@ybotok/loam 0.2.0-alpha.5 → 0.2.0-alpha.7

package/dist/core/explain/refusals.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../../../src/core/explain/refusals.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EACT,gMAAgM;IAClM,gBAAgB,EACd,4MAA4M;IAC9M,gBAAgB,EACd,oJAAoJ;IACtJ,gBAAgB,EACd,qQAAqQ;IACvQ,gBAAgB,EACd,iNAAiN;IACnN,gBAAgB,EACd,4KAA4K;IAC9K,sBAAsB,EACpB,8LAA8L;IAChM,cAAc,EACZ,oOAAoO;IACtO,6BAA6B,EAC3B,yQAAyQ;IAC3Q,gBAAgB,EACd,gLAAgL;IAClL,cAAc,EACZ,yJAAyJ;IAC3J,qBAAqB,EACnB,qLAAqL;IACvL,gBAAgB,EACd,yLAAyL;IAC3L,kBAAkB,EAChB,oMAAoM;IACtM,gBAAgB,EACd,gMAAgM;IAClM,kBAAkB,EAChB,2NAA2N;IAC7N,oBAAoB,EAClB,sRAAsR;IACxR,gBAAgB,EACd,wIAAwI;IAC1I,oBAAoB,EAClB,wMAAwM;IAC1M,kBAAkB,EAChB,gNAAgN;IAClN,qBAAqB,EACnB,uLAAuL;IACzL,kBAAkB,EAChB,6XAA6X;IAC/X,iBAAiB,EACf,gLAAgL;IAClL,wBAAwB,EACtB,+VAA+V;IACjW,kBAAkB,EAChB,uNAAuN;IACzN,mBAAmB,EACjB,4KAA4K;IAC9K,cAAc,EACZ,uNAAuN;IACzN,kBAAkB,EAChB,mMAAmM;IACrM,aAAa,EACX,uJAAuJ;IACzJ,kBAAkB,EAChB,oJAAoJ;IACtJ,sBAAsB,EACpB,6LAA6L;IAC/L,gBAAgB,EACd,uGAAuG;IACzG,cAAc,EACZ,0MAA0M;IAC5M,kBAAkB,EAChB,wNAAwN;IAC1N,WAAW,EACT,wMAAwM;IAC1M,qBAAqB,EACnB,sOAAsO;IACxO,kBAAkB,EAChB,kOAAkO;IACpO,aAAa,EACX,+JAA+J;IACjK,YAAY,EACV,sNAAsN;IACxN,mBAAmB,EACjB,4NAA4N;IAC9N,mBAAmB,EACjB,oQAAoQ;IACtQ,mBAAmB,EACjB,oSAAoS;IACtS,wBAAwB,EACtB,yOAAyO;IAC3O,wBAAwB,EACtB,+MAA+M;IACjN,uBAAuB,EACrB,mSAAmS;IACrS,QAAQ,EACN,mNAAmN;CACzK,CAAC","sourcesContent":["/**\n * One sentence per envelope refusal code, for `loam explain`.\n *\n * This is the one deliberate restatement in the explain lookup, and the\n * compiler is its drift test: unlike the finding codes — whose prose ships in\n * the /loam-check fix tables and is PARSED at runtime (fix-tables.ts) — the\n * `ErrorCode` union's meanings live only in doc comments, which are erased,\n * so there is no runtime constant to read. `satisfies Record<ErrorCode,\n * string>` makes the pairing exhaustive both ways: a new union member cannot\n * ship without a row here (missing key fails typecheck), and a row for a\n * retired code fails the same way. What tsc cannot pin is accuracy — a\n * reworded doc comment can drift from its sentence — which is why each row\n * stays ONE sentence in the union's own voice (what happened, what it means,\n * whether re-running can work) rather than growing a paragraph of its own.\n */\nimport type { ErrorCode } from \"../envelope/json.js\";\n\nexport const REFUSAL_MEANINGS = {\n  \"no-config\":\n    \"No loam.json at or above the working directory — the repo is not wired to a fleet; run `loam init --docs <dir>` once per repository rather than letting a command guess where the fleet lives.\",\n  \"config-invalid\":\n    \"loam.json exists but cannot be loaded — repair the file (or delete it and re-run `loam init`); the code is distinct from `no-config` because running init over a corrupt config would silently rewrite it.\",\n  \"unknown-target\":\n    \"The name resolves to nothing this command can address — no such service, feature, workflow or subject; the message offers the closest known names.\",\n  \"invalid-option\":\n    \"The invocation itself is wrong — flags that contradict each other, a value that cannot be right, or a mistyped flag or command; nothing was read or written, and with `--json` anywhere in the arguments even commander's own usage errors arrive as this envelope.\",\n  \"already-exists\":\n    \"Refusing to create over something that already exists — a feature directory, a workspace file, a name already claimed in the subsystem namespace — because overwriting would destroy work nobody asked to lose.\",\n  \"sources-absent\":\n    \"`loam vouch` refuses to stamp a document that names no `sources` — with nothing tying the document to code, the staleness signal a vouch exists to power could never fire.\",\n  \"sources-path-missing\":\n    \"`loam vouch` refuses to stamp: a listed source does not exist in the service repo, or is a glob pattern (not supported) — the digest would cover a different file set than the author meant.\",\n  \"not-coherent\":\n    \"`loam archive` refuses: the feature has coherence issues, carried in `issues[]` with a per-issue `overridable` — fix the gating ones, or `--approve` the judgment calls; a refusal `--approve` cannot move says so in the message.\",\n  \"living-outside-requirements\":\n    \"`loam archive` refuses: the LIVING spec holds a requirement outside its `## Requirements` section, and the merge rewrites only that section, so the requirement would land in the file twice — the fix is in the living document, and `--approve` does not override it.\",\n  \"archive-exists\":\n    \"`loam archive` refuses: `features/archive/` already holds a directory for this feature — a destination collision, not a merge problem; move the old archive entry aside first.\",\n  \"merge-failed\":\n    \"The merge — or a journaled writer's one-file commit — could not be computed or was rolled back; the living docs are unchanged, and re-running can work.\",\n  \"rollback-incomplete\":\n    \"A failed write could not be fully undone: some files were not put back, and the message lists them — the one refusal that needs a human before anything else runs against the repo.\",\n  \"feature-active\":\n    \"`loam unarchive` refuses: a `features/` directory for this feature already exists outside the archive, so restoring would write over work in flight — remove or rename it, then re-run.\",\n  \"snapshot-missing\":\n    \"`loam unarchive` refuses: the archive carries no snapshot of what it overwrote (it predates snapshots, or was written by a different loam) — restore the living docs from version control instead.\",\n  \"snapshot-stale\":\n    \"`loam unarchive` refuses: the living docs changed after the archive, so restoring is no longer an undo — re-run with `--force` to restore anyway, deliberately discarding those later changes.\",\n  \"snapshot-corrupt\":\n    \"`loam unarchive` refuses: a snapshot pre-image no longer matches the digest the archive recorded for it, so restoring would write text nobody wrote — `--force` does not override this one; restore from version control.\",\n  \"commit-interrupted\":\n    \"A journaled writer (archive, unarchive, rebase, vouch, new, gherkin, a recording verify) was killed mid-commit and this run cannot repair the leftovers on its own — the docs may be half-written; run the command the message names, or `loam doctor` for the file-by-file account.\",\n  \"restore-failed\":\n    \"`loam unarchive` failed and everything was rolled back — nothing was restored, the living docs are unchanged, and re-running can work.\",\n  \"answers-unreadable\":\n    \"A recording `loam verify` could not read a user-named file — the answers JSON, or a cucumber/contract report — as what it claims to be; fail-closed: nothing was recorded, so fix the file and re-run.\",\n  \"answers-mismatch\":\n    \"The answer set does not answer the current checklist — an id not on it, a claim with no answer, or an entry for a claim a passed report already owns; re-derive the checklist and answer exactly what it asks.\",\n  \"answers-unevidenced\":\n    \"A `confirmed` answer carries no evidence — evidence is `file:line`, and a claim you cannot show is `unconfirmed` with a note saying why, which is a successful record, not a failure.\",\n  \"service-mismatch\":\n    \"A command that must run inside one service's own repository was told `--service` for a service this repository's loam.json does not declare: a recording `loam verify`, whose attestation must be bound to the code it is about; `loam gherkin`, whose .feature files land in that service's checkout; or `loam vouch`, whose `sources` resolve there. Run it from that service's own repo.\",\n  \"unknown-service\":\n    \"Federated verify recording: the selected service is not one this feature's checklist (or the docs repo) knows, so there is nothing its attestation could bind to — fix the id.\",\n  \"repository-unavailable\":\n    \"The repository this operation must be bound to (or read from) cannot be answered for — most commonly a writing `loam verify`, a `loam gherkin` or a `loam vouch` run where loam.json declares no `service` at all (the docs repo, usually), or a docs repo that cannot be enumerated — so the command refuses rather than guessing which service it is about.\",\n  \"record-federated\":\n    \"`loam verify --record` without `--service` over a federated (schema 2) record — the all-at-once form would erase other repositories' attestations, so it is refused naming the attestors; record per service instead.\",\n  \"record-unreadable\":\n    \"A verification.yaml exists but cannot be read as a record — it is never overwritten and never reported as absent; repair it by hand, or re-record from the service's repo.\",\n  \"record-raced\":\n    \"`loam verify --record` found the record changed between its locked read and the swap — an editor or a lock-ignoring writer landed first; nothing was written, and re-running merges over the record as it now stands.\",\n  \"gherkin-conflict\":\n    \"`loam gherkin <FEAT>` would overwrite a `.feature` file owned by another feature still in flight — the whole emission refuses and names the owner; archive or coordinate with that feature first.\",\n  \"vouch-raced\":\n    \"`loam vouch` found the spec changed between reading and stamping — another vouch or an edit landed first; nothing was written, so re-read and re-run.\",\n  \"vouch-unattended\":\n    \"`loam vouch` with nobody on the other end of stdin and no `--yes` — the stamp is a person's claim to have read the document, and nobody was asked.\",\n  \"vouch-unattributable\":\n    \"`loam vouch` could not learn who is vouching — git names no `user.email` here — and a stamp with nobody behind it records only that the word was written; set your git identity and re-run.\",\n  \"vouch-declined\":\n    \"`loam vouch` asked and the person said no — nothing was stamped; a successful refusal, not a failure.\",\n  \"docs-missing\":\n    \"`docsDir` in loam.json points at nothing — the docs repo was never cloned, or the path is wrong; a read command refuses rather than reporting an empty fleet, and `loam doctor` names the wiring to fix.\",\n  \"services-missing\":\n    \"`docsDir` is a directory but holds no `services/` — it is some other directory, most often the service repo itself after a typo; fix the pointer rather than scaffolding a second source of truth beside the real one.\",\n  \"docs-busy\":\n    \"Another loam writer holds the docs repo's advisory lock — nothing was read or written, and re-running once it finishes works; a lock nothing will ever release shows up in `loam doctor` as a blocker.\",\n  \"subsystem-not-empty\":\n    \"`loam subsystem` rm refuses a subsystem that still holds members — services or child subsystems, named in the message — because a destructive command never picks targets the caller did not name; move them out first, then re-run.\",\n  \"move-uncommitted\":\n    \"A subsystem move/rename refuses because git reports uncommitted or untracked paths under a directory being moved — the rename would sweep them into a move nobody reviewed; commit, `git stash -u`, or remove them, then re-run.\",\n  \"move-failed\":\n    \"A subsystem move/rename failed and was rolled back cleanly — every rename undone, the generated views file restored, the docs unchanged; re-running can work.\",\n  \"no-members\":\n    \"`loam open` found no service checkout bound to this docs repo under any scanned root — the workspace would hold only the docs repo; clone a bound checkout beside it, or point `--root` at where the checkouts live.\",\n  \"binding-duplicate\":\n    \"Two discovered repositories' committed loam.json files declare the same `service` for this docs repo — loam will not guess which checkout speaks for the service; narrow the scan with `--root`, or fix the stray binding.\",\n  \"owners-unreadable\":\n    \"`loam list --owners` could not use the named CODEOWNERS file — the path cannot be read, or a line does not parse as `pattern owner…` (the message names the line); fail-closed, because a half-read ownership file must never file a service under the wrong team.\",\n  \"seed-file-invalid\":\n    \"`loam seed`'s fleet file is missing, unreadable, not YAML, the wrong shape, carries an illegal id — or no longer names every existing `services/<id>/` (that refusal lists the exact ids as `missingServices`); the message names the file and line, and editing the file and re-running succeeds.\",\n  \"seed-duplicate-service\":\n    \"fleet.yaml declares one name twice — as two services, or as both a service and an external/subsystem; service ids, subsystem names and externals share one flat namespace, both declaration lines are named, and renaming one fixes it.\",\n  \"seed-unknown-subsystem\":\n    \"A service's `subsystem:` in fleet.yaml names nothing `subsystems:` declares — the message carries a did-you-mean over the names the file really declares; add the subsystem or fix the spelling, then re-run.\",\n  \"seed-landscape-edited\":\n    \"architecture/landscape.likec4 carries hand edits (the line-1 stamp's digest no longer matches) or was authored some other way — `loam seed` never overwrites human work and wrote nothing; fold the edits into fleet.yaml and delete the file, or keep the hand-authored map and stop using seed.\",\n  internal:\n    \"An unexpected throw — the one refusal with no stable meaning; it exists so a `--json` consumer still receives an envelope instead of a stack trace, and a repeatable `internal` is a loam defect worth reporting.\",\n} as const satisfies Record<ErrorCode, string>;\n"]}
