@ybotok/loam 0.2.0-alpha.5 → 0.2.0-alpha.7

package/dist/core/repo/tree/render/projects.js.map

@@ -1 +1 @@
-{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../../../../src/core/repo/tree/render/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU,EAAE,WAAmB;IAChE,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACrG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,WAAmB;IAClE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAClG,CAAC;AA6BD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAsB,EACtB,OAAgE;IAEhE,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,QAAQ,IAAI,CAAC,CAAC;QACd,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC","sourcesContent":["/**\n * The renderer's project file for ONE service — `services/<…>/<id>/likec4.config.json`\n * — the second thing under `services/` that exists only to be rendered.\n *\n * Why it exists. The root `likec4.config.json` scopes the fleet project to\n * `architecture/` and excludes `services/**`, and must: loam parses every\n * `.likec4` file ALONE, so each `model.likec4` declares its own `specification`\n * block, and a renderer merging the tree reports every declaration as a\n * duplicate. The cost of that exclusion went unstated for a release: an\n * adopted service's model — the artifact `loam adopt` spends the most effort\n * on — was a box on the fleet map with nothing renderable inside it from the\n * docs root, and the documented way to see it was one renderer invocation per\n * service directory. Measured at the 1.59.2 pin: a `likec4.config.json` INSIDE\n * a service directory is registered as a project of its own even though the\n * root excludes the directory (the root's `exclude` does not hide a nested\n * project file), the workspace then loads `fleet` plus one project per service\n * with zero errors, and each service project carries LikeC4's own `index` view\n * of the containers beside whatever view the model authors. One two-key file\n * per service directory is therefore what makes the model renderable from the\n * same root, in the same renderer, beside the map.\n *\n * CREATE-ONLY, never compared, never rewritten, never removed — the root\n * config's ownership rule (`core/docs.ts`: written once, never re-read, the\n * team owns it), NOT the generated views file's. The bytes are a function of\n * the service id alone, which SCHEMA.md defines as the identity no verb ever\n * changes, so nothing can make the file stale; a compare would only fight the\n * per-project keys LikeC4 lets a team add (`title`, styles, a contact), and\n * would restale every service on any change to this rule. Presence is the one\n * question loam owes the file, and presence needs no parse: rule 26 stands,\n * and loam still reads none of it. A leftover file after a model is deleted is\n * the team's, and harmless — measured, a nested project holding no `.likec4`\n * file is silently absent from the renderer's project list.\n *\n * THE NAME. LikeC4's project-name grammar (measured at the pin) refuses an\n * empty name, the word `default`, and the bytes `.`, `@` and `#`; loam's\n * service-id grammar admits `.`. So every `.` becomes `-`, and a name that\n * would then equal the ROOT project's (`fleet` — a nested project of that name\n * is silently registered as `fleet-1`) or LikeC4's reserved `default` is\n * prefixed `service-`. Readable and typeable after `--project`, and NOT\n * injective: an id spelled a.b beside a service literally named a-b, or\n * `service-fleet` beside `fleet`, share a name and the renderer suffixes the\n * later one `-1`. That is disclosed rather than escaped away, because the\n * picker shows the `title` (measured: `title ?? id`), which is ALWAYS the id\n * verbatim, and a collision costs one suffixed label rather than the blanked\n * workspace that made `subsystemViewId` injective. The root's name arrives as\n * a parameter, like every spelling this package needs from `repo/`: `render/`\n * cannot import `repo/paths.ts` (`stale.ts` records the cycle), and a second\n * copy of the word `fleet` here would be the drift the injection prevents.\n *\n * A DIRECTORY THAT IS NOT A LEGAL SERVICE ID IS OWED NO FILE. The tree walk\n * enumerates every directory on purpose — the fleet is never reported smaller\n * than it is — and `service.id-invalid` names the illegal ones. Folding only\n * `.` is right for every LEGAL id, whose remaining bytes LikeC4 accepts; a\n * name like `pay@1` would produce a project file the renderer silently drops\n * (measured: zero errors, the project simply absent from the list), and\n * because the file is create-only the grade below would then be silent\n * forever while the model stayed unrendered — the exact state this file\n * exists to remove, with a label saying it was fixed. So the survey skips\n * such a service: the writer creates nothing, the grader says nothing, and\n * `service.id-invalid`'s own repair — the rename — is what earns the file on\n * the first sync after it.\n *\n * NO MODEL, NO FILE: a service directory without `model.likec4` — one an\n * archive materialised, a spec-only baseline — is owed nothing, and gets its\n * file on the first `loam subsystem sync` after the model lands. A feature's\n * `delta.likec4` is deliberately out of scope: the directory is transient and\n * `loam archive` moves it where a project file would still be registered, so\n * every shipped feature would keep a dead project in the list forever.\n */\nimport { existsSync } from \"node:fs\";\nimport type { ServiceDir } from \"../../../kernel/ids/dirs.js\";\nimport { dirNameHazard } from \"../../../kernel/ids/service.js\";\n\n/** LikeC4's own reserved project name; a file naming it is refused outright. */\nconst LIKEC4_RESERVED_PROJECT = \"default\";\n\n/**\n * The project name for a service id — the id itself for every id made of\n * letters, digits, `_` and `-`, which is nearly all of them.\n */\nexport function serviceProjectName(id: string, rootProject: string): string {\n  const folded = id.replace(/\\./g, \"-\");\n  return folded === rootProject || folded === LIKEC4_RESERVED_PROJECT ? `service-${folded}` : folded;\n}\n\n/**\n * The exact bytes of a service's project file: two keys, two-space JSON, LF,\n * one trailing newline — the root file's own serialisation. `title` is the id\n * verbatim, always, so whatever the renderer labels a project with is the\n * service's real identity even where `name` had to bend.\n */\nexport function renderServiceProject(id: string, rootProject: string): string {\n  return `${JSON.stringify({ name: serviceProjectName(id, rootProject), title: id }, null, 2)}\\n`;\n}\n\n/**\n * A service whose model has no project file beside it, and where the file\n * goes. The SERVICE travels whole — a walked service or a full entry,\n * whichever the caller surveyed — rather than its id: the grader spells the\n * finding's path from the entry's own placement, and a join back by id would\n * name the wrong directory the moment two services share a leaf name under\n * different subsystems (`subsystem.name-collision` — a broken tree the walk\n * still enumerates in full, and one this grade is emitted on by design).\n */\nexport interface ProjectGap<T> {\n  service: T;\n  /** Absolute path of the file `loam subsystem sync` will create. */\n  path: string;\n}\n\n/** What one survey of the tree found: the gaps, and the domain they were counted against. */\nexport interface ProjectSurvey<T> {\n  /** Every service owed a file and lacking one, sorted by id. */\n  gaps: ProjectGap<T>[];\n  /**\n   * Every service the survey considered at all — a model on disk, a legal id\n   * — file or no file. `modelled - gaps.length` is therefore \"already had\n   * one\", derived from the same walk rather than counted a second way.\n   */\n  modelled: number;\n}\n\n/**\n * ONE predicate for the writer (`subsystem sync`) and the grader\n * (`validate --all`), on `viewsState`'s precedent — two private spellings of\n * \"is this model a project\" would be two chances to answer differently about\n * one file, and a grader naming a gap the writer would not fill is a loop no\n * command can clear. Both the gaps AND the count live here for the same\n * reason: a caller re-deriving \"has a model\" beside this function is the\n * second spelling in another coat.\n *\n * Structural over `{ id, dir }` so a walked service and a full entry both fit,\n * and the two file spellings arrive injected (`repo/paths.ts`'s\n * `serviceRenderPaths`) for the package reason the banner gives. Sorted by id,\n * plain lexicographic like every list this package emits, so the writer's\n * report and the grader's findings come out in one stable order.\n */\nexport function surveyProjects<T extends { id: string; dir: ServiceDir }>(\n  services: readonly T[],\n  pathsOf: (dir: ServiceDir) => { model: string; project: string },\n): ProjectSurvey<T> {\n  const gaps: ProjectGap<T>[] = [];\n  let modelled = 0;\n  for (const service of services) {\n    // The banner's rule: a name the renderer would refuse earns no file, and\n    // `service.id-invalid` — not this survey — is what names the repair.\n    if (dirNameHazard(service.id) !== null) continue;\n    const paths = pathsOf(service.dir);\n    if (!existsSync(paths.model)) continue;\n    modelled += 1;\n    if (!existsSync(paths.project)) gaps.push({ service, path: paths.project });\n  }\n  gaps.sort((a, b) => (a.service.id < b.service.id ? -1 : a.service.id > b.service.id ? 1 : 0));\n  return { gaps, modelled };\n}\n"]}
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../../../../src/core/repo/tree/render/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU,EAAE,WAAmB;IAChE,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACrG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,WAAmB;IAClE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAClG,CAAC;AA2ED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAsB,EACtB,OAAgE,EAChE,YAA4C;IAE5C,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,MAAM,CAAC,IAAI,CAAC;YACV,OAAO;YACP,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,mEAAmE;YACnE,wEAAwE;YACxE,iEAAiE;YACjE,sEAAsE;YACtE,yDAAyD;YACzD,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC;YACrC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO;QACL,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACzG,yEAAyE;QACzE,4EAA4E;QAC5E,0DAA0D;QAC1D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM;KACtD,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The renderer's project file for ONE service — `services/<…>/<id>/likec4.config.json`\n * — the second thing under `services/` that exists only to be rendered.\n *\n * Why it exists, and WHICH MODELS IT IS FOR. A model that STANDS ALONE declares\n * its own `specification` block, so it is parsed alone and the root project must\n * exclude its directory — a renderer merging it into the map reports every kind\n * and element it declares as a duplicate, blamed on both files. The cost of that\n * exclusion went unstated for a release: an adopted service's model — the\n * artifact `loam adopt` spends the most effort on — was a box on the fleet map\n * with nothing renderable inside it from the docs root, and the documented way\n * to see it was one renderer invocation per service directory. Measured at the\n * 1.59.2 pin: a `likec4.config.json` INSIDE a service directory is registered as\n * a project of its own even though the root excludes the directory (the root's\n * `exclude` does not hide a nested project file), the workspace then loads\n * `fleet` plus one project per service with zero errors, and each service\n * project carries LikeC4's own `index` view of the containers beside whatever\n * view the model authors. One two-key file per such directory is therefore what\n * makes that model renderable from the same root, in the same renderer, beside\n * the map.\n *\n * A model that EXTENDS the map is owed NO file, and that is the same\n * measurement read the other way: it declares no kinds, it lives in the ROOT\n * project beside the map, and a nested project file beside it TAKES it out of\n * there — measured at the 1.59.2 pin, the workspace loads two projects and, where\n * the nested one claims the model, it holds it alone (the map's kinds are not in\n * there with it, so it does not resolve) and `export json --project fleet` loses\n * the service's containers. So the survey below takes the shape as a predicate, the writer\n * creates a file only for the standalone half and removes one beside the\n * extending half, and `service.likec4-config-stray` grades what is left.