexpressible: the\n      // landscape said the producer was #external, and this error fired\n      // anyway — so honesty cost a red build, and the exit ramp people took\n      // was deleting the link. The landscape already carries the answer; an\n      // external producer shifts the contract question to the one file that\n      // can settle it, this service's own asyncapi.yaml.\n      const ext = externalProducerOf(message, land, landSvcOf, known);\n      if (ext !== null) {\n        const local = events.messages.find((m) => m.name === message);\n        if (local === undefined || local.payloadEmpty === true) {\n          findings.push({\n            severity: \"warn\",\n            code: \"spine.message-external\",\n            subject: service,\n            message:\n              `${service}: consumes '${message}' from '${ext}', a system outside the fleet — the ` +\n              `producer declares no contract here, so the only payload definition is this service's ` +\n              `own asyncapi.yaml, and it currently defines no shape for it; declare the message with ` +\n              `its payload`,\n          });\n        }\n        // A carried contract closes the question: the landscape states the\n        // external dependency, the consumer owns the schema — nothing to say.\n      } else if (producers.unreadable.length === 0) {\n        findings.push({\n          severity: \"error\",\n          code: \"spine.message-unproduced\",\n          subject: service,\n          message: `${service}: consumes '${message}', but no service in the fleet and no #external element declares it is sent — the message has no producer anywhere, so nothing defines its payload`,\n        });\n      }\n    } else if (who.length > 1) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.message-contested\",\n        subject: service,\n        message: `${service}: consumes '${message}', which ${who.length} services declare they send (${who.join(\", \")}) — every consumer's join picks one of them arbitrarily, so the payload this service reads is whichever one happens to win`,\n      });\n    }\n  }\n  return findings;\n}\n"]}

package/dist/commands/validate/service/evidence-pins.js

@@ -3,11 +3,19 @@
  * this service has attested, its pins graded against THIS working tree.
  *
  * Service-repo-scoped like `sources.*` and the gherkin chain — the citations
- * resolve only inside the service's own repository. From the docs repo the
- * whole family is silent by design: every pin would grade `unresolved` there,
- * which would be a lie about the code rather than about the record, and
+ * resolve only inside the service's own repository. From the docs repo this
+ * TARGET is silent by design: every pin would grade `unresolved` there, which
+ * would be a lie about the code rather than about the record, and
  * `sources.unverifiable-from-here` already names the blind spot once per
- * service.
+ * service. One code of the family is not about the code at all —
+ * `evidence.record-unreadable` is about the record, which lives in the docs
+ * repo — so the FEATURE target (`../feature.ts`) raises it too, from anywhere,
+ * through `featureRecordFindings` below:
+ * with only this target raising it, `validate --all` in the docs repo stayed
+ * green over a conflict-marked record that `verify` refused and `status`,
+ * `gate` and `tasks` all reported. In a service repo's `--all` the same file
+ * is therefore named twice, once per target: here as this service's pins
+ * going unchecked, there as the feature's record itself.
  *
  * ARCHIVED records are deliberately not linted (a v1 non-goal, recorded here):
  * a frozen record is history, post-ship code drift is normal evolution, and
@@ -24,9 +32,9 @@
 import { repoPath } from "../../../core/envelope/json.js";
 import { inOrder } from "../../../core/kernel/concurrency.js";
 import {} from "../../../core/kernel/ids/service.js";
+import {} from "../../../core/repo/entries.js";
 import { listFeatures } from "../../../core/repo/repo.js";
-import { readVerificationState } from "../../../core/verify/file.js";
-import { verificationPath } from "../../../core/verify/record.js";
+import { readVerificationState } from "../../../core/verify/read/file.js";
 import { lintEvidencePins } from "../../../core/verify/pins/lint.js";
 import {} from "../../../core/vocabulary/report.js";
 export async function evidencePinFindings(docsDir, service, repoDir, fleet) {
@@ -49,7 +57,7 @@ export async function evidencePinFindings(docsDir, service, repoDir, fleet) {
         // this service, so the finding fires regardless of attestation.
         const read = await readVerificationState(feature.dir);
         if (read.state === "unreadable") {
-            return { feature: feature.id, path: repoPath(docsDir, verificationPath(feature.dir)), unreadable: read.reason };
+            return { feature: feature.id, path: repoPath(docsDir, read.path), unreadable: read.reason, advice: read.advice };
         }
         if (read.state === "absent" || read.verification.schema !== 2)
             return null;
@@ -69,9 +77,7 @@ export async function evidencePinFindings(docsDir, service, repoDir, fleet) {
                 severity: "warn",
                 code: "evidence.record-unreadable",
                 subject: service,
-                message: `${me}: ${entry.feature}: ${entry.path} exists but cannot be read as a verification record (${entry.unreadable}) — ` +
-                    "none of its evidence was checked. It is plain YAML: repair it by hand, or re-record " +
-                    `(\`loam verify ${entry.feature} --service ${me} --record answers.json\`); loam never overwrites a record it could not read`,
+                message: recordUnreadableMessage(`${me}: ${entry.feature}`, entry),
             });
             continue;
         }
@@ -124,6 +130,46 @@ export async function evidencePinFindings(docsDir, service, repoDir, fleet) {
     }
     return findings;
 }
+/**
+ * `evidence.record-unreadable` on the FEATURE target (`../feature.ts`), from
+ * anywhere — the docs repo included, which is where the record lives. Kept
+ * here, beside the service target's emission, so one module owns the code and
+ * its words: the record read is the same `readVerificationState`, the path is
+ * made docs-relative the same way, and the message is the same sentence.