+{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../../../src/core/explain/refusals.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EACT,gMAAgM;IAClM,gBAAgB,EACd,4MAA4M;IAC9M,gBAAgB,EACd,oJAAoJ;IACtJ,gBAAgB,EACd,qQAAqQ;IACvQ,gBAAgB,EACd,iNAAiN;IACnN,gBAAgB,EACd,4KAA4K;IAC9K,sBAAsB,EACpB,8LAA8L;IAChM,cAAc,EACZ,oOAAoO;IACtO,6BAA6B,EAC3B,yQAAyQ;IAC3Q,gBAAgB,EACd,gLAAgL;IAClL,cAAc,EACZ,yJAAyJ;IAC3J,qBAAqB,EACnB,qLAAqL;IACvL,gBAAgB,EACd,yLAAyL;IAC3L,kBAAkB,EAChB,oMAAoM;IACtM,gBAAgB,EACd,gMAAgM;IAClM,kBAAkB,EAChB,2NAA2N;IAC7N,oBAAoB,EAClB,sRAAsR;IACxR,gBAAgB,EACd,wIAAwI;IAC1I,oBAAoB,EAClB,wMAAwM;IAC1M,kBAAkB,EAChB,gNAAgN;IAClN,qBAAqB,EACnB,uLAAuL;IACzL,kBAAkB,EAChB,6XAA6X;IAC/X,iBAAiB,EACf,gLAAgL;IAClL,wBAAwB,EACtB,+VAA+V;IACjW,kBAAkB,EAChB,uNAAuN;IACzN,mBAAmB,EACjB,4KAA4K;IAC9K,cAAc,EACZ,uNAAuN;IACzN,kBAAkB,EAChB,mMAAmM;IACrM,aAAa,EACX,uJAAuJ;IACzJ,kBAAkB,EAChB,oJAAoJ;IACtJ,sBAAsB,EACpB,6LAA6L;IAC/L,gBAAgB,EACd,uGAAuG;IACzG,cAAc,EACZ,0MAA0M;IAC5M,kBAAkB,EAChB,wNAAwN;IAC1N,WAAW,EACT,wMAAwM;IAC1M,qBAAqB,EACnB,sOAAsO;IACxO,kBAAkB,EAChB,kOAAkO;IACpO,aAAa,EACX,+JAA+J;IACjK,YAAY,EACV,sNAAsN;IACxN,mBAAmB,EACjB,4NAA4N;IAC9N,mBAAmB,EACjB,oQAAoQ;IACtQ,mBAAmB,EACjB,oSAAoS;IACtS,wBAAwB,EACtB,yOAAyO;IAC3O,wBAAwB,EACtB,+MAA+M;IACjN,uBAAuB,EACrB,8VAA8V;IAChW,QAAQ,EACN,mNAAmN;CACzK,CAAC","sourcesContent":["/**\n * One sentence per envelope refusal code, for `loam explain`.\n *\n * This is the one deliberate restatement in the explain lookup, and the\n * compiler is its drift test: unlike the finding codes — whose prose ships in\n * the /loam-check fix tables and is PARSED at runtime (fix-tables.ts) — the\n * `ErrorCode` union's meanings live only in doc comments, which are erased,\n * so there is no runtime constant to read. `satisfies Record<ErrorCode,\n * string>` makes the pairing exhaustive both ways: a new union member cannot\n * ship without a row here (missing key fails typecheck), and a row for a\n * retired code fails the same way. What tsc cannot pin is accuracy — a\n * reworded doc comment can drift from its sentence — which is why each row\n * stays ONE sentence in the union's own voice (what happened, what it means,\n * whether re-running can work) rather than growing a paragraph of its own.\n */\nimport type { ErrorCode } from \"../envelope/json.js\";\n\nexport const REFUSAL_MEANINGS = {\n  \"no-config\":\n    \"No loam.json at or above the working directory — the repo is not wired to a fleet; run `loam init --docs <dir>` once per repository rather than letting a command guess where the fleet lives.\",\n  \"config-invalid\":\n    \"loam.json exists but cannot be loaded — repair the file (or delete it and re-run `loam init`); the code is distinct from `no-config` because running init over a corrupt config would silently rewrite it.\",\n  \"unknown-target\":\n    \"The name resolves to nothing this command can address — no such service, feature, workflow or subject; the message offers the closest known names.\",\n  \"invalid-option\":\n    \"The invocation itself is wrong — flags that contradict each other, a value that cannot be right, or a mistyped flag or command; nothing was read or written, and with `--json` anywhere in the arguments even commander's own usage errors arrive as this envelope.\",\n  \"already-exists\":\n    \"Refusing to create over something that already exists — a feature directory, a workspace file, a name already claimed in the subsystem namespace — because overwriting would destroy work nobody asked to lose.\",\n  \"sources-absent\":\n    \"`loam vouch` refuses to stamp a document that names no `sources` — with nothing tying the document to code, the staleness signal a vouch exists to power could never fire.\",\n  \"sources-path-missing\":\n    \"`loam vouch` refuses to stamp: a listed source does not exist in the service repo, or is a glob pattern (not supported) — the digest would cover a different file set than the author meant.\",\n  \"not-coherent\":\n    \"`loam archive` refuses: the feature has coherence issues, carried in `issues[]` with a per-issue `overridable` — fix the gating ones, or `--approve` the judgment calls; a refusal `--approve` cannot move says so in the message.\",\n  \"living-outside-requirements\":\n    \"`loam archive` refuses: the LIVING spec holds a requirement outside its `## Requirements` section, and the merge rewrites only that section, so the requirement would land in the file twice — the fix is in the living document, and `--approve` does not override it.\",\n  \"archive-exists\":\n    \"`loam archive` refuses: `features/archive/` already holds a directory for this feature — a destination collision, not a merge problem; move the old archive entry aside first.\",\n  \"merge-failed\":\n    \"The merge — or a journaled writer's one-file commit — could not be computed or was rolled back; the living docs are unchanged, and re-running can work.\",\n  \"rollback-incomplete\":\n    \"A failed write could not be fully undone: some files were not put back, and the message lists them — the one refusal that needs a human before anything else runs against the repo.\",\n  \"feature-active\":\n    \"`loam unarchive` refuses: a `features/` directory for this feature already exists outside the archive, so restoring would write over work in flight — remove or rename it, then re-run.\",\n  \"snapshot-missing\":\n    \"`loam unarchive` refuses: the archive carries no snapshot of what it overwrote (it predates snapshots, or was written by a different loam) — restore the living docs from version control instead.\",\n  \"snapshot-stale\":\n    \"`loam unarchive` refuses: the living docs changed after the archive, so restoring is no longer an undo — re-run with `--force` to restore anyway, deliberately discarding those later changes.\",\n  \"snapshot-corrupt\":\n    \"`loam unarchive` refuses: a snapshot pre-image no longer matches the digest the archive recorded for it, so restoring would write text nobody wrote — `--force` does not override this one; restore from version control.\",\n  \"commit-interrupted\":\n    \"A journaled writer (archive, unarchive, rebase, vouch, new, gherkin, a recording verify) was killed mid-commit and this run cannot repair the leftovers on its own — the docs may be half-written; run the command the message names, or `loam doctor` for the file-by-file account.\",\n  \"restore-failed\":\n    \"`loam unarchive` failed and everything was rolled back — nothing was restored, the living docs are unchanged, and re-running can work.\",\n  \"answers-unreadable\":\n    \"A recording `loam verify` could not read a user-named file — the answers JSON, or a cucumber/contract report — as what it claims to be; fail-closed: nothing was recorded, so fix the file and re-run.\",\n  \"answers-mismatch\":\n    \"The answer set does not answer the current checklist — an id not on it, a claim with no answer, or an entry for a claim a passed report already owns; re-derive the checklist and answer exactly what it asks.\",\n  \"answers-unevidenced\":\n    \"A `confirmed` answer carries no evidence — evidence is `file:line`, and a claim you cannot show is `unconfirmed` with a note saying why, which is a successful record, not a failure.\",\n  \"service-mismatch\":\n    \"A command that must run inside one service's own repository was told `--service` for a service this repository's loam.json does not declare: a recording `loam verify`, whose attestation must be bound to the code it is about; `loam gherkin`, whose .feature files land in that service's checkout; or `loam vouch`, whose `sources` resolve there. Run it from that service's own repo.\",\n  \"unknown-service\":\n    \"Federated verify recording: the selected service is not one this feature's checklist (or the docs repo) knows, so there is nothing its attestation could bind to — fix the id.\",\n  \"repository-unavailable\":\n    \"The repository this operation must be bound to (or read from) cannot be answered for — most commonly a writing `loam verify`, a `loam gherkin` or a `loam vouch` run where loam.json declares no `service` at all (the docs repo, usually), or a docs repo that cannot be enumerated — so the command refuses rather than guessing which service it is about.\",\n  \"record-federated\":\n    \"`loam verify --record` without `--service` over a federated (schema 2) record — the all-at-once form would erase other repositories' attestations, so it is refused naming the attestors; record per service instead.\",\n  \"record-unreadable\":\n    \"A verification.yaml exists but cannot be read as a record — it is never overwritten and never reported as absent; repair it by hand, or re-record from the service's repo.\",\n  \"record-raced\":\n    \"`loam verify --record` found the record changed between its locked read and the swap — an editor or a lock-ignoring writer landed first; nothing was written, and re-running merges over the record as it now stands.\",\n  \"gherkin-conflict\":\n    \"`loam gherkin <FEAT>` would overwrite a `.feature` file owned by another feature still in flight — the whole emission refuses and names the owner; archive or coordinate with that feature first.\",\n  \"vouch-raced\":\n    \"`loam vouch` found the spec changed between reading and stamping — another vouch or an edit landed first; nothing was written, so re-read and re-run.\",\n  \"vouch-unattended\":\n    \"`loam vouch` with nobody on the other end of stdin and no `--yes` — the stamp is a person's claim to have read the document, and nobody was asked.\",\n  \"vouch-unattributable\":\n    \"`loam vouch` could not learn who is vouching — git names no `user.email` here — and a stamp with nobody behind it records only that the word was written; set your git identity and re-run.\",\n  \"vouch-declined\":\n    \"`loam vouch` asked and the person said no — nothing was stamped; a successful refusal, not a failure.\",\n  \"docs-missing\":\n    \"`docsDir` in loam.json points at nothing — the docs repo was never cloned, or the path is wrong; a read command refuses rather than reporting an empty fleet, and `loam doctor` names the wiring to fix.\",\n  \"services-missing\":\n    \"`docsDir` is a directory but holds no `services/` — it is some other directory, most often the service repo itself after a typo; fix the pointer rather than scaffolding a second source of truth beside the real one.\",\n  \"docs-busy\":\n    \"Another loam writer holds the docs repo's advisory lock — nothing was read or written, and re-running once it finishes works; a lock nothing will ever release shows up in `loam doctor` as a blocker.\",\n  \"subsystem-not-empty\":\n    \"`loam subsystem` rm refuses a subsystem that still holds members — services or child subsystems, named in the message — because a destructive command never picks targets the caller did not name; move them out first, then re-run.\",\n  \"move-uncommitted\":\n    \"A subsystem move/rename refuses because git reports uncommitted or untracked paths under a directory being moved — the rename would sweep them into a move nobody reviewed; commit, `git stash -u`, or remove them, then re-run.\",\n  \"move-failed\":\n    \"A subsystem move/rename failed and was rolled back cleanly — every rename undone, the generated views file restored, the docs unchanged; re-running can work.\",\n  \"no-members\":\n    \"`loam open` found no service checkout bound to this docs repo under any scanned root — the workspace would hold only the docs repo; clone a bound checkout beside it, or point `--root` at where the checkouts live.\",\n  \"binding-duplicate\":\n    \"Two discovered repositories' committed loam.json files declare the same `service` for this docs repo — loam will not guess which checkout speaks for the service; narrow the scan with `--root`, or fix the stray binding.\",\n  \"owners-unreadable\":\n    \"`loam list --owners` could not use the named CODEOWNERS file — the path cannot be read, or a line does not parse as `pattern owner…` (the message names the line); fail-closed, because a half-read ownership file must never file a service under the wrong team.\",\n  \"seed-file-invalid\":\n    \"`loam seed`'s fleet file is missing, unreadable, not YAML, the wrong shape, carries an illegal id — or no longer names every existing `services/<id>/` (that refusal lists the exact ids as `missingServices`); the message names the file and line, and editing the file and re-running succeeds.\",\n  \"seed-duplicate-service\":\n    \"fleet.yaml declares one name twice — as two services, or as both a service and an external/subsystem; service ids, subsystem names and externals share one flat namespace, both declaration lines are named, and renaming one fixes it.\",\n  \"seed-unknown-subsystem\":\n    \"A service's `subsystem:` in fleet.yaml names nothing `subsystems:` declares — the message carries a did-you-mean over the names the file really declares; add the subsystem or fix the spelling, then re-run.\",\n  \"seed-landscape-edited\":\n    \"architecture/landscape.likec4 carries hand edits (the line-1 stamp's digest no longer matches) or was authored some other way, which includes anything written ABOVE the scaffold's stub — `loam seed` never overwrites human work and wrote nothing; fold the edits into fleet.yaml and delete the file, or keep the hand-authored map and stop using seed.\",\n  internal:\n    \"An unexpected throw — the one refusal with no stable meaning; it exists so a `--json` consumer still receives an envelope instead of a stack trace, and a repeatable `internal` is a loam defect worth reporting.\",\n} as const satisfies Record<ErrorCode, string>;\n"]}

package/dist/core/explore/explore.js

@@ -16,13 +16,19 @@
  * documentation has got — and stops. Which of those neighbours the feature
  * really touches is a judgement about intent, and loam does not make those.
  *
- * The landscape is parsed ONCE for the whole exploration. Per-service reads of
- * it exist (`brief/landscape.ts`'s `landscapeContext`) and are correct for one service;
+ * "The fleet map" here is the `architecture/` PROJECT — the landscape plus every
+ * other `.likec4` under it, minus the generated views file — and not the
+ * landscape FILE. See the read below for the disagreement that reading one file
+ * caused.
+ *
+ * It is parsed ONCE for the whole exploration. Per-service reads of it exist
+ * (`brief/landscape.ts`'s `landscapeContext`) and are correct for one service;
  * calling one of those per seed is how `validate --all` came to cost 13 seconds
  * on 120 services, and this command sits in front of authoring, where that is
  * the difference between a habit and a thing people skip.
  */
 import { existsSync } from "node:fs";
+import { relative } from "node:path";
 import { FleetContext } from "../fleet-context.js";
 import {} from "../c4/likec4.js";
 import { serviceResolver } from "../c4/resolve/service.js";
@@ -43,9 +49,24 @@ export async function explore(req) {
     const entries = await context.listServices(docsDir);
     const byId = new Map(entries.map((e) => [e.id, e]));
     const known = new Set(byId.keys());
-    const landPath = landscapePath(docsDir);
-    const present = existsSync(landPath);
-    const land = present ? await context.loadLikeC4(landPath) : null;
+    // The `architecture/` PROJECT, never `architecture/landscape.likec4` alone.
+    // The map is a project — the landscape merged with every use case, palette and
+    // second `model { }` block beside it — and reading one file of it made this
+    // command answer differently from `loam adopt` and `loam context` about the
+    // same tree (reproduced: with a broken `architecture/palette.likec4` beside a
+    // landscape that parses, `context checkout-web --json` reported
+    // `landscape.parses: false` while `explore checkout-web --json` reported
+    // `parses: true` and went on to describe every edge). `core/pack/living.ts`
+    // named this module as the last reader that disagreed. Whichever answer is
+    // right, an agent handed both has no way to tell — and the renderer's answer
+    // is the project's.
+    //
+    // `present` stays a fact about the FILE, because that file is the WRITE target:
+    // `loam new`'s scaffold and every brief ask for edits to
+    // `architecture/landscape.likec4` by name, and "the project is empty" is not
+    // the same instruction as "there is no map to edit".
+    const present = existsSync(landscapePath(docsDir));
+    const land = present ? await context.architecture(docsDir) : null;
     const parses = land !== null && land.errors.length === 0;
     const elements = parses ? land.elements : [];
     const relationships = parses ? land.relationships : [];
@@ -79,9 +100,15 @@ export async function explore(req) {
     // other: a service can realize a capability without appearing in its drawn
     // flow, and a flow can pass through a service that has written nothing down.
     //
-    // The scan gates its own load, and this whole block is already behind
-    // `--capability` being passed at all, so an exploration by service or by
-    // operation never touches `architecture/` as a project.
+    // The scan gates its own load — a fleet whose documents mention no reserved
+    // tag never starts LikeC4 for it — and this whole block is behind
+    // `--capability` being passed at all. What it is no longer behind is the
+    // project itself: the read above loads `architecture/` for every exploration,
+    // so a `--capability` run pays for a SECOND parse of the same documents
+    // (`readUseCases` takes a `DocsDir`, not this invocation's memo). Accepted
+    // rather than unnoticed: the alternative is a seam that hands the scan a
+    // pre-loaded project, which is a change to a module five callers share, and
+    // the cost lands only on the flag that already opts into the fleet rollup.
