@ybotok/loam 0.2.0-alpha.6 → 0.2.0-alpha.9

package/dist/core/usecases/suites/participants.js

@@ -0,0 +1,83 @@
+import { ancestorIds } from "../../kernel/ids/fqn/ancestors.js";
+import { compareIds } from "../../repo/entries.js";
+import { EXTERNAL_TAG } from "../../vocabulary/maturity.js";
+/**
+ * Every endpoint the views' steps draw, resolved through the scan's ONE
+ * element→service resolver — the resolver `attributeStep` grades the same hops
+ * with, built over the same enumerated fleet (`readUseCases`). A second
+ * resolver here could not disagree today and would be a second place to change.
+ *
+ * AN ENDPOINT THAT RESOLVES TO NO ENUMERATED SERVICE IS REPORTED, NEVER DROPPED.
+ * This answer is what a test environment is provisioned from, and a silently
+ * shorter list is the one failure that cannot be seen from the list itself: the
+ * stand comes up, the missing participant is simply absent, and the journey
+ * fails against something nobody was told to start. The actor who begins a
+ * flow, a topic in the middle, a partner's API — each is named here, so the
+ * reader decides whether it needs a double, a fixture or a directory. The
+ * caller that only wants seeds (`servicesInFlowsClaiming`) reads `services` and
+ * ignores the rest, which is a choice it can see itself making.
+ *
+ * Sorted with compareIds rather than in step order: a union has no document
+ * order to preserve, and a payload ordered by LikeC4's record order would
+ * reorder under a dependency bump.
+ */
+export function participantsOf(scan, views) {
+    const known = scan.model.known;
+    const services = new Set();
+    const unresolved = new Set();
+    for (const view of views) {
+        for (const step of view.steps) {
+            for (const id of [step.source, step.target]) {
+                const service = scan.resolve(id);
+                if (known.has(service))
+                    services.add(service);
+                else
+                    unresolved.add(id);
+            }
+        }
+    }
+    const byId = new Map(scan.model.elements.map((e) => [e.id, e]));
+    return {
+        services: [...services].sort(compareIds),
+        unresolved: [...unresolved].sort(compareIds).map((element) => ({ element, external: isExternal(element, byId, known) })),
+    };
+}
+/**
+ * `#external` on the element or on anything it is drawn inside — up to, and
+ * including, the first element that stands for a service.
+ *
+ * The walk is `core/gate/partners.ts`' reading of the same tag (`endFacts`),
+ * stop included, so `list suites` and the gate cannot disagree about whether
+ * an endpoint is ours. Walking up is what is true for a stand: `stripe.api`
+ * drawn inside an `#external` `stripe` is somebody else's endpoint whether or
+ * not the container repeats the tag, and LikeC4 does not inherit tags
+ * downward, so reading the element's own tags alone would print "ours, with no
+ * directory" over a partner's API. Stopping is just as true: an element bound
+ * with `metadata { service '<id>' }`, or titled for a real `services/<id>/`,
+ * IS a service, and what sits above it is a grouping whose `#external` is the
+ * grouping's claim, not the service's. Without the stop a service bound inside
+ * an `#external` zone and not yet given a directory was printed as "bring a
+ * double" while the gate graded it as ours. The tag on that element itself is
+ * read before the stop, as the gate reads it.
+ *
+ * "Stands for a service" is `commands/validate/fleet/census.ts`'
+ * `standsForService`, spelled here rather than imported because core may not
+ * reach into commands — as `core/gate/partners.ts` and `core/verify/checklist.ts`
+ * spell it.
+ *
+ * A tag a KIND declares (`element topic { #external }`) arrives on every element
+ * of that kind in the parsed model, so a topic counts without repeating it.
+ */
+function isExternal(element, byId, known) {
+    for (const id of ancestorIds(element)) {
+        const e = byId.get(id);
+        if (e === undefined)
+            continue;
+        if (e.tags.includes(EXTERNAL_TAG))
+            return true;
+        if (e.service !== undefined || known.has(e.title))
+            return false;
+    }
+    return false;
+}
+//# sourceMappingURL=participants.js.map

package/dist/core/usecases/suites/participants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"participants.js","sourceRoot":"","sources":["../../../../src/core/usecases/suites/participants.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AA2B5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAc,EAAE,KAA4B;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;;oBACzC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO;QACL,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;KACzH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,IAA+B,EAAE,KAA0B;IAC9F,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * Who takes part in a set of use cases — the union a test environment is built\n * from, and the participants that union cannot place.\n *\n * It began as `servicesInFlowsClaiming` in `../capability.ts`, which answered\n * the same question for the flows claiming one capability and kept only the\n * half `loam explore` needed: the enumerated services. A suite asks it of a\n * different set of views — the ones carrying one `#suite-` tag — and needs the\n * other half too, so the walk moved here and grew a second output rather than\n * being written twice. Two walks over \"which services does this flow touch\"\n * would be two answers to the question a test stand is provisioned from.\n *\n * THE DEPENDENCY RUNS PARENT → CHILD, never back. `../capability.ts` and\n * `../fleet.ts` (which takes the suite prefix from `./suites.ts`) import this\n * package, so nothing here may value-import `core/usecases/` — the package\n * graph would close a cycle `import/no-cycle` cannot see (docs/DESIGN.md rule\n * 21). `UseCaseScan` crosses as a TYPE only, which erases.\n */\nimport type { Elem } from \"../../c4/likec4.js\";\nimport type { ParsedView } from \"../../c4/parsed/dynamic-views.js\";\nimport { ancestorIds } from \"../../kernel/ids/fqn/ancestors.js\";\nimport { compareIds } from \"../../repo/entries.js\";\nimport { EXTERNAL_TAG } from \"../../vocabulary/maturity.js\";\nimport type { UseCaseScan } from \"../fleet.js\";\n\n/** A scan that read — the only kind with elements to resolve against. */\nexport type ReadScan = Extract<UseCaseScan, { kind: \"read\" }>;\n\n/** A participant the element→service join could not land on an enumerated service. */\nexport interface UnresolvedParticipant {\n  /** The element id a step drew, exactly as the view spells it. */\n  element: string;\n  /**\n   * Does the element, or anything it is drawn inside short of a service, carry\n   * `#external`? Then it is deliberately not the fleet's, and a stand needs a\n   * double for it rather than a directory. See `isExternal` for why an\n   * ancestor's tag counts and why the walk stops at a service.\n   */\n  external: boolean;\n}\n\n/** The union of a set of views' participants, split by whether the fleet can stand each one up. */\nexport interface Participants {\n  /** Enumerated service ids, sorted and deduplicated. */\n  services: string[];\n  /** Everything else the steps drew, one entry per element id, sorted by it. */\n  unresolved: UnresolvedParticipant[];\n}\n\n/**\n * Every endpoint the views' steps draw, resolved through the scan's ONE\n * element→service resolver — the resolver `attributeStep` grades the same hops\n * with, built over the same enumerated fleet (`readUseCases`). A second\n * resolver here could not disagree today and would be a second place to change.\n *\n * AN ENDPOINT THAT RESOLVES TO NO ENUMERATED SERVICE IS REPORTED, NEVER DROPPED.\n * This answer is what a test environment is provisioned from, and a silently\n * shorter list is the one failure that cannot be seen from the list itself: the\n * stand comes up, the missing participant is simply absent, and the journey\n * fails against something nobody was told to start. The actor who begins a\n * flow, a topic in the middle, a partner's API — each is named here, so the\n * reader decides whether it needs a double, a fixture or a directory. The\n * caller that only wants seeds (`servicesInFlowsClaiming`) reads `services` and\n * ignores the rest, which is a choice it can see itself making.\n *\n * Sorted with compareIds rather than in step order: a union has no document\n * order to preserve, and a payload ordered by LikeC4's record order would\n * reorder under a dependency bump.\n */\nexport function participantsOf(scan: ReadScan, views: readonly ParsedView[]): Participants {\n  const known = scan.model.known;\n  const services = new Set<string>();\n  const unresolved = new Set<string>();\n  for (const view of views) {\n    for (const step of view.steps) {\n      for (const id of [step.source, step.target]) {\n        const service = scan.resolve(id);\n        if (known.has(service)) services.add(service);\n        else unresolved.add(id);\n      }\n    }\n  }\n  const byId = new Map(scan.model.elements.map((e) => [e.id, e]));\n  return {\n    services: [...services].sort(compareIds),\n    unresolved: [...unresolved].sort(compareIds).map((element) => ({ element, external: isExternal(element, byId, known) })),\n  };\n}\n\n/**\n * `#external` on the element or on anything it is drawn inside — up to, and\n * including, the first element that stands for a service.\n *\n * The walk is `core/gate/partners.ts`' reading of the same tag (`endFacts`),\n * stop included, so `list suites` and the gate cannot disagree about whether\n * an endpoint is ours. Walking up is what is true for a stand: `stripe.api`\n * drawn inside an `#external` `stripe` is somebody else's endpoint whether or\n * not the container repeats the tag, and LikeC4 does not inherit tags\n * downward, so reading the element's own tags alone would print \"ours, with no\n * directory\" over a partner's API. Stopping is just as true: an element bound\n * with `metadata { service '<id>' }`, or titled for a real `services/<id>/`,\n * IS a service, and what sits above it is a grouping whose `#external` is the\n * grouping's claim, not the service's. Without the stop a service bound inside\n * an `#external` zone and not yet given a directory was printed as \"bring a\n * double\" while the gate graded it as ours. The tag on that element itself is\n * read before the stop, as the gate reads it.\n *\n * \"Stands for a service\" is `commands/validate/fleet/census.ts`'\n * `standsForService`, spelled here rather than imported because core may not\n * reach into commands — as `core/gate/partners.ts` and `core/verify/checklist.ts`\n * spell it.\n *\n * A tag a KIND declares (`element topic { #external }`) arrives on every element\n * of that kind in the parsed model, so a topic counts without repeating it.\n */\nfunction isExternal(element: string, byId: ReadonlyMap<string, Elem>, known: ReadonlySet<string>): boolean {\n  for (const id of ancestorIds(element)) {\n    const e = byId.get(id);\n    if (e === undefined) continue;\n    if (e.tags.includes(EXTERNAL_TAG)) return true;\n    if (e.service !== undefined || known.has(e.title)) return false;\n  }\n  return false;\n}\n"]}

package/dist/core/usecases/suites/suites.js

@@ -0,0 +1,45 @@
+import { compareIds } from "../../repo/entries.js";
+import { participantsOf } from "./participants.js";
+/**
+ * The reserved tag prefix, matched EXACTLY — case included — as `cap-` and
+ * `req-` are. Exported for `../fleet.ts`, where it joins the other two in the
+ * one opt-in predicate and the one byte gate in front of it.
