@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/core/c4/splice/authored-source.js

@@ -1,26 +1,84 @@
 import { maskSource, matchBrace } from "../source-mask.js";
+export function spliceSource(deltaText, decl, carry) {
+    const { featureId, indent: targetIndent, omit = [] } = carry;
+    const block = deltaText.slice(decl.start, decl.end);
+    const cuts = omit
+        .filter((r) => r.start >= decl.start && r.end <= decl.end)
+        .map((r) => wholeLines(block, r.start - decl.start, r.end - decl.start));
+    return reindent(stripFeatureTag(block, featureId, cuts), decl.indent, targetIndent);
+}
 /**
- * A declaration's authored source, ready to land in the living landscape:
- * byte-verbatim except that the feature's own tag is stripped and the
- * indentation is rebased from where the block sat in the delta to where it
- * lands. A construct the strip leaves empty goes too — a line that held only
- * the tag disappears whole, and `x = kind 'y' { #FEAT-1 }` lands as
- * `x = kind 'y'`, not as a pair of empty braces.
+ * Widen a cut to the whole lines it sits on, when it has them to itself.
+ *
+ * A scanned declaration's span starts at its first character and ends one past
+ * its last brace, so cutting it verbatim would leave the leading indent and the
+ * trailing newline behind as a blank line — and the emptied-line rule below only
+ * fires on a removal a line contains. A cut sharing its line with other code is
+ * left exactly as asked.
  */
-export function spliceSource(deltaText, decl, featureId, targetIndent) {
-    const block = deltaText.slice(decl.start, decl.end);
-    return reindent(stripFeatureTag(block, featureId), decl.indent, targetIndent);
+function wholeLines(block, start, end) {
+    const lineStart = block.lastIndexOf("\n", start - 1) + 1;
+    if (!/^[ \t]*$/.test(block.slice(lineStart, start)))
+        return [start, end];
+    const nl = block.indexOf("\n", end);
+    const to = nl === -1 ? block.length : nl;
+    if (!/^[ \t\r]*$/.test(block.slice(end, to)))
+        return [start, end];
+    return [lineStart, nl === -1 ? block.length : nl + 1];
+}
+/**
+ * Rewrite the line endings a merge INSERTED to the ones the document already
+ * uses.
+ *
+ * Splicing composes bytes from two files, and the delta's newlines are not
+ * necessarily the living document's: on a repository without `core.autocrlf`
+ * normalisation a CRLF landscape or model came back with a handful of bare-LF
+ * lines in the spliced region — two conventions in one file, noisy in an editor
+ * and in every diff (verification 2026-09-04, W-CRLF). One helper for both
+ * merges, because both had it.
+ *
+ * Only a document with ONE convention is corrected, and then in whichever
+ * direction it uses: a file that is already mixed has no convention to match, and
+ * guessing one would rewrite lines nobody touched.
+ */
+export function matchLineEndings(document, merged) {
+    const crlf = (document.match(/\r\n/g) ?? []).length;
+    const bare = (document.match(/(?<!\r)\n/g) ?? []).length;
+    if (crlf > 0 && bare === 0)
+        return merged.replace(/(?<!\r)\n/g, "\r\n");
+    if (bare > 0 && crlf === 0)
+        return merged.replace(/\r\n/g, "\n");
+    return merged;
 }
-function stripFeatureTag(block, featureId) {
+function stripFeatureTag(block, featureId, cuts) {
     const { code } = maskSource(block);
     const esc = featureId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const removals = [];
+    const removals = cuts.map(([s, e]) => [s, e]);
     for (const m of block.matchAll(new RegExp(`#${esc}(?![\\w-])`, "g"))) {
         // Only tags in CODE count — a description quoting "#FEAT-1" is content.
         if (code.slice(m.index, m.index + m[0].length) !== m[0])
             continue;
         let s = m.index;
         let e = s + m[0].length;
+        // A tag list's separators go with the tag they separate. LikeC4 reads a
+        // list as `#a #b, #c;` — one or more tags first, then `,` groups, then an
+        // optional `;` — so `#FEAT-1, #x` stripped to `, #x` and `#FEAT-1;` to a
+        // bare `;`, and the parse net refused a delta LikeC4 accepts. The comma
+        // after the tag goes with it, else the comma before it; the `;` only when
+        // no tag is left in front of it.
+        const commaAfter = /^[ \t]*,[ \t]*/.exec(code.slice(e));
+        const commaBefore = /,[ \t]*$/.exec(code.slice(0, s));
+        const semi = /^[ \t]*;/.exec(code.slice(e));
+        if (commaAfter !== null) {
+            removals.push([s, e + commaAfter[0].length]);
+            continue;
+        }
+        if (commaBefore !== null) {
+            removals.push([commaBefore.index, e]);
+            continue;
+        }
+        if (semi !== null && !/#[\w-]+\s*$/.test(code.slice(0, s)))
+            e += semi[0].length;
         // Take the whitespace on ONE side with the token — trailing first, so
         // `#FEAT-1 #critical` leaves `#critical` at its own indent, and a token at
         // the end of a line does not leave a trailing space behind.
@@ -88,13 +146,21 @@ function applyRemovals(text, removals) {
  * Rebase a block's indentation: the `base` its lines carried in the delta
  * becomes `target`. The first line arrives with no leading whitespace (the
  * scanner's span starts at the declaration itself), so it only gains `target`.
+ *
+ * A CRLF delta's blank line is `"\r"`, not `""`, so splitting on `\n` alone used
+ * to hand a non-empty body to the rule below and every blank line inside a
+ * spliced block came out carrying the target indent as trailing whitespace. The
+ * carriage return is set aside and put back, which leaves the line's own ending
+ * exactly as authored for `matchLineEndings` to reconcile.
  */
 function reindent(block, base, target) {
     return block
         .split("\n")
         .map((line, k) => {
-        const body = k === 0 ? line : line.startsWith(base) ? line.slice(base.length) : line;
-        return body.length === 0 ? "" : target + body;
+        const cr = line.endsWith("\r");
+        const raw = cr ? line.slice(0, -1) : line;
+        const body = k === 0 ? raw : raw.startsWith(base) ? raw.slice(base.length) : raw;
+        return (body.length === 0 ? "" : target + body) + (cr ? "\r" : "");
     })
         .join("\n");
 }

