@ybotok/loam 0.2.0-alpha.5 → 0.2.0-alpha.7

package/dist/commands/validate/fleet/map/attest.js

@@ -0,0 +1,102 @@
+/**
+ * What the fleet's own `model.likec4` files say, read ONCE for the two map
+ * checks that need it: the calls each model attests across its boundary
+ * (`./isolation.ts`), and the datastores that live nested inside a service's own
+ * element (`../../checks/fleet-shape.ts`).
+ *
+ * One reader rather than two, because the two checks were answering the same
+ * question from different evidence and disagreeing about the fleet. The
+ * consumer census walked the MAP's relationships alone, so a store whose
+ * consuming edges are all drawn in `services/<…>/model.likec4` had zero
+ * consumers and earned nothing at all — and a store reached by three models plus
+ * one map edge was graded against the single service the MAP happened to draw
+ * (R1). A model is evidence about the fleet exactly as the map is, so it is read
+ * here and handed to both.
+ *
+ * EXTENDING MODELS ONLY, for the consumer join. An extending model's ids ARE the
+ * map's fully-qualified ids — one project, one id space — so `counterpartId`
+ * joins to a drawn element exactly. A standalone model's ids are its own file's,
+ * and `../../../../core/c4/resolve/attested.ts` says outright that a counterpart
+ * is never matched to a landscape element: joining one would file a coincidence
+ * of spelling as a coupling. Standalone models still contribute their attested
+ * CALLS, because `landscape.service-isolated` asks only whether the model
+ * declares any, which is shape-independent.
+ *
+ * A model that does not parse contributes nothing — neither calls nor stores.
+ * `c4.invalid` is that file's finding, and a fleet-shape advisory computed from
+ * a document nobody could read would be an inference about bytes.
+ *
+ * A sub-package of `fleet/` for `./isolation.ts`'s reason and with its rule: it
+ * imports NOTHING from `fleet/`, so the map facts it needs (the resolver, the
+ * ids the map draws at fleet level) arrive on the input record.
+ */
+import { existsSync } from "node:fs";
+import {} from "../../../../core/c4/likec4.js";
+import { attestedCalls } from "../../../../core/c4/resolve/attested.js";
+import { FleetContext } from "../../../../core/fleet-context.js";
+import { inOrder } from "../../../../core/kernel/concurrency.js";
+import {} from "../../../../core/repo/entries.js";
+import { servicePathsAt } from "../../../../core/repo/paths.js";
+import { DATASTORE_KIND } from "../../../../core/vocabulary/maturity.js";
+export async function mapAttestation(input) {
+    // Through the ONE reader of `model.likec4` (`core/c4/service-model/load.ts`),
+    // so a model that EXTENDS the map attests the calls it draws inside the
+    // element the map binds — read as a slice of the per-service project — exactly
+    // as a standalone one attests the calls it draws in its own file. Memoised in
+    // the index, so under `--all` these are hits. Pooled and joined on the entry,
+    // never by index.
+    const context = input.fleet ?? new FleetContext();
+    const present = input.entries.filter((entry) => existsSync(servicePathsAt(entry.dir).model));
+    // ONE workspace for the fleet's models rather than one per service. Both
+    // answers below are about the WHOLE fleet — who else reaches this store is not
+    // a question a narrowed run may answer differently — while `--base` prefetches
+    // only the scope it grades, so without this a scoped run would spin a LikeC4
+    // workspace per un-narrowed service. An accelerator with `prefetchLikeC4`'s
+    // failure story exactly: a batch that cannot run seeds nothing, and every read
+    // below falls back to its own load.
+    await context.prefetchServiceModels(input.docsDir, present.map((entry) => servicePathsAt(entry.dir)));
+    const loaded = await inOrder(present, async (entry) => ({
+        entry,
+        // CONTAINED, for `fleet/load.ts unreadableLandscape`'s reason: this runs on
+        // the landscape target, which sits outside the dispatcher's `guarded`, so a
+        // `model.likec4` that is a directory or carries a permission bit would
+        // otherwise become the whole run's `repository-unavailable` — one file, and
+        // no report at all for the ninety-nine services that are fine. A model that
+        // could not be READ contributes nothing here, exactly as one that did not
+        // parse does; `service.unreadable` is its own target's finding.
+        model: await context.serviceModel(input.docsDir, servicePathsAt(entry.dir)).catch(() => null),
+    }));
+    const models = [];
+    const nestedStores = [];
+    for (const { entry, model } of loaded) {
+        // A model that does not parse attests nothing: `c4.invalid` is its finding.
+        // An extending model whose MAP does not parse could not be read at all, and
+        // neither reader runs in that state anyway — the fleet target returns on
+        // `landscape.invalid` long before here.
+        if (model === null || model.mapUnreadable || model.doc.errors.length > 0)
+            continue;
+        models.push({
+            service: entry.id,
+            extending: model.shape === "extending",
+            calls: attestedCalls(model.doc, entry.id, input.services),
+        });
+        if (model.shape !== "extending")
+            continue;
+        for (const element of model.doc.elements) {
+            if (element.kind.toLowerCase() !== DATASTORE_KIND)
+                continue;
+            // The slice carries the partners this model's own edges point at, and a
+            // partner may be another service's store — so the store is kept only when
+            // the MAP's resolver files it under this service, and only when the map
+            // does not draw it as a peer of the services (which is the fleet-level
+            // census's subject, and a different grade).
