@ybotok/loam 0.2.0-alpha.6 → 0.2.0-alpha.9

package/dist/core/deployment/delta.js.map

@@ -1 +1 @@
-{"version":3,"file":"delta.js","sourceRoot":"","sources":["../../../src/core/deployment/delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAkB,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAc,MAAM,wBAAwB,CAAC;AAcpD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAsB;IAC7D,MAAM,GAAG,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB,EAAE,GAAW;IAChE,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAgB,EAAE,UAAsB;IAClF,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,yEAAyE;IACzE,oEAAoE;IACpE,4EAA4E;IAC5E,8EAA8E;IAC9E,mDAAmD;IACnD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,GAAG,CAAC,GAAG;YAChB,OAAO,EACL,8BAA8B,GAAG,CAAC,GAAG,gCAAgC,GAAG,CAAC,GAAG,6BAA6B;gBACzG,GAAG,MAAM,kGAAkG;gBAC3G,0CAA0C;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;SAC3D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,QAAQ,EAAE,OAAgB;QAC1B,IAAI,EAAE,uBAAgC;QACtC,OAAO,EAAE,GAAG,CAAC,GAAG;QAChB,OAAO,EACL,gBAAgB,GAAG,CAAC,GAAG,wFAAwF;YAC/G,mFAAmF;YACnF,qCAAqC,GAAG,CAAC,GAAG,0BAA0B,GAAG,CAAC,GAAG,iCAAiC;YAC9G,8EAA8E;YAC9E,6FAA6F;YAC7F,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,mFAAmF;KAC3G,CAAC,CAAC,CACN,CAAC;AACJ,CAAC;AAkCD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAA6B;IACxE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/C,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzG,CAAC;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,GAAG,GAAG,GAAG,IAAI,gBAAgB,CAAC;AACvC,CAAC","sourcesContent":["/**\n * A feature's own topology: `features/<FEAT>/deployment/<name>.likec4`.\n *\n * Until this slot existed a change that stood up a standby cluster had to be\n * written in two places at once — the requirement in the feature, the topology\n * edited straight into `architecture/` — because `delta.likec4` refuses a\n * `deployment { }` block and always will: that document re-declares the\n * landscape's own identifiers and carries its own `specification`, so it cannot\n * be staged beside the map in one LikeC4 project. A document that declares\n * NEITHER can, which is exactly why the use-case axis put its flows in files of\n * their own, and why this mirrors it rather than inventing a shape.\n *\n * WHAT MAKES IT WORK, and it was measured before the axis was written: LikeC4\n * `extend` resolves across documents of one project. A feature writes\n *\n *     deployment {\n *       extend eu {\n *         dcC = datacenter 'DC-C' { k8sC = cluster 'cluster-c' { … } }\n *       }\n *       eu.dcA.k8sA -> eu.dcC.k8sC 'async replication'\n *     }\n *\n * and the living region gains a datacenter with the living file untouched. So\n * the merge is a copy, not a splice, and `unarchive` needs nothing new — a\n * create is undone by deleting, which the snapshot manifest already records for\n * every write in the plan.\n *\n * CREATE-ONLY, for `core/usecases/delta/flows.ts`'s reasons rather than a\n * weaker version of them. A requirement delta merges INTO a living document and\n * two features editing one requirement would overwrite each other silently; a\n * topology document has no such algebra — the file is one block, the merge is a\n * whole-file copy, and there is nothing to merge partially. Rewriting a living\n * one through a feature would be a silent whole-file replacement with no pin to\n * collide on, where editing `architecture/<name>.likec4` directly in the same\n * pull request produces an ordinary git conflict a human resolves.\n *\n * ## Graded against the map its own merge would leave behind\n *\n * `ARCH-LOAM-FEATURE-CORPUS`, and this axis needs it more literally than the\n * use-case one does: a feature that stands a service up in a new cluster\n * declares that service in its `delta.likec4` and instances it here, so the\n * element the topology names exists ONLY post-merge. Read against the living\n * landscape it is unresolved, LikeC4 refuses the whole project, and loam would\n * report a hole against a file whose only fault is arriving with the change\n * that makes it true.\n *\n * The staging is `core/c4/project/staged.ts`, shared with the use-case slot\n * rather than copied — the two would have disagreed first about the merge\n * preview, which is the one thing both refusals rest on.\n */\nimport { existsSync } from \"node:fs\";\nimport { basename, join, relative, resolve } from \"node:path\";\nimport { architectureDir } from \"../c4/project/architecture.js\";\nimport { stageMergedProject } from \"../c4/project/staged.js\";\nimport { type LoadedDoc } from \"../c4/likec4.js\";\nimport type { ExtendingModel } from \"../c4/splice/contract.js\";\nimport { architectureDocuments } from \"../c4/project/documents.js\";\nimport { featureDeploymentDir } from \"../repo/authored/paths.js\";\nimport { reservedArchitectureName } from \"../repo/paths.js\";\nimport type { DocsDir, FeatureDir } from \"../kernel/ids/dirs.js\";\nimport { type Issue } from \"../vocabulary/issue.js\";\n\n/** One topology document a feature carries. */\nexport interface FeatureDeployment {\n  /**\n   * The path INSIDE the feature's `deployment/` directory, `/`-separated — the\n   * id this axis has. Nesting is spelled by the tree, as it is for every other\n   * authored tree in the repo.\n   */\n  rel: string;\n  /** The absolute path of the authored file. */\n  path: string;\n}\n\n/**\n * The topology documents one feature carries, ordered by path.\n *\n * Zero readdirs when the feature has no `deployment/` directory, which is every\n * feature in a fleet that has not adopted the axis: `architectureDocuments`\n * answers an absent directory with an empty list rather than a throw. That\n * directory's existence is the whole per-feature opt-in.\n */\nexport async function featureDeployments(featureDir: FeatureDir): Promise<FeatureDeployment[]> {\n  const dir = featureDeploymentDir(featureDir);\n  const paths = await architectureDocuments(dir);\n  const base = resolve(dir);\n  return paths.map((path) => ({ rel: relative(base, path).split(/[\\\\/]/).join(\"/\"), path }));\n}\n\n/**\n * The LIVING path a feature-local topology document addresses.\n *\n * Straight into `architecture/`, with no subdirectory of its own — unlike\n * `architecture/usecases/`, and the difference is the model rather than taste.\n * A `deployment { }` block is part of the fleet's ONE architecture project and\n * is read as such by every loader; filing it under a subdirectory would suggest\n * a second project, which is exactly the reading `subsystems.likec4` and\n * `landscape.likec4` already refuse by sitting at the top level together.\n *\n * `rel` is joined un-split, which `node:path` normalizes. What holds the join is\n * PROVENANCE: every `rel` here came out of an `architectureDocuments` walk, so\n * each component is a directory entry that exists. No caller takes one from argv.\n */\nexport function livingDeploymentPath(docsDir: DocsDir, rel: string): string {\n  return join(architectureDir(docsDir), rel);\n}\n\n/**\n * The two things that can go wrong about a topology document's NAME, before\n * anything about its contents is asked.\n *\n * `deployment.doc-reserved` — the name is one loam owns inside `architecture/`.\n * The merge writes straight into that directory, unlike a flow, which lands\n * under `usecases/`, so `<name>` is free to collide with the living map, the\n * generated subsystem views, or the flow tree. `reservedArchitectureName`\n * carries which and why. It is asked FIRST and WITHOUT an existence test,\n * because two of the three fail silently when the target does not exist yet.\n *\n * `deployment.doc-exists` — a topology document this feature introduces that\n * the living `architecture/` already holds.\n *\n * An ERROR and never a warning-that-gates, for `usecase.flow-exists`'s reason:\n * there is no legal reading of it. The merge would replace an authored topology\n * wholesale, and no `--approve` makes that a different act than it is. Two\n * features introducing the same file is the case that makes it load-bearing\n * rather than pedantic — whichever archives first creates the living document,\n * and the second is told before it merges that its own file is the one to\n * delete.\n *\n * The collision is on the FILE, not on what is inside it. Two features may both\n * extend the same living region from two documents of their own and both\n * archive; that is the shape `extend` exists for, and refusing it would make the\n * slot useless for the fleet-wide change it was built for.\n */\nexport async function deploymentDeltaIssues(docsDir: DocsDir, featureDir: FeatureDir): Promise<Issue[]> {\n  const docs = await featureDeployments(featureDir);\n  const issues: Issue[] = [];\n  // The reservation runs FIRST and independently of existence, because two of\n  // the three names it refuses need not exist for the merge to be wrong. A\n  // topology copied over `subsystems.likec4` is destroyed by the next\n  // `loam subsystem sync` and is invisible to every project load until then —\n  // the merge would report `created architecture/subsystems.likec4` and nothing\n  // downstream would ever say another word about it.\n  for (const doc of docs) {\n    const reason = reservedArchitectureName(doc.rel);\n    if (reason === null) continue;\n    issues.push({\n      severity: \"error\",\n      code: \"deployment.doc-reserved\",\n      subject: doc.rel,\n      message:\n        `features/<FEAT>/deployment/${doc.rel} would merge to architecture/${doc.rel}, and that name is loam's: ` +\n        `${reason}. Rename the feature's document — its name is yours to choose, and \\`extend\\` is how it adds to ` +\n        \"what a living document already declares.\",\n    });\n  }\n  return issues.concat(\n    docs\n      .filter((doc) => reservedArchitectureName(doc.rel) === null)\n      .filter((doc) => existsSync(livingDeploymentPath(docsDir, doc.rel)))\n      .map((doc) => ({\n        severity: \"error\" as const,\n        code: \"deployment.doc-exists\" as const,\n        subject: doc.rel,\n        message:\n          `architecture/${doc.rel} already exists, so this feature's topology would replace an authored one wholesale — ` +\n          \"a feature-local deployment document INTRODUCES topology, it does not rewrite it. \" +\n          `Delete features/<FEAT>/deployment/${doc.rel} and edit architecture/${doc.rel} directly in this same change, ` +\n          \"where git produces an ordinary conflict if somebody else is editing it too. \" +\n          `To ADD to what that file declares, write a document of another name that says \\`extend\\` — ` +\n          `\\`${suggest(doc.rel)}\\` — which is what lets two features grow one region without touching each other.`,\n      })),\n  );\n}\n\n/** What the caller needs to grade this feature's topology against the merge preview. */\nexport interface DeploymentOverlayRequest {\n  docsDir: DocsDir;\n  featureDir: FeatureDir;\n  /** The feature's id — the tag that selects the delta's own additions. */\n  featureId: string;\n  /**\n   * The caller's memoised LikeC4 read, when it has one. A FUNCTION rather than\n   * the `FleetContext` itself, for the reason the use-case overlay states: one\n   * memoised read does not justify an edge from this package to\n   * `core/fleet-context.ts`, and the edge would push it up a DAG level for\n   * nothing.\n   */\n  load?: (path: string) => Promise<LoadedDoc>;\n  /**\n   * The fleet's extending models, for the merge preview — the SAME list\n   * `loam archive` routes with. A preview computed without them holds interior\n   * the archive puts in `services/<…>/model.likec4`, so a topology document\n   * naming `<service-fqn>.<container>` reads clean here and against nothing\n   * once it is living; `deployment.doc-invalid` is the gate that then fails\n   * open (verification 2026-09-04, review F8).\n   *\n   * A THUNK for `load`'s reason and one more: the early return below is the\n   * axis's per-feature opt-in, and a feature with no `deployment/` directory\n   * must not pay a fleet enumeration to be told so.\n   */\n  models?: () => Promise<readonly ExtendingModel[]>;\n}\n\n/** Whether this feature's topology could be read at all, against the map its merge would leave. */\nexport type DeploymentOverlay = { kind: \"read\" } | { kind: \"unreadable\"; errors: string[] };\n\n/**\n * Parse this feature's topology documents over the post-merge map.\n *\n * A feature with no `deployment/` directory is `read` at the cost of one walk\n * over a directory that is not there — the axis's per-feature opt-in, and the\n * whole price a fleet that has not adopted it pays. Nothing is staged, nothing\n * is parsed, and no temp tree is made.\n *\n * The verdict is deliberately BINARY. The use-case overlay hands its caller the\n * views it read because the axis has questions about their content; this one\n * has none — a topology document is checked by being parseable against the map\n * the merge will write, and everything else about it is graded by\n * `loam validate --all` once it is living, exactly as the landscape is.\n */\nexport async function readFeatureDeployments(req: DeploymentOverlayRequest): Promise<DeploymentOverlay> {\n  const docs = await featureDeployments(req.featureDir);\n  if (docs.length === 0) return { kind: \"read\" };\n  // AFTER the early return: the fleet read is paid only by a feature that\n  // actually brings a topology document.\n  const models = req.models === undefined ? undefined : await req.models();\n  const staged = await stageMergedProject({\n    docsDir: req.docsDir,\n    featureDir: req.featureDir,\n    featureId: req.featureId,\n    documents: docs.map((doc) => ({ rel: doc.rel, path: doc.path })),\n    ...(req.load === undefined ? {} : { load: req.load }),\n    ...(models === undefined ? {} : { models }),\n  });\n  return staged.kind === \"unreadable\" ? { kind: \"unreadable\", errors: staged.errors } : { kind: \"read\" };\n}\n\n/** A free name near the colliding one, so the fix is a rename the author can copy. */\nfunction suggest(rel: string): string {\n  const name = basename(rel).replace(/\\.likec4$/, \"\");\n  const dir = rel.slice(0, rel.length - basename(rel).length);\n  return `${dir}${name}-extend.likec4`;\n}\n"]}