package/dist/core/c4/splice/authored-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"authored-source.js","sourceRoot":"","sources":["../../../../src/core/c4/splice/authored-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,IAAoD,EACpD,SAAiB,EACjB,YAAoB;IAEpB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,SAAiB;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACrE,wEAAwE;QACxE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAClE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,sEAAsE;QACtE,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAExC,+DAA+D;IAC/D,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,GAAI,CAAC;QACnD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClD,IACE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,OAAO,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,EACjF,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC;YAAE,SAAS;QACjE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAAE,SAAS;QACxE,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,8DAA8D;AAC9D,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,EAAU,EAAE,QAAiC;IACzF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,QAAiC;IACpE,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc;IAC3D,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;IAChD,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import { maskSource, matchBrace } from \"../source-mask.js\";\n\n/**\n * A declaration's authored source, ready to land in the living landscape:\n * byte-verbatim except that the feature's own tag is stripped and the\n * indentation is rebased from where the block sat in the delta to where it\n * lands. A construct the strip leaves empty goes too — a line that held only\n * the tag disappears whole, and `x = kind 'y' { #FEAT-1 }` lands as\n * `x = kind 'y'`, not as a pair of empty braces.\n */\nexport function spliceSource(\n  deltaText: string,\n  decl: { start: number; end: number; indent: string },\n  featureId: string,\n  targetIndent: string,\n): string {\n  const block = deltaText.slice(decl.start, decl.end);\n  return reindent(stripFeatureTag(block, featureId), decl.indent, targetIndent);\n}\n\nfunction stripFeatureTag(block: string, featureId: string): string {\n  const { code } = maskSource(block);\n  const esc = featureId.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  const removals: Array<[number, number]> = [];\n  for (const m of block.matchAll(new RegExp(`#${esc}(?![\\\\w-])`, \"g\"))) {\n    // Only tags in CODE count — a description quoting \"#FEAT-1\" is content.\n    if (code.slice(m.index, m.index + m[0].length) !== m[0]) continue;\n    let s = m.index;\n    let e = s + m[0].length;\n    // Take the whitespace on ONE side with the token — trailing first, so\n    // `#FEAT-1 #critical` leaves `#critical` at its own indent, and a token at\n    // the end of a line does not leave a trailing space behind.\n    if (block[e] === \" \" || block[e] === \"\\t\") {\n      while (block[e] === \" \" || block[e] === \"\\t\") e += 1;\n    } else {\n      while (s > 0 && (block[s - 1] === \" \" || block[s - 1] === \"\\t\")) s -= 1;\n    }\n    removals.push([s, e]);\n  }\n  if (removals.length === 0) return block;\n\n  // A line the strip emptied disappears whole, newline included.\n  for (let lineStart = 0; lineStart < block.length; ) {\n    const nl = block.indexOf(\"\\n\", lineStart);\n    const lineEnd = nl === -1 ? block.length : nl + 1;\n    if (\n      removals.some(([s, e]) => s >= lineStart && e <= lineEnd) &&\n      /^\\s*$/.test(residual(block, lineStart, nl === -1 ? block.length : nl, removals))\n    ) {\n      removals.push([lineStart, lineEnd]);\n    }\n    lineStart = lineEnd;\n  }\n\n  // A body the strip emptied goes too, braces and all — but only one the strip\n  // emptied: braces that were authored empty are authored bytes and survive.\n  for (let at = code.indexOf(\"{\"); at !== -1; at = code.indexOf(\"{\", at + 1)) {\n    const closeAt = matchBrace(code, at);\n    if (closeAt === -1) continue;\n    if (!removals.some(([s, e]) => s > at && e <= closeAt)) continue;\n    if (!/^\\s*$/.test(residual(block, at + 1, closeAt, removals))) continue;\n    let s = at;\n    while (s > 0 && /\\s/.test(block[s - 1]!)) s -= 1;\n    removals.push([s, closeAt + 1]);\n  }\n  return applyRemovals(block, removals);\n}\n\n/** The text of [from, to) with the removal ranges cut out. */\nfunction residual(text: string, from: number, to: number, removals: Array<[number, number]>): string {\n  let out = \"\";\n  for (let i = from; i < to; i += 1) {\n    if (!removals.some(([s, e]) => i >= s && i < e)) out += text[i];\n  }\n  return out;\n}\n\nfunction applyRemovals(text: string, removals: Array<[number, number]>): string {\n  const sorted = [...removals].sort((a, b) => a[0] - b[0] || b[1] - a[1]);\n  let out = \"\";\n  let i = 0;\n  for (const [s, e] of sorted) {\n    if (s > i) out += text.slice(i, s);\n    if (e > i) i = e;\n  }\n  return out + text.slice(i);\n}\n\n/**\n * Rebase a block's indentation: the `base` its lines carried in the delta\n * becomes `target`. The first line arrives with no leading whitespace (the\n * scanner's span starts at the declaration itself), so it only gains `target`.\n */\nfunction reindent(block: string, base: string, target: string): string {\n  return block\n    .split(\"\\n\")\n    .map((line, k) => {\n      const body = k === 0 ? line : line.startsWith(base) ? line.slice(base.length) : line;\n      return body.length === 0 ? \"\" : target + body;\n    })\n    .join(\"\\n\");\n}\n"]}
+{"version":3,"file":"authored-source.js","sourceRoot":"","sources":["../../../../src/core/c4/splice/authored-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAmC3D,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,IAAoD,EACpD,KAAY;IAEZ,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;IAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,OAAO,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,GAAW;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClE,OAAO,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAc;IAC/D,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,SAAiB,EAAE,IAAqC;IAC9F,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAA4B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACrE,wEAAwE;QACxE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAClE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,iCAAiC;QACjC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAChF,sEAAsE;QACtE,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAExC,+DAA+D;IAC/D,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,GAAI,CAAC;QACnD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClD,IACE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,OAAO,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,EACjF,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC;YAAE,SAAS;QACjE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAAE,SAAS;QACxE,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,8DAA8D;AAC9D,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,EAAU,EAAE,QAAiC;IACzF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,QAAiC;IACpE,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc;IAC3D,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACf,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import { maskSource, matchBrace } from \"../source-mask.js\";\n\n/** A half-open byte range of `deltaText`, as the source scan reports one. */\nexport interface SourceRange {\n  start: number;\n  end: number;\n}\n\n/**\n * A declaration's authored source, ready to land in the living landscape:\n * byte-verbatim except that the feature's own tag is stripped (with the `,` or\n * `;` that set it apart in a tag list, which would otherwise be left stray) and\n * the indentation is rebased from where the block sat in the delta to where it\n * lands. A construct the strip leaves empty goes too — a line that held only\n * the tag disappears whole, and `x = kind 'y' { #FEAT-1 }` lands as\n * `x = kind 'y'`, not as a pair of empty braces.\n *\n * `omit` cuts named ranges of the delta out on the way over, and it exists for\n * one caller: a NEW service element whose interior belongs to that service's\n * extending model. The children come along in the parent's bytes — they carry no\n * feature tag of their own, because LikeC4 does not inherit tags, so nothing in\n * the addition set can see them — and the map must take the box without them or\n * the model can never declare them (verification 2026-09-04, refutation of E1).\n * The ranges join the tag's removals, so a body they empty collapses the same\n * way `#FEAT-1`-only braces do.\n */\n/** How a declaration is carried over: whose tag to drop, where it lands, and what to leave behind. */\nexport interface Carry {\n  featureId: string;\n  /** The indent of the position the block lands at. */\n  indent: string;\n  /** Delta ranges cut out on the way over — see the banner; `[]` when nothing rides separately. */\n  omit?: readonly SourceRange[];\n}\n\nexport function spliceSource(\n  deltaText: string,\n  decl: { start: number; end: number; indent: string },\n  carry: Carry,\n): string {\n  const { featureId, indent: targetIndent, omit = [] } = carry;\n  const block = deltaText.slice(decl.start, decl.end);\n  const cuts = omit\n    .filter((r) => r.start >= decl.start && r.end <= decl.end)\n    .map((r) => wholeLines(block, r.start - decl.start, r.end - decl.start));\n  return reindent(stripFeatureTag(block, featureId, cuts), decl.indent, targetIndent);\n}\n\n/**\n * Widen a cut to the whole lines it sits on, when it has them to itself.\n *\n * A scanned declaration's span starts at its first character and ends one past\n * its last brace, so cutting it verbatim would leave the leading indent and the\n * trailing newline behind as a blank line — and the emptied-line rule below only\n * fires on a removal a line contains. A cut sharing its line with other code is\n * left exactly as asked.\n */\nfunction wholeLines(block: string, start: number, end: number): [number, number] {\n  const lineStart = block.lastIndexOf(\"\\n\", start - 1) + 1;\n  if (!/^[ \\t]*$/.test(block.slice(lineStart, start))) return [start, end];\n  const nl = block.indexOf(\"\\n\", end);\n  const to = nl === -1 ? block.length : nl;\n  if (!/^[ \\t\\r]*$/.test(block.slice(end, to))) return [start, end];\n  return [lineStart, nl === -1 ? block.length : nl + 1];\n}\n\n/**\n * Rewrite the line endings a merge INSERTED to the ones the document already\n * uses.\n *\n * Splicing composes bytes from two files, and the delta's newlines are not\n * necessarily the living document's: on a repository without `core.autocrlf`\n * normalisation a CRLF landscape or model came back with a handful of bare-LF\n * lines in the spliced region — two conventions in one file, noisy in an editor\n * and in every diff (verification 2026-09-04, W-CRLF). One helper for both\n * merges, because both had it.\n *\n * Only a document with ONE convention is corrected, and then in whichever\n * direction it uses: a file that is already mixed has no convention to match, and\n * guessing one would rewrite lines nobody touched.\n */\nexport function matchLineEndings(document: string, merged: string): string {\n  const crlf = (document.match(/\\r\\n/g) ?? []).length;\n  const bare = (document.match(/(?<!\\r)\\n/g) ?? []).length;\n  if (crlf > 0 && bare === 0) return merged.replace(/(?<!\\r)\\n/g, \"\\r\\n\");\n  if (bare > 0 && crlf === 0) return merged.replace(/\\r\\n/g, \"\\n\");\n  return merged;\n}\n\nfunction stripFeatureTag(block: string, featureId: string, cuts: ReadonlyArray<[number, number]>): string {\n  const { code } = maskSource(block);\n  const esc = featureId.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  const removals: Array<[number, number]> = cuts.map(([s, e]) => [s, e]);\n  for (const m of block.matchAll(new RegExp(`#${esc}(?![\\\\w-])`, \"g\"))) {\n    // Only tags in CODE count — a description quoting \"#FEAT-1\" is content.\n    if (code.slice(m.index, m.index + m[0].length) !== m[0]) continue;\n    let s = m.index;\n    let e = s + m[0].length;\n    // A tag list's separators go with the tag they separate. LikeC4 reads a\n    // list as `#a #b, #c;` — one or more tags first, then `,` groups, then an\n    // optional `;` — so `#FEAT-1, #x` stripped to `, #x` and `#FEAT-1;` to a\n    // bare `;`, and the parse net refused a delta LikeC4 accepts. The comma\n    // after the tag goes with it, else the comma before it; the `;` only when\n    // no tag is left in front of it.\n    const commaAfter = /^[ \\t]*,[ \\t]*/.exec(code.slice(e));\n    const commaBefore = /,[ \\t]*$/.exec(code.slice(0, s));\n    const semi = /^[ \\t]*;/.exec(code.slice(e));\n    if (commaAfter !== null) {\n      removals.push([s, e + commaAfter[0].length]);\n      continue;\n    }\n    if (commaBefore !== null) {\n      removals.push([commaBefore.index, e]);\n      continue;\n    }\n    if (semi !== null && !/#[\\w-]+\\s*$/.test(code.slice(0, s))) e += semi[0].length;\n    // Take the whitespace on ONE side with the token — trailing first, so\n    // `#FEAT-1 #critical` leaves `#critical` at its own indent, and a token at\n    // the end of a line does not leave a trailing space behind.\n    if (block[e] === \" \" || block[e] === \"\\t\") {\n      while (block[e] === \" \" || block[e] === \"\\t\") e += 1;\n    } else {\n      while (s > 0 && (block[s - 1] === \" \" || block[s - 1] === \"\\t\")) s -= 1;\n    }\n    removals.push([s, e]);\n  }\n  if (removals.length === 0) return block;\n\n  // A line the strip emptied disappears whole, newline included.\n  for (let lineStart = 0; lineStart < block.length; ) {\n    const nl = block.indexOf(\"\\n\", lineStart);\n    const lineEnd = nl === -1 ? block.length : nl + 1;\n    if (\n      removals.some(([s, e]) => s >= lineStart && e <= lineEnd) &&\n      /^\\s*$/.test(residual(block, lineStart, nl === -1 ? block.length : nl, removals))\n    ) {\n      removals.push([lineStart, lineEnd]);\n    }\n    lineStart = lineEnd;\n  }\n\n  // A body the strip emptied goes too, braces and all — but only one the strip\n  // emptied: braces that were authored empty are authored bytes and survive.\n  for (let at = code.indexOf(\"{\"); at !== -1; at = code.indexOf(\"{\", at + 1)) {\n    const closeAt = matchBrace(code, at);\n    if (closeAt === -1) continue;\n    if (!removals.some(([s, e]) => s > at && e <= closeAt)) continue;\n    if (!/^\\s*$/.test(residual(block, at + 1, closeAt, removals))) continue;\n    let s = at;\n    while (s > 0 && /\\s/.test(block[s - 1]!)) s -= 1;\n    removals.push([s, closeAt + 1]);\n  }\n  return applyRemovals(block, removals);\n}\n\n/** The text of [from, to) with the removal ranges cut out. */\nfunction residual(text: string, from: number, to: number, removals: Array<[number, number]>): string {\n  let out = \"\";\n  for (let i = from; i < to; i += 1) {\n    if (!removals.some(([s, e]) => i >= s && i < e)) out += text[i];\n  }\n  return out;\n}\n\nfunction applyRemovals(text: string, removals: Array<[number, number]>): string {\n  const sorted = [...removals].sort((a, b) => a[0] - b[0] || b[1] - a[1]);\n  let out = \"\";\n  let i = 0;\n  for (const [s, e] of sorted) {\n    if (s > i) out += text.slice(i, s);\n    if (e > i) i = e;\n  }\n  return out + text.slice(i);\n}\n\n/**\n * Rebase a block's indentation: the `base` its lines carried in the delta\n * becomes `target`. The first line arrives with no leading whitespace (the\n * scanner's span starts at the declaration itself), so it only gains `target`.\n *\n * A CRLF delta's blank line is `\"\\r\"`, not `\"\"`, so splitting on `\\n` alone used\n * to hand a non-empty body to the rule below and every blank line inside a\n * spliced block came out carrying the target indent as trailing whitespace. The\n * carriage return is set aside and put back, which leaves the line's own ending\n * exactly as authored for `matchLineEndings` to reconcile.\n */\nfunction reindent(block: string, base: string, target: string): string {\n  return block\n    .split(\"\\n\")\n    .map((line, k) => {\n      const cr = line.endsWith(\"\\r\");\n      const raw = cr ? line.slice(0, -1) : line;\n      const body = k === 0 ? raw : raw.startsWith(base) ? raw.slice(base.length) : raw;\n      return (body.length === 0 ? \"\" : target + body) + (cr ? \"\\r\" : \"\");\n    })\n    .join(\"\\n\");\n}\n"]}