+            if (input.standsForService(element))
+                continue;
+            if (input.drawnIds.has(element.id) || input.resolve(element.id) !== entry.id)
+                continue;
+            nestedStores.push({ owner: entry.id, fqn: element.id, title: element.title });
+        }
+    }
+    return { models, nestedStores };
+}
+//# sourceMappingURL=attest.js.map

package/dist/commands/validate/fleet/map/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../../../../src/commands/validate/fleet/map/attest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAa,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAqB,MAAM,yCAAyC,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAEjE,OAAO,EAAqB,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AA8CzE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAkB;IACrD,8EAA8E;IAC9E,wEAAwE;IACxE,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,kBAAkB;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,YAAY,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,yEAAyE;IACzE,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,oCAAoC;IACpC,MAAM,OAAO,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACtD,KAAK;QACL,4EAA4E;QAC5E,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,gEAAgE;QAChE,KAAK,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAC9F,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;QACtC,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,wCAAwC;QACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACnF,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,KAAK,CAAC,KAAK,KAAK,WAAW;YACtC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW;YAAE,SAAS;QAC1C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;gBAAE,SAAS;YAC5D,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,4CAA4C;YAC5C,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,KAAM,KAAK,CAAC,EAAa;gBAAE,SAAS;YACnG,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC","sourcesContent":["/**\n * What the fleet's own `model.likec4` files say, read ONCE for the two map\n * checks that need it: the calls each model attests across its boundary\n * (`./isolation.ts`), and the datastores that live nested inside a service's own\n * element (`../../checks/fleet-shape.ts`).\n *\n * One reader rather than two, because the two checks were answering the same\n * question from different evidence and disagreeing about the fleet. The\n * consumer census walked the MAP's relationships alone, so a store whose\n * consuming edges are all drawn in `services/<…>/model.likec4` had zero\n * consumers and earned nothing at all — and a store reached by three models plus\n * one map edge was graded against the single service the MAP happened to draw\n * (R1). A model is evidence about the fleet exactly as the map is, so it is read\n * here and handed to both.\n *\n * EXTENDING MODELS ONLY, for the consumer join. An extending model's ids ARE the\n * map's fully-qualified ids — one project, one id space — so `counterpartId`\n * joins to a drawn element exactly. A standalone model's ids are its own file's,\n * and `../../../../core/c4/resolve/attested.ts` says outright that a counterpart\n * is never matched to a landscape element: joining one would file a coincidence\n * of spelling as a coupling. Standalone models still contribute their attested\n * CALLS, because `landscape.service-isolated` asks only whether the model\n * declares any, which is shape-independent.\n *\n * A model that does not parse contributes nothing — neither calls nor stores.\n * `c4.invalid` is that file's finding, and a fleet-shape advisory computed from\n * a document nobody could read would be an inference about bytes.\n *\n * A sub-package of `fleet/` for `./isolation.ts`'s reason and with its rule: it\n * imports NOTHING from `fleet/`, so the map facts it needs (the resolver, the\n * ids the map draws at fleet level) arrive on the input record.\n */\nimport { existsSync } from \"node:fs\";\nimport { type Elem } from \"../../../../core/c4/likec4.js\";\nimport { attestedCalls, type AttestedCall } from \"../../../../core/c4/resolve/attested.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { inOrder } from \"../../../../core/kernel/concurrency.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\nimport { type ServiceEntry } from \"../../../../core/repo/entries.js\";\nimport { servicePathsAt } from \"../../../../core/repo/paths.js\";\nimport { DATASTORE_KIND } from \"../../../../core/vocabulary/maturity.js\";\n\n/** One service's model, as the map checks read it. */\nexport interface AttestedModel {\n  /** The service directory this model belongs to. */\n  service: string;\n  /** EXTENDING — and therefore whether `counterpartId` is a map id at all. */\n  extending: boolean;\n  calls: readonly AttestedCall[];\n}\n\n/** A datastore drawn INSIDE the element that resolves to its owner, rather than beside it. */\nexport interface NestedStore {\n  /** The service whose element holds it. */\n  owner: string;\n  /** The store's id as the one project spells it — `marketplace.orderService.db`. */\n  fqn: string;\n  title: string;\n}\n\nexport interface MapAttestation {\n  models: readonly AttestedModel[];\n  nestedStores: readonly NestedStore[];\n}\n\nexport interface AttestInput {\n  docsDir: DocsDir;\n  /** The enumerated services — every one of them, not a candidate subset: both readers ask about the whole fleet. */\n  entries: readonly ServiceEntry[];\n  /** The services/<id>/ directories that exist, as the resolver's `known`. */\n  services: ReadonlySet<string>;\n  /** The MAP's element→service resolver — what decides whose element a nested id sits under. */\n  resolve: (id: string) => string;\n  /**\n   * `census.ts`'s one predicate for \"this element stands for a `services/<id>/`\",\n   * injected because a `fleet/map/` module may not import `fleet/`. A `database`\n   * that IS a service directory is the fleet itself, not a store: the binding\n   * checks grade it, exactly as they do in `./consumers.ts`'s two halves.\n   */\n  standsForService: (e: Elem) => boolean;\n  /** The ids the map draws at FLEET level: a datastore among them is a peer, and the peer census owns it. */\n  drawnIds: ReadonlySet<string>;\n  /** Under `--all` every model.likec4 is already in this memo, so the reads below are hits. */\n  fleet?: FleetContext;\n}\n\nexport async function mapAttestation(input: AttestInput): Promise<MapAttestation> {\n  // Through the ONE reader of `model.likec4` (`core/c4/service-model/load.ts`),\n  // so a model that EXTENDS the map attests the calls it draws inside the\n  // element the map binds — read as a slice of the per-service project — exactly\n  // as a standalone one attests the calls it draws in its own file. Memoised in\n  // the index, so under `--all` these are hits. Pooled and joined on the entry,\n  // never by index.\n  const context = input.fleet ?? new FleetContext();\n  const present = input.entries.filter((entry) => existsSync(servicePathsAt(entry.dir).model));\n  // ONE workspace for the fleet's models rather than one per service. Both\n  // answers below are about the WHOLE fleet — who else reaches this store is not\n  // a question a narrowed run may answer differently — while `--base` prefetches\n  // only the scope it grades, so without this a scoped run would spin a LikeC4\n  // workspace per un-narrowed service. An accelerator with `prefetchLikeC4`'s\n  // failure story exactly: a batch that cannot run seeds nothing, and every read\n  // below falls back to its own load.\n  await context.prefetchServiceModels(input.docsDir, present.map((entry) => servicePathsAt(entry.dir)));\n  const loaded = await inOrder(present, async (entry) => ({\n    entry,\n    // CONTAINED, for `fleet/load.ts unreadableLandscape`'s reason: this runs on\n    // the landscape target, which sits outside the dispatcher's `guarded`, so a\n    // `model.likec4` that is a directory or carries a permission bit would\n    // otherwise become the whole run's `repository-unavailable` — one file, and\n    // no report at all for the ninety-nine services that are fine. A model that\n    // could not be READ contributes nothing here, exactly as one that did not\n    // parse does; `service.unreadable` is its own target's finding.\n    model: await context.serviceModel(input.docsDir, servicePathsAt(entry.dir)).catch(() => null),\n  }));\n\n  const models: AttestedModel[] = [];\n  const nestedStores: NestedStore[] = [];\n  for (const { entry, model } of loaded) {\n    // A model that does not parse attests nothing: `c4.invalid` is its finding.\n    // An extending model whose MAP does not parse could not be read at all, and\n    // neither reader runs in that state anyway — the fleet target returns on\n    // `landscape.invalid` long before here.\n    if (model === null || model.mapUnreadable || model.doc.errors.length > 0) continue;\n    models.push({\n      service: entry.id,\n      extending: model.shape === \"extending\",\n      calls: attestedCalls(model.doc, entry.id, input.services),\n    });\n    if (model.shape !== \"extending\") continue;\n    for (const element of model.doc.elements) {\n      if (element.kind.toLowerCase() !== DATASTORE_KIND) continue;\n      // The slice carries the partners this model's own edges point at, and a\n      // partner may be another service's store — so the store is kept only when\n      // the MAP's resolver files it under this service, and only when the map\n      // does not draw it as a peer of the services (which is the fleet-level\n      // census's subject, and a different grade).\n      if (input.standsForService(element)) continue;\n      if (input.drawnIds.has(element.id) || input.resolve(element.id) !== (entry.id as string)) continue;\n      nestedStores.push({ owner: entry.id, fqn: element.id, title: element.title });\n    }\n  }\n  return { models, nestedStores };\n}\n"]}

package/dist/commands/validate/fleet/map/bindings.js

@@ -0,0 +1,109 @@
+/**
+ * The element↔directory passes of the fleet cross-check: which drawn box
+ * answers for which `services/<id>/`, and what it means when the answer is
+ * none, two, or one nobody owns.