\n *\n * NEVER COMPARED, NEVER REWRITTEN — the root config's ownership rule\n * (`core/docs.ts`: written once, never re-read, the team owns it), NOT the\n * generated views file's. The bytes are a function of the service id alone,\n * which SCHEMA.md defines as the identity no verb ever changes, so nothing can\n * make the file stale; a compare would only fight the per-project keys LikeC4\n * lets a team add (`title`, styles, a contact), and would restale every service\n * on any change to this rule. Presence is the one question loam owes the file,\n * and presence needs no parse: rule 26 stands, and loam still reads none of it.\n *\n * REMOVED IN EXACTLY ONE STATE: beside a model that EXTENDS the map. That is a\n * correction, and it is measured rather than reasoned. The design note said a\n * nested project beside an extending model was registered EMPTY and therefore\n * harmless; on likec4 1.59.2 two agents measured the opposite (verification\n * 2026-09-04, W1) — the nested project CLAIMS the model, the workspace loads\n * \"2 projects\", the model is Invalid inside its own one (`Could not resolve\n * reference to Element named 'svc_svc_a'`, because the map is not in there with\n * it), and `export json --project fleet` drops the service's containers. So the\n * file is not a leftover, it is a working renderer taken away from the fleet,\n * and `loam subsystem sync` deletes it — which is what SCHEMA, the message and\n * `/loam-adopt` step 5 had been promising all along.\n *\n * THE EXPORT LOSS IS THE WORSE HALF, NOT THE CERTAIN ONE, and the finding's\n * message says so since it was re-measured (re-verification 2026-09-04, area C\n * item 7). Same pin, two fleets: on the seeded fleet above the containers went\n * and came back when the file was deleted; on `examples/docs` a stray beside the\n * extending order-service left `export json --project fleet` byte-identical —\n * 33 elements, every `marketplace.orderService.*` child present — because there\n * the ROOT project kept the model. What is true in every state measured is the\n * second project itself: the docs root stops being a one-project workspace, and\n * `likec4 validate .` goes from ✓ Valid to ✗ Invalid (\"Specify exact project,\n * known: [order-service, fleet]\"). A message that asserted the export loss\n * unconditionally was refutable on the repository's own example fleet.\n *\n * A leftover beside a model that is GONE stays. That one really is the team's:\n * a nested project holding no `.likec4` file is silently absent from the\n * renderer's project list (measured), so it costs nothing, and a survey that\n * deleted files in directories it found no model in would be a writer acting on\n * an absence.\n *\n * THE NAME. LikeC4's project-name grammar (measured at the pin) refuses an\n * empty name, the word `default`, and the bytes `.`, `@` and `#`; loam's\n * service-id grammar admits `.`. So every `.` becomes `-`, and a name that\n * would then equal the ROOT project's (`fleet` — a nested project of that name\n * is silently registered as `fleet-1`) or LikeC4's reserved `default` is\n * prefixed `service-`. Readable and typeable after `--project`, and NOT\n * injective: an id spelled a.b beside a service literally named a-b, or\n * `service-fleet` beside `fleet`, share a name and the renderer suffixes the\n * later one `-1`. That is disclosed rather than escaped away, because the\n * picker shows the `title` (measured: `title ?? id`), which is ALWAYS the id\n * verbatim, and a collision costs one suffixed label rather than the blanked\n * workspace that made `subsystemViewId` injective. The root's name arrives as\n * a parameter, like every spelling this package needs from `repo/`: `render/`\n * cannot import `repo/paths.ts` (`stale.ts` records the cycle), and a second\n * copy of the word `fleet` here would be the drift the injection prevents.\n *\n * A DIRECTORY THAT IS NOT A LEGAL SERVICE ID IS OWED NO FILE. The tree walk\n * enumerates every directory on purpose — the fleet is never reported smaller\n * than it is — and `service.id-invalid` names the illegal ones. Folding only\n * `.` is right for every LEGAL id, whose remaining bytes LikeC4 accepts; a\n * name like `pay@1` would produce a project file the renderer silently drops\n * (measured: zero errors, the project simply absent from the list), and\n * because the file is create-only the grade below would then be silent\n * forever while the model stayed unrendered — the exact state this file\n * exists to remove, with a label saying it was fixed. So the survey skips\n * such a service: the writer creates nothing, the grader says nothing, and\n * `service.id-invalid`'s own repair — the rename — is what earns the file on\n * the first sync after it.\n *\n * NO MODEL, NO FILE: a service directory without `model.likec4` — one an\n * archive materialised, a spec-only baseline — is owed nothing, and gets its\n * file on the first `loam subsystem sync` after the model lands. A feature's\n * `delta.likec4` is deliberately out of scope: the directory is transient and\n * `loam archive` moves it where a project file would still be registered, so\n * every shipped feature would keep a dead project in the list forever.\n */\nimport { existsSync } from \"node:fs\";\nimport type { ServiceDir } from \"../../../kernel/ids/dirs.js\";\nimport { dirNameHazard } from \"../../../kernel/ids/service.js\";\n\n/** LikeC4's own reserved project name; a file naming it is refused outright. */\nconst LIKEC4_RESERVED_PROJECT = \"default\";\n\n/**\n * The project name for a service id — the id itself for every id made of\n * letters, digits, `_` and `-`, which is nearly all of them.\n */\nexport function serviceProjectName(id: string, rootProject: string): string {\n  const folded = id.replace(/\\./g, \"-\");\n  return folded === rootProject || folded === LIKEC4_RESERVED_PROJECT ? `service-${folded}` : folded;\n}\n\n/**\n * The exact bytes of a service's project file: two keys, two-space JSON, LF,\n * one trailing newline — the root file's own serialisation. `title` is the id\n * verbatim, always, so whatever the renderer labels a project with is the\n * service's real identity even where `name` had to bend.\n */\nexport function renderServiceProject(id: string, rootProject: string): string {\n  return `${JSON.stringify({ name: serviceProjectName(id, rootProject), title: id }, null, 2)}\\n`;\n}\n\n/**\n * A service whose model has no project file beside it, and where the file\n * goes. The SERVICE travels whole — a walked service or a full entry,\n * whichever the caller surveyed — rather than its id: the grader spells the\n * finding's path from the entry's own placement, and a join back by id would\n * name the wrong directory the moment two services share a leaf name under\n * different subsystems (`subsystem.name-collision` — a broken tree the walk\n * still enumerates in full, and one this grade is emitted on by design).\n */\nexport interface ProjectGap<T> {\n  service: T;\n  /** Absolute path of the file `loam subsystem sync` will create. */\n  path: string;\n}\n\n/**\n * One surveyed model: everything the writer and the four renderer grades ask\n * about a single `model.likec4`, answered in one walk.\n *\n * The SHAPE is on here rather than re-derived per grade because it decides\n * opposite things for the two of them: a model that stands alone is owed a\n * project file and must be excluded from the root project, and a model that\n * extends the map is owed neither and must NOT be excluded. Two readers of the\n * same bytes would be two chances to answer that backwards, and backwards is\n * not a warning — it is a renderer that shows nothing.\n */\nexport interface SurveyedModel<T> {\n  service: T;\n  /** Absolute path of the per-service project file, whether or not it exists. */\n  path: string;\n  /** True when the model declares its own element kinds — the caller's byte scan, injected. */\n  standalone: boolean;\n  /** True when a `likec4.config.json` already sits beside the model. */\n  configured: boolean;\n}\n\n/** What one survey of the tree found: the gaps, the models behind them, and the domain they were counted against. */\nexport interface ProjectSurvey<T> {\n  /** Every service owed a file and lacking one, sorted by id. */\n  gaps: ProjectGap<T>[];\n  /**\n   * Every service owed NO file that has one anyway — an extending model with a\n   * `likec4.config.json` beside it, sorted by id. The mirror of `gaps`, and the\n   * same shape, because the writer does the same thing with it: `subsystem sync`\n   * plans a delete where it plans a create, and `service.likec4-config-stray`\n   * grades what is left. One predicate for both, so the grader can never name a\n   * stray the writer would decline to remove.\n   */\n  strays: ProjectGap<T>[];\n  /** Every model the survey considered, sorted by id — the four renderer grades walk this. */\n  models: SurveyedModel<T>[];\n  /**\n   * Every service the survey considered at all — a model on disk, a legal id\n   * — file or no file, whichever shape the model has. It is what the\n   * root-missing note is owed to: without the root project file NOTHING under\n   * `services/` is written, and the count a person needs there is how many\n   * models the run walked past.\n   */\n  modelled: number;\n  /**\n   * The subset of those whose model STANDS ALONE — the only services owed a\n   * project file at all, and therefore the domain `gaps` was drawn from.\n   *\n   * Apart from `modelled` because the two stopped meaning the same thing when a\n   * model could extend the map, and one subtraction rested on their being\n   * equal: `modelled - gaps.length` was \"already had a file\", and it counted\n   * every extending model as one — a fleet that had just migrated reported N\n   * services holding a file that must not exist. `standalone - gaps.length` is\n   * the same subtraction over the domain that is actually owed the file.\n   */\n  standalone: number;\n}\n\n/**\n * ONE predicate for the writer (`subsystem sync`) and the grader\n * (`validate --all`), on `viewsState`'s precedent — two private spellings of\n * \"is this model a project\" would be two chances to answer differently about\n * one file, and a grader naming a gap the writer would not fill is a loop no\n * command can clear. Both the gaps AND the count live here for the same\n * reason: a caller re-deriving \"has a model\" beside this function is the\n * second spelling in another coat.\n *\n * Structural over `{ id, dir }` so a walked service and a full entry both fit,\n * and the two file spellings arrive injected (`repo/paths.ts`'s\n * `serviceRenderPaths`) for the package reason the banner gives. Sorted by id,\n * plain lexicographic like every list this package emits, so the writer's\n * report and the grader's findings come out in one stable order.\n */\nexport function surveyProjects<T extends { id: string; dir: ServiceDir }>(\n  services: readonly T[],\n  pathsOf: (dir: ServiceDir) => { model: string; project: string },\n  isStandalone: (modelPath: string) => boolean,\n): ProjectSurvey<T> {\n  const models: SurveyedModel<T>[] = [];\n  for (const service of services) {\n    // The banner's rule: a name the renderer would refuse earns no file, and\n    // `service.id-invalid` — not this survey — is what names the repair.\n    if (dirNameHazard(service.id) !== null) continue;\n    const paths = pathsOf(service.dir);\n    if (!existsSync(paths.model)) continue;\n    models.push({\n      service,\n      path: paths.project,\n      // INJECTED rather than read here, and the reason is this package's\n      // standing one: `render/` may not import `c4/` (see `./stale.ts` on the\n      // cycle), and the shape is a fact about the model's GRAMMAR that\n      // `c4/service-model/shape.ts` owns. A predicate crossing the boundary\n      // keeps one scanner for the writer and the grader alike.\n      standalone: isStandalone(paths.model),\n      configured: existsSync(paths.project),\n    });\n  }\n  models.sort((a, b) => (a.service.id < b.service.id ? -1 : a.service.id > b.service.id ? 1 : 0));\n  return {\n    // A model that EXTENDS the map is owed no project file: it belongs to the\n    // root project, and a nested project file beside it CLAIMS it — the model\n    // then parses alone, where the map's kinds are not, and the fleet project\n    // loses the service's interior. So the gap set narrowed to the standalone\n    // shape, and `strays` below is the grade's and the writer's other direction.\n    gaps: models.filter((m) => m.standalone && !m.configured).map(({ service, path }) => ({ service, path })),\n    // The other direction, and the one the banner's correction is about: the\n    // nested project claims the model and the fleet project loses the service's\n    // interior, so the file is removed rather than tolerated.\n    strays: models.filter((m) => !m.standalone && m.configured).map(({ service, path }) => ({ service, path })),\n    models,\n    modelled: models.length,\n    standalone: models.filter((m) => m.standalone).length,\n  };\n}\n"]}

