@ybotok/loam 0.2.0-alpha.5 → 0.2.0-alpha.6

package/dist/commands/validate/fleet/load.js

@@ -1,3 +1,19 @@
+/**
+ * The landscape's contained load path — the one phase of the fleet target that
+ * touches the filesystem before anything can be graded. Split from
+ * `./landscape.ts` when the fleet target grew past the line limit; the
+ * containment DOCTRINE below travelled with the functions it explains.
+ *
+ * The load ITSELF is no longer here. `loadArchitecture` moved to
+ * `core/c4/project/architecture.ts` when the use-case axis grew a second reader
+ * of it, and that module's banner records why; what stayed is the containment,
+ * which is command-layer business because it is about which validate TARGET a
+ * failed read is filed against.
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { FleetContext } from "../../../core/fleet-context.js";
+import { featurePaths, landscapePath, servicePathsAt } from "../../../core/repo/paths.js";
 /**
  * A landscape that could not be READ, shaped as one that did not PARSE.
  *
@@ -49,4 +65,54 @@ export async function readLandscape(load) {
         return unreadableLandscape(err);
     }
 }
+/**
+ * ONE workspace per document KIND for the whole `--all` run.
+ *
+ * The per-path load pays a fresh Langium workspace per document (~100 ms each
+ * even warm), which made the fleet's main CI command O(documents) workspace
+ * spins — 13.7 s median over the 120-service benchmark (docs/BENCHMARKS.md). So
+ * `--all` enumerates its documents up front and batch-parses them into the
+ * fleet context's memo; every load below, the landscape read included, is then a
+ * seeded hit. The enumerations are the same memoised promises the target loops
+ * reuse.
+ *
+ * TWO WORKSPACES, because the fleet's models no longer parse the same way as
+ * each other: a model that EXTENDS the map is a PROJECT (the map plus that
+ * file) and a model that stands alone is a document. So the shapes are read
+ * first, the DOCUMENT batch is asked for everything that is one — the landscape,
+ * every feature delta, every standalone model — and `prefetchServiceModels`
+ * then batches the extending half as projects, finding its own standalone list
+ * already memoised and asking for nothing.
+ *
+ * The order is load-bearing rather than tidy. `prefetchLikeC4` returns without a
+ * workspace when fewer than two documents are missing (one document gains
+ * nothing from batch isolation it already has), so splitting the documents
+ * across two calls is how a fleet of one service and one feature ends up
+ * batching the feature and parsing the model in a workspace of its own — the
+ * exact per-document spin this function exists to remove, and what
+ * `test/validate-batch-fallback.test.ts` counts.
+ *
+ * If a batch CANNOT run — a sandbox denying tmpdir writes — the prefetch seeds
+ * nothing and every load falls back to today's per-path parse: identical
+ * findings, the old speed. Single-service `validate` and `list` keep their
+ * untouched code paths on purpose, so the ≤10% regression bound in
+ * docs/BENCHMARKS.md holds by construction.
+ *
+ * It lives HERE rather than in `../validate.ts` because it is fleet-loading
+ * business and that module is the argument grammar and the target dispatch; the
+ * block also took that file to its line limit, which is the ceiling asking the
+ * question it exists to ask.
+ */
+export async function prefetchFleetDocuments(input) {
+    const { docsDir, fleet } = input;
+    const paths = input.services.filter((svc) => svc.has.model).map((svc) => servicePathsAt(svc.dir));
+    const shapes = await fleet.modelShapes(paths.map((p) => p.model));
+    const landscape = landscapePath(docsDir);
+    await fleet.prefetchLikeC4([
+        ...(existsSync(landscape) ? [landscape] : []),
+        ...input.features.filter((feat) => feat.has.delta).map((feat) => featurePaths(feat.dir).delta),
+        ...paths.filter((p) => shapes.get(resolve(p.model)) !== "extending").map((p) => p.model),
+    ]);
+    await fleet.prefetchServiceModels(docsDir, paths);
+}
 //# sourceMappingURL=load.js.map

package/dist/commands/validate/fleet/load.js.map

@@ -1 +1 @@
-{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../../src/commands/validate/fleet/load.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO;QACL,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,EAAE;KAClB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA8B;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;AACH,CAAC","sourcesContent":["/**\n * The landscape's contained load path — the one phase of the fleet target that\n * touches the filesystem before anything can be graded. Split from\n * `./landscape.ts` when the fleet target grew past the line limit; the\n * containment DOCTRINE below travelled with the functions it explains.\n *\n * The load ITSELF is no longer here. `loadArchitecture` moved to\n * `core/c4/project/architecture.ts` when the use-case axis grew a second reader\n * of it, and that module's banner records why; what stayed is the containment,\n * which is command-layer business because it is about which validate TARGET a\n * failed read is filed against.\n */\nimport type { LoadedDoc } from \"../../../core/c4/likec4.js\";\n\n/**\n * A landscape that could not be READ, shaped as one that did not PARSE.