     const capSeeds = [];
     let unresolvedCaps = [];
     if (req.capabilities.length > 0) {
@@ -167,7 +194,15 @@ export async function explore(req) {
         services,
         neighbours: [...ring.keys()].sort(compareIds),
         overlaps,
-        landscape: { present, parses },
+        landscape: {
+            present,
+            parses,
+            broken: land === null
+                ? []
+                : [...new Set(land.errors.map((e) => e.sourceFsPath).filter((p) => p !== undefined))]
+                    .map((abs) => relative(docsDir, abs).split(/[\\/]/).join("/"))
+                    .sort(),
+        },
         scaffold: newCommand(featureId, seeds, known),
     };
 }

package/dist/core/explore/explore.js.map

@@ -1 +1 @@
-{"version":3,"file":"explore.js","sourceRoot":"","sources":["../../../src/core/explore/explore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAY,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAiB,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAwHrE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAmB;IAC/C,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,IAAI,YAAY,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAU,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE/C,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,IAAI;YAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;YAC7C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,EAAE;IACF,sEAAsE;IACtE,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,IAAI,cAAc,GAAa,EAAE,CAAC;IAClC,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,KAAK,MAAM,EAAE,IAAI,uBAAuB,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,kEAAkE;QAClE,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,gCAAgC;QAChC,cAAc,GAAG,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC9B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE9D,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,YAAY;IACZ,EAAE;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAwB;QAC1C,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,gBAAyB,CAAU,CAAC;QAC1E,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,YAAqB,CAAU,CAAC;KACpE,CAAC,CAAC;IAEH,MAAM,OAAO,GAAiD;QAC5D,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC;QAC7E,GAAG,CAAC,GAAG,IAAI,CAAC;aACT,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;KAC3C,CAAC;IAEF,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CACX,MAAM,QAAQ,CAAC;YACb,EAAE;YACF,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,aAAa;YACb,KAAK;YACL,QAAQ;YACR,MAAM;YACN,OAAO;SACR,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAqB,QAAQ;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACnF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;SACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpD,OAAO;QACL,KAAK;QACL,OAAO;QACP,oBAAoB;QACpB,sBAAsB,EAAE,cAAc;QACtC,QAAQ;QACR,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAC7C,QAAQ;QACR,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;QAC9B,QAAQ,EAAE,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC;KAC9C,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The blast radius of a change nobody has written down yet.\n *\n * Everything else in loam answers a question about documents that exist. This\n * module answers the one that comes BEFORE the first document: which services\n * does this feature actually touch? On a fleet of a hundred that call is the\n * hardest one in the cycle and the only one made with no tool in hand —\n * `loam new FEAT-101 --touches a --touches b` takes the answer as an argument\n * and scaffolds whatever it was told. A `--touches` list short by one service\n * is not caught by anything: the feature validates, archives, and ships with a\n * consumer nobody updated.\n *\n * So this states the work the same way `brief/brief.ts` does. It reads the fleet map\n * and the living contracts, reports the ring of services around the seeds, the\n * features already in flight over the same ground, and how far each service's\n * documentation has got — and stops. Which of those neighbours the feature\n * really touches is a judgement about intent, and loam does not make those.\n *\n * The landscape is parsed ONCE for the whole exploration. Per-service reads of\n * it exist (`brief/landscape.ts`'s `landscapeContext`) and are correct for one service;\n * calling one of those per seed is how `validate --all` came to cost 13 seconds\n * on 120 services, and this command sits in front of authoring, where that is\n * the difference between a habit and a thing people skip.\n */\nimport { existsSync } from \"node:fs\";\nimport { FleetContext } from \"../fleet-context.js\";\nimport { type Rel } from \"../c4/likec4.js\";\nimport { serviceResolver } from \"../c4/resolve/service.js\";\nimport { type Maturity } from \"../vocabulary/maturity.js\";\nimport { capabilityRollup, unresolvedCapabilities } from \"../capabilities/rollup.js\";\nimport { compareIds, nearestIds, type ServiceEntry } from \"../repo/entries.js\";\nimport { landscapePath } from \"../repo/paths.js\";\nimport { readUseCases } from \"../usecases/fleet.js\";\nimport { servicesInFlowsClaiming } from \"../usecases/capability.js\";\nimport { describe, newCommand, operationOwner } from \"./describe.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\n\n/** One end of a call the fleet map already draws. */\nexport interface ExploreEdge {\n  /** The service at the other end. */\n  service: string;\n  /** The operationId the call uses, or null for an edge nobody tied to one. */\n  op: string | null;\n  title: string | null;\n}\n\n/**\n * Why a service is in the answer. Seeds were asked for; the rest were derived.\n *\n * A neighbour on both sides of a seed reports `calls-seed` — see the overlap\n * rule in `explore`. The field is a hint about where to look, not a complete\n * description of the edges; `inbound`/`outbound` are that.\n */\nexport type ExploreReason = \"seed\" | \"calls-seed\" | \"called-by-seed\";\n\nexport interface ExploreService {\n  id: string;\n  reason: ExploreReason;\n  /** Whether `services/<id>/` exists at all. */\n  known: boolean;\n  /**\n   * How far this service's documentation has got, or null when it does not\n   * exist yet. A `--touches` naming a service at `empty` or `partial` is a\n   * different job from one naming a vouched service, and the difference decides\n   * whether the feature starts with `loam adopt`.\n   */\n  maturity: Maturity | null;\n  /** What stands between it and `vouched` — `maturityGaps`, so it matches `list --needs-work`. */\n  missing: string[];\n  /** Whether anything in the fleet map resolves to it. */\n  modelled: boolean;\n  /** operationIds its living contract exposes today, `x-loam-remove` markers excluded. */\n  operations: string[];\n  /**\n   * Whether that contract could be read at all, beside the `error` the parser\n   * gave when it could not.\n   *\n   * It rides next to `operations` rather than inside it for the reason `delta`\n   * carries the same pair: an unreadable contract yields an EMPTY operation\n   * list, indistinguishable from a service with no endpoints — and this is the\n   * field the workflow tells an agent to read before deciding whether an\n   * operation it is about to add already exists. Answering `[]` over a YAML\n   * error is how a MODIFIED requirement gets authored as ADDED.\n   */\n  openapi: { unreadable: boolean; error?: string };\n  inbound: ExploreEdge[];\n  outbound: ExploreEdge[];\n}\n\n/** An active feature already working over ground the exploration covers. */\nexport interface ExploreOverlap {\n  feature: string;\n  /** The explored services it already carries a delta for. */\n  services: string[];\n}\n\nexport interface Exploration {\n  /** The seed ids, as asked for. */\n  seeds: string[];\n  /**\n   * Seeds that name no `services/<id>/`, each with the closest real ids. A seed\n   * may legitimately be a service the feature INTRODUCES, so this is reported\n   * rather than refused — but a typo produces exactly the same shape, and the\n   * near-miss list is what tells the two apart.\n   */\n  unknown: Array<{ id: string; nearest: string[] }>;\n  /** Operation seeds that resolved to no service's living contract. */\n  unresolvedOperations: string[];\n  /**\n   * Capability seeds that seeded nothing: not declared in\n   * architecture/capabilities.yaml (the file may not exist at all — explore\n   * refuses nothing, every miss is a field), or declared and realized by no\n   * living requirement. One list on purpose; splitting the two miss kinds\n   * waits for a consumer to ask.\n   */\n  unresolvedCapabilities: string[];\n  /** Seeds first, then the ring, each in id order. */\n  services: ExploreService[];\n  /** Ids the ring added that were not asked for — the candidates to weigh. */\n  neighbours: string[];\n  overlaps: ExploreOverlap[];\n  landscape: { present: boolean; parses: boolean };\n  /**\n   * The literal `loam new` line the seeds imply — seeds only. The ring is\n   * deliberately NOT folded in: this module's whole claim is that it does not\n   * know which neighbours the feature touches, and a command line that quietly\n   * included them would make the guess on the reader's behalf and look derived\n   * while doing it.\n   *\n   * Named for what it does rather than `command`, which is the envelope's key\n   * for the command that RAN. The rename is not cosmetic: `emitJson` spreads\n   * the payload LAST, so a payload field called `command` would silently\n   * OVERRIDE the envelope's — `command` would come back as\n   * `\"loam new FEAT-000 …\"`, and every consumer branching on\n   * `command === \"explore\"` (the same key `status`, `doctor`, `dependencies`,\n   * `archive` and `unarchive` emit) would quietly stop matching, with tsc and\n   * the linter green throughout.\n   */\n  scaffold: string;\n}\n\nexport interface ExploreRequest {\n  docsDir: DocsDir;\n  /** Service ids to explore around. Checked at the command boundary. */\n  services: ServiceEntry[\"id\"][];\n  /** operationIds to explore around; each resolves to the service that defines it. */\n  operations: string[];\n  /** Declared capability ids to explore around; each seeds its realizing services. */\n  capabilities: string[];\n  /** Placeholder feature id for the suggested command line. */\n  featureId: string;\n  context?: FleetContext;\n}\n\n/**\n * Read the fleet around a proposed change. Reads only; writes nothing, and\n * refuses nothing — every miss is reported as a field.\n */\nexport async function explore(req: ExploreRequest): Promise<Exploration> {\n  const { docsDir, featureId } = req;\n  const context = req.context ?? new FleetContext();\n  const entries = await context.listServices(docsDir);\n  const byId = new Map<string, ServiceEntry>(entries.map((e) => [e.id, e]));\n  const known: ReadonlySet<string> = new Set(byId.keys());\n\n  const landPath = landscapePath(docsDir);\n  const present = existsSync(landPath);\n  const land = present ? await context.loadLikeC4(landPath) : null;\n  const parses = land !== null && land.errors.length === 0;\n  const elements = parses ? land.elements : [];\n  const relationships: Rel[] = parses ? land.relationships : [];\n  // One resolver for the whole scan, built with the real service ids so an edge\n  // drawn into a modelled container (`paymentService.api`) counts for the\n  // service that owns it — the same resolution `list`, `show` and `validate`\n  // use, so no two commands can disagree about who calls whom.\n  const svcOf = serviceResolver(elements, known);\n\n  // Operation seeds resolve through the living contracts, not the map: the map\n  // says who CALLS an operation, and the question here is who DEFINES it.\n  const opSeeds: ServiceEntry[\"id\"][] = [];\n  const unresolvedOperations: string[] = [];\n  for (const op of req.operations) {\n    const owner = await operationOwner(entries, op, context);\n    if (owner === null) unresolvedOperations.push(op);\n    else opSeeds.push(owner);\n  }\n\n  // Capability seeds resolve through the vocabulary and the fleet rollup —\n  // one rollup pass for ALL requested ids, through this exploration's shared\n  // context cache, never a fresh walk per capability. A realizing service is\n  // by construction an enumerated one, so every seed it adds is `known`.\n  //\n  // And through the fleet's USE CASES, which answer the same question off a\n  // different document. The rollup finds services whose living requirements\n  // carry a `Capability:` line; a `dynamic view` tagged `#cap-<slug>` finds the\n  // services the flow actually runs through — including ones whose spec.md has\n  // never named the capability, which on a brownfield fleet is most of them.\n  // The two are unioned rather than ranked because neither is a subset of the\n  // other: a service can realize a capability without appearing in its drawn\n  // flow, and a flow can pass through a service that has written nothing down.\n  //\n  // The scan gates its own load, and this whole block is already behind\n  // `--capability` being passed at all, so an exploration by service or by\n  // operation never touches `architecture/` as a project.\n  const capSeeds: ServiceEntry[\"id\"][] = [];\n  let unresolvedCaps: string[] = [];\n  if (req.capabilities.length > 0) {\n    const vocab = await context.capabilities(docsDir);\n    const rows = await capabilityRollup({ services: entries, vocab, read: (p) => context.readRequirements(p) });\n    const wanted = new Set(req.capabilities);\n    const realizing = new Set(rows.filter((r) => wanted.has(r.id)).flatMap((r) => r.services));\n    const scan = await readUseCases({ docsDir, known });\n    for (const id of servicesInFlowsClaiming(scan, req.capabilities)) realizing.add(id);\n    capSeeds.push(...entries.filter((e) => realizing.has(e.id)).map((e) => e.id));\n    // `unresolvedCapabilities` is unchanged on purpose: it grades the\n    // VOCABULARY — declared or not, realized by a living requirement or not —\n    // and a capability drawn in a flow but realized by nobody is still a\n    // capability nothing implements. Letting a tag silence that would hide the\n    // gap the field exists to name.\n    unresolvedCaps = unresolvedCapabilities(rows, req.capabilities);\n  }\n\n  const seeds = [...new Set([...req.services, ...opSeeds, ...capSeeds])];\n  const unknown = seeds\n    .filter((id) => !known.has(id))\n    .map((id) => ({ id, nearest: nearestIds(id, [...known]) }));\n\n  // The ring: one hop, both directions. A seed that is not modelled contributes\n  // nothing here and that is the honest answer — an invisible service has no\n  // neighbours anyone can derive, which is what `landscape.service-unmodelled`\n  // is about.\n  //\n  // The two directions are collected separately rather than written into one\n  // map as the loop goes, because a neighbour can be BOTH — it calls a seed and\n  // the seed calls it — and a single-map version answers whichever edge the\n  // parser happened to yield last. That is a field whose value depends on the\n  // order lines appear in a `.likec4` file, which is the kind of answer that\n  // reads as derived and is not.\n  const seedSet = new Set<string>(seeds);\n  const callsSeed = new Set<string>();\n  const calledBySeed = new Set<string>();\n  for (const r of relationships) {\n    const from = svcOf(r.source);\n    const to = svcOf(r.target);\n    if (seedSet.has(from) && !seedSet.has(to)) calledBySeed.add(to);\n    if (seedSet.has(to) && !seedSet.has(from)) callsSeed.add(from);\n  }\n\n  // `calls-seed` wins the overlap, deterministically. Of the two directions it\n  // is the one that more often has to be touched: a consumer depends on the\n  // seed's contract, so a change to that contract is what breaks it, while a\n  // provider the seed merely calls is usually unaffected by the seed changing.\n  const ring = new Map<string, ExploreReason>([\n    ...[...calledBySeed].map((id) => [id, \"called-by-seed\" as const] as const),\n    ...[...callsSeed].map((id) => [id, \"calls-seed\" as const] as const),\n  ]);\n\n  const ordered: Array<{ id: string; reason: ExploreReason }> = [\n    ...[...seeds].sort(compareIds).map((id) => ({ id, reason: \"seed\" as const })),\n    ...[...ring]\n      .sort(([a], [b]) => compareIds(a, b))\n      .map(([id, reason]) => ({ id, reason })),\n  ];\n\n  const services: ExploreService[] = [];\n  for (const { id, reason } of ordered) {\n    services.push(\n      await describe({\n        id,\n        reason,\n        entry: byId.get(id),\n        relationships,\n        svcOf,\n        elements,\n        parses,\n        context,\n      }),\n    );\n  }\n\n  const covered = new Set(services.map((s) => s.id));\n  const features = await context.listFeatures(docsDir);\n  const overlaps: ExploreOverlap[] = features\n    .map((f) => ({ feature: f.id, services: f.services.filter((s) => covered.has(s)) }))\n    .filter((o) => o.services.length > 0)\n    .sort((a, b) => compareIds(a.feature, b.feature));\n\n  return {\n    seeds,\n    unknown,\n    unresolvedOperations,\n    unresolvedCapabilities: unresolvedCaps,\n    services,\n    neighbours: [...ring.keys()].sort(compareIds),\n    overlaps,\n    landscape: { present, parses },\n    scaffold: newCommand(featureId, seeds, known),\n  };\n}\n"]}