+ * Readability only — an `ok` record contributes nothing here, its verdict is
+ * `verify`'s and `status`'s to state — and a warn for the reasons the header
+ * gives: `valid` and `loam archive` are untouched, `--strict` is the lever.
+ */
+export async function featureRecordFindings(docsDir, feature) {
+    const read = await readVerificationState(feature.dir);
+    if (read.state !== "unreadable")
+        return [];
+    const path = repoPath(docsDir, read.path);
+    return [
+        {
+            severity: "warn",
+            code: "evidence.record-unreadable",
+            message: recordUnreadableMessage(feature.id, { path, unreadable: read.reason, advice: read.advice }),
+            locations: [{ path, role: "primary" }],
+        },
+    ];
+}
+/**
+ * The sentence `evidence.record-unreadable` carries, for both targets that
+ * raise it. Each emission spells the code literally (the codes-drift
+ * collector resolves the `code` slot, as `drift` above says); only the words
+ * are shared, so the two cannot drift into two descriptions of one file.
+ *
+ * The reader's own recipe for the one file that failed, never a fixed one:
+ * "re-record" alone sent this finding's reader into `--record`'s refusal of
+ * the very same file, and the safe repair differs between a service's own
+ * attestation file and the one-file record other services' evidence may sit
+ * in. `path` is docs-relative.
+ */
+function recordUnreadableMessage(label, file) {
+    return (`${label}: ${file.path} exists but cannot be read as a verification record (${file.unreadable}) — ` +
+        `none of its evidence was checked. ${file.advice} loam never overwrites a record it could not read`);
+}
 /** One drift as a detail line: which claim, which citation, what changed. */
 function detailLine(d) {
     return `${d.claim} ${d.evidence} — ${d.what}`;

package/dist/commands/validate/service/evidence-pins.js.map

@@ -1 +1 @@
-{"version":3,"file":"evidence-pins.js","sourceRoot":"","sources":["../../../../src/commands/validate/service/evidence-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAA+B,MAAM,mCAAmC,CAAC;AAClG,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAIlE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAwB,EACxB,OAA2B,EAC3B,KAAoB;IAEpB,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,EAAE,GAAW,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAKxD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAmB,EAAE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAClH,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,wDAAwD,KAAK,CAAC,UAAU,MAAM;oBACpH,sFAAsF;oBACtF,kBAAkB,KAAK,CAAC,OAAO,cAAc,EAAE,6EAA6E;aAC/H,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAChC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QACnE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACxB,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAE,IAAY,EAAE,QAAgB,EAAQ,EAAE;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI;gBACJ,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,OAAO,KAAK,MAAM,CAAC,MAAM,6BAA6B,QAAQ,KAAK;oBAC7E,uFAAuF;oBACvF,kBAAkB,OAAO,cAAc,EAAE,wDAAwD;gBACnG,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;aAChC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,KAAK,CACH,YAAY,EACZ,qBAAqB,EACrB,sIAAsI,CACvI,CAAC;QACF,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,4EAA4E,CAAC,CAAC;QAC/G,KAAK,CAAC,cAAc,EAAE,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;QACpG,KAAK,CACH,eAAe,EACf,wBAAwB,EACxB,0EAA0E,CAC3E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;gBACd,mEAAmE;gBACnE,mEAAmE;gBACnE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,OAAO,KAAK,IAAI,CAAC,QAAQ,uDAAuD;oBAC1F,wDAAwD,OAAO,cAAc,EAAE,wCAAwC;aAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,EAAE,KAAK,OAAO,2BAA2B,aAAa,yDAAyD;SAC5H,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,CAAW;IAC7B,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC","sourcesContent":["/**\n * The evidence-pin re-check as validate findings: every ACTIVE feature record\n * this service has attested, its pins graded against THIS working tree.\n *\n * Service-repo-scoped like `sources.*` and the gherkin chain — the citations\n * resolve only inside the service's own repository. From the docs repo the\n * whole family is silent by design: every pin would grade `unresolved` there,\n * which would be a lie about the code rather than about the record, and\n * `sources.unverifiable-from-here` already names the blind spot once per\n * service.\n *\n * ARCHIVED records are deliberately not linted (a v1 non-goal, recorded here):\n * a frozen record is history, post-ship code drift is normal evolution, and\n * grading it would turn every service's CI permanently yellow the week after\n * every ship. If audit-time re-checks of shipped records are ever wanted, the\n * same `lintEvidencePins` call over `listFeatures` include-archived is the\n * whole change — behind an explicit flag, so the default stays quiet.\n *\n * Everything here demotes reviewer confidence only: warns never flip `valid`,\n * `--strict` may gate on them as it gates on any warning, and no grade ever\n * moves a verdict — `attested` never silently becomes `verified` and a drifted\n * pin never un-confirms a claim.