\n *\n * The landscape is the one artifact no target owns: it is read once for the\n * whole run and it is graded on a target of its own, which runs OUTSIDE\n * `guarded`. So a landscape.likec4 that is a directory, or that carries a\n * permission bit this process cannot open, escaped every per-target catch and\n * became the whole run's `repository-unavailable` — one file, and a fleet gate\n * that said nothing about the ninety-nine services that are fine. A DANGLING\n * symlink is not one of those shapes and never was: every read of the file is\n * gated on an `existsSync` that follows the link, so a broken one resolves as\n * `landscape.missing` long before anything opens it.\n *\n * What this contains is the FLEET-level reads, and only those: the `--all`\n * preload, and both reads inside `validateLandscape` — the conflict-marker\n * `readFile` and the parse. `loam validate --service <id>` and\n * `loam validate --feature <id>` hand in no preloaded doc, so `validateService`\n * and `validateFeature` open the same file again on demand, unwrapped and\n * INSIDE `guarded`: an EISDIR there is still reported as `service.unreadable`\n * or `feature.unreadable`, which files the fleet map's failure against the one\n * target the caller happened to name. That is the wrong subject on a finding\n * that does at least carry the offending path, and it costs those runs nothing\n * further — they grade a single target either way, so there is no report left\n * unwritten — which is why the remainder was left for the change that gives the\n * landscape one load path instead of three.\n *\n * `guarded` is deliberately NOT widened to cover the landscape target instead.\n * Its code ternary knows only services and features, so it would file the fleet\n * map's failure as `feature.unreadable`; and a guarded failure yields no\n * document, so all N services would go on to re-open the same broken file\n * inside their own guards and emit N copies of it. Containing the IO here needs\n * no new code and no new sentence: \"could not be read\" and \"did not parse\" have\n * the same consequence — nothing may be concluded from this file — and\n * `landscape.invalid` is already how that is said.\n */\nexport function unreadableLandscape(err: unknown): LoadedDoc {\n  return {\n    errors: [{ message: err instanceof Error ? err.message : String(err) }],\n    elements: [],\n    relationships: [],\n  };\n}\n\n/** One landscape load, answering with `unreadableLandscape` rather than throwing. */\nexport async function readLandscape(load: () => Promise<LoadedDoc>): Promise<LoadedDoc> {\n  try {\n    return await load();\n  } catch (err) {\n    return unreadableLandscape(err);\n  }\n}\n"]}
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../../src/commands/validate/fleet/load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAG9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO;QACL,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,EAAE;KAClB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA8B;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAoB;IAC/D,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,CAAC,cAAc,CAAC;QACzB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAC9F,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;KACzF,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC","sourcesContent":["/**\n * The landscape's contained load path — the one phase of the fleet target that\n * touches the filesystem before anything can be graded. Split from\n * `./landscape.ts` when the fleet target grew past the line limit; the\n * containment DOCTRINE below travelled with the functions it explains.\n *\n * The load ITSELF is no longer here. `loadArchitecture` moved to\n * `core/c4/project/architecture.ts` when the use-case axis grew a second reader\n * of it, and that module's banner records why; what stayed is the containment,\n * which is command-layer business because it is about which validate TARGET a\n * failed read is filed against.\n */\nimport { existsSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport type { LoadedDoc } from \"../../../core/c4/likec4.js\";\nimport { FleetContext } from \"../../../core/fleet-context.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport type { FeatureEntry, ServiceEntry } from \"../../../core/repo/entries.js\";\nimport { featurePaths, landscapePath, servicePathsAt } from \"../../../core/repo/paths.js\";\n\n/**\n * A landscape that could not be READ, shaped as one that did not PARSE.\n *\n * The landscape is the one artifact no target owns: it is read once for the\n * whole run and it is graded on a target of its own, which runs OUTSIDE\n * `guarded`. So a landscape.likec4 that is a directory, or that carries a\n * permission bit this process cannot open, escaped every per-target catch and\n * became the whole run's `repository-unavailable` — one file, and a fleet gate\n * that said nothing about the ninety-nine services that are fine. A DANGLING\n * symlink is not one of those shapes and never was: every read of the file is\n * gated on an `existsSync` that follows the link, so a broken one resolves as\n * `landscape.missing` long before anything opens it.