package/dist/core/c4/splice/contract.js

@@ -7,4 +7,24 @@
  */
 export class LandscapeSpliceError extends Error {
 }
+/**
+ * Refuse a splice the splice map cannot see once it has landed — the document
+ * scanned the same number of statements after the insert as before it.
+ *
+ * Every insert adds at least one declaration or edge, so an unchanged count
+ * means the bytes went somewhere the scan reads as nothing: inside a comment or
+ * a string. LikeC4 reads it the same way, so the parse net passes a document
+ * that simply lacks the addition, and the archive printed "+1 relationship(s)"
+ * over an edge that was never there (review, 2026-10-22, on a block comment
+ * whose last line starts with `//`). Placement is meant never to do this; this
+ * is what turns a placement bug into `merge-failed` instead of silent loss.
+ */
+export function assertSpliceVisible(before, after, what) {
+    const count = (s) => (s === null ? 0 : s.elements.length + s.rels.length);
+    if (count(after) > count(before))
+        return;
+    throw new LandscapeSpliceError(`placing '${what}' would land it where neither the splice map nor LikeC4 reads it — inside a comment or a string — ` +
+        `so the merge would lose it while reporting it merged; nothing was written. Move the comment it would land in, ` +
+        `then re-run, and report the shape`);
+}
 //# sourceMappingURL=contract.js.map

package/dist/core/c4/splice/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../../src/core/c4/splice/contract.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG","sourcesContent":["import type { Elem, Rel } from \"../likec4.js\";\n\n/**\n * A landscape merge the splicer could not compute. Every one is mechanical —\n * the input cannot be spliced as authored, never a judgment `--approve` may\n * override — and it is thrown at plan time, so nothing has been written.\n * `archiveErrorCode` (commands/archive/archive.ts) owns the mapping to `merge-failed`;\n * the splicer itself never names a CLI code.\n */\nexport class LandscapeSpliceError extends Error {}\n\nexport interface LandscapePlan {\n  /** The merged landscape source, or null when everything was already there. */\n  content: string | null;\n  addedEls: Elem[];\n  addedRels: Rel[];\n}\n\n/**\n * Everything the landscape splicer reads, as text and parsed views already in\n * hand. The merge is a pure text-to-text computation — reading the two files\n * (and deciding to write the result) stays with the caller, which is also what\n * keeps the splicer free of the staging layer.\n */\nexport interface LandscapeMergeRequest {\n  /** The living landscape.likec4, decoded by the caller's readUtf8. */\n  landscapeText: string;\n  /** delta.likec4 as authored — the bytes the additions are spliced from. */\n  deltaText: string;\n  /** EVERY element the delta declares — the title join and the parent lookup read past the tagged ones. */\n  deltaElements: Elem[];\n  /** The delta's elements tagged with the feature: the candidate additions. */\n  newEls: Elem[];\n  /** The delta's relationships tagged with the feature. */\n  newRels: Rel[];\n  featureId: string;\n}\n"]}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../../src/core/c4/splice/contract.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA2B,EAAE,KAA0B,EAAE,IAAY;IACvG,MAAM,KAAK,GAAG,CAAC,CAAsB,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO;IACzC,MAAM,IAAI,oBAAoB,CAC5B,YAAY,IAAI,oGAAoG;QAClH,gHAAgH;QAChH,mCAAmC,CACtC,CAAC;AACJ,CAAC","sourcesContent":["import type { Elem, Rel } from \"../likec4.js\";\nimport type { ScanKinds, ScannedModel } from \"../source-scan.js\";\n\n/**\n * A landscape merge the splicer could not compute. Every one is mechanical —\n * the input cannot be spliced as authored, never a judgment `--approve` may\n * override — and it is thrown at plan time, so nothing has been written.\n * `archiveErrorCode` (commands/archive/archive.ts) owns the mapping to `merge-failed`;\n * the splicer itself never names a CLI code.\n */\nexport class LandscapeSpliceError extends Error {}\n\n/**\n * Refuse a splice the splice map cannot see once it has landed — the document\n * scanned the same number of statements after the insert as before it.\n *\n * Every insert adds at least one declaration or edge, so an unchanged count\n * means the bytes went somewhere the scan reads as nothing: inside a comment or\n * a string. LikeC4 reads it the same way, so the parse net passes a document\n * that simply lacks the addition, and the archive printed \"+1 relationship(s)\"\n * over an edge that was never there (review, 2026-10-22, on a block comment\n * whose last line starts with `//`). Placement is meant never to do this; this\n * is what turns a placement bug into `merge-failed` instead of silent loss.\n */\nexport function assertSpliceVisible(before: ScannedModel | null, after: ScannedModel | null, what: string): void {\n  const count = (s: ScannedModel | null): number => (s === null ? 0 : s.elements.length + s.rels.length);\n  if (count(after) > count(before)) return;\n  throw new LandscapeSpliceError(\n    `placing '${what}' would land it where neither the splice map nor LikeC4 reads it — inside a comment or a string — ` +\n      `so the merge would lose it while reporting it merged; nothing was written. Move the comment it would land in, ` +\n      `then re-run, and report the shape`,\n  );\n}\n\n/**\n * A service whose `model.likec4` EXTENDS the fleet map — the document that owns\n * that service's interior, and therefore the one a nested addition belongs in.\n *\n * The merge takes these as TEXT already in hand, exactly as it takes the\n * landscape: reading the fleet and writing the result stay with the caller.\n * A service with a standalone model, or none, is simply absent from the list,\n * and the merge then behaves as it did before the extending shape existed.\n */\nexport interface ExtendingModel {\n  /** The `services/<…>/<svc>` directory name — what an element's binding resolves to. */\n  service: string;\n  /** Repo-relative and `/`-separated: what a message names and where the caller writes. */\n  path: string;\n  /** The living model source, as authored. */\n  text: string;\n}\n\n/** What one extending model owes this feature — routed, not yet spliced. */\nexport interface ModelAdditions {\n  model: ExtendingModel;\n  els: Elem[];\n  rels: Rel[];\n  /**\n   * The kinds the model borrows from the map it extends, read off the landscape\n   * this merge spliced: a model declares none of its own, and its scan cannot\n   * see a `kind name` declaration or an `a .kind b` edge without them.\n   */\n  borrowed: ScanKinds;\n}\n\n/**\n * The tags each relationship kind of the DELTA gives every edge of that kind —\n * its `specification.relationshipKindTags`. The parsed additions carry them and\n * the delta's statements do not, so the splice needs the table to match one to\n * the other (`./identity/edges.ts`, `scannedStatementKey`).\n */\nexport type KindTags = Readonly<Record<string, readonly string[]>>;\n\nexport interface LandscapePlan {\n  /** The merged landscape source, or null when everything was already there. */\n  content: string | null;\n  addedEls: Elem[];\n  addedRels: Rel[];\n  /**\n   * The additions this merge routed AWAY from the map, per model that owns\n   * them. Empty when the request named no extending models — the shape every\n   * caller had before the routing existed. `./model/merge.ts` turns each entry\n   * into that model's merged text.\n   */\n  models: ModelAdditions[];\n}\n\n/**\n * Everything the landscape splicer reads, as text and parsed views already in\n * hand. The merge is a pure text-to-text computation — reading the two files\n * (and deciding to write the result) stays with the caller, which is also what\n * keeps the splicer free of the staging layer.\n */\nexport interface LandscapeMergeRequest {\n  /** The living landscape.likec4, decoded by the caller's readUtf8. */\n  landscapeText: string;\n  /** delta.likec4 as authored — the bytes the additions are spliced from. */\n  deltaText: string;\n  /** EVERY element the delta declares — the title join and the parent lookup read past the tagged ones. */\n  deltaElements: Elem[];\n  /** The delta's elements tagged with the feature: the candidate additions. */\n  newEls: Elem[];\n  /** The delta's relationships tagged with the feature. */\n  newRels: Rel[];\n  featureId: string;\n  /** The delta's relationship kinds' tags. Omitted reads as a delta whose kinds carry none. */\n  deltaKindTags?: KindTags;\n  /**\n   * The fleet's extending models. Omitted (or empty) is the pre-extending\n   * behaviour byte for byte: every addition lands on the map.\n   */\n  models?: readonly ExtendingModel[];\n}\n"]}