+ */
+export const SUITE_TAG_PREFIX = "suite-";
+/**
+ * The suite names one view declares: the tags with the prefix stripped,
+ * deduplicated and sorted.
+ *
+ * A bare `#suite-` is a suite named `''` and is KEPT, for the reason a bare
+ * `#cap-` stays a claim: the prefix is the opt-in however little follows it,
+ * and a view that asked to be in a suite must not silently be in none.
+ */
+function suiteNames(view) {
+    const names = view.tags.filter((tag) => tag.startsWith(SUITE_TAG_PREFIX)).map((tag) => tag.slice(SUITE_TAG_PREFIX.length));
+    return [...new Set(names)].sort(compareIds);
+}
+/**
+ * Group the scan's use cases by suite.
+ *
+ * The order is by (document, view id). `../place.ts`' `viewFile` is how a
+ * document is SPELLED, and it only prefixes `sourcePath` with a constant, so
+ * ordering on `sourcePath` itself orders identically without pointing this
+ * package back at its parent.
+ */
+export function suiteListing(scan) {
+    const ordered = [...scan.views].sort((a, b) => compareIds(a.sourcePath ?? "", b.sourcePath ?? "") || compareIds(a.id, b.id));
+    const byName = new Map();
+    const ungrouped = [];
+    for (const view of ordered) {
+        const names = suiteNames(view);
+        if (names.length === 0)
+            ungrouped.push(view);
+        for (const name of names)
+            byName.set(name, [...(byName.get(name) ?? []), view]);
+    }
+    const suites = [...byName]
+        .sort(([a], [b]) => compareIds(a, b))
+        .map(([name, views]) => ({ name, views, ...participantsOf(scan, views) }));
+    return { suites, ungrouped };
+}
+//# sourceMappingURL=suites.js.map

package/dist/core/usecases/suites/suites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suites.js","sourceRoot":"","sources":["../../../../src/core/usecases/suites/suites.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,cAAc,EAA6C,MAAM,mBAAmB,CAAC;AAE9F;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAEzC;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAiC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3H,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC;AA6BD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CACvF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC;SACvB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * Suites: which use cases run together, and what a run of one needs standing up.\n *\n * A use case joins a suite by carrying a `#suite-<name>` tag on its `dynamic\n * view`. A TAG rather than a directory, because suites are many-to-many — one\n * journey belongs to the smoke suite and the payments suite at once — and a\n * directory gives exactly one group. The tag also buys the typo check for free:\n * LikeC4 refuses an undeclared tag, so a suite declared once in the landscape's\n * `specification` block makes a mistyped suite a parse error, where a mistyped\n * directory would silently open a second, empty suite.\n *\n * A SEPARATE PREFIX, not `#cap-`. A capability says what a flow is FOR and may\n * be claimed once per meaning; a suite says what a flow is RUN WITH, and a\n * flow is routinely in several. Reusing the capability tag would make every\n * suite a business promise and every smoke run a capability, and the `#cap-`\n * resolution ladder (`../../capabilities/usecase-join.ts`) would convict every\n * suite name the vocabulary does not declare. The prefix also keeps the tag\n * clear of the feature-id grammar: a view tag is never read as a `#FEAT-`\n * marker (feature tags are read off elements and relationships only), and no\n * other reserved prefix — `cap-`, `req-`, `obl-` — is a prefix of this one or\n * has it as a prefix, so no tag can be claimed by two readers.\n *\n * TAGGING IS THE OPT-IN, and that is the owner's call recorded in SCHEMA.md: a\n * view carrying only `#suite-` tags IS a use case — `../fleet.ts`' `isUseCase`\n * admits it — and is graded hop by hop like any other. Nothing here grades; this\n * module groups the views the scan already admitted.\n *\n * Depends on its parent by TYPE only — `./participants.ts` says why the value\n * direction is parent → child.\n */\nimport type { ParsedView } from \"../../c4/parsed/dynamic-views.js\";\nimport { compareIds } from \"../../repo/entries.js\";\nimport { participantsOf, type ReadScan, type UnresolvedParticipant } from \"./participants.js\";\n\n/**\n * The reserved tag prefix, matched EXACTLY — case included — as `cap-` and\n * `req-` are. Exported for `../fleet.ts`, where it joins the other two in the\n * one opt-in predicate and the one byte gate in front of it.\n */\nexport const SUITE_TAG_PREFIX = \"suite-\";\n\n/**\n * The suite names one view declares: the tags with the prefix stripped,\n * deduplicated and sorted.\n *\n * A bare `#suite-` is a suite named `''` and is KEPT, for the reason a bare\n * `#cap-` stays a claim: the prefix is the opt-in however little follows it,\n * and a view that asked to be in a suite must not silently be in none.\n */\nfunction suiteNames(view: { tags: readonly string[] }): string[] {\n  const names = view.tags.filter((tag) => tag.startsWith(SUITE_TAG_PREFIX)).map((tag) => tag.slice(SUITE_TAG_PREFIX.length));\n  return [...new Set(names)].sort(compareIds);\n}\n\n/** One suite: its name, its use cases, and the environment their union needs. */\nexport interface Suite {\n  /** The tag without `#suite-` — what `loam list suites <name>` takes. */\n  name: string;\n  /** The use cases carrying the tag, ordered by (document, view id). */\n  views: ParsedView[];\n  /** The enumerated services those use cases draw — what must be up. */\n  services: string[];\n  /** Participants that resolve to no enumerated service — named, never dropped. */\n  unresolved: UnresolvedParticipant[];\n}\n\n/** Every suite the fleet's use cases declare, and the use cases in none. */\nexport interface SuiteListing {\n  /** Sorted by name. */\n  suites: Suite[];\n  /**\n   * The use cases carrying no `#suite-` tag, ordered by (document, view id).\n   *\n   * Answered because everything else here is per-suite: a journey in no suite\n   * is absent from every suite's list, which is the one absence a per-suite\n   * output cannot show. Legal and normal — an unfiled service is the same shape\n   * — so it is named and never graded.\n   */\n  ungrouped: ParsedView[];\n}\n\n/**\n * Group the scan's use cases by suite.\n *\n * The order is by (document, view id). `../place.ts`' `viewFile` is how a\n * document is SPELLED, and it only prefixes `sourcePath` with a constant, so\n * ordering on `sourcePath` itself orders identically without pointing this\n * package back at its parent.\n */\nexport function suiteListing(scan: ReadScan): SuiteListing {\n  const ordered = [...scan.views].sort(\n    (a, b) => compareIds(a.sourcePath ?? \"\", b.sourcePath ?? \"\") || compareIds(a.id, b.id),\n  );\n  const byName = new Map<string, ParsedView[]>();\n  const ungrouped: ParsedView[] = [];\n  for (const view of ordered) {\n    const names = suiteNames(view);\n    if (names.length === 0) ungrouped.push(view);\n    for (const name of names) byName.set(name, [...(byName.get(name) ?? []), view]);\n  }\n  const suites = [...byName]\n    .sort(([a], [b]) => compareIds(a, b))\n    .map(([name, views]) => ({ name, views, ...participantsOf(scan, views) }));\n  return { suites, ungrouped };\n}\n"]}

package/dist/core/verify/answers.js

@@ -36,6 +36,17 @@ export const VERDICTS = ["confirmed", "unconfirmed"];
  * `attestedClaims` in `./record.ts` — exactly where it was.