+{"version":3,"file":"explore.js","sourceRoot":"","sources":["../../../src/core/explore/explore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAY,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAiB,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgIrE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAmB;IAC/C,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,IAAI,YAAY,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAExD,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,gEAAgE;IAChE,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,oBAAoB;IACpB,EAAE;IACF,gFAAgF;IAChF,yDAAyD;IACzD,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAU,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE/C,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,IAAI;YAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;YAC7C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,EAAE;IACF,4EAA4E;IAC5E,kEAAkE;IAClE,yEAAyE;IACzE,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,IAAI,cAAc,GAAa,EAAE,CAAC;IAClC,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,KAAK,MAAM,EAAE,IAAI,uBAAuB,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,kEAAkE;QAClE,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,gCAAgC;QAChC,cAAc,GAAG,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC9B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE9D,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,YAAY;IACZ,EAAE;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAwB;QAC1C,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,gBAAyB,CAAU,CAAC;QAC1E,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,YAAqB,CAAU,CAAC;KACpE,CAAC,CAAC;IAEH,MAAM,OAAO,GAAiD;QAC5D,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAe,EAAE,CAAC,CAAC;QAC7E,GAAG,CAAC,GAAG,IAAI,CAAC;aACT,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;KAC3C,CAAC;IAEF,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CACX,MAAM,QAAQ,CAAC;YACb,EAAE;YACF,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,aAAa;YACb,KAAK;YACL,QAAQ;YACR,MAAM;YACN,OAAO;SACR,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAqB,QAAQ;SACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACnF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;SACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpD,OAAO;QACL,KAAK;QACL,OAAO;QACP,oBAAoB;QACpB,sBAAsB,EAAE,cAAc;QACtC,QAAQ;QACR,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAC7C,QAAQ;QACR,SAAS,EAAE;YACT,OAAO;YACP,MAAM;YACN,MAAM,EACJ,IAAI,KAAK,IAAI;gBACX,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;qBAC7F,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;qBAC7D,IAAI,EAAE;SAChB;QACD,QAAQ,EAAE,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC;KAC9C,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The blast radius of a change nobody has written down yet.\n *\n * Everything else in loam answers a question about documents that exist. This\n * module answers the one that comes BEFORE the first document: which services\n * does this feature actually touch? On a fleet of a hundred that call is the\n * hardest one in the cycle and the only one made with no tool in hand —\n * `loam new FEAT-101 --touches a --touches b` takes the answer as an argument\n * and scaffolds whatever it was told. A `--touches` list short by one service\n * is not caught by anything: the feature validates, archives, and ships with a\n * consumer nobody updated.\n *\n * So this states the work the same way `brief/brief.ts` does. It reads the fleet map\n * and the living contracts, reports the ring of services around the seeds, the\n * features already in flight over the same ground, and how far each service's\n * documentation has got — and stops. Which of those neighbours the feature\n * really touches is a judgement about intent, and loam does not make those.\n *\n * \"The fleet map\" here is the `architecture/` PROJECT — the landscape plus every\n * other `.likec4` under it, minus the generated views file — and not the\n * landscape FILE. See the read below for the disagreement that reading one file\n * caused.\n *\n * It is parsed ONCE for the whole exploration. Per-service reads of it exist\n * (`brief/landscape.ts`'s `landscapeContext`) and are correct for one service;\n * calling one of those per seed is how `validate --all` came to cost 13 seconds\n * on 120 services, and this command sits in front of authoring, where that is\n * the difference between a habit and a thing people skip.\n */\nimport { existsSync } from \"node:fs\";\nimport { relative } from \"node:path\";\nimport { FleetContext } from \"../fleet-context.js\";\nimport { type Rel } from \"../c4/likec4.js\";\nimport { serviceResolver } from \"../c4/resolve/service.js\";\nimport { type Maturity } from \"../vocabulary/maturity.js\";\nimport { capabilityRollup, unresolvedCapabilities } from \"../capabilities/rollup.js\";\nimport { compareIds, nearestIds, type ServiceEntry } from \"../repo/entries.js\";\nimport { landscapePath } from \"../repo/paths.js\";\nimport { readUseCases } from \"../usecases/fleet.js\";\nimport { servicesInFlowsClaiming } from \"../usecases/capability.js\";\nimport { describe, newCommand, operationOwner } from \"./describe.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\n\n/** One end of a call the fleet map already draws. */\nexport interface ExploreEdge {\n  /** The service at the other end. */\n  service: string;\n  /** The operationId the call uses, or null for an edge nobody tied to one. */\n  op: string | null;\n  title: string | null;\n}\n\n/**\n * Why a service is in the answer. Seeds were asked for; the rest were derived.\n *\n * A neighbour on both sides of a seed reports `calls-seed` — see the overlap\n * rule in `explore`. The field is a hint about where to look, not a complete\n * description of the edges; `inbound`/`outbound` are that.\n */\nexport type ExploreReason = \"seed\" | \"calls-seed\" | \"called-by-seed\";\n\nexport interface ExploreService {\n  id: string;\n  reason: ExploreReason;\n  /** Whether `services/<id>/` exists at all. */\n  known: boolean;\n  /**\n   * How far this service's documentation has got, or null when it does not\n   * exist yet. A `--touches` naming a service at `empty` or `partial` is a\n   * different job from one naming a vouched service, and the difference decides\n   * whether the feature starts with `loam adopt`.\n   */\n  maturity: Maturity | null;\n  /** What stands between it and `vouched` — `maturityGaps`, so it matches `list --needs-work`. */\n  missing: string[];\n  /** Whether anything in the fleet map resolves to it. */\n  modelled: boolean;\n  /** operationIds its living contract exposes today, `x-loam-remove` markers excluded. */\n  operations: string[];\n  /**\n   * Whether that contract could be read at all, beside the `error` the parser\n   * gave when it could not.\n   *\n   * It rides next to `operations` rather than inside it for the reason `delta`\n   * carries the same pair: an unreadable contract yields an EMPTY operation\n   * list, indistinguishable from a service with no endpoints — and this is the\n   * field the workflow tells an agent to read before deciding whether an\n   * operation it is about to add already exists. Answering `[]` over a YAML\n   * error is how a MODIFIED requirement gets authored as ADDED.\n   */\n  openapi: { unreadable: boolean; error?: string };\n  inbound: ExploreEdge[];\n  outbound: ExploreEdge[];\n}\n\n/** An active feature already working over ground the exploration covers. */\nexport interface ExploreOverlap {\n  feature: string;\n  /** The explored services it already carries a delta for. */\n  services: string[];\n}\n\nexport interface Exploration {\n  /** The seed ids, as asked for. */\n  seeds: string[];\n  /**\n   * Seeds that name no `services/<id>/`, each with the closest real ids. A seed\n   * may legitimately be a service the feature INTRODUCES, so this is reported\n   * rather than refused — but a typo produces exactly the same shape, and the\n   * near-miss list is what tells the two apart.\n   */\n  unknown: Array<{ id: string; nearest: string[] }>;\n  /** Operation seeds that resolved to no service's living contract. */\n  unresolvedOperations: string[];\n  /**\n   * Capability seeds that seeded nothing: not declared in\n   * architecture/capabilities.yaml (the file may not exist at all — explore\n   * refuses nothing, every miss is a field), or declared and realized by no\n   * living requirement. One list on purpose; splitting the two miss kinds\n   * waits for a consumer to ask.\n   */\n  unresolvedCapabilities: string[];\n  /** Seeds first, then the ring, each in id order. */\n  services: ExploreService[];\n  /** Ids the ring added that were not asked for — the candidates to weigh. */\n  neighbours: string[];\n  overlaps: ExploreOverlap[];\n  /**\n   * `broken` is the `architecture/` documents that failed, docs-relative POSIX,\n   * deduped and sorted — `[]` while `parses` is true. `parses` answers for the\n   * PROJECT, so the broken document is very often a SIBLING beside a landscape\n   * that reads perfectly, and naming the landscape file was a claim about bytes\n   * loam read fine (verification 2026-09-04). Spelled as `landscape.invalid`\n   * spells it, so the two surfaces name one file one way.\n   */\n  landscape: { present: boolean; parses: boolean; broken: string[] };\n  /**\n   * The literal `loam new` line the seeds imply — seeds only. The ring is\n   * deliberately NOT folded in: this module's whole claim is that it does not\n   * know which neighbours the feature touches, and a command line that quietly\n   * included them would make the guess on the reader's behalf and look derived\n   * while doing it.\n   *\n   * Named for what it does rather than `command`, which is the envelope's key\n   * for the command that RAN. The rename is not cosmetic: `emitJson` spreads\n   * the payload LAST, so a payload field called `command` would silently\n   * OVERRIDE the envelope's — `command` would come back as\n   * `\"loam new FEAT-000 …\"`, and every consumer branching on\n   * `command === \"explore\"` (the same key `status`, `doctor`, `dependencies`,\n   * `archive` and `unarchive` emit) would quietly stop matching, with tsc and\n   * the linter green throughout.\n   */\n  scaffold: string;\n}\n\nexport interface ExploreRequest {\n  docsDir: DocsDir;\n  /** Service ids to explore around. Checked at the command boundary. */\n  services: ServiceEntry[\"id\"][];\n  /** operationIds to explore around; each resolves to the service that defines it. */\n  operations: string[];\n  /** Declared capability ids to explore around; each seeds its realizing services. */\n  capabilities: string[];\n  /** Placeholder feature id for the suggested command line. */\n  featureId: string;\n  context?: FleetContext;\n}\n\n/**\n * Read the fleet around a proposed change. Reads only; writes nothing, and\n * refuses nothing — every miss is reported as a field.\n */\nexport async function explore(req: ExploreRequest): Promise<Exploration> {\n  const { docsDir, featureId } = req;\n  const context = req.context ?? new FleetContext();\n  const entries = await context.listServices(docsDir);\n  const byId = new Map<string, ServiceEntry>(entries.map((e) => [e.id, e]));\n  const known: ReadonlySet<string> = new Set(byId.keys());\n\n  // The `architecture/` PROJECT, never `architecture/landscape.likec4` alone.\n  // The map is a project — the landscape merged with every use case, palette and\n  // second `model { }` block beside it — and reading one file of it made this\n  // command answer differently from `loam adopt` and `loam context` about the\n  // same tree (reproduced: with a broken `architecture/palette.likec4` beside a\n  // landscape that parses, `context checkout-web --json` reported\n  // `landscape.parses: false` while `explore checkout-web --json` reported\n  // `parses: true` and went on to describe every edge). `core/pack/living.ts`\n  // named this module as the last reader that disagreed. Whichever answer is\n  // right, an agent handed both has no way to tell — and the renderer's answer\n  // is the project's.\n  //\n  // `present` stays a fact about the FILE, because that file is the WRITE target:\n  // `loam new`'s scaffold and every brief ask for edits to\n  // `architecture/landscape.likec4` by name, and \"the project is empty\" is not\n  // the same instruction as \"there is no map to edit\".\n  const present = existsSync(landscapePath(docsDir));\n  const land = present ? await context.architecture(docsDir) : null;\n  const parses = land !== null && land.errors.length === 0;\n  const elements = parses ? land.elements : [];\n  const relationships: Rel[] = parses ? land.relationships : [];\n  // One resolver for the whole scan, built with the real service ids so an edge\n  // drawn into a modelled container (`paymentService.api`) counts for the\n  // service that owns it — the same resolution `list`, `show` and `validate`\n  // use, so no two commands can disagree about who calls whom.\n  const svcOf = serviceResolver(elements, known);\n\n  // Operation seeds resolve through the living contracts, not the map: the map\n  // says who CALLS an operation, and the question here is who DEFINES it.\n  const opSeeds: ServiceEntry[\"id\"][] = [];\n  const unresolvedOperations: string[] = [];\n  for (const op of req.operations) {\n    const owner = await operationOwner(entries, op, context);\n    if (owner === null) unresolvedOperations.push(op);\n    else opSeeds.push(owner);\n  }\n\n  // Capability seeds resolve through the vocabulary and the fleet rollup —\n  // one rollup pass for ALL requested ids, through this exploration's shared\n  // context cache, never a fresh walk per capability. A realizing service is\n  // by construction an enumerated one, so every seed it adds is `known`.\n  //\n  // And through the fleet's USE CASES, which answer the same question off a\n  // different document. The rollup finds services whose living requirements\n  // carry a `Capability:` line; a `dynamic view` tagged `#cap-<slug>` finds the\n  // services the flow actually runs through — including ones whose spec.md has\n  // never named the capability, which on a brownfield fleet is most of them.\n  // The two are unioned rather than ranked because neither is a subset of the\n  // other: a service can realize a capability without appearing in its drawn\n  // flow, and a flow can pass through a service that has written nothing down.\n  //\n  // The scan gates its own load — a fleet whose documents mention no reserved\n  // tag never starts LikeC4 for it — and this whole block is behind\n  // `--capability` being passed at all. What it is no longer behind is the\n  // project itself: the read above loads `architecture/` for every exploration,\n  // so a `--capability` run pays for a SECOND parse of the same documents\n  // (`readUseCases` takes a `DocsDir`, not this invocation's memo). Accepted\n  // rather than unnoticed: the alternative is a seam that hands the scan a\n  // pre-loaded project, which is a change to a module five callers share, and\n  // the cost lands only on the flag that already opts into the fleet rollup.\n  const capSeeds: ServiceEntry[\"id\"][] = [];\n  let unresolvedCaps: string[] = [];\n  if (req.capabilities.length > 0) {\n    const vocab = await context.capabilities(docsDir);\n    const rows = await capabilityRollup({ services: entries, vocab, read: (p) => context.readRequirements(p) });\n    const wanted = new Set(req.capabilities);\n    const realizing = new Set(rows.filter((r) => wanted.has(r.id)).flatMap((r) => r.services));\n    const scan = await readUseCases({ docsDir, known });\n    for (const id of servicesInFlowsClaiming(scan, req.capabilities)) realizing.add(id);\n    capSeeds.push(...entries.filter((e) => realizing.has(e.id)).map((e) => e.id));\n    // `unresolvedCapabilities` is unchanged on purpose: it grades the\n    // VOCABULARY — declared or not, realized by a living requirement or not —\n    // and a capability drawn in a flow but realized by nobody is still a\n    // capability nothing implements. Letting a tag silence that would hide the\n    // gap the field exists to name.\n    unresolvedCaps = unresolvedCapabilities(rows, req.capabilities);\n  }\n\n  const seeds = [...new Set([...req.services, ...opSeeds, ...capSeeds])];\n  const unknown = seeds\n    .filter((id) => !known.has(id))\n    .map((id) => ({ id, nearest: nearestIds(id, [...known]) }));\n\n  // The ring: one hop, both directions. A seed that is not modelled contributes\n  // nothing here and that is the honest answer — an invisible service has no\n  // neighbours anyone can derive, which is what `landscape.service-unmodelled`\n  // is about.\n  //\n  // The two directions are collected separately rather than written into one\n  // map as the loop goes, because a neighbour can be BOTH — it calls a seed and\n  // the seed calls it — and a single-map version answers whichever edge the\n  // parser happened to yield last. That is a field whose value depends on the\n  // order lines appear in a `.likec4` file, which is the kind of answer that\n  // reads as derived and is not.\n  const seedSet = new Set<string>(seeds);\n  const callsSeed = new Set<string>();\n  const calledBySeed = new Set<string>();\n  for (const r of relationships) {\n    const from = svcOf(r.source);\n    const to = svcOf(r.target);\n    if (seedSet.has(from) && !seedSet.has(to)) calledBySeed.add(to);\n    if (seedSet.has(to) && !seedSet.has(from)) callsSeed.add(from);\n  }\n\n  // `calls-seed` wins the overlap, deterministically. Of the two directions it\n  // is the one that more often has to be touched: a consumer depends on the\n  // seed's contract, so a change to that contract is what breaks it, while a\n  // provider the seed merely calls is usually unaffected by the seed changing.\n  const ring = new Map<string, ExploreReason>([\n    ...[...calledBySeed].map((id) => [id, \"called-by-seed\" as const] as const),\n    ...[...callsSeed].map((id) => [id, \"calls-seed\" as const] as const),\n  ]);\n\n  const ordered: Array<{ id: string; reason: ExploreReason }> = [\n    ...[...seeds].sort(compareIds).map((id) => ({ id, reason: \"seed\" as const })),\n    ...[...ring]\n      .sort(([a], [b]) => compareIds(a, b))\n      .map(([id, reason]) => ({ id, reason })),\n  ];\n\n  const services: ExploreService[] = [];\n  for (const { id, reason } of ordered) {\n    services.push(\n      await describe({\n        id,\n        reason,\n        entry: byId.get(id),\n        relationships,\n        svcOf,\n        elements,\n        parses,\n        context,\n      }),\n    );\n  }\n\n  const covered = new Set(services.map((s) => s.id));\n  const features = await context.listFeatures(docsDir);\n  const overlaps: ExploreOverlap[] = features\n    .map((f) => ({ feature: f.id, services: f.services.filter((s) => covered.has(s)) }))\n    .filter((o) => o.services.length > 0)\n    .sort((a, b) => compareIds(a.feature, b.feature));\n\n  return {\n    seeds,\n    unknown,\n    unresolvedOperations,\n    unresolvedCapabilities: unresolvedCaps,\n    services,\n    neighbours: [...ring.keys()].sort(compareIds),\n    overlaps,\n    landscape: {\n      present,\n      parses,\n      broken:\n        land === null\n          ? []\n          : [...new Set(land.errors.map((e) => e.sourceFsPath).filter((p): p is string => p !== undefined))]\n              .map((abs) => relative(docsDir, abs).split(/[\\\\/]/).join(\"/\"))\n              .sort(),\n    },\n    scaffold: newCommand(featureId, seeds, known),\n  };\n}\n"]}

package/dist/core/fleet-context.js

@@ -28,6 +28,7 @@ import { conflictMarkerLines } from "./conflict-markers.js";
 import { decodeDocument } from "./kernel/document-bytes.js";
 import { loadFile } from "./c4/likec4.js";
 import { loadBatch } from "./c4/workspace.js";
+import { ServiceModels } from "./c4/prefetch/fleet.js";
 import { readOpenapi } from "./openapi/doc.js";
 import {} from "./repo/entries.js";
 import { featureSpecServices, listFeatures, listFleetTree, serviceEntries } from "./repo/repo.js";
@@ -47,6 +48,19 @@ export class FleetContext {
     capabilityVocabularies = new Map();
     featureCapabilities = new Map();
     likec4 = new Map();
+    /**
+     * The service-model axis's own memos, one object because the rules they
+     * encode are `c4/prefetch/fleet.ts`'s rather than this class's. It counts
+     * through this instance's counter, so `stats()` stays the one place a caller
+     * reads what an invocation cost.