+ *
+ * Lifted out of `../landscape.ts` when that module reached its line limit, and
+ * the seam is a phase rather than a subject: everything here runs after the map
+ * has parsed, reads nothing from disk, and grades exactly one join — the census
+ * `../census.ts` derives against the enumeration `../landscape.ts` performed.
+ * The four grades are ordered as the report reads them, and the ORDER is the
+ * caller's business, which is why this is one function rather than four.
+ *
+ * A sub-package of `fleet/` for `./isolation.ts`'s reason, and with its rule: it
+ * imports NOTHING from `fleet/` itself — a child reaching back into its parent
+ * while the parent calls the child is the package cycle
+ * `scripts/package-graph.mjs` refuses — so the two census derivations arrive as
+ * data on the input record rather than as an import of `../census.js`.
+ */
+import {} from "../../../../core/c4/likec4.js";
+import { elementService } from "../../../../core/c4/resolve/service.js";
+import { EXTERNAL_TAG, INFRA_KINDS } from "../../../../core/vocabulary/maturity.js";
+import {} from "../../../../core/vocabulary/report.js";
+export function bindingFindings(input) {
+    const { elements, drawn, services, pathOf } = input;
+    const findings = [];
+    // Two boxes standing for one service directory. Every join in loam is
+    // `element -> service`, computed by picking the FIRST element that resolves —
+    // so with two of them, which one wins is readdir order, and the edges of the
+    // loser are attributed to a service they do not belong to. Silent until now,
+    // and unfixable by staring at either element on its own.
+    const perService = new Map();
+    for (const e of drawn) {
+        if (e.tags.includes(EXTERNAL_TAG))
+            continue;
+        const id = elementService(e);
+        perService.set(id, [...(perService.get(id) ?? []), e]);
+    }
+    for (const [id, elems] of perService) {
+        if (elems.length < 2)
+            continue;
+        // A collision only matters where it decides something: a real directory to
+        // attribute to, or a binding somebody wrote down on purpose.
+        if (!services.has(id) && !elems.some((e) => e.service !== undefined))
+            continue;
+        findings.push({
+            severity: "warn",
+            code: "landscape.binding-duplicate",
+            subject: id,
+            message: `landscape: ${elems.length} elements resolve to service '${id}' (${elems.map((e) => e.id).join(", ")}) — every element→service join picks one of them arbitrarily, so the others' edges are filed under a service that does not own them; keep one element per services/<id>/`,
+        });
+    }
+    for (const id of services) {
+        if (input.modelled.has(id))
+            continue;
+        findings.push({
+            severity: "error",
+            code: "landscape.service-unmodelled",
+            subject: id,
+            message: `landscape: ${pathOf(id)}/ exists but nothing in architecture/landscape.likec4 models it — add an element, or bind one with metadata { service '${id}' }`,
+        });
+    }
+    // A binding is a claim about this repo wherever it is written — including
+    // inside another element, which the old top-level filter never looked at, so
+    // a typo one level down bound an edge to a service that does not exist and
+    // nothing said so. Every element with a binding answers for it, at any depth.
+    for (const e of elements) {
+        if (e.tags.includes(EXTERNAL_TAG) || e.service === undefined)
+            continue;
+        if (services.has(e.service))
+            continue;
+        findings.push({
+            severity: "error",
+            code: "landscape.binding-unknown",
+            subject: e.service,
+            message: `landscape: '${e.title}' binds to service '${e.service}', but services/${e.service}/ does not exist`,
+        });
+    }
+    // Walked over the SYSTEM census — the same derivation the scorecard counts,
+    // so the map's exemptions and the fleet rollup cannot drift — with the two
+    // residual skips that are not exemptions: a bound element is the binding
+    // pass's subject above, and a title naming a real directory is documented.
+    //
+    // Infrastructure the fleet OWNS is out of `systems` upstream, in
+    // `../census.ts drawnSystems` (INFRA_KINDS), and it had to be: this message
+    // offers exactly two remedies and BOTH are false of an owned datastore — there
+    // is no `services/<id>/` to bind, and `#external` would claim somebody else
+    // runs it. Measured on a one-service fixture drawing an owned `database` at
+    // fleet level (2026-09-07), it fired here and had no correct fix.
+    for (const e of input.systems) {
+        if (e.service !== undefined)
+            continue; // graded by the binding pass above
+        if (services.has(e.title))
+            continue;
+        findings.push({
+            severity: "warn",
+            code: "landscape.service-undocumented",
+            subject: e.title,
+            // The third remedy is spelled from `INFRA_KINDS` rather than typed out,
+            // for the reason the set exists at all: the hook is a kind NAME, so a
+            // fleet whose specification spells its store `postgres` still lands here,
+            // and this sentence is the only place that tells its author which
+            // spellings loam reads. A prose copy would be a second list free to drift
+            // from the one the census walks.