  */
 export const ANSWERED_BY = ["runner", "external-runner", "agent"];
+/**
+ * The entries an answers file holds — a bare array, or an object with an
+ * `answers` array — or null for any other shape. One reading of the file's
+ * shape for `checkAnswers` and `--diff-answers`' off-lens note, so the two
+ * cannot disagree about which entries a file has.
+ */
+export function answerEntries(raw) {
+    if (Array.isArray(raw))
+        return raw;
+    return isRecord(raw) && Array.isArray(raw["answers"]) ? raw["answers"] : null;
+}
 /**
  * Accept an answer set only if it answers THIS checklist: every claim once, no
  * claim twice, nothing extra, and no "confirmed" that shows nothing.
@@ -66,11 +77,7 @@ export const ANSWERED_BY = ["runner", "external-runner", "agent"];
  */
 export function checkAnswers(claims, raw, runnerOwned, context) {
     const refuse = (code, message) => ({ ok: false, code, message });
-    const list = Array.isArray(raw)
-        ? raw
-        : isRecord(raw) && Array.isArray(raw["answers"])
-            ? raw["answers"]
-            : null;
+    const list = answerEntries(raw);
     if (list === null) {
         return refuse("answers-unreadable", "Expected a JSON array of answers, or an object with an `answers` array: " +
             `[{ "id": "...", "verdict": "confirmed", "evidence": ["file:line"] }]`);

package/dist/core/verify/answers.js.map

@@ -1 +1 @@
-{"version":3,"file":"answers.js","sourceRoot":"","sources":["../../../src/core/verify/answers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAc,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAoB,MAAM,eAAe,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,aAAa,CAAU,CAAC;AAG9D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAU,CAAC;AA4B3E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAe,EACf,GAAY,EACZ,WAAiC,EACjC,OAA+C;IAE/C,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,OAAe,EAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAErG,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC7B,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC,CAAE,GAAG,CAAC,SAAS,CAAe;YAC/B,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,MAAM,CACX,oBAAoB,EACpB,0EAA0E;YACxE,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,oBAAoB,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,oBAAoB,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAE,QAA8B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACtF,OAAO,MAAM,CACX,oBAAoB,EACpB,GAAG,KAAK,MAAM,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,sBAAsB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC;YACX,EAAE;YACF,OAAO,EAAE,OAAkB;YAC3B,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;;YAChC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG;YACZ,SAAS,CAAC,MAAM,GAAG,CAAC;gBAClB,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,iFAAiF,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gEAAgE;gBAC1L,CAAC,CAAC,EAAE;YACN,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,yDAAyD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YACxH,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YAC5F,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,sCAAsC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;SAC9G,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,MAAM,CACX,kBAAkB,EAClB,8CAA8C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChE,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CACX,qBAAqB,EACrB,GAAG,WAAW,CAAC,MAAM,6CAA6C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,sGAAsG,CAC/L,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,0DAA0D;IAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,OAAgB,EAChB,QAAiB,EACjB,OAA+C;IAE/C,MAAM,OAAO,GAAG,sDAAsD,CAAC;IACvE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3F,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,+CAA+C;IAC/C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACvD,MAAM,IAAI,GAAG,iBAAiB,OAAO,CAAC,OAAO,0CAA0C,CAAC;IACxF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAC7B,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,4DAA4D,IAAI,KAAK;YACjH,sEAAsE;QAC1E,CAAC,CAAC,0DAA0D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,IAAI,MAAM;YAC7H,OAAO,IAAI,yCAAyC,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["/**\n * The answers, and the one thing loam checks about them.\n *\n * loam does not judge an answer. It cannot: it never read the code. What it\n * guarantees is that every question was asked and that every answer sits next\n * to the question it answers — so an answer set that does not correspond to the\n * current checklist is refused rather than merged. An unchecked claim must\n * never be able to masquerade as checked, and that refusal is `checkAnswers`.\n *\n * A scenario claim is answered mechanically wherever it can be: `--results`\n * reads a cucumber JSON report and matches it by the digest tag `loam gherkin`\n * stamped, and only a green run confirms one (`core/results.ts`). Where it\n * cannot — a legacy service whose suite is months away, which is the fleet loam\n * exists for — `--record` may still take an agent's word for it, and\n * `./record.ts` marks that answer attested rather than run.\n */\nimport { isRecord } from \"../kernel/records.js\";\nimport { type Claim } from \"./checklist.js\";\nimport { type EvidencePin } from \"./pins/pin.js\";\n\n/**\n * Two verdicts, deliberately. Anything an agent cannot show evidence for is\n * unconfirmed — a third value for \"not applicable\" would absorb every claim\n * nobody wanted to answer.\n */\nexport const VERDICTS = [\"confirmed\", \"unconfirmed\"] as const;\nexport type Verdict = (typeof VERDICTS)[number];\n\n/**\n * Who answered a claim: the `runner` (a cucumber report's digest-tagged\n * scenarios, matched mechanically by `--results`), the `external-runner` (an\n * API contract-test report's operationId-matched entries, matched mechanically\n * by `--contract-results` — external because loam did not generate the suite\n * the way it generates the gherkin, so the join key is the operationId the\n * claim asserts rather than a digest loam stamped), or an `agent` (somebody's\n * word about the code, taken back by `--record`). On the record so a reviewer\n * can tell a green run from an assertion. `external-runner` never answers a\n * `scenario.tested` claim, which is what keeps the attested boundary —\n * `attestedClaims` in `./record.ts` — exactly where it was.\n */\nexport const ANSWERED_BY = [\"runner\", \"external-runner\", \"agent\"] as const;\nexport type AnsweredBy = (typeof ANSWERED_BY)[number];\n\nexport interface Answer {\n  id: string;\n  verdict: Verdict;\n  /** Where it can be seen — `file:line`, or a report scenario for the runner. Required for `confirmed`. */\n  evidence: string[];\n  note?: string;\n  answered_by: AnsweredBy;\n  /**\n   * loam's own stamp, never caller input: `validateServiceEvidence` computes\n   * these from the attested commit's blobs and the record path attaches them.\n   * `checkAnswers` below deliberately never reads the field, so an\n   * `evidence_pins` key in an answers FILE is ignored, not honored — an agent\n   * must not be able to hand loam a pin loam did not derive.\n   */\n  evidence_pins?: EvidencePin[];\n}\n\n/** Why an answer set was refused. Each names a different way it fails to answer. */\nexport type AnswerRefusal = \"answers-unreadable\" | \"answers-mismatch\" | \"answers-unevidenced\";\n\nexport type AnswerCheck =\n  /** The answers, re-ordered to the checklist, one per claim. */\n  | { ok: true; answers: Answer[] }\n  | { ok: false; code: AnswerRefusal; message: string };\n\n/**\n * Accept an answer set only if it answers THIS checklist: every claim once, no\n * claim twice, nothing extra, and no \"confirmed\" that shows nothing.\n *\n * The refusals are the point of the command. If a stale or partial answer file\n * could be recorded, `verification.yaml` would say a claim was checked when\n * nobody ever asked it — and a record that can lie is worse than no record,\n * because it looks like evidence.\n *\n * `runnerOwned` is the composition rule under `--results` and\n * `--contract-results`: ids a mechanical report answers — scenario claims under\n * the first flag, api.exposes claims under the second — which an answers file\n * must therefore not touch. An entry naming one refuses with its own diagnosis\n * — the id IS on the feature's checklist, so calling it unknown would send the\n * caller hunting a staleness that is not there. `--diff-answers`\n * (commands/verify/cross/diff.ts) calls this with it UNSET on purpose: under a\n * diff both agents answer everything in scope, scenario claims included,\n * because the diff consults no report — so making scenario claims runner-only\n * even without `--results` would break that lens.\n *\n * `context` is what turns the last line from a circle into an instruction. In a\n * fleet the commonest way to \"miss\" a claim is that it is not yours: the\n * checklist spans ten repositories and this one can only answer its own. Told\n * only to \"answer the claims it lists\", an agent in the payment-service repo\n * re-runs verify, sees the same checkout-web claims it cannot speak for, and\n * either loops or invents evidence. So when every unanswered claim belongs to\n * another service, say THAT, and name the command that records them.\n */\nexport function checkAnswers(\n  claims: Claim[],\n  raw: unknown,\n  runnerOwned?: ReadonlySet<string>,\n  context?: { feature: string; service?: string },\n): AnswerCheck {\n  const refuse = (code: AnswerRefusal, message: string): AnswerCheck => ({ ok: false, code, message });\n\n  const list = Array.isArray(raw)\n    ? raw\n    : isRecord(raw) && Array.isArray(raw[\"answers\"])\n      ? (raw[\"answers\"] as unknown[])\n      : null;\n  if (list === null) {\n    return refuse(\n      \"answers-unreadable\",\n      \"Expected a JSON array of answers, or an object with an `answers` array: \" +\n        `[{ \"id\": \"...