\n */\nimport { repoPath } from \"../../../core/envelope/json.js\";\nimport { inOrder } from \"../../../core/kernel/concurrency.js\";\nimport { type PathableService } from \"../../../core/kernel/ids/service.js\";\nimport { listFeatures } from \"../../../core/repo/repo.js\";\nimport { readVerificationState } from \"../../../core/verify/file.js\";\nimport { verificationPath } from \"../../../core/verify/record.js\";\nimport { lintEvidencePins, type PinDrift, type PinLint } from \"../../../core/verify/pins/lint.js\";\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport type { FleetContext } from \"../../../core/fleet-context.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\n\nexport async function evidencePinFindings(\n  docsDir: DocsDir,\n  service: PathableService,\n  repoDir: string | undefined,\n  fleet?: FleetContext,\n): Promise<Finding[]> {\n  if (repoDir === undefined) return [];\n  // Membership questions cross the provenance line through plain strings by\n  // design (kernel/ids/service.ts) — record subjects are document text.\n  const me: string = service;\n  // ACTIVE features only — see the header for why archived records stay frozen.\n  const features = await listFeatures(docsDir, {}, fleet);\n  type Linted =\n    | null\n    | { feature: string; path: string; unreadable: string }\n    | { feature: string; lint: PinLint };\n  const lints = await inOrder(features, async (feature): Promise<Linted> => {\n    // Three states, graded apart on purpose. ABSENT is a feature nobody has\n    // verified — legitimate silence. UNREADABLE is somebody's record this run\n    // could not use, and it must be a finding here rather than a skip: the\n    // damage that most plausibly breaks a record in a service repo's CI is a\n    // hand edit to the very pins this family grades, and a lint that went\n    // silent over it would turn \"someone broke the record\" into a green run —\n    // `verify` names the same file `record-unreadable`, but this CI job never\n    // runs verify. An unreadable record also cannot say whether it attests\n    // this service, so the finding fires regardless of attestation.\n    const read = await readVerificationState(feature.dir);\n    if (read.state === \"unreadable\") {\n      return { feature: feature.id, path: repoPath(docsDir, verificationPath(feature.dir)), unreadable: read.reason };\n    }\n    if (read.state === \"absent\" || read.verification.schema !== 2) return null;\n    if (!(read.verification.attestations ?? []).some((a) => a.service === me)) return null;\n    return { feature: feature.id, lint: await lintEvidencePins(read.verification.claims, me, repoDir) };\n  });\n\n  const findings: Finding[] = [];\n  let checked = 0;\n  let pinnedRecords = 0;\n  let drifted = false;\n  for (const entry of lints) {\n    if (entry === null) continue;\n    if (\"unreadable\" in entry) {\n      findings.push({\n        severity: \"warn\",\n        code: \"evidence.record-unreadable\",\n        subject: service,\n        message:\n          `${me}: ${entry.feature}: ${entry.path} exists but cannot be read as a verification record (${entry.unreadable}) — ` +\n          \"none of its evidence was checked. It is plain YAML: repair it by hand, or re-record \" +\n          `(\\`loam verify ${entry.feature} --service ${me} --record answers.json\\`); loam never overwrites a record it could not read`,\n      });\n      continue;\n    }\n    const { feature, lint } = entry;\n    if (lint.checked > 0 || lint.drifts.length > 0) pinnedRecords += 1;\n    checked += lint.checked;\n    // The code is spelled as a literal at each call below, and the grade rides\n    // beside it rather than being sliced back out of the code string — the\n    // codes-drift collector resolves the `code` slot, and a derivation would\n    // be a second definition of the pairing free to drift from the first.\n    const drift = (grade: PinDrift[\"grade\"], code: string, sentence: string): void => {\n      const drifts = lint.drifts.filter((d) => d.grade === grade);\n      if (drifts.length === 0) return;\n      drifted = true;\n      findings.push({\n        severity: \"warn\",\n        code,\n        subject: service,\n        message:\n          `${me}: ${feature}: ${drifts.length} recorded evidence pin(s) ${sentence} — ` +\n          \"a reading priority for the reviewer, never a verdict change; re-answer and re-record \" +\n          `(\\`loam verify ${feature} --service ${me} --record answers.json\\`) once the evidence is re-read`,\n        details: drifts.map(detailLine),\n      });\n    };\n    drift(\n      \"unresolved\",\n      \"evidence.unresolved\",\n      \"cannot be re-checked in this working tree: the cited file is gone, unreadable, not a regular file, or the cited line is past its end\",\n    );\n    drift(\"moved\", \"evidence.moved\", \"cite a file that changed since the record, though each cited line survives\");\n    drift(\"line-changed\", \"evidence.line-changed\", \"cite line(s) that no longer say what was recorded\");\n    drift(\n      \"token-missing\",\n      \"evidence.token-missing\",\n      \"cite file(s) that no longer contain the literal string the claim asserts\",\n    );\n    if (lint.unpinned > 0) {\n      findings.push({\n        severity: \"ok\",\n        // The pre-content_digest-vouch precedent: a record from before the\n        // capability existed is not wrong, it is unfindable-by-this-check.