+            message: `landscape: '${e.title}' has no services/${e.title}/ — bind it with metadata { service '<id>' }, tag it #${EXTERNAL_TAG} if it is not ours, or give it one of the kinds loam reads as infrastructure (${[...INFRA_KINDS].join(", ")}) if it is a store, queue or bucket the fleet runs rather than a system somebody adopts`,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=bindings.js.map

package/dist/commands/validate/fleet/map/bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.js","sourceRoot":"","sources":["../../../../../src/commands/validate/fleet/map/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAa,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AAiBrE,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,sEAAsE;IACtE,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7B,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;YAAE,SAAS;QAC/E,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,cAAc,KAAK,CAAC,MAAM,iCAAiC,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0KAA0K;SACxR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACrC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,cAAc,MAAM,CAAC,EAAE,CAAC,0HAA0H,EAAE,KAAK;SACnK,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACvE,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,eAAe,CAAC,CAAC,KAAK,uBAAuB,CAAC,CAAC,OAAO,mBAAmB,CAAC,CAAC,OAAO,kBAAkB;SAC9G,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,EAAE;IACF,iEAAiE;IACjE,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,kEAAkE;IAClE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS,CAAC,mCAAmC;QAC1E,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,SAAS;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,CAAC,CAAC,KAAK;YAChB,wEAAwE;YACxE,sEAAsE;YACtE,0EAA0E;YAC1E,kEAAkE;YAClE,0EAA0E;YAC1E,iCAAiC;YACjC,OAAO,EAAE,eAAe,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC,KAAK,yDAAyD,YAAY,iFAAiF,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yFAAyF;SACtU,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The element↔directory passes of the fleet cross-check: which drawn box\n * answers for which `services/<id>/`, and what it means when the answer is\n * none, two, or one nobody owns.\n *\n * Lifted out of `../landscape.ts` when that module reached its line limit, and\n * the seam is a phase rather than a subject: everything here runs after the map\n * has parsed, reads nothing from disk, and grades exactly one join — the census\n * `../census.ts` derives against the enumeration `../landscape.ts` performed.\n * The four grades are ordered as the report reads them, and the ORDER is the\n * caller's business, which is why this is one function rather than four.\n *\n * A sub-package of `fleet/` for `./isolation.ts`'s reason, and with its rule: it\n * imports NOTHING from `fleet/` itself — a child reaching back into its parent\n * while the parent calls the child is the package cycle\n * `scripts/package-graph.mjs` refuses — so the two census derivations arrive as\n * data on the input record rather than as an import of `../census.js`.\n */\nimport { type Elem } from \"../../../../core/c4/likec4.js\";\nimport { elementService } from \"../../../../core/c4/resolve/service.js\";\nimport { EXTERNAL_TAG, INFRA_KINDS } from \"../../../../core/vocabulary/maturity.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\n\nexport interface BindingInput {\n  /** Every element the map declares, at any depth — a binding answers for itself wherever it is written. */\n  elements: Elem[];\n  /** Service-LEVEL elements (`census.ts serviceLevelElements`) — the fleet map's own boxes. */\n  drawn: Elem[];\n  /** The drawn SYSTEMS (`census.ts drawnSystems`) — `drawn` minus what the map itself says is no service. */\n  systems: Elem[];\n  /** The services/<id>/ directories that exist. */\n  services: ReadonlySet<string>;\n  /** The services some element resolves to — the set `landscape.service-unmodelled` reads. */\n  modelled: ReadonlySet<string>;\n  /** Where a service's directory sits, repo-relative — the enumeration's answer, never `services/<id>`. */\n  pathOf: (id: string) => string;\n}\n\nexport function bindingFindings(input: BindingInput): Finding[] {\n  const { elements, drawn, services, pathOf } = input;\n  const findings: Finding[] = [];\n\n  // Two boxes standing for one service directory. Every join in loam is\n  // `element -> service`, computed by picking the FIRST element that resolves —\n  // so with two of them, which one wins is readdir order, and the edges of the\n  // loser are attributed to a service they do not belong to. Silent until now,\n  // and unfixable by staring at either element on its own.\n  const perService = new Map<string, Elem[]>();\n  for (const e of drawn) {\n    if (e.tags.includes(EXTERNAL_TAG)) continue;\n    const id = elementService(e);\n    perService.set(id, [...(perService.get(id) ?? []), e]);\n  }\n  for (const [id, elems] of perService) {\n    if (elems.length < 2) continue;\n    // A collision only matters where it decides something: a real directory to\n    // attribute to, or a binding somebody wrote down on purpose.\n    if (!services.has(id) && !elems.some((e) => e.service !== undefined)) continue;\n    findings.push({\n      severity: \"warn\",\n      code: \"landscape.binding-duplicate\",\n      subject: id,\n      message: `landscape: ${elems.length} elements resolve to service '${id}' (${elems.map((e) => e.id).join(\", \")}) — every element→service join picks one of them arbitrarily, so the others' edges are filed under a service that does not own them; keep one element per services/<id>/`,\n    });\n  }\n\n  for (const id of services) {\n    if (input.modelled.has(id)) continue;\n    findings.push({\n      severity: \"error\",\n      code: \"landscape.service-unmodelled\",\n      subject: id,\n      message: `landscape: ${pathOf(id)}/ exists but nothing in architecture/landscape.likec4 models it — add an element, or bind one with metadata { service '${id}' }`,\n    });\n  }\n\n  // A binding is a claim about this repo wherever it is written — including\n  // inside another element, which the old top-level filter never looked at, so\n  // a typo one level down bound an edge to a service that does not exist and\n  // nothing said so. Every element with a binding answers for it, at any depth.\n  for (const e of elements) {\n    if (e.tags.includes(EXTERNAL_TAG) || e.service === undefined) continue;\n    if (services.has(e.service)) continue;\n    findings.push({\n      severity: \"error\",\n      code: \"landscape.binding-unknown\",\n      subject: e.service,\n      message: `landscape: '${e.title}' binds to service '${e.service}', but services/${e.service}/ does not exist`,\n    });\n  }\n\n  // Walked over the SYSTEM census — the same derivation the scorecard counts,\n  // so the map's exemptions and the fleet rollup cannot drift — with the two\n  // residual skips that are not exemptions: a bound element is the binding\n  // pass's subject above, and a title naming a real directory is documented.\n  //\n  // Infrastructure the fleet OWNS is out of `systems` upstream, in\n  // `../census.ts drawnSystems` (INFRA_KINDS), and it had to be: this message\n  // offers exactly two remedies and BOTH are false of an owned datastore — there\n  // is no `services/<id>/` to bind, and `#external` would claim somebody else\n  // runs it. Measured on a one-service fixture drawing an owned `database` at\n  // fleet level (2026-09-07), it fired here and had no correct fix.\n  for (const e of input.systems) {\n    if (e.service !== undefined) continue; // graded by the binding pass above\n    if (services.has(e.title)) continue;\n    findings.push({\n      severity: \"warn\",\n      code: \"landscape.service-undocumented\",\n      subject: e.title,\n      // The third remedy is spelled from `INFRA_KINDS` rather than typed out,\n      // for the reason the set exists at all: the hook is a kind NAME, so a\n      // fleet whose specification spells its store `postgres` still lands here,\n      // and this sentence is the only place that tells its author which\n      // spellings loam reads. A prose copy would be a second list free to drift\n      // from the one the census walks.\n      message: `landscape: '${e.title}' has no services/${e.title}/ — bind it with metadata { service '<id>' }, tag it #${EXTERNAL_TAG} if it is not ours, or give it one of the kinds loam reads as infrastructure (${[...INFRA_KINDS].join(\", \")}) if it is a store, queue or bucket the fleet runs rather than a system somebody adopts`,\n    });\n  }\n\n  return findings;\n}\n"]}

package/dist/commands/validate/fleet/map/consumers.js

@@ -0,0 +1,219 @@
+/**
+ * Who consumes a drawn element — and the datastore grade that reads the answer.