package/dist/core/repo/tree/render/service/header.js

@@ -0,0 +1,125 @@
+/**
+ * The one line that says a file under `architecture/` is LOAM'S — the opening
+ * comment both generated views files carry, and the predicate that reads it
+ * back off a file on disk.
+ *
+ * WHY A MARK EXISTS AT ALL. `architecture/subsystems.likec4` and
+ * `architecture/services.likec4` are filenames loam RESERVES inside a directory
+ * the team owns, and `loam subsystem sync` rewrites them wholesale. A docs repo
+ * that already kept a hand-authored diagram at one of those paths — plausible
+ * for `services.likec4` in particular, which loam reserved only now — would
+ * have lost it on the first sync after the upgrade, with no warning and nothing
+ * to restore it from. That is the one promise the rest of the tree keeps
+ * everywhere: authored bytes stay authored, which is what archive's verbatim
+ * splice is for. So the writer asks the file itself who wrote it, and refuses
+ * every path where the answer is not loam.
+ *
+ * IT LIVES HERE, in the leaf package, for the reason `./view-id.ts` does: the
+ * parent (`../views.ts`) may import a child and never the reverse, so the one
+ * spelling BOTH generated files must open with has to sit below both. Two
+ * literals for one mark is how the day comes that a file loam wrote is not
+ * recognised as loam's and the writer refuses to regenerate its own output.
+ *
+ * SO DOES THE READ, AND SO DOES THE SENTENCE, and that is the correction this
+ * module carries. The guard first shipped inside `loam subsystem sync` alone,
+ * and there are FOUR other writers of exactly these two paths: the shared commit
+ * window behind `subsystem new`, `rm`, `move` and `rename`
+ * (`commands/subsystem/txn/txn.ts`) and `loam seed`
+ * (`commands/seed/plan.ts`). Reproduced before this module grew: with a
+ * hand-authored `architecture/services.likec4` in the tree, `loam subsystem new
+ * platform` printed "architecture/services.likec4 updated" and destroyed it —
+ * the file's digest changed and its first line became loam's header. A guard
+ * that lives in one of five writers is not a guard. So the reader
+ * (`readGeneratedFile`, `authoredGeneratedPaths`) and the refusal sentence
+ * (`authoredRefusal`) sit beside the mark itself, below every writer, and a
+ * sixth writer added tomorrow has one place to reach for rather than a fourth
+ * spelling to invent.
+ */
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+/**
+ * The first bytes of every generated views file. Part of the content-compare
+ * contract, so it is not prose that may be reworded: the rest of each header is,
+ * and deliberately, because only this much identifies the owner.
+ */
+export const GENERATED_MARK = "// generated by loam";
+/**
+ * Was the text now at a generated path written by loam?
+ *
+ * A LEADING BYTE-ORDER MARK is stripped first, and that is not tidiness: a
+ * Windows editor that opens a generated file and saves it back adds one without
+ * changing a single fact in the file, and without this the writer would call its
+ * own output authored and refuse to regenerate it for good — a refusal no
+ * re-running could ever clear. CRLF needs no such treatment, for the reason
+ * `viewsAgree` records one file over: the mark is the head of the first line and
+ * the line ending is behind it.
+ *
+ * The test is the MARK and not the whole header, because the header's remaining
+ * lines differ between the two files and are prose. It is also deliberately not
+ * a test of the whole file: a hand EDIT of a generated file keeps the header, and
+ * that file is loam's to repair — `subsystem.views-stale` names it and one sync
+ * puts it back. Only a file that never carried the mark is somebody else's.
+ */
+export function isGenerated(text) {
+    return text.replace(/^\uFEFF/, "").startsWith(GENERATED_MARK);
+}
+/**
+ * Read one generated path and answer both questions about it at once \u2014 what it
+ * says, and whether loam may write it.
+ *
+ * ONE READ, because the only caller that needs the text is the one that also
+ * compares it (`subsystem sync`'s `planFile`), and asking the disk twice for the
+ * same small file so that two helpers could each own half the answer is how the
+ * two halves come to disagree about which file they were talking about.
+ *
+ * ABSENT IS NOT AUTHORED. There is nothing to lose at a path that holds
+ * nothing, and a fleet being scaffolded must still get its first generated file
+ * \u2014 a guard that refused an absent file would refuse every repository forever.
+ */
+export async function readGeneratedFile(path) {
+    if (!existsSync(path))
+        return { text: null, authored: false };
+    const text = await readFile(path, "utf8");
+    return { text, authored: !isGenerated(text) };
+}
+/**
+ * Which of these generated paths hold a file loam did not write \u2014 the question
+ * every writer that rewrites the PAIR wholesale asks before it stages anything.
+ *
+ * The paths come back in the order they were given, so a caller's message names
+ * the files in a stable order rather than in whichever order the reads finished.
+ */
+export async function authoredGeneratedPaths(paths) {
+    // Independent reads of at most two small files: `Promise.all`, per the house
+    // rule, and the order of the input is preserved by the map rather than by the
+    // scheduler.
+    const reads = await Promise.all(paths.map(async (path) => ({ path, read: await readGeneratedFile(path) })));
+    return reads.filter((r) => r.read.authored).map((r) => r.path);
+}
+/**
+ * The one sentence a refusal owes about ONE authored file, composed here and
+ * parameterised by the file, because FIVE writers refuse for this reason and a
+ * reader who met the sentence from `loam subsystem sync` must recognise it
+ * verbatim from `loam subsystem new`, `rm`, `move`, `rename` and `loam seed`.
+ *
+ * It names three things a person cannot get anywhere else: which file was left
+ * alone, WHY loam thinks the file is not its own (the mark it looked for), and
+ * the fact that nothing was written to it. The last clause closes the loop the
+ * refusal otherwise leaves open \u2014 `loam validate --all` will keep reporting
+ * `subsystem.views-stale` for that path and keep naming `loam subsystem sync` as
+ * the repair, so a person who is not told why the writers decline would be sent
+ * back and forth between the two forever.
+ *
+ * It deliberately does NOT name a command to re-run. It used to say "re-run
+ * `loam subsystem sync`", which was true of the one caller it then had and wrong
+ * for the four that were added: the command to re-run is the one the person
+ * typed, and the sentence a caller appends says what that command did instead.
+ */
+export function authoredRefusal(file) {
+    return (`${file} left as it is \u2014 its first line is not \`${GENERATED_MARK}\`, so it is an AUTHORED file standing at a ` +
+        "path loam generates and rewrites wholesale. Nothing was written to it and not one of its bytes changed. " +
+        "Rename it to something loam does not reserve (every other `.likec4` under architecture/ renders in the same " +
+        "project, so the diagram is not lost) or delete it, then re-run. Until then `loam validate --all` reports " +
+        "`subsystem.views-stale` for that path and every loam command that writes the file keeps refusing.");
+}
+//# sourceMappingURL=header.js.map