+{"version":3,"file":"delta.js","sourceRoot":"","sources":["../../../src/core/deployment/delta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAkB,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAc,MAAM,wBAAwB,CAAC;AAcpD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAsB;IAC7D,OAAO,iBAAiB,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB,EAAE,GAAW;IAChE,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAgB,EAAE,UAAsB;IAClF,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,8EAA8E;IAC9E,wEAAwE;IACxE,sEAAsE;IACtE,4EAA4E;IAC5E,qEAAqE;IACrE,6EAA6E;IAC7E,6BAA6B;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,GAAG,CAAC,GAAG;YAChB,OAAO,EACL,8BAA8B,GAAG,CAAC,GAAG,gCAAgC,GAAG,CAAC,GAAG,6BAA6B;gBACzG,GAAG,MAAM,kGAAkG;gBAC3G,0CAA0C;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI;SACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;SAC3D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,QAAQ,EAAE,OAAgB;QAC1B,IAAI,EAAE,uBAAgC;QACtC,OAAO,EAAE,GAAG,CAAC,GAAG;QAChB,OAAO,EACL,gBAAgB,GAAG,CAAC,GAAG,wFAAwF;YAC/G,mFAAmF;YACnF,qCAAqC,GAAG,CAAC,GAAG,0BAA0B,GAAG,CAAC,GAAG,iCAAiC;YAC9G,8EAA8E;YAC9E,6FAA6F;YAC7F,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,mFAAmF;KAC3G,CAAC,CAAC,CACN,CAAC;AACJ,CAAC;AAkCD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAA6B;IACxE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/C,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzG,CAAC;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,GAAG,GAAG,GAAG,IAAI,gBAAgB,CAAC;AACvC,CAAC","sourcesContent":["/**\n * A feature's own topology: `features/<FEAT>/deployment/<name>.likec4`.\n *\n * Until this slot existed a change that stood up a standby cluster had to be\n * written in two places at once — the requirement in the feature, the topology\n * edited straight into `architecture/` — because `delta.likec4` refuses a\n * `deployment { }` block and always will: that document re-declares the\n * landscape's own identifiers and carries its own `specification`, so it cannot\n * be staged beside the map in one LikeC4 project. A document that declares\n * NEITHER can, which is exactly why the use-case axis put its flows in files of\n * their own, and why this mirrors it rather than inventing a shape.\n *\n * WHAT MAKES IT WORK, and it was measured before the axis was written: LikeC4\n * `extend` resolves across documents of one project. A feature writes\n *\n *     deployment {\n *       extend eu {\n *         dcC = datacenter 'DC-C' { k8sC = cluster 'cluster-c' { … } }\n *       }\n *       eu.dcA.k8sA -> eu.dcC.k8sC 'async replication'\n *     }\n *\n * and the living region gains a datacenter with the living file untouched. So\n * the merge is a copy, not a splice, and `unarchive` needs nothing new — a\n * create is undone by deleting, which the snapshot manifest already records for\n * every write in the plan.\n *\n * CREATE-ONLY, for `core/usecases/delta/flows.ts`'s reasons rather than a\n * weaker version of them. A requirement delta merges INTO a living document and\n * two features editing one requirement would overwrite each other silently; a\n * topology document has no such algebra — the file is one block, the merge is a\n * whole-file copy, and there is nothing to merge partially. Rewriting a living\n * one through a feature would be a silent whole-file replacement with no pin to\n * collide on, where editing `architecture/<name>.likec4` directly in the same\n * pull request produces an ordinary git conflict a human resolves.\n *\n * ## Graded against the map its own merge would leave behind\n *\n * `ARCH-LOAM-FEATURE-CORPUS`, and this axis needs it more literally than the\n * use-case one does: a feature that stands a service up in a new cluster\n * declares that service in its `delta.likec4` and instances it here, so the\n * element the topology names exists ONLY post-merge. Read against the living\n * landscape it is unresolved, LikeC4 refuses the whole project, and loam would\n * report a hole against a file whose only fault is arriving with the change\n * that makes it true.\n *\n * The staging is `core/c4/project/staged.ts`, shared with the use-case slot\n * rather than copied — the two would have disagreed first about the merge\n * preview, which is the one thing both refusals rest on.\n */\nimport { existsSync } from \"node:fs\";\nimport { basename, join } from \"node:path\";\nimport { architectureDir } from \"../c4/project/architecture.js\";\nimport { stageMergedProject } from \"../c4/project/staged.js\";\nimport { type LoadedDoc } from \"../c4/likec4.js\";\nimport type { ExtendingModel } from \"../c4/splice/contract.js\";\nimport { relativeDocuments } from \"../c4/project/documents.js\";\nimport { featureDeploymentDir } from \"../repo/authored/paths.js\";\nimport { reservedArchitectureName } from \"../repo/paths.js\";\nimport type { DocsDir, FeatureDir } from \"../kernel/ids/dirs.js\";\nimport { type Issue } from \"../vocabulary/issue.js\";\n\n/** One topology document a feature carries. */\nexport interface FeatureDeployment {\n  /**\n   * The path INSIDE the feature's `deployment/` directory, `/`-separated — the\n   * id this axis has. Nesting is spelled by the tree, as it is for every other\n   * authored tree in the repo.\n   */\n  rel: string;\n  /** The absolute path of the authored file. */\n  path: string;\n}\n\n/**\n * The topology documents one feature carries, ordered by path.\n *\n * Zero readdirs when the feature has no `deployment/` directory, which is every\n * feature in a fleet that has not adopted the axis: `architectureDocuments`\n * answers an absent directory with an empty list rather than a throw. That\n * directory's existence is the whole per-feature opt-in.\n */\nexport async function featureDeployments(featureDir: FeatureDir): Promise<FeatureDeployment[]> {\n  return relativeDocuments(featureDeploymentDir(featureDir));\n}\n\n/**\n * The LIVING path a feature-local topology document addresses.\n *\n * Straight into `architecture/`, with no subdirectory of its own — unlike\n * `architecture/usecases/`, and the difference is the model rather than taste.\n * A `deployment { }` block is part of the fleet's ONE architecture project and\n * is read as such by every loader; filing it under a subdirectory would suggest\n * a second project, which is exactly the reading `subsystems.likec4` and\n * `landscape.likec4` already refuse by sitting at the top level together.\n *\n * `rel` is joined un-split, which `node:path` normalizes. What holds the join is\n * PROVENANCE: every `rel` here came out of an `architectureDocuments` walk, so\n * each component is a directory entry that exists. No caller takes one from argv.\n */\nexport function livingDeploymentPath(docsDir: DocsDir, rel: string): string {\n  return join(architectureDir(docsDir), rel);\n}\n\n/**\n * The two things that can go wrong about a topology document's NAME, before\n * anything about its contents is asked.\n *\n * `deployment.doc-reserved` — the name is one loam owns inside `architecture/`.\n * The merge writes straight into that directory, unlike a flow, which lands\n * under `usecases/`, so `<name>` is free to collide with the living map, either\n * of the two GENERATED views files (`subsystems.likec4` and `services.likec4`),\n * or the flow tree. `reservedArchitectureName` carries which and why. It is\n * asked FIRST and WITHOUT an existence test, because three of the four fail\n * silently when the target does not exist yet.\n *\n * `deployment.doc-exists` — a topology document this feature introduces that\n * the living `architecture/` already holds.\n *\n * An ERROR and never a warning-that-gates, for `usecase.flow-exists`'s reason:\n * there is no legal reading of it. The merge would replace an authored topology\n * wholesale, and no `--approve` makes that a different act than it is. Two\n * features introducing the same file is the case that makes it load-bearing\n * rather than pedantic — whichever archives first creates the living document,\n * and the second is told before it merges that its own file is the one to\n * delete.\n *\n * The collision is on the FILE, not on what is inside it. Two features may both\n * extend the same living region from two documents of their own and both\n * archive; that is the shape `extend` exists for, and refusing it would make the\n * slot useless for the fleet-wide change it was built for.\n */\nexport async function deploymentDeltaIssues(docsDir: DocsDir, featureDir: FeatureDir): Promise<Issue[]> {\n  const docs = await featureDeployments(featureDir);\n  const issues: Issue[] = [];\n  // The reservation runs FIRST and independently of existence, because three of\n  // the four names it refuses need not exist for the merge to be wrong. A\n  // topology copied over either GENERATED file — `subsystems.likec4` or\n  // `services.likec4` — is destroyed by the next `loam subsystem sync` and is\n  // invisible to every project load until then: the merge would report\n  // `created architecture/subsystems.likec4` and nothing downstream would ever\n  // say another word about it.\n  for (const doc of docs) {\n    const reason = reservedArchitectureName(doc.rel);\n    if (reason === null) continue;\n    issues.push({\n      severity: \"error\",\n      code: \"deployment.doc-reserved\",\n      subject: doc.rel,\n      message:\n        `features/<FEAT>/deployment/${doc.rel} would merge to architecture/${doc.rel}, and that name is loam's: ` +\n        `${reason}. Rename the feature's document — its name is yours to choose, and \\`extend\\` is how it adds to ` +\n        \"what a living document already declares.\",\n    });\n  }\n  return issues.concat(\n    docs\n      .filter((doc) => reservedArchitectureName(doc.rel) === null)\n      .filter((doc) => existsSync(livingDeploymentPath(docsDir, doc.rel)))\n      .map((doc) => ({\n        severity: \"error\" as const,\n        code: \"deployment.doc-exists\" as const,\n        subject: doc.rel,\n        message:\n          `architecture/${doc.rel} already exists, so this feature's topology would replace an authored one wholesale — ` +\n          \"a feature-local deployment document INTRODUCES topology, it does not rewrite it. \" +\n          `Delete features/<FEAT>/deployment/${doc.rel} and edit architecture/${doc.rel} directly in this same change, ` +\n          \"where git produces an ordinary conflict if somebody else is editing it too. \" +\n          `To ADD to what that file declares, write a document of another name that says \\`extend\\` — ` +\n          `\\`${suggest(doc.rel)}\\` — which is what lets two features grow one region without touching each other.`,\n      })),\n  );\n}\n\n/** What the caller needs to grade this feature's topology against the merge preview. */\nexport interface DeploymentOverlayRequest {\n  docsDir: DocsDir;\n  featureDir: FeatureDir;\n  /** The feature's id — the tag that selects the delta's own additions. */\n  featureId: string;\n  /**\n   * The caller's memoised LikeC4 read, when it has one. A FUNCTION rather than\n   * the `FleetContext` itself, for the reason the use-case overlay states: one\n   * memoised read does not justify an edge from this package to\n   * `core/fleet-context.ts`, and the edge would push it up a DAG level for\n   * nothing.\n   */\n  load?: (path: string) => Promise<LoadedDoc>;\n  /**\n   * The fleet's extending models, for the merge preview — the SAME list\n   * `loam archive` routes with. A preview computed without them holds interior\n   * the archive puts in `services/<…>/model.likec4`, so a topology document\n   * naming `<service-fqn>.<container>` reads clean here and against nothing\n   * once it is living; `deployment.doc-invalid` is the gate that then fails\n   * open (verification 2026-09-04, review F8).\n   *\n   * A THUNK for `load`'s reason and one more: the early return below is the\n   * axis's per-feature opt-in, and a feature with no `deployment/` directory\n   * must not pay a fleet enumeration to be told so.\n   */\n  models?: () => Promise<readonly ExtendingModel[]>;\n}\n\n/** Whether this feature's topology could be read at all, against the map its merge would leave. */\nexport type DeploymentOverlay = { kind: \"read\" } | { kind: \"unreadable\"; errors: string[] };\n\n/**\n * Parse this feature's topology documents over the post-merge map.\n *\n * A feature with no `deployment/` directory is `read` at the cost of one walk\n * over a directory that is not there — the axis's per-feature opt-in, and the\n * whole price a fleet that has not adopted it pays. Nothing is staged, nothing\n * is parsed, and no temp tree is made.\n *\n * The verdict is deliberately BINARY. The use-case overlay hands its caller the\n * views it read because the axis has questions about their content; this one\n * has none — a topology document is checked by being parseable against the map\n * the merge will write, and everything else about it is graded by\n * `loam validate --all` once it is living, exactly as the landscape is.\n */\nexport async function readFeatureDeployments(req: DeploymentOverlayRequest): Promise<DeploymentOverlay> {\n  const docs = await featureDeployments(req.featureDir);\n  if (docs.length === 0) return { kind: \"read\" };\n  // AFTER the early return: the fleet read is paid only by a feature that\n  // actually brings a topology document.\n  const models = req.models === undefined ? undefined : await req.models();\n  const staged = await stageMergedProject({\n    docsDir: req.docsDir,\n    featureDir: req.featureDir,\n    featureId: req.featureId,\n    documents: docs.map((doc) => ({ rel: doc.rel, path: doc.path })),\n    ...(req.load === undefined ? {} : { load: req.load }),\n    ...(models === undefined ? {} : { models }),\n  });\n  return staged.kind === \"unreadable\" ? { kind: \"unreadable\", errors: staged.errors } : { kind: \"read\" };\n}\n\n/** A free name near the colliding one, so the fix is a rename the author can copy. */\nfunction suggest(rel: string): string {\n  const name = basename(rel).replace(/\\.likec4$/, \"\");\n  const dir = rel.slice(0, rel.length - basename(rel).length);\n  return `${dir}${name}-extend.likec4`;\n}\n"]}

package/dist/core/diff/base-git.js

@@ -1,11 +1,20 @@
 /**
- * Git-at-a-ref reader for the DOCS repo — the base side of `loam diff`.