\n *\n * What this contains is the FLEET-level reads, and only those: the `--all`\n * preload, and both reads inside `validateLandscape` — the conflict-marker\n * `readFile` and the parse. `loam validate --service <id>` and\n * `loam validate --feature <id>` hand in no preloaded doc, so `validateService`\n * and `validateFeature` open the same file again on demand, unwrapped and\n * INSIDE `guarded`: an EISDIR there is still reported as `service.unreadable`\n * or `feature.unreadable`, which files the fleet map's failure against the one\n * target the caller happened to name. That is the wrong subject on a finding\n * that does at least carry the offending path, and it costs those runs nothing\n * further — they grade a single target either way, so there is no report left\n * unwritten — which is why the remainder was left for the change that gives the\n * landscape one load path instead of three.\n *\n * `guarded` is deliberately NOT widened to cover the landscape target instead.\n * Its code ternary knows only services and features, so it would file the fleet\n * map's failure as `feature.unreadable`; and a guarded failure yields no\n * document, so all N services would go on to re-open the same broken file\n * inside their own guards and emit N copies of it. Containing the IO here needs\n * no new code and no new sentence: \"could not be read\" and \"did not parse\" have\n * the same consequence — nothing may be concluded from this file — and\n * `landscape.invalid` is already how that is said.\n */\nexport function unreadableLandscape(err: unknown): LoadedDoc {\n  return {\n    errors: [{ message: err instanceof Error ? err.message : String(err) }],\n    elements: [],\n    relationships: [],\n  };\n}\n\n/** One landscape load, answering with `unreadableLandscape` rather than throwing. */\nexport async function readLandscape(load: () => Promise<LoadedDoc>): Promise<LoadedDoc> {\n  try {\n    return await load();\n  } catch (err) {\n    return unreadableLandscape(err);\n  }\n}\n\n/** Everything a `--all` run parses up front, and the enumerations it was narrowed to. */\nexport interface FleetPrefetch {\n  docsDir: DocsDir;\n  fleet: FleetContext;\n  /** The services this run grades — the `--base` narrowing when there is one. */\n  services: readonly ServiceEntry[];\n  /** The active features this run grades, likewise. */\n  features: readonly FeatureEntry[];\n}\n\n/**\n * ONE workspace per document KIND for the whole `--all` run.\n *\n * The per-path load pays a fresh Langium workspace per document (~100 ms each\n * even warm), which made the fleet's main CI command O(documents) workspace\n * spins — 13.7 s median over the 120-service benchmark (docs/BENCHMARKS.md). So\n * `--all` enumerates its documents up front and batch-parses them into the\n * fleet context's memo; every load below, the landscape read included, is then a\n * seeded hit. The enumerations are the same memoised promises the target loops\n * reuse.\n *\n * TWO WORKSPACES, because the fleet's models no longer parse the same way as\n * each other: a model that EXTENDS the map is a PROJECT (the map plus that\n * file) and a model that stands alone is a document. So the shapes are read\n * first, the DOCUMENT batch is asked for everything that is one — the landscape,\n * every feature delta, every standalone model — and `prefetchServiceModels`\n * then batches the extending half as projects, finding its own standalone list\n * already memoised and asking for nothing.\n *\n * The order is load-bearing rather than tidy. `prefetchLikeC4` returns without a\n * workspace when fewer than two documents are missing (one document gains\n * nothing from batch isolation it already has), so splitting the documents\n * across two calls is how a fleet of one service and one feature ends up\n * batching the feature and parsing the model in a workspace of its own — the\n * exact per-document spin this function exists to remove, and what\n * `test/validate-batch-fallback.test.ts` counts.\n *\n * If a batch CANNOT run — a sandbox denying tmpdir writes — the prefetch seeds\n * nothing and every load falls back to today's per-path parse: identical\n * findings, the old speed. Single-service `validate` and `list` keep their\n * untouched code paths on purpose, so the ≤10% regression bound in\n * docs/BENCHMARKS.md holds by construction.\n *\n * It lives HERE rather than in `../validate.ts` because it is fleet-loading\n * business and that module is the argument grammar and the target dispatch; the\n * block also took that file to its line limit, which is the ceiling asking the\n * question it exists to ask.\n */\nexport async function prefetchFleetDocuments(input: FleetPrefetch): Promise<void> {\n  const { docsDir, fleet } = input;\n  const paths = input.services.filter((svc) => svc.has.model).map((svc) => servicePathsAt(svc.dir));\n  const shapes = await fleet.modelShapes(paths.map((p) => p.model));\n  const landscape = landscapePath(docsDir);\n  await fleet.prefetchLikeC4([\n    ...(existsSync(landscape) ? [landscape] : []),\n    ...input.features.filter((feat) => feat.has.delta).map((feat) => featurePaths(feat.dir).delta),\n    ...paths.filter((p) => shapes.get(resolve(p.model)) !== \"extending\").map((p) => p.model),\n  ]);\n  await fleet.prefetchServiceModels(docsDir, paths);\n}\n"]}

package/dist/commands/validate/fleet/map/attest.js

@@ -0,0 +1,103 @@
+/**
+ * What the fleet's own `model.likec4` files say, read ONCE for the two map
+ * checks that need it: the calls each model attests across its boundary
+ * (`./isolation.ts`), and the datastores that live nested inside a service's own
+ * element (`../../checks/fleet-shape.ts`).
