@ybotok/loam 0.2.0-alpha.6 → 0.2.0-alpha.9

package/dist/core/coherence/consumed/operations.js

@@ -0,0 +1,70 @@
+import { nothingStill, refusalDetails, refusalMessage, stillNamed } from "./refusal.js";
+export async function consumedOperationIssues(request) {
+    const { consumers, removingOps, displacedOps } = request;
+    const issues = [];
+    // --- taking an operation out of the contract while the fleet still calls it ---
+    // Exactness and justification never ask what matters to the other
+    // ninety-nine repos: is anybody still calling it? The merge deletes the
+    // operation while the edge, the requirement and the use-case hop naming it
+    // stay, so the next `validate --all` breaks a repository whose author was
+    // never in this feature. Asked of the ONE consumer index, read after this
+    // feature's merge (core/consumers/ says what it reads and what a feature can
+    // retire). `own` counts too: for a marker the REMOVED requirement leaves with
+    // the merge, so what remains is a second one, or an internal edge. One index
+    // for both shapes and the event axis, so the fleet is read once. A consumer
+    // document the index could not read or place refuses too (./refusal.ts):
+    // "nobody could look" never let a removal through before the one index.
+    const still = async (svc, op) => stillNamed(await consumers.opConsumers(svc, op));
+    // The landscape merge only ADDS edges, so an edge is dropped or redrawn in the living map itself.
+    const route = `drop or redraw its edge in the architecture/ project, MODIFY or REMOVE the requirement that names it in this feature's specs/<service>/ delta`;
+    for (const [svc, retiring] of removingOps) {
+        for (const op of retiring) {
+            const found = await still(svc, op);
+            if (nothingStill(found))
+                continue;
+            issues.push({
+                severity: "error",
+                code: "openapi.remove-op-consumed",
+                subject: svc,
+                details: refusalDetails(found),
+                message: refusalMessage(found, {
+                    subject: svc,
+                    lost: `this feature retires '${op}'`,
+                    verb: "consume",
+                    named: (list) => `${svc}: this feature retires '${op}', but the fleet would still consume it after this merge — ${list}. Retire each consumer in the same change (${route}), or archive with --approve to break it deliberately.`,
+                }),
+            });
+        }
+    }
+    // The same loss with no marker to read: another operation defined where a
+    // consumed one lives replaces it there, and once the contract the merge
+    // would write defines it nowhere it has left the contract exactly as a
+    // retirement does. One code, because the breach and its override are the
+    // removal's — only `api.op-unconsumed` (advisory) said anything before, and
+    // the archive passed without `--approve`. With no marker there is no REMOVED
+    // requirement either, so the provider's own requirement naming the old id
+    // stays unless this feature restates it — `own` is what catches it.
+    for (const [svc, displaced] of displacedOps) {
+        for (const { id: op, at } of displaced) {
+            const found = await still(svc, op);
+            if (nothingStill(found))
+                continue;
+            const by = at.map(({ address, by: id }) => `${id === undefined ? "an operation with no operationId" : `'${id}'`} at ${address}`).join(" and ");
+            const lost = `this feature's openapi.yaml defines ${by}, where '${op}' lives now — the merge replaces it there and would leave '${op}' defined nowhere`;
+            issues.push({
+                severity: "error",
+                code: "openapi.remove-op-consumed",
+                subject: svc,
+                details: refusalDetails(found),
+                message: refusalMessage(found, {
+                    subject: svc,
+                    lost,
+                    verb: "consume",
+                    named: (list) => `${svc}: ${lost}, but it is still consumed — ${list}. Define '${op}' at another address in this delta if it is to stay. To take it out on purpose, update every consumer in the same change — ${route} (${svc}'s own restated to name the new operation, for a rename; a REMOVED one owes no x-loam-remove marker, since the overwrite already takes '${op}' out) — or archive with --approve to break it deliberately.`,
+                }),
+            });
+        }
+    }
+    return issues;
+}
+//# sourceMappingURL=operations.js.map

package/dist/core/coherence/consumed/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../../../src/core/coherence/consumed/operations.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAC;AAUzG,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAkC;IAC9E,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACzD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,iFAAiF;IACjF,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,KAAK,GAAG,KAAK,EAAE,GAAW,EAAE,EAAU,EAAuB,EAAE,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACvH,kGAAkG;IAClG,MAAM,KAAK,GAAG,+IAA+I,CAAC;IAC9J,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC;QAC1C,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,YAAY,CAAC,KAAK,CAAC;gBAAE,SAAS;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC;gBAC9B,OAAO,EAAE,cAAc,CAAC,KAAK,EAAE;oBAC7B,OAAO,EAAE,GAAG;oBACZ,IAAI,EAAE,yBAAyB,EAAE,GAAG;oBACpC,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,2BAA2B,EAAE,8DAA8D,IAAI,8CAA8C,KAAK,wDAAwD;iBAClO,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,oEAAoE;IACpE,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,YAAY,EAAE,CAAC;QAC5C,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,YAAY,CAAC,KAAK,CAAC;gBAAE,SAAS;YAClC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,OAAO,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/I,MAAM,IAAI,GAAG,uCAAuC,EAAE,YAAY,EAAE,8DAA8D,EAAE,mBAAmB,CAAC;YACxJ,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC;gBAC9B,OAAO,EAAE,cAAc,CAAC,KAAK,EAAE;oBAC7B,OAAO,EAAE,GAAG;oBACZ,IAAI;oBACJ,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,IAAI,gCAAgC,IAAI,aAAa,EAAE,8HAA8H,KAAK,KAAK,GAAG,2IAA2I,EAAE,8DAA8D;iBAC1a,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * The contract axis's removal gate, `openapi.remove-op-consumed`: does the\n * fleet still consume an operation this feature takes out of the contract —\n * by a removal marker, or by defining another operation where it lives?\n *\n * Moved out of `../coherence.ts`, which ran at its 400-line limit, along the\n * seam the gate already had there: everything below asks the consumer index\n * (core/consumers/) one question per operation the merge loses and phrases\n * the refusal, and nothing else in featureCoherence reads its answer. The\n * index itself is built there and handed in, because the event axis's twin\n * (`asyncapi.remove-message-consumed`, ../events/events.ts) asks the same one.\n */\nimport type { Issue } from \"../../vocabulary/issue.js\";\nimport type { ConsumerIndex } from \"../../consumers/consumers.js\";\nimport type { Declared } from \"../declared.js\";\nimport { nothingStill, refusalDetails, refusalMessage, stillNamed, type StillNamed } from \"./refusal.js\";\n\n/** What the gate is asked over: the shared index, and the two ways this feature's merge loses an operation. */\nexport interface ConsumedOperationsRequest {\n  /** The consumer index, read after this feature's merge — shared with the event axis so the fleet is read once. */\n  consumers: ConsumerIndex;\n  removingOps: Declared[\"removingOps\"];\n  displacedOps: Declared[\"displacedOps\"];\n}\n\nexport async function consumedOperationIssues(request: ConsumedOperationsRequest): Promise<Issue[]> {\n  const { consumers, removingOps, displacedOps } = request;\n  const issues: Issue[] = [];\n  // --- taking an operation out of the contract while the fleet still calls it ---\n  // Exactness and justification never ask what matters to the other\n  // ninety-nine repos: is anybody still calling it? The merge deletes the\n  // operation while the edge, the requirement and the use-case hop naming it\n  // stay, so the next `validate --all` breaks a repository whose author was\n  // never in this feature. Asked of the ONE consumer index, read after this\n  // feature's merge (core/consumers/ says what it reads and what a feature can\n  // retire). `own` counts too: for a marker the REMOVED requirement leaves with\n  // the merge, so what remains is a second one, or an internal edge. One index\n  // for both shapes and the event axis, so the fleet is read once. A consumer\n  // document the index could not read or place refuses too (./refusal.ts):\n  // \"nobody could look\" never let a removal through before the one index.\n  const still = async (svc: string, op: string): Promise<StillNamed> => stillNamed(await consumers.opConsumers(svc, op));\n  // The landscape merge only ADDS edges, so an edge is dropped or redrawn in the living map itself.\n  const route = `drop or redraw its edge in the architecture/ project, MODIFY or REMOVE the requirement that names it in this feature's specs/<service>/ delta`;\n  for (const [svc, retiring] of removingOps) {\n    for (const op of retiring) {\n      const found = await still(svc, op);\n      if (nothingStill(found)) continue;\n      issues.push({\n        severity: \"error\",\n        code: \"openapi.remove-op-consumed\",\n        subject: svc,\n        details: refusalDetails(found),\n        message: refusalMessage(found, {\n          subject: svc,\n          lost: `this feature retires '${op}'`,\n          verb: \"consume\",\n          named: (list) => `${svc}: this feature retires '${op}', but the fleet would still consume it after this merge — ${list}. Retire each consumer in the same change (${route}), or archive with --approve to break it deliberately.`,\n        }),\n      });\n    }\n  }\n\n  // The same loss with no marker to read: another operation defined where a\n  // consumed one lives replaces it there, and once the contract the merge\n  // would write defines it nowhere it has left the contract exactly as a\n  // retirement does. One code, because the breach and its override are the\n  // removal's — only `api.op-unconsumed` (advisory) said anything before, and\n  // the archive passed without `--approve`. With no marker there is no REMOVED\n  // requirement either, so the provider's own requirement naming the old id\n  // stays unless this feature restates it — `own` is what catches it.\n  for (const [svc, displaced] of displacedOps) {\n    for (const { id: op, at } of displaced) {\n      const found = await still(svc, op);\n      if (nothingStill(found)) continue;\n      const by = at.map(({ address, by: id }) => `${id === undefined ? \"an operation with no operationId\" : `'${id}'`} at ${address}`).join(\" and \");\n      const lost = `this feature's openapi.yaml defines ${by}, where '${op}' lives now — the merge replaces it there and would leave '${op}' defined nowhere`;\n      issues.push({\n        severity: \"error\",\n        code: \"openapi.remove-op-consumed\",\n        subject: svc,\n        details: refusalDetails(found),\n        message: refusalMessage(found, {\n          subject: svc,\n          lost,\n          verb: \"consume\",\n          named: (list) => `${svc}: ${lost}, but it is still consumed — ${list}. Define '${op}' at another address in this delta if it is to stay. To take it out on purpose, update every consumer in the same change — ${route} (${svc}'s own restated to name the new operation, for a rename; a REMOVED one owes no x-loam-remove marker, since the overwrite already takes '${op}' out) — or archive with --approve to break it deliberately.`,\n        }),\n      });\n    }\n  }\n  return issues;\n}\n"]}

package/dist/core/coherence/consumed/refusal.js

@@ -0,0 +1,38 @@
+import { documentDoubt } from "../../consumers/scan.js";
+/**
+ * The gate's reading of one answer: `victims` and `own` as evidence, and of the
+ * suspensions only the document doubts. A caller drawn with no op and a
+ * contested hop stay out — `documentDoubt` (core/consumers/scan.ts) says why
+ * they are a warning's worth in `loam diff` and nothing here.