\", \"verdict\": \"confirmed\", \"evidence\": [\"file:line\"] }]`,\n    );\n  }\n\n  const answers: Answer[] = [];\n  for (const [i, entry] of list.entries()) {\n    const where = `answer ${i + 1}`;\n    if (!isRecord(entry)) return refuse(\"answers-unreadable\", `${where} is not an object`);\n    const id = entry[\"id\"];\n    if (typeof id !== \"string\" || id.length === 0) {\n      return refuse(\"answers-unreadable\", `${where} has no claim id`);\n    }\n    const verdict = entry[\"verdict\"];\n    if (typeof verdict !== \"string\" || !(VERDICTS as readonly string[]).includes(verdict)) {\n      return refuse(\n        \"answers-unreadable\",\n        `${where} ('${id}') has verdict ${JSON.stringify(verdict)} — expected one of ${VERDICTS.join(\", \")}`,\n      );\n    }\n    const note = typeof entry[\"note\"] === \"string\" ? entry[\"note\"].trim() : \"\";\n    answers.push({\n      id,\n      verdict: verdict as Verdict,\n      evidence: stringList(entry[\"evidence\"]),\n      ...(note.length > 0 ? { note } : {}),\n      answered_by: \"agent\",\n    });\n  }\n\n  const byId = new Map<string, Answer>();\n  const twice: string[] = [];\n  for (const a of answers) {\n    if (byId.has(a.id)) twice.push(a.id);\n    else byId.set(a.id, a);\n  }\n  const known = new Set(claims.map((c) => c.id));\n  const strayIds = [...new Set(answers.map((a) => a.id).filter((id) => !known.has(id)))];\n  const runnerHit = strayIds.filter((id) => runnerOwned?.has(id) === true);\n  const unknown = strayIds.filter((id) => runnerOwned?.has(id) !== true);\n  const missingClaims = claims.filter((c) => !byId.has(c.id));\n  const missing = missingClaims.map((c) => c.id);\n  if (runnerHit.length + unknown.length + missing.length + twice.length > 0) {\n    const parts = [\n      runnerHit.length > 0\n        ? `${runnerHit.length} answer(s) name claim(s) a report owns under --results or --contract-results: ${runnerHit.join(\", \")} — the report answers those; take them out of the answers file`\n        : \"\",\n      unknown.length > 0 ? `${unknown.length} answer(s) name a claim that is not on the checklist: ${unknown.join(\", \")}` : \"\",\n      missing.length > 0 ? `${missing.length} claim(s) have no answer: ${missing.join(\", \")}` : \"\",\n      twice.length > 0 ? `${twice.length} claim(s) answered more than once: ${[...new Set(twice)].join(\", \")}` : \"\",\n    ].filter((s) => s.length > 0);\n    return refuse(\n      \"answers-mismatch\",\n      `These answers do not match the checklist — ${parts.join(\"; \")}. ` +\n        missingAdvice(missingClaims, claims.filter((c) => byId.has(c.id)), context),\n    );\n  }\n\n  const unevidenced = claims\n    .map((c) => byId.get(c.id)!)\n    .filter((a) => a.verdict === \"confirmed\" && a.evidence.length === 0)\n    .map((a) => a.id);\n  if (unevidenced.length > 0) {\n    return refuse(\n      \"answers-unevidenced\",\n      `${unevidenced.length} claim(s) are confirmed with no evidence: ${unevidenced.join(\", \")}. A confirmation with nothing behind it is an assertion — give a file:line, or answer 'unconfirmed'.`,\n    );\n  }\n\n  // Checklist order, not the order they were written in: the record reads in the\n  // order the questions were asked, whatever the agent did.\n  return { ok: true, answers: claims.map((c) => byId.get(c.id)!) };\n}\n\n/**\n * The last sentence of an `answers-mismatch`. \"Re-run and answer the claims it\n * lists\" is sound advice only when the caller CAN answer them. In a fleet the\n * checklist is federated — a feature's claims are filed under the service whose\n * code answers them — so the honest diagnosis for a repo that answered\n * everything it owns is \"the rest is not yours\", together with the form that\n * records the rest. Anything else sends the caller round the same loop.\n */\nfunction missingAdvice(\n  missing: Claim[],\n  answered: Claim[],\n  context?: { feature: string; service?: string },\n): string {\n  const generic = \"Re-run `loam verify` and answer the claims it lists.\";\n  if (context === undefined || missing.length === 0 || answered.length === 0) return generic;\n  // The signature of \"I answered mine and the rest is not mine\": the services\n  // that own the unanswered claims and the services that own the answered ones\n  // do not overlap. A single-service checklist with one claim forgotten fails\n  // this test and keeps the generic advice, which is the right advice there —\n  // that claim really is the caller's to answer.\n  const owners = [...new Set(missing.map((c) => c.subject))].sort();\n  const covered = new Set(answered.map((c) => c.subject));\n  if (owners.some((s) => covered.has(s))) return generic;\n  const form = `\\`loam verify ${context.feature} --record answers.json --service <svc>\\``;\n  const mine = context.service;\n  return mine === undefined\n    ? `Those claims are owned by ${owners.join(\", \")} — each service attests its own from its own repository (${form}); ` +\n        \"this all-at-once form has to answer the whole checklist in one file.\"\n    : `Every unanswered claim belongs to a different service (${owners.join(\", \")}) and this repository can only attest '${mine}' — ` +\n        `run ${form} in each of those repositories instead.`;\n}\n\nfunction stringList(v: unknown): string[] {\n  if (typeof v === \"string\") return v.trim().length > 0 ? [v.trim()] : [];\n  if (!Array.isArray(v)) return [];\n  return v.map((x) => String(x).trim()).filter((s) => s.length > 0);\n}\n\n"]}
+{"version":3,"file":"answers.js","sourceRoot":"","sources":["../../../src/core/verify/answers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAc,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAoB,MAAM,eAAe,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,aAAa,CAAU,CAAC;AAG9D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAU,CAAC;AAoB3E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,SAAS,CAAe,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/F,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAe,EACf,GAAY,EACZ,WAAiC,EACjC,OAA+C;IAE/C,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,OAAe,EAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAErG,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,MAAM,CACX,oBAAoB,EACpB,0EAA0E;YACxE,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,oBAAoB,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;QACvF,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,oBAAoB,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAE,QAA8B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACtF,OAAO,MAAM,CACX,oBAAoB,EACpB,GAAG,KAAK,MAAM,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,sBAAsB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC;YACX,EAAE;YACF,OAAO,EAAE,OAAkB;YAC3B,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;;YAChC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG;YACZ,SAAS,CAAC,MAAM,GAAG,CAAC;gBAClB,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,iFAAiF,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gEAAgE;gBAC1L,CAAC,CAAC,EAAE;YACN,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,yDAAyD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YACxH,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;YAC5F,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,sCAAsC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;SAC9G,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,MAAM,CACX,kBAAkB,EAClB,8CAA8C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChE,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CACX,qBAAqB,EACrB,GAAG,WAAW,CAAC,MAAM,6CAA6C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,sGAAsG,CAC/L,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,0DAA0D;IAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,OAAgB,EAChB,QAAiB,EACjB,OAA+C;IAE/C,MAAM,OAAO,GAAG,sDAAsD,CAAC;IACvE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3F,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,+CAA+C;IAC/C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IACvD,MAAM,IAAI,GAAG,iBAAiB,OAAO,CAAC,OAAO,0CAA0C,CAAC;IACxF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAC7B,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,4DAA4D,IAAI,KAAK;YACjH,sEAAsE;QAC1E,CAAC,CAAC,0DAA0D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,IAAI,MAAM;YAC7H,OAAO,IAAI,yCAAyC,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["/**\n * The answers, and the one thing loam checks about them.\n *\n * loam does not judge an answer. It cannot: it never read the code. What it\n * guarantees is that every question was asked and that every answer sits next\n * to the question it answers — so an answer set that does not correspond to the\n * current checklist is refused rather than merged. An unchecked claim must\n * never be able to masquerade as checked, and that refusal is `checkAnswers`.\n *\n * A scenario claim is answered mechanically wherever it can be: `--results`\n * reads a cucumber JSON report and matches it by the digest tag `loam gherkin`\n * stamped, and only a green run confirms one (`core/results.ts`). Where it\n * cannot — a legacy service whose suite is months away, which is the fleet loam\n * exists for — `--record` may still take an agent's word for it, and\n * `./record.ts` marks that answer attested rather than run.\n */\nimport { isRecord } from \"../kernel/records.js\";\nimport { type Claim } from \"./checklist.js\";\nimport { type EvidencePin } from \"./pins/pin.js\";\n\n/**\n * Two verdicts, deliberately. Anything an agent cannot show evidence for is\n * unconfirmed — a third value for \"not applicable\" would absorb every claim\n * nobody wanted to answer.\n */\nexport const VERDICTS = [\"confirmed\", \"unconfirmed\"] as const;\nexport type Verdict = (typeof VERDICTS)[number];\n\n/**\n * Who answered a claim: the `runner` (a cucumber report's digest-tagged\n * scenarios, matched mechanically by `--results`), the `external-runner` (an\n * API contract-test report's operationId-matched entries, matched mechanically\n * by `--contract-results` — external because loam did not generate the suite\n * the way it generates the gherkin, so the join key is the operationId the\n * claim asserts rather than a digest loam stamped), or an `agent` (somebody's\n * word about the code, taken back by `--record`). On the record so a reviewer\n * can tell a green run from an assertion. `external-runner` never answers a\n * `scenario.tested` claim, which is what keeps the attested boundary —\n * `attestedClaims` in `./record.ts` — exactly where it was.