package/dist/core/repo/tree/render/service/header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header.js","sourceRoot":"","sources":["../../../../../../src/core/repo/tree/render/service/header.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAChE,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAwB;IACnE,6EAA6E;IAC7E,8EAA8E;IAC9E,aAAa;IACb,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAC3E,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,CACL,GAAG,IAAI,iDAAiD,cAAc,8CAA8C;QACpH,0GAA0G;QAC1G,8GAA8G;QAC9G,2GAA2G;QAC3G,mGAAmG,CACpG,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The one line that says a file under `architecture/` is LOAM'S — the opening\n * comment both generated views files carry, and the predicate that reads it\n * back off a file on disk.\n *\n * WHY A MARK EXISTS AT ALL. `architecture/subsystems.likec4` and\n * `architecture/services.likec4` are filenames loam RESERVES inside a directory\n * the team owns, and `loam subsystem sync` rewrites them wholesale. A docs repo\n * that already kept a hand-authored diagram at one of those paths — plausible\n * for `services.likec4` in particular, which loam reserved only now — would\n * have lost it on the first sync after the upgrade, with no warning and nothing\n * to restore it from. That is the one promise the rest of the tree keeps\n * everywhere: authored bytes stay authored, which is what archive's verbatim\n * splice is for. So the writer asks the file itself who wrote it, and refuses\n * every path where the answer is not loam.\n *\n * IT LIVES HERE, in the leaf package, for the reason `./view-id.ts` does: the\n * parent (`../views.ts`) may import a child and never the reverse, so the one\n * spelling BOTH generated files must open with has to sit below both. Two\n * literals for one mark is how the day comes that a file loam wrote is not\n * recognised as loam's and the writer refuses to regenerate its own output.\n *\n * SO DOES THE READ, AND SO DOES THE SENTENCE, and that is the correction this\n * module carries. The guard first shipped inside `loam subsystem sync` alone,\n * and there are FOUR other writers of exactly these two paths: the shared commit\n * window behind `subsystem new`, `rm`, `move` and `rename`\n * (`commands/subsystem/txn/txn.ts`) and `loam seed`\n * (`commands/seed/plan.ts`). Reproduced before this module grew: with a\n * hand-authored `architecture/services.likec4` in the tree, `loam subsystem new\n * platform` printed \"architecture/services.likec4 updated\" and destroyed it —\n * the file's digest changed and its first line became loam's header. A guard\n * that lives in one of five writers is not a guard. So the reader\n * (`readGeneratedFile`, `authoredGeneratedPaths`) and the refusal sentence\n * (`authoredRefusal`) sit beside the mark itself, below every writer, and a\n * sixth writer added tomorrow has one place to reach for rather than a fourth\n * spelling to invent.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\n\n/**\n * The first bytes of every generated views file. Part of the content-compare\n * contract, so it is not prose that may be reworded: the rest of each header is,\n * and deliberately, because only this much identifies the owner.\n */\nexport const GENERATED_MARK = \"// generated by loam\";\n\n/**\n * Was the text now at a generated path written by loam?\n *\n * A LEADING BYTE-ORDER MARK is stripped first, and that is not tidiness: a\n * Windows editor that opens a generated file and saves it back adds one without\n * changing a single fact in the file, and without this the writer would call its\n * own output authored and refuse to regenerate it for good — a refusal no\n * re-running could ever clear. CRLF needs no such treatment, for the reason\n * `viewsAgree` records one file over: the mark is the head of the first line and\n * the line ending is behind it.\n *\n * The test is the MARK and not the whole header, because the header's remaining\n * lines differ between the two files and are prose. It is also deliberately not\n * a test of the whole file: a hand EDIT of a generated file keeps the header, and\n * that file is loam's to repair — `subsystem.views-stale` names it and one sync\n * puts it back. Only a file that never carried the mark is somebody else's.\n */\nexport function isGenerated(text: string): boolean {\n  return text.replace(/^\\uFEFF/, \"\").startsWith(GENERATED_MARK);\n}\n\n/** What a writer of a generated path learns by reading it, in one read. */\nexport interface GeneratedFileRead {\n  /** The bytes as text, or null when nothing stands at the path. */\n  text: string | null;\n  /** SOMEBODY ELSE wrote this: a file is there and its first line is not the mark. */\n  authored: boolean;\n}\n\n/**\n * Read one generated path and answer both questions about it at once \\u2014 what it\n * says, and whether loam may write it.\n *\n * ONE READ, because the only caller that needs the text is the one that also\n * compares it (`subsystem sync`'s `planFile`), and asking the disk twice for the\n * same small file so that two helpers could each own half the answer is how the\n * two halves come to disagree about which file they were talking about.\n *\n * ABSENT IS NOT AUTHORED. There is nothing to lose at a path that holds\n * nothing, and a fleet being scaffolded must still get its first generated file\n * \\u2014 a guard that refused an absent file would refuse every repository forever.\n */\nexport async function readGeneratedFile(path: string): Promise<GeneratedFileRead> {\n  if (!existsSync(path)) return { text: null, authored: false };\n  const text = await readFile(path, \"utf8\");\n  return { text, authored: !isGenerated(text) };\n}\n\n/**\n * Which of these generated paths hold a file loam did not write \\u2014 the question\n * every writer that rewrites the PAIR wholesale asks before it stages anything.\n *\n * The paths come back in the order they were given, so a caller's message names\n * the files in a stable order rather than in whichever order the reads finished.\n */\nexport async function authoredGeneratedPaths(paths: readonly string[]): Promise<string[]> {\n  // Independent reads of at most two small files: `Promise.all`, per the house\n  // rule, and the order of the input is preserved by the map rather than by the\n  // scheduler.\n  const reads = await Promise.all(\n    paths.map(async (path) => ({ path, read: await readGeneratedFile(path) })),\n  );\n  return reads.filter((r) => r.read.authored).map((r) => r.path);\n}\n\n/**\n * The one sentence a refusal owes about ONE authored file, composed here and\n * parameterised by the file, because FIVE writers refuse for this reason and a\n * reader who met the sentence from `loam subsystem sync` must recognise it\n * verbatim from `loam subsystem new`, `rm`, `move`, `rename` and `loam seed`.\n *\n * It names three things a person cannot get anywhere else: which file was left\n * alone, WHY loam thinks the file is not its own (the mark it looked for), and\n * the fact that nothing was written to it. The last clause closes the loop the\n * refusal otherwise leaves open \\u2014 `loam validate --all` will keep reporting\n * `subsystem.views-stale` for that path and keep naming `loam subsystem sync` as\n * the repair, so a person who is not told why the writers decline would be sent\n * back and forth between the two forever.\n *\n * It deliberately does NOT name a command to re-run. It used to say \"re-run\n * `loam subsystem sync`\", which was true of the one caller it then had and wrong\n * for the four that were added: the command to re-run is the one the person\n * typed, and the sentence a caller appends says what that command did instead.\n */\nexport function authoredRefusal(file: string): string {\n  return (\n    `${file} left as it is \\u2014 its first line is not \\`${GENERATED_MARK}\\`, so it is an AUTHORED file standing at a ` +\n    \"path loam generates and rewrites wholesale. Nothing was written to it and not one of its bytes changed. \" +\n    \"Rename it to something loam does not reserve (every other `.likec4` under architecture/ renders in the same \" +\n    \"project, so the diagram is not lost) or delete it, then re-run. Until then `loam validate --all` reports \" +\n    \"`subsystem.views-stale` for that path and every loam command that writes the file keeps refusing.\"\n  );\n}\n"]}