+ * Git-at-a-ref reader for the DOCS repo — the base side of `loam diff`, and
+ * the "what had already shipped" side of `loam gate --since`.
  *
- * Three questions, all read-only: does this docs directory sit in a git
+ * Five questions, all read-only: does this docs directory sit in a git
  * repository and where (`resolveBase`), what did `services/` hold at the base
- * commit (`listBaseTree`), and what were one file's bytes there
- * (`showBaseFile`). No checkout, no temp writes — the base state is read
- * straight out of the object store with `rev-parse`/`ls-tree`/`show`.
+ * commit (`listBaseTree`), which subdirectories did one docs directory hold
+ * there (`listBaseSubdirs` — gate's `features/archive/` question) and which of
+ * them differ in the working tree now (`subdirsChangedSince` — its second),
+ * and what were one file's bytes there (`showBaseFile`). No checkout, no temp
+ * writes — the base state is read straight out of the object store with
+ * `rev-parse`/`ls-tree`/`show`, and the comparison with `diff`/`ls-files`.
+ *
+ * Gate takes diff's doctrine below along with the mechanics: a `--since` ref
+ * git cannot answer for is a refusal, never "nothing was archived since",
+ * because that silence would pass a deploy over every feature it could not
+ * see — the same fail-open as a silently empty diff base, one command over.
  *
  * The doctrine here is deliberately NOT provenance's. `../provenance/git.ts`
  * answers every git decline with "git will not say" — null, no finding —
@@ -21,6 +30,7 @@
  * construction.
  */
 import { spawn } from "node:child_process";
+import { relative, sep } from "node:path";
 import { collectStderr, declineDetail, GIT_TIMEOUT_MS, gitSaid, gitText } from "../provenance/git.js";
 /**
  * How many bytes one base file may be — the same generosity as
@@ -31,8 +41,8 @@ import { collectStderr, declineDetail, GIT_TIMEOUT_MS, gitSaid, gitText } from "
  * killed and the file reads as unreadable for its subject, never truncated.
  *
  * The question-asking mechanics — `gitText`, `GitAnswer`, `gitSaid`,
- * `declineDetail`, `collectStderr` — are the shared set exported beside
- * `collectStdout`: `../provenance/gitq/vouched-ancestor.ts` asks with the
+ * `declineDetail`, `collectStderr` — are the shared set `../provenance/git.ts`
+ * exports: `../provenance/gitq/vouched-ancestor.ts` asks with the
  * same shapes and the opposite consequence (it degrades to "full read" where
  * this module's callers REFUSE), and the helpers stay verdict-free so the two
  * doctrines cannot bleed into each other through a shared line.
@@ -73,15 +83,87 @@ export async function resolveBase(docsDir, ref) {
 }
 /**
  * Every file path under `services/` at the base commit, DOCS-RELATIVE
- * (`services/...`, prefix already stripped). `--full-tree` anchors both the
- * pathspec and the output at the repository root regardless of cwd, so the
- * one prefix from `resolveBase` is the whole story; `-z` because git quotes
- * non-ASCII paths in line output. An empty answer is git ANSWERING — the base
+ * (`services/...`, prefix already stripped — `lsTree` below holds the
+ * mechanics both listings share). An empty answer is git ANSWERING — the base
  * commit simply has no `services/` — and only a non-zero exit is a failure.
  */
 export async function listBaseTree(base) {
+    return lsTree(base, "-r", "services");
+}
+/**
+ * The NAMES of the immediate subdirectories of one docs directory at the base
+ * commit — `loam gate --since`'s question: which `features/archive/<FEAT>/`
+ * directories already existed at the ref, so every other archived feature
+ * shipped after it. `dir` is the absolute path a `repo/paths.ts` builder
+ * spells (`archiveDir`), made docs-relative here, so the layout keeps its one
+ * spelling; the separator is forced to `/` because git paths are slash-joined
+ * on every host. `-d` lists trees only, and the trailing slash asks for the
+ * directory's CHILDREN rather than the directory entry itself. An empty answer
+ * is git answering — the base had no such directory — and only a decline is
+ * `failed`, which the caller refuses on, as `listBaseTree`'s callers do.
+ */
+export async function listBaseSubdirs(base, dir) {
+    const rel = `${relative(base.docsDir, dir).split(sep).join("/")}/`;
+    const listing = await lsTree(base, "-d", rel);
+    if (listing.kind === "failed")
+        return listing;
+    return {
+        kind: "ok",
+        names: listing.paths.filter((p) => p.startsWith(rel)).map((p) => p.slice(rel.length)),
+    };
+}
+/**
+ * The NAMES of the immediate subdirectories of one docs directory whose
+ * contents differ between the base commit and the WORKING TREE — committed
+ * since or not — gate's second `features/archive/` question. A directory that
+ * was already there at the ref is not thereby old: `loam unarchive`, an edit
+ * and `loam archive` again leave a feature at the very path it shipped from
+ * before, and reading presence alone graded that re-shipped feature as one an
+ * earlier deploy had already answered for.
+ *
+ * Not a comparison of tree ids, though `ls-tree` has the ref's: the working
+ * tree has no id until somebody commits it, and minting one means writing
+ * objects — this module asks git, it never writes. The same two questions as
+ * `validate --base`'s scope (`./scope/changed-paths.ts`) instead, narrowed to
+ * the one directory: `git diff` for every tracked path that differs from the
+ * ref, `--no-renames` so a moved file names the place it left as well as the
+ * one it reached, and `ls-files --others` for what nobody has committed yet —
+ * the re-archive a pipeline is about to ship is exactly that. Both pathspecs
+ * are relative to `docsDir`, where git runs; both listings answer
+ * root-relative (`git diff` always, `ls-files` under `--full-name`), so the
+ * one prefix strip serves both. A decline is `failed`, and the caller decides
+ * which way that fails.
+ */
+export async function subdirsChangedSince(base, dir) {
+    const rel = `${relative(base.docsDir, dir).split(sep).join("/")}/`;
+    const tracked = await gitText(base.docsDir, ["diff", "--name-only", "--no-renames", "--no-ext-diff", "-z", base.commit, "--", rel]);
+    if (tracked.spawnError !== undefined || tracked.code !== 0 || tracked.overflowed) {
+        return { kind: "failed", detail: tracked.overflowed ? "the changed-path listing exceeded the output cap." : declineDetail(tracked) };
+    }
+    const untracked = await gitText(base.docsDir, ["ls-files", "--others", "--exclude-standard", "--full-name", "-z", "--", rel]);
+    if (untracked.spawnError !== undefined || untracked.code !== 0 || untracked.overflowed) {
+        return { kind: "failed", detail: untracked.overflowed ? "the untracked-path listing exceeded the output cap." : declineDetail(untracked) };
+    }
+    const under = `${base.prefix}${rel}`;
+    const names = new Set();
+    for (const path of [...tracked.out.split("\0"), ...untracked.out.split("\0")]) {
+        if (!path.startsWith(under))
+            continue;
+        const name = path.slice(under.length).split("/")[0];
+        if (name !== "")
+            names.add(name);
+    }
+    return { kind: "ok", names };
+}
+/**
+ * The one `ls-tree` both listings ask, DOCS-RELATIVE (prefix already
+ * stripped). `--full-tree` anchors both the pathspec and the output at the
+ * repository root regardless of cwd, so the one prefix from `resolveBase` is
+ * the whole story; `-z` because git quotes non-ASCII paths in line output.