+ */
+export function stillNamed(found) {
+    return {
+        named: [...found.victims, ...found.own],
+        unchecked: [...found.suspended, ...found.ownSuspended].filter(documentDoubt).map((s) => s.text),
+    };
+}
+/** Nothing named and nothing unchecked: the removal is the gate's to let through. */
+export function nothingStill(still) {
+    return still.named.length === 0 && still.unchecked.length === 0;
+}
+/** The one remedy every unchecked document shares, after "make". */
+const READABLE = "each document listed readable (re-save it as UTF-8, or leave one directory per service id) so the gate can answer";
+/**
+ * The message for one refusal. With named consumers it is the gate's own
+ * sentence, plus one more when documents went unchecked too; with only
+ * unchecked documents it never claims a consumer — "nobody could look" is not
+ * "somebody still calls it", any more than it is "nobody does".
+ */
+export function refusalMessage(still, wording) {
+    const unchecked = still.unchecked.join("; ");
+    if (still.named.length === 0) {
+        return `${wording.subject}: ${wording.lost}, but whether the fleet would still ${wording.verb} it after this merge could not be checked — ${unchecked}. Make ${READABLE}, or archive with --approve to break it deliberately.`;
+    }
+    const named = wording.named(still.named.join("; "));
+    return still.unchecked.length === 0 ? named : `${named} Whether anything else would still ${wording.verb} it could not be checked either — ${unchecked}: make ${READABLE}.`;
+}
+/** What a refusal's `details[]` lists: the named consumers, then the documents nobody could check. */
+export function refusalDetails(still) {
+    return [...still.named, ...still.unchecked];
+}
+//# sourceMappingURL=refusal.js.map

package/dist/core/coherence/consumed/refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../../../../src/core/coherence/consumed/refusal.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAUxD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB;IACzC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC;QACvC,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;AAClE,CAAC;AAaD,oEAAoE;AACpE,MAAM,QAAQ,GAAG,mHAAmH,CAAC;AAErI;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,OAAuB;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,uCAAuC,OAAO,CAAC,IAAI,+CAA+C,SAAS,UAAU,QAAQ,uDAAuD,CAAC;IACjO,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,sCAAsC,OAAO,CAAC,IAAI,qCAAqC,SAAS,UAAU,QAAQ,GAAG,CAAC;AAC9K,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;AAC9C,CAAC","sourcesContent":["/**\n * What a removal refusal counts of one consumer-index answer, and how it says\n * so — shared by the operation gate (./operations.ts) and its event twin\n * (../events/events.ts), so a consumer nobody could read refuses the same way,\n * in the same sentence, on both axes.\n *\n * Two lists, because they are two different claims. `named` is positive\n * evidence — the merge would strand these — and its sentence is each gate's\n * own, with the remedy that fits the shape. `unchecked` is a document nobody\n * could read or place, so the refusal must not say the fleet still consumes\n * anything: it says the gate could not tell, names the documents, and gives the\n * one remedy they share. Both land in `details[]`, the named ones first — the\n * order `loam diff` lists victims and doubts in.\n */\nimport type { Consumers } from \"../../consumers/consumers.js\";\nimport { documentDoubt } from \"../../consumers/scan.js\";\n\n/** What the gate counts of one index answer. */\nexport interface StillNamed {\n  /** The consumers the merge would strand, then the provider's own documents still naming it. */\n  named: string[];\n  /** The documents — a consumer's, or the provider's own — the scan could not read or place (`documentDoubt`). */\n  unchecked: string[];\n}\n\n/**\n * The gate's reading of one answer: `victims` and `own` as evidence, and of the\n * suspensions only the document doubts. A caller drawn with no op and a\n * contested hop stay out — `documentDoubt` (core/consumers/scan.ts) says why\n * they are a warning's worth in `loam diff` and nothing here.\n */\nexport function stillNamed(found: Consumers): StillNamed {\n  return {\n    named: [...found.victims, ...found.own],\n    unchecked: [...found.suspended, ...found.ownSuspended].filter(documentDoubt).map((s) => s.text),\n  };\n}\n\n/** Nothing named and nothing unchecked: the removal is the gate's to let through. */\nexport function nothingStill(still: StillNamed): boolean {\n  return still.named.length === 0 && still.unchecked.length === 0;\n}\n\n/** One refusal's sentence, as the gate that raises it phrases it. */\nexport interface RefusalWording {\n  subject: string;\n  /** How this feature's merge takes it out — the opening clause, e.g. \"this feature retires 'capturePayment'\". */\n  lost: string;\n  /** What a consumer does with it: \"consume\" for an operation, \"name\" for a message. */\n  verb: string;\n  /** The gate's own sentence over its named consumers, given them joined. */\n  named: (list: string) => string;\n}\n\n/** The one remedy every unchecked document shares, after \"make\". */\nconst READABLE = \"each document listed readable (re-save it as UTF-8, or leave one directory per service id) so the gate can answer\";\n\n/**\n * The message for one refusal. With named consumers it is the gate's own\n * sentence, plus one more when documents went unchecked too; with only\n * unchecked documents it never claims a consumer — \"nobody could look\" is not\n * \"somebody still calls it\", any more than it is \"nobody does\".\n */\nexport function refusalMessage(still: StillNamed, wording: RefusalWording): string {\n  const unchecked = still.unchecked.join(\"; \");\n  if (still.named.length === 0) {\n    return `${wording.subject}: ${wording.lost}, but whether the fleet would still ${wording.verb} it after this merge could not be checked — ${unchecked}. Make ${READABLE}, or archive with --approve to break it deliberately.`;\n  }\n  const named = wording.named(still.named.join(\"; \"));\n  return still.unchecked.length === 0 ? named : `${named} Whether anything else would still ${wording.verb} it could not be checked either — ${unchecked}: make ${READABLE}.`;\n}\n\n/** What a refusal's `details[]` lists: the named consumers, then the documents nobody could check. */\nexport function refusalDetails(still: StillNamed): string[] {\n  return [...still.named, ...still.unchecked];\n}\n"]}

package/dist/core/coherence/declared.js

@@ -1,21 +1,23 @@
 /**
  * What a feature's own delta DECLARES, per service, indexed once.
  *
- * Seven indexes over the same four files (the delta spec.md, arch.spec.md,
+ * Nine indexes over the same four files (the delta spec.md, arch.spec.md,
  * openapi.yaml, and the living contract they are graded against), built in one
  * walk because every check downstream joins on the service id and would
  * otherwise re-read the delta per question. The distinctions here are the ones
  * the checks cannot make for themselves: an operation a REMOVED requirement
  * governs is being retired, so it neither claims the contract nor governs
  * anything after the merge; a removal marker that names an id also defined
- * elsewhere in the delta is a RELOCATION, not a retirement; and a marker with
+ * elsewhere in the delta is a RELOCATION, not a retirement; a living operation
+ * another one replaces at its address, with no marker naming it, leaves the
+ * contract all the same; and a marker with
  * no `operationId` at all is a shape only this walk can see. The capability
  * gate rides the same loop: both delta spec documents are graded against the
  * fleet vocabulary here, because coherence.ts and this package's file count
  * are both at their limits and the walk already holds the parsed documents.