package/dist/core/repo/tree/render/service/peers.js

@@ -0,0 +1,28 @@
+/**
+ * Every element on the far side of an edge touching this service, sorted and
+ * de-duplicated.
+ *
+ * "Touching" is the subject OR any descendant of it: an edge into
+ * `svc.api` is an edge into the service, and the view that hid it would be
+ * lying about the service's surface. The far endpoint is dropped when it is
+ * itself the subject or one of its descendants — that is INTERIOR, already
+ * drawn by the view's own `include *`, and naming it again would put a second
+ * include line in the file for a node that is already there.
+ *
+ * Sorted and de-duplicated because the generated file is a pure function of
+ * committed bytes: document order is the parse's, not the author's, and two
+ * edges between the same pair must not emit the same include twice.
+ */
+export function peersOf(fqn, relationships) {
+    const prefix = `${fqn}.`;
+    const own = (id) => id === fqn || id.startsWith(prefix);
+    const found = new Set();
+    for (const rel of relationships) {
+        if (own(rel.source) && !own(rel.target))
+            found.add(rel.target);
+        if (own(rel.target) && !own(rel.source))
+            found.add(rel.source);
+    }
+    return [...found].sort();
+}
+//# sourceMappingURL=peers.js.map

package/dist/core/repo/tree/render/service/peers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"peers.js","sourceRoot":"","sources":["../../../../../../src/core/repo/tree/render/service/peers.ts"],"names":[],"mappings":"AAoCA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,aAA6B;IAChE,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["/**\n * The NEIGHBOUR SET of one service: every element the map draws an edge to or\n * from, computed by loam rather than asked of the renderer.\n *\n * This module exists because of a measurement, and the measurement is the whole\n * reason the per-service view is not three wildcard lines. At likec4 1.59.2, on\n * a 120-service map whose services are nested in `group` boxes, the obvious\n * recipe\n *\n *     include *\n *     include <fqn> -> *\n *     include * -> <fqn>\n *\n * drew the GROUP BOXES as the counterparts — `growth`, `catalog`, `support`,\n * `notifications` — instead of the peer services, and NONE of them carried\n * drill-down. LikeC4 resolves a counterpart at the highest ancestor that is not\n * also an ancestor of the subject, so on any map that groups its services —\n * which is exactly what a fleet past about thirty services needs at fleet\n * level — the wildcard form says \"payments/service-0 talks to the growth group\"\n * and navigates nowhere. It looks perfect on a five-service FLAT fixture, which\n * is how it would have shipped.\n *\n * Re-measured here at 1.59.2 on the 58-service / 11-group fleet, subject\n * `payments.svc0` with 8 real peers: the wildcard recipe draws 10 nodes of which\n * four are group boxes; naming the peers draws 11 — the subject, its `api`, its\n * `db` and all 8 peers, each at its own level, each carrying `navigateTo` into\n * that peer's own generated view (6 of the 8 are services and have one; the\n * customer and the broker are not).\n *\n * The counterpart is taken AS THE MAP DECLARES IT — an edge landing on\n * `kafka.orderEvents` names the topic, not the broker — because that is the\n * truer picture and it is the one the map already draws. Anything the render\n * substituted here would be loam re-drawing somebody's architecture.\n */\nimport type { Rel } from \"../../../../c4/likec4.js\";\n\n/**\n * Every element on the far side of an edge touching this service, sorted and\n * de-duplicated.\n *\n * \"Touching\" is the subject OR any descendant of it: an edge into\n * `svc.api` is an edge into the service, and the view that hid it would be\n * lying about the service's surface. The far endpoint is dropped when it is\n * itself the subject or one of its descendants — that is INTERIOR, already\n * drawn by the view's own `include *`, and naming it again would put a second\n * include line in the file for a node that is already there.\n *\n * Sorted and de-duplicated because the generated file is a pure function of\n * committed bytes: document order is the parse's, not the author's, and two\n * edges between the same pair must not emit the same include twice.\n */\nexport function peersOf(fqn: string, relationships: readonly Rel[]): string[] {\n  const prefix = `${fqn}.`;\n  const own = (id: string): boolean => id === fqn || id.startsWith(prefix);\n  const found = new Set<string>();\n  for (const rel of relationships) {\n    if (own(rel.source) && !own(rel.target)) found.add(rel.target);\n    if (own(rel.target) && !own(rel.source)) found.add(rel.source);\n  }\n  return [...found].sort();\n}\n"]}