package/dist/core/c4/splice/delta-blocks.js

@@ -57,7 +57,7 @@
  * (`core/usecases/delta/flows.ts`), and it is a views-only document — which is
  * exactly why it stages beside the map when this one cannot.
  */
-import { maskSource, matchBrace } from "../source-mask.js";
+import { maskSource, topLevelBlocks } from "../source-mask.js";
 import { LandscapeSpliceError } from "./contract.js";
 /**
  * Top-level blocks a delta can declare. `specification` and `model` are absent
@@ -74,6 +74,10 @@ function refuse(block, detail, home) {
 }
 /** Where the living documents keep what this delta cannot carry. */
 const LANDSCAPE_HOME = "architecture/landscape.likec4, where the living documents keep it,";
+/** Where a FEATURE keeps TOPOLOGY — the third whole-file slot, added with the deployment axis. */
+const DEPLOYMENT_HOME = "features/<FEAT>/deployment/<name>.likec4 — a document of its own, which `loam archive` copies into " +
+    "architecture/ and `loam unarchive` takes back; say `extend` in it to add to a region the living map " +
+    "already declares —";
 /** Where a FEATURE keeps a flow — a slot of its own, not the living tree. See the header. */
 const FLOW_HOME = "features/<FEAT>/usecases/<name>.likec4 — a views-only document of its own, which `loam archive` copies into " +
     "architecture/usecases/ and `loam unarchive` takes back —";
@@ -85,30 +89,26 @@ const FLOW_HOME = "features/<FEAT>/usecases/<name>.likec4 — a views-only docum
  * `scanModel` splices under, and for the same reason: this refuses an archive,
  * and a refusal a comment can provoke is worse than the silence it replaced.
  *
- * Brace depth is tracked in one forward pass rather than recounted per match:
- * only a block at depth 0 is a top-level declaration, and `deployment` at depth
- * 1 is an ordinary `specification { deploymentNode … }` or a view predicate.
+ * Only a block at depth 0 is a top-level declaration (`topLevelBlocks`), and
+ * `deployment` at depth 1 is an ordinary `specification { deploymentNode … }`
+ * or a view predicate.
  */
 export function assertMergeableDelta(deltaText) {
     const { code } = maskSource(deltaText);
-    let depth = 0;
-    let cursor = 0;
-    for (const m of code.matchAll(TOP_LEVEL_BLOCK)) {
-        for (; cursor < m.index; cursor += 1) {
-            if (code[cursor] === "{")
-                depth += 1;
-            else if (code[cursor] === "}")
-                depth -= 1;
-        }
-        if (depth !== 0)
-            continue;
+    for (const { match: m, body: inner } of topLevelBlocks(code, TOP_LEVEL_BLOCK)) {
         const block = m[1];
         if (block !== "views") {
-            refuse(`\`${block} { }\` block`, `a top-level \`${block} { }\` block`, LANDSCAPE_HOME);
+            refuse(`\`${block} { }\` block`, `a top-level \`${block} { }\` block`, 
+            // The refusal is unchanged and always will be — this document
+            // re-declares the landscape's identifiers and carries its own
+            // `specification`, so it cannot be staged beside the map in one project.
+            // What changed is where it sends the author: a feature introducing
+            // topology WITH the change that makes it true now has a slot of its
+            // own, and pointing at the living landscape was the advice that made
+            // the axis's headline case a two-pull-request job. `global { }` has no
+            // such slot and keeps the living home.
+            block === "deployment" ? DEPLOYMENT_HOME : LANDSCAPE_HOME);
         }
-        const open = m.index + m[0].length - 1;
-        const close = matchBrace(code, open);
-        const inner = code.slice(open + 1, close === -1 ? code.length : close);
         const authored = AUTHORED_VIEW.exec(inner);
         if (authored !== null) {
             const kind = authored[1];
@@ -119,7 +119,7 @@ export function assertMergeableDelta(deltaText) {
             // an author to the living landscape for one they are introducing WITH
             // this change was the advice that made the axis's headline case a
             // two-pull-request job.
-            kind === "dynamic" ? FLOW_HOME : LANDSCAPE_HOME);
+            kind === "dynamic" ? FLOW_HOME : DEPLOYMENT_HOME);
         }
     }
 }