\n        code: \"evidence.unpinned\",\n        subject: service,\n        message:\n          `${me}: ${feature}: ${lint.unpinned} agent-confirmed citation(s) carry no evidence pin — ` +\n          `recorded before pins existed; the next \\`loam verify ${feature} --service ${me} --record\\` makes them drift-checkable`,\n      });\n    }\n  }\n  if (checked > 0 && !drifted) {\n    findings.push({\n      severity: \"ok\",\n      code: \"evidence.checked\",\n      subject: service,\n      message: `${me}: ${checked} evidence pin(s) across ${pinnedRecords} feature record(s) re-checked against this working tree`,\n    });\n  }\n  return findings;\n}\n\n/** One drift as a detail line: which claim, which citation, what changed. */\nfunction detailLine(d: PinDrift): string {\n  return `${d.claim} ${d.evidence} — ${d.what}`;\n}\n"]}
+{"version":3,"file":"evidence-pins.js","sourceRoot":"","sources":["../../../../src/commands/validate/service/evidence-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAqB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAA+B,MAAM,mCAAmC,CAAC;AAClG,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAIlE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAwB,EACxB,OAA2B,EAC3B,KAAmB;IAEnB,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,EAAE,GAAW,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAKxD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAmB,EAAE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACnH,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,uBAAuB,CAAC,GAAG,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC;aACnE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAChC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QACnE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACxB,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAE,IAAY,EAAE,QAAgB,EAAQ,EAAE;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI;gBACJ,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,OAAO,KAAK,MAAM,CAAC,MAAM,6BAA6B,QAAQ,KAAK;oBAC7E,uFAAuF;oBACvF,kBAAkB,OAAO,cAAc,EAAE,wDAAwD;gBACnG,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;aAChC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,KAAK,CACH,YAAY,EACZ,qBAAqB,EACrB,sIAAsI,CACvI,CAAC;QACF,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,4EAA4E,CAAC,CAAC;QAC/G,KAAK,CAAC,cAAc,EAAE,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;QACpG,KAAK,CACH,eAAe,EACf,wBAAwB,EACxB,0EAA0E,CAC3E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;gBACd,mEAAmE;gBACnE,mEAAmE;gBACnE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,OAAO,KAAK,IAAI,CAAC,QAAQ,uDAAuD;oBAC1F,wDAAwD,OAAO,cAAc,EAAE,wCAAwC;aAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,EAAE,KAAK,OAAO,2BAA2B,aAAa,yDAAyD;SAC5H,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAgB,EAAE,OAAqB;IACjF,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACpG,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;SACvC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,uBAAuB,CAC9B,KAAa,EACb,IAA0D;IAE1D,OAAO,CACL,GAAG,KAAK,KAAK,IAAI,CAAC,IAAI,wDAAwD,IAAI,CAAC,UAAU,MAAM;QACnG,qCAAqC,IAAI,CAAC,MAAM,mDAAmD,CACpG,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,CAAW;IAC7B,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC","sourcesContent":["/**\n * The evidence-pin re-check as validate findings: every ACTIVE feature record\n * this service has attested, its pins graded against THIS working tree.\n *\n * Service-repo-scoped like `sources.*` and the gherkin chain — the citations\n * resolve only inside the service's own repository. From the docs repo this\n * TARGET is silent by design: every pin would grade `unresolved` there, which\n * would be a lie about the code rather than about the record, and\n * `sources.unverifiable-from-here` already names the blind spot once per\n * service. One code of the family is not about the code at all —\n * `evidence.record-unreadable` is about the record, which lives in the docs\n * repo — so the FEATURE target (`../feature.ts`) raises it too, from anywhere,\n * through `featureRecordFindings` below:\n * with only this target raising it, `validate --all` in the docs repo stayed\n * green over a conflict-marked record that `verify` refused and `status`,\n * `gate` and `tasks` all reported. In a service repo's `--all` the same file\n * is therefore named twice, once per target: here as this service's pins\n * going unchecked, there as the feature's record itself.\n *\n * ARCHIVED records are deliberately not linted (a v1 non-goal, recorded here):\n * a frozen record is history, post-ship code drift is normal evolution, and\n * grading it would turn every service's CI permanently yellow the week after\n * every ship. If audit-time re-checks of shipped records are ever wanted, the\n * same `lintEvidencePins` call over `listFeatures` include-archived is the\n * whole change — behind an explicit flag, so the default stays quiet.