+ *
+ * One reader rather than two, because the two checks were answering the same
+ * question from different evidence and disagreeing about the fleet. The
+ * consumer census walked the MAP's relationships alone, so a store whose
+ * consuming edges are all drawn in `services/<…>/model.likec4` had zero
+ * consumers and earned nothing at all — and a store reached by three models plus
+ * one map edge was reported `landscape.datastore-private` naming the single
+ * service the MAP happened to draw (R1). A model is evidence about the fleet
+ * exactly as the map is, so it is read here and handed to both.
+ *
+ * EXTENDING MODELS ONLY, for the consumer join. An extending model's ids ARE the
+ * map's fully-qualified ids — one project, one id space — so `counterpartId`
+ * joins to a drawn element exactly. A standalone model's ids are its own file's,
+ * and `../../../../core/c4/resolve/attested.ts` says outright that a counterpart
+ * is never matched to a landscape element: joining one would file a coincidence
+ * of spelling as a coupling. Standalone models still contribute their attested
+ * CALLS, because `landscape.service-isolated` asks only whether the model
+ * declares any, which is shape-independent.
+ *
+ * A model that does not parse contributes nothing — neither calls nor stores.
+ * `c4.invalid` is that file's finding, and a fleet-shape advisory computed from
+ * a document nobody could read would be an inference about bytes.
+ *
+ * A sub-package of `fleet/` for `./isolation.ts`'s reason and with its rule: it
+ * imports NOTHING from `fleet/`, so the map facts it needs (the resolver, the
+ * ids the map draws at fleet level) arrive on the input record.
+ */
+import { existsSync } from "node:fs";
+import {} from "../../../../core/c4/likec4.js";
+import { attestedCalls } from "../../../../core/c4/resolve/attested.js";
+import { FleetContext } from "../../../../core/fleet-context.js";
+import { inOrder } from "../../../../core/kernel/concurrency.js";
+import {} from "../../../../core/repo/entries.js";
+import { servicePathsAt } from "../../../../core/repo/paths.js";
+/** The element kind read as a datastore, compared case-insensitively — `fleet-shape.ts`'s spelling. */
+const DATASTORE_KIND = "database";
+export async function mapAttestation(input) {
+    // Through the ONE reader of `model.likec4` (`core/c4/service-model/load.ts`),
+    // so a model that EXTENDS the map attests the calls it draws inside the
+    // element the map binds — read as a slice of the per-service project — exactly
+    // as a standalone one attests the calls it draws in its own file. Memoised in
+    // the index, so under `--all` these are hits. Pooled and joined on the entry,
+    // never by index.
+    const context = input.fleet ?? new FleetContext();
+    const present = input.entries.filter((entry) => existsSync(servicePathsAt(entry.dir).model));
+    // ONE workspace for the fleet's models rather than one per service. Both
+    // answers below are about the WHOLE fleet — who else reaches this store is not
+    // a question a narrowed run may answer differently — while `--base` prefetches
+    // only the scope it grades, so without this a scoped run would spin a LikeC4
+    // workspace per un-narrowed service. An accelerator with `prefetchLikeC4`'s
+    // failure story exactly: a batch that cannot run seeds nothing, and every read
+    // below falls back to its own load.
+    await context.prefetchServiceModels(input.docsDir, present.map((entry) => servicePathsAt(entry.dir)));
+    const loaded = await inOrder(present, async (entry) => ({
+        entry,
+        // CONTAINED, for `fleet/load.ts unreadableLandscape`'s reason: this runs on
+        // the landscape target, which sits outside the dispatcher's `guarded`, so a
+        // `model.likec4` that is a directory or carries a permission bit would
+        // otherwise become the whole run's `repository-unavailable` — one file, and
+        // no report at all for the ninety-nine services that are fine. A model that
+        // could not be READ contributes nothing here, exactly as one that did not
+        // parse does; `service.unreadable` is its own target's finding.
+        model: await context.serviceModel(input.docsDir, servicePathsAt(entry.dir)).catch(() => null),
+    }));
+    const models = [];
+    const nestedStores = [];
+    for (const { entry, model } of loaded) {
+        // A model that does not parse attests nothing: `c4.invalid` is its finding.
+        // An extending model whose MAP does not parse could not be read at all, and
+        // neither reader runs in that state anyway — the fleet target returns on
+        // `landscape.invalid` long before here.
+        if (model === null || model.mapUnreadable || model.doc.errors.length > 0)
+            continue;
+        models.push({
+            service: entry.id,
+            extending: model.shape === "extending",
+            calls: attestedCalls(model.doc, entry.id, input.services),
+        });
+        if (model.shape !== "extending")
+            continue;
+        for (const element of model.doc.elements) {
+            if (element.kind.toLowerCase() !== DATASTORE_KIND)
+                continue;
+            // The slice carries the partners this model's own edges point at, and a
+            // partner may be another service's store — so the store is kept only when
+            // the MAP's resolver files it under this service, and only when the map
+            // does not draw it as a peer of the services (which is the fleet-level
+            // census's subject, and a different grade).