package/dist/core/repo/tree/render/service/view-id.js

@@ -0,0 +1,67 @@
+/**
+ * The identifier loam mints for a per-service overview view, and the ONE
+ * encoder every generated view id is spelled through.
+ *
+ * The encoder lives HERE, in the child package, rather than beside the
+ * subsystem render that has used it since it was written — and the direction is
+ * forced rather than chosen. `../views.ts` imports this package to compose the
+ * per-service file, so an import the other way would be the package cycle
+ * `scripts/package-graph.mjs` refuses; that script's own advice for exactly this
+ * shape is "move the helper; do not import the weight", and an id encoder is the
+ * leaf while the two renders are the weight. One copy is also the point: the
+ * injectivity argument below holds across BOTH prefixes only while they share an
+ * encoder, and a second spelling would be a second chance to collide.
+ *
+ * INJECTIVITY is a correctness rule and not tidiness. The renderer refuses the
+ * whole `architecture/` project over a duplicate view id, and the naive folding
+ * (every non-identifier byte and the join separator alike becoming `_`) collided
+ * three DISTINCT healthy names onto one identifier — `a_b`, and `b` under `a`,
+ * both rendering `subsystem_a_b` — so `validate --all` was green while the
+ * renderer refused the fleet map, and `subsystem.name-collision` never fired
+ * because the flat namespace really was intact.
+ *
+ * Hence the encoding: an identifier byte (`[A-Za-z0-9]`) passes through, any
+ * other byte becomes `_` + two lowercase hex digits (`.` → `_2e`, `-` → `_2d`,
+ * `_` itself → `_5f` — the underscore must be escaped precisely because it is
+ * BOTH legal in a name and the separator between path segments). Underscore runs
+ * then decode uniquely — one is an escape, two a separator, three a separator
+ * followed by an escape — so no two distinct legal names share an identifier. A
+ * name `subsystem.name-invalid` already flagged may hold a code point above 0xff
+ * whose longer hex could in principle re-collide; it is deterministic still, and
+ * that directory is already an error finding by name.
+ *
+ * The prefix is EXPORTED, with the minting function, because the collision check
+ * (`subsystem.view-id-collision`) has to ask the generator what it mints rather
+ * than re-derive it. A check carrying its own copy of the escaping goes quiet the
+ * day the encoding changes, and going quiet is the failure that whole family
+ * exists to prevent.
+ */
+/**
+ * The reserved prefix for a generated per-service overview. Distinct from
+ * `subsystem_` so the two generated files can never mint the same id for
+ * different subjects, and it cannot match the shape LikeC4 mints for an unnamed
+ * view (`^view_[0-9a-z]+$`, `core/c4/parsed/view-ids.ts`), so a generated id is
+ * never mistaken for a synthesized one.
+ */
+export const SERVICE_VIEW_PREFIX = "service_";
+/** One name, folded to identifier bytes injectively — the banner argues why this shape. */
+export function escapeViewIdSegment(name) {
+    return [...name]
+        .map((ch) => (/[A-Za-z0-9]/.test(ch) ? ch : `_${ch.codePointAt(0).toString(16).padStart(2, "0")}`))
+        .join("");
+}
+/**
+ * The view id for one service, from its `services/<id>/` DIRECTORY name.
+ *
+ * The directory id rather than the map element's title or its fqn, for the same
+ * reason the title uses it: it is the name every loam command already addresses
+ * the service by, a directory name cannot hold a `/` or a `.`, and it cannot
+ * drift when somebody renames a box on the map. Two services cannot share a
+ * directory id — the walk's flat namespace already refuses that as
+ * `subsystem.name-collision` — so injectivity of the encoder is injectivity of
+ * the whole id.
+ */
+export function serviceViewId(id) {
+    return `${SERVICE_VIEW_PREFIX}${escapeViewIdSegment(id)}`;
+}
+//# sourceMappingURL=view-id.js.map

package/dist/core/repo/tree/render/service/view-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-id.js","sourceRoot":"","sources":["../../../../../../src/core/repo/tree/render/service/view-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE9C,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,CAAC,GAAG,IAAI,CAAC;SACb,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;SACnG,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,GAAG,mBAAmB,GAAG,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * The identifier loam mints for a per-service overview view, and the ONE\n * encoder every generated view id is spelled through.\n *\n * The encoder lives HERE, in the child package, rather than beside the\n * subsystem render that has used it since it was written — and the direction is\n * forced rather than chosen. `../views.ts` imports this package to compose the\n * per-service file, so an import the other way would be the package cycle\n * `scripts/package-graph.mjs` refuses; that script's own advice for exactly this\n * shape is \"move the helper; do not import the weight\", and an id encoder is the\n * leaf while the two renders are the weight. One copy is also the point: the\n * injectivity argument below holds across BOTH prefixes only while they share an\n * encoder, and a second spelling would be a second chance to collide.\n *\n * INJECTIVITY is a correctness rule and not tidiness. The renderer refuses the\n * whole `architecture/` project over a duplicate view id, and the naive folding\n * (every non-identifier byte and the join separator alike becoming `_`) collided\n * three DISTINCT healthy names onto one identifier — `a_b`, and `b` under `a`,\n * both rendering `subsystem_a_b` — so `validate --all` was green while the\n * renderer refused the fleet map, and `subsystem.name-collision` never fired\n * because the flat namespace really was intact.\n *\n * Hence the encoding: an identifier byte (`[A-Za-z0-9]`) passes through, any\n * other byte becomes `_` + two lowercase hex digits (`.` → `_2e`, `-` → `_2d`,\n * `_` itself → `_5f` — the underscore must be escaped precisely because it is\n * BOTH legal in a name and the separator between path segments). Underscore runs\n * then decode uniquely — one is an escape, two a separator, three a separator\n * followed by an escape — so no two distinct legal names share an identifier. A\n * name `subsystem.name-invalid` already flagged may hold a code point above 0xff\n * whose longer hex could in principle re-collide; it is deterministic still, and\n * that directory is already an error finding by name.\n *\n * The prefix is EXPORTED, with the minting function, because the collision check\n * (`subsystem.view-id-collision`) has to ask the generator what it mints rather\n * than re-derive it. A check carrying its own copy of the escaping goes quiet the\n * day the encoding changes, and going quiet is the failure that whole family\n * exists to prevent.\n */\n\n/**\n * The reserved prefix for a generated per-service overview. Distinct from\n * `subsystem_` so the two generated files can never mint the same id for\n * different subjects, and it cannot match the shape LikeC4 mints for an unnamed\n * view (`^view_[0-9a-z]+$`, `core/c4/parsed/view-ids.ts`), so a generated id is\n * never mistaken for a synthesized one.\n */\nexport const SERVICE_VIEW_PREFIX = \"service_\";\n\n/** One name, folded to identifier bytes injectively — the banner argues why this shape. */\nexport function escapeViewIdSegment(name: string): string {\n  return [...name]\n    .map((ch) => (/[A-Za-z0-9]/.test(ch) ? ch : `_${ch.codePointAt(0)!.toString(16).padStart(2, \"0\")}`))\n    .join(\"\");\n}\n\n/**\n * The view id for one service, from its `services/<id>/` DIRECTORY name.\n *\n * The directory id rather than the map element's title or its fqn, for the same\n * reason the title uses it: it is the name every loam command already addresses\n * the service by, a directory name cannot hold a `/` or a `.`, and it cannot\n * drift when somebody renames a box on the map. Two services cannot share a\n * directory id — the walk's flat namespace already refuses that as\n * `subsystem.name-collision` — so injectivity of the encoder is injectivity of\n * the whole id.\n */\nexport function serviceViewId(id: string): string {\n  return `${SERVICE_VIEW_PREFIX}${escapeViewIdSegment(id)}`;\n}\n"]}

package/dist/core/repo/tree/render/service/views.js

@@ -0,0 +1,78 @@
+import { GENERATED_MARK } from "./header.js";
+import { peersOf } from "./peers.js";
+import { serviceViewId } from "./view-id.js";
+/**
+ * The global style group these views reference when the map declares one, the
+ * exact counterpart of `SUBSYSTEM_STYLE_GROUP` and reserved on the same terms:
+ * presence of the DECLARATION is the whole opt-in, because referencing an
+ * undeclared style id is a parse error that blanks the entire `architecture/`
+ * project in the renderer. The name mirrors the file it styles.
+ */
+export const SERVICE_STYLE_GROUP = "services";
+/**
+ * The header every generated file opens with — stable bytes, part of the
+ * content-compare contract, naming the regenerator so a reader who found the
+ * file before the docs knows what owns it. `loam subsystem sync` regenerates
+ * BOTH generated files, which is why one command is named here and why one
+ * finding code (`subsystem.views-stale`) honestly covers both.
+ *
+ * It OPENS with the shared `GENERATED_MARK` rather than spelling it, because
+ * the same bytes are what `loam subsystem sync` reads back off disk to decide
+ * whether the file at this reserved path is loam's to rewrite at all
+ * (`./header.js`). A second literal here is how a file loam wrote stops being
+ * recognised as loam's.
+ */
+const HEADER = `${GENERATED_MARK} — one overview view per service under services/, drawn from the fleet map.\n` +
+    "// Do not edit: `loam subsystem sync` regenerates this file from the directories and the map,\n" +
+    "// and `loam validate --all` reports `subsystem.views-stale` when it drifts.\n" +
+    "// A navigation aid, not the fleet's architecture: author your own diagrams elsewhere.\n";
+/**
+ * Render the whole file, or null when no service resolves to a map element —
+ * the file must then be ABSENT, so a fleet whose map draws nothing never
+ * carries a generated artifact that says nothing.
+ *
+ * Services sorted by id and peers sorted by id, one `include` per line: the
+ * output is byte-reproducible on any machine from the same committed bytes (no
+ * timestamps, no absolute paths, no readdir-order dependence), and two
+ * concurrent changes to different services touch different lines, so git merges
+ * the file without intervention.
+ */
+export function renderServiceViews(input) {
+    if (input.subjects.length === 0)
+        return null;
+    const lines = [HEADER, ...(input.disclosure === null ? [] : [input.disclosure]), "views {"];
+    const subjects = [...input.subjects].sort((a, b) => (a.id < b.id ? -1 : 1));
+    for (const [i, subject] of subjects.entries()) {
+        if (i > 0)
+            lines.push("");
+        lines.push(...viewLines(subject, peersOf(subject.fqn, input.relationships), input.styled));
+    }
+    lines.push("}");
+    return lines.join("\n") + "\n";
+}
+/**
+ * One view, in the order the parser demands: metadata FIRST, and that is a hard
+ * constraint rather than a taste — measured, an `include` line followed by
+ * `title` is a parse error ("Expecting token of type '}' but found `title`"),
+ * and one parse error in this file blanks the whole `architecture/` project in
+ * the renderer. `global style` sits after `title` and before anything that
+ * includes, where the same pin measured it parsing with zero errors.
+ */
+function viewLines(subject, peers, styled) {
+    const { fqn } = subject;
+    const out = [`  view ${serviceViewId(subject.id)} of ${fqn} {`, `    title '${subject.title}'`];
+    if (styled)
+        out.push(`    global style ${SERVICE_STYLE_GROUP}`);
+    out.push("    include *");
+    for (const peer of peers)
+        out.push(`    include ${peer}`);
+    out.push("    exclude * -> *", `    include -> ${fqn}`, `    include ${fqn} ->`);
+    // The interior wiring, last. Measured: `include <fqn>.* -> <fqn>.*` on a
+    // CHILDLESS element is legal — `likec4 validate` reports valid and the export
+    // carries zero errors — so one generated line serves both model shapes: an
+    // EXTENDING model's containers live in the root project and are drawn, a
+    // STANDALONE model's are not in this project and the line matches nothing.
+    out.push(`    include ${fqn}.* -> ${fqn}.*`, "  }");
+    return out;
+}
+//# sourceMappingURL=views.js.map