package/dist/core/c4/splice/delta-blocks.js.map

@@ -1 +1 @@
-{"version":3,"file":"delta-blocks.js","sourceRoot":"","sources":["../../../../src/core/c4/splice/delta-blocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,2FAA2F;AAC3F,MAAM,aAAa,GAAG,iCAAiC,CAAC;AAExD,SAAS,MAAM,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY;IACzD,MAAM,IAAI,oBAAoB,CAC5B,yBAAyB,MAAM,wEAAwE;QACrG,sEAAsE,KAAK,QAAQ;QACnF,GAAG,IAAI,0BAA0B,CACpC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,cAAc,GAAG,oEAAoE,CAAC;AAE5F,6FAA6F;AAC7F,MAAM,SAAS,GACb,8GAA8G;IAC9G,0DAA0D,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;iBAChC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,KAAK,CAAC;YAAE,SAAS;QAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,KAAK,cAAc,EAAE,iBAAiB,KAAK,cAAc,EAAE,cAAc,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC1B,MAAM,CACJ,KAAK,IAAI,SAAS,EAClB,OAAO,IAAI,0FAA0F;gBACnG,sFAAsF;YACxF,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,kEAAkE;YAClE,wBAAwB;YACxB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * What a delta may declare that the landscape merge cannot carry.\n *\n * `planLandscapeMerge` splices out of the delta's `model { }` block and nothing\n * else. That is correct — the living landscape is a model plus the views its own\n * authors chose — but it used to be SILENT: a delta declaring `deployment { }`\n * or a `dynamic view` archived at exit 0, reported `+N element(s), +M\n * relationship(s)` exactly as usual, and the block was simply gone. The merge's\n * own parse net cannot catch it either, because a landscape missing a deployment\n * model is perfectly legal — there is nothing to fail on. Nobody finds out until\n * somebody goes looking for a diagram that was archived months ago.\n *\n * So the loss is made a refusal, which is the same doctrine as the merge's other\n * mechanical refusals (an unlocatable declaration, two statements on one line):\n * the input cannot be spliced as authored, `--approve` deliberately does not\n * override it — that flag overrides loam's JUDGMENT about coherence, never its\n * ability to carry an axis — and nothing is written.\n *\n * ## Why views are graded and not simply banned\n *\n * `loam new` scaffolds a `views { view <feat> { include * } }` block into every\n * delta.likec4 (commands/new/templates.ts), so refusing the block outright would\n * refuse loam's own scaffold on its first archive. It is there to be RENDERED\n * while the feature is in flight, and it is meant not to travel.\n *\n * The line drawn here is recoverability, and it is the only line that survives\n * the scaffold:\n *\n *  - A static `view` is a rendering OF the model. Once the merge lands, the\n *    whole model is in landscape.likec4, so the author can restate the view\n *    there at any time from information that still exists. Dropping it loses a\n *    convenience.\n *  - A `dynamic view`'s ordered steps, and a `deployment { }` block's topology,\n *    exist in NO other document the fleet keeps. When the merge drops those,\n *    the information is gone. That is what gets refused. Rule 26 sharpens the\n *    stakes rather than the rule: a `dynamic view`'s steps are now something\n *    loam READS, so dropping one silently would discard checked content, not\n *    merely a convenience.\n *\n * A residual is accepted knowingly: a delta carrying a SECOND static view still\n * loses it without a word. Refusing that would mean telling an author with two\n * preview views to delete one, which is a false refusal on a harmless file, and\n * the loss there is recoverable by the argument above.\n *\n * ## The dynamic-view refusal is unchanged; its ADVICE moved\n *\n * A `dynamic view` still cannot ride inside `delta.likec4`, and the reason is\n * mechanical rather than a policy about where flows belong: this document\n * re-declares the landscape's own identifiers to anchor its new edges and\n * carries its own `specification` block because LikeC4 parses it standalone, so\n * it cannot be staged beside the map in one project — a duplicate specification\n * is an error blamed on both files, and a re-declared element is a duplicate id.\n * What changed is where the refusal sends the author. It used to say\n * `architecture/landscape.likec4`, which was the only honest answer while the\n * axis had no feature-delta path: a flow could not ship with the change that\n * made it true. `features/<FEAT>/usecases/<name>.likec4` is that path\n * (`core/usecases/delta/flows.ts`), and it is a views-only document — which is\n * exactly why it stages beside the map when this one cannot.\n */\nimport { maskSource, matchBrace } from \"../source-mask.js\";\nimport { LandscapeSpliceError } from \"./contract.js\";\n\n/**\n * Top-level blocks a delta can declare. `specification` and `model` are absent\n * on purpose: the specification is re-declared in every delta because LikeC4\n * parses each one standalone, and the model is the thing being spliced.\n */\nconst TOP_LEVEL_BLOCK = /\\b(deployment|global|views)\\s*\\{/g;\n\n/** A `dynamic view` / `deployment view` inside a views block — the irrecoverable kinds. */\nconst AUTHORED_VIEW = /\\b(dynamic|deployment)\\s+view\\b/;\n\nfunction refuse(block: string, detail: string, home: string): never {\n  throw new LandscapeSpliceError(\n    `delta.likec4 declares ${detail}, and the landscape merge splices only what is inside \\`model { }\\` — ` +\n      `archiving would drop it silently, so nothing was written. Move the ${block} into ` +\n      `${home} and re-run the archive.`,\n  );\n}\n\n/** Where the living documents keep what this delta cannot carry. */\nconst LANDSCAPE_HOME = \"architecture/landscape.likec4, where the living documents keep it,\";\n\n/** Where a FEATURE keeps a flow — a slot of its own, not the living tree. See the header. */\nconst FLOW_HOME =\n  \"features/<FEAT>/usecases/<name>.likec4 — a views-only document of its own, which `loam archive` copies into \" +\n  \"architecture/usecases/ and `loam unarchive` takes back —\";\n\n/**\n * Refuse a delta whose non-model blocks the merge would discard.\n *\n * Runs over MASKED source, so a `deployment {` written inside a comment or a\n * description string cannot trigger it — the same masking discipline\n * `scanModel` splices under, and for the same reason: this refuses an archive,\n * and a refusal a comment can provoke is worse than the silence it replaced.\n *\n * Brace depth is tracked in one forward pass rather than recounted per match:\n * only a block at depth 0 is a top-level declaration, and `deployment` at depth\n * 1 is an ordinary `specification { deploymentNode … }` or a view predicate.\n */\nexport function assertMergeableDelta(deltaText: string): void {\n  const { code } = maskSource(deltaText);\n  let depth = 0;\n  let cursor = 0;\n  for (const m of code.matchAll(TOP_LEVEL_BLOCK)) {\n    for (; cursor < m.index; cursor += 1) {\n      if (code[cursor] === \"{\") depth += 1;\n      else if (code[cursor] === \"}\") depth -= 1;\n    }\n    if (depth !== 0) continue;\n    const block = m[1]!;\n    if (block !== \"views\") {\n      refuse(`\\`${block} { }\\` block`, `a top-level \\`${block} { }\\` block`, LANDSCAPE_HOME);\n    }\n    const open = m.index + m[0].length - 1;\n    const close = matchBrace(code, open);\n    const inner = code.slice(open + 1, close === -1 ? code.length : close);\n    const authored = AUTHORED_VIEW.exec(inner);\n    if (authored !== null) {\n      const kind = authored[1]!;\n      refuse(\n        `\\`${kind} view\\``,\n        `a \\`${kind} view\\` in its \\`views { }\\` block — a view of that kind describes ordering or topology ` +\n          `recorded in no other document, unlike the static preview view \\`loam new\\` scaffolds`,\n        // A deployment view is topology and belongs in the living map; a dynamic\n        // view is a flow, and a flow now has a feature slot of its own. Sending\n        // an author to the living landscape for one they are introducing WITH\n        // this change was the advice that made the axis's headline case a\n        // two-pull-request job.\n        kind === \"dynamic\" ? FLOW_HOME : LANDSCAPE_HOME,\n      );\n    }\n  }\n}\n"]}
+{"version":3,"file":"delta-blocks.js","sourceRoot":"","sources":["../../../../src/core/c4/splice/delta-blocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,2FAA2F;AAC3F,MAAM,aAAa,GAAG,iCAAiC,CAAC;AAExD,SAAS,MAAM,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY;IACzD,MAAM,IAAI,oBAAoB,CAC5B,yBAAyB,MAAM,wEAAwE;QACrG,sEAAsE,KAAK,QAAQ;QACnF,GAAG,IAAI,0BAA0B,CACpC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,cAAc,GAAG,oEAAoE,CAAC;AAE5F,kGAAkG;AAClG,MAAM,eAAe,GACnB,qGAAqG;IACrG,sGAAsG;IACtG,oBAAoB,CAAC;AAEvB,6FAA6F;AAC7F,MAAM,SAAS,GACb,8GAA8G;IAC9G,0DAA0D,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACvC,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,CACJ,KAAK,KAAK,cAAc,EACxB,iBAAiB,KAAK,cAAc;YACpC,8DAA8D;YAC9D,8DAA8D;YAC9D,yEAAyE;YACzE,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,uEAAuE;YACvE,uCAAuC;YACvC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC1B,MAAM,CACJ,KAAK,IAAI,SAAS,EAClB,OAAO,IAAI,0FAA0F;gBACnG,sFAAsF;YACxF,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,kEAAkE;YAClE,wBAAwB;YACxB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * What a delta may declare that the landscape merge cannot carry.\n *\n * `planLandscapeMerge` splices out of the delta's `model { }` block and nothing\n * else. That is correct — the living landscape is a model plus the views its own\n * authors chose — but it used to be SILENT: a delta declaring `deployment { }`\n * or a `dynamic view` archived at exit 0, reported `+N element(s), +M\n * relationship(s)` exactly as usual, and the block was simply gone. The merge's\n * own parse net cannot catch it either, because a landscape missing a deployment\n * model is perfectly legal — there is nothing to fail on. Nobody finds out until\n * somebody goes looking for a diagram that was archived months ago.\n *\n * So the loss is made a refusal, which is the same doctrine as the merge's other\n * mechanical refusals (an unlocatable declaration, two statements on one line):\n * the input cannot be spliced as authored, `--approve` deliberately does not\n * override it — that flag overrides loam's JUDGMENT about coherence, never its\n * ability to carry an axis — and nothing is written.\n *\n * ## Why views are graded and not simply banned\n *\n * `loam new` scaffolds a `views { view <feat> { include * } }` block into every\n * delta.likec4 (commands/new/templates.ts), so refusing the block outright would\n * refuse loam's own scaffold on its first archive. It is there to be RENDERED\n * while the feature is in flight, and it is meant not to travel.\n *\n * The line drawn here is recoverability, and it is the only line that survives\n * the scaffold:\n *\n *  - A static `view` is a rendering OF the model. Once the merge lands, the\n *    whole model is in landscape.likec4, so the author can restate the view\n *    there at any time from information that still exists. Dropping it loses a\n *    convenience.\n *  - A `dynamic view`'s ordered steps, and a `deployment { }` block's topology,\n *    exist in NO other document the fleet keeps. When the merge drops those,\n *    the information is gone. That is what gets refused. Rule 26 sharpens the\n *    stakes rather than the rule: a `dynamic view`'s steps are now something\n *    loam READS, so dropping one silently would discard checked content, not\n *    merely a convenience.\n *\n * A residual is accepted knowingly: a delta carrying a SECOND static view still\n * loses it without a word. Refusing that would mean telling an author with two\n * preview views to delete one, which is a false refusal on a harmless file, and\n * the loss there is recoverable by the argument above.\n *\n * ## The dynamic-view refusal is unchanged; its ADVICE moved\n *\n * A `dynamic view` still cannot ride inside `delta.likec4`, and the reason is\n * mechanical rather than a policy about where flows belong: this document\n * re-declares the landscape's own identifiers to anchor its new edges and\n * carries its own `specification` block because LikeC4 parses it standalone, so\n * it cannot be staged beside the map in one project — a duplicate specification\n * is an error blamed on both files, and a re-declared element is a duplicate id.\n * What changed is where the refusal sends the author. It used to say\n * `architecture/landscape.likec4`, which was the only honest answer while the\n * axis had no feature-delta path: a flow could not ship with the change that\n * made it true. `features/<FEAT>/usecases/<name>.likec4` is that path\n * (`core/usecases/delta/flows.ts`), and it is a views-only document — which is\n * exactly why it stages beside the map when this one cannot.\n */\nimport { maskSource, topLevelBlocks } from \"../source-mask.js\";\nimport { LandscapeSpliceError } from \"./contract.js\";\n\n/**\n * Top-level blocks a delta can declare. `specification` and `model` are absent\n * on purpose: the specification is re-declared in every delta because LikeC4\n * parses each one standalone, and the model is the thing being spliced.\n */\nconst TOP_LEVEL_BLOCK = /\\b(deployment|global|views)\\s*\\{/g;\n\n/** A `dynamic view` / `deployment view` inside a views block — the irrecoverable kinds. */\nconst AUTHORED_VIEW = /\\b(dynamic|deployment)\\s+view\\b/;\n\nfunction refuse(block: string, detail: string, home: string): never {\n  throw new LandscapeSpliceError(\n    `delta.likec4 declares ${detail}, and the landscape merge splices only what is inside \\`model { }\\` — ` +\n      `archiving would drop it silently, so nothing was written. Move the ${block} into ` +\n      `${home} and re-run the archive.`,\n  );\n}\n\n/** Where the living documents keep what this delta cannot carry. */\nconst LANDSCAPE_HOME = \"architecture/landscape.likec4, where the living documents keep it,\";\n\n/** Where a FEATURE keeps TOPOLOGY — the third whole-file slot, added with the deployment axis. */\nconst DEPLOYMENT_HOME =\n  \"features/<FEAT>/deployment/<name>.likec4 — a document of its own, which `loam archive` copies into \" +\n  \"architecture/ and `loam unarchive` takes back; say `extend` in it to add to a region the living map \" +\n  \"already declares —\";\n\n/** Where a FEATURE keeps a flow — a slot of its own, not the living tree. See the header. */\nconst FLOW_HOME =\n  \"features/<FEAT>/usecases/<name>.likec4 — a views-only document of its own, which `loam archive` copies into \" +\n  \"architecture/usecases/ and `loam unarchive` takes back —\";\n\n/**\n * Refuse a delta whose non-model blocks the merge would discard.\n *\n * Runs over MASKED source, so a `deployment {` written inside a comment or a\n * description string cannot trigger it — the same masking discipline\n * `scanModel` splices under, and for the same reason: this refuses an archive,\n * and a refusal a comment can provoke is worse than the silence it replaced.\n *\n * Only a block at depth 0 is a top-level declaration (`topLevelBlocks`), and\n * `deployment` at depth 1 is an ordinary `specification { deploymentNode … }`\n * or a view predicate.\n */\nexport function assertMergeableDelta(deltaText: string): void {\n  const { code } = maskSource(deltaText);\n  for (const { match: m, body: inner } of topLevelBlocks(code, TOP_LEVEL_BLOCK)) {\n    const block = m[1]!;\n    if (block !== \"views\") {\n      refuse(\n        `\\`${block} { }\\` block`,\n        `a top-level \\`${block} { }\\` block`,\n        // The refusal is unchanged and always will be — this document\n        // re-declares the landscape's identifiers and carries its own\n        // `specification`, so it cannot be staged beside the map in one project.\n        // What changed is where it sends the author: a feature introducing\n        // topology WITH the change that makes it true now has a slot of its\n        // own, and pointing at the living landscape was the advice that made\n        // the axis's headline case a two-pull-request job. `global { }` has no\n        // such slot and keeps the living home.\n        block === \"deployment\" ? DEPLOYMENT_HOME : LANDSCAPE_HOME,\n      );\n    }\n    const authored = AUTHORED_VIEW.exec(inner);\n    if (authored !== null) {\n      const kind = authored[1]!;\n      refuse(\n        `\\`${kind} view\\``,\n        `a \\`${kind} view\\` in its \\`views { }\\` block — a view of that kind describes ordering or topology ` +\n          `recorded in no other document, unlike the static preview view \\`loam new\\` scaffolds`,\n        // A deployment view is topology and belongs in the living map; a dynamic\n        // view is a flow, and a flow now has a feature slot of its own. Sending\n        // an author to the living landscape for one they are introducing WITH\n        // this change was the advice that made the axis's headline case a\n        // two-pull-request job.\n        kind === \"dynamic\" ? FLOW_HOME : DEPLOYMENT_HOME,\n      );\n    }\n  }\n}\n"]}