+            if (input.standsForService(element))
+                continue;
+            if (input.drawnIds.has(element.id) || input.resolve(element.id) !== entry.id)
+                continue;
+            nestedStores.push({ owner: entry.id, fqn: element.id, title: element.title });
+        }
+    }
+    return { models, nestedStores };
+}
+//# sourceMappingURL=attest.js.map

package/dist/commands/validate/fleet/map/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../../../../src/commands/validate/fleet/map/attest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAa,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAqB,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAEjE,OAAO,EAAqB,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,uGAAuG;AACvG,MAAM,cAAc,GAAG,UAAU,CAAC;AA8ClC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAkB;IACrD,8EAA8E;IAC9E,wEAAwE;IACxE,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,kBAAkB;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,YAAY,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,yEAAyE;IACzE,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,oCAAoC;IACpC,MAAM,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,KAAK;QACL,4EAA4E;QAC5E,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,gEAAgE;QAChE,KAAK,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAC9F,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;QACtC,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,wCAAwC;QACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACnF,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,KAAK,CAAC,KAAK,KAAK,WAAW;YACtC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;YAAE,SAAS;QAC1C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;gBAAE,SAAS;YAC5D,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,4CAA4C;YAC5C,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,KAAM,KAAK,CAAC,EAAa;gBAAE,SAAS;YACnG,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC","sourcesContent":["/**\n * What the fleet's own `model.likec4` files say, read ONCE for the two map\n * checks that need it: the calls each model attests across its boundary\n * (`./isolation.ts`), and the datastores that live nested inside a service's own\n * element (`../../checks/fleet-shape.ts`).\n *\n * One reader rather than two, because the two checks were answering the same\n * question from different evidence and disagreeing about the fleet. The\n * consumer census walked the MAP's relationships alone, so a store whose\n * consuming edges are all drawn in `services/<…>/model.likec4` had zero\n * consumers and earned nothing at all — and a store reached by three models plus\n * one map edge was reported `landscape.datastore-private` naming the single\n * service the MAP happened to draw (R1). A model is evidence about the fleet\n * exactly as the map is, so it is read here and handed to both.\n *\n * EXTENDING MODELS ONLY, for the consumer join. An extending model's ids ARE the\n * map's fully-qualified ids — one project, one id space — so `counterpartId`\n * joins to a drawn element exactly. A standalone model's ids are its own file's,\n * and `../../../../core/c4/resolve/attested.ts` says outright that a counterpart\n * is never matched to a landscape element: joining one would file a coincidence\n * of spelling as a coupling. Standalone models still contribute their attested\n * CALLS, because `landscape.service-isolated` asks only whether the model\n * declares any, which is shape-independent.\n *\n * A model that does not parse contributes nothing — neither calls nor stores.\n * `c4.invalid` is that file's finding, and a fleet-shape advisory computed from\n * a document nobody could read would be an inference about bytes.\n *\n * A sub-package of `fleet/` for `./isolation.ts`'s reason and with its rule: it\n * imports NOTHING from `fleet/`, so the map facts it needs (the resolver, the\n * ids the map draws at fleet level) arrive on the input record.\n */\nimport { existsSync } from \"node:fs\";\nimport { type Elem } from \"../../../../core/c4/likec4.js\";\nimport { attestedCalls, type AttestedCall } from \"../../../../core/c4/resolve/attested.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { inOrder } from \"../../../../core/kernel/concurrency.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\nimport { type ServiceEntry } from \"../../../../core/repo/entries.js\";\nimport { servicePathsAt } from \"../../../../core/repo/paths.js\";\n\n/** The element kind read as a datastore, compared case-insensitively — `fleet-shape.ts`'s spelling. */\nconst DATASTORE_KIND = \"database\";\n\n/** One service's model, as the map checks read it. */\nexport interface AttestedModel {\n  /** The service directory this model belongs to. */\n  service: string;\n  /** EXTENDING — and therefore whether `counterpartId` is a map id at all. */\n  extending: boolean;\n  calls: readonly AttestedCall[];\n}\n\n/** A datastore drawn INSIDE the element that resolves to its owner, rather than beside it. */\nexport interface NestedStore {\n  /** The service whose element holds it. */\n  owner: string;\n  /** The store's id as the one project spells it — `marketplace.orderService.db`. */\n  fqn: string;\n  title: string;\n}\n\nexport interface MapAttestation {\n  models: readonly AttestedModel[];\n  nestedStores: readonly NestedStore[];\n}\n\nexport interface AttestInput {\n  docsDir: DocsDir;\n  /** The enumerated services — every one of them, not a candidate subset: both readers ask about the whole fleet. */\n  entries: readonly ServiceEntry[];\n  /** The services/<id>/ directories that exist, as the resolver's `known`. */\n  services: ReadonlySet<string>;\n  /** The MAP's element→service resolver — what decides whose element a nested id sits under. */\n  resolve: (id: string) => string;\n  /**\n   * `census.ts`'s one predicate for \"this element stands for a `services/<id>/`\",\n   * injected because a `fleet/map/` module may not import `fleet/`. A `database`\n   * that IS a service directory is the fleet itself, not a store: the binding\n   * checks grade it, exactly as they do in `./consumers.ts`'s two halves.