\n */\nexport const ANSWERED_BY = [\"runner\", \"external-runner\", \"agent\"] as const;\nexport type AnsweredBy = (typeof ANSWERED_BY)[number];\n\nexport interface Answer {\n  id: string;\n  verdict: Verdict;\n  /** Where it can be seen — `file:line`, or a report scenario for the runner. Required for `confirmed`. */\n  evidence: string[];\n  note?: string;\n  answered_by: AnsweredBy;\n  /**\n   * loam's own stamp, never caller input: `validateServiceEvidence` computes\n   * these from the attested commit's blobs and the record path attaches them.\n   * `checkAnswers` below deliberately never reads the field, so an\n   * `evidence_pins` key in an answers FILE is ignored, not honored — an agent\n   * must not be able to hand loam a pin loam did not derive.\n   */\n  evidence_pins?: EvidencePin[];\n}\n\n/**\n * The entries an answers file holds — a bare array, or an object with an\n * `answers` array — or null for any other shape. One reading of the file's\n * shape for `checkAnswers` and `--diff-answers`' off-lens note, so the two\n * cannot disagree about which entries a file has.\n */\nexport function answerEntries(raw: unknown): unknown[] | null {\n  if (Array.isArray(raw)) return raw;\n  return isRecord(raw) && Array.isArray(raw[\"answers\"]) ? (raw[\"answers\"] as unknown[]) : null;\n}\n\n/** Why an answer set was refused. Each names a different way it fails to answer. */\nexport type AnswerRefusal = \"answers-unreadable\" | \"answers-mismatch\" | \"answers-unevidenced\";\n\nexport type AnswerCheck =\n  /** The answers, re-ordered to the checklist, one per claim. */\n  | { ok: true; answers: Answer[] }\n  | { ok: false; code: AnswerRefusal; message: string };\n\n/**\n * Accept an answer set only if it answers THIS checklist: every claim once, no\n * claim twice, nothing extra, and no \"confirmed\" that shows nothing.\n *\n * The refusals are the point of the command. If a stale or partial answer file\n * could be recorded, `verification.yaml` would say a claim was checked when\n * nobody ever asked it — and a record that can lie is worse than no record,\n * because it looks like evidence.\n *\n * `runnerOwned` is the composition rule under `--results` and\n * `--contract-results`: ids a mechanical report answers — scenario claims under\n * the first flag, api.exposes claims under the second — which an answers file\n * must therefore not touch. An entry naming one refuses with its own diagnosis\n * — the id IS on the feature's checklist, so calling it unknown would send the\n * caller hunting a staleness that is not there. `--diff-answers`\n * (commands/verify/cross/diff.ts) calls this with it UNSET on purpose: under a\n * diff both agents answer everything in scope, scenario claims included,\n * because the diff consults no report — so making scenario claims runner-only\n * even without `--results` would break that lens.\n *\n * `context` is what turns the last line from a circle into an instruction. In a\n * fleet the commonest way to \"miss\" a claim is that it is not yours: the\n * checklist spans ten repositories and this one can only answer its own. Told\n * only to \"answer the claims it lists\", an agent in the payment-service repo\n * re-runs verify, sees the same checkout-web claims it cannot speak for, and\n * either loops or invents evidence. So when every unanswered claim belongs to\n * another service, say THAT, and name the command that records them.\n */\nexport function checkAnswers(\n  claims: Claim[],\n  raw: unknown,\n  runnerOwned?: ReadonlySet<string>,\n  context?: { feature: string; service?: string },\n): AnswerCheck {\n  const refuse = (code: AnswerRefusal, message: string): AnswerCheck => ({ ok: false, code, message });\n\n  const list = answerEntries(raw);\n  if (list === null) {\n    return refuse(\n      \"answers-unreadable\",\n      \"Expected a JSON array of answers, or an object with an `answers` array: \" +\n        `[{ \"id\": \"...\", \"verdict\": \"confirmed\", \"evidence\": [\"file:line\"] }]`,\n    );\n  }\n\n  const answers: Answer[] = [];\n  for (const [i, entry] of list.entries()) {\n    const where = `answer ${i + 1}`;\n    if (!isRecord(entry)) return refuse(\"answers-unreadable\", `${where} is not an object`);\n    const id = entry[\"id\"];\n    if (typeof id !== \"string\" || id.length === 0) {\n      return refuse(\"answers-unreadable\", `${where} has no claim id`);\n    }\n    const verdict = entry[\"verdict\"];\n    if (typeof verdict !== \"string\" || !(VERDICTS as readonly string[]).includes(verdict)) {\n      return refuse(\n        \"answers-unreadable\",\n        `${where} ('${id}') has verdict ${JSON.stringify(verdict)} — expected one of ${VERDICTS.join(\", \")}`,\n      );\n    }\n    const note = typeof entry[\"note\"] === \"string\" ? entry[\"note\"].trim() : \"\";\n    answers.push({\n      id,\n      verdict: verdict as Verdict,\n      evidence: stringList(entry[\"evidence\"]),\n      ...(note.length > 0 ? { note } : {}),\n      answered_by: \"agent\",\n    });\n  }\n\n  const byId = new Map<string, Answer>();\n  const twice: string[] = [];\n  for (const a of answers) {\n    if (byId.has(a.id)) twice.push(a.id);\n    else byId.set(a.id, a);\n  }\n  const known = new Set(claims.map((c) => c.id));\n  const strayIds = [...new Set(answers.map((a) => a.id).filter((id) => !known.has(id)))];\n  const runnerHit = strayIds.filter((id) => runnerOwned?.has(id) === true);\n  const unknown = strayIds.filter((id) => runnerOwned?.has(id) !== true);\n  const missingClaims = claims.filter((c) => !byId.has(c.id));\n  const missing = missingClaims.map((c) => c.id);\n  if (runnerHit.length + unknown.length + missing.length + twice.length > 0) {\n    const parts = [\n      runnerHit.length > 0\n        ? `${runnerHit.length} answer(s) name claim(s) a report owns under --results or --contract-results: ${runnerHit.join(\", \")} — the report answers those; take them out of the answers file`\n        : \"\",\n      unknown.length > 0 ? `${unknown.length} answer(s) name a claim that is not on the checklist: ${unknown.join(\", \")}` : \"\",\n      missing.length > 0 ? `${missing.length} claim(s) have no answer: ${missing.join(\", \")}` : \"\",\n      twice.length > 0 ? `${twice.length} claim(s) answered more than once: ${[...new Set(twice)].join(\", \")}` : \"\",\n    ].filter((s) => s.length > 0);\n    return refuse(\n      \"answers-mismatch\",\n      `These answers do not match the checklist — ${parts.join(\"; \")}. ` +\n        missingAdvice(missingClaims, claims.filter((c) => byId.has(c.id)), context),\n    );\n  }\n\n  const unevidenced = claims\n    .map((c) => byId.get(c.id)!)\n    .filter((a) => a.verdict === \"confirmed\" && a.evidence.length === 0)\n    .map((a) => a.id);\n  if (unevidenced.length > 0) {\n    return refuse(\n      \"answers-unevidenced\",\n      `${unevidenced.length} claim(s) are confirmed with no evidence: ${unevidenced.join(\", \")}. A confirmation with nothing behind it is an assertion — give a file:line, or answer 'unconfirmed'.`,\n    );\n  }\n\n  // Checklist order, not the order they were written in: the record reads in the\n  // order the questions were asked, whatever the agent did.\n  return { ok: true, answers: claims.map((c) => byId.get(c.id)!) };\n}\n\n/**\n * The last sentence of an `answers-mismatch`. \"Re-run and answer the claims it\n * lists\" is sound advice only when the caller CAN answer them. In a fleet the\n * checklist is federated — a feature's claims are filed under the service whose\n * code answers them — so the honest diagnosis for a repo that answered\n * everything it owns is \"the rest is not yours\", together with the form that\n * records the rest. Anything else sends the caller round the same loop.\n */\nfunction missingAdvice(\n  missing: Claim[],\n  answered: Claim[],\n  context?: { feature: string; service?: string },\n): string {\n  const generic = \"Re-run `loam verify` and answer the claims it lists.\";\n  if (context === undefined || missing.length === 0 || answered.length === 0) return generic;\n  // The signature of \"I answered mine and the rest is not mine\": the services\n  // that own the unanswered claims and the services that own the answered ones\n  // do not overlap. A single-service checklist with one claim forgotten fails\n  // this test and keeps the generic advice, which is the right advice there —\n  // that claim really is the caller's to answer.\n  const owners = [...new Set(missing.map((c) => c.subject))].sort();\n  const covered = new Set(answered.map((c) => c.subject));\n  if (owners.some((s) => covered.has(s))) return generic;\n  const form = `\\`loam verify ${context.feature} --record answers.json --service <svc>\\``;\n  const mine = context.service;\n  return mine === undefined\n    ? `Those claims are owned by ${owners.join(\", \")} — each service attests its own from its own repository (${form}); ` +\n        \"this all-at-once form has to answer the whole checklist in one file.\"\n    : `Every unanswered claim belongs to a different service (${owners.join(\", \")}) and this repository can only attest '${mine}' — ` +\n        `run ${form} in each of those repositories instead.`;\n}\n\nfunction stringList(v: unknown): string[] {\n  if (typeof v === \"string\") return v.trim().length > 0 ? [v.trim()] : [];\n  if (!Array.isArray(v)) return [];\n  return v.map((x) => String(x).trim()).filter((s) => s.length > 0);\n}\n\n"]}

package/dist/core/verify/build.js

@@ -6,7 +6,10 @@
  * because the two disagree about what an unanswered claim means: answering
  * everything at once, a missing answer is a gap in this run, while a federated
  * record is assembled from attestations that each covered one service and were
- * never expected to cover the rest.