\n *\n * Everything here demotes reviewer confidence only: warns never flip `valid`,\n * `--strict` may gate on them as it gates on any warning, and no grade ever\n * moves a verdict — `attested` never silently becomes `verified` and a drifted\n * pin never un-confirms a claim.\n */\nimport { repoPath } from \"../../../core/envelope/json.js\";\nimport { inOrder } from \"../../../core/kernel/concurrency.js\";\nimport { type PathableService } from \"../../../core/kernel/ids/service.js\";\nimport { type FeatureEntry } from \"../../../core/repo/entries.js\";\nimport { listFeatures } from \"../../../core/repo/repo.js\";\nimport { readVerificationState } from \"../../../core/verify/read/file.js\";\nimport { lintEvidencePins, type PinDrift, type PinLint } from \"../../../core/verify/pins/lint.js\";\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport type { FleetContext } from \"../../../core/fleet-context.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\n\nexport async function evidencePinFindings(\n  docsDir: DocsDir,\n  service: PathableService,\n  repoDir: string | undefined,\n  fleet: FleetContext,\n): Promise<Finding[]> {\n  if (repoDir === undefined) return [];\n  // Membership questions cross the provenance line through plain strings by\n  // design (kernel/ids/service.ts) — record subjects are document text.\n  const me: string = service;\n  // ACTIVE features only — see the header for why archived records stay frozen.\n  const features = await listFeatures(docsDir, {}, fleet);\n  type Linted =\n    | null\n    | { feature: string; path: string; unreadable: string; advice: string }\n    | { feature: string; lint: PinLint };\n  const lints = await inOrder(features, async (feature): Promise<Linted> => {\n    // Three states, graded apart on purpose. ABSENT is a feature nobody has\n    // verified — legitimate silence. UNREADABLE is somebody's record this run\n    // could not use, and it must be a finding here rather than a skip: the\n    // damage that most plausibly breaks a record in a service repo's CI is a\n    // hand edit to the very pins this family grades, and a lint that went\n    // silent over it would turn \"someone broke the record\" into a green run —\n    // `verify` names the same file `record-unreadable`, but this CI job never\n    // runs verify. An unreadable record also cannot say whether it attests\n    // this service, so the finding fires regardless of attestation.\n    const read = await readVerificationState(feature.dir);\n    if (read.state === \"unreadable\") {\n      return { feature: feature.id, path: repoPath(docsDir, read.path), unreadable: read.reason, advice: read.advice };\n    }\n    if (read.state === \"absent\" || read.verification.schema !== 2) return null;\n    if (!(read.verification.attestations ?? []).some((a) => a.service === me)) return null;\n    return { feature: feature.id, lint: await lintEvidencePins(read.verification.claims, me, repoDir) };\n  });\n\n  const findings: Finding[] = [];\n  let checked = 0;\n  let pinnedRecords = 0;\n  let drifted = false;\n  for (const entry of lints) {\n    if (entry === null) continue;\n    if (\"unreadable\" in entry) {\n      findings.push({\n        severity: \"warn\",\n        code: \"evidence.record-unreadable\",\n        subject: service,\n        message: recordUnreadableMessage(`${me}: ${entry.feature}`, entry),\n      });\n      continue;\n    }\n    const { feature, lint } = entry;\n    if (lint.checked > 0 || lint.drifts.length > 0) pinnedRecords += 1;\n    checked += lint.checked;\n    // The code is spelled as a literal at each call below, and the grade rides\n    // beside it rather than being sliced back out of the code string — the\n    // codes-drift collector resolves the `code` slot, and a derivation would\n    // be a second definition of the pairing free to drift from the first.\n    const drift = (grade: PinDrift[\"grade\"], code: string, sentence: string): void => {\n      const drifts = lint.drifts.filter((d) => d.grade === grade);\n      if (drifts.length === 0) return;\n      drifted = true;\n      findings.push({\n        severity: \"warn\",\n        code,\n        subject: service,\n        message:\n          `${me}: ${feature}: ${drifts.length} recorded evidence pin(s) ${sentence} — ` +\n          \"a reading priority for the reviewer, never a verdict change; re-answer and re-record \" +\n          `(\\`loam verify ${feature} --service ${me} --record answers.json\\`) once the evidence is re-read`,\n        details: drifts.map(detailLine),\n      });\n    };\n    drift(\n      \"unresolved\",\n      \"evidence.unresolved\",\n      \"cannot be re-checked in this working tree: the cited file is gone, unreadable, not a regular file, or the cited line is past its end\",\n    );\n    drift(\"moved\", \"evidence.moved\", \"cite a file that changed since the record, though each cited line survives\");\n    drift(\"line-changed\", \"evidence.line-changed\", \"cite line(s) that no longer say what was recorded\");\n    drift(\n      \"token-missing\",\n      \"evidence.token-missing\",\n      \"cite file(s) that no longer contain the literal string the claim asserts\",\n    );\n    if (lint.unpinned > 0) {\n      findings.push({\n        severity: \"ok\",\n        // The pre-content_digest-vouch precedent: a record from before the\n        // capability existed is not wrong, it is unfindable-by-this-check.