+ *
+ * The census used to walk the MAP's relationships alone, and under the extending
+ * shape that is a partial view of the fleet: a service draws the container-level
+ * call in its own `model.likec4` and the map carries the service-level twin, so a
+ * store whose consuming edges were all drawn in models had ZERO consumers and
+ * was graded on the one service the map happened to draw (R1). A model is
+ * evidence about the fleet exactly as the map is, so both are counted here,
+ * once, by one derivation two checks share.
+ *
+ * WHERE A STORE LIVES IS THE TEAM'S CHOICE, and this module used to say the
+ * opposite at length. Nested under the element that resolves to its owner — in
+ * that service's `extend <fqn> { store = database … }` block, or inside its
+ * element on the map — and drawn as a fleet-level PEER are both first-class
+ * placements, and loam grades neither as wrong. `landscape.datastore-private`
+ * existed to push every one-consumer store into the first, its whole message a
+ * prescription to delete the peer; it is retired (2026-09-07), the arm below is
+ * gone, and no message here prescribes a move.
+ *
+ * What survives the retirement is the one CONSEQUENCE, which is a fact about
+ * LikeC4 rather than a preference: a per-service project is `architecture/` plus
+ * that ONE model, so an edge naming `<owner-fqn>.<store>` resolves for a SECOND
+ * service only when the MAP declares the store. Written in the owner's `extend`
+ * block instead, the same edge is two errors on the consumer's own model
+ * ("Could not resolve reference to Referenceable named 'store'"). That is the
+ * load-bearing half, it is stated by `reversibility` below where it actually
+ * bites, and SCHEMA carries the same sentence.
+ *
+ * The choice is cheap, and the surviving message says exactly HOW cheap, because
+ * "reversible" was false in the one state that used to assert it. The two
+ * placements do give the store the same id, `<owner-fqn>.<store>` — but the
+ * move is only free in ONE direction once a second service names it. Measured
+ * on `examples/docs`: moving `db` out of order-service's `extend` block into
+ * `orderService` on the map left the model at 12 elements · 8 relationships,
+ * left `Covers: marketplace.orderService.db` in its arch.spec.md resolving, and
+ * left checkout-web's container-level edge to it resolving too. Moving it BACK
+ * with that second edge drawn is two errors on checkout-web's own model
+ * ("Could not resolve reference to Referenceable named 'db'"), or
+ * `landscape.invalid` plus one `spine.landscape-invalid` per service when the
+ * second edge is drawn on the map — because an `extend` block is visible to its
+ * own service's project alone. `datastore-shared` printed the unconditional
+ * clause in 100% of the states it fires in, every one of which already has the
+ * second consumer that makes map→extend break (verification 2026-09-04). So the
+ * rule the message states is directional: extend→map is always safe; map→extend
+ * only while no other service's model or map edge names the store.
+ *
+ * A sub-package of `fleet/` for `./isolation.ts`'s reason and with its rule: it
+ * imports NOTHING from `fleet/`, so the map facts it reads arrive on the input
+ * records the caller fills.
+ */
+import {} from "../../../../core/c4/likec4.js";
+import { DATASTORE_KIND } from "../../../../core/vocabulary/maturity.js";
+import {} from "../../../../core/vocabulary/report.js";
+import {} from "./attest.js";
+/**
+ * Distinct consumer SERVICES of an element, its nested children included: an
+ * edge into `kafka.paymentEvents` is consumption of `kafka`.
+ *
+ * Two kinds of evidence, unioned. From the MAP: a relationship whose target is
+ * the element or a descendant and whose source the shared resolver files under a
+ * real `services/<id>/` — persons, other external systems and unresolved sources
+ * never count, and two edges from one service are one consumer. From the
+ * MODELS: a service whose own model attests an OUTBOUND call at the element or a
+ * descendant.
+ *
+ * The model half reads EXTENDING models only, and the reason is the id space. An
+ * extending model's ids are the map's fully-qualified ids — one project — so the
+ * join is exact. A standalone model's ids are its own file's, and
+ * `core/c4/resolve/attested.ts` says outright that a counterpart is never
+ * matched to a landscape element: joining one would file a coincidence of
+ * spelling as a coupling between two services.
+ */
+export function consumerCensus(input) {
+    const reaches = (elementId, id) => id === elementId || id.startsWith(`${elementId}.`);
+    return (elementId) => {
+        const out = new Set();
+        for (const r of input.relationships) {
+            if (!reaches(elementId, r.target))
+                continue;
+            const svc = input.resolve(r.source);
+            if (input.services.has(svc))
+                out.add(svc);
+        }
+        for (const model of input.attested) {
+            if (!model.extending)
+                continue;
+            if (model.calls.some((c) => c.direction === "out" && reaches(elementId, c.counterpartId))) {
+                out.add(model.service);
+            }
+        }
+        return [...out].sort();
+    };
+}
+/**
+ * A datastore two or more services reach is the strongest coupling two services
+ * can have and the hardest to undo, which deserves to be STATED rather than
+ * inferred. That is the whole of this grade now, and it applies to both
+ * placements alike: a fleet-level peer and a store nested under its owner earn
+ * the same `landscape.datastore-shared` at two consumers, and neither is graded
+ * at one.
+ *
+ * The one-consumer arm is gone (2026-09-07). A fleet-level peer with a single
+ * consumer used to be `landscape.datastore-private` — "drawn as a peer it reads
+ * as a system in its own right … delete this peer" — which made WHERE a store is
+ * drawn a restriction rather than the team's choice. It was never a fact about
+ * the fleet: the same store, nested, was silent, so the finding graded the
+ * drawing and not the architecture. The nested half was ALREADY silent at one
+ * consumer, and it is that half's rule that now holds for both.
+ */
+export function datastoreFindings(input) {
+    const findings = [];
+    for (const e of input.drawn) {
+        // An element that stands for a real service is the fleet itself, not its
+        // shape; a datastore bound to a directory is graded by the binding checks.
+        if (input.standsForService(e))
+            continue;
+        if (e.kind.toLowerCase() !== DATASTORE_KIND)
+            continue;
+        const consumers = input.consumers(e.id);
+        // One consumer is a store that service owns, drawn where the team chose to
+        // draw it — a fact about the map's layout, not about the fleet. Zero is a
+        // store nothing reaches, which was never graded here either.