+ */
+async function lsTree(base, mode, root) {
     const answer = await gitText(base.docsDir, [
-        "ls-tree", "-r", "-z", "--name-only", "--full-tree", base.commit, "--", `${base.prefix}services`,
+        "ls-tree", mode, "-z", "--name-only", "--full-tree", base.commit, "--", `${base.prefix}${root}`,
     ]);
     if (answer.spawnError !== undefined || answer.code !== 0 || answer.overflowed) {
         return {

package/dist/core/diff/base-git.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-git.js","sourceRoot":"","sources":["../../../src/core/diff/base-git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAGtG;;;;;;;;;;;;;;GAcG;AACH,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAO7C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,GAAW;IAC7D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IACvG,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,WAAW,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;AAC1D,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB;IACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,UAAU;KACjG,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC9E,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,MAAM,CAAC,UAAU;gBACvB,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC;SAC1B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,MAAM,CAAC,GAAG;aACd,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAC3C,CAAC;AACJ,CAAC;AAMD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB,EAAE,GAAW;IAChE,OAAO,IAAI,OAAO,CAAe,CAAC,IAAI,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE;YAC1E,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,IAAI,UAAU;gBAAE,OAAO;YACvB,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC9C,UAAU,GAAG,IAAI,CAAC;gBAClB,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;QACtG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU;wBAChB,CAAC,CAAC,0CAA0C;wBAC5C,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC;iBAC7D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Git-at-a-ref reader for the DOCS repo — the base side of `loam diff`.\n *\n * Three questions, all read-only: does this docs directory sit in a git\n * repository and where (`resolveBase`), what did `services/` hold at the base\n * commit (`listBaseTree`), and what were one file's bytes there\n * (`showBaseFile`). No checkout, no temp writes — the base state is read\n * straight out of the object store with `rev-parse`/`ls-tree`/`show`.\n *\n * The doctrine here is deliberately NOT provenance's. `../provenance/git.ts`\n * answers every git decline with \"git will not say\" — null, no finding —\n * because provenance has no denominator without git and nothing to report.\n * Diff is the opposite case: without the base there is no honest diff at all,\n * and a silently empty base would report the whole fleet as ADDED — the exact\n * \"green over zero services\" failure `docsRepoReady` exists to prevent, one\n * step later. So every decline travels as a typed outcome the command REFUSES\n * on, carrying git's own words (bounded) so the refusal can say why.\n *\n * What is shared with provenance is the mechanics: the one timeout and the\n * capped stdout reader, so rule 20 (every child spawn bounded) holds by\n * construction.\n */\nimport { spawn } from \"node:child_process\";\nimport { collectStderr, declineDetail, GIT_TIMEOUT_MS, gitSaid, gitText } from \"../provenance/git.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\n\n/**\n * How many bytes one base file may be — the same generosity as\n * `../provenance/git.ts`'s stdout cap, restated here because that constant is\n * private to its module and this one collects BYTES, not text (a base\n * contract's UTF-8-ness is a fact to grade, and `setEncoding(\"utf8\")` would\n * substitute U+FFFD before anyone could check). Past the cap the child is\n * killed and the file reads as unreadable for its subject, never truncated.\n *\n * The question-asking mechanics — `gitText`, `GitAnswer`, `gitSaid`,\n * `declineDetail`, `collectStderr` — are the shared set exported beside\n * `collectStdout`: `../provenance/gitq/vouched-ancestor.ts` asks with the\n * same shapes and the opposite consequence (it degrades to \"full read\" where\n * this module's callers REFUSE), and the helpers stay verdict-free so the two\n * doctrines cannot bleed into each other through a shared line.\n */\nconst MAX_BASE_FILE_BYTES = 64 * 1024 * 1024;\n\nexport type BaseResolution =\n  | { kind: \"no-git\"; detail: string }\n  | { kind: \"no-ref\"; detail: string }\n  | { kind: \"ok\"; commit: string; prefix: string };\n\n/**\n * Resolve the base: is `docsDir` inside a git work tree, where does it sit in\n * that repository, and which commit does `ref` name?\n *\n * `--show-prefix` is asked FIRST and is not decoration: a docs repo checked\n * out as a subdirectory of a larger repository (a monorepo's `docs/`) answers\n * every later `ls-tree`/`show` only under that prefix. Dropping it makes every\n * path miss, and a diff whose base paths all miss reports the whole fleet as\n * added — silently, in exactly the repositories big enough to care.\n */\nexport async function resolveBase(docsDir: DocsDir, ref: string): Promise<BaseResolution> {\n  const where = await gitText(docsDir, [\"rev-parse\", \"--show-prefix\"]);\n  if (where.spawnError !== undefined || where.code !== 0) {\n    return { kind: \"no-git\", detail: declineDetail(where) };\n  }\n  // A ref spelled like an option would be parsed as one by git, not resolved\n  // as a revision — refuse it before it reaches an argv. Same reason the MCP\n  // argv boundary refuses '-'-prefixed strings.\n  const spelled = ref.trim();\n  if (spelled === \"\" || spelled.startsWith(\"-\")) {\n    return { kind: \"no-ref\", detail: \"a ref must be a revision name, not empty and not option-shaped.\" };\n  }\n  // `^{commit}` peels an annotated tag to the commit it tags, and refuses a\n  // ref that names any other object kind — a tree or blob sha is not a base\n  // state to diff against.\n  const verified = await gitText(docsDir, [\"rev-parse\", \"--verify\", `${spelled}^{commit}`]);\n  const commit = verified.out.trim();\n  if (verified.code !== 0 || !/^[0-9a-f]{40}$/.test(commit)) {\n    const said = gitSaid(verified);\n    return { kind: \"no-ref\", detail: said === \"\" ? \"\" : `git said: ${said}` };\n  }\n  return { kind: \"ok\", commit, prefix: where.out.trim() };\n}\n\n/** The resolved base every later question is asked against. */\nexport interface ResolvedBase {\n  docsDir: DocsDir;\n  commit: string;\n  /** The docs repo's path inside its repository, `\"\"` or `\"docs/\"`-shaped — `rev-parse --show-prefix`'s answer. */\n  prefix: string;\n}\n\nexport type BaseTreeListing =\n  | { kind: \"ok\"; paths: string[] }\n  | { kind: \"failed\"; detail: string };\n\n/**\n * Every file path under `services/` at the base commit, DOCS-RELATIVE\n * (`services/...`, prefix already stripped). `--full-tree` anchors both the\n * pathspec and the output at the repository root regardless of cwd, so the\n * one prefix from `resolveBase` is the whole story; `-z` because git quotes\n * non-ASCII paths in line output. An empty answer is git ANSWERING — the base\n * commit simply has no `services/` — and only a non-zero exit is a failure.\n */\nexport async function listBaseTree(base: ResolvedBase): Promise<BaseTreeListing> {\n  const answer = await gitText(base.docsDir, [\n    \"ls-tree\", \"-r\", \"-z\", \"--name-only\", \"--full-tree\", base.commit, \"--\", `${base.prefix}services`,\n  ]);\n  if (answer.spawnError !== undefined || answer.code !== 0 || answer.overflowed) {\n    return {\n      kind: \"failed\",\n      detail: answer.overflowed\n        ? \"the base tree listing exceeded the output cap.\"\n        : declineDetail(answer),\n    };\n  }\n  return {\n    kind: \"ok\",\n    paths: answer.out\n      .split(\"\\0\")\n      .filter((p) => p.startsWith(base.prefix) && p !== \"\")\n      .map((p) => p.slice(base.prefix.length)),\n  };\n}\n\nexport type BaseFileRead =\n  | { kind: \"ok\"; bytes: Buffer }\n  | { kind: \"failed\"; detail: string };\n\n/**\n * One base file's bytes, by docs-relative path. Callers only ask for paths\n * `listBaseTree` returned, so there is no \"absent\" arm: a decline here is\n * abnormal and travels as `failed` for per-subject containment — that one\n * subject degrades with the detail, never the whole diff.\n */\nexport async function showBaseFile(base: ResolvedBase, rel: string): Promise<BaseFileRead> {\n  return new Promise<BaseFileRead>((done) => {\n    const child = spawn(\"git\", [\"show\", `${base.commit}:${base.prefix}${rel}`], {\n      cwd: base.docsDir,\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      timeout: GIT_TIMEOUT_MS,\n    });\n    // Bytes, not text: `collectStdout` decodes as UTF-8, and a base contract\n    // whose bytes are NOT UTF-8 must arrive intact so base-state can grade it\n    // unreadable instead of parsing a document nobody wrote.\n    const chunks: Buffer[] = [];\n    let held = 0;\n    let overflowed = false;\n    child.stdout.on(\"data\", (chunk: Buffer) => {\n      if (overflowed) return;\n      if (held + chunk.length > MAX_BASE_FILE_BYTES) {\n        overflowed = true;\n        child.kill();\n        return;\n      }\n      chunks.push(chunk);\n      held += chunk.length;\n    });\n    const err = collectStderr(child);\n    child.on(\"error\", (e) => done({ kind: \"failed\", detail: `git could not be started: ${e.message}.` }));\n    child.on(\"close\", (code) => {\n      if (code !== 0 || overflowed) {\n        done({\n          kind: \"failed\",\n          detail: overflowed\n            ? \"the file exceeds the base-read byte cap.\"\n            : declineDetail({ code, out: \"\", err: err(), overflowed }),\n        });\n        return;\n      }\n      done({ kind: \"ok\", bytes: Buffer.concat(chunks) });\n    });\n  });\n}\n"]}
+{"version":3,"file":"base-git.js","sourceRoot":"","sources":["../../../src/core/diff/base-git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAGtG;;;;;;;;;;;;;;GAcG;AACH,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAO7C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,GAAW;IAC7D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IACvG,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,WAAW,CAAC,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;AAC1D,CAAC;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB;IACnD,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAkB,EAClB,GAAW;IAEX,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;KACtF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAkB,EAClB,GAAW;IAEX,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACpI,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IACvI,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9H,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7I,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACrD,IAAI,IAAI,KAAK,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CAAC,IAAkB,EAAE,IAAiB,EAAE,IAAY;IACvE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;QACzC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE;KAChG,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC9E,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,MAAM,CAAC,UAAU;gBACvB,CAAC,CAAC,gDAAgD;gBAClD,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC;SAC1B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,MAAM,CAAC,GAAG;aACd,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAC3C,CAAC;AACJ,CAAC;AAMD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB,EAAE,GAAW;IAChE,OAAO,IAAI,OAAO,CAAe,CAAC,IAAI,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE;YAC1E,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,IAAI,UAAU;gBAAE,OAAO;YACvB,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBAC9C,UAAU,GAAG,IAAI,CAAC;gBAClB,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;QACtG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,UAAU;wBAChB,CAAC,CAAC,0CAA0C;wBAC5C,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC;iBAC7D,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Git-at-a-ref reader for the DOCS repo — the base side of `loam diff`, and\n * the \"what had already shipped\" side of `loam gate --since`.\n *\n * Five questions, all read-only: does this docs directory sit in a git\n * repository and where (`resolveBase`), what did `services/` hold at the base\n * commit (`listBaseTree`), which subdirectories did one docs directory hold\n * there (`listBaseSubdirs` — gate's `features/archive/` question) and which of\n * them differ in the working tree now (`subdirsChangedSince` — its second),\n * and what were one file's bytes there (`showBaseFile`). No checkout, no temp\n * writes — the base state is read straight out of the object store with\n * `rev-parse`/`ls-tree`/`show`, and the comparison with `diff`/`ls-files`.\n *\n * Gate takes diff's doctrine below along with the mechanics: a `--since` ref\n * git cannot answer for is a refusal, never \"nothing was archived since\",\n * because that silence would pass a deploy over every feature it could not\n * see — the same fail-open as a silently empty diff base, one command over.\n *\n * The doctrine here is deliberately NOT provenance's. `../provenance/git.ts`\n * answers every git decline with \"git will not say\" — null, no finding —\n * because provenance has no denominator without git and nothing to report.\n * Diff is the opposite case: without the base there is no honest diff at all,\n * and a silently empty base would report the whole fleet as ADDED — the exact\n * \"green over zero services\" failure `docsRepoReady` exists to prevent, one\n * step later. So every decline travels as a typed outcome the command REFUSES\n * on, carrying git's own words (bounded) so the refusal can say why.