+     */
+    models = new ServiceModels({
+        onProjectLoad: () => {
+            this.counts.projectLoads += 1;
+        },
+        known: async (docsDir) => new Set((await this.listServices(docsDir)).map((s) => s.id)),
+        standalone: (path) => this.loadLikeC4(path),
+    });
     counts = {
         serviceEnumerations: 0,
         featureEnumerations: 0,
@@ -58,6 +72,7 @@ export class FleetContext {
         capabilityParses: 0,
         featureCapabilityWalks: 0,
         likec4Loads: 0,
+        projectLoads: 0,
     };
     /** A copy suitable for diagnostics/tests; callers cannot mutate the counters. */
     stats() {
@@ -276,5 +291,37 @@ export class FleetContext {
             this.likec4.set(k, Promise.resolve(doc));
         }
     }
+    /** The fleet map as the PROJECT it is — landscape plus use cases, minus the generated views file. */
+    architecture(docsDir) {
+        return this.models.architecture(docsDir);
+    }
+    /**
+     * Which shape each of these models has, keyed by resolved path — one read of
+     * each file's bytes per invocation. Ask over the FULL enumeration, never a
+     * narrowed run's subset: shapes decide which directories are owed a
+     * per-service `likec4.config.json`, and a partial map answers "not
+     * standalone" for every service outside it.
+     */
+    modelShapes(paths) {
+        return this.models.shapes(paths);
+    }
+    /**
+     * A service's C4 model, read the way its own SHAPE demands — the one entry
+     * point for every reader of `model.likec4`, standalone or extending
+     * (`c4/service-model/load.ts` states the four arms and why each exists).
+     */
+    serviceModel(docsDir, paths) {
+        return this.models.model(docsDir, paths);
+    }
+    /**
+     * Every service's model prepared in two workspaces whatever the fleet's mix:
+     * the extending ones as one project each in one of them, the standalone ones
+     * through the document batch above. An accelerator with `prefetchLikeC4`'s
+     * failure story exactly — a batch that could not be created seeds nothing, so
+     * findings never change because of a tmpdir, only the speed does.
+     */
+    async prefetchServiceModels(docsDir, paths) {
+        await this.prefetchLikeC4(await this.models.prefetch(docsDir, paths));
+    }
 }
 //# sourceMappingURL=fleet-context.js.map

package/dist/core/fleet-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-context.js","sourceRoot":"","sources":["../../src/core/fleet-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,wBAAwB,EAA6B,MAAM,gCAAgC,CAAC;AACrG,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAkB,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAmC,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAwC,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAElG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AAsCtD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpD,mEAAmE;AACnE,MAAM,OAAO,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IACtD,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IACtD,eAAe,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC7D,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC3C,YAAY,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClD,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,sBAAsB,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC1E,mBAAmB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACjE,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE/C,MAAM,GAAsB;QAC3C,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;QACtB,0BAA0B,EAAE,CAAC;QAC7B,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,CAAC;QACzB,WAAW,EAAE,CAAC;KACf,CAAC;IAEF,iFAAiF;IACjF,KAAK;QACH,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,OAAgB;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;YACrC,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,OAAgB;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,OAAgB,EAAE,IAAI,GAAkC,EAAE;QACrE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjF,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;YACrC,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACrD,wEAAwE;gBACxE,yEAAyE;gBACzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACxE,CAAC;gBACH,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mBAAmB,CAAC,UAAsB;QACxC,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,0BAA0B,IAAI,CAAC,CAAC;YAC5C,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QACnB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;YAC3B,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,OAAO,mBAAmB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC;YACnC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YAC/B,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC;YAChC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,OAAgB;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC;YAClC,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,UAAsB;QAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,CAAC,CAAC;YACxC,OAAO,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IAEH,UAAU,CAAC,IAAY;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;YAC7B,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,cAAc,CAAC,KAAe;QAClC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAC/B,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,yEAAyE;YACzE,sEAAsE;YACtE,kEAAkE;YAClE,uDAAuD;YACvD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;CACF","sourcesContent":["/**\n * Request-scoped read index for commands that walk a whole loam repository.\n *\n * The filesystem remains the source of truth.  This class deliberately has no\n * singleton/global instance: a command creates one after loading loam.json and\n * drops it when that invocation finishes.  Within that lifetime identical\n * reads share their in-flight Promise, which removes both duplicate I/O and\n * duplicate parsing without making a later CLI invocation observe stale data.\n *\n * Because every markdown artifact is read HERE, this is also where the two\n * failures a read must never swallow are answered: bytes that are not UTF-8\n * (which `readFile(path, \"utf8\")` silently turns into U+FFFD, so a UTF-16\n * spec.md parses as zero requirements and grades green), and git conflict\n * markers left in a living document (which parse as prose, and which the next\n * `loam archive` rewrites away). One place, so no reader can forget. Both\n * RULES live in leaves — the decode in `document-bytes.ts`, the marker scan\n * and its findings in `conflict-markers.ts` — because the parsers and graders\n * that touch a single file without an index owe the same rules, and must not\n * have to import this module — and the fleet it pulls in behind it — to obey\n * them.\n */\nimport { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { readAsyncapi } from \"./asyncapi/read.js\";\nimport type { AsyncapiDoc } from \"./asyncapi/model.js\";\nimport { readCapabilityVocabulary, type CapabilityVocabulary } from \"./capabilities/capabilities.js\";\nimport { featureCapabilityDeltas } from \"./capabilities/delta/tree.js\";\nimport type { CapabilityTree } from \"./capabilities/tree.js\";\nimport { conflictMarkerLines } from \"./conflict-markers.js\";\nimport { decodeDocument } from \"./kernel/document-bytes.js\";\nimport { loadFile, type LoadedDoc } from \"./c4/likec4.js\";\nimport { loadBatch } from \"./c4/workspace.js\";\nimport { readOpenapi, type OpenapiDoc, type Operation } from \"./openapi/doc.js\";\nimport type { RawServiceId } from \"./kernel/ids/service.js\";\nimport { type FeatureEntry, type ServiceEntry } from \"./repo/entries.js\";\nimport { featureSpecServices, listFeatures, listFleetTree, serviceEntries } from \"./repo/repo.js\";\nimport type { FleetTree } from \"./repo/tree/walk.js\";\nimport { parseRequirements } from \"./document/parse.js\";\nimport { type Requirement } from \"./document/spec.js\";\nimport type { DocsDir, FeatureDir } from \"./kernel/ids/dirs.js\";\n\nexport interface FleetContextStats {\n  serviceEnumerations: number;\n  featureEnumerations: number;\n  featureServiceEnumerations: number;\n  textReads: number;\n  requirementParses: number;\n  openapiParses: number;\n  /**\n   * Reads of a service's `asyncapi.yaml`. Counted separately because this axis\n   * is the one that makes a per-service run read the whole fleet: \"does anybody\n   * publish this message\" has no local answer, so `spine.message-unproduced`\n   * walks every service's contract. The memo is what keeps that one walk per\n   * command instead of one per consuming edge.\n   */\n  asyncapiParses: number;\n  /**\n   * Reads of the capability vocabulary — `architecture/capabilities.yaml` AND\n   * the `capabilities/` walk, which are one vocabulary and so one read. One per\n   * invocation is the capability axis's exit criterion, and this counter is how\n   * a test pins it. (Permissions predates the memo and re-parses per service —\n   * do not copy that.)\n   */\n  capabilityParses: number;\n  /**\n   * Walks of ONE feature's `capabilities/` delta tree. Counted apart from\n   * `capabilityParses` because it answers a different question about a\n   * different directory, and because a fleet that has not adopted the business\n   * axis must be able to prove it pays nothing: every feature's walk is a\n   * single `existsSync` that finds no directory, so this counter rises while\n   * `textReads` and `requirementParses` do not.\n   */\n  featureCapabilityWalks: number;\n  likec4Loads: number;\n}\n\nconst key = (path: string): string => resolve(path);\n\n/** One coherent filesystem snapshot for one command invocation. */\nexport class FleetContext {\n  private readonly trees = new Map<string, Promise<FleetTree>>();\n  private readonly services = new Map<string, Promise<ServiceEntry[]>>();\n  private readonly features = new Map<string, Promise<FeatureEntry[]>>();\n  private readonly featureServices = new Map<string, Promise<RawServiceId[]>>();\n  private readonly texts = new Map<string, Promise<string>>();\n  private readonly requirements = new Map<string, Promise<Requirement[]>>();\n  private readonly openapis = new Map<string, Promise<OpenapiDoc>>();\n  private readonly asyncapis = new Map<string, Promise<AsyncapiDoc>>();\n  private readonly capabilityVocabularies = new Map<string, Promise<CapabilityVocabulary>>();\n  private readonly featureCapabilities = new Map<string, Promise<CapabilityTree>>();\n  private readonly likec4 = new Map<string, Promise<LoadedDoc>>();\n\n  private readonly counts: FleetContextStats = {\n    serviceEnumerations: 0,\n    featureEnumerations: 0,\n    featureServiceEnumerations: 0,\n    textReads: 0,\n    requirementParses: 0,\n    openapiParses: 0,\n    asyncapiParses: 0,\n    capabilityParses: 0,\n    featureCapabilityWalks: 0,\n    likec4Loads: 0,\n  };\n\n  /** A copy suitable for diagnostics/tests; callers cannot mutate the counters. */\n  stats(): Readonly<FleetContextStats> {\n    return { ...this.counts };\n  }\n\n  /**\n   * The classified `services/` tree — the ONE enumeration this invocation\n   * performs. `listServices` below derives its entries from this memo, so a\n   * command that asks for both the fleet and the tree's findings (`validate\n   * --all` does) still walks the directories exactly once. The counter keeps\n   * its historical meaning — walks of `services/` — it just counts the walk\n   * where the walk now happens.\n   */\n  fleetTree(docsDir: DocsDir): Promise<FleetTree> {\n    const k = key(docsDir);\n    let pending = this.trees.get(k);\n    if (pending === undefined) {\n      this.counts.serviceEnumerations += 1;\n      pending = listFleetTree(docsDir);\n      this.trees.set(k, pending);\n    }\n    return pending;\n  }\n\n  listServices(docsDir: DocsDir): Promise<ServiceEntry[]> {\n    const k = key(docsDir);\n    let pending = this.services.get(k);\n    if (pending === undefined) {\n      pending = this.fleetTree(docsDir).then(serviceEntries);\n      this.services.set(k, pending);\n    }\n    return pending;\n  }\n\n  listFeatures(docsDir: DocsDir, opts: { includeArchived?: boolean } = {}): Promise<FeatureEntry[]> {\n    const k = `${key(docsDir)}\\0${opts.includeArchived === true ? \"all\" : \"active\"}`;\n    let pending = this.features.get(k);\n    if (pending === undefined) {\n      this.counts.featureEnumerations += 1;\n      pending = listFeatures(docsDir, opts).then((entries) => {\n        // listFeatures has already enumerated every feature's specs/ directory;\n        // seed the narrower lookup so validation/coherence do not read it again.\n        for (const entry of entries) {\n          const featureKey = key(entry.dir);\n          if (!this.featureServices.has(featureKey)) {\n            this.featureServices.set(featureKey, Promise.resolve(entry.services));\n          }\n        }\n        return entries;\n      });\n      this.features.set(k, pending);\n    }\n    return pending;\n  }\n\n  featureSpecServices(featureDir: FeatureDir): Promise<RawServiceId[]> {\n    const k = key(featureDir);\n    let pending = this.featureServices.get(k);\n    if (pending === undefined) {\n      this.counts.featureServiceEnumerations += 1;\n      pending = featureSpecServices(featureDir);\n      this.featureServices.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * A markdown artifact as text. Bytes in, decoded once, and refused rather\n   * than degraded when they are not UTF-8 — see NotUtf8DocumentError.\n   */\n  readText(path: string): Promise<string> {\n    const k = key(path);\n    let pending = this.texts.get(k);\n    if (pending === undefined) {\n      this.counts.textReads += 1;\n      pending = readFile(path).then((bytes) => decodeDocument(bytes, path));\n      this.texts.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * Git conflict markers in an already-read document, by line. Free for any\n   * caller that was going to read the file anyway — which is every caller,\n   * which is the point: the marker check used to cost a whole extra read of one\n   * hand-picked file, so it was done for one hand-picked file.\n   */\n  async conflictMarkers(path: string): Promise<number[]> {\n    return conflictMarkerLines(await this.readText(path));\n  }\n\n  readRequirements(path: string): Promise<Requirement[]> {\n    const k = key(path);\n    let pending = this.requirements.get(k);\n    if (pending === undefined) {\n      this.counts.requirementParses += 1;\n      pending = this.readText(path).then(parseRequirements);\n      this.requirements.set(k, pending);\n    }\n    return pending;\n  }\n\n  readOpenapi(path: string): Promise<OpenapiDoc> {\n    const k = key(path);\n    let pending = this.openapis.get(k);\n    if (pending === undefined) {\n      this.counts.openapiParses += 1;\n      pending = readOpenapi(path);\n      this.openapis.set(k, pending);\n    }\n    return pending;\n  }\n\n  readAsyncapi(path: string): Promise<AsyncapiDoc> {\n    const k = key(path);\n    let pending = this.asyncapis.get(k);\n    if (pending === undefined) {\n      this.counts.asyncapiParses += 1;\n      pending = readAsyncapi(path);\n      this.asyncapis.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * The capability vocabulary, read once per invocation. Direction rule,\n   * load-bearing: this file imports `capabilities/capabilities.js`, so nothing\n   * under src/core/capabilities/ may import this module back — that edge is a\n   * core-root↔capabilities package cycle `import/no-cycle` cannot see, which is\n   * why the functions there take plain data or a `read` function, never a FleetContext.\n   */\n  capabilities(docsDir: DocsDir): Promise<CapabilityVocabulary> {\n    const k = key(docsDir);\n    let pending = this.capabilityVocabularies.get(k);\n    if (pending === undefined) {\n      this.counts.capabilityParses += 1;\n      pending = readCapabilityVocabulary(docsDir);\n      this.capabilityVocabularies.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * One feature's `capabilities/` delta tree, walked once per invocation. Two\n   * readers ask for it in the same run — the delta-shape walk\n   * (`core/delta/delta.ts`) and the capability overlay\n   * (`core/coherence/declared.ts`) — and without the memo a feature carrying\n   * three capability deltas paid the readdirs twice.\n   *\n   * The direction rule stated on `capabilities()` above applies verbatim: the\n   * function this stands in front of takes a plain `FeatureDir`, never a\n   * FleetContext, so `src/core/capabilities/` never imports this module back.\n   */\n  featureCapabilityDeltas(featureDir: FeatureDir): Promise<CapabilityTree> {\n    const k = key(featureDir);\n    let pending = this.featureCapabilities.get(k);\n    if (pending === undefined) {\n      this.counts.featureCapabilityWalks += 1;\n      pending = featureCapabilityDeltas(featureDir);\n      this.featureCapabilities.set(k, pending);\n    }\n    return pending;\n  }\n\n  async operations(path: string): Promise<Operation[]> {\n    return (await this.readOpenapi(path)).ops;\n  }\n\n  async operationIds(path: string): Promise<string[]> {\n    return (await this.readOpenapi(path)).ops.map((op) => op.id);\n  }\n\n  /*\n   * Deliberately no `serviceOperationIds` here. The living-plus-feature union is\n   * a RULE — every removal applied before any upsert — not a read, and a second\n   * copy of a rule is a second chance to spell it differently. This one did: it\n   * interleaved removals with upserts, so a relocated operation answered\n   * \"defined\" through `archive` (no context) and \"gone\" through `validate` and\n   * `status` (context), or the reverse, depending on the order the feature's\n   * YAML happened to spell the two slots in. `core/openapi/doc.ts` owns the rule and\n   * threads a context through the reads underneath it, which is the only part\n   * this class was ever needed for.\n   */\n\n  loadLikeC4(path: string): Promise<LoadedDoc> {\n    const k = key(path);\n    let pending = this.likec4.get(k);\n    if (pending === undefined) {\n      this.counts.likec4Loads += 1;\n      pending = loadFile(path);\n      this.likec4.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * Parse many `.likec4` documents through ONE shared workspace (`loadBatch`)\n   * and seed the memo above, so every later `loadLikeC4` in this invocation is\n   * a hit. Purely an accelerator: the cache is still this instance's — one\n   * invocation, one snapshot, no module state — and the counter still means\n   * \"documents parsed via LikeC4\", incremented once per batch-parsed document.\n   *\n   * The failure story is the contract here. A batch-INFRASTRUCTURE failure —\n   * a sandboxed runner denying tmpdir writes is the environment class ROADMAP\n   * documents — degrades to today's per-path loads by seeding nothing: never\n   * an error, and never fewer findings, only the old speed. A path the batch\n   * could not stage (missing, unreadable) is simply absent from the result, so\n   * the later `loadLikeC4` reproduces today's per-path error exactly. And\n   * fewer than two misses returns without a workspace at all: one document\n   * gains nothing from batch isolation it already has.\n   */\n  async prefetchLikeC4(paths: string[]): Promise<void> {\n    const missing = [...new Set(paths.map(key))].filter((k) => !this.likec4.has(k));\n    if (missing.length < 2) return;\n    let docs: Map<string, LoadedDoc>;\n    try {\n      docs = await loadBatch(missing);\n    } catch {\n      return;\n    }\n    for (const [k, doc] of docs) {\n      // Keyed by the same `key()` as loadLikeC4 — loadBatch resolves paths the\n      // identical way, and `missing` was already resolved, so this holds by\n      // construction; the has() guard keeps a concurrent load's promise\n      // authoritative rather than double-counting the parse.\n      if (this.likec4.has(k)) continue;\n      this.counts.likec4Loads += 1;\n      this.likec4.set(k, Promise.resolve(doc));\n    }\n  }\n}\n"]}