+        if (consumers.length < 2)
+            continue;
+        findings.push(sharedFinding(e.title, consumers, "", ""));
+    }
+    for (const store of nestedStoresOf(input)) {
+        // The owner is a consumer by construction — the store sits inside the element
+        // that resolves to it — so silence at one consumer IS the fixed state, and
+        // the only question left is whether a second service reaches the same data.
+        const consumers = [...new Set([store.owner, ...input.consumers(store.fqn)])].sort();
+        if (consumers.length < 2)
+            continue;
+        findings.push(sharedFinding(store.title, consumers, 
+        // The store's own id, and said as such. The clause read "nested under
+        // '<fqn>'", which sends a reader looking for an element that HOLDS the
+        // store — when that id IS the store, and its container is its prefix.
+        ` — ${store.owner}'s own store, written as '${store.fqn}'`, reversibility(store, consumers.filter((c) => c !== store.owner))));
+    }
+    return findings;
+}
+/**
+ * Every store nested under the element that resolves to its owner, from both
+ * places the stance allows one to be written: inside the service's element ON
+ * THE MAP, and in the service's own extending model. Keyed by fqn, so a
+ * map-declared store — which the owner's model slice carries too, since a slice
+ * is everything resolving to the service — is one store and not two.
+ *
+ * Both sources are needed and neither is redundant. The map's covers a service
+ * whose model is standalone or absent (no slice to read); the model's covers a
+ * store the map never draws, which is the placement the adopt brief prescribes.
+ */
+function nestedStoresOf(input) {
+    const drawnIds = new Set(input.drawn.map((e) => e.id));
+    const byFqn = new Map();
+    for (const e of input.elements) {
+        if (e.kind.toLowerCase() !== DATASTORE_KIND || drawnIds.has(e.id))
+            continue;
+        // The peer branch's guard, which this half was missing: a `database` bound
+        // with `metadata { service '<id>' }` and drawn one level down became a store
+        // "owned" by its own binding, so a second reader made it a shared datastore
+        // and the fix offered was to give each service its own copy of a service.
+        if (input.standsForService(e))
+            continue;
+        const owner = input.resolve(e.id);
+        if (!input.services.has(owner))
+            continue;
+        byFqn.set(e.id, { owner, fqn: e.id, title: e.title });
+    }
+    for (const store of input.nestedStores)
+        if (!byFqn.has(store.fqn))
+            byFqn.set(store.fqn, store);
+    return [...byFqn.values()];
+}
+/**
+ * Which way the store may still be moved, now that a second service reaches it.
+ *
+ * The clause this replaces said the two placements were interchangeable — "the
+ * two placements give it the same id … so moving the declaration between them
+ * rewrites no edge" — and that is false in every state `datastore-shared` fires
+ * in, because the finding needs a second consumer and a second consumer's edge
+ * resolves only against a store the MAP declares (a per-service project is
+ * `architecture/` plus one model). Measured: performing the move the sentence
+ * called free turned a clean `examples/docs` into `c4.invalid` on the consumer's
+ * model, or into `landscape.invalid` + one `spine.landscape-invalid` per service
+ * when the second edge is on the map (verification 2026-09-04).
+ *
+ * The direction is stated rather than the current placement, and it holds
+ * either way round: out of the owner's `extend` block onto the map is always
+ * safe, back in is not while another service names the store. (In practice a
+ * store this finding reaches is one the MAP declares — a second consumer's edge
+ * cannot resolve against an `extend` block, so it could never have been drawn
+ * — which is the same fact said from the other side.)
+ */
+function reversibility(store, others) {
+    const named = others.length === 1 ? `${others[0]}'s edge` : `${others.join(", ")}'s edges`;
+    return (`. Both placements give it the same id, ${store.fqn}, but with a second consumer the move is ONE-WAY: ` +
+        `${named} resolves only against a declaration the MAP holds — a per-service project is \`architecture/\` ` +
+        `plus one model, so an \`extend\` block is visible to its own service's project alone. Out of ` +
+        `${store.owner}'s \`extend\` block onto ${store.owner}'s element on the map is always safe; moving it ` +
+        `back INTO the \`extend\` block breaks that edge — \`c4.invalid\` on the other service's model, or ` +
+        `\`landscape.invalid\` when the edge is drawn on the map`);
+}
+/** The two-or-more message, shared by the peer and the nested store — one word about coupling, once. */
+function sharedFinding(title, consumers, where, tail) {
+    return {
+        severity: "warn",
+        code: "landscape.datastore-shared",
+        subject: title,
+        message: `landscape: '${title}' is a datastore shared by ${consumers.length} services ` +
+            `(${consumers.join(", ")})${where} — the strongest coupling two services can have, and the ` +
+            `hardest to undo. Shared means the same DATA: if they read the same tables or keys, keep it ` +
+            `where it is and let this warning state the coupling; if they only share a host or cluster ` +
+            `(two schemas, two lock paths), that is operational blast radius — a runbook fact — and the ` +
+            `honest model is one private store per service${tail}`,
+    };
+}
+//# sourceMappingURL=consumers.js.map

package/dist/commands/validate/fleet/map/consumers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumers.js","sourceRoot":"","sources":["../../../../../src/commands/validate/fleet/map/consumers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAAuB,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAwC,MAAM,aAAa,CAAC;AAanE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAU,EAAW,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC;IAC/G,OAAO,CAAC,SAAiB,EAAY,EAAE;QACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,SAAS;gBAAE,SAAS;YAC/B,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;gBAC1F,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AA0BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAqB;IACrD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;YAAE,SAAS;QACtD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxC,2EAA2E;QAC3E,0EAA0E;QAC1E,6DAA6D;QAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACnC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,8EAA8E;QAC9E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACnC,QAAQ,CAAC,IAAI,CACX,aAAa,CACX,KAAK,CAAC,KAAK,EACX,SAAS;QACT,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,KAAK,CAAC,KAAK,6BAA6B,KAAK,CAAC,GAAG,GAAG,EAC1D,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CACjE,CACF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,KAAqB;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACzC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,YAAY;QAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,aAAa,CAAC,KAAkB,EAAE,MAAgB;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;IAC5F,OAAO,CACL,0CAA0C,KAAK,CAAC,GAAG,oDAAoD;QACvG,GAAG,KAAK,kGAAkG;QAC1G,+FAA+F;QAC/F,GAAG,KAAK,CAAC,KAAK,4BAA4B,KAAK,CAAC,KAAK,kDAAkD;QACvG,oGAAoG;QACpG,yDAAyD,CAC1D,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,aAAa,CAAC,KAAa,EAAE,SAAmB,EAAE,KAAa,EAAE,IAAY;IACpF,OAAO;QACL,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,KAAK;QACd,OAAO,EACL,eAAe,KAAK,8BAA8B,SAAS,CAAC,MAAM,YAAY;YAC9E,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,2DAA2D;YAC5F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,gDAAgD,IAAI,EAAE;KACzD,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Who consumes a drawn element — and the datastore grade that reads the answer.