\n *\n * What is shared with provenance is the mechanics: the one timeout and the\n * capped stdout reader, so rule 20 (every child spawn bounded) holds by\n * construction.\n */\nimport { spawn } from \"node:child_process\";\nimport { relative, sep } from \"node:path\";\nimport { collectStderr, declineDetail, GIT_TIMEOUT_MS, gitSaid, gitText } from \"../provenance/git.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\n\n/**\n * How many bytes one base file may be — the same generosity as\n * `../provenance/git.ts`'s stdout cap, restated here because that constant is\n * private to its module and this one collects BYTES, not text (a base\n * contract's UTF-8-ness is a fact to grade, and `setEncoding(\"utf8\")` would\n * substitute U+FFFD before anyone could check). Past the cap the child is\n * killed and the file reads as unreadable for its subject, never truncated.\n *\n * The question-asking mechanics — `gitText`, `GitAnswer`, `gitSaid`,\n * `declineDetail`, `collectStderr` — are the shared set `../provenance/git.ts`\n * exports: `../provenance/gitq/vouched-ancestor.ts` asks with the\n * same shapes and the opposite consequence (it degrades to \"full read\" where\n * this module's callers REFUSE), and the helpers stay verdict-free so the two\n * doctrines cannot bleed into each other through a shared line.\n */\nconst MAX_BASE_FILE_BYTES = 64 * 1024 * 1024;\n\nexport type BaseResolution =\n  | { kind: \"no-git\"; detail: string }\n  | { kind: \"no-ref\"; detail: string }\n  | { kind: \"ok\"; commit: string; prefix: string };\n\n/**\n * Resolve the base: is `docsDir` inside a git work tree, where does it sit in\n * that repository, and which commit does `ref` name?\n *\n * `--show-prefix` is asked FIRST and is not decoration: a docs repo checked\n * out as a subdirectory of a larger repository (a monorepo's `docs/`) answers\n * every later `ls-tree`/`show` only under that prefix. Dropping it makes every\n * path miss, and a diff whose base paths all miss reports the whole fleet as\n * added — silently, in exactly the repositories big enough to care.\n */\nexport async function resolveBase(docsDir: DocsDir, ref: string): Promise<BaseResolution> {\n  const where = await gitText(docsDir, [\"rev-parse\", \"--show-prefix\"]);\n  if (where.spawnError !== undefined || where.code !== 0) {\n    return { kind: \"no-git\", detail: declineDetail(where) };\n  }\n  // A ref spelled like an option would be parsed as one by git, not resolved\n  // as a revision — refuse it before it reaches an argv. Same reason the MCP\n  // argv boundary refuses '-'-prefixed strings.\n  const spelled = ref.trim();\n  if (spelled === \"\" || spelled.startsWith(\"-\")) {\n    return { kind: \"no-ref\", detail: \"a ref must be a revision name, not empty and not option-shaped.\" };\n  }\n  // `^{commit}` peels an annotated tag to the commit it tags, and refuses a\n  // ref that names any other object kind — a tree or blob sha is not a base\n  // state to diff against.\n  const verified = await gitText(docsDir, [\"rev-parse\", \"--verify\", `${spelled}^{commit}`]);\n  const commit = verified.out.trim();\n  if (verified.code !== 0 || !/^[0-9a-f]{40}$/.test(commit)) {\n    const said = gitSaid(verified);\n    return { kind: \"no-ref\", detail: said === \"\" ? \"\" : `git said: ${said}` };\n  }\n  return { kind: \"ok\", commit, prefix: where.out.trim() };\n}\n\n/** The resolved base every later question is asked against. */\nexport interface ResolvedBase {\n  docsDir: DocsDir;\n  commit: string;\n  /** The docs repo's path inside its repository, `\"\"` or `\"docs/\"`-shaped — `rev-parse --show-prefix`'s answer. */\n  prefix: string;\n}\n\nexport type BaseTreeListing =\n  | { kind: \"ok\"; paths: string[] }\n  | { kind: \"failed\"; detail: string };\n\n/**\n * Every file path under `services/` at the base commit, DOCS-RELATIVE\n * (`services/...`, prefix already stripped — `lsTree` below holds the\n * mechanics both listings share). An empty answer is git ANSWERING — the base\n * commit simply has no `services/` — and only a non-zero exit is a failure.\n */\nexport async function listBaseTree(base: ResolvedBase): Promise<BaseTreeListing> {\n  return lsTree(base, \"-r\", \"services\");\n}\n\n/**\n * The NAMES of the immediate subdirectories of one docs directory at the base\n * commit — `loam gate --since`'s question: which `features/archive/<FEAT>/`\n * directories already existed at the ref, so every other archived feature\n * shipped after it. `dir` is the absolute path a `repo/paths.ts` builder\n * spells (`archiveDir`), made docs-relative here, so the layout keeps its one\n * spelling; the separator is forced to `/` because git paths are slash-joined\n * on every host. `-d` lists trees only, and the trailing slash asks for the\n * directory's CHILDREN rather than the directory entry itself. An empty answer\n * is git answering — the base had no such directory — and only a decline is\n * `failed`, which the caller refuses on, as `listBaseTree`'s callers do.\n */\nexport async function listBaseSubdirs(\n  base: ResolvedBase,\n  dir: string,\n): Promise<{ kind: \"ok\"; names: string[] } | { kind: \"failed\"; detail: string }> {\n  const rel = `${relative(base.docsDir, dir).split(sep).join(\"/\")}/`;\n  const listing = await lsTree(base, \"-d\", rel);\n  if (listing.kind === \"failed\") return listing;\n  return {\n    kind: \"ok\",\n    names: listing.paths.filter((p) => p.startsWith(rel)).map((p) => p.slice(rel.length)),\n  };\n}\n\n/**\n * The NAMES of the immediate subdirectories of one docs directory whose\n * contents differ between the base commit and the WORKING TREE — committed\n * since or not — gate's second `features/archive/` question. A directory that\n * was already there at the ref is not thereby old: `loam unarchive`, an edit\n * and `loam archive` again leave a feature at the very path it shipped from\n * before, and reading presence alone graded that re-shipped feature as one an\n * earlier deploy had already answered for.\n *\n * Not a comparison of tree ids, though `ls-tree` has the ref's: the working\n * tree has no id until somebody commits it, and minting one means writing\n * objects — this module asks git, it never writes. The same two questions as\n * `validate --base`'s scope (`./scope/changed-paths.ts`) instead, narrowed to\n * the one directory: `git diff` for every tracked path that differs from the\n * ref, `--no-renames` so a moved file names the place it left as well as the\n * one it reached, and `ls-files --others` for what nobody has committed yet —\n * the re-archive a pipeline is about to ship is exactly that. Both pathspecs\n * are relative to `docsDir`, where git runs; both listings answer\n * root-relative (`git diff` always, `ls-files` under `--full-name`), so the\n * one prefix strip serves both. A decline is `failed`, and the caller decides\n * which way that fails.\n */\nexport async function subdirsChangedSince(\n  base: ResolvedBase,\n  dir: string,\n): Promise<{ kind: \"ok\"; names: Set<string> } | { kind: \"failed\"; detail: string }> {\n  const rel = `${relative(base.docsDir, dir).split(sep).join(\"/\")}/`;\n  const tracked = await gitText(base.docsDir, [\"diff\", \"--name-only\", \"--no-renames\", \"--no-ext-diff\", \"-z\", base.commit, \"--\", rel]);\n  if (tracked.spawnError !== undefined || tracked.code !== 0 || tracked.overflowed) {\n    return { kind: \"failed\", detail: tracked.overflowed ? \"the changed-path listing exceeded the output cap.\" : declineDetail(tracked) };\n  }\n  const untracked = await gitText(base.docsDir, [\"ls-files\", \"--others\", \"--exclude-standard\", \"--full-name\", \"-z\", \"--\", rel]);\n  if (untracked.spawnError !== undefined || untracked.code !== 0 || untracked.overflowed) {\n    return { kind: \"failed\", detail: untracked.overflowed ? \"the untracked-path listing exceeded the output cap.\" : declineDetail(untracked) };\n  }\n  const under = `${base.prefix}${rel}`;\n  const names = new Set<string>();\n  for (const path of [...tracked.out.split(\"\\0\"), ...untracked.out.split(\"\\0\")]) {\n    if (!path.startsWith(under)) continue;\n    const name = path.slice(under.length).split(\"/\")[0]!;\n    if (name !== \"\") names.add(name);\n  }\n  return { kind: \"ok\", names };\n}\n\n/**\n * The one `ls-tree` both listings ask, DOCS-RELATIVE (prefix already\n * stripped). `--full-tree` anchors both the pathspec and the output at the\n * repository root regardless of cwd, so the one prefix from `resolveBase` is\n * the whole story; `-z` because git quotes non-ASCII paths in line output.\n */\nasync function lsTree(base: ResolvedBase, mode: \"-r\" | \"-d\", root: string): Promise<BaseTreeListing> {\n  const answer = await gitText(base.docsDir, [\n    \"ls-tree\", mode, \"-z\", \"--name-only\", \"--full-tree\", base.commit, \"--\", `${base.prefix}${root}`,\n  ]);\n  if (answer.spawnError !== undefined || answer.code !== 0 || answer.overflowed) {\n    return {\n      kind: \"failed\",\n      detail: answer.overflowed\n        ? \"the base tree listing exceeded the output cap.\"\n        : declineDetail(answer),\n    };\n  }\n  return {\n    kind: \"ok\",\n    paths: answer.out\n      .split(\"\\0\")\n      .filter((p) => p.startsWith(base.prefix) && p !== \"\")\n      .map((p) => p.slice(base.prefix.length)),\n  };\n}\n\nexport type BaseFileRead =\n  | { kind: \"ok\"; bytes: Buffer }\n  | { kind: \"failed\"; detail: string };\n\n/**\n * One base file's bytes, by docs-relative path. Callers only ask for paths\n * `listBaseTree` returned, so there is no \"absent\" arm: a decline here is\n * abnormal and travels as `failed` for per-subject containment — that one\n * subject degrades with the detail, never the whole diff.\n */\nexport async function showBaseFile(base: ResolvedBase, rel: string): Promise<BaseFileRead> {\n  return new Promise<BaseFileRead>((done) => {\n    const child = spawn(\"git\", [\"show\", `${base.commit}:${base.prefix}${rel}`], {\n      cwd: base.docsDir,\n      stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      timeout: GIT_TIMEOUT_MS,\n    });\n    // Bytes, not text: `collectStdout` decodes as UTF-8, and a base contract\n    // whose bytes are NOT UTF-8 must arrive intact so base-state can grade it\n    // unreadable instead of parsing a document nobody wrote.\n    const chunks: Buffer[] = [];\n    let held = 0;\n    let overflowed = false;\n    child.stdout.on(\"data\", (chunk: Buffer) => {\n      if (overflowed) return;\n      if (held + chunk.length > MAX_BASE_FILE_BYTES) {\n        overflowed = true;\n        child.kill();\n        return;\n      }\n      chunks.push(chunk);\n      held += chunk.length;\n    });\n    const err = collectStderr(child);\n    child.on(\"error\", (e) => done({ kind: \"failed\", detail: `git could not be started: ${e.message}.` }));\n    child.on(\"close\", (code) => {\n      if (code !== 0 || overflowed) {\n        done({\n          kind: \"failed\",\n          detail: overflowed\n            ? \"the file exceeds the base-read byte cap.\"\n            : declineDetail({ code, out: \"\", err: err(), overflowed }),\n        });\n        return;\n      }\n      done({ kind: \"ok\", bytes: Buffer.concat(chunks) });\n    });\n  });\n}\n"]}

package/dist/core/diff/base-state.js

@@ -41,6 +41,8 @@
  */
 import { isUtf8 } from "node:buffer";
 import { inOrder } from "../kernel/concurrency.js";
+import { rawServiceId } from "../kernel/ids/service.js";
+import { decodeDocument } from "../kernel/document-bytes.js";
 import { parseRequirements } from "../document/parse.js";
 import { openapiFromText } from "../openapi/doc.js";
 import { asyncapiFromText } from "../asyncapi/read.js";
@@ -48,6 +50,7 @@ import { ARTIFACT_FILES, isServiceArtifactName } from "../repo/paths.js";
 import { SUBSYSTEM_MARKER } from "../repo/tree/marker.js";
 import { RESERVED_INTERIOR } from "../repo/tree/walk.js";
 import { listBaseTree, showBaseFile } from "./base-git.js";
+import { bytesDigest, collisions } from "../consumers/state.js";
 /**
  * Classify the base tree's file listing into service directories — the module
  * banner's three restated walk branches, in depth order so every ancestor is
@@ -133,44 +136,53 @@ function classifyBaseDirs(paths) {
         if (interior(segments))
             continue;
         acceptedDirs.add(dir);
-        accepted.push({ id: segments[segments.length - 1], dir, files: fileChildren.get(dir) ?? new Set() });
+        accepted.push({ id: rawServiceId(segments[segments.length - 1]), dir, files: fileChildren.get(dir) ?? new Set() });
     }
     return { dirs: accepted, ambiguous: collisions(accepted) };
 }
-function collisions(dirs) {
-    const byId = new Map();
-    for (const d of dirs)
-        byId.set(d.id, [...(byId.get(d.id) ?? []), d.dir]);
-    return new Map([...byId].filter(([, claimants]) => claimants.length > 1));
-}
 /**
  * Lift one fetched file into an axis state through its parser. Absence is the
  * listing's answer, a `show` failure is per-subject containment, and only
- * then do the bytes reach a parser.
+ * then do the bytes reach a parser. A parser's refusal carries the hash of
+ * the bytes it refused (`AxisState`'s `bytes`); a `show` failure has none to
+ * hash.
  */
 function axisFrom(raw, parse) {
     if (raw === null)
         return { kind: "absent" };
     if (raw.read.kind === "failed")
         return { kind: "unreadable", path: raw.rel, error: raw.read.detail };
-    return parse(raw.rel, raw.read.bytes);
+    const state = parse(raw.rel, raw.read.bytes);
+    return state.kind === "unreadable" ? { ...state, bytes: bytesDigest(raw.read.bytes) } : state;
 }
 /**
- * The same refusal `readOpenapi`/`readAsyncapi`/`decodeDocument` make on the
- * living side: non-UTF-8 bytes would be silently rewritten as U+FFFD by
- * `toString`, and a document nobody wrote must not be graded.