package/dist/core/repo/tree/render/service/views.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"views.js","sourceRoot":"","sources":["../../../../../../src/core/repo/tree/render/service/views.ts"],"names":[],"mappings":"AAkEA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAuB9C;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,GACV,GAAG,cAAc,+EAA+E;IAChG,iGAAiG;IACjG,gFAAgF;IAChF,0FAA0F,CAAC;AAE7F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAa,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,OAA2B,EAAE,KAAwB,EAAE,MAAe;IACvF,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,UAAU,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,GAAG,IAAI,EAAE,cAAc,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;IAChG,IAAI,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,mBAAmB,EAAE,CAAC,CAAC;IAChE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAC1D,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,GAAG,EAAE,EAAE,eAAe,GAAG,KAAK,CAAC,CAAC;IACjF,yEAAyE;IACzE,8EAA8E;IAC9E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CAAC,eAAe,GAAG,SAAS,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * `architecture/services.likec4` — one generated LikeC4 view per service,\n * showing that service, its own interior, and its links to everything else the\n * fleet map draws.\n *\n * GENERATED, never authored, exactly like the subsystem views beside it:\n * authored bytes stay authored (archive's verbatim-splice promise), `loam\n * subsystem sync` owns this file outright, and staleness against the tree is a\n * content compare and never a parse — a views-only document does not parse\n * standalone, so nothing in loam ever loads it. docs/DESIGN.md rule 26 does not\n * change with a second file: what a view SHOWS stays unread in every document,\n * this one included.\n *\n * ## The recipe, and why the obvious one is wrong\n *\n * Measured at likec4 1.59.2 on a 120-service and a 58-service fleet. Each view\n * is written as\n *\n *     view service_<id> of <fqn> {\n *       title '<subsystem path> / <service id>'\n *       global style services          // only when the map declares the group\n *       include *                      // the service and its own interior\n *       include <peer>                 // one line per peer, id-sorted\n *       exclude * -> *                 // drop the peer-to-peer cross traffic\n *       include -> <fqn>               // its inbound edges\n *       include <fqn> ->               // its outbound edges\n *       include <fqn>.* -> <fqn>.*     // its internal wiring\n *     }\n *\n * Three things in that shape are measurements rather than taste, and each one\n * fails SILENTLY — zero errors, a wrong picture — if it is tidied away:\n *\n *  1. **The peers are named, not wildcarded.** `./peers.ts` carries the\n *     measurement: `include <fqn> -> *` collapses every counterpart to its\n *     GROUP box and yields zero drill-down on any map that nests services.\n *  2. **The edge predicates are UNARY.** `include -> <fqn>` and `include <fqn>\n *     ->`, never the binary `include * -> <fqn>` / `include <fqn> -> *`.\n *     Measured on `payments.svc0` of the 58-service fleet, swapping the two\n *     unary lines for their binary forms takes the view from 11 nodes to 15:\n *     the four parent GROUP boxes of the named peers come back as nodes of\n *     their own, so the view regrows exactly what rule 1 removed. Zero errors\n *     either way, which is what makes it worth a comment.\n *  3. **`exclude * -> *` sits between the includes and the edge lines.** Without\n *     it the named peers bring their own cross traffic with them: on the same\n *     subject, 24 edges instead of 9, on a view about one service.\n *\n * `of <fqn>` is the navigation half and costs one keyword: LikeC4 computes\n * `navigateTo` into a view declared `of` an element from every OTHER view that\n * draws that element, with no authored links. That is what makes the fleet map,\n * every subsystem view and every other service view click-through into a\n * service. Two views of one element are legal — the first document\n * alphabetically wins the default target and both stay reachable, because the\n * subject's own node cycles to the other — so a team's authored element view in\n * `landscape.likec4` keeps precedence over this file, which sorts later.\n *\n * ## What arrives from outside\n *\n * Everything about the TREE — which services exist, what each one's element is,\n * what its title reads — arrives composed, in `ServiceViewSubject`. This package\n * may not import `../views.ts` or `../text.ts`: the parent imports it, and the\n * reverse edge would be the package cycle `scripts/package-graph.mjs` refuses.\n * So the title arrives already through `likec4String` rather than escaped a\n * second time here; a second escaper is how one of the two forgets an\n * apostrophe and ships a fleet-wide parse error.\n */\nimport type { Rel } from \"../../../../c4/likec4.js\";\nimport { GENERATED_MARK } from \"./header.js\";\nimport { peersOf } from \"./peers.js\";\nimport { serviceViewId } from \"./view-id.js\";\n\n/**\n * The global style group these views reference when the map declares one, the\n * exact counterpart of `SUBSYSTEM_STYLE_GROUP` and reserved on the same terms:\n * presence of the DECLARATION is the whole opt-in, because referencing an\n * undeclared style id is a parse error that blanks the entire `architecture/`\n * project in the renderer. The name mirrors the file it styles.\n */\nexport const SERVICE_STYLE_GROUP = \"services\";\n\n/** One service this file draws — resolved against the map, and already escaped. */\nexport interface ServiceViewSubject {\n  /** The `services/<id>/` directory id: the sort key and the view id's source. */\n  id: string;\n  /** The landscape element it resolves to — the view's `of`, and its subject. */\n  fqn: string;\n  /** `<subsystem path> / <service id>`, already through `likec4String`. */\n  title: string;\n}\n\n/** Everything the file render reads, as one record — see the banner on why it arrives composed. */\nexport interface ServiceViewsInput {\n  subjects: readonly ServiceViewSubject[];\n  /** The map's edges, from which each subject's peer set is computed. */\n  relationships: readonly Rel[];\n  /** Emit `global style services` — true only when the map DECLARES that group. */\n  styled: boolean;\n  /** The one file-level comment the render may write, or null. */\n  disclosure: string | null;\n}\n\n/**\n * The header every generated file opens with — stable bytes, part of the\n * content-compare contract, naming the regenerator so a reader who found the\n * file before the docs knows what owns it. `loam subsystem sync` regenerates\n * BOTH generated files, which is why one command is named here and why one\n * finding code (`subsystem.views-stale`) honestly covers both.\n *\n * It OPENS with the shared `GENERATED_MARK` rather than spelling it, because\n * the same bytes are what `loam subsystem sync` reads back off disk to decide\n * whether the file at this reserved path is loam's to rewrite at all\n * (`./header.js`). A second literal here is how a file loam wrote stops being\n * recognised as loam's.\n */\nconst HEADER =\n  `${GENERATED_MARK} — one overview view per service under services/, drawn from the fleet map.\\n` +\n  \"// Do not edit: `loam subsystem sync` regenerates this file from the directories and the map,\\n\" +\n  \"// and `loam validate --all` reports `subsystem.views-stale` when it drifts.\\n\" +\n  \"// A navigation aid, not the fleet's architecture: author your own diagrams elsewhere.\\n\";\n\n/**\n * Render the whole file, or null when no service resolves to a map element —\n * the file must then be ABSENT, so a fleet whose map draws nothing never\n * carries a generated artifact that says nothing.\n *\n * Services sorted by id and peers sorted by id, one `include` per line: the\n * output is byte-reproducible on any machine from the same committed bytes (no\n * timestamps, no absolute paths, no readdir-order dependence), and two\n * concurrent changes to different services touch different lines, so git merges\n * the file without intervention.\n */\nexport function renderServiceViews(input: ServiceViewsInput): string | null {\n  if (input.subjects.length === 0) return null;\n  const lines: string[] = [HEADER, ...(input.disclosure === null ? [] : [input.disclosure]), \"views {\"];\n  const subjects = [...input.subjects].sort((a, b) => (a.id < b.id ? -1 : 1));\n  for (const [i, subject] of subjects.entries()) {\n    if (i > 0) lines.push(\"\");\n    lines.push(...viewLines(subject, peersOf(subject.fqn, input.relationships), input.styled));\n  }\n  lines.push(\"}\");\n  return lines.join(\"\\n\") + \"\\n\";\n}\n\n/**\n * One view, in the order the parser demands: metadata FIRST, and that is a hard\n * constraint rather than a taste — measured, an `include` line followed by\n * `title` is a parse error (\"Expecting token of type '}' but found `title`\"),\n * and one parse error in this file blanks the whole `architecture/` project in\n * the renderer. `global style` sits after `title` and before anything that\n * includes, where the same pin measured it parsing with zero errors.\n */\nfunction viewLines(subject: ServiceViewSubject, peers: readonly string[], styled: boolean): string[] {\n  const { fqn } = subject;\n  const out = [`  view ${serviceViewId(subject.id)} of ${fqn} {`, `    title '${subject.title}'`];\n  if (styled) out.push(`    global style ${SERVICE_STYLE_GROUP}`);\n  out.push(\"    include *\");\n  for (const peer of peers) out.push(`    include ${peer}`);\n  out.push(\"    exclude * -> *\", `    include -> ${fqn}`, `    include ${fqn} ->`);\n  // The interior wiring, last. Measured: `include <fqn>.* -> <fqn>.*` on a\n  // CHILDLESS element is legal — `likec4 validate` reports valid and the export\n  // carries zero errors — so one generated line serves both model shapes: an\n  // EXTENDING model's containers live in the root project and are drawn, a\n  // STANDALONE model's are not in this project and the line matches nothing.\n  out.push(`    include ${fqn}.* -> ${fqn}.*`, \"  }\");\n  return out;\n}\n"]}