\n   */\n  standsForService: (e: Elem) => boolean;\n  /** The ids the map draws at FLEET level: a datastore among them is a peer, and the peer census owns it. */\n  drawnIds: ReadonlySet<string>;\n  /** Under `--all` every model.likec4 is already in this memo, so the reads below are hits. */\n  fleet?: FleetContext;\n}\n\nexport async function mapAttestation(input: AttestInput): Promise<MapAttestation> {\n  // Through the ONE reader of `model.likec4` (`core/c4/service-model/load.ts`),\n  // so a model that EXTENDS the map attests the calls it draws inside the\n  // element the map binds — read as a slice of the per-service project — exactly\n  // as a standalone one attests the calls it draws in its own file. Memoised in\n  // the index, so under `--all` these are hits. Pooled and joined on the entry,\n  // never by index.\n  const context = input.fleet ?? new FleetContext();\n  const present = input.entries.filter((entry) => existsSync(servicePathsAt(entry.dir).model));\n  // ONE workspace for the fleet's models rather than one per service. Both\n  // answers below are about the WHOLE fleet — who else reaches this store is not\n  // a question a narrowed run may answer differently — while `--base` prefetches\n  // only the scope it grades, so without this a scoped run would spin a LikeC4\n  // workspace per un-narrowed service. An accelerator with `prefetchLikeC4`'s\n  // failure story exactly: a batch that cannot run seeds nothing, and every read\n  // below falls back to its own load.\n  await context.prefetchServiceModels(input.docsDir, present.map((entry) => servicePathsAt(entry.dir)));\n  const loaded = await inOrder(present, async (entry) => ({\n    entry,\n    // CONTAINED, for `fleet/load.ts unreadableLandscape`'s reason: this runs on\n    // the landscape target, which sits outside the dispatcher's `guarded`, so a\n    // `model.likec4` that is a directory or carries a permission bit would\n    // otherwise become the whole run's `repository-unavailable` — one file, and\n    // no report at all for the ninety-nine services that are fine. A model that\n    // could not be READ contributes nothing here, exactly as one that did not\n    // parse does; `service.unreadable` is its own target's finding.\n    model: await context.serviceModel(input.docsDir, servicePathsAt(entry.dir)).catch(() => null),\n  }));\n\n  const models: AttestedModel[] = [];\n  const nestedStores: NestedStore[] = [];\n  for (const { entry, model } of loaded) {\n    // A model that does not parse attests nothing: `c4.invalid` is its finding.\n    // An extending model whose MAP does not parse could not be read at all, and\n    // neither reader runs in that state anyway — the fleet target returns on\n    // `landscape.invalid` long before here.\n    if (model === null || model.mapUnreadable || model.doc.errors.length > 0) continue;\n    models.push({\n      service: entry.id,\n      extending: model.shape === \"extending\",\n      calls: attestedCalls(model.doc, entry.id, input.services),\n    });\n    if (model.shape !== \"extending\") continue;\n    for (const element of model.doc.elements) {\n      if (element.kind.toLowerCase() !== DATASTORE_KIND) continue;\n      // The slice carries the partners this model's own edges point at, and a\n      // partner may be another service's store — so the store is kept only when\n      // the MAP's resolver files it under this service, and only when the map\n      // does not draw it as a peer of the services (which is the fleet-level\n      // census's subject, and a different grade).\n      if (input.standsForService(element)) continue;\n      if (input.drawnIds.has(element.id) || input.resolve(element.id) !== (entry.id as string)) continue;\n      nestedStores.push({ owner: entry.id, fqn: element.id, title: element.title });\n    }\n  }\n  return { models, nestedStores };\n}\n"]}

package/dist/commands/validate/fleet/map/bindings.js

@@ -0,0 +1,96 @@
+/**
+ * The element↔directory passes of the fleet cross-check: which drawn box
+ * answers for which `services/<id>/`, and what it means when the answer is
+ * none, two, or one nobody owns.
+ *
+ * Lifted out of `../landscape.ts` when that module reached its line limit, and
+ * the seam is a phase rather than a subject: everything here runs after the map
+ * has parsed, reads nothing from disk, and grades exactly one join — the census
+ * `../census.ts` derives against the enumeration `../landscape.ts` performed.
+ * The four grades are ordered as the report reads them, and the ORDER is the
+ * caller's business, which is why this is one function rather than four.