+ * The same refusal `readOpenapi`/`readAsyncapi` make on the living side for a
+ * CONTRACT: non-UTF-8 bytes would be silently rewritten as U+FFFD by
+ * `toString`, and a document nobody wrote must not be graded. Contracts only:
+ * the spec axis decodes through `decodeDocument` instead (`specState`), because
+ * that is what its living side does, and each axis must refuse at the base
+ * exactly the bytes its living reader refuses.
  */
 function decodeBase(path, bytes) {
     if (!isUtf8(bytes))
         return { unreadable: { kind: "unreadable", path, error: "file is not valid UTF-8" } };
     return { text: bytes.toString("utf8") };
 }
+/**
+ * A spec-axis file decodes through `decodeDocument` — the rule the living side
+ * applies to the same file (`FleetContext.readText`) — not through
+ * `decodeBase`'s `isUtf8`-only test. The difference is the NUL test: UTF-16LE
+ * of ASCII saved WITHOUT a byte-order mark is a valid UTF-8 sequence, so
+ * `isUtf8` alone let it through here and it parsed as zero requirements while
+ * the working tree refused the identical bytes. The base then read as a
+ * readable EMPTY spec: an untouched file diffed as one-sided containment, and
+ * a branch that re-saved it as UTF-8 reported every requirement in it as
+ * added. `decodeDocument`'s `NotUtf8DocumentError` lands in the catch below
+ * and becomes the unreadable arm like any parse failure.
+ */
 function specState(path, bytes) {
-    const decoded = decodeBase(path, bytes);
-    if ("unreadable" in decoded)
-        return decoded.unreadable;
     try {
-        return { kind: "read", value: parseRequirements(decoded.text) };
+        return { kind: "read", value: parseRequirements(decodeDocument(bytes, path)) };
     }
     catch (e) {
         return { kind: "unreadable", path, error: e instanceof Error ? e.message : String(e) };

package/dist/core/diff/base-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-state.js","sourceRoot":"","sources":["../../../src/core/diff/base-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAkB,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAqB,MAAM,eAAe,CAAC;AAyD9E;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAe;IACvC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,wEAAwE;QACxE,kEAAkE;QAClE,iEAAiE;QACjE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,2EAA2E;QAC3E,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,yEAAyE;QACzE,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;YACvD,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,GAAG,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC;IAClG,MAAM,WAAW,GAAG,CAAC,GAAW,EAAW,EAAE,CAC3C,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,oBAAoB;IACpB,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,4EAA4E;IAC5E,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAW,EAAE,CACpD,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,aAAa,GAAG,CAAC,GAAW,EAAW,EAAE,CAC7C,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;SACtF,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACpF,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;SACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACxD,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACL,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,2EAA2E;IAC3E,4EAA4E;IAC5E,kEAAkE;IAClE,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,CAAC,QAAkB,EAAW,EAAE;QAC/C,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC1C,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,IAAe;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAKD;;;;GAIG;AACH,SAAS,QAAQ,CAAI,GAAY,EAAE,KAAoD;IACrF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5C,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrG,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;IAC1G,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IACvD,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,UAAU;QACnB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,iCAAiC,EAAE;QACrF,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IACvD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,UAAU;QACnB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,kCAAkC,EAAE;QACtF,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,wNAAwN;AACxN,KAAK,UAAU,eAAe,CAAC,IAAkB,EAAE,CAAU;IAC3D,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE,CACrD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7G,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;QAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;QACnE,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;QACpE,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAkB;IACpD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpG,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC;AAC/F,CAAC","sourcesContent":["/**\n * The base side of `loam diff`: the fleet as the base commit held it, read\n * entirely out of git's object store (`./base-git.ts`) and parsed with the\n * SAME parsers the living files go through — `parseRequirements`,\n * `openapiFromText`, `asyncapiFromText` — so a base document can never read\n * differently from the identical bytes sitting on disk.\n *\n * CLASSIFICATION is a second, simplified spelling of `repo/tree/walk.ts`'s\n * rule, and that is a recorded risk, not an accident: the walk classifies a\n * LIVE filesystem (readdir, symlinks, marker files) and cannot walk a git\n * ref. What keeps the two honest is sharing the artifact-name table\n * (`ARTIFACT_FILES`/`isServiceArtifactName` from `repo/paths.ts`), the\n * marker name (`SUBSYSTEM_MARKER`) and the reserved-interior set\n * (`RESERVED_INTERIOR` from `repo/tree/walk.ts`) instead of respelling them, and restating\n * — exactly — the walk's SERVICE branches: (0) a directory named for a\n * service's own interior (`adrs/`, `usecases/`, `ui/`) is classified nowhere,\n * counts as nothing beneath its parent, and hides everything under it, because\n * the walk never descends into one; (1) a directory holding a service\n * artifact is a service, marker present or not (artifacts win); (2) the leaf\n * rule — neither marker nor artifact and nothing beneath (an empty or\n * not-yet-adopted directory, a lone README.md, a lone `.gitkeep` — which is\n * the whole content of a directory `loam seed` creates) is a service too; (3) nothing\n * inside a PLAIN service is classified again (`examples/openapi.yaml` two\n * levels down is interior, the walk stops there), but a service carrying the\n * marker BESIDE its artifacts is still descended — minus artifact-named\n * children like `adrs/` — so the services stranded beneath it stay\n * enumerated, the walk's marker-misplaced branch. Subsystem and unmarked\n * group directories need no restating: a flat file listing descends through\n * them by construction. What is deliberately NOT restated: the walk's\n * findings (`subsystem.marker-misplaced`, `subsystem.unmarked`,\n * `subsystem.name-collision`) — those are validate's live diagnostics; here\n * a name claimed twice suspends the subject (`ambiguous`) instead. If\n * walk.ts's rule ever changes, this module owes the same change;\n * test/diff.test.ts pins the visible agreement (subsystem move, not-adopted\n * leaf, stranded-under-marker).\n *\n * Deliberate consequence of joining by leaf directory name: a service MOVED\n * between subsystems keeps its id and diffs as UNCHANGED. Subsystem placement\n * is navigation, not identity — SCHEMA's own position, and the reason\n * `subsystem move` never touches a join key.\n */\nimport { isUtf8 } from \"node:buffer\";\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport { parseRequirements } from \"../document/parse.js\";\nimport type { Requirement } from \"../document/spec.js\";\nimport { openapiFromText, type Operation } from \"../openapi/doc.js\";\nimport { asyncapiFromText } from \"../asyncapi/read.js\";\nimport type { EventMessage } from \"../asyncapi/model.js\";\nimport { ARTIFACT_FILES, isServiceArtifactName } from \"../repo/paths.js\";\nimport { SUBSYSTEM_MARKER } from \"../repo/tree/marker.js\";\nimport { RESERVED_INTERIOR } from \"../repo/tree/walk.js\";\nimport { listBaseTree, showBaseFile, type ResolvedBase } from \"./base-git.js\";\n\n/**\n * One artifact's state on one side of the diff. `unreadable` is the\n * containment arm: the file exists but could not be read as its kind, so\n * every finding on this axis for this subject is SUSPENDED — \"nobody could\n * look\" must never grade as \"nothing is there\", in either direction.\n */\nexport type AxisState<T> =\n  | { kind: \"absent\" }\n  | { kind: \"read\"; value: T }\n  | { kind: \"unreadable\"; path: string; error: string };\n\n/** The keys of a service state that hold requirement-bearing documents. */\nexport type SpecAxisKey = \"spec\" | \"archSpec\";\n\n/**\n * One service on one side of the diff — the same shape for the base ref and\n * the working tree (`./current-state.ts` builds the other), which is what\n * lets `./semantic.ts` join the two without caring which side came from git.\n */\nexport interface ServiceState {\n  id: string;\n  /** Docs-relative directory with forward slashes, e.g. `services/billing/payment-service`. */\n  dir: string;\n  spec: AxisState<Requirement[]>;\n  /** Read on both sides for the `Consumes:` join — the outbox requirement lives here as often as in spec.md (core/coherence/events/lookups.ts's lesson). */\n  archSpec: AxisState<Requirement[]>;\n  /** Operations with `x-loam-remove` markers filtered out: a marker is bookkeeping, never a callable operation. */\n  openapi: AxisState<Operation[]>;\n  /** Messages with removal markers filtered out, for the same reason. */\n  asyncapi: AxisState<EventMessage[]>;\n}\n\nexport interface BaseFleet {\n  /** By service id, insertion-sorted by id — deterministic output depends on it. */\n  services: Map<string, ServiceState>;\n  /**\n   * Ids claimed by MORE than one base directory. The live walk grades this\n   * `subsystem.name-collision`; here the id's base state is unanswerable, so\n   * the subject is carried with every axis suspended rather than one claimant\n   * silently winning the join.\n   */\n  ambiguous: Map<string, string[]>;\n}\n\nexport type BaseFleetRead =\n  | { kind: \"ok\"; fleet: BaseFleet }\n  | { kind: \"failed\"; detail: string };\n\n/** A classified base service directory and which artifact files the base tree listed in it. */\ninterface BaseDir {\n  id: string;\n  dir: string;\n  files: Set<string>;\n}\n\n/**\n * Classify the base tree's file listing into service directories — the module\n * banner's three restated walk branches, in depth order so every ancestor is\n * decided before anything beneath it.\n */\nfunction classifyBaseDirs(paths: string[]): { dirs: BaseDir[]; ambiguous: Map<string, string[]> } {\n  const fileChildren = new Map<string, Set<string>>();\n  const dirChildren = new Map<string, Set<string>>();\n  // Directories nothing VISIBLE lives in, so neither map above names them.\n  const bare = new Set<string>();\n  for (const path of paths) {\n    const all = path.split(\"/\");\n    // Dot-named entries are invisible to the live walk — but the walk still\n    // SEES the directory holding them, because readdir discovered the\n    // directory itself and only its CONTENTS are filtered (walk.ts's\n    // `subdirNames` and `visitDir`). So cut the path at its first dot-named\n    // segment rather than discarding the whole path: everything above the cut\n    // stays a visible directory, the cut segment and everything beneath it\n    // stay invisible. Discarding it outright hid every directory whose only\n    // file is dot-named — which is exactly what `loam seed` writes into a\n    // service directory it creates (`.gitkeep`, and nothing else), so a seeded\n    // service was absent from the base and diffed as `diff.service-added`\n    // against the unchanged tree that had just been committed.\n    const cut = all.findIndex((s) => s.startsWith(\".\") || s === \"\");\n    const segments = cut === -1 ? all : all.slice(0, cut);\n    // Only a whole path ends in a file; a cut one is a pure directory chain.\n    const fileAt = cut === -1 ? segments.length - 1 : -1;\n    for (let i = 1; i < segments.length; i += 1) {\n      const dir = segments.slice(0, i).join(\"/\");\n      const child = segments[i]!;\n      const into = i === fileAt ? fileChildren : dirChildren;\n      let set = into.get(dir);\n      if (set === undefined) into.set(dir, (set = new Set()));\n      set.add(child);\n    }\n    if (fileAt === -1 && segments.length > 1) bare.add(segments.join(\"/\"));\n  }\n  const hasMarker = (dir: string): boolean => fileChildren.get(dir)?.has(SUBSYSTEM_MARKER) === true;\n  const hasArtifact = (dir: string): boolean =>\n    [...