  */
 import { existsSync } from "node:fs";
-import { NotUtf8DocumentError } from "../kernel/document-bytes.js";
+import { readOr } from "../openapi/contract-text.js";
 import { readFile } from "node:fs/promises";
 import {} from "../kernel/ids/service.js";
 import { featureSpecPaths } from "../repo/paths.js";
@@ -29,6 +31,8 @@ import { realizesUnknownIssues } from "../capabilities/realizes/findings.js";
 import { capabilityUnknownIssues } from "../capabilities/findings.js";
 import { openapiBaselineIssues } from "../openapi/baseline/gate.js";
 import { readOpenapi } from "../openapi/doc.js";
+import { operationRetirements } from "./retired/retirement.js";
+import { operationArrivals } from "./retired/revival/arrivals.js";
 export async function declaredByService(scope, svcNames, issues, context) {
     const { docsDir, featureDir, featureId } = scope;
     const reqOps = new Map();
@@ -41,6 +45,10 @@ export async function declaredByService(scope, svcNames, issues, context) {
     const anonymousMarkers = new Map();
     const featureApiOps = new Set();
     const unreadableApis = new Set();
+    const revivalCandidates = new Map();
+    const displacedOps = new Map();
+    /** Per service read here: the operationIds its living contract holds, or null when it does not read. */
+    const livingIds = new Map();
     // The capability gate's vocabulary, once per call. Absent or invalid stays
     // SILENT here — capability.invalid is validate --all's one finding about a
     // broken file, and an absent file means the fleet never opted in — so with
@@ -108,8 +116,12 @@ export async function declaredByService(scope, svcNames, issues, context) {
             issues.push(...capabilityUnknownIssues(archReqs, archTarget, capabilityVocab));
             issues.push(...realizesUnknownIssues(archReqs, archTarget, await capabilityReqs()));
         }
-        // Only operations genuinely NEW to this service count as feature-added: authors
-        // restate the full living API in the delta file (it is a complete document, not a patch).
+        // Only operations the living contract does not hold count as feature-added:
+        // a delta may restate living operations it does not change (a quote), and
+        // a quote adds nothing. "Not in living" is not quite "new", though — an
+        // operation an archived feature RETIRED is absent too, and adding it back
+        // is `openapi.op-revived`'s question (./retired/revival/revived.ts), asked of the
+        // `revivalCandidates` collected below.
         const featDoc = await readOpenapi(paths.openapi, context);
         // A feature contract that EXISTS but does not read is a broken document,
         // not an empty one — the living-side `openapi.invalid` discipline
@@ -131,15 +143,10 @@ export async function declaredByService(scope, svcNames, issues, context) {
         }
         const featOps = featDoc.ops;
         const removals = featOps.filter((op) => op.remove);
-        // A relocation — same operationId, removal marker on the old slot, upsert
-        // on the new one — retires nothing. Every rule that asks "is this operation
-        // going away" must therefore ask the NET set (markers this feature does not
-        // redefine), while "did the author write a marker at all" asks the raw one.
-        // Conflating them made moving an endpoint fail three checks at once for a
-        // change that removes nothing.
-        const redefined = new Set(featOps.filter((op) => !op.remove).map((op) => op.id));
-        const markerIds = new Set(removals.map((op) => op.id));
-        const netRemoved = new Set([...markerIds].filter((id) => !redefined.has(id)));
+        // The raw marker set and the NET one (markers minus relocations) —
+        // ./retired/retirement.ts owns the rule and says why the two differ; the
+        // retired index reads every archived feature through the same function.
+        const { markerIds, net: netRemoved } = operationRetirements(featOps);
         removingOps.set(svc, netRemoved);
         allMarkerIds.set(svc, markerIds);
         anonymousMarkers.set(svc, featDoc.anonymousRemovals.length > 0);
@@ -155,8 +162,15 @@ export async function declaredByService(scope, svcNames, issues, context) {
                 message: `${svc}: ${marker.method} ${marker.path} carries x-loam-remove: true but declares no operationId — loam cannot tell which operation it retires; name the operation the living contract has at that slot`,
             });
         }
-        const livingDoc = await readOpenapi((await locateServicePaths(docsDir, svc, context)).openapi, context);
+        const livingOpenapiPath = (await locateServicePaths(docsDir, svc, context)).openapi;
+        const livingDoc = await readOpenapi(livingOpenapiPath, context);
         const livingOps = livingDoc.ops;
+        livingIds.set(svc, livingDoc.unreadable ? null : new Set(livingOps.filter((op) => !op.remove).map((op) => op.id)));
+        const sides = { featPath: paths.openapi, featDoc, livingPath: livingOpenapiPath, livingDoc, service: svc };
+        const moved = await operationArrivals(sides, context);
+        revivalCandidates.set(svc, moved.operations);
+        if (moved.displaced.length > 0)
+            displacedOps.set(svc, moved.displaced);
         for (const id of livingDoc.duplicateIds) {
             const slots = livingOps.filter((op) => op.id === id).map((op) => `${op.method} ${op.path}`);
             issues.push({
@@ -172,27 +186,14 @@ export async function declaredByService(scope, svcNames, issues, context) {
         // read when there is one, mirroring the readRequirements pattern above;
         // the gate itself never touches the filesystem.
         if (existsSync(paths.openapi)) {
-            const livingOpenapiPath = (await locateServicePaths(docsDir, svc, context)).openapi;
-            // `context.readText` DECODES and THROWS on non-UTF-8 bytes, where the
-            // no-context `readFile` substitutes U+FFFD and lets `readOpenapi`
-            // flag the document unreadable. Uncaught, one service's UTF-16 living
-            // contract took down the whole feature target under validate's
-            // context while archive's no-context path sailed past — the exact
+            // `readOr` (../openapi/contract-text.ts, which says why): `context.readText`
+            // throws on non-UTF-8 bytes where the no-context `readFile` lets
+            // `readOpenapi` flag the document unreadable — the exact
             // context/no-context divergence doc.ts documents as paid for once.
             // Either text failing to decode gets the same answer the gate gives
             // an unreadable parse: that side's surface checks are skipped.
-            const readOr = async (p) => {
-                try {
-                    return context === undefined ? await readFile(p, "utf8") : await context.readText(p);
-                }
-                catch (err) {
-                    if (err instanceof NotUtf8DocumentError)
-                        return undefined;
-                    throw err;
-                }
-            };
-            const featureText = await readOr(paths.openapi);
-            const livingText = !existsSync(livingOpenapiPath) ? undefined : await readOr(livingOpenapiPath);
+            const featureText = await readOr(paths.openapi, context);
+            const livingText = !existsSync(livingOpenapiPath) ? undefined : await readOr(livingOpenapiPath, context);
             if (featureText !== undefined) {
                 issues.push(...openapiBaselineIssues({ featDoc, livingDoc, featureText, livingText, service: svc, featureId }));
             }
@@ -246,9 +247,31 @@ export async function declaredByService(scope, svcNames, issues, context) {
         if (unreadableApis.has(svc))
             continue;
         const marked = allMarkerIds.get(svc) ?? new Set();
+        const replaced = new Set((displacedOps.get(svc) ?? []).map((d) => d.id));
+        const living = livingIds.get(svc);
         for (const op of required) {
             if (marked.has(op))
                 continue;
+            // A marker is owed only while there is a living operation for it to
+            // retire — the event axis's rule (events/declared.ts) on the contract
+            // axis. An operation this delta already REPLACES at its address leaves
+            // the contract without one, and the marker could not even be written:
+            // the slot holds the replacement. So the route the overwrite's
+            // `openapi.remove-op-consumed` names — REMOVE the requirement governing
+            // the old id — ended in this error, followable only by deleting the
+            // requirement's Operations: line, which nothing said (review
+            // 2026-10-12, finding 4). And an id the service's living contract does
+            // not define is not this service's to mark at all: a REMOVED consumer
+            // requirement naming ANOTHER service's operation was told to retire it
+            // from its own contract. Both exemptions are facts about a contract
+            // loam READ: a living openapi.yaml that does not parse proves neither,
+            // so the marker stays owed — the closed direction, and the answer this
+            // check gave before either exemption existed. Skipping it there let a
+            // REMOVED requirement with no marker pass at exit 0 (the contract
+            // review, finding 3); `openapi.invalid` is still validate's finding
+            // about the file itself.