+ * never expected to cover the rest. They also land in different places: the
+ * all-at-once record is the one file `verification.yaml`, while each service's
+ * attestation is a file of its own under `verification/` (`./location.ts` says
+ * why, on `verificationDir`).
  */
 import {} from "./checklist.js";
 import {} from "./answers.js";
@@ -47,104 +50,121 @@ export function buildVerification(checklist, answers, today, reports = {}) {
         ...(reports.contract === undefined ? {} : { contractReport: reports.contract }),
     };
 }
-export function buildFederatedVerification(checklist, attestation, answers, previous) {
+/**
+ * One service's attestation, as the file only that service ever writes.
+ *
+ * This used to be a merge: the new attestation spliced into the one shared
+ * record, every other service's answers retained, pruned to the current
+ * checklist and re-sorted — and that rewrite of everybody's bytes is exactly
+ * what made two teams' docs PRs conflict. Now nothing else is touched. The
+ * other services' files stand as they are, the union is added up at read time
+ * (`read/union.ts`), and an answer of theirs the feature no longer asks is
+ * simply not counted there rather than pruned here.
+ *
+ * The file is a whole schema-2 record with one attestation, so it is graded
+ * with the same shape check as every record and reads without loam: its
+ * `summary` counts the whole checklist, with the claims other services answer
+ * honestly `unanswered` in it.
+ */
+export function buildServiceRecord(checklist, attestation, answers, previous) {
     const { service, recorded, commit, reports, docsCommit } = attestation;
-    const currentById = new Map(checklist.claims.map((claim) => [claim.id, claim]));
-    const localIds = new Set(checklist.claims.filter((claim) => claim.subject === service).map((claim) => claim.id));
-    // An old all-at-once record remains readable, but its answers have no commit
-    // attestation and therefore cannot silently become somebody else's
-    // federated contribution. The first schema-2 write starts a clean federation.
-    const previouslyAttested = new Set((previous?.attestations ?? []).flatMap((a) => a.claims));
-    const retained = (previous?.schema === 2 ? previous.claims : []).filter((claim) => {
-        const current = currentById.get(claim.id);
-        return current !== undefined && current.subject !== service && previouslyAttested.has(claim.id);
-    });
-    const local = answers.map((answer) => {
+    const byId = new Map(answers.map((answer) => [answer.id, answer]));
+    const currentIds = new Set(checklist.claims.map((claim) => claim.id));
+    for (const answer of answers) {
         // Same contract as `buildVerification`: an answer is built from the live
         // checklist, so it always names a current claim. Off-checklist answers do
         // NOT belong here — `discarded` means "an answer the PREVIOUS record held",
         // and routing an incoming stray into it would change what the printed
         // notice tells an operator. A caller that reaches this gets told which
-        // answer it was rather than a `TypeError` on `claim.kind`.
-        const claim = currentById.get(answer.id);
-        if (claim === undefined) {
-            throw new Error(`buildFederatedVerification: answer ${answer.id} names no current claim`);
+        // answer it was rather than an answer silently missing from the file.
+        if (!currentIds.has(answer.id)) {
+            throw new Error(`buildServiceRecord: answer ${answer.id} names no current claim`);
         }
-        return {
-            id: claim.id,
-            kind: claim.kind,
-            subject: claim.subject,
-            claim: claim.claim,
-            verdict: answer.verdict,
-            answered_by: answer.answered_by,
-            evidence: answer.evidence,
-            ...(answer.note === undefined ? {} : { note: answer.note }),
-            // The pins the evidence validation stamped onto this repository's
-            // answers ride into the record here; retained other-service claims are
-            // spread whole below, so THEIR pins survive a re-record untouched.
-            ...(answer.evidence_pins === undefined ? {} : { evidence_pins: answer.evidence_pins }),
-        };
-    });
-    const byId = new Map([...retained, ...local].map((claim) => [claim.id, claim]));
+    }
     const claims = checklist.claims.flatMap((claim) => {
         const answer = byId.get(claim.id);
         if (answer === undefined)
             return [];
-        // Normalize retained legacy entries to the current question text and add
-        // the subject schema 2 needs for future independent replacement.
-        return [{ ...answer, kind: claim.kind, subject: claim.subject, claim: claim.claim }];
-    });
-    const retainedAttestations = (previous?.attestations ?? []).flatMap((attestation) => {
-        if (attestation.service === service)
-            return [];
-        const ids = attestation.claims.filter((id) => currentById.get(id)?.subject === attestation.service && byId.has(id));
-        return ids.length === 0 ? [] : [{ ...attestation, claims: ids }];
+        return [
+            {
+                id: claim.id,
+                kind: claim.kind,
+                subject: claim.subject,
+                claim: claim.claim,
+                verdict: answer.verdict,
+                answered_by: answer.answered_by,
+                evidence: answer.evidence,
+                ...(answer.note === undefined ? {} : { note: answer.note }),
+                // The pins the evidence validation stamped onto this repository's
+                // answers ride into the file here; no other service's file is
+                // rewritten, so THEIR pins are never touched at all.
+                ...(answer.evidence_pins === undefined ? {} : { evidence_pins: answer.evidence_pins }),
+            },
+        ];
     });
-    const attestations = [
-        ...retainedAttestations,
-        {
-            service,
-            commit,
-            recorded,
-            claims: checklist.claims.filter((c) => localIds.has(c.id)).map((c) => c.id),
-            // What THIS repository answered, and what it answered it against. Both
-            // ride with the attestation rather than the record for the reason the
-            // reports do: they are one repository's facts, pruned and retained with
-            // that repository's answers.
-            checklist: checklist.digest,
-            ...(docsCommit === undefined ? {} : { docsCommit }),
-            // Filed with the attestation, not the record: each report is one
-            // repository's run, and it is pruned or retained with that repository's
-            // answers rather than outliving them — the contract report under the
-            // same rule as the cucumber one.
-            ...(reports.results === undefined ? {} : { report: reports.results }),
-            ...(reports.contract === undefined ? {} : { contractReport: reports.contract }),
-        },
-    ].sort((a, b) => a.service.localeCompare(b.service));
     const confirmed = claims.filter((claim) => claim.verdict === "confirmed").length;
-    const unconfirmed = claims.length - confirmed;
-    const unanswered = checklist.claims.length - claims.length;
-    // Everything the old record answered that the new one does not. The caller
-    // prints it; nothing here decides it is acceptable.
-    const discarded = (previous?.claims ?? [])
-        .filter((claim) => !byId.has(claim.id))
+    const record = {
+        schema: 2,
+        feature: checklist.feature,
+        recorded,
+        checklist: checklist.digest,
+        summary: {
+            claims: checklist.claims.length,
+            confirmed,
+            unconfirmed: claims.length - confirmed,
+            unanswered: checklist.claims.length - claims.length,
+        },
+        claims,
+        attestations: [
+            {
+                service,
+                commit,
+                recorded,
+                claims: checklist.claims.filter((c) => c.subject === service).map((c) => c.id),
+                // What THIS repository answered, and what it answered it against.
+                // `checklist` is what `verify.checklist-forked` and the union's
+                // one-version rule read; `docsCommit` pins the side the question came
+                // from.
+                checklist: checklist.digest,
+                ...(docsCommit === undefined ? {} : { docsCommit }),
+                // Each report is one repository's run, filed with that repository's
+                // attestation — the contract report under the same rule as the
+                // cucumber one.