package/dist/core/c4/splice/identity/declared.js

@@ -0,0 +1,87 @@
+/**
+ * What the fleet's extending models ALREADY declare — the half of the archive's
+ * existence check that does not live on the map.
+ *
+ * The check has two joins: by id, and by TITLE for a delta that spells an
+ * element under its own identifier rather than the map's. Only the id half ever
+ * learned about the models the merge now writes into, so a container a service
+ * already draws under a different id was spliced in beside itself and the
+ * service silently grew two boxes with one name — while the SAME delta against
+ * the same title ON THE MAP adds nothing (review of E1). One rule, two
+ * documents, two answers.
+ *
+ * THE MODEL HALF IS SCOPED TO ITS SERVICE, and the map's is deliberately not.
+ * The map's global title index is the id-less fallback for documents written
+ * before `metadata { service }` existed, and it carries a hazard its own
+ * comment states: two services' boxes sharing a title join to each other unless
+ * both sides are bound. A service's interior is exactly where that would bite —
+ * every extending model in a fleet names a container 'api' — so a model's
+ * declaration joins by title only against an addition resolving to the SAME
+ * explicitly bound service. Either side unbound means no title join at all: an
+ * addition landing beside a namesake is a duplicate the author can see, and a
+ * wrongly skipped one is a container that quietly never arrived.
+ *
+ * The reader is the SCAN and not a parse, for the reason the caller states: ids
+ * are exact inside the fqn namespace the map and its models share, and parsing
+ * every model here would cost one LikeC4 workspace per service to answer a
+ * question about text. Two kinds of declaration therefore carry no title, and
+ * neither loses anything: one whose head names no title (LikeC4 titles it after
+ * its own name, and a model's default and a delta's differ exactly when their
+ * ids do — which the id join already covers) and one writing its title as a
+ * body property.
+ */
+import { ancestorIds } from "../../../kernel/ids/fqn/ancestors.js";
+/**
+ * Index the scanned models.
+ *
+ * `bindEls` is the corpus the service binding resolves against — the living
+ * map's elements plus the delta's, the same one routing uses, because a model's
+ * declaration is bound by an ancestor the MAP owns and a delta's addition by an
+ * ancestor either document may.
+ */
+export function modelDeclarations(scans, bindEls) {
+    const bound = new Map();
+    for (const e of bindEls)
+        if (e.service !== undefined)
+            bound.set(e.id, e.service);
+    // An EXPLICIT binding on the id or an ancestor, and nothing else.
+    // `serviceResolver`'s last rung answers with the element's own title or its
+    // raw id — the rung its own comment calls the one that lies — and here that
+    // would file two unbound services' containers under invented names and then
+    // let those names join.
+    const serviceOf = (id) => {
+        for (const candidate of ancestorIds(id)) {
+            const service = bound.get(candidate);
+            if (service !== undefined)
+                return service;
+        }
+        return undefined;
+    };
+    const ids = [];
+    const titles = new Set();
+    for (const { scan } of scans) {
+        for (const e of scan?.elements ?? []) {
+            // An `extend` frame declares nothing: it reopens an element the map owns.
+            if (e.extend === true)
+                continue;
+            ids.push(e.id);
+            if (e.title === undefined)
+                continue;
+            const service = serviceOf(e.id);
+            if (service !== undefined)
+                titles.add(titleKey(service, e.title));
+        }
+    }
+    return {
+        ids,
+        declaresTitle: (id, title) => {
+            const service = serviceOf(id);
+            return service !== undefined && titles.has(titleKey(service, title));
+        },
+    };
+}
+/** Length-prefixed: a service id and a title cannot spell another pair's key. */
+function titleKey(service, title) {
+    return `${service.length}:${service}${title}`;
+}
+//# sourceMappingURL=declared.js.map