+            if (replaced.has(op) || (living !== undefined && living !== null && !living.has(op)))
+                continue;
             // Distinguish "no marker at all" from "a marker is there but loam cannot
             // read which operation it names" — the first asks the author to write the
             // marker, the second to write the operationId, and telling somebody who
@@ -264,6 +287,9 @@ export async function declaredByService(scope, svcNames, issues, context) {
             });
         }
     }
-    return { reqOps, removedReqOps, removingOps, allMarkerIds, anonymousMarkers, featureApiOps, unreadableApis };
+    return {
+        reqOps, removedReqOps, removingOps, allMarkerIds, anonymousMarkers, featureApiOps, unreadableApis, revivalCandidates,
+        displacedOps,
+    };
 }
 //# sourceMappingURL=declared.js.map

package/dist/core/coherence/declared.js.map

@@ -1 +1 @@
-{"version":3,"file":"declared.js","sourceRoot":"","sources":["../../../src/core/coherence/declared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAwB,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAmChD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAiB,EACjB,QAA2B,EAC3B,MAAe,EACf,OAAsB;IAEtB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,0FAA0F;IAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,iFAAiF;IACjF,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,yEAAyE;IACzE,2EAA2E;IAC3E,yBAAyB;IACzB,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,gBAAgB,GACpB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACxH,MAAM,eAAe,GAAG,uBAAuB,CAC7C,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,EACrG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACvC,CAAC;IACF,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO,KAAK,SAAS,CAAC;IACjF,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,4CAA4C;IAC5C,IAAI,YAAY,GAA+C,IAAI,CAAC;IACpE,MAAM,cAAc,GAAG,GAAwC,EAAE;QAC/D,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS;YAChC,CAAC,CAAC,KAAK,EAAE,CAAS,EAA0B,EAAE,CAAC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3F,CAAC,CAAC,CAAC,CAAS,EAA0B,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,0EAA0E;QAC1E,YAAY,KAAK,0BAA0B,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACtF,uBAAuB,CACrB,KAAK,EACL,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CACpG,CACF,CAAC;QACF,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS;gBAChC,CAAC,CAAC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACvD,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/C,6EAA6E;YAC7E,2EAA2E;YAC3E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YACvF,aAAa,CAAC,GAAG,CACf,GAAG,EACH,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC/E,CAAC;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;gBACvE,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,EAAE,CAAC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS;gBACpC,CAAC,CAAC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,cAAc,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,gFAAgF;QAChF,0FAA0F;QAC1F,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,yEAAyE;QACzE,kEAAkE;QAClE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG,GAAG,+CAA+C,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,GAAG,uGAAuG;aAC9N,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnD,0EAA0E;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;QAC1E,+BAA+B;QAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9E,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACjC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEhE,oEAAoE;QACpE,2EAA2E;QAC3E,4EAA4E;QAC5E,oCAAoC;QACpC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,iKAAiK;aAClN,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxG,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;QAChC,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5F,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG,GAAG,6CAA6C,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,8IAA8I;aACxO,CAAC,CAAC;QACL,CAAC;QACD,sEAAsE;QACtE,mEAAmE;QACnE,yEAAyE;QACzE,wEAAwE;QACxE,gDAAgD;QAChD,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,iBAAiB,GAAG,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACpF,sEAAsE;YACtE,kEAAkE;YAClE,sEAAsE;YACtE,+DAA+D;YAC/D,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,MAAM,GAAG,KAAK,EAAE,CAAS,EAA+B,EAAE;gBAC9D,IAAI,CAAC;oBACH,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACvF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,oBAAoB;wBAAE,OAAO,SAAS,CAAC;oBAC1D,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAChG,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACT,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAChF,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;gBACzB,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YAED,kEAAkE;YAClE,yEAAyE;YACzE,uEAAuE;YACvE,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAC9D,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC9F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,+BAA+B;wBACrC,OAAO,EAAE,GAAG;wBACZ,OAAO,EAAE,GAAG,GAAG,yBAAyB,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,wCAAwC;qBACrI,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;oBACnC,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,gCAAgC;wBACtC,OAAO,EAAE,GAAG;wBACZ,OAAO,EAAE,GAAG,GAAG,2BAA2B,MAAM,CAAC,EAAE,QAAQ,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,wCAAwC,MAAM,CAAC,EAAE,GAAG;qBAC5I,CAAC,CAAC;gBACL,CAAC;gBACD,uEAAuE;gBACvE,2DAA2D;gBAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,SAAS;gBACzC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,mCAAmC;wBACzC,OAAO,EAAE,GAAG;wBACZ,OAAO,EAAE,GAAG,GAAG,yBAAyB,MAAM,CAAC,EAAE,+DAA+D;qBACjH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC;QAC5C,uEAAuE;QACvE,iDAAiD;QACjD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAC1D,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC7B,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,4BAA4B;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;oBACzC,CAAC,CAAC,GAAG,GAAG,kCAAkC,EAAE,qGAAqG,EAAE,kBAAkB;oBACrK,CAAC,CAAC,GAAG,GAAG,kCAAkC,EAAE,4EAA4E;aAC3H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;AAC/G,CAAC","sourcesContent":["/**\n * What a feature's own delta DECLARES, per service, indexed once.\n *\n * Seven indexes over the same four files (the delta spec.md, arch.spec.md,\n * openapi.yaml, and the living contract they are graded against), built in one\n * walk because every check downstream joins on the service id and would\n * otherwise re-read the delta per question. The distinctions here are the ones\n * the checks cannot make for themselves: an operation a REMOVED requirement\n * governs is being retired, so it neither claims the contract nor governs\n * anything after the merge; a removal marker that names an id also defined\n * elsewhere in the delta is a RELOCATION, not a retirement; and a marker with\n * no `operationId` at all is a shape only this walk can see. The capability\n * gate rides the same loop: both delta spec documents are graded against the\n * fleet vocabulary here, because coherence.ts and this package's file count\n * are both at their limits and the walk already holds the parsed documents.\n */\nimport { existsSync } from \"node:fs\";\nimport { NotUtf8DocumentError } from \"../kernel/document-bytes.js\";\nimport { readFile } from \"node:fs/promises\";\nimport { type PathableService } from \"../kernel/ids/service.js\";\nimport type { Issue } from \"../vocabulary/issue.js\";\nimport { featureSpecPaths } from \"../repo/paths.js\";\nimport { locateServicePaths } from \"../repo/service-target.js\";\nimport { parseRequirements } from \"../document/parse.js\";\nimport { readCapabilityVocabulary } from \"../capabilities/capabilities.js\";\nimport { capabilityRequirementIndex } from \"../capabilities/findings.js\";\nimport { withFeatureCapabilities, withFeatureRequirements } from \"../capabilities/delta/overlay.js\";\nimport { featureCapabilityDeltas } from \"../capabilities/delta/tree.js\";\nimport { realizesUnknownIssues } from \"../capabilities/realizes/findings.js\";\nimport type { CapabilityRequirementIndex } from \"../capabilities/realizes/join.js\";\nimport { capabilityUnknownIssues } from \"../capabilities/findings.js\";\nimport type { Requirement } from \"../document/spec.js\";\nimport { openapiBaselineIssues } from \"../openapi/baseline/gate.js\";\nimport { readOpenapi } from \"../openapi/doc.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir, FeatureDir } from \"../kernel/ids/dirs.js\";\n\n/** Everything one feature's delta says about its own services. */\nexport interface Declared {\n  /** Per service: the operations its non-REMOVED requirements govern. */\n  reqOps: Map<PathableService, string[]>;\n  /** Per service: the operations its REMOVED requirements governed. */\n  removedReqOps: Map<string, Set<string>>;\n  /** Per service: operations this feature genuinely retires (markers minus relocations). */\n  removingOps: Map<string, Set<string>>;\n  /** Per service: every id a removal marker names, relocations included. */\n  allMarkerIds: Map<string, Set<string>>;\n  /** Per service: does the feature contract carry a marker with no operationId? */\n  anonymousMarkers: Map<string, boolean>;\n  /** The operationIds genuinely NEW to their service across the whole feature. */\n  featureApiOps: Set<string>;\n  /**\n   * Services whose FEATURE openapi.yaml exists but does not parse. Every check\n   * that joins on the feature contract must suspend itself for these — an\n   * unreadable document yields the same empty op set as an absent one, and\n   * grading against that emptiness produced false errors pointing everywhere\n   * but at the broken file.