+ *
+ * A sub-package of `fleet/` for `./isolation.ts`'s reason, and with its rule: it
+ * imports NOTHING from `fleet/` itself — a child reaching back into its parent
+ * while the parent calls the child is the package cycle
+ * `scripts/package-graph.mjs` refuses — so the two census derivations arrive as
+ * data on the input record rather than as an import of `../census.js`.
+ */
+import {} from "../../../../core/c4/likec4.js";
+import { elementService } from "../../../../core/c4/resolve/service.js";
+import { EXTERNAL_TAG } from "../../../../core/vocabulary/maturity.js";
+import {} from "../../../../core/vocabulary/report.js";
+export function bindingFindings(input) {
+    const { elements, drawn, services, pathOf } = input;
+    const findings = [];
+    // Two boxes standing for one service directory. Every join in loam is
+    // `element -> service`, computed by picking the FIRST element that resolves —
+    // so with two of them, which one wins is readdir order, and the edges of the
+    // loser are attributed to a service they do not belong to. Silent until now,
+    // and unfixable by staring at either element on its own.
+    const perService = new Map();
+    for (const e of drawn) {
+        if (e.tags.includes(EXTERNAL_TAG))
+            continue;
+        const id = elementService(e);
+        perService.set(id, [...(perService.get(id) ?? []), e]);
+    }
+    for (const [id, elems] of perService) {
+        if (elems.length < 2)
+            continue;
+        // A collision only matters where it decides something: a real directory to
+        // attribute to, or a binding somebody wrote down on purpose.
+        if (!services.has(id) && !elems.some((e) => e.service !== undefined))
+            continue;
+        findings.push({
+            severity: "warn",
+            code: "landscape.binding-duplicate",
+            subject: id,
+            message: `landscape: ${elems.length} elements resolve to service '${id}' (${elems.map((e) => e.id).join(", ")}) — every element→service join picks one of them arbitrarily, so the others' edges are filed under a service that does not own them; keep one element per services/<id>/`,
+        });
+    }
+    for (const id of services) {
+        if (input.modelled.has(id))
+            continue;
+        findings.push({
+            severity: "error",
+            code: "landscape.service-unmodelled",
+            subject: id,
+            message: `landscape: ${pathOf(id)}/ exists but nothing in architecture/landscape.likec4 models it — add an element, or bind one with metadata { service '${id}' }`,
+        });
+    }
+    // A binding is a claim about this repo wherever it is written — including
+    // inside another element, which the old top-level filter never looked at, so
+    // a typo one level down bound an edge to a service that does not exist and
+    // nothing said so. Every element with a binding answers for it, at any depth.
+    for (const e of elements) {
+        if (e.tags.includes(EXTERNAL_TAG) || e.service === undefined)
+            continue;
+        if (services.has(e.service))
+            continue;
+        findings.push({
+            severity: "error",
+            code: "landscape.binding-unknown",
+            subject: e.service,
+            message: `landscape: '${e.title}' binds to service '${e.service}', but services/${e.service}/ does not exist`,
+        });
+    }
+    // Walked over the SYSTEM census — the same derivation the scorecard counts,
+    // so the map's exemptions and the fleet rollup cannot drift — with the two
+    // residual skips that are not exemptions: a bound element is the binding
+    // pass's subject above, and a title naming a real directory is documented.
+    for (const e of input.systems) {
+        if (e.service !== undefined)
+            continue; // graded by the binding pass above
+        if (services.has(e.title))
+            continue;
+        findings.push({
+            severity: "warn",
+            code: "landscape.service-undocumented",
+            subject: e.title,
+            message: `landscape: '${e.title}' has no services/${e.title}/ — bind it with metadata { service '<id>' }, or tag it #${EXTERNAL_TAG} if it is not ours`,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=bindings.js.map

package/dist/commands/validate/fleet/map/bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.js","sourceRoot":"","sources":["../../../../../src/commands/validate/fleet/map/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAa,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AAiBrE,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,sEAAsE;IACtE,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7B,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;YAAE,SAAS;QAC/E,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,cAAc,KAAK,CAAC,MAAM,iCAAiC,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0KAA0K;SACxR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACrC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,cAAc,MAAM,CAAC,EAAE,CAAC,0HAA0H,EAAE,KAAK;SACnK,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACvE,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,eAAe,CAAC,CAAC,KAAK,uBAAuB,CAAC,CAAC,OAAO,mBAAmB,CAAC,CAAC,OAAO,kBAAkB;SAC9G,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS,CAAC,mCAAmC;QAC1E,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,CAAC,CAAC,KAAK;YAChB,OAAO,EAAE,eAAe,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC,KAAK,4DAA4D,YAAY,oBAAoB;SACxJ,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The element↔directory passes of the fleet cross-check: which drawn box\n * answers for which `services/<id>/`, and what it means when the answer is\n * none, two, or one nobody owns.