\n        code: \"evidence.unpinned\",\n        subject: service,\n        message:\n          `${me}: ${feature}: ${lint.unpinned} agent-confirmed citation(s) carry no evidence pin — ` +\n          `recorded before pins existed; the next \\`loam verify ${feature} --service ${me} --record\\` makes them drift-checkable`,\n      });\n    }\n  }\n  if (checked > 0 && !drifted) {\n    findings.push({\n      severity: \"ok\",\n      code: \"evidence.checked\",\n      subject: service,\n      message: `${me}: ${checked} evidence pin(s) across ${pinnedRecords} feature record(s) re-checked against this working tree`,\n    });\n  }\n  return findings;\n}\n\n/**\n * `evidence.record-unreadable` on the FEATURE target (`../feature.ts`), from\n * anywhere — the docs repo included, which is where the record lives. Kept\n * here, beside the service target's emission, so one module owns the code and\n * its words: the record read is the same `readVerificationState`, the path is\n * made docs-relative the same way, and the message is the same sentence.\n * Readability only — an `ok` record contributes nothing here, its verdict is\n * `verify`'s and `status`'s to state — and a warn for the reasons the header\n * gives: `valid` and `loam archive` are untouched, `--strict` is the lever.\n */\nexport async function featureRecordFindings(docsDir: DocsDir, feature: FeatureEntry): Promise<Finding[]> {\n  const read = await readVerificationState(feature.dir);\n  if (read.state !== \"unreadable\") return [];\n  const path = repoPath(docsDir, read.path);\n  return [\n    {\n      severity: \"warn\",\n      code: \"evidence.record-unreadable\",\n      message: recordUnreadableMessage(feature.id, { path, unreadable: read.reason, advice: read.advice }),\n      locations: [{ path, role: \"primary\" }],\n    },\n  ];\n}\n\n/**\n * The sentence `evidence.record-unreadable` carries, for both targets that\n * raise it. Each emission spells the code literally (the codes-drift\n * collector resolves the `code` slot, as `drift` above says); only the words\n * are shared, so the two cannot drift into two descriptions of one file.\n *\n * The reader's own recipe for the one file that failed, never a fixed one:\n * \"re-record\" alone sent this finding's reader into `--record`'s refusal of\n * the very same file, and the safe repair differs between a service's own\n * attestation file and the one-file record other services' evidence may sit\n * in. `path` is docs-relative.\n */\nfunction recordUnreadableMessage(\n  label: string,\n  file: { path: string; unreadable: string; advice: string },\n): string {\n  return (\n    `${label}: ${file.path} exists but cannot be read as a verification record (${file.unreadable}) — ` +\n    `none of its evidence was checked. ${file.advice} loam never overwrites a record it could not read`\n  );\n}\n\n/** One drift as a detail line: which claim, which citation, what changed. */\nfunction detailLine(d: PinDrift): string {\n  return `${d.claim} ${d.evidence} — ${d.what}`;\n}\n"]}

package/dist/commands/validate/service/model/diverged.js

@@ -0,0 +1,226 @@
+import { ARTIFACT_FILES } from "../../../../core/repo/paths.js";
+import { serviceLevelElements } from "../../fleet/census.js";
+/**
+ * How the OTHER declaration is named.
+ *
+ * The document, not the file: `Elem` carries no source path, and the map is a
+ * PROJECT — `architecture/landscape.likec4` plus every other `.likec4` under
+ * `architecture/` — so naming the landscape file was a guess that sent an author
+ * to a document that does not declare the element at all.
+ */
+const MAP = "the fleet map (architecture/)";
+export function divergedFindings(check) {
+    const { service, model, architecture, known } = check;
+    // An extending model declares each of these elements exactly once by
+    // construction — there is no copy to diverge — and the shapes' other grade
+    // (`c4.element-unowned`) is what asks its question.
+    if (model.shape !== "standalone")
+        return [];
+    if (model.doc.errors.length > 0)
+        return [];
+    if (architecture === null || architecture.errors.length > 0)
+        return [];
+    const index = joinIndex(architecture.elements, known);
+    const findings = [];
+    for (const mine of model.doc.elements) {
+        const theirs = counterpart(index, mine);
+        if (theirs === undefined)
+            continue;
+        const fields = differing(mine, theirs);
+        if (fields.length === 0)
+            continue;
+        // Where "copy the map's declaration verbatim" is a no-op: the tag sets are
+        // all that differ (so the two kinds are equal, and the block to open can be
+        // named) and copying the map's literal tags across would leave them still
+        // differing. `fields` is checked first because copying DOES fix a title or a
+        // binding, so the verbatim remedy stays right whenever one of those differs.