(fileChildren.get(dir) ?? [])].some((f) => isServiceArtifactName(f, \"file\")) ||\n    [...(dirChildren.get(dir) ?? [])].some((d) => isServiceArtifactName(d, \"dir\"));\n  // The walk's `RESERVED_INTERIOR` rule, restated for a flat listing: a\n  // directory named for a service's own interior is never classified, and\n  // neither is anything beneath it, because the walk never descends into one.\n  // Segment 2 onward, matching where the walk applies it — to a directory's\n  // CHILDREN, so a directory literally at `services/usecases/` is still\n  // classified there.\n  const reserved = (dir: string): boolean => dir.split(\"/\").slice(2).some((s) => RESERVED_INTERIOR.has(s));\n  // …and, for the same reason, one of them is not the subdirectory that keeps\n  // its parent off the leaf rule: the walk filters them out of `dirs` before\n  // asking whether anything is beneath.\n  const classifiableChildren = (dir: string): boolean =>\n    [...(dirChildren.get(dir) ?? [])].some((d) => !RESERVED_INTERIOR.has(d));\n  // The walk's leaf rule: neither marker nor artifact and nothing beneath is a\n  // service. (A truly EMPTY directory is unrepresentable in a git tree, so at\n  // the base this arm means \"no visible entry of ours\" — files none of which\n  // are artifacts, or nothing but dot-named entries, the `loam seed` shape.)\n  const isLeafService = (dir: string): boolean =>\n    !hasMarker(dir) && !hasArtifact(dir) && !classifiableChildren(dir);\n  const candidates = [...new Set([...fileChildren.keys(), ...dirChildren.keys(), ...bare])]\n    .filter((dir) => dir !== \"services\" && dir.startsWith(\"services/\") && !reserved(dir))\n    .filter((dir) => hasArtifact(dir) || isLeafService(dir))\n    .sort((a, b) => {\n      const depth = a.split(\"/\").length - b.split(\"/\").length;\n      return depth !== 0 ? depth : a < b ? -1 : 1;\n    });\n  const accepted: BaseDir[] = [];\n  const acceptedDirs = new Set<string>();\n  // Is this candidate INTERIOR to the nearest service already accepted above\n  // it? A plain service swallows everything beneath (the walk stops there); a\n  // marker-beside-artifacts service is descended except through its\n  // artifact-named children (`adrs/`), so a service stranded under it stays.\n  const interior = (segments: string[]): boolean => {\n    for (let i = segments.length - 1; i >= 2; i -= 1) {\n      const ancestor = segments.slice(0, i).join(\"/\");\n      if (!acceptedDirs.has(ancestor)) continue;\n      return hasMarker(ancestor) ? isServiceArtifactName(segments[i]!, \"dir\") : true;\n    }\n    return false;\n  };\n  for (const dir of candidates) {\n    const segments = dir.split(\"/\");\n    if (interior(segments)) continue;\n    acceptedDirs.add(dir);\n    accepted.push({ id: segments[segments.length - 1]!, dir, files: fileChildren.get(dir) ?? new Set() });\n  }\n  return { dirs: accepted, ambiguous: collisions(accepted) };\n}\n\nfunction collisions(dirs: BaseDir[]): Map<string, string[]> {\n  const byId = new Map<string, string[]>();\n  for (const d of dirs) byId.set(d.id, [...(byId.get(d.id) ?? []), d.dir]);\n  return new Map([...byId].filter(([, claimants]) => claimants.length > 1));\n}\n\n/** One shown base file, or `null` for a file the base tree never listed. */\ntype Fetched = { rel: string; read: Awaited<ReturnType<typeof showBaseFile>> } | null;\n\n/**\n * Lift one fetched file into an axis state through its parser. Absence is the\n * listing's answer, a `show` failure is per-subject containment, and only\n * then do the bytes reach a parser.\n */\nfunction axisFrom<T>(raw: Fetched, parse: (path: string, bytes: Buffer) => AxisState<T>): AxisState<T> {\n  if (raw === null) return { kind: \"absent\" };\n  if (raw.read.kind === \"failed\") return { kind: \"unreadable\", path: raw.rel, error: raw.read.detail };\n  return parse(raw.rel, raw.read.bytes);\n}\n\n/**\n * The same refusal `readOpenapi`/`readAsyncapi`/`decodeDocument` make on the\n * living side: non-UTF-8 bytes would be silently rewritten as U+FFFD by\n * `toString`, and a document nobody wrote must not be graded.\n */\nfunction decodeBase(path: string, bytes: Buffer): { text: string } | { unreadable: AxisState<never> } {\n  if (!isUtf8(bytes)) return { unreadable: { kind: \"unreadable\", path, error: \"file is not valid UTF-8\" } };\n  return { text: bytes.toString(\"utf8\") };\n}\n\nfunction specState(path: string, bytes: Buffer): AxisState<Requirement[]> {\n  const decoded = decodeBase(path, bytes);\n  if (\"unreadable\" in decoded) return decoded.unreadable;\n  try {\n    return { kind: \"read\", value: parseRequirements(decoded.text) };\n  } catch (e) {\n    return { kind: \"unreadable\", path, error: e instanceof Error ? e.message : String(e) };\n  }\n}\n\nfunction openapiState(path: string, bytes: Buffer): AxisState<Operation[]> {\n  const decoded = decodeBase(path, bytes);\n  if (\"unreadable\" in decoded) return decoded.unreadable;\n  const doc = openapiFromText(decoded.text);\n  return doc.unreadable\n    ? { kind: \"unreadable\", path, error: doc.error ?? \"not a readable OpenAPI document\" }\n    : { kind: \"read\", value: doc.ops.filter((op) => !op.remove) };\n}\n\nfunction asyncapiState(path: string, bytes: Buffer): AxisState<EventMessage[]> {\n  const decoded = decodeBase(path, bytes);\n  if (\"unreadable\" in decoded) return decoded.unreadable;\n  const doc = asyncapiFromText(decoded.text);\n  return doc.unreadable\n    ? { kind: \"unreadable\", path, error: doc.error ?? \"not a readable AsyncAPI document\" }\n    : { kind: \"read\", value: doc.messages.filter((m) => m.remove !== true) };\n}\n\n/** One base service's four axes. Sequential INSIDE the service on purpose: the pool below rations children at the service grain, and four spawns per in-flight worker would multiply past the cap it exists to hold. */\nasync function readBaseService(base: ResolvedBase, d: BaseDir): Promise<ServiceState> {\n  const fetch = async (file: string): Promise<Fetched> =>\n    d.files.has(file) ? { rel: `${d.dir}/${file}`, read: await showBaseFile(base, `${d.dir}/${file}`) } : null;\n  return {\n    id: d.id,\n    dir: d.dir,\n    spec: axisFrom(await fetch(ARTIFACT_FILES.spec), specState),\n    archSpec: axisFrom(await fetch(ARTIFACT_FILES.archSpec), specState),\n    openapi: axisFrom(await fetch(ARTIFACT_FILES.openapi), openapiState),\n    asyncapi: axisFrom(await fetch(ARTIFACT_FILES.asyncapi), asyncapiState),\n  };\n}\n\n/**\n * The whole base fleet. `failed` only when git cannot LIST the tree — the\n * whole-diff refusal; a single file that cannot be shown or parsed degrades\n * its own subject's axis to `unreadable` and nothing else.\n */\nexport async function readBaseFleet(base: ResolvedBase): Promise<BaseFleetRead> {\n  const listing = await listBaseTree(base);\n  if (listing.kind === \"failed\") return listing;\n  const { dirs, ambiguous } = classifyBaseDirs(listing.paths);\n  const sorted = [...dirs].sort((a, b) => (a.id < b.id ? -1 : 1)).filter((d) => !ambiguous.has(d.id));\n  // Pooled, ordered reads: bounded children in flight, results by input index,\n  // so the same base state always assembles the same fleet.\n  const states = await inOrder(sorted, (d) => readBaseService(base, d));\n  return { kind: \"ok\", fleet: { services: new Map(states.map((s) => [s.id, s])), ambiguous } };\n}\n"]}
+{"version":3,"file":"base-state.js","sourceRoot":"","sources":["../../../src/core/diff/base-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,YAAY,EAAqB,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAkB,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAqB,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAqC,MAAM,uBAAuB,CAAC;AAyBnG;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAe;IACvC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,wEAAwE;QACxE,kEAAkE;QAClE,iEAAiE;QACjE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,2EAA2E;QAC3E,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,yEAAyE;QACzE,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;YACvD,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,GAAG,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC;IAClG,MAAM,WAAW,GAAG,CAAC,GAAW,EAAW,EAAE,CAC3C,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,oBAAoB;IACpB,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,4EAA4E;IAC5E,2EAA2E;IAC3E,sCAAsC;IACtC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAW,EAAE,CACpD,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,aAAa,GAAG,CAAC,GAAW,EAAW,EAAE,CAC7C,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;SACtF,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACpF,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;SACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACxD,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACL,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,2EAA2E;IAC3E,4EAA4E;IAC5E,kEAAkE;IAClE,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,CAAC,QAAkB,EAAW,EAAE;QAC/C,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC1C,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7D,CAAC;AAKD;;;;;;GAMG;AACH,SAAS,QAAQ,CAAI,GAAY,EAAE,KAAoD;IACrF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5C,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrG,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAChG,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC;IAC1G,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC5C,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;IACjF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IACvD,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,UAAU;QACnB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,iCAAiC,EAAE;QACrF,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IACvD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,UAAU;QACnB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,kCAAkC,EAAE;QACtF,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,wNAAwN;AACxN,KAAK,UAAU,eAAe,CAAC,IAAkB,EAAE,CAAU;IAC3D,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE,CACrD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7G,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;QAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;QACnE,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;QACpE,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAkB;IACpD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpG,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC;AAC/F,CAAC","sourcesContent":["/**\n * The base side of `loam diff`: the fleet as the base commit held it, read\n * entirely out of git's object store (`./base-git.ts`) and parsed with the\n * SAME parsers the living files go through — `parseRequirements`,\n * `openapiFromText`, `asyncapiFromText` — so a base document can never read\n * differently from the identical bytes sitting on disk.\n *\n * CLASSIFICATION is a second, simplified spelling of `repo/tree/walk.ts`'s\n * rule, and that is a recorded risk, not an accident: the walk classifies a\n * LIVE filesystem (readdir, symlinks, marker files) and cannot walk a git\n * ref. What keeps the two honest is sharing the artifact-name table\n * (`ARTIFACT_FILES`/`isServiceArtifactName` from `repo/paths.ts`), the\n * marker name (`SUBSYSTEM_MARKER`) and the reserved-interior set\n * (`RESERVED_INTERIOR` from `repo/tree/walk.ts`) instead of respelling them, and restating\n * — exactly — the walk's SERVICE branches: (0) a directory named for a\n * service's own interior (`adrs/`, `usecases/`, `ui/`) is classified nowhere,\n * counts as nothing beneath its parent, and hides everything under it, because\n * the walk never descends into one; (1) a directory holding a service\n * artifact is a service, marker present or not (artifacts win); (2) the leaf\n * rule — neither marker nor artifact and nothing beneath (an empty or\n * not-yet-adopted directory, a lone README.md, a lone `.gitkeep` — which is\n * the whole content of a directory `loam seed` creates) is a service too; (3) nothing\n * inside a PLAIN service is classified again (`examples/openapi.yaml` two\n * levels down is interior, the walk stops there), but a service carrying the\n * marker BESIDE its artifacts is still descended — minus artifact-named\n * children like `adrs/` — so the services stranded beneath it stay\n * enumerated, the walk's marker-misplaced branch. Subsystem and unmarked\n * group directories need no restating: a flat file listing descends through\n * them by construction. What is deliberately NOT restated: the walk's\n * findings (`subsystem.marker-misplaced`, `subsystem.unmarked`,\n * `subsystem.name-collision`) — those are validate's live diagnostics; here\n * a name claimed twice suspends the subject (`ambiguous`) instead. If\n * walk.ts's rule ever changes, this module owes the same change;\n * test/diff.test.ts pins the visible agreement (subsystem move, not-adopted\n * leaf, stranded-under-marker).