package/dist/core/c4/splice/identity/declared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/declared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAenE;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAmD,EACnD,OAAwB;IAExB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACjF,kEAAkE;IAClE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,wBAAwB;IACxB,MAAM,SAAS,GAAG,CAAC,EAAU,EAA+B,EAAE;QAC5D,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,0EAA0E;YAC1E,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;gBAAE,SAAS;YAChC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG;QACH,aAAa,EAAE,CAAC,EAAE,EAAE,KAAK,EAAW,EAAE;YACpC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,OAAwB,EAAE,KAAa;IACvD,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;AAChD,CAAC","sourcesContent":["/**\n * What the fleet's extending models ALREADY declare — the half of the archive's\n * existence check that does not live on the map.\n *\n * The check has two joins: by id, and by TITLE for a delta that spells an\n * element under its own identifier rather than the map's. Only the id half ever\n * learned about the models the merge now writes into, so a container a service\n * already draws under a different id was spliced in beside itself and the\n * service silently grew two boxes with one name — while the SAME delta against\n * the same title ON THE MAP adds nothing (review of E1). One rule, two\n * documents, two answers.\n *\n * THE MODEL HALF IS SCOPED TO ITS SERVICE, and the map's is deliberately not.\n * The map's global title index is the id-less fallback for documents written\n * before `metadata { service }` existed, and it carries a hazard its own\n * comment states: two services' boxes sharing a title join to each other unless\n * both sides are bound. A service's interior is exactly where that would bite —\n * every extending model in a fleet names a container 'api' — so a model's\n * declaration joins by title only against an addition resolving to the SAME\n * explicitly bound service. Either side unbound means no title join at all: an\n * addition landing beside a namesake is a duplicate the author can see, and a\n * wrongly skipped one is a container that quietly never arrived.\n *\n * The reader is the SCAN and not a parse, for the reason the caller states: ids\n * are exact inside the fqn namespace the map and its models share, and parsing\n * every model here would cost one LikeC4 workspace per service to answer a\n * question about text. Two kinds of declaration therefore carry no title, and\n * neither loses anything: one whose head names no title (LikeC4 titles it after\n * its own name, and a model's default and a delta's differ exactly when their\n * ids do — which the id join already covers) and one writing its title as a\n * body property.\n */\nimport { ancestorIds } from \"../../../kernel/ids/fqn/ancestors.js\";\nimport type { DeclaredService } from \"../../../kernel/ids/service.js\";\nimport type { Elem } from \"../../likec4.js\";\nimport type { ScannedModel } from \"../../source-scan.js\";\n\nexport interface ModelDeclarations {\n  /** Every id an extending model declares — the id join's share, and exact. */\n  ids: string[];\n  /**\n   * True when some model already declares an element titled `title` inside the\n   * service `id` resolves to. False whenever either side is unbound.\n   */\n  declaresTitle: (id: string, title: string) => boolean;\n}\n\n/**\n * Index the scanned models.\n *\n * `bindEls` is the corpus the service binding resolves against — the living\n * map's elements plus the delta's, the same one routing uses, because a model's\n * declaration is bound by an ancestor the MAP owns and a delta's addition by an\n * ancestor either document may.\n */\nexport function modelDeclarations(\n  scans: ReadonlyArray<{ scan: ScannedModel | null }>,\n  bindEls: readonly Elem[],\n): ModelDeclarations {\n  const bound = new Map<string, DeclaredService>();\n  for (const e of bindEls) if (e.service !== undefined) bound.set(e.id, e.service);\n  // An EXPLICIT binding on the id or an ancestor, and nothing else.\n  // `serviceResolver`'s last rung answers with the element's own title or its\n  // raw id — the rung its own comment calls the one that lies — and here that\n  // would file two unbound services' containers under invented names and then\n  // let those names join.\n  const serviceOf = (id: string): DeclaredService | undefined => {\n    for (const candidate of ancestorIds(id)) {\n      const service = bound.get(candidate);\n      if (service !== undefined) return service;\n    }\n    return undefined;\n  };\n  const ids: string[] = [];\n  const titles = new Set<string>();\n  for (const { scan } of scans) {\n    for (const e of scan?.elements ?? []) {\n      // An `extend` frame declares nothing: it reopens an element the map owns.\n      if (e.extend === true) continue;\n      ids.push(e.id);\n      if (e.title === undefined) continue;\n      const service = serviceOf(e.id);\n      if (service !== undefined) titles.add(titleKey(service, e.title));\n    }\n  }\n  return {\n    ids,\n    declaresTitle: (id, title): boolean => {\n      const service = serviceOf(id);\n      return service !== undefined && titles.has(titleKey(service, title));\n    },\n  };\n}\n\n/** Length-prefixed: a service id and a title cannot spell another pair's key. */\nfunction titleKey(service: DeclaredService, title: string): string {\n  return `${service.length}:${service}${title}`;\n}\n"]}

package/dist/core/c4/splice/identity/edges.js

@@ -1,3 +1,40 @@
+/**
+ * Which AUTHORED STATEMENT a parsed addition was written as — the key that
+ * matches a `Rel` back to its bytes in delta.likec4, so the splice carries the
+ * declaration verbatim instead of re-serializing it.
+ *
+ * Stricter than `relKey` below on purpose, and asking a different question:
+ * `relKey` decides whether the living document already HAS this edge, across
+ * two id namespaces, so it joins on titles; this one runs inside ONE document
+ * where ids are exact, and it must tell apart two statements the merge would
+ * otherwise hand each other's bytes. Both endpoints, the title, all three spine
+ * keys and the tags, because a pool entry shared by two additions gives the
+ * second one the first one's authored source.
+ *
+ * The tags are a SET, and a parsed `Rel`'s are not the ones written in the
+ * statement: since LikeC4 1.59.0 a relationship kind can carry tags
+ * (`relationship publishes { #async }`), and the parse hands every edge of the
+ * kind its kind's tags, deduplicated against the statement's own (measured at
+ * the 1.59.2 pin). A scanned statement carries only what is written in it, so
+ * `scannedStatementKey` adds its kind's tags before keying — keyed as written,
+ * every edge of a tagged kind found no statement, and archive refused a delta
+ * `validate --feature` and `status` had called ready (`merge-failed`, or
+ * `usecase.flow-invalid` when the feature had flows; 2026-10).
+ */
+export function relStatementKey(r) {
+    const spine = [r.op ?? "", r.publishes ?? "", r.consumes ?? ""];
+    return JSON.stringify([r.source, r.target, r.title ?? "", ...spine, [...new Set(r.tags)].sort()]);
+}
+/**
+ * A scanned statement's `relStatementKey`, with the tags its kind gives it —
+ * what the parse of the same statement carries. `kindTags` is the document's
+ * `specification.relationshipKindTags` (`../../parsed/specification.ts`); a
+ * document whose kinds carry no tags keys exactly as `relStatementKey` does.
+ */
+export function scannedStatementKey(s, kindTags) {
+    const inherited = s.kind === undefined ? [] : (kindTags[s.kind] ?? []);
+    return relStatementKey({ ...s, tags: [...s.tags, ...inherited] });
+}
 /**
  * The order of loam-inserted relationships that share a landing region:
  * (source title, target title, the three spine keys, title) as one comparable