\n   */\n  unreadableApis: Set<string>;\n}\n\n/** The three facts this walk needs about the feature it is reading. */\nexport interface DeltaScope {\n  docsDir: DocsDir;\n  featureDir: FeatureDir;\n  featureId: string;\n}\n\nexport async function declaredByService(\n  scope: DeltaScope,\n  svcNames: PathableService[],\n  issues: Issue[],\n  context?: FleetContext,\n): Promise<Declared> {\n  const { docsDir, featureDir, featureId } = scope;\n    const reqOps = new Map<PathableService, string[]>();\n    const removedReqOps = new Map<string, Set<string>>();\n    /** Per service: operations this feature genuinely retires (markers minus relocations). */\n    const removingOps = new Map<string, Set<string>>();\n    /** Per service: every id a removal marker names, relocations included. */\n    const allMarkerIds = new Map<string, Set<string>>();\n    /** Per service: does the feature contract carry a marker with no operationId? */\n    const anonymousMarkers = new Map<string, boolean>();\n    const featureApiOps = new Set<string>();\n    const unreadableApis = new Set<string>();\n    // The capability gate's vocabulary, once per call. Absent or invalid stays\n    // SILENT here — capability.invalid is validate --all's one finding about a\n    // broken file, and an absent file means the fleet never opted in — so with\n    // either, nothing new gates archive (the roadmap's own trade; the\n    // /loam-check row tells agents to fix the YAML first). `grading` is that\n    // silence hoisted into a guard, so a silent axis also skips the reads that\n    // exist only to feed it.\n    //\n    // The vocabulary is the one this feature's MERGE would leave behind, not\n    // the one on disk: a feature that adds a capability requirement in its own\n    // capability delta and `Realizes:` it from its own service delta is the\n    // flow the whole axis exists for, and graded against the living tree alone\n    // it is refused with `capability.realizes-unknown` — an error, gating\n    // archive, for a target the same archive creates. `capabilities/delta/\n    // overlay.ts` states the whole judgement. One `existsSync` for a feature\n    // that carries no capability delta, which is every feature in a fleet that\n    // has not adopted the axis.\n    const capabilityDeltas =\n      context === undefined ? await featureCapabilityDeltas(featureDir) : await context.featureCapabilityDeltas(featureDir);\n    const capabilityVocab = withFeatureCapabilities(\n      context === undefined ? await readCapabilityVocabulary(docsDir) : await context.capabilities(docsDir),\n      capabilityDeltas.docs.map((d) => d.id),\n    );\n    const grading = capabilityVocab.present && capabilityVocab.invalid === undefined;\n    // The `Realizes:` index, built at most ONCE per feature and only if some\n    // delta document actually reaches the grading branch. Lazy rather than\n    // eager because it reads every capability document in the fleet, and a\n    // feature whose deltas carry no requirement file at all must not pay for\n    // that — the same \"a silent axis skips the reads that feed it\" rule\n    // `grading` above states, one level deeper.\n    let pendingIndex: Promise<CapabilityRequirementIndex> | null = null;\n    const capabilityReqs = (): Promise<CapabilityRequirementIndex> => {\n      const read = context === undefined\n        ? async (p: string): Promise<Requirement[]> => parseRequirements(await readFile(p, \"utf8\"))\n        : (p: string): Promise<Requirement[]> => context.readRequirements(p);\n      // The living index first, then widened by what this feature's capability\n      // deltas ADD or MODIFY. Both halves are inside the lazy thunk, so a\n      // feature whose deltas carry no requirement file at all pays for neither.\n      pendingIndex ??= capabilityRequirementIndex(capabilityVocab, read).then(async (index) =>\n        withFeatureRequirements(\n          index,\n          await Promise.all(capabilityDeltas.docs.map(async (d) => ({ id: d.id, reqs: await read(d.spec) }))),\n        ),\n      );\n      return pendingIndex;\n    };\n    for (const svc of svcNames) {\n      const paths = featureSpecPaths(featureDir, svc);\n      if (existsSync(paths.spec)) {\n        const reqs = context === undefined\n          ? parseRequirements(await readFile(paths.spec, \"utf8\"))\n          : await context.readRequirements(paths.spec);\n        // REMOVED requirements are being retired along with their operations — their\n        // ops neither claim the contract (E1) nor govern anything after the merge.\n        reqOps.set(svc, reqs.filter((r) => r.kind !== \"REMOVED\").flatMap((r) => r.operations));\n        removedReqOps.set(\n          svc,\n          new Set(reqs.filter((r) => r.kind === \"REMOVED\").flatMap((r) => r.operations)),\n        );\n        if (grading) {\n          const target = { where: `${svc}: spec.md`, subject: svc };\n          issues.push(...capabilityUnknownIssues(reqs, target, capabilityVocab));\n          issues.push(...realizesUnknownIssues(reqs, target, await capabilityReqs()));\n        }\n      }\n      // The delta arch.spec.md carries the same grammar and merges the same\n      // way, so an undeclared capability in it gates identically. Nothing else\n      // in this walk needs the arch delta, so the read itself sits behind\n      // `grading` — and it is NOT always cached: `validate --feature` passes a\n      // context, but archive's plan gate (commands/archive/plan/gate.ts) calls\n      // featureCoherence without one, so this parse is paid fresh there.\n      if (grading && existsSync(paths.archSpec)) {\n        const archReqs = context === undefined\n          ? parseRequirements(await readFile(paths.archSpec, \"utf8\"))\n          : await context.readRequirements(paths.archSpec);\n        const archTarget = { where: `${svc}: arch.spec.md`, subject: svc };\n        issues.push(...capabilityUnknownIssues(archReqs, archTarget, capabilityVocab));\n        issues.push(...realizesUnknownIssues(archReqs, archTarget, await capabilityReqs()));\n      }\n      // Only operations genuinely NEW to this service count as feature-added: authors\n      // restate the full living API in the delta file (it is a complete document, not a patch).\n      const featDoc = await readOpenapi(paths.openapi, context);\n      // A feature contract that EXISTS but does not read is a broken document,\n      // not an empty one — the living-side `openapi.invalid` discipline\n      // (validate/service/api.ts), applied to the delta. Before this check,\n      // `validate --feature` said nothing about the file at all: the empty\n      // parse silently skipped every baseline pin and removal marker in it,\n      // and E1 graded requirements against a contract that was never read.\n      // The rest of this service's contract-axis checks are suspended — every\n      // one of them would be an opinion about a document nobody could open.\n      if (featDoc.unreadable) {\n        unreadableApis.add(svc);\n        issues.push({\n          severity: \"error\",\n          code: \"openapi.invalid\",\n          subject: svc,\n          message: `${svc}: this feature's openapi.yaml does not parse${featDoc.error === undefined ? \"\" : ` (${featDoc.error})`} — the contract axis is unchecked and the merge would have nothing true to write. Fix the YAML first.`,\n        });\n        continue;\n      }\n      const featOps = featDoc.ops;\n      const removals = featOps.filter((op) => op.remove);\n      // A relocation — same operationId, removal marker on the old slot, upsert\n      // on the new one — retires nothing. Every rule that asks \"is this operation\n      // going away\" must therefore ask the NET set (markers this feature does not\n      // redefine), while \"did the author write a marker at all\" asks the raw one.\n      // Conflating them made moving an endpoint fail three checks at once for a\n      // change that removes nothing.\n      const redefined = new Set(featOps.filter((op) => !op.remove).map((op) => op.id));\n      const markerIds = new Set(removals.map((op) => op.id));\n      const netRemoved = new Set([...markerIds].filter((id) => !redefined.has(id)));\n      removingOps.set(svc, netRemoved);\n      allMarkerIds.set(svc, markerIds);\n      anonymousMarkers.set(svc, featDoc.anonymousRemovals.length > 0);\n\n      // A marker with no operationId names a slot but no operation. Every\n      // id-keyed check is blind to it, so it used to travel all the way into the\n      // living contract as a literal `x-loam-remove: true` — the one feature-only\n      // key that must never be published.\n      for (const marker of featDoc.anonymousRemovals) {\n        issues.push({\n          severity: \"error\",\n          code: \"openapi.remove-marker-anonymous\",\n          subject: svc,\n          message: `${svc}: ${marker.method} ${marker.path} carries x-loam-remove: true but declares no operationId — loam cannot tell which operation it retires; name the operation the living contract has at that slot`,\n        });\n      }\n\n      const livingDoc = await readOpenapi((await locateServicePaths(docsDir, svc, context)).openapi, context);\n      const livingOps = livingDoc.ops;\n      for (const id of livingDoc.duplicateIds) {\n        const slots = livingOps.filter((op) => op.id === id).map((op) => `${op.method} ${op.path}`);\n        issues.push({\n          severity: \"warn\",\n          code: \"openapi.duplicate-operationid\",\n          subject: svc,\n          message: `${svc}: the living OpenAPI defines operationId '${id}' at ${slots.join(\" and \")} — every join on the id (a requirement's Operations: line, an edge's metadata { op }, a removal marker) picks one of those slots arbitrarily`,\n        });\n      }\n      // The baseline axis — operation pins, path-item keys and components —\n      // graded in its own package (openapi/baseline/gate.ts), slot-keyed\n      // exactly as the merge writes. Texts come through the context's memoized\n      // read when there is one, mirroring the readRequirements pattern above;\n      // the gate itself never touches the filesystem.\n      if (existsSync(paths.openapi)) {\n        const livingOpenapiPath = (await locateServicePaths(docsDir, svc, context)).openapi;\n        // `context.readText` DECODES and THROWS on non-UTF-8 bytes, where the\n        // no-context `readFile` substitutes U+FFFD and lets `readOpenapi`\n        // flag the document unreadable. Uncaught, one service's UTF-16 living\n        // contract took down the whole feature target under validate's\n        // context while archive's no-context path sailed past — the exact\n        // context/no-context divergence doc.ts documents as paid for once.\n        // Either text failing to decode gets the same answer the gate gives\n        // an unreadable parse: that side's surface checks are skipped.\n        const readOr = async (p: string): Promise<string | undefined> => {\n          try {\n            return context === undefined ? await readFile(p, \"utf8\") : await context.readText(p);\n          } catch (err) {\n            if (err instanceof NotUtf8DocumentError) return undefined;\n            throw err;\n          }\n        };\n        const featureText = await readOr(paths.openapi);\n        const livingText = !existsSync(livingOpenapiPath) ? undefined : await readOr(livingOpenapiPath);\n        if (featureText !