\n *\n * Lifted out of `../landscape.ts` when that module reached its line limit, and\n * the seam is a phase rather than a subject: everything here runs after the map\n * has parsed, reads nothing from disk, and grades exactly one join — the census\n * `../census.ts` derives against the enumeration `../landscape.ts` performed.\n * The four grades are ordered as the report reads them, and the ORDER is the\n * caller's business, which is why this is one function rather than four.\n *\n * A sub-package of `fleet/` for `./isolation.ts`'s reason, and with its rule: it\n * imports NOTHING from `fleet/` itself — a child reaching back into its parent\n * while the parent calls the child is the package cycle\n * `scripts/package-graph.mjs` refuses — so the two census derivations arrive as\n * data on the input record rather than as an import of `../census.js`.\n */\nimport { type Elem } from \"../../../../core/c4/likec4.js\";\nimport { elementService } from \"../../../../core/c4/resolve/service.js\";\nimport { EXTERNAL_TAG } from \"../../../../core/vocabulary/maturity.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\n\nexport interface BindingInput {\n  /** Every element the map declares, at any depth — a binding answers for itself wherever it is written. */\n  elements: Elem[];\n  /** Service-LEVEL elements (`census.ts serviceLevelElements`) — the fleet map's own boxes. */\n  drawn: Elem[];\n  /** The drawn SYSTEMS (`census.ts drawnSystems`) — `drawn` minus what the map itself says is no service. */\n  systems: Elem[];\n  /** The services/<id>/ directories that exist. */\n  services: ReadonlySet<string>;\n  /** The services some element resolves to — the set `landscape.service-unmodelled` reads. */\n  modelled: ReadonlySet<string>;\n  /** Where a service's directory sits, repo-relative — the enumeration's answer, never `services/<id>`. */\n  pathOf: (id: string) => string;\n}\n\nexport function bindingFindings(input: BindingInput): Finding[] {\n  const { elements, drawn, services, pathOf } = input;\n  const findings: Finding[] = [];\n\n  // Two boxes standing for one service directory. Every join in loam is\n  // `element -> service`, computed by picking the FIRST element that resolves —\n  // so with two of them, which one wins is readdir order, and the edges of the\n  // loser are attributed to a service they do not belong to. Silent until now,\n  // and unfixable by staring at either element on its own.\n  const perService = new Map<string, Elem[]>();\n  for (const e of drawn) {\n    if (e.tags.includes(EXTERNAL_TAG)) continue;\n    const id = elementService(e);\n    perService.set(id, [...(perService.get(id) ?? []), e]);\n  }\n  for (const [id, elems] of perService) {\n    if (elems.length < 2) continue;\n    // A collision only matters where it decides something: a real directory to\n    // attribute to, or a binding somebody wrote down on purpose.\n    if (!services.has(id) && !elems.some((e) => e.service !== undefined)) continue;\n    findings.push({\n      severity: \"warn\",\n      code: \"landscape.binding-duplicate\",\n      subject: id,\n      message: `landscape: ${elems.length} elements resolve to service '${id}' (${elems.map((e) => e.id).join(\", \")}) — every element→service join picks one of them arbitrarily, so the others' edges are filed under a service that does not own them; keep one element per services/<id>/`,\n    });\n  }\n\n  for (const id of services) {\n    if (input.modelled.has(id)) continue;\n    findings.push({\n      severity: \"error\",\n      code: \"landscape.service-unmodelled\",\n      subject: id,\n      message: `landscape: ${pathOf(id)}/ exists but nothing in architecture/landscape.likec4 models it — add an element, or bind one with metadata { service '${id}' }`,\n    });\n  }\n\n  // A binding is a claim about this repo wherever it is written — including\n  // inside another element, which the old top-level filter never looked at, so\n  // a typo one level down bound an edge to a service that does not exist and\n  // nothing said so. Every element with a binding answers for it, at any depth.\n  for (const e of elements) {\n    if (e.tags.includes(EXTERNAL_TAG) || e.service === undefined) continue;\n    if (services.has(e.service)) continue;\n    findings.push({\n      severity: \"error\",\n      code: \"landscape.binding-unknown\",\n      subject: e.service,\n      message: `landscape: '${e.title}' binds to service '${e.service}', but services/${e.service}/ does not exist`,\n    });\n  }\n\n  // Walked over the SYSTEM census — the same derivation the scorecard counts,\n  // so the map's exemptions and the fleet rollup cannot drift — with the two\n  // residual skips that are not exemptions: a bound element is the binding\n  // pass's subject above, and a title naming a real directory is documented.\n  for (const e of input.systems) {\n    if (e.service !== undefined) continue; // graded by the binding pass above\n    if (services.has(e.title)) continue;\n    findings.push({\n      severity: \"warn\",\n      code: \"landscape.service-undocumented\",\n      subject: e.title,\n      message: `landscape: '${e.title}' has no services/${e.title}/ — bind it with metadata { service '<id>' }, or tag it #${EXTERNAL_TAG} if it is not ours`,\n    });\n  }\n\n  return findings;\n}\n"]}