package/dist/core/c4/splice/identity/edges.js.map

@@ -1 +1 @@
-{"version":3,"file":"edges.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/edges.ts"],"names":[],"mappings":"AAoBA;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,CAAyG;IAEzG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,CAAM;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,EAAU;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * How the landscape merge decides that two relationships are the SAME EDGE,\n * and in what order equal ones are written.\n *\n * A subject of its own, and not a corner of placement: everything in\n * `../placement.ts` answers *where in the text* a statement goes, in byte\n * offsets, while everything here answers *which statement this is*, as a\n * comparable string. The merge asks the identity question first and the\n * placement question second, and getting the first one wrong is the failure\n * mode that is silent — a delta edge that hashes the same as a living one is\n * counted as already present and dropped at exit 0, with `+0 relationship(s)`\n * printed over a binding that never reached the map.\n *\n * Both keys are built from fields BOTH `Rel` and `ScannedRel` carry, because\n * the same edge must key identically as today's addition and as a statement in\n * the next archive's scan of the file it was written into. A field only one of\n * them has would make the merge disagree with itself one archive later.\n */\nimport type { Elem, Rel } from \"../../likec4.js\";\n\n/**\n * The order of loam-inserted relationships that share a landing region:\n * (source title, target title, the three spine keys, title) as one comparable\n * string. Titles, not ids — the namespaces differ. The same edge must sort\n * identically as today's addition and as a statement in the next archive's\n * scan, so every field is one BOTH `Rel` and `ScannedRel` carry.\n */\nexport function relSortKey(\n  els: Elem[],\n  r: { source: string; target: string; title?: string; op?: string; publishes?: string; consumes?: string },\n): string {\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify([titleOf(els, r.source), titleOf(els, r.target), ...spine, r.title ?? \"\"]);\n}\n\n/**\n * What makes two edges the same edge. Endpoints are compared by TITLE, which is\n * stable across the delta's and the landscape's id namespaces.\n *\n * An edge carrying a SPINE KEY — `op`, `publishes` or `consumes` — IS that call\n * or that message, whatever it is titled: retitling it must not merge a second\n * copy. An edge with none has only its title. Separate namespaces, because they\n * are separate things: an op-less edge titled `authorizePayment` is not the edge\n * whose operationId is authorizePayment, and keying on `op ?? title` quietly\n * merged only one of them.\n *\n * ALL THREE keys, not just `op`. While the other two were out, a delta edge differing from a\n * living one only by `metadata { publishes 'x' }` hashed the same, counted as already present,\n * and was dropped — `+0 relationship(s)` at exit 0 over a binding that never reached the map.\n */\nexport function relKey(els: Elem[], r: Rel): string {\n  const src = titleOf(els, r.source);\n  const tgt = titleOf(els, r.target);\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify(spine.some((v) => v !== \"\") ? [\"spine\", src, tgt, ...spine] : [\"title\", src, tgt, r.title ?? \"\"]);\n}\n\nexport function titleOf(elements: Elem[], id: string): string {\n  return elements.find((e) => e.id === id)?.title ?? id;\n}\n"]}
+{"version":3,"file":"edges.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/edges.ts"],"names":[],"mappings":"AAwBA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,eAAe,CAAC,CAAmB;IACjD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACpG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAa,EAAE,QAAkB;IACnE,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,eAAe,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,CAAyG;IAEzG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,CAAM;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,EAAU;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * How the landscape merge decides that two relationships are the SAME EDGE,\n * and in what order equal ones are written.\n *\n * A subject of its own, and not a corner of placement: everything in\n * `../placement.ts` answers *where in the text* a statement goes, in byte\n * offsets, while everything here answers *which statement this is*, as a\n * comparable string. The merge asks the identity question first and the\n * placement question second, and getting the first one wrong is the failure\n * mode that is silent — a delta edge that hashes the same as a living one is\n * counted as already present and dropped at exit 0, with `+0 relationship(s)`\n * printed over a binding that never reached the map.\n *\n * Both keys are built from fields BOTH `Rel` and `ScannedRel` carry, because\n * the same edge must key identically as today's addition and as a statement in\n * the next archive's scan of the file it was written into. A field only one of\n * them has would make the merge disagree with itself one archive later. The one\n * field the two read differently — the tags, which the parse inherits from the\n * relationship's kind — is reconciled on the scanned side (`scannedStatementKey`).\n */\nimport type { Elem, Rel } from \"../../likec4.js\";\nimport type { ScannedRel } from \"../../source-scan.js\";\nimport type { KindTags } from \"../contract.js\";\n\n/**\n * Which AUTHORED STATEMENT a parsed addition was written as — the key that\n * matches a `Rel` back to its bytes in delta.likec4, so the splice carries the\n * declaration verbatim instead of re-serializing it.\n *\n * Stricter than `relKey` below on purpose, and asking a different question:\n * `relKey` decides whether the living document already HAS this edge, across\n * two id namespaces, so it joins on titles; this one runs inside ONE document\n * where ids are exact, and it must tell apart two statements the merge would\n * otherwise hand each other's bytes. Both endpoints, the title, all three spine\n * keys and the tags, because a pool entry shared by two additions gives the\n * second one the first one's authored source.\n *\n * The tags are a SET, and a parsed `Rel`'s are not the ones written in the\n * statement: since LikeC4 1.59.0 a relationship kind can carry tags\n * (`relationship publishes { #async }`), and the parse hands every edge of the\n * kind its kind's tags, deduplicated against the statement's own (measured at\n * the 1.59.2 pin). A scanned statement carries only what is written in it, so\n * `scannedStatementKey` adds its kind's tags before keying — keyed as written,\n * every edge of a tagged kind found no statement, and archive refused a delta\n * `validate --feature` and `status` had called ready (`merge-failed`, or\n * `usecase.flow-invalid` when the feature had flows; 2026-10).\n */\nexport function relStatementKey(r: Rel | ScannedRel): string {\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify([r.source, r.target, r.title ?? \"\", ...spine, [...new Set(r.tags)].sort()]);\n}\n\n/**\n * A scanned statement's `relStatementKey`, with the tags its kind gives it —\n * what the parse of the same statement carries. `kindTags` is the document's\n * `specification.relationshipKindTags` (`../../parsed/specification.ts`); a\n * document whose kinds carry no tags keys exactly as `relStatementKey` does.\n */\nexport function scannedStatementKey(s: ScannedRel, kindTags: KindTags): string {\n  const inherited = s.kind === undefined ? [] : (kindTags[s.kind] ?? []);\n  return relStatementKey({ ...s, tags: [...s.tags, ...inherited] });\n}\n\n/**\n * The order of loam-inserted relationships that share a landing region:\n * (source title, target title, the three spine keys, title) as one comparable\n * string. Titles, not ids — the namespaces differ. The same edge must sort\n * identically as today's addition and as a statement in the next archive's\n * scan, so every field is one BOTH `Rel` and `ScannedRel` carry.\n */\nexport function relSortKey(\n  els: Elem[],\n  r: { source: string; target: string; title?: string; op?: string; publishes?: string; consumes?: string },\n): string {\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify([titleOf(els, r.source), titleOf(els, r.target), ...spine, r.title ?? \"\"]);\n}\n\n/**\n * What makes two edges the same edge. Endpoints are compared by TITLE, which is\n * stable across the delta's and the landscape's id namespaces.\n *\n * An edge carrying a SPINE KEY — `op`, `publishes` or `consumes` — IS that call\n * or that message, whatever it is titled: retitling it must not merge a second\n * copy. An edge with none has only its title. Separate namespaces, because they\n * are separate things: an op-less edge titled `authorizePayment` is not the edge\n * whose operationId is authorizePayment, and keying on `op ?? title` quietly\n * merged only one of them.\n *\n * ALL THREE keys, not just `op`. While the other two were out, a delta edge differing from a\n * living one only by `metadata { publishes 'x' }` hashed the same, counted as already present,\n * and was dropped — `+0 relationship(s)` at exit 0 over a binding that never reached the map.\n */\nexport function relKey(els: Elem[], r: Rel): string {\n  const src = titleOf(els, r.source);\n  const tgt = titleOf(els, r.target);\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify(spine.some((v) => v !== \"\") ? [\"spine\", src, tgt, ...spine] : [\"title\", src, tgt, r.title ?? \"\"]);\n}\n\nexport function titleOf(elements: Elem[], id: string): string {\n  return elements.find((e) => e.id === id)?.title ?? id;\n}\n"]}

package/dist/core/c4/splice/identity/existing.js

@@ -0,0 +1,80 @@
+import { scanModel } from "../../source-scan.js";
+import { modelDeclarations } from "./declared.js";
+import { relKey } from "./edges.js";
+/**
+ * Report (never guess) when a title join would cross two bound services: with
+ * both sides carrying an explicit `metadata { service }` binding and every
+ * binding disagreeing, they are provably DIFFERENT services' boxes sharing a
+ * title ('API', 'Database'). Skipping would silently drop the addition, and any
+ * delta edge into it would then refuse the whole archive at the merge's parse
+ * net with a message about nothing.
+ */
+export function newAdditions(req) {
+    const { livingEls, livingRels, bindEls, deltaElements, candidates, models, borrowed } = req;
+    const modelScans = models.map((model) => ({ scan: scanModel(model.text, borrowed) }));
+    const declared = modelDeclarations(modelScans, bindEls);
+    const haveIds = new Set([...livingEls.map((e) => e.id), ...declared.ids]);
+    // The title join needs the matched element back, not just membership: the
+    // cross-service guard below compares service BINDINGS across the join.
+    const byTitle = new Map();
+    const seeTitle = (el) => {
+        byTitle.set(el.title, [...(byTitle.get(el.title) ?? []), el]);
+    };
+    for (const el of livingEls)
+        seeTitle(el);
+    const els = [];
+    for (const e of candidates.els) {
+        if (haveIds.has(e.id))
+            continue;
+        // The addition's OWN service first, and before the map's global title
+        // index: a box this service's model already draws is existence, whoever
+        // else on the map happens to share the title.
+        if (declared.declaresTitle(e.id, e.title))
+            continue;
+        const sameTitle = byTitle.get(e.title);
+        if (sameTitle !== undefined) {
+            // A title match is the id-less fallback join, and skipping on it is only
+            // safe when the two sides could be the same box.
+            if (e.service !== undefined && sameTitle.every((m) => m.service !== undefined && m.service !== e.service)) {
+                return { els, rels: [], declaredIds: new Set(declared.ids), collision: { addition: e, living: sameTitle[0] } };
+            }
+            // KNOWN (narrowed by the guard above): with EITHER side unbound the title
+            // join stays trusting — the unbound title-fallback is the legal legacy
+            // pattern — so a cross-service collision hiding behind an unbound element
+            // is still silently skipped here. Scoping titles per service is backlog.
+            continue;
+        }
+        haveIds.add(e.id);
+        seeTitle(e);
+        els.push(e);
+    }
+    // An edge already in the landscape consumes one delta edge of the same
+    // identity, which is what keeps re-archiving idempotent.
+    const have = new Map();
+    for (const r of livingRels) {
+        const k = relKey(livingEls, r);
+        have.set(k, (have.get(k) ?? 0) + 1);
+    }
+    // An edge an extending model already draws consumes a delta edge exactly as a
+    // living map edge does — keyed through the DELTA's elements, because the
+    // model spells its endpoints in the map's fqn namespace and the delta must
+    // too for the nesting to resolve at all.
+    for (const { scan } of modelScans) {
+        for (const r of scan?.rels ?? []) {
+            const k = relKey(deltaElements, r);
+            have.set(k, (have.get(k) ?? 0) + 1);
+        }
+    }
+    const rels = [];
+    for (const r of candidates.rels) {
+        const k = relKey(deltaElements, r);
+        const n = have.get(k) ?? 0;
+        if (n > 0) {
+            have.set(k, n - 1);
+            continue;
+        }
+        rels.push(r);
+    }
+    return { els, rels, declaredIds: new Set(declared.ids) };
+}
+//# sourceMappingURL=existing.js.map