== undefined) {\n          issues.push(\n            ...openapiBaselineIssues({ featDoc, livingDoc, featureText, livingText, service: svc, featureId }),\n          );\n        }\n      }\n\n      if (featOps.length > 0) {\n        const living = new Set(livingOps.filter((op) => !op.remove).map((op) => op.id));\n        for (const op of featOps) {\n          if (!op.remove && !living.has(op.id)) featureApiOps.add(op.id);\n        }\n\n        // Removal is exact: the feature names both an operationId and the\n        // path+method slot it expects to delete. That catches stale deltas whose\n        // target moved or was already retired before the archive planner runs.\n        const justified = removedReqOps.get(svc) ?? new Set<string>();\n        for (const marker of removals) {\n          const target = livingOps.find((op) => op.path === marker.path && op.method === marker.method);\n          if (target === undefined) {\n            issues.push({\n              severity: \"error\",\n              code: \"openapi.remove-target-missing\",\n              subject: svc,\n              message: `${svc}: removal marker for '${marker.id}' addresses ${marker.method} ${marker.path}, but no living operation exists there`,\n            });\n          } else if (target.id !== marker.id) {\n            issues.push({\n              severity: \"error\",\n              code: \"openapi.remove-target-mismatch\",\n              subject: svc,\n              message: `${svc}: removal marker names '${marker.id}' at ${marker.method} ${marker.path}, but the living operation there is '${target.id}'`,\n            });\n          }\n          // A relocation needs no REMOVED requirement: the requirement governing\n          // the operation stays, the operation only changes address.\n          if (!netRemoved.has(marker.id)) continue;\n          if (!justified.has(marker.id)) {\n            issues.push({\n              severity: \"error\",\n              code: \"openapi.remove-marker-unjustified\",\n              subject: svc,\n              message: `${svc}: removal marker for '${marker.id}' is not governed by a REMOVED requirement's Operations: line`,\n            });\n          }\n        }\n      }\n    }\n    for (const [svc, required] of removedReqOps) {\n      // The markers live in the unreadable file — \"no matching marker\" would\n      // be a claim about a document nobody could open.\n      if (unreadableApis.has(svc)) continue;\n      const marked = allMarkerIds.get(svc) ?? new Set<string>();\n      for (const op of required) {\n        if (marked.has(op)) continue;\n        // Distinguish \"no marker at all\" from \"a marker is there but loam cannot\n        // read which operation it names\" — the first asks the author to write the\n        // marker, the second to write the operationId, and telling somebody who\n        // already wrote the marker that there is none sends them looking for a\n        // file they are staring at.\n        issues.push({\n          severity: \"error\",\n          code: \"openapi.remove-marker-missing\",\n          subject: svc,\n          message: anonymousMarkers.get(svc) === true\n            ? `${svc}: REMOVED requirement governs '${op}', and its feature openapi.yaml carries an x-loam-remove: true marker with no operationId — name '${op}' on that marker`\n            : `${svc}: REMOVED requirement governs '${op}', but its feature openapi.yaml has no matching x-loam-remove: true marker`,\n        });\n      }\n    }\n  return { reqOps, removedReqOps, removingOps, allMarkerIds, anonymousMarkers, featureApiOps, unreadableApis };\n}\n"]}
+{"version":3,"file":"declared.js","sourceRoot":"","sources":["../../../src/core/coherence/declared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAwB,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAmC,MAAM,+BAA+B,CAAC;AAmDnG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAiB,EACjB,QAA2B,EAC3B,MAAe,EACf,OAAsB;IAEtB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC9D,0FAA0F;IAC1F,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,iFAAiF;IACjF,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAmC,CAAC;IAChE,wGAAwG;IACxG,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsC,CAAC;IAChE,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,yEAAyE;IACzE,2EAA2E;IAC3E,yBAAyB;IACzB,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,4BAA4B;IAC5B,MAAM,gBAAgB,GACpB,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACxH,MAAM,eAAe,GAAG,uBAAuB,CAC7C,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,EACrG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACvC,CAAC;IACF,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO,KAAK,SAAS,CAAC;IACjF,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,4CAA4C;IAC5C,IAAI,YAAY,GAA+C,IAAI,CAAC;IACpE,MAAM,cAAc,GAAG,GAAwC,EAAE;QAC/D,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS;YAChC,CAAC,CAAC,KAAK,EAAE,CAAS,EAA0B,EAAE,CAAC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3F,CAAC,CAAC,CAAC,CAAS,EAA0B,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,0EAA0E;QAC1E,YAAY,KAAK,0BAA0B,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACtF,uBAAuB,CACrB,KAAK,EACL,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CACpG,CACF,CAAC;QACF,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS;gBAChC,CAAC,CAAC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACvD,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/C,6EAA6E;YAC7E,2EAA2E;YAC3E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YACvF,aAAa,CAAC,GAAG,CACf,GAAG,EACH,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC/E,CAAC;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;gBACvE,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,cAAc,EAAE,CAAC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS;gBACpC,CAAC,CAAC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC3D,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,cAAc,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,4EAA4E;QAC5E,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,kFAAkF;QAClF,uCAAuC;QACvC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,yEAAyE;QACzE,kEAAkE;QAClE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG,GAAG,+CAA+C,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,GAAG,uGAAuG;aAC9N,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnD,mEAAmE;QACnE,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACrE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACjC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEhE,oEAAoE;QACpE,2EAA2E;QAC3E,4EAA4E;QAC5E,oCAAoC;QACpC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,iKAAiK;aAClN,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GAAG,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACpF,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;QAChC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnH,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC3G,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtD,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACvE,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5F,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,GAAG,GAAG,6CAA6C,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,8IAA8I;aACxO,CAAC,CAAC;QACL,CAAC;QACD,sEAAsE;QACtE,mEAAmE;QACnE,yEAAyE;QACzE,wEAAwE;QACxE,gDAAgD;QAChD,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,6EAA6E;YAC7E,iEAAiE;YACjE,yDAAyD;YACzD,mEAAmE;YACnE,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzD,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACzG,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACT,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAChF,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;gBACzB,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YAED,kEAAkE;YAClE,yEAAyE;YACzE,uEAAuE;YACvE,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAC9D,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC9F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,+BAA+B;wBACrC,OAAO,EAAE,GAAG;wBACZ,OAAO,EAAE,GAAG,GAAG,yBAAyB,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,wCAAwC;qBACrI,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;oBACnC,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,gCAAgC;wBACtC,OAAO,EAAE,GAAG;wBACZ,OAAO,EAAE,GAAG,GAAG,2BAA2B,MAAM,CAAC,EAAE,QAAQ,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,wCAAwC,MAAM,CAAC,EAAE,GAAG;qBAC5I,CAAC,CAAC;gBACL,CAAC;gBACD,uEAAuE;gBACvE,2DAA2D;gBAC3D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,SAAS;gBACzC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC;wBACV,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,mCAAmC;wBACzC,OAAO,EAAE,GAAG;wBACZ,OAAO,EAAE,GAAG,GAAG,yBAAyB,MAAM,CAAC,EAAE,+DAA+D;qBACjH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC;QAC5C,uEAAuE;QACvE,iDAAiD;QACjD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC7B,oEAAoE;YACpE,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,+DAA+D;YAC/D,wEAAwE;YACxE,oEAAoE;YACpE,6DAA6D;YAC7D,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,kEAAkE;YAClE,oEAAoE;YACpE,yBAAyB;YACzB,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAAE,SAAS;YAC/F,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,4BAA4B;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,GAAG;gBACZ,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;oBACzC,CAAC,CAAC,GAAG,GAAG,kCAAkC,EAAE,qGAAqG,EAAE,kBAAkB;oBACrK,CAAC,CAAC,GAAG,GAAG,kCAAkC,EAAE,4EAA4E;aAC3H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACH,OAAO;QACL,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB;QACpH,YAAY;KACb,CAAC;AACJ,CAAC","sourcesContent":["/**\n * What a feature's own delta DECLARES, per service, indexed once.\n *\n * Nine indexes over the same four files (the delta spec.md, arch.spec.md,\n * openapi.yaml, and the living contract they are graded against), built in one\n * walk because every check downstream joins on the service id and would\n * otherwise re-read the delta per question. The distinctions here are the ones\n * the checks cannot make for themselves: an operation a REMOVED requirement\n * governs is being retired, so it neither claims the contract nor governs\n * anything after the merge; a removal marker that names an id also defined\n * elsewhere in the delta is a RELOCATION, not a retirement; a living operation\n * another one replaces at its address, with no marker naming it, leaves the\n * contract all the same; and a marker with\n * no `operationId` at all is a shape only this walk can see. The capability\n * gate rides the same loop: both delta spec documents are graded against the\n * fleet vocabulary here, because coherence.ts and this package's file count\n * are both at their limits and the walk already holds the parsed documents.