\n *\n * Deliberate consequence of joining by leaf directory name: a service MOVED\n * between subsystems keeps its id and diffs as UNCHANGED. Subsystem placement\n * is navigation, not identity — SCHEMA's own position, and the reason\n * `subsystem move` never touches a join key.\n */\nimport { isUtf8 } from \"node:buffer\";\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport { rawServiceId, type RawServiceId } from \"../kernel/ids/service.js\";\nimport { decodeDocument } from \"../kernel/document-bytes.js\";\nimport { parseRequirements } from \"../document/parse.js\";\nimport type { Requirement } from \"../document/spec.js\";\nimport { openapiFromText, type Operation } from \"../openapi/doc.js\";\nimport { asyncapiFromText } from \"../asyncapi/read.js\";\nimport type { EventMessage } from \"../asyncapi/model.js\";\nimport { ARTIFACT_FILES, isServiceArtifactName } from \"../repo/paths.js\";\nimport { SUBSYSTEM_MARKER } from \"../repo/tree/marker.js\";\nimport { RESERVED_INTERIOR } from \"../repo/tree/walk.js\";\nimport { listBaseTree, showBaseFile, type ResolvedBase } from \"./base-git.js\";\nimport { bytesDigest, collisions, type AxisState, type ServiceState } from \"../consumers/state.js\";\n\nexport interface BaseFleet {\n  /** By service id, insertion-sorted by id — deterministic output depends on it. */\n  services: Map<string, ServiceState>;\n  /**\n   * Ids claimed by MORE than one base directory. The live walk grades this\n   * `subsystem.name-collision`; here the id's base state is unanswerable, so\n   * the subject is carried with every axis suspended rather than one claimant\n   * silently winning the join.\n   */\n  ambiguous: Map<string, string[]>;\n}\n\nexport type BaseFleetRead =\n  | { kind: \"ok\"; fleet: BaseFleet }\n  | { kind: \"failed\"; detail: string };\n\n/** A classified base service directory and which artifact files the base tree listed in it. */\ninterface BaseDir {\n  id: RawServiceId;\n  dir: string;\n  files: Set<string>;\n}\n\n/**\n * Classify the base tree's file listing into service directories — the module\n * banner's three restated walk branches, in depth order so every ancestor is\n * decided before anything beneath it.\n */\nfunction classifyBaseDirs(paths: string[]): { dirs: BaseDir[]; ambiguous: Map<string, string[]> } {\n  const fileChildren = new Map<string, Set<string>>();\n  const dirChildren = new Map<string, Set<string>>();\n  // Directories nothing VISIBLE lives in, so neither map above names them.\n  const bare = new Set<string>();\n  for (const path of paths) {\n    const all = path.split(\"/\");\n    // Dot-named entries are invisible to the live walk — but the walk still\n    // SEES the directory holding them, because readdir discovered the\n    // directory itself and only its CONTENTS are filtered (walk.ts's\n    // `subdirNames` and `visitDir`). So cut the path at its first dot-named\n    // segment rather than discarding the whole path: everything above the cut\n    // stays a visible directory, the cut segment and everything beneath it\n    // stay invisible. Discarding it outright hid every directory whose only\n    // file is dot-named — which is exactly what `loam seed` writes into a\n    // service directory it creates (`.gitkeep`, and nothing else), so a seeded\n    // service was absent from the base and diffed as `diff.service-added`\n    // against the unchanged tree that had just been committed.\n    const cut = all.findIndex((s) => s.startsWith(\".\") || s === \"\");\n    const segments = cut === -1 ? all : all.slice(0, cut);\n    // Only a whole path ends in a file; a cut one is a pure directory chain.\n    const fileAt = cut === -1 ? segments.length - 1 : -1;\n    for (let i = 1; i < segments.length; i += 1) {\n      const dir = segments.slice(0, i).join(\"/\");\n      const child = segments[i]!;\n      const into = i === fileAt ? fileChildren : dirChildren;\n      let set = into.get(dir);\n      if (set === undefined) into.set(dir, (set = new Set()));\n      set.add(child);\n    }\n    if (fileAt === -1 && segments.length > 1) bare.add(segments.join(\"/\"));\n  }\n  const hasMarker = (dir: string): boolean => fileChildren.get(dir)?.has(SUBSYSTEM_MARKER) === true;\n  const hasArtifact = (dir: string): boolean =>\n    [...(fileChildren.get(dir) ?? [])].some((f) => isServiceArtifactName(f, \"file\")) ||\n    [...(dirChildren.get(dir) ?? [])].some((d) => isServiceArtifactName(d, \"dir\"));\n  // The walk's `RESERVED_INTERIOR` rule, restated for a flat listing: a\n  // directory named for a service's own interior is never classified, and\n  // neither is anything beneath it, because the walk never descends into one.\n  // Segment 2 onward, matching where the walk applies it — to a directory's\n  // CHILDREN, so a directory literally at `services/usecases/` is still\n  // classified there.\n  const reserved = (dir: string): boolean => dir.split(\"/\").slice(2).some((s) => RESERVED_INTERIOR.has(s));\n  // …and, for the same reason, one of them is not the subdirectory that keeps\n  // its parent off the leaf rule: the walk filters them out of `dirs` before\n  // asking whether anything is beneath.\n  const classifiableChildren = (dir: string): boolean =>\n    [...(dirChildren.get(dir) ?? [])].some((d) => !RESERVED_INTERIOR.has(d));\n  // The walk's leaf rule: neither marker nor artifact and nothing beneath is a\n  // service. (A truly EMPTY directory is unrepresentable in a git tree, so at\n  // the base this arm means \"no visible entry of ours\" — files none of which\n  // are artifacts, or nothing but dot-named entries, the `loam seed` shape.)\n  const isLeafService = (dir: string): boolean =>\n    !hasMarker(dir) && !hasArtifact(dir) && !classifiableChildren(dir);\n  const candidates = [...new Set([...fileChildren.keys(), ...dirChildren.keys(), ...bare])]\n    .filter((dir) => dir !== \"services\" && dir.startsWith(\"services/\") && !reserved(dir))\n    .filter((dir) => hasArtifact(dir) || isLeafService(dir))\n    .sort((a, b) => {\n      const depth = a.split(\"/\").length - b.split(\"/\").length;\n      return depth !== 0 ? depth : a < b ? -1 : 1;\n    });\n  const accepted: BaseDir[] = [];\n  const acceptedDirs = new Set<string>();\n  // Is this candidate INTERIOR to the nearest service already accepted above\n  // it? A plain service swallows everything beneath (the walk stops there); a\n  // marker-beside-artifacts service is descended except through its\n  // artifact-named children (`adrs/`), so a service stranded under it stays.\n  const interior = (segments: string[]): boolean => {\n    for (let i = segments.length - 1; i >= 2; i -= 1) {\n      const ancestor = segments.slice(0, i).join(\"/\");\n      if (!acceptedDirs.has(ancestor)) continue;\n      return hasMarker(ancestor) ? isServiceArtifactName(segments[i]!, \"dir\") : true;\n    }\n    return false;\n  };\n  for (const dir of candidates) {\n    const segments = dir.split(\"/\");\n    if (interior(segments)) continue;\n    acceptedDirs.add(dir);\n    accepted.push({ id: rawServiceId(segments[segments.length - 1]!), dir, files: fileChildren.get(dir) ?? new Set() });\n  }\n  return { dirs: accepted, ambiguous: collisions(accepted) };\n}\n\n/** One shown base file, or `null` for a file the base tree never listed. */\ntype Fetched = { rel: string; read: Awaited<ReturnType<typeof showBaseFile>> } | null;\n\n/**\n * Lift one fetched file into an axis state through its parser. Absence is the\n * listing's answer, a `show` failure is per-subject containment, and only\n * then do the bytes reach a parser. A parser's refusal carries the hash of\n * the bytes it refused (`AxisState`'s `bytes`); a `show` failure has none to\n * hash.\n */\nfunction axisFrom<T>(raw: Fetched, parse: (path: string, bytes: Buffer) => AxisState<T>): AxisState<T> {\n  if (raw === null) return { kind: \"absent\" };\n  if (raw.read.kind === \"failed\") return { kind: \"unreadable\", path: raw.rel, error: raw.read.detail };\n  const state = parse(raw.rel, raw.read.bytes);\n  return state.kind === \"unreadable\" ? { ...state, bytes: bytesDigest(raw.read.bytes) } : state;\n}\n\n/**\n * The same refusal `readOpenapi`/`readAsyncapi` make on the living side for a\n * CONTRACT: non-UTF-8 bytes would be silently rewritten as U+FFFD by\n * `toString`, and a document nobody wrote must not be graded. Contracts only:\n * the spec axis decodes through `decodeDocument` instead (`specState`), because\n * that is what its living side does, and each axis must refuse at the base\n * exactly the bytes its living reader refuses.\n */\nfunction decodeBase(path: string, bytes: Buffer): { text: string } | { unreadable: AxisState<never> } {\n  if (!isUtf8(bytes)) return { unreadable: { kind: \"unreadable\", path, error: \"file is not valid UTF-8\" } };\n  return { text: bytes.toString(\"utf8\") };\n}\n\n/**\n * A spec-axis file decodes through `decodeDocument` — the rule the living side\n * applies to the same file (`FleetContext.readText`) — not through\n * `decodeBase`'s `isUtf8`-only test. The difference is the NUL test: UTF-16LE\n * of ASCII saved WITHOUT a byte-order mark is a valid UTF-8 sequence, so\n * `isUtf8` alone let it through here and it parsed as zero requirements while\n * the working tree refused the identical bytes. The base then read as a\n * readable EMPTY spec: an untouched file diffed as one-sided containment, and\n * a branch that re-saved it as UTF-8 reported every requirement in it as\n * added. `decodeDocument`'s `NotUtf8DocumentError` lands in the catch below\n * and becomes the unreadable arm like any parse failure.\n */\nfunction specState(path: string, bytes: Buffer): AxisState<Requirement[]> {\n  try {\n    return { kind: \"read\", value: parseRequirements(decodeDocument(bytes, path)) };\n  } catch (e) {\n    return { kind: \"unreadable\", path, error: e instanceof Error ? e.message : String(e) };\n  }\n}\n\nfunction openapiState(path: string, bytes: Buffer): AxisState<Operation[]> {\n  const decoded = decodeBase(path, bytes);\n  if (\"unreadable\" in decoded) return decoded.unreadable;\n  const doc = openapiFromText(decoded.text);\n  return doc.unreadable\n    ? { kind: \"unreadable\", path, error: doc.error ?? \"not a readable OpenAPI document\" }\n    : { kind: \"read\", value: doc.ops.filter((op) => !op.remove) };\n}\n\nfunction asyncapiState(path: string, bytes: Buffer): AxisState<EventMessage[]> {\n  const decoded = decodeBase(path, bytes);\n  if (\"unreadable\" in decoded) return decoded.unreadable;\n  const doc = asyncapiFromText(decoded.text);\n  return doc.unreadable\n    ? { kind: \"unreadable\", path, error: doc.error ?? \"not a readable AsyncAPI document\" }\n    : { kind: \"read\", value: doc.messages.filter((m) => m.remove !== true) };\n}\n\n/** One base service's four axes. Sequential INSIDE the service on purpose: the pool below rations children at the service grain, and four spawns per in-flight worker would multiply past the cap it exists to hold. */\nasync function readBaseService(base: ResolvedBase, d: BaseDir): Promise<ServiceState> {\n  const fetch = async (file: string): Promise<Fetched> =>\n    d.files.has(file) ? { rel: `${d.dir}/${file}`, read: await showBaseFile(base, `${d.dir}/${file}`) } : null;\n  return {\n    id: d.id,\n    dir: d.dir,\n    spec: axisFrom(await fetch(ARTIFACT_FILES.spec), specState),\n    archSpec: axisFrom(await fetch(ARTIFACT_FILES.archSpec), specState),\n    openapi: axisFrom(await fetch(ARTIFACT_FILES.openapi), openapiState),\n    asyncapi: axisFrom(await fetch(ARTIFACT_FILES.asyncapi), asyncapiState),\n  };\n}\n\n/**\n * The whole base fleet. `failed` only when git cannot LIST the tree — the\n * whole-diff refusal; a single file that cannot be shown or parsed degrades\n * its own subject's axis to `unreadable` and nothing else.\n */\nexport async function readBaseFleet(base: ResolvedBase): Promise<BaseFleetRead> {\n  const listing = await listBaseTree(base);\n  if (listing.kind === \"failed\") return listing;\n  const { dirs, ambiguous } = classifyBaseDirs(listing.paths);\n  const sorted = [...dirs].sort((a, b) => (a.id < b.id ? -1 : 1)).filter((d) => !ambiguous.has(d.id));\n  // Pooled, ordered reads: bounded children in flight, results by input index,\n  // so the same base state always assembles the same fleet.\n  const states = await inOrder(sorted, (d) => readBaseService(base, d));\n  return { kind: \"ok\", fleet: { services: new Map(states.map((s) => [s.id, s])), ambiguous } };\n}\n"]}