+                ...(reports.results === undefined ? {} : { report: reports.results }),
+                ...(reports.contract === undefined ? {} : { contractReport: reports.contract }),
+            },
+        ],
+    };
+    const { legacy, own, filed } = previous;
+    const federatedLegacy = legacy?.schema === 2;
+    const dropLegacy = legacy !== null &&
+        (!federatedLegacy || (legacy.attestations ?? []).every((a) => a.service === service || filed.has(a.service)));
+    // Everything this write takes off the disk that the new file does not carry:
+    // this service's own previous answers (from its file, or from its share of a
+    // one-file record no file of its own had superseded yet) and, when the
+    // one-file record is dropped, an all-at-once record's answers. Another
+    // service's answers are never in this list — their files are not touched.
+    const replaced = [
+        ...(own?.claims ?? []),
+        ...(legacy === null
+            ? []
+            : !federatedLegacy
+                ? legacy.claims
+                : own === null
+                    ? legacy.claims.filter((claim) => claim.subject === service)
+                    : []),
+    ];
+    const carried = new Set(claims.map((claim) => claim.id));
+    // Keyed by id: a service's own file and its share of the one-file record
+    // can both hold the same stale answer, and it is one answer.
+    const dropped = new Map(replaced.filter((claim) => !carried.has(claim.id)).map((claim) => [claim.id, claim]));
+    const discarded = [...dropped.values()]
         .map((claim) => ({
         id: claim.id,
         claim: claim.claim,
         ...(claim.subject === undefined ? {} : { subject: claim.subject }),
-        reason: currentById.has(claim.id) ? "unattested" : "off-checklist",
+        reason: currentIds.has(claim.id) ? "unattested" : "off-checklist",
     }));
-    return {
-        verification: {
-            schema: 2,
-            feature: checklist.feature,
-            recorded,
-            checklist: checklist.digest,
-            summary: { claims: checklist.claims.length, confirmed, unconfirmed, unanswered },
-            claims,
-            attestations,
-        },
-        discarded,
-    };
+    return { record, dropLegacy, discarded };
 }
 //# sourceMappingURL=build.js.map

package/dist/core/verify/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/core/verify/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAkB,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAe,MAAM,cAAc,CAAC;AAC3C,OAAO,EAKN,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,iBAAiB,CAC/B,SAAoB,EACpB,OAAiB,EACjB,KAAa,EACb,OAAO,GAAoB,EAAE;IAE7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAoB,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACzD,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,mCAAmC;QACnC,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACzE,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,SAAS,CAAC,MAAM;QAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE;QACrF,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KAChF,CAAC;AACJ,CAAC;AA8CD,MAAM,UAAU,0BAA0B,CACxC,SAAoB,EACpB,WAAwB,EACxB,OAAiB,EACjB,QAA6B;IAE7B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAEjH,6EAA6E;IAC7E,mEAAmE;IACnE,8EAA8E;IAC9E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAChF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAiB,EAAE;QAClD,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3D,kEAAkE;YAClE,uEAAuE;YACvE,mEAAmE;YACnE,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;SACvF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACpC,yEAAyE;QACzE,iEAAiE;QACjE,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QAClF,IAAI,WAAW,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CACnC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,KAAK,WAAW,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAC7E,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAyB;QACzC,GAAG,oBAAoB;QACvB;YACE,OAAO;YACP,MAAM;YACN,QAAQ;YACR,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,uEAAuE;YACvE,sEAAsE;YACtE,wEAAwE;YACxE,6BAA6B;YAC7B,SAAS,EAAE,SAAS,CAAC,MAAM;YAC3B,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YACnD,iEAAiE;YACjE,wEAAwE;YACxE,qEAAqE;YACrE,iCAAiC;YACjC,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAChF;KACF,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACjF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;IAC9C,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE3D,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;SACvC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC;QAChC,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAClE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe;KACnE,CAAC,CAAC,CAAC;IAEN,OAAO;QACL,YAAY,EAAE;YACZ,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,QAAQ;YACR,SAAS,EAAE,SAAS,CAAC,MAAM;YAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE;YAChF,MAAM;YACN,YAAY;SACb;QACD,SAAS;KACV,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Checklist plus answers becomes a record — once for a feature answered all at\n * once, once for a fleet answering service by service.\n *\n * The federated form is separate from `buildVerification` and not a flag on it\n * because the two disagree about what an unanswered claim means: answering\n * everything at once, a missing answer is a gap in this run, while a federated\n * record is assembled from attestations that each covered one service and were\n * never expected to cover the rest.\n */\nimport { type Checklist } from \"./checklist.js\";\nimport { type Answer } from \"./answers.js\";\nimport {\n  type ConsumedReports,\n  type RecordedClaim,\n  type ServiceAttestation,\n  type Verification,\n} from \"./record.js\";\n\nexport function buildVerification(\n  checklist: Checklist,\n  answers: Answer[],\n  today: string,\n  reports: ConsumedReports = {},\n): Verification {\n  const byId = new Map(answers.map((a) => [a.id, a]));\n  const claims: RecordedClaim[] = checklist.claims.map((c) => {\n    // Callers hand in an answer per claim — `runnerAnswers` is total over the\n    // checklist, and both other callers map the checklist to build theirs. The\n    // branch is here because the alternative to a diagnosis is a `TypeError` on\n    // `a.verdict`, which cli.ts reports as `internal` with a stack about a\n    // property of `undefined` and no word about which claim went missing.\n    const a = byId.get(c.id);\n    if (a === undefined) throw new Error(`buildVerification: no answer for claim ${c.id}`);\n    // Deliberately no `evidence_pins` here: the legacy all-at-once form binds\n    // to no commit, so there is no attested blob to pin — and none is ever\n    // handed in, because pins are computed inside the federated evidence\n    // validation this form never runs.\n    return {\n      id: c.id,\n      kind: c.kind,\n      claim: c.claim,\n      verdict: a.verdict,\n      answered_by: a.answered_by,\n      evidence: a.evidence,\n      ...(a.note === undefined ? {} : { note: a.note }),\n    };\n  });\n  const confirmed = claims.filter((c) => c.verdict === \"confirmed\").length;\n  return {\n    feature: checklist.feature,\n    recorded: today,\n    checklist: checklist.digest,\n    summary: { claims: claims.length, confirmed, unconfirmed: claims.length - confirmed },\n    claims,\n    ...(reports.results === undefined ? {} : { report: reports.results }),\n    ...(reports.contract === undefined ? {} : { contractReport: reports.contract }),\n  };\n}\n\n/**\n * An answer the previous record held that the new one does not carry.\n *\n * Dropping these is correct — see `buildFederatedVerification` — but doing it\n * silently is not: a schema-1 record answers the WHOLE checklist, so the first\n * federated write turns a green record into a partial one, and an operator who\n * is not told which answers went missing reads the drop as loam losing data.\n */\nexport interface DiscardedAnswer {\n  id: string;\n  claim: string;\n  /** The service the record filed it under, when it said. Absent in schema-1 records. */\n  subject?: string;\n  /**\n   * `off-checklist` — the feature changed and nobody asks this question any\n   * more. `unattested` — the question still stands, but no service attestation\n   * binds the answer to a commit, so it cannot be carried into a federated\n   * record; the owning repository has to record it again.\n   */\n  reason: \"off-checklist\" | \"unattested\";\n}\n\nexport interface FederatedBuild {\n  verification: Verification;\n  /** In checklist-independent record order — see {@link DiscardedAnswer}. */\n  discarded: DiscardedAnswer[];\n}\n\n/**\n * Replace one service's contribution while retaining current contributions\n * from other repositories. Claim ids removed from the live checklist are\n * pruned from both the answers and their attestations, so a changed feature can\n * never keep a green answer to a question it no longer asks.\n */\n/** One service's attestation: whose word it is, when, and against which commit. */\nexport interface Attestation {\n  service: string;\n  recorded: string;\n  commit: string;\n  reports: ConsumedReports;\n  /** The docs-repo HEAD the checklist was derived from, when git could answer. */\n  docsCommit?: string;\n}\n\nexport function buildFederatedVerification(\n  checklist: Checklist,\n  attestation: Attestation,\n  answers: Answer[],\n  previous: Verification | null,\n): FederatedBuild {\n  const { service, recorded, commit, reports, docsCommit } = attestation;\n  const currentById = new Map(checklist.claims.map((claim) => [claim.id, claim]));\n  const localIds = new Set(checklist.claims.filter((claim) => claim.subject === service).map((claim) => claim.id));\n\n  // An old all-at-once record remains readable, but its answers have no commit\n  // attestation and therefore cannot silently become somebody else's\n  // federated contribution. The first schema-2 write starts a clean federation.