+{"version":3,"file":"fleet-context.js","sourceRoot":"","sources":["../../src/core/fleet-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,wBAAwB,EAA6B,MAAM,gCAAgC,CAAC;AACrG,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAkB,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,EAAE,WAAW,EAAmC,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAwC,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAElG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AA8CtD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpD,mEAAmE;AACnE,MAAM,OAAO,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC9C,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IACtD,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IACtD,eAAe,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC7D,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC3C,YAAY,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClD,SAAS,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,sBAAsB,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC1E,mBAAmB,GAAG,IAAI,GAAG,EAAmC,CAAC;IACjE,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IAChE;;;;;OAKG;IACc,MAAM,GAAG,IAAI,aAAa,CAAC;QAC1C,aAAa,EAAE,GAAG,EAAE;YAClB,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;KAC5C,CAAC,CAAC;IAEc,MAAM,GAAsB;QAC3C,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;QACtB,0BAA0B,EAAE,CAAC;QAC7B,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,CAAC;QACzB,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;KAChB,CAAC;IAEF,iFAAiF;IACjF,KAAK;QACH,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,OAAgB;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;YACrC,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,OAAgB;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,OAAgB,EAAE,IAAI,GAAkC,EAAE;QACrE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjF,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;YACrC,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBACrD,wEAAwE;gBACxE,yEAAyE;gBACzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACxE,CAAC;gBACH,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mBAAmB,CAAC,UAAsB;QACxC,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,0BAA0B,IAAI,CAAC,CAAC;YAC5C,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QACnB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;YAC3B,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,OAAO,mBAAmB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC;YACnC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YAC/B,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC;YAChC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,OAAgB;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC;YAClC,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,UAAsB;QAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,CAAC,CAAC;YACxC,OAAO,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IAEH,UAAU,CAAC,IAAY;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;YAC7B,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,cAAc,CAAC,KAAe;QAClC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAC/B,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5B,yEAAyE;YACzE,sEAAsE;YACtE,kEAAkE;YAClE,uDAAuD;YACvD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,qGAAqG;IACrG,YAAY,CAAC,OAAgB;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,KAAwB;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,OAAgB,EAAE,KAAmB;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CAAC,OAAgB,EAAE,KAA8B;QAC1E,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;CACF","sourcesContent":["/**\n * Request-scoped read index for commands that walk a whole loam repository.\n *\n * The filesystem remains the source of truth.  This class deliberately has no\n * singleton/global instance: a command creates one after loading loam.json and\n * drops it when that invocation finishes.  Within that lifetime identical\n * reads share their in-flight Promise, which removes both duplicate I/O and\n * duplicate parsing without making a later CLI invocation observe stale data.\n *\n * Because every markdown artifact is read HERE, this is also where the two\n * failures a read must never swallow are answered: bytes that are not UTF-8\n * (which `readFile(path, \"utf8\")` silently turns into U+FFFD, so a UTF-16\n * spec.md parses as zero requirements and grades green), and git conflict\n * markers left in a living document (which parse as prose, and which the next\n * `loam archive` rewrites away). One place, so no reader can forget. Both\n * RULES live in leaves — the decode in `document-bytes.ts`, the marker scan\n * and its findings in `conflict-markers.ts` — because the parsers and graders\n * that touch a single file without an index owe the same rules, and must not\n * have to import this module — and the fleet it pulls in behind it — to obey\n * them.\n */\nimport { readFile } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { readAsyncapi } from \"./asyncapi/read.js\";\nimport type { AsyncapiDoc } from \"./asyncapi/model.js\";\nimport { readCapabilityVocabulary, type CapabilityVocabulary } from \"./capabilities/capabilities.js\";\nimport { featureCapabilityDeltas } from \"./capabilities/delta/tree.js\";\nimport type { CapabilityTree } from \"./capabilities/tree.js\";\nimport { conflictMarkerLines } from \"./conflict-markers.js\";\nimport { decodeDocument } from \"./kernel/document-bytes.js\";\nimport { loadFile, type LoadedDoc } from \"./c4/likec4.js\";\nimport { loadBatch } from \"./c4/workspace.js\";\nimport { ServiceModels } from \"./c4/prefetch/fleet.js\";\nimport type { ServiceModel } from \"./c4/service-model/load.js\";\nimport type { ModelShape } from \"./c4/service-model/shape.js\";\nimport type { ServicePaths } from \"./repo/paths.js\";\nimport { readOpenapi, type OpenapiDoc, type Operation } from \"./openapi/doc.js\";\nimport type { RawServiceId } from \"./kernel/ids/service.js\";\nimport { type FeatureEntry, type ServiceEntry } from \"./repo/entries.js\";\nimport { featureSpecServices, listFeatures, listFleetTree, serviceEntries } from \"./repo/repo.js\";\nimport type { FleetTree } from \"./repo/tree/walk.js\";\nimport { parseRequirements } from \"./document/parse.js\";\nimport { type Requirement } from \"./document/spec.js\";\nimport type { DocsDir, FeatureDir } from \"./kernel/ids/dirs.js\";\n\nexport interface FleetContextStats {\n  serviceEnumerations: number;\n  featureEnumerations: number;\n  featureServiceEnumerations: number;\n  textReads: number;\n  requirementParses: number;\n  openapiParses: number;\n  /**\n   * Reads of a service's `asyncapi.yaml`. Counted separately because this axis\n   * is the one that makes a per-service run read the whole fleet: \"does anybody\n   * publish this message\" has no local answer, so `spine.message-unproduced`\n   * walks every service's contract. The memo is what keeps that one walk per\n   * command instead of one per consuming edge.\n   */\n  asyncapiParses: number;\n  /**\n   * Reads of the capability vocabulary — `architecture/capabilities.yaml` AND\n   * the `capabilities/` walk, which are one vocabulary and so one read. One per\n   * invocation is the capability axis's exit criterion, and this counter is how\n   * a test pins it. (Permissions predates the memo and re-parses per service —\n   * do not copy that.)\n   */\n  capabilityParses: number;\n  /**\n   * Walks of ONE feature's `capabilities/` delta tree. Counted apart from\n   * `capabilityParses` because it answers a different question about a\n   * different directory, and because a fleet that has not adopted the business\n   * axis must be able to prove it pays nothing: every feature's walk is a\n   * single `existsSync` that finds no directory, so this counter rises while\n   * `textReads` and `requirementParses` do not.\n   */\n  featureCapabilityWalks: number;\n  likec4Loads: number;\n  /**\n   * PER-SERVICE PROJECTS parsed — the map plus one extending model, staged\n   * together (`c4/service-model/`). Apart from `likec4Loads` because they are\n   * different units: that counter means documents parsed alone, and a fleet\n   * whose models all extend the map moves every unit to this one. One project\n   * per service is the axis's exit criterion, and this is how a test pins it.\n   */\n  projectLoads: number;\n}\n\nconst key = (path: string): string => resolve(path);\n\n/** One coherent filesystem snapshot for one command invocation. */\nexport class FleetContext {\n  private readonly trees = new Map<string, Promise<FleetTree>>();\n  private readonly services = new Map<string, Promise<ServiceEntry[]>>();\n  private readonly features = new Map<string, Promise<FeatureEntry[]>>();\n  private readonly featureServices = new Map<string, Promise<RawServiceId[]>>();\n  private readonly texts = new Map<string, Promise<string>>();\n  private readonly requirements = new Map<string, Promise<Requirement[]>>();\n  private readonly openapis = new Map<string, Promise<OpenapiDoc>>();\n  private readonly asyncapis = new Map<string, Promise<AsyncapiDoc>>();\n  private readonly capabilityVocabularies = new Map<string, Promise<CapabilityVocabulary>>();\n  private readonly featureCapabilities = new Map<string, Promise<CapabilityTree>>();\n  private readonly likec4 = new Map<string, Promise<LoadedDoc>>();\n  /**\n   * The service-model axis's own memos, one object because the rules they\n   * encode are `c4/prefetch/fleet.ts`'s rather than this class's. It counts\n   * through this instance's counter, so `stats()` stays the one place a caller\n   * reads what an invocation cost.\n   */\n  private readonly models = new ServiceModels({\n    onProjectLoad: () => {\n      this.counts.projectLoads += 1;\n    },\n    known: async (docsDir) => new Set((await this.listServices(docsDir)).map((s) => s.id)),\n    standalone: (path) => this.loadLikeC4(path),\n  });\n\n  private readonly counts: FleetContextStats = {\n    serviceEnumerations: 0,\n    featureEnumerations: 0,\n    featureServiceEnumerations: 0,\n    textReads: 0,\n    requirementParses: 0,\n    openapiParses: 0,\n    asyncapiParses: 0,\n    capabilityParses: 0,\n    featureCapabilityWalks: 0,\n    likec4Loads: 0,\n    projectLoads: 0,\n  };\n\n  /** A copy suitable for diagnostics/tests; callers cannot mutate the counters. */\n  stats(): Readonly<FleetContextStats> {\n    return { ...this.counts };\n  }\n\n  /**\n   * The classified `services/` tree — the ONE enumeration this invocation\n   * performs. `listServices` below derives its entries from this memo, so a\n   * command that asks for both the fleet and the tree's findings (`validate\n   * --all` does) still walks the directories exactly once. The counter keeps\n   * its historical meaning — walks of `services/` — it just counts the walk\n   * where the walk now happens.\n   */\n  fleetTree(docsDir: DocsDir): Promise<FleetTree> {\n    const k = key(docsDir);\n    let pending = this.trees.get(k);\n    if (pending === undefined) {\n      this.counts.serviceEnumerations += 1;\n      pending = listFleetTree(docsDir);\n      this.trees.set(k, pending);\n    }\n    return pending;\n  }\n\n  listServices(docsDir: DocsDir): Promise<ServiceEntry[]> {\n    const k = key(docsDir);\n    let pending = this.services.get(k);\n    if (pending === undefined) {\n      pending = this.fleetTree(docsDir).then(serviceEntries);\n      this.services.set(k, pending);\n    }\n    return pending;\n  }\n\n  listFeatures(docsDir: DocsDir, opts: { includeArchived?: boolean } = {}): Promise<FeatureEntry[]> {\n    const k = `${key(docsDir)}\\0${opts.includeArchived === true ? \"all\" : \"active\"}`;\n    let pending = this.features.get(k);\n    if (pending === undefined) {\n      this.counts.featureEnumerations += 1;\n      pending = listFeatures(docsDir, opts).then((entries) => {\n        // listFeatures has already enumerated every feature's specs/ directory;\n        // seed the narrower lookup so validation/coherence do not read it again.\n        for (const entry of entries) {\n          const featureKey = key(entry.dir);\n          if (!this.featureServices.has(featureKey)) {\n            this.featureServices.set(featureKey, Promise.resolve(entry.services));\n          }\n        }\n        return entries;\n      });\n      this.features.set(k, pending);\n    }\n    return pending;\n  }\n\n  featureSpecServices(featureDir: FeatureDir): Promise<RawServiceId[]> {\n    const k = key(featureDir);\n    let pending = this.featureServices.get(k);\n    if (pending === undefined) {\n      this.counts.featureServiceEnumerations += 1;\n      pending = featureSpecServices(featureDir);\n      this.featureServices.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * A markdown artifact as text. Bytes in, decoded once, and refused rather\n   * than degraded when they are not UTF-8 — see NotUtf8DocumentError.\n   */\n  readText(path: string): Promise<string> {\n    const k = key(path);\n    let pending = this.texts.get(k);\n    if (pending === undefined) {\n      this.counts.textReads += 1;\n      pending = readFile(path).then((bytes) => decodeDocument(bytes, path));\n      this.texts.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * Git conflict markers in an already-read document, by line. Free for any\n   * caller that was going to read the file anyway — which is every caller,\n   * which is the point: the marker check used to cost a whole extra read of one\n   * hand-picked file, so it was done for one hand-picked file.\n   */\n  async conflictMarkers(path: string): Promise<number[]> {\n    return conflictMarkerLines(await this.readText(path));\n  }\n\n  readRequirements(path: string): Promise<Requirement[]> {\n    const k = key(path);\n    let pending = this.requirements.get(k);\n    if (pending === undefined) {\n      this.counts.requirementParses += 1;\n      pending = this.readText(path).then(parseRequirements);\n      this.requirements.set(k, pending);\n    }\n    return pending;\n  }\n\n  readOpenapi(path: string): Promise<OpenapiDoc> {\n    const k = key(path);\n    let pending = this.openapis.get(k);\n    if (pending === undefined) {\n      this.counts.openapiParses += 1;\n      pending = readOpenapi(path);\n      this.openapis.set(k, pending);\n    }\n    return pending;\n  }\n\n  readAsyncapi(path: string): Promise<AsyncapiDoc> {\n    const k = key(path);\n    let pending = this.asyncapis.get(k);\n    if (pending === undefined) {\n      this.counts.asyncapiParses += 1;\n      pending = readAsyncapi(path);\n      this.asyncapis.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * The capability vocabulary, read once per invocation. Direction rule,\n   * load-bearing: this file imports `capabilities/capabilities.js`, so nothing\n   * under src/core/capabilities/ may import this module back — that edge is a\n   * core-root↔capabilities package cycle `import/no-cycle` cannot see, which is\n   * why the functions there take plain data or a `read` function, never a FleetContext.\n   */\n  capabilities(docsDir: DocsDir): Promise<CapabilityVocabulary> {\n    const k = key(docsDir);\n    let pending = this.capabilityVocabularies.get(k);\n    if (pending === undefined) {\n      this.counts.capabilityParses += 1;\n      pending = readCapabilityVocabulary(docsDir);\n      this.capabilityVocabularies.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * One feature's `capabilities/` delta tree, walked once per invocation. Two\n   * readers ask for it in the same run — the delta-shape walk\n   * (`core/delta/delta.ts`) and the capability overlay\n   * (`core/coherence/declared.ts`) — and without the memo a feature carrying\n   * three capability deltas paid the readdirs twice.\n   *\n   * The direction rule stated on `capabilities()` above applies verbatim: the\n   * function this stands in front of takes a plain `FeatureDir`, never a\n   * FleetContext, so `src/core/capabilities/` never imports this module back.\n   */\n  featureCapabilityDeltas(featureDir: FeatureDir): Promise<CapabilityTree> {\n    const k = key(featureDir);\n    let pending = this.featureCapabilities.get(k);\n    if (pending === undefined) {\n      this.counts.featureCapabilityWalks += 1;\n      pending = featureCapabilityDeltas(featureDir);\n      this.featureCapabilities.set(k, pending);\n    }\n    return pending;\n  }\n\n  async operations(path: string): Promise<Operation[]> {\n    return (await this.readOpenapi(path)).ops;\n  }\n\n  async operationIds(path: string): Promise<string[]> {\n    return (await this.readOpenapi(path)).ops.map((op) => op.id);\n  }\n\n  /*\n   * Deliberately no `serviceOperationIds` here. The living-plus-feature union is\n   * a RULE — every removal applied before any upsert — not a read, and a second\n   * copy of a rule is a second chance to spell it differently. This one did: it\n   * interleaved removals with upserts, so a relocated operation answered\n   * \"defined\" through `archive` (no context) and \"gone\" through `validate` and\n   * `status` (context), or the reverse, depending on the order the feature's\n   * YAML happened to spell the two slots in. `core/openapi/doc.ts` owns the rule and\n   * threads a context through the reads underneath it, which is the only part\n   * this class was ever needed for.\n   */\n\n  loadLikeC4(path: string): Promise<LoadedDoc> {\n    const k = key(path);\n    let pending = this.likec4.get(k);\n    if (pending === undefined) {\n      this.counts.likec4Loads += 1;\n      pending = loadFile(path);\n      this.likec4.set(k, pending);\n    }\n    return pending;\n  }\n\n  /**\n   * Parse many `.likec4` documents through ONE shared workspace (`loadBatch`)\n   * and seed the memo above, so every later `loadLikeC4` in this invocation is\n   * a hit. Purely an accelerator: the cache is still this instance's — one\n   * invocation, one snapshot, no module state — and the counter still means\n   * \"documents parsed via LikeC4\", incremented once per batch-parsed document.\n   *\n   * The failure story is the contract here. A batch-INFRASTRUCTURE failure —\n   * a sandboxed runner denying tmpdir writes is the environment class ROADMAP\n   * documents — degrades to today's per-path loads by seeding nothing: never\n   * an error, and never fewer findings, only the old speed. A path the batch\n   * could not stage (missing, unreadable) is simply absent from the result, so\n   * the later `loadLikeC4` reproduces today's per-path error exactly. And\n   * fewer than two misses returns without a workspace at all: one document\n   * gains nothing from batch isolation it already has.\n   */\n  async prefetchLikeC4(paths: string[]): Promise<void> {\n    const missing = [...new Set(paths.map(key))].filter((k) => !this.likec4.has(k));\n    if (missing.length < 2) return;\n    let docs: Map<string, LoadedDoc>;\n    try {\n      docs = await loadBatch(missing);\n    } catch {\n      return;\n    }\n    for (const [k, doc] of docs) {\n      // Keyed by the same `key()` as loadLikeC4 — loadBatch resolves paths the\n      // identical way, and `missing` was already resolved, so this holds by\n      // construction; the has() guard keeps a concurrent load's promise\n      // authoritative rather than double-counting the parse.\n      if (this.likec4.has(k)) continue;\n      this.counts.likec4Loads += 1;\n      this.likec4.set(k, Promise.resolve(doc));\n    }\n  }\n\n  /** The fleet map as the PROJECT it is — landscape plus use cases, minus the generated views file. */\n  architecture(docsDir: DocsDir): Promise<LoadedDoc> {\n    return this.models.architecture(docsDir);\n  }\n\n  /**\n   * Which shape each of these models has, keyed by resolved path — one read of\n   * each file's bytes per invocation. Ask over the FULL enumeration, never a\n   * narrowed run's subset: shapes decide which directories are owed a\n   * per-service `likec4.config.json`, and a partial map answers \"not\n   * standalone\" for every service outside it.\n   */\n  modelShapes(paths: readonly string[]): Promise<Map<string, ModelShape>> {\n    return this.models.shapes(paths);\n  }\n\n  /**\n   * A service's C4 model, read the way its own SHAPE demands — the one entry\n   * point for every reader of `model.likec4`, standalone or extending\n   * (`c4/service-model/load.ts` states the four arms and why each exists).\n   */\n  serviceModel(docsDir: DocsDir, paths: ServicePaths): Promise<ServiceModel> {\n    return this.models.model(docsDir, paths);\n  }\n\n  /**\n   * Every service's model prepared in two workspaces whatever the fleet's mix:\n   * the extending ones as one project each in one of them, the standalone ones\n   * through the document batch above. An accelerator with `prefetchLikeC4`'s\n   * failure story exactly — a batch that could not be created seeds nothing, so\n   * findings never change because of a tmpdir, only the speed does.\n   */\n  async prefetchServiceModels(docsDir: DocsDir, paths: readonly ServicePaths[]): Promise<void> {\n    await this.prefetchLikeC4(await this.models.prefetch(docsDir, paths));\n  }\n}\n"]}

package/dist/core/gate/checks.js

@@ -111,7 +111,11 @@ function partnersFindings(scan, service) {
     for (const p of scan.partners) {
         // An `#external` partner is somebody else's system: its side of the join
         // is unrecorded ON PURPOSE, the same exemption the landscape census grants
-        // (`landscape.service-undocumented` skips #external too).