\n *\n * The census used to walk the MAP's relationships alone, and under the extending\n * shape that is a partial view of the fleet: a service draws the container-level\n * call in its own `model.likec4` and the map carries the service-level twin, so a\n * store whose consuming edges were all drawn in models had ZERO consumers and\n * was graded on the one service the map happened to draw (R1). A model is\n * evidence about the fleet exactly as the map is, so both are counted here,\n * once, by one derivation two checks share.\n *\n * WHERE A STORE LIVES IS THE TEAM'S CHOICE, and this module used to say the\n * opposite at length. Nested under the element that resolves to its owner — in\n * that service's `extend <fqn> { store = database … }` block, or inside its\n * element on the map — and drawn as a fleet-level PEER are both first-class\n * placements, and loam grades neither as wrong. `landscape.datastore-private`\n * existed to push every one-consumer store into the first, its whole message a\n * prescription to delete the peer; it is retired (2026-09-07), the arm below is\n * gone, and no message here prescribes a move.\n *\n * What survives the retirement is the one CONSEQUENCE, which is a fact about\n * LikeC4 rather than a preference: a per-service project is `architecture/` plus\n * that ONE model, so an edge naming `<owner-fqn>.<store>` resolves for a SECOND\n * service only when the MAP declares the store. Written in the owner's `extend`\n * block instead, the same edge is two errors on the consumer's own model\n * (\"Could not resolve reference to Referenceable named 'store'\"). That is the\n * load-bearing half, it is stated by `reversibility` below where it actually\n * bites, and SCHEMA carries the same sentence.\n *\n * The choice is cheap, and the surviving message says exactly HOW cheap, because\n * \"reversible\" was false in the one state that used to assert it. The two\n * placements do give the store the same id, `<owner-fqn>.<store>` — but the\n * move is only free in ONE direction once a second service names it. Measured\n * on `examples/docs`: moving `db` out of order-service's `extend` block into\n * `orderService` on the map left the model at 12 elements · 8 relationships,\n * left `Covers: marketplace.orderService.db` in its arch.spec.md resolving, and\n * left checkout-web's container-level edge to it resolving too. Moving it BACK\n * with that second edge drawn is two errors on checkout-web's own model\n * (\"Could not resolve reference to Referenceable named 'db'\"), or\n * `landscape.invalid` plus one `spine.landscape-invalid` per service when the\n * second edge is drawn on the map — because an `extend` block is visible to its\n * own service's project alone. `datastore-shared` printed the unconditional\n * clause in 100% of the states it fires in, every one of which already has the\n * second consumer that makes map→extend break (verification 2026-09-04). So the\n * rule the message states is directional: extend→map is always safe; map→extend\n * only while no other service's model or map edge names the store.\n *\n * A sub-package of `fleet/` for `./isolation.ts`'s reason and with its rule: it\n * imports NOTHING from `fleet/`, so the map facts it reads arrive on the input\n * records the caller fills.\n */\nimport { type Elem, type Rel } from \"../../../../core/c4/likec4.js\";\nimport { DATASTORE_KIND } from \"../../../../core/vocabulary/maturity.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { type AttestedModel, type NestedStore } from \"./attest.js\";\n\nexport interface CensusInput {\n  /** The map's own edges — a service-level twin is what the map carries of a container-level call. */\n  relationships: Rel[];\n  /** The services/<id>/ directories that exist: a consumer is a source filed under a real one. */\n  services: ReadonlySet<string>;\n  /** The shared element→service resolver every edge join uses. */\n  resolve: (id: string) => string;\n  /** What each service's own model attests (`./attest.ts`). */\n  attested: readonly AttestedModel[];\n}\n\n/**\n * Distinct consumer SERVICES of an element, its nested children included: an\n * edge into `kafka.paymentEvents` is consumption of `kafka`.\n *\n * Two kinds of evidence, unioned. From the MAP: a relationship whose target is\n * the element or a descendant and whose source the shared resolver files under a\n * real `services/<id>/` — persons, other external systems and unresolved sources\n * never count, and two edges from one service are one consumer. From the\n * MODELS: a service whose own model attests an OUTBOUND call at the element or a\n * descendant.\n *\n * The model half reads EXTENDING models only, and the reason is the id space. An\n * extending model's ids are the map's fully-qualified ids — one project — so the\n * join is exact. A standalone model's ids are its own file's, and\n * `core/c4/resolve/attested.ts` says outright that a counterpart is never\n * matched to a landscape element: joining one would file a coincidence of\n * spelling as a coupling between two services.\n */\nexport function consumerCensus(input: CensusInput): (elementId: string) => string[] {\n  const reaches = (elementId: string, id: string): boolean => id === elementId || id.startsWith(`${elementId}.`);\n  return (elementId: string): string[] => {\n    const out = new Set<string>();\n    for (const r of input.relationships) {\n      if (!reaches(elementId, r.target)) continue;\n      const svc = input.resolve(r.source);\n      if (input.services.has(svc)) out.add(svc);\n    }\n    for (const model of input.attested) {\n      if (!model.extending) continue;\n      if (model.calls.some((c) => c.direction === \"out\" && reaches(elementId, c.counterpartId))) {\n        out.add(model.service);\n      }\n    }\n    return [...out].sort();\n  };\n}\n\nexport interface DatastoreInput {\n  /** Service-LEVEL elements — the fleet map's own boxes, where a store drawn as a peer is found. */\n  drawn: Elem[];\n  /** Every element the MAP declares, at any depth — the other place a nested store is written. */\n  elements: Elem[];\n  /** Stores an extending model declares inside its own element (`./attest.ts`). */\n  nestedStores: readonly NestedStore[];\n  /** The services/<id>/ directories that exist. */\n  services: ReadonlySet<string>;\n  /** The shared element→service resolver, for naming the consumer's own element on the map. */\n  resolve: (id: string) => string;\n  /**\n   * `census.ts`'s one predicate for \"this element stands for a `services/<id>/`\",\n   * injected because a `fleet/map/` module may not import `fleet/`. Both halves\n   * of the grade below skip such an element: it is the fleet itself, not its\n   * shape, and a store bound to a directory is the binding checks' subject.\n   * `./attest.ts` applies the same predicate to the stores a MODEL declares, so\n   * all three places answer it once.