package/dist/core/repo/tree/render/stale.js

@@ -16,10 +16,26 @@
  */
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
-import {} from "../../../c4/likec4.js";
-import { renderSubsystemViews, viewsAgree } from "./views.js";
-export async function viewsState(path, tree, elements) {
-    const expected = renderSubsystemViews(tree, elements);
+import { renderServiceOverviews, renderSubsystemViews, viewsAgree } from "./views.js";
+export async function viewsState(path, tree, map) {
+    return stateOf(path, renderSubsystemViews(tree, map));
+}
+/**
+ * The same question about the OTHER generated file, `architecture/services.likec4`.
+ *
+ * A second exported function rather than a `which` parameter, and a second call
+ * at every asker rather than one that answers about both: the two files go stale
+ * for different reasons and are repaired in one command, so a caller that wants
+ * both asks twice and names each file in its own finding —
+ * `subsystem.views-stale` carries the path precisely so one code can honestly
+ * cover two files. Folding them into one state would lose which one drifted,
+ * which is the only thing the message has to say.
+ */
+export async function serviceViewsState(path, tree, map) {
+    return stateOf(path, renderServiceOverviews(tree, map));
+}
+/** Read the file, or record its absence, and compare — the half both askers share. */
+async function stateOf(path, expected) {
     const actual = existsSync(path) ? await readFile(path, "utf8") : null;
     return { actual, expected, agrees: viewsAgree(actual, expected) };
 }

package/dist/core/repo/tree/render/stale.js.map

@@ -1 +1 @@
-{"version":3,"file":"stale.js","sourceRoot":"","sources":["../../../../../src/core/repo/tree/render/stale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAa,MAAM,uBAAuB,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAgB9D,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAe,EAAE,QAAgB;IAC9E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;AACpE,CAAC","sourcesContent":["/**\n * Is the generated file on disk what this tree and this map render to?\n *\n * One function, because the question now has three askers — `validate --all`\n * (which turns a disagreement into `subsystem.views-stale`), `loam subsystem\n * sync` and the write verbs (which repair it), and `loam archive` (which must\n * not report a repo current when it has just made the file stale). Three\n * private compares would be three chances to answer differently about one\n * file, and the module that mints the bytes is the one that owes the answer.\n *\n * The PATH arrives as a parameter rather than a `DocsDir`: `repo/paths.ts`\n * owns the spelling of every file in a docs repo, and importing it here would\n * close the package cycle `repo → repo/tree → repo/tree/render → repo` that\n * `scripts/package-graph.mjs` exists to refuse. `walk.ts` pays the same price\n * for the same reason and says so.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { type Elem } from \"../../../c4/likec4.js\";\nimport type { FleetTree } from \"../walk.js\";\nimport { renderSubsystemViews, viewsAgree } from \"./views.js\";\n\n/**\n * The three states, kept apart: absent, must-be-absent, and\n * present-but-different are three different sentences, and a fleet whose views\n * file does not exist is not a fleet whose views file is blank.\n */\nexport interface ViewsState {\n  /** The bytes on disk, or null when the file is not there. */\n  actual: string | null;\n  /** The bytes the tree renders to, or null when the file must be absent. */\n  expected: string | null;\n  /** Do the two say the same thing? Content, not bytes — `viewsAgree` says why. */\n  agrees: boolean;\n}\n\nexport async function viewsState(path: string, tree: FleetTree, elements: Elem[]): Promise<ViewsState> {\n  const expected = renderSubsystemViews(tree, elements);\n  const actual = existsSync(path) ? await readFile(path, \"utf8\") : null;\n  return { actual, expected, agrees: viewsAgree(actual, expected) };\n}\n"]}
+{"version":3,"file":"stale.js","sourceRoot":"","sources":["../../../../../src/core/repo/tree/render/stale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAiB,sBAAsB,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAgBrG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAe,EAAE,GAAa;IAC3E,OAAO,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAe,EAAE,GAAa;IAClF,OAAO,OAAO,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,QAAuB;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;AACpE,CAAC","sourcesContent":["/**\n * Is the generated file on disk what this tree and this map render to?\n *\n * One function, because the question now has three askers — `validate --all`\n * (which turns a disagreement into `subsystem.views-stale`), `loam subsystem\n * sync` and the write verbs (which repair it), and `loam archive` (which must\n * not report a repo current when it has just made the file stale). Three\n * private compares would be three chances to answer differently about one\n * file, and the module that mints the bytes is the one that owes the answer.\n *\n * The PATH arrives as a parameter rather than a `DocsDir`: `repo/paths.ts`\n * owns the spelling of every file in a docs repo, and importing it here would\n * close the package cycle `repo → repo/tree → repo/tree/render → repo` that\n * `scripts/package-graph.mjs` exists to refuse. `walk.ts` pays the same price\n * for the same reason and says so.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport type { FleetTree } from \"../walk.js\";\nimport { type MapFacts, renderServiceOverviews, renderSubsystemViews, viewsAgree } from \"./views.js\";\n\n/**\n * The three states, kept apart: absent, must-be-absent, and\n * present-but-different are three different sentences, and a fleet whose views\n * file does not exist is not a fleet whose views file is blank.\n */\nexport interface ViewsState {\n  /** The bytes on disk, or null when the file is not there. */\n  actual: string | null;\n  /** The bytes the tree renders to, or null when the file must be absent. */\n  expected: string | null;\n  /** Do the two say the same thing? Content, not bytes — `viewsAgree` says why. */\n  agrees: boolean;\n}\n\nexport async function viewsState(path: string, tree: FleetTree, map: MapFacts): Promise<ViewsState> {\n  return stateOf(path, renderSubsystemViews(tree, map));\n}\n\n/**\n * The same question about the OTHER generated file, `architecture/services.likec4`.\n *\n * A second exported function rather than a `which` parameter, and a second call\n * at every asker rather than one that answers about both: the two files go stale\n * for different reasons and are repaired in one command, so a caller that wants\n * both asks twice and names each file in its own finding —\n * `subsystem.views-stale` carries the path precisely so one code can honestly\n * cover two files. Folding them into one state would lose which one drifted,\n * which is the only thing the message has to say.\n */\nexport async function serviceViewsState(path: string, tree: FleetTree, map: MapFacts): Promise<ViewsState> {\n  return stateOf(path, renderServiceOverviews(tree, map));\n}\n\n/** Read the file, or record its absence, and compare — the half both askers share. */\nasync function stateOf(path: string, expected: string | null): Promise<ViewsState> {\n  const actual = existsSync(path) ? await readFile(path, \"utf8\") : null;\n  return { actual, expected, agrees: viewsAgree(actual, expected) };\n}\n"]}