+        // (`landscape.service-undocumented` skips #external too). The fleet's own
+        // infrastructure — a `database`, `queue`, `topic`, `cache` or `bucket` — is
+        // not a partner at all and never reaches this loop: `./partners.ts` drops it
+        // from the SET, beside the actors, because the three remedies below are all
+        // false of a store the fleet runs.
         if (p.external)
             continue;
         if (p.maturity === null) {

package/dist/core/gate/checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../../src/core/gate/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAqB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAK/D,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAoB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAmC,MAAM,aAAa,CAAC;AAgBjF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAgB;IAC/C,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjG,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/D,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC;QAC5B,iBAAiB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QACnF,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,GAAgB;QAC1B,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;QACpE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC3C,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC1D,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE;KAC9E,CAAC;IACF,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,SAAS,gBAAgB,CAAC,IAAiB,EAAE,OAAe;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,mEAAmE;IACnE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,yEAAyE,OAAO,8JAA8J;SACxP,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EACL,6DAA6D,IAAI,CAAC,gBAAgB,IAAI,kBAAkB,8BAA8B,OAAO,0BAA0B;gBACvK,2KAA2K;SAC9K,CAAC,CAAC;IACL,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,oEAAoE;IACpE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC/E,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,OAAO;YAChB,OAAO,EACL,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,MAAM,CAAC,QAAQ,sJAAsJ;gBACvN,+CAA+C,OAAO,yEAAyE;YACjI,OAAO,EAAE,MAAM,CAAC,IAAI;YACpB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,yEAAyE;QACzE,2EAA2E;QAC3E,0DAA0D;QAC1D,IAAI,CAAC,CAAC,QAAQ;YAAE,SAAS;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EACL,IAAI,CAAC,CAAC,OAAO,YAAY,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,oDAAoD;oBAC5I,oIAAoI;gBACtI,OAAO,EAAE,CAAC,CAAC,GAAG;aACf,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EACL,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,QAAQ,4CAA4C,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC,OAAO,4BAA4B;gBACzQ,OAAO,EAAE,CAAC,CAAC,GAAG;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,IAAiB;IAClE,MAAM,QAAQ,GAA6E;QACzF;YACE,EAAE,EAAE,GAAG,CAAC,OAAO;YACf,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC;SACrE;QACD,2EAA2E;QAC3E,qEAAqE;QACrE,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;KACJ,CAAC;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,IAAI,CAAC;YACH,yEAAyE;YACzE,kEAAkE;YAClE,uEAAuE;YACvE,iEAAiE;YACjE,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,wDAAwD;YACxD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,UAAU,CAAC,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YACjG,OAAO,GAAG;iBACP,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,eAAe;gBAC1B,CAAC,CAAC,IAAI,KAAK,eAAe;gBAC1B,CAAC,CAAC,IAAI,KAAK,uBAAuB,CACrC;gBACD,iEAAiE;gBACjE,mEAAmE;gBACnE,qCAAqC;iBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC","sourcesContent":["/**\n * The four checks behind `loam gate` — a can-i-deploy-shaped PURE QUERY over\n * evidence other commands already recorded. Nothing here executes anything,\n * writes anything, takes the docs lock, or re-derives a coherence plan: every\n * answer is either already on disk (verification.yaml, vouch stamps, the\n * commit journal) or a presence/landscape fact the enumeration carries.\n *\n *   partners      the landscape's direct joins, both ends graded on the ladder\n *   freshness     content.stale / sources.stale over the target and partners,\n *                 plus the one integrity error that makes freshness\n *                 unjudgeable (frontmatter.malformed) and a refusing decode\n *                 of the spec bytes themselves\n *   verification  verificationState per active feature touching the service\n *                 (its own module, `./verification.ts`)\n *   interrupted   the `.loam-commit` journal — the one repo state that poisons\n *                 every other answer above\n *\n * Every `gate.*` code is spelled as a literal `code:` property at its emit\n * site, never through a code-taking factory parameter — verifyStep\n * (core/status/verification.ts) records that test/codes-drift.test.ts's\n * collector is blind to the parameter form, and a refactor toward a factory\n * would silently undocument the family.\n */\nimport { existsSync } from \"node:fs\";\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport { serviceProvenance } from \"../provenance/findings.js\";\nimport { interruptedCommitFinding } from \"../staging/recovery/finding.js\";\nimport { servicePathsAt, SPEC_AXES, type ServicePaths } from \"../repo/paths.js\";\nimport { serviceTreePath } from \"../kernel/ids/dirs.js\";\nimport { locateServicePaths } from \"../repo/service-target.js\";\nimport type { Finding } from \"../vocabulary/report.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport type { RawServiceId } from \"../kernel/ids/service.js\";\nimport { atLeastDocumented, partnerScan, type PartnerScan } from \"./partners.js\";\nimport { verificationCheck } from \"./verification.js\";\nimport { unreadableSubject, type GateCheck, type GateReport } from \"./report.js\";\n\nexport interface GateRequest {\n  docsDir: DocsDir;\n  /** The service being deployed — a name the enumeration approved. */\n  service: RawServiceId;\n  /**\n   * The repository loam is standing in, passed ONLY when the gated service is\n   * this repo's own binding — validate's `repoOf` rule: `sources` are paths\n   * into a service's own repository, so `sources.stale` is honestly checkable\n   * only there, while `content.stale` needs nothing but the document.\n   */\n  repoDir?: string;\n  fleet: FleetContext;\n}\n\nexport async function gateReport(req: GateRequest): Promise<GateReport> {\n  // The scan first, alone: freshness walks the partner set it derives. The\n  // three remaining checks are independent of each other — different files,\n  // memoized reads — so they run concurrently; only the scan must be ordered.\n  const scan = await partnerScan({ docsDir: req.docsDir, service: req.service, fleet: req.fleet });\n  const [freshness, verification, interrupted] = await Promise.all([\n    freshnessFindings(req, scan),\n    verificationCheck({ docsDir: req.docsDir, service: req.service, fleet: req.fleet }),\n    interruptedCommitFinding(req.docsDir),\n  ]);\n  const checks: GateCheck[] = [\n    { check: \"partners\", findings: partnersFindings(scan, req.service) },\n    { check: \"freshness\", findings: freshness },\n    { check: \"verification\", findings: verification.findings },\n    { check: \"interrupted\", findings: interrupted === null ? [] : [interrupted] },\n  ];\n  return {\n    service: req.service,\n    landscape: scan.landscape,\n    partners: scan.partners,\n    features: verification.features,\n    checks,\n  };\n}\n\n/* ------------------------------------------------------------------ */\n/* Check 1: partners                                                   */\n/* ------------------------------------------------------------------ */\n\nfunction partnersFindings(scan: PartnerScan, service: string): Finding[] {\n  const findings: Finding[] = [];\n  // \"Could not look\" must never read as \"no partners\" — the docsRepoReady\n  // doctrine one level down. `validate --all` owns the diagnosis of the\n  // landscape itself; this code only refuses the false silence. The two ways\n  // of not looking are graded apart, the way `landscape.missing` and\n  // `landscape.invalid` are: ABSENT is a warning — a repo before its first\n  // adopt legitimately has no map yet — but a map that EXISTS and cannot be\n  // parsed or read is an ERROR, because `validate --all` fails that repo\n  // (`landscape.invalid`) and a deploy gate that passed where the fleet gate\n  // fails would be the quieter of two contradictory verdicts.\n  if (scan.landscape === \"absent\") {\n    findings.push({\n      severity: \"warn\",\n      code: \"gate.partners-unknown\",\n      message: `architecture/landscape.likec4 does not exist, so the partner set for '${service}' could not be derived — an absent map means nobody could look, not that nothing joins this service. \\`loam validate --all\\` diagnoses the landscape itself.`,\n    });\n  } else if (scan.landscape === \"invalid\") {\n    findings.push({\n      severity: \"error\",\n      code: \"gate.partners-unknown\",\n      message:\n        `architecture/landscape.likec4 exists but cannot be used — ${scan.landscapeProblem ?? \"it did not parse\"} — so the partner set for '${service}' could not be derived. ` +\n        `A broken map means nobody could look, not that nothing joins this service, and \\`loam validate --all\\` fails this repo for the same file. Fix the landscape, then re-run.`,\n    });\n  }\n  // The rung depends on the landscape only through the api question (does\n  // anything call this service?). With no readable map that question is\n  // unanswerable, and the fail-closed grading — `landscapeEvidence`: no proof\n  // means an API is expected — would convict a worker or UI for a contract\n  // nobody may be owed. One unanswerable fact yields ONE finding (the\n  // landscape's own, above), so under an unreadable map this error fires only\n  // when the service is below `documented` REGARDLESS of the api question.\n  const target = scan.landscape === \"read\" ? scan.target : scan.targetWithoutApi;\n  if (!atLeastDocumented(target.maturity)) {\n    findings.push({\n      severity: \"error\",\n      code: \"gate.service-undocumented\",\n      subject: service,\n      message:\n        `${serviceTreePath(scan.targetEntry)}/ sits at '${target.maturity}' on the adoption ladder — below 'documented', the docs cannot say what its joins even are, so no recorded evidence can answer the deploy question. ` +\n        `Author the baseline (\\`loam adopt --service ${service}\\` briefs it); this check passes once the required artifact set exists.`,\n      details: target.gaps,\n      text: { detailPrefix: \"- \" },\n    });\n  }\n  // The partners that HAVE a directory, by id: their findings name it, and it\n  // is `services/<subsystem>/<id>/` for a filed one. The no-directory branch\n  // below keeps the bare `services/<id>/` spelling deliberately — there is no\n  // directory to name, and the unfiled form is what the fix would create.\n  const partnerPath = new Map(scan.partnerEntries.map((e) => [e.id as string, serviceTreePath(e)]));\n  for (const p of scan.partners) {\n    // An `#external` partner is somebody else's system: its side of the join\n    // is unrecorded ON PURPOSE, the same exemption the landscape census grants\n    // (`landscape.service-undocumented` skips #external too).\n    if (p.external) continue;\n    if (p.maturity === null) {\n      findings.push({\n        severity: \"warn\",\n        code: \"gate.partner-undocumented\",\n        subject: p.service,\n        message:\n          `'${p.service}' joins '${service}' (${p.via.join(\", \")}) but has no services/${p.service}/ directory — its side of the join is unrecorded. ` +\n          `Adopt it, bind its landscape element to the right service with metadata { service '<id>' }, or tag it #external if it is not ours.`,\n        details: p.via,\n      });\n    } else if (!atLeastDocumented(p.maturity)) {\n      findings.push({\n        severity: \"warn\",\n        code: \"gate.partner-undocumented\",\n        subject: p.service,\n        message:\n          `${partnerPath.get(p.service) ?? `services/${p.service}`}/ sits at '${p.maturity}' — below 'documented' — while it joins '${service}' (${p.via.join(\", \")}): its side of the join is not fully recorded. \\`loam adopt --service ${p.service}\\` briefs what is missing.`,\n        details: p.via,\n      });\n    }\n  }\n  return findings;\n}\n\n/* ------------------------------------------------------------------ */\n/* Check 2: freshness                                                  */\n/* ------------------------------------------------------------------ */\n\n/**\n * `serviceProvenance` filtered to the two staleness codes plus the ONE\n * integrity error that makes freshness unjudgeable: `frontmatter.malformed`.\n * A header YAML refuses to parse cannot certify a `content_digest`, and\n * dropping that error read \"cannot judge\" as \"nothing stale\" — the exact\n * fail-open a deploy gate must not have. Everything else provenance grades\n * (missing owners, unstamped sources, absent frontmatter) is `validate`'s\n * report to make — a deploy gate that repeated it would drown the findings a\n * pipeline can actually act on at deploy time.\n */\nasync function freshnessFindings(req: GateRequest, scan: PartnerScan): Promise<Finding[]> {\n  const subjects: { id: RawServiceId; repoDir: string | undefined; paths: ServicePaths }[] = [\n    {\n      id: req.service,\n      repoDir: req.repoDir,\n      paths: await locateServicePaths(req.docsDir, req.service, req.fleet),\n    },\n    // Only the DOCUMENTED partners: a partner with no directory has nothing to\n    // grade, and already carries gate.partner-undocumented from check 1.\n    ...scan.partnerEntries.map((e) => ({\n      id: e.id,\n      repoDir: undefined,\n      paths: servicePathsAt(e.dir),\n    })),\n  ];\n  // Independent per-subject reads through the shared memo; inOrder keeps the\n  // findings in subject order (target first, partners sorted) so identical\n  // state yields identical bytes.\n  const graded = await inOrder(subjects, async (s) => {\n    try {\n      // The integrity gate serviceProvenance cannot give: its own reads decode\n      // with 'utf8', which silently turns UTF-16 bytes into replacement\n      // characters — the file then grades as having no frontmatter at all (a\n      // warning this check does not retain), and mangled bytes read as\n      // \"nothing stale\". So both spec axes are decoded FIRST through the\n      // invocation's read index, whose decoder refuses non-UTF-8 naming the\n      // file (NotUtf8DocumentError spells `path` the way Node does, so the\n      // containment below names it without knowing the type).\n      for (const axis of SPEC_AXES) {\n        const path = s.paths[axis.key];\n        if (existsSync(path)) await req.fleet.readText(path);\n      }\n      const all = await serviceProvenance(req.docsDir, s.id, { repoDir: s.repoDir, fleet: req.fleet });\n      return all\n        .filter(\n          (f) =>\n            f.code === \"content.stale\" ||\n            f.code === \"sources.stale\" ||\n            f.code === \"frontmatter.malformed\",\n        )\n        // The staleness emitters name the file in the message but set no\n        // subject; the payload's per-service attribution should not make a\n        // caller parse it back out of prose.\n        .map((f) => (f.subject === undefined ? { ...f, subject: s.id } : f));\n    } catch (err) {\n      return [unreadableSubject(\"service\", s.id, err)];\n    }\n  });\n  return graded.flat();\n}\n"]}