\n   */\n  standsForService: (e: Elem) => boolean;\n  /** The census above, built once and shared with the platform-candidate advisory. */\n  consumers: (elementId: string) => string[];\n}\n\n/**\n * A datastore two or more services reach is the strongest coupling two services\n * can have and the hardest to undo, which deserves to be STATED rather than\n * inferred. That is the whole of this grade now, and it applies to both\n * placements alike: a fleet-level peer and a store nested under its owner earn\n * the same `landscape.datastore-shared` at two consumers, and neither is graded\n * at one.\n *\n * The one-consumer arm is gone (2026-09-07). A fleet-level peer with a single\n * consumer used to be `landscape.datastore-private` — \"drawn as a peer it reads\n * as a system in its own right … delete this peer\" — which made WHERE a store is\n * drawn a restriction rather than the team's choice. It was never a fact about\n * the fleet: the same store, nested, was silent, so the finding graded the\n * drawing and not the architecture. The nested half was ALREADY silent at one\n * consumer, and it is that half's rule that now holds for both.\n */\nexport function datastoreFindings(input: DatastoreInput): Finding[] {\n  const findings: Finding[] = [];\n  for (const e of input.drawn) {\n    // An element that stands for a real service is the fleet itself, not its\n    // shape; a datastore bound to a directory is graded by the binding checks.\n    if (input.standsForService(e)) continue;\n    if (e.kind.toLowerCase() !== DATASTORE_KIND) continue;\n    const consumers = input.consumers(e.id);\n    // One consumer is a store that service owns, drawn where the team chose to\n    // draw it — a fact about the map's layout, not about the fleet. Zero is a\n    // store nothing reaches, which was never graded here either.\n    if (consumers.length < 2) continue;\n    findings.push(sharedFinding(e.title, consumers, \"\", \"\"));\n  }\n  for (const store of nestedStoresOf(input)) {\n    // The owner is a consumer by construction — the store sits inside the element\n    // that resolves to it — so silence at one consumer IS the fixed state, and\n    // the only question left is whether a second service reaches the same data.\n    const consumers = [...new Set([store.owner, ...input.consumers(store.fqn)])].sort();\n    if (consumers.length < 2) continue;\n    findings.push(\n      sharedFinding(\n        store.title,\n        consumers,\n        // The store's own id, and said as such. The clause read \"nested under\n        // '<fqn>'\", which sends a reader looking for an element that HOLDS the\n        // store — when that id IS the store, and its container is its prefix.\n        ` — ${store.owner}'s own store, written as '${store.fqn}'`,\n        reversibility(store, consumers.filter((c) => c !== store.owner)),\n      ),\n    );\n  }\n\n  return findings;\n}\n\n/**\n * Every store nested under the element that resolves to its owner, from both\n * places the stance allows one to be written: inside the service's element ON\n * THE MAP, and in the service's own extending model. Keyed by fqn, so a\n * map-declared store — which the owner's model slice carries too, since a slice\n * is everything resolving to the service — is one store and not two.\n *\n * Both sources are needed and neither is redundant. The map's covers a service\n * whose model is standalone or absent (no slice to read); the model's covers a\n * store the map never draws, which is the placement the adopt brief prescribes.\n */\nfunction nestedStoresOf(input: DatastoreInput): NestedStore[] {\n  const drawnIds = new Set(input.drawn.map((e) => e.id));\n  const byFqn = new Map<string, NestedStore>();\n  for (const e of input.elements) {\n    if (e.kind.toLowerCase() !== DATASTORE_KIND || drawnIds.has(e.id)) continue;\n    // The peer branch's guard, which this half was missing: a `database` bound\n    // with `metadata { service '<id>' }` and drawn one level down became a store\n    // \"owned\" by its own binding, so a second reader made it a shared datastore\n    // and the fix offered was to give each service its own copy of a service.\n    if (input.standsForService(e)) continue;\n    const owner = input.resolve(e.id);\n    if (!input.services.has(owner)) continue;\n    byFqn.set(e.id, { owner, fqn: e.id, title: e.title });\n  }\n  for (const store of input.nestedStores) if (!byFqn.has(store.fqn)) byFqn.set(store.fqn, store);\n  return [...byFqn.values()];\n}\n\n/**\n * Which way the store may still be moved, now that a second service reaches it.\n *\n * The clause this replaces said the two placements were interchangeable — \"the\n * two placements give it the same id … so moving the declaration between them\n * rewrites no edge\" — and that is false in every state `datastore-shared` fires\n * in, because the finding needs a second consumer and a second consumer's edge\n * resolves only against a store the MAP declares (a per-service project is\n * `architecture/` plus one model). Measured: performing the move the sentence\n * called free turned a clean `examples/docs` into `c4.invalid` on the consumer's\n * model, or into `landscape.invalid` + one `spine.landscape-invalid` per service\n * when the second edge is on the map (verification 2026-09-04).\n *\n * The direction is stated rather than the current placement, and it holds\n * either way round: out of the owner's `extend` block onto the map is always\n * safe, back in is not while another service names the store. (In practice a\n * store this finding reaches is one the MAP declares — a second consumer's edge\n * cannot resolve against an `extend` block, so it could never have been drawn\n * — which is the same fact said from the other side.)\n */\nfunction reversibility(store: NestedStore, others: string[]): string {\n  const named = others.length === 1 ? `${others[0]!}'s edge` : `${others.join(\", \")}'s edges`;\n  return (\n    `. Both placements give it the same id, ${store.fqn}, but with a second consumer the move is ONE-WAY: ` +\n    `${named} resolves only against a declaration the MAP holds — a per-service project is \\`architecture/\\` ` +\n    `plus one model, so an \\`extend\\` block is visible to its own service's project alone. Out of ` +\n    `${store.owner}'s \\`extend\\` block onto ${store.owner}'s element on the map is always safe; moving it ` +\n    `back INTO the \\`extend\\` block breaks that edge — \\`c4.invalid\\` on the other service's model, or ` +\n    `\\`landscape.invalid\\` when the edge is drawn on the map`\n  );\n}\n\n/** The two-or-more message, shared by the peer and the nested store — one word about coupling, once. */\nfunction sharedFinding(title: string, consumers: string[], where: string, tail: string): Finding {\n  return {\n    severity: \"warn\",\n    code: \"landscape.datastore-shared\",\n    subject: title,\n    message:\n      `landscape: '${title}' is a datastore shared by ${consumers.length} services ` +\n      `(${consumers.join(\", \")})${where} — the strongest coupling two services can have, and the ` +\n      `hardest to undo. Shared means the same DATA: if they read the same tables or keys, keep it ` +\n      `where it is and let this warning state the coupling; if they only share a host or cluster ` +\n      `(two schemas, two lock paths), that is operational blast radius — a runbook fact — and the ` +\n      `honest model is one private store per service${tail}`,\n  };\n}\n"]}