\n */\nimport { existsSync } from \"node:fs\";\nimport { readOr } from \"../openapi/contract-text.js\";\nimport { readFile } from \"node:fs/promises\";\nimport { type PathableService } from \"../kernel/ids/service.js\";\nimport type { Issue } from \"../vocabulary/issue.js\";\nimport { featureSpecPaths } from \"../repo/paths.js\";\nimport { locateServicePaths } from \"../repo/service-target.js\";\nimport { parseRequirements } from \"../document/parse.js\";\nimport { readCapabilityVocabulary } from \"../capabilities/capabilities.js\";\nimport { capabilityRequirementIndex } from \"../capabilities/findings.js\";\nimport { withFeatureCapabilities, withFeatureRequirements } from \"../capabilities/delta/overlay.js\";\nimport { featureCapabilityDeltas } from \"../capabilities/delta/tree.js\";\nimport { realizesUnknownIssues } from \"../capabilities/realizes/findings.js\";\nimport type { CapabilityRequirementIndex } from \"../capabilities/realizes/join.js\";\nimport { capabilityUnknownIssues } from \"../capabilities/findings.js\";\nimport type { Requirement } from \"../document/spec.js\";\nimport { openapiBaselineIssues } from \"../openapi/baseline/gate.js\";\nimport { readOpenapi } from \"../openapi/doc.js\";\nimport { operationRetirements } from \"./retired/retirement.js\";\nimport { operationArrivals, type Arrival, type Displacement } from \"./retired/revival/arrivals.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir, FeatureDir } from \"../kernel/ids/dirs.js\";\n\n/** Everything one feature's delta says about its own services. */\nexport interface Declared {\n  /** Per service: the operations its non-REMOVED requirements govern. */\n  reqOps: Map<PathableService, string[]>;\n  /** Per service: the operations its REMOVED requirements governed. */\n  removedReqOps: Map<PathableService, Set<string>>;\n  /** Per service: operations this feature genuinely retires (markers minus relocations). */\n  removingOps: Map<string, Set<string>>;\n  /** Per service: every id a removal marker names, relocations included. */\n  allMarkerIds: Map<string, Set<string>>;\n  /** Per service: does the feature contract carry a marker with no operationId? */\n  anonymousMarkers: Map<string, boolean>;\n  /** The operationIds the living contract of their service does not hold, across the whole feature — new, or revived (see `revivalCandidates`). */\n  featureApiOps: Set<string>;\n  /**\n   * Services whose FEATURE openapi.yaml exists but does not parse. Every check\n   * that joins on the feature contract must suspend itself for these — an\n   * unreadable document yields the same empty op set as an absent one, and\n   * grading against that emptiness produced false errors pointing everywhere\n   * but at the broken file.\n   */\n  unreadableApis: Set<string>;\n  /**\n   * Per service: every (operationId, address) the contract the archive would\n   * write has and the living one lacks — an addition, or a revival of what an\n   * archived feature retired or moved away, which the living contract alone\n   * cannot tell apart. coherence.ts asks the retired index (./retired/) only\n   * when one of these lists is non-empty.\n   */\n  revivalCandidates: Map<PathableService, Arrival[]>;\n  /**\n   * Per service: every living operationId the contract the archive would\n   * write answers nowhere while no removal marker names it — replaced at its\n   * address by another operation (./retired/revival/arrivals.ts). The\n   * removal gate's consumers are asked of these too: the loss is the same,\n   * only the spelling differs.\n   */\n  displacedOps: Map<PathableService, Displacement[]>;\n}\n\n/** The three facts this walk needs about the feature it is reading. */\nexport interface DeltaScope {\n  docsDir: DocsDir;\n  featureDir: FeatureDir;\n  featureId: string;\n}\n\nexport async function declaredByService(\n  scope: DeltaScope,\n  svcNames: PathableService[],\n  issues: Issue[],\n  context?: FleetContext,\n): Promise<Declared> {\n  const { docsDir, featureDir, featureId } = scope;\n    const reqOps = new Map<PathableService, string[]>();\n    const removedReqOps = new Map<PathableService, Set<string>>();\n    /** Per service: operations this feature genuinely retires (markers minus relocations). */\n    const removingOps = new Map<string, Set<string>>();\n    /** Per service: every id a removal marker names, relocations included. */\n    const allMarkerIds = new Map<string, Set<string>>();\n    /** Per service: does the feature contract carry a marker with no operationId? */\n    const anonymousMarkers = new Map<string, boolean>();\n    const featureApiOps = new Set<string>();\n    const unreadableApis = new Set<string>();\n    const revivalCandidates = new Map<PathableService, Arrival[]>();\n    const displacedOps = new Map<PathableService, Displacement[]>();\n    /** Per service read here: the operationIds its living contract holds, or null when it does not read. */\n    const livingIds = new Map<string, ReadonlySet<string> | null>();\n    // The capability gate's vocabulary, once per call. Absent or invalid stays\n    // SILENT here — capability.invalid is validate --all's one finding about a\n    // broken file, and an absent file means the fleet never opted in — so with\n    // either, nothing new gates archive (the roadmap's own trade; the\n    // /loam-check row tells agents to fix the YAML first). `grading` is that\n    // silence hoisted into a guard, so a silent axis also skips the reads that\n    // exist only to feed it.\n    //\n    // The vocabulary is the one this feature's MERGE would leave behind, not\n    // the one on disk: a feature that adds a capability requirement in its own\n    // capability delta and `Realizes:` it from its own service delta is the\n    // flow the whole axis exists for, and graded against the living tree alone\n    // it is refused with `capability.realizes-unknown` — an error, gating\n    // archive, for a target the same archive creates. `capabilities/delta/\n    // overlay.ts` states the whole judgement. One `existsSync` for a feature\n    // that carries no capability delta, which is every feature in a fleet that\n    // has not adopted the axis.\n    const capabilityDeltas =\n      context === undefined ? await featureCapabilityDeltas(featureDir) : await context.featureCapabilityDeltas(featureDir);\n    const capabilityVocab = withFeatureCapabilities(\n      context === undefined ? await readCapabilityVocabulary(docsDir) : await context.capabilities(docsDir),\n      capabilityDeltas.docs.map((d) => d.id),\n    );\n    const grading = capabilityVocab.present && capabilityVocab.invalid === undefined;\n    // The `Realizes:` index, built at most ONCE per feature and only if some\n    // delta document actually reaches the grading branch. Lazy rather than\n    // eager because it reads every capability document in the fleet, and a\n    // feature whose deltas carry no requirement file at all must not pay for\n    // that — the same \"a silent axis skips the reads that feed it\" rule\n    // `grading` above states, one level deeper.\n    let pendingIndex: Promise<CapabilityRequirementIndex> | null = null;\n    const capabilityReqs = (): Promise<CapabilityRequirementIndex> => {\n      const read = context === undefined\n        ? async (p: string): Promise<Requirement[]> => parseRequirements(await readFile(p, \"utf8\"))\n        : (p: string): Promise<Requirement[]> => context.readRequirements(p);\n      // The living index first, then widened by what this feature's capability\n      // deltas ADD or MODIFY. Both halves are inside the lazy thunk, so a\n      // feature whose deltas carry no requirement file at all pays for neither.\n      pendingIndex ??= capabilityRequirementIndex(capabilityVocab, read).then(async (index) =>\n        withFeatureRequirements(\n          index,\n          await Promise.all(capabilityDeltas.docs.map(async (d) => ({ id: d.id, reqs: await read(d.spec) }))),\n        ),\n      );\n      return pendingIndex;\n    };\n    for (const svc of svcNames) {\n      const paths = featureSpecPaths(featureDir, svc);\n      if (existsSync(paths.spec)) {\n        const reqs = context === undefined\n          ? parseRequirements(await readFile(paths.spec, \"utf8\"))\n          : await context.readRequirements(paths.spec);\n        // REMOVED requirements are being retired along with their operations — their\n        // ops neither claim the contract (E1) nor govern anything after the merge.\n        reqOps.set(svc, reqs.filter((r) => r.kind !== \"REMOVED\").flatMap((r) => r.operations));\n        removedReqOps.set(\n          svc,\n          new Set(reqs.filter((r) => r.kind === \"REMOVED\").flatMap((r) => r.operations)),\n        );\n        if (grading) {\n          const target = { where: `${svc}: spec.md`, subject: svc };\n          issues.push(...capabilityUnknownIssues(reqs, target, capabilityVocab));\n          issues.push(...realizesUnknownIssues(reqs, target, await capabilityReqs()));\n        }\n      }\n      // The delta arch.spec.md carries the same grammar and merges the same\n      // way, so an undeclared capability in it gates identically. Nothing else\n      // in this walk needs the arch delta, so the read itself sits behind\n      // `grading` — and it is NOT always cached: `validate --feature` passes a\n      // context, but archive's plan gate (commands/archive/plan/gate.ts) calls\n      // featureCoherence without one, so this parse is paid fresh there.