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../../src/core/gate/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAqB,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAK/D,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAoB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAmC,MAAM,aAAa,CAAC;AAgBjF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAgB;IAC/C,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjG,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/D,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC;QAC5B,iBAAiB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QACnF,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC;KACtC,CAAC,CAAC;IACH,MAAM,MAAM,GAAgB;QAC1B,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;QACpE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC3C,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC1D,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE;KAC9E,CAAC;IACF,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,SAAS,gBAAgB,CAAC,IAAiB,EAAE,OAAe;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,wEAAwE;IACxE,sEAAsE;IACtE,2EAA2E;IAC3E,mEAAmE;IACnE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,yEAAyE,OAAO,8JAA8J;SACxP,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EACL,6DAA6D,IAAI,CAAC,gBAAgB,IAAI,kBAAkB,8BAA8B,OAAO,0BAA0B;gBACvK,2KAA2K;SAC9K,CAAC,CAAC;IACL,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,oEAAoE;IACpE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC/E,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,OAAO;YAChB,OAAO,EACL,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,MAAM,CAAC,QAAQ,sJAAsJ;gBACvN,+CAA+C,OAAO,yEAAyE;YACjI,OAAO,EAAE,MAAM,CAAC,IAAI;YACpB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,mCAAmC;QACnC,IAAI,CAAC,CAAC,QAAQ;YAAE,SAAS;QACzB,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EACL,IAAI,CAAC,CAAC,OAAO,YAAY,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,oDAAoD;oBAC5I,oIAAoI;gBACtI,OAAO,EAAE,CAAC,CAAC,GAAG;aACf,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EACL,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,QAAQ,4CAA4C,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC,OAAO,4BAA4B;gBACzQ,OAAO,EAAE,CAAC,CAAC,GAAG;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,IAAiB;IAClE,MAAM,QAAQ,GAA6E;QACzF;YACE,EAAE,EAAE,GAAG,CAAC,OAAO;YACf,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC;SACrE;QACD,2EAA2E;QAC3E,qEAAqE;QACrE,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;KACJ,CAAC;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,IAAI,CAAC;YACH,yEAAyE;YACzE,kEAAkE;YAClE,uEAAuE;YACvE,iEAAiE;YACjE,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,wDAAwD;YACxD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,UAAU,CAAC,IAAI,CAAC;oBAAE,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YACjG,OAAO,GAAG;iBACP,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,eAAe;gBAC1B,CAAC,CAAC,IAAI,KAAK,eAAe;gBAC1B,CAAC,CAAC,IAAI,KAAK,uBAAuB,CACrC;gBACD,iEAAiE;gBACjE,mEAAmE;gBACnE,qCAAqC;iBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC","sourcesContent":["/**\n * The four checks behind `loam gate` — a can-i-deploy-shaped PURE QUERY over\n * evidence other commands already recorded. Nothing here executes anything,\n * writes anything, takes the docs lock, or re-derives a coherence plan: every\n * answer is either already on disk (verification.yaml, vouch stamps, the\n * commit journal) or a presence/landscape fact the enumeration carries.\n *\n *   partners      the landscape's direct joins, both ends graded on the ladder\n *   freshness     content.stale / sources.stale over the target and partners,\n *                 plus the one integrity error that makes freshness\n *                 unjudgeable (frontmatter.malformed) and a refusing decode\n *                 of the spec bytes themselves\n *   verification  verificationState per active feature touching the service\n *                 (its own module, `./verification.ts`)\n *   interrupted   the `.loam-commit` journal — the one repo state that poisons\n *                 every other answer above\n *\n * Every `gate.*` code is spelled as a literal `code:` property at its emit\n * site, never through a code-taking factory parameter — verifyStep\n * (core/status/verification.ts) records that test/codes-drift.test.ts's\n * collector is blind to the parameter form, and a refactor toward a factory\n * would silently undocument the family.\n */\nimport { existsSync } from \"node:fs\";\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport { serviceProvenance } from \"../provenance/findings.js\";\nimport { interruptedCommitFinding } from \"../staging/recovery/finding.js\";\nimport { servicePathsAt, SPEC_AXES, type ServicePaths } from \"../repo/paths.js\";\nimport { serviceTreePath } from \"../kernel/ids/dirs.js\";\nimport { locateServicePaths } from \"../repo/service-target.js\";\nimport type { Finding } from \"../vocabulary/report.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport type { RawServiceId } from \"../kernel/ids/service.js\";\nimport { atLeastDocumented, partnerScan, type PartnerScan } from \"./partners.js\";\nimport { verificationCheck } from \"./verification.js\";\nimport { unreadableSubject, type GateCheck, type GateReport } from \"./report.js\";\n\nexport interface GateRequest {\n  docsDir: DocsDir;\n  /** The service being deployed — a name the enumeration approved. */\n  service: RawServiceId;\n  /**\n   * The repository loam is standing in, passed ONLY when the gated service is\n   * this repo's own binding — validate's `repoOf` rule: `sources` are paths\n   * into a service's own repository, so `sources.stale` is honestly checkable\n   * only there, while `content.stale` needs nothing but the document.\n   */\n  repoDir?: string;\n  fleet: FleetContext;\n}\n\nexport async function gateReport(req: GateRequest): Promise<GateReport> {\n  // The scan first, alone: freshness walks the partner set it derives. The\n  // three remaining checks are independent of each other — different files,\n  // memoized reads — so they run concurrently; only the scan must be ordered.\n  const scan = await partnerScan({ docsDir: req.docsDir, service: req.service, fleet: req.fleet });\n  const [freshness, verification, interrupted] = await Promise.all([\n    freshnessFindings(req, scan),\n    verificationCheck({ docsDir: req.docsDir, service: req.service, fleet: req.fleet }),\n    interruptedCommitFinding(req.docsDir),\n  ]);\n  const checks: GateCheck[] = [\n    { check: \"partners\", findings: partnersFindings(scan, req.service) },\n    { check: \"freshness\", findings: freshness },\n    { check: \"verification\", findings: verification.findings },\n    { check: \"interrupted\", findings: interrupted === null ? [] : [interrupted] },\n  ];\n  return {\n    service: req.service,\n    landscape: scan.landscape,\n    partners: scan.partners,\n    features: verification.features,\n    checks,\n  };\n}\n\n/* ------------------------------------------------------------------ */\n/* Check 1: partners                                                   */\n/* ------------------------------------------------------------------ */\n\nfunction partnersFindings(scan: PartnerScan, service: string): Finding[] {\n  const findings: Finding[] = [];\n  // \"Could not look\" must never read as \"no partners\" — the docsRepoReady\n  // doctrine one level down. `validate --all` owns the diagnosis of the\n  // landscape itself; this code only refuses the false silence. The two ways\n  // of not looking are graded apart, the way `landscape.missing` and\n  // `landscape.invalid` are: ABSENT is a warning — a repo before its first\n  // adopt legitimately has no map yet — but a map that EXISTS and cannot be\n  // parsed or read is an ERROR, because `validate --all` fails that repo\n  // (`landscape.invalid`) and a deploy gate that passed where the fleet gate\n  // fails would be the quieter of two contradictory verdicts.\n  if (scan.landscape === \"absent\") {\n    findings.push({\n      severity: \"warn\",\n      code: \"gate.partners-unknown\",\n      message: `architecture/landscape.likec4 does not exist, so the partner set for '${service}' could not be derived — an absent map means nobody could look, not that nothing joins this service. \\`loam validate --all\\` diagnoses the landscape itself.`,\n    });\n  } else if (scan.landscape === \"invalid\") {\n    findings.push({\n      severity: \"error\",\n      code: \"gate.partners-unknown\",\n      message:\n        `architecture/landscape.likec4 exists but cannot be used — ${scan.landscapeProblem ?? \"it did not parse\"} — so the partner set for '${service}' could not be derived. ` +\n        `A broken map means nobody could look, not that nothing joins this service, and \\`loam validate --all\\` fails this repo for the same file. Fix the landscape, then re-run.`,\n    });\n  }\n  // The rung depends on the landscape only through the api question (does\n  // anything call this service?). With no readable map that question is\n  // unanswerable, and the fail-closed grading — `landscapeEvidence`: no proof\n  // means an API is expected — would convict a worker or UI for a contract\n  // nobody may be owed. One unanswerable fact yields ONE finding (the\n  // landscape's own, above), so under an unreadable map this error fires only\n  // when the service is below `documented` REGARDLESS of the api question.\n  const target = scan.landscape === \"read\" ? scan.target : scan.targetWithoutApi;\n  if (!atLeastDocumented(target.maturity)) {\n    findings.push({\n      severity: \"error\",\n      code: \"gate.service-undocumented\",\n      subject: service,\n      message:\n        `${serviceTreePath(scan.targetEntry)}/ sits at '${target.maturity}' on the adoption ladder — below 'documented', the docs cannot say what its joins even are, so no recorded evidence can answer the deploy question. ` +\n        `Author the baseline (\\`loam adopt --service ${service}\\` briefs it); this check passes once the required artifact set exists.`,\n      details: target.gaps,\n      text: { detailPrefix: \"- \" },\n    });\n  }\n  // The partners that HAVE a directory, by id: their findings name it, and it\n  // is `services/<subsystem>/<id>/` for a filed one. The no-directory branch\n  // below keeps the bare `services/<id>/` spelling deliberately — there is no\n  // directory to name, and the unfiled form is what the fix would create.\n  const partnerPath = new Map(scan.partnerEntries.map((e) => [e.id as string, serviceTreePath(e)]));\n  for (const p of scan.partners) {\n    // An `#external` partner is somebody else's system: its side of the join\n    // is unrecorded ON PURPOSE, the same exemption the landscape census grants\n    // (`landscape.service-undocumented` skips #external too). The fleet's own\n    // infrastructure — a `database`, `queue`, `topic`, `cache` or `bucket` — is\n    // not a partner at all and never reaches this loop: `./partners.ts` drops it\n    // from the SET, beside the actors, because the three remedies below are all\n    // false of a store the fleet runs.\n    if (p.external) continue;\n    if (p.maturity === null) {\n      findings.push({\n        severity: \"warn\",\n        code: \"gate.partner-undocumented\",\n        subject: p.service,\n        message:\n          `'${p.service}' joins '${service}' (${p.via.join(\", \")}) but has no services/${p.service}/ directory — its side of the join is unrecorded. ` +\n          `Adopt it, bind its landscape element to the right service with metadata { service '<id>' }, or tag it #external if it is not ours.`,\n        details: p.via,\n      });\n    } else if (!atLeastDocumented(p.maturity)) {\n      findings.push({\n        severity: \"warn\",\n        code: \"gate.partner-undocumented\",\n        subject: p.service,\n        message:\n          `${partnerPath.get(p.service) ?? `services/${p.service}`}/ sits at '${p.maturity}' — below 'documented' — while it joins '${service}' (${p.via.join(\", \")}): its side of the join is not fully recorded. \\`loam adopt --service ${p.service}\\` briefs what is missing.`,\n        details: p.via,\n      });\n    }\n  }\n  return findings;\n}\n\n/* ------------------------------------------------------------------ */\n/* Check 2: freshness                                                  */\n/* ------------------------------------------------------------------ */\n\n/**\n * `serviceProvenance` filtered to the two staleness codes plus the ONE\n * integrity error that makes freshness unjudgeable: `frontmatter.malformed`.\n * A header YAML refuses to parse cannot certify a `content_digest`, and\n * dropping that error read \"cannot judge\" as \"nothing stale\" — the exact\n * fail-open a deploy gate must not have. Everything else provenance grades\n * (missing owners, unstamped sources, absent frontmatter) is `validate`'s\n * report to make — a deploy gate that repeated it would drown the findings a\n * pipeline can actually act on at deploy time.\n */\nasync function freshnessFindings(req: GateRequest, scan: PartnerScan): Promise<Finding[]> {\n  const subjects: { id: RawServiceId; repoDir: string | undefined; paths: ServicePaths }[] = [\n    {\n      id: req.service,\n      repoDir: req.repoDir,\n      paths: await locateServicePaths(req.docsDir, req.service, req.fleet),\n    },\n    // Only the DOCUMENTED partners: a partner with no directory has nothing to\n    // grade, and already carries gate.partner-undocumented from check 1.\n    ...scan.partnerEntries.map((e) => ({\n      id: e.id,\n      repoDir: undefined,\n      paths: servicePathsAt(e.dir),\n    })),\n  ];\n  // Independent per-subject reads through the shared memo; inOrder keeps the\n  // findings in subject order (target first, partners sorted) so identical\n  // state yields identical bytes.\n  const graded = await inOrder(subjects, async (s) => {\n    try {\n      // The integrity gate serviceProvenance cannot give: its own reads decode\n      // with 'utf8', which silently turns UTF-16 bytes into replacement\n      // characters — the file then grades as having no frontmatter at all (a\n      // warning this check does not retain), and mangled bytes read as\n      // \"nothing stale\". So both spec axes are decoded FIRST through the\n      // invocation's read index, whose decoder refuses non-UTF-8 naming the\n      // file (NotUtf8DocumentError spells `path` the way Node does, so the\n      // containment below names it without knowing the type).\n      for (const axis of SPEC_AXES) {\n        const path = s.paths[axis.key];\n        if (existsSync(path)) await req.fleet.readText(path);\n      }\n      const all = await serviceProvenance(req.docsDir, s.id, { repoDir: s.repoDir, fleet: req.fleet });\n      return all\n        .filter(\n          (f) =>\n            f.code === \"content.stale\" ||\n            f.code === \"sources.stale\" ||\n            f.code === \"frontmatter.malformed\",\n        )\n        // The staleness emitters name the file in the message but set no\n        // subject; the payload's per-service attribution should not make a\n        // caller parse it back out of prose.\n        .map((f) => (f.subject === undefined ? { ...f, subject: s.id } : f));\n    } catch (err) {\n      return [unreadableSubject(\"service\", s.id, err)];\n    }\n  });\n  return graded.flat();\n}\n"]}