+        const specs = { mine: model.doc.specification, theirs: architecture.specification };
+        const inherited = fields.length === 1 && fields[0] === "tags" && copyIsNoOp(mine, theirs, specs)
+            ? declaringSide(mine.kind, specs)
+            : null;
+        findings.push({
+            severity: "warn",
+            code: "c4.declaration-diverged",
+            subject: service,
+            message: `${service}: ${ARTIFACT_FILES.model} declares '${mine.id}' as ${describe(mine)} and ` +
+                `${MAP} declares ${theirs.id === mine.id ? "it" : `'${theirs.id}'`} as ${describe(theirs)} — ` +
+                remedy(fields, mine.kind, inherited),
+        });
+    }
+    return findings;
+}
+/**
+ * What the message says after the two declarations: which fields differ, and
+ * what to do about it. `inherited` is null when copying the map's declaration
+ * fixes this, and otherwise the clause naming which document's `specification`
+ * puts the tags on the kind — the side an author has to open.
+ */
+function remedy(fields, kind, inherited) {
+    // "the kind differs" / "the title differs" / "the tags differ": the verb
+    // agrees with the last field named, and `tags` is the one plural noun in the
+    // set. It shipped as "the kind differ", and a sentence a reader trips over is
+    // one they stop reading.
+    const plural = fields.length > 1 || fields[fields.length - 1] === "tags";
+    const named = `the ${fields.join(", ")} differ${plural ? "" : "s"}`;
+    // The two kinds are equal whenever `tags` is the only differing field, so the
+    // block to open can be named exactly.
+    if (inherited !== null) {
+        return (`${named}, and copying the map's declaration would not clear it: the sets come apart on ` +
+            `\`specification { element ${kind} { … } }\`, ${inherited}. Either match the two specification ` +
+            'blocks on that kind, or migrate the model to extend the map (SCHEMA.md, "Two shapes of a service ' +
+            'model") so there is one specification and one declaration');
+    }
+    return (`${named}, so two documents are two authorities on one element. Copy the map's declaration verbatim, or ` +
+        'migrate the model to extend the map (SCHEMA.md, "Two shapes of a service model") so it is declared once');
+}
+function joinIndex(elements, known) {
+    // Which map elements are the fleet's own boxes rather than somebody's
+    // interior, by the ONE predicate every other fleet check asks it with
+    // (`fleet/census.ts`): a binding or a title naming a real services/<id>/ makes
+    // an element a service at any depth, and what sits inside one is that
+    // service's container. Everything else is fleet-level — a top-level element,
+    // or a box the map draws inside a plain grouping element — see the header.
+    const fleetLevel = new Set(serviceLevelElements([...elements], known).map((e) => e.id));
+    return {
+        byId: unique(elements, (e) => [e.id]),
+        byBinding: unique(elements, (e) => (e.service === undefined ? [] : [e.service])),
+        // Every DOTTED tail of the id, so a model's `paymentService.api` reaches the
+        // map's `marketplace.paymentService.api`: a tail carrying a dot names the
+        // owner as well as the leaf, so the two documents are talking about one
+        // element.
+        //
+        // The bare LAST segment names only the leaf, and it is emitted for
+        // FLEET-LEVEL boxes alone. This shipped unconditional, and the comment
+        // here claimed it was not: a standalone model's own `db`, `api` or `agent`
+        // joined whatever `<something>.<that name>` the map happened to hold — one
+        // service's private cache told to copy another service's store, verbatim.
+        // loam's own meta/docs hit it (`agent` ↔ `loam.core.agent`, a container of
+        // src/core/agent/), which is the case that made the rung wrong rather than
+        // merely risky (verification 2026-09-04).
+        //
+        // A box the map draws inside a plain GROUP still emits its bare segment,
+        // and deliberately: `infra.cache` is the fleet's cache, so a model's own
+        // top-level `cache` is a second meaning for one name and worth the warning.
+        // Grouping is a drawing convenience, not ownership — only a SERVICE owns an
+        // interior — so the guard is "no ancestor stands for a service" and not
+        // "the id carries no dot".