\n      if (grading && existsSync(paths.archSpec)) {\n        const archReqs = context === undefined\n          ? parseRequirements(await readFile(paths.archSpec, \"utf8\"))\n          : await context.readRequirements(paths.archSpec);\n        const archTarget = { where: `${svc}: arch.spec.md`, subject: svc };\n        issues.push(...capabilityUnknownIssues(archReqs, archTarget, capabilityVocab));\n        issues.push(...realizesUnknownIssues(archReqs, archTarget, await capabilityReqs()));\n      }\n      // Only operations the living contract does not hold count as feature-added:\n      // a delta may restate living operations it does not change (a quote), and\n      // a quote adds nothing. \"Not in living\" is not quite \"new\", though — an\n      // operation an archived feature RETIRED is absent too, and adding it back\n      // is `openapi.op-revived`'s question (./retired/revival/revived.ts), asked of the\n      // `revivalCandidates` collected below.\n      const featDoc = await readOpenapi(paths.openapi, context);\n      // A feature contract that EXISTS but does not read is a broken document,\n      // not an empty one — the living-side `openapi.invalid` discipline\n      // (validate/service/api.ts), applied to the delta. Before this check,\n      // `validate --feature` said nothing about the file at all: the empty\n      // parse silently skipped every baseline pin and removal marker in it,\n      // and E1 graded requirements against a contract that was never read.\n      // The rest of this service's contract-axis checks are suspended — every\n      // one of them would be an opinion about a document nobody could open.\n      if (featDoc.unreadable) {\n        unreadableApis.add(svc);\n        issues.push({\n          severity: \"error\",\n          code: \"openapi.invalid\",\n          subject: svc,\n          message: `${svc}: this feature's openapi.yaml does not parse${featDoc.error === undefined ? \"\" : ` (${featDoc.error})`} — the contract axis is unchecked and the merge would have nothing true to write. Fix the YAML first.`,\n        });\n        continue;\n      }\n      const featOps = featDoc.ops;\n      const removals = featOps.filter((op) => op.remove);\n      // The raw marker set and the NET one (markers minus relocations) —\n      // ./retired/retirement.ts owns the rule and says why the two differ; the\n      // retired index reads every archived feature through the same function.\n      const { markerIds, net: netRemoved } = operationRetirements(featOps);\n      removingOps.set(svc, netRemoved);\n      allMarkerIds.set(svc, markerIds);\n      anonymousMarkers.set(svc, featDoc.anonymousRemovals.length > 0);\n\n      // A marker with no operationId names a slot but no operation. Every\n      // id-keyed check is blind to it, so it used to travel all the way into the\n      // living contract as a literal `x-loam-remove: true` — the one feature-only\n      // key that must never be published.\n      for (const marker of featDoc.anonymousRemovals) {\n        issues.push({\n          severity: \"error\",\n          code: \"openapi.remove-marker-anonymous\",\n          subject: svc,\n          message: `${svc}: ${marker.method} ${marker.path} carries x-loam-remove: true but declares no operationId — loam cannot tell which operation it retires; name the operation the living contract has at that slot`,\n        });\n      }\n\n      const livingOpenapiPath = (await locateServicePaths(docsDir, svc, context)).openapi;\n      const livingDoc = await readOpenapi(livingOpenapiPath, context);\n      const livingOps = livingDoc.ops;\n      livingIds.set(svc, livingDoc.unreadable ? null : new Set(livingOps.filter((op) => !op.remove).map((op) => op.id)));\n      const sides = { featPath: paths.openapi, featDoc, livingPath: livingOpenapiPath, livingDoc, service: svc };\n      const moved = await operationArrivals(sides, context);\n      revivalCandidates.set(svc, moved.operations);\n      if (moved.displaced.length > 0) displacedOps.set(svc, moved.displaced);\n      for (const id of livingDoc.duplicateIds) {\n        const slots = livingOps.filter((op) => op.id === id).map((op) => `${op.method} ${op.path}`);\n        issues.push({\n          severity: \"warn\",\n          code: \"openapi.duplicate-operationid\",\n          subject: svc,\n          message: `${svc}: the living OpenAPI defines operationId '${id}' at ${slots.join(\" and \")} — every join on the id (a requirement's Operations: line, an edge's metadata { op }, a removal marker) picks one of those slots arbitrarily`,\n        });\n      }\n      // The baseline axis — operation pins, path-item keys and components —\n      // graded in its own package (openapi/baseline/gate.ts), slot-keyed\n      // exactly as the merge writes. Texts come through the context's memoized\n      // read when there is one, mirroring the readRequirements pattern above;\n      // the gate itself never touches the filesystem.\n      if (existsSync(paths.openapi)) {\n        // `readOr` (../openapi/contract-text.ts, which says why): `context.readText`\n        // throws on non-UTF-8 bytes where the no-context `readFile` lets\n        // `readOpenapi` flag the document unreadable — the exact\n        // context/no-context divergence doc.ts documents as paid for once.\n        // Either text failing to decode gets the same answer the gate gives\n        // an unreadable parse: that side's surface checks are skipped.\n        const featureText = await readOr(paths.openapi, context);\n        const livingText = !existsSync(livingOpenapiPath) ? undefined : await readOr(livingOpenapiPath, context);\n        if (featureText !== undefined) {\n          issues.push(\n            ...openapiBaselineIssues({ featDoc, livingDoc, featureText, livingText, service: svc, featureId }),\n          );\n        }\n      }\n\n      if (featOps.length > 0) {\n        const living = new Set(livingOps.filter((op) => !op.remove).map((op) => op.id));\n        for (const op of featOps) {\n          if (!op.remove && !living.has(op.id)) featureApiOps.add(op.id);\n        }\n\n        // Removal is exact: the feature names both an operationId and the\n        // path+method slot it expects to delete. That catches stale deltas whose\n        // target moved or was already retired before the archive planner runs.\n        const justified = removedReqOps.get(svc) ?? new Set<string>();\n        for (const marker of removals) {\n          const target = livingOps.find((op) => op.path === marker.path && op.method === marker.method);\n          if (target === undefined) {\n            issues.push({\n              severity: \"error\",\n              code: \"openapi.remove-target-missing\",\n              subject: svc,\n              message: `${svc}: removal marker for '${marker.id}' addresses ${marker.method} ${marker.path}, but no living operation exists there`,\n            });\n          } else if (target.id !== marker.id) {\n            issues.push({\n              severity: \"error\",\n              code: \"openapi.remove-target-mismatch\",\n              subject: svc,\n              message: `${svc}: removal marker names '${marker.id}' at ${marker.method} ${marker.path}, but the living operation there is '${target.id}'`,\n            });\n          }\n          // A relocation needs no REMOVED requirement: the requirement governing\n          // the operation stays, the operation only changes address.\n          if (!netRemoved.has(marker.id)) continue;\n          if (!justified.has(marker.id)) {\n            issues.push({\n              severity: \"error\",\n              code: \"openapi.remove-marker-unjustified\",\n              subject: svc,\n              message: `${svc}: removal marker for '${marker.id}' is not governed by a REMOVED requirement's Operations: line`,\n            });\n          }\n        }\n      }\n    }\n    for (const [svc, required] of removedReqOps) {\n      // The markers live in the unreadable file — \"no matching marker\" would\n      // be a claim about a document nobody could open.\n      if (unreadableApis.has(svc)) continue;\n      const marked = allMarkerIds.get(svc) ?? new Set<string>();\n      const replaced = new Set((displacedOps.get(svc) ?? []).map((d) => d.id));\n      const living = livingIds.get(svc);\n      for (const op of required) {\n        if (marked.has(op)) continue;\n        // A marker is owed only while there is a living operation for it to\n        // retire — the event axis's rule (events/declared.ts) on the contract\n        // axis. An operation this delta already REPLACES at its address leaves\n        // the contract without one, and the marker could not even be written:\n        // the slot holds the replacement. So the route the overwrite's\n        // `openapi.remove-op-consumed` names — REMOVE the requirement governing\n        // the old id — ended in this error, followable only by deleting the\n        // requirement's Operations: line, which nothing said (review\n        // 2026-10-12, finding 4). And an id the service's living contract does\n        // not define is not this service's to mark at all: a REMOVED consumer\n        // requirement naming ANOTHER service's operation was told to retire it\n        // from its own contract. Both exemptions are facts about a contract\n        // loam READ: a living openapi.yaml that does not parse proves neither,\n        // so the marker stays owed — the closed direction, and the answer this\n        // check gave before either exemption existed. Skipping it there let a\n        // REMOVED requirement with no marker pass at exit 0 (the contract\n        // review, finding 3); `openapi.invalid` is still validate's finding\n        // about the file itself.\n        if (replaced.has(op) || (living !== undefined && living !== null && !living.has(op))) continue;\n        // Distinguish \"no marker at all\" from \"a marker is there but loam cannot\n        // read which operation it names\" — the first asks the author to write the\n        // marker, the second to write the operationId, and telling somebody who\n        // already wrote the marker that there is none sends them looking for a\n        // file they are staring at.\n        issues.push({\n          severity: \"error\",\n          code: \"openapi.remove-marker-missing\",\n          subject: svc,\n          message: anonymousMarkers.get(svc) === true\n            ? `${svc}: REMOVED requirement governs '${op}', and its feature openapi.yaml carries an x-loam-remove: true marker with no operationId — name '${op}' on that marker`\n            : `${svc}: REMOVED requirement governs '${op}', but its feature openapi.yaml has no matching x-loam-remove: true marker`,\n        });\n      }\n    }\n  return {\n    reqOps, removedReqOps, removingOps, allMarkerIds, anonymousMarkers, featureApiOps, unreadableApis, revivalCandidates,\n    displacedOps,\n  };\n}\n"]}