+        bySuffix: unique(elements, (e) => {
+            const segments = e.id.split(".");
+            const tails = segments.map((_, i) => segments.slice(i).join("."));
+            return fleetLevel.has(e.id) ? tails : tails.slice(0, -1);
+        }),
+    };
+}
+/** An index holding only the keys exactly ONE element answers to — a shared key joins nothing. */
+function unique(elements, keys) {
+    const claims = new Map();
+    for (const element of elements) {
+        for (const key of keys(element)) {
+            const held = claims.get(key);
+            if (held === undefined)
+                claims.set(key, [element]);
+            else
+                held.push(element);
+        }
+    }
+    const index = new Map();
+    for (const [key, held] of claims)
+        if (held.length === 1)
+            index.set(key, held[0]);
+    return index;
+}
+/** The map's declaration of the element this model declares, or undefined when nothing joins. */
+function counterpart(index, mine) {
+    const byId = index.byId.get(mine.id);
+    if (byId !== undefined)
+        return byId;
+    // The binding is the strongest evidence after the id: both documents wrote
+    // `metadata { service '<id>' }`, so both mean the same directory.
+    const bound = mine.service === undefined ? undefined : index.byBinding.get(mine.service);
+    if (bound !== undefined)
+        return bound;
+    return index.bySuffix.get(mine.id);
+}
+/** Which of the four compared fields disagree, in a fixed order so two runs read alike. */
+function differing(mine, theirs) {
+    const fields = [];
+    if (mine.kind !== theirs.kind)
+        fields.push("kind");
+    if (mine.title !== theirs.title)
+        fields.push("title");
+    // A SET, sorted: tag order is authoring order and means nothing, and a model
+    // that lists the map's two tags the other way round is the same declaration.
+    if (tagList(mine) !== tagList(theirs))
+        fields.push("tags");
+    if (mine.service !== theirs.service)
+        fields.push("service binding");
+    return fields;
+}
+function tagList(e) {
+    return [...new Set(e.tags)].sort().join(" ");
+}
+/**
+ * Would "copy the map's declaration verbatim" leave the tag sets still
+ * differing? Answered by SIMULATING the copy, which is the only way to be right
+ * about it in both directions.
+ *
+ * `Elem.tags` is what LikeC4 hands over, and since 1.59.0 that includes every
+ * tag the element's kind declares (`core/c4/parsed/specification.ts` says why
+ * loam reads the block at all). Copying the map's DECLARATION copies its literal
+ * tags into the model and nothing else — the model keeps its own specification —
+ * so the model's element would come back carrying `mine's kind defaults ∪ the
+ * map's literal tags`, against the map's `its kind defaults ∪ the same literal
+ * tags`. Those differ exactly when the two kind defaults differ outside the
+ * copied literals, and then the remedy is a no-op.
+ *
+ * The first version compared the two LITERAL tag lists and switched arms only
+ * when they were equal, which caught one direction of the same case and missed
+ * its mirror: a model writing `#external` on an element whose map twin inherits
+ * `#external #platform` from `element topic { … }` was told to copy the map's
+ * bare line, and doing exactly that produced the OTHER arm of this same message
+ * (verification 2026-09-04, second pass, examples/docs order-service).
+ */
+function copyIsNoOp(mine, theirs, specs) {
+    const copied = literalTags(theirs, specs.theirs);
+    const after = union(kindTags(mine.kind, specs.mine), copied);
+    const before = union(kindTags(theirs.kind, specs.theirs), copied);
+    return after !== before;
+}
+/**
+ * Which document's `specification` puts the tags on the kind — the half of the
+ * message that tells an author which file to open. "Both, differently" is a real
+ * state (each block declares its own tag on the same kind) and gets its own
+ * words rather than a guess at one side.
+ */
+function declaringSide(kind, specs) {
+    const mine = kindTags(kind, specs.mine);
+    const theirs = kindTags(kind, specs.theirs);
+    if (mine.length > 0 && theirs.length > 0)
+        return "which the two documents declare different tags on";
+    if (theirs.length > 0)
+        return `which ${MAP} declares tags on and ${ARTIFACT_FILES.model} does not`;
+    if (mine.length > 0)
+        return `which ${ARTIFACT_FILES.model} declares tags on and ${MAP} does not`;
+    // No kind declares anything and the copy still fails: not reachable from the
+    // predicate above (with equal kinds and no defaults the copy always clears
+    // it), and a sentence that names no file beats one that names the wrong file.
+    return "which the two documents' blocks disagree on";
+}
+/** The tags `spec` puts on every element of `kind`, sorted — the defaults an element cannot see. */
+function kindTags(kind, spec) {
+    return [...new Set(spec?.elementKindTags[kind] ?? [])].sort();
+}
+/** A tag SET as one comparable string; see `tagList` for why order is dropped. */
+function union(a, b) {
+    return [...new Set([...a, ...b])].sort().join(" ");
+}
+function literalTags(e, spec) {
+    const inherited = new Set(kindTags(e.kind, spec));
+    return [...new Set(e.tags)].filter((tag) => !inherited.has(tag)).sort();
+}
+/** One element as the message names it — every compared field, in the order `differing` reports them. */
+function describe(e) {
+    const tags = tagList(e);
+    return `${e.kind} '${e.title}' [${tags === "" ? "no tags" : tags}, bound to ${e.service ?? "unbound"}]`;
+}
+//# sourceMappingURL=diverged.js.map