\n  const previouslyAttested = new Set((previous?.attestations ?? []).flatMap((a) => a.claims));\n  const retained = (previous?.schema === 2 ? previous.claims : []).filter((claim) => {\n    const current = currentById.get(claim.id);\n    return current !== undefined && current.subject !== service && previouslyAttested.has(claim.id);\n  });\n  const local = answers.map((answer): RecordedClaim => {\n    // Same contract as `buildVerification`: an answer is built from the live\n    // checklist, so it always names a current claim. Off-checklist answers do\n    // NOT belong here — `discarded` means \"an answer the PREVIOUS record held\",\n    // and routing an incoming stray into it would change what the printed\n    // notice tells an operator. A caller that reaches this gets told which\n    // answer it was rather than a `TypeError` on `claim.kind`.\n    const claim = currentById.get(answer.id);\n    if (claim === undefined) {\n      throw new Error(`buildFederatedVerification: answer ${answer.id} names no current claim`);\n    }\n    return {\n      id: claim.id,\n      kind: claim.kind,\n      subject: claim.subject,\n      claim: claim.claim,\n      verdict: answer.verdict,\n      answered_by: answer.answered_by,\n      evidence: answer.evidence,\n      ...(answer.note === undefined ? {} : { note: answer.note }),\n      // The pins the evidence validation stamped onto this repository's\n      // answers ride into the record here; retained other-service claims are\n      // spread whole below, so THEIR pins survive a re-record untouched.\n      ...(answer.evidence_pins === undefined ? {} : { evidence_pins: answer.evidence_pins }),\n    };\n  });\n  const byId = new Map([...retained, ...local].map((claim) => [claim.id, claim]));\n  const claims = checklist.claims.flatMap((claim) => {\n    const answer = byId.get(claim.id);\n    if (answer === undefined) return [];\n    // Normalize retained legacy entries to the current question text and add\n    // the subject schema 2 needs for future independent replacement.\n    return [{ ...answer, kind: claim.kind, subject: claim.subject, claim: claim.claim }];\n  });\n\n  const retainedAttestations = (previous?.attestations ?? []).flatMap((attestation) => {\n    if (attestation.service === service) return [];\n    const ids = attestation.claims.filter(\n      (id) => currentById.get(id)?.subject === attestation.service && byId.has(id),\n    );\n    return ids.length === 0 ? [] : [{ ...attestation, claims: ids }];\n  });\n  const attestations: ServiceAttestation[] = [\n    ...retainedAttestations,\n    {\n      service,\n      commit,\n      recorded,\n      claims: checklist.claims.filter((c) => localIds.has(c.id)).map((c) => c.id),\n      // What THIS repository answered, and what it answered it against. Both\n      // ride with the attestation rather than the record for the reason the\n      // reports do: they are one repository's facts, pruned and retained with\n      // that repository's answers.\n      checklist: checklist.digest,\n      ...(docsCommit === undefined ? {} : { docsCommit }),\n      // Filed with the attestation, not the record: each report is one\n      // repository's run, and it is pruned or retained with that repository's\n      // answers rather than outliving them — the contract report under the\n      // same rule as the cucumber one.\n      ...(reports.results === undefined ? {} : { report: reports.results }),\n      ...(reports.contract === undefined ? {} : { contractReport: reports.contract }),\n    },\n  ].sort((a, b) => a.service.localeCompare(b.service));\n\n  const confirmed = claims.filter((claim) => claim.verdict === \"confirmed\").length;\n  const unconfirmed = claims.length - confirmed;\n  const unanswered = checklist.claims.length - claims.length;\n\n  // Everything the old record answered that the new one does not. The caller\n  // prints it; nothing here decides it is acceptable.\n  const discarded = (previous?.claims ?? [])\n    .filter((claim) => !byId.has(claim.id))\n    .map((claim): DiscardedAnswer => ({\n      id: claim.id,\n      claim: claim.claim,\n      ...(claim.subject === undefined ? {} : { subject: claim.subject }),\n      reason: currentById.has(claim.id) ? \"unattested\" : \"off-checklist\",\n    }));\n\n  return {\n    verification: {\n      schema: 2,\n      feature: checklist.feature,\n      recorded,\n      checklist: checklist.digest,\n      summary: { claims: checklist.claims.length, confirmed, unconfirmed, unanswered },\n      claims,\n      attestations,\n    },\n    discarded,\n  };\n}\n"]}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/core/verify/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAkB,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAe,MAAM,cAAc,CAAC;AAC3C,OAAO,EAA+D,MAAM,aAAa,CAAC;AAE1F,MAAM,UAAU,iBAAiB,CAC/B,SAAoB,EACpB,OAAiB,EACjB,KAAa,EACb,OAAO,GAAoB,EAAE;IAE7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAoB,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACzD,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,mCAAmC;QACnC,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACzE,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,SAAS,CAAC,MAAM;QAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE;QACrF,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KAChF,CAAC;AACJ,CAAC;AA6DD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAoB,EACpB,WAAwB,EACxB,OAAiB,EACjB,QAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAmB,EAAE;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACpC,OAAO;YACL;gBACE,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC3D,kEAAkE;gBAClE,8DAA8D;gBAC9D,qDAAqD;gBACrD,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;aACvF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACjF,MAAM,MAAM,GAAiB;QAC3B,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,QAAQ;QACR,SAAS,EAAE,SAAS,CAAC,MAAM;QAC3B,OAAO,EAAE;YACP,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;YAC/B,SAAS;YACT,WAAW,EAAE,MAAM,CAAC,MAAM,GAAG,SAAS;YACtC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;SACpD;QACD,MAAM;QACN,YAAY,EAAE;YACZ;gBACE,OAAO;gBACP,MAAM;gBACN,QAAQ;gBACR,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,kEAAkE;gBAClE,gEAAgE;gBAChE,sEAAsE;gBACtE,QAAQ;gBACR,SAAS,EAAE,SAAS,CAAC,MAAM;gBAC3B,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;gBACnD,oEAAoE;gBACpE,+DAA+D;gBAC/D,gBAAgB;gBAChB,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aAChF;SACF;KACF,CAAC;IAEF,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACxC,MAAM,eAAe,GAAG,MAAM,EAAE,MAAM,KAAK,CAAC,CAAC;IAC7C,MAAM,UAAU,GACd,MAAM,KAAK,IAAI;QACf,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChH,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,MAAM,KAAK,IAAI;YACjB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,eAAe;gBAChB,CAAC,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC,GAAG,KAAK,IAAI;oBACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC;oBAC5D,CAAC,CAAC,EAAE,CAAC;KACZ,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9G,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;SACpC,GAAG,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC;QAChC,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAClE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe;KAClE,CAAC,CAAC,CAAC;IACN,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC","sourcesContent":["/**\n * Checklist plus answers becomes a record — once for a feature answered all at\n * once, once for a fleet answering service by service.\n *\n * The federated form is separate from `buildVerification` and not a flag on it\n * because the two disagree about what an unanswered claim means: answering\n * everything at once, a missing answer is a gap in this run, while a federated\n * record is assembled from attestations that each covered one service and were\n * never expected to cover the rest. They also land in different places: the\n * all-at-once record is the one file `verification.yaml`, while each service's\n * attestation is a file of its own under `verification/` (`./location.ts` says\n * why, on `verificationDir`).\n */\nimport { type Checklist } from \"./checklist.js\";\nimport { type Answer } from \"./answers.js\";\nimport { type ConsumedReports, type RecordedClaim, type Verification } from \"./record.js\";\n\nexport function buildVerification(\n  checklist: Checklist,\n  answers: Answer[],\n  today: string,\n  reports: ConsumedReports = {},\n): Verification {\n  const byId = new Map(answers.map((a) => [a.id, a]));\n  const claims: RecordedClaim[] = checklist.claims.map((c) => {\n    // Callers hand in an answer per claim — `runnerAnswers` is total over the\n    // checklist, and both other callers map the checklist to build theirs. The\n    // branch is here because the alternative to a diagnosis is a `TypeError` on\n    // `a.verdict`, which cli.ts reports as `internal` with a stack about a\n    // property of `undefined` and no word about which claim went missing.\n    const a = byId.get(c.id);\n    if (a === undefined) throw new Error(`buildVerification: no answer for claim ${c.id}`);\n    // Deliberately no `evidence_pins` here: the legacy all-at-once form binds\n    // to no commit, so there is no attested blob to pin — and none is ever\n    // handed in, because pins are computed inside the federated evidence\n    // validation this form never runs.\n    return {\n      id: c.id,\n      kind: c.kind,\n      claim: c.claim,\n      verdict: a.verdict,\n      answered_by: a.answered_by,\n      evidence: a.evidence,\n      ...(a.note === undefined ? {} : { note: a.note }),\n    };\n  });\n  const confirmed = claims.filter((c) => c.verdict === \"confirmed\").length;\n  return {\n    feature: checklist.feature,\n    recorded: today,\n    checklist: checklist.digest,\n    summary: { claims: claims.length, confirmed, unconfirmed: claims.length - confirmed },\n    claims,\n    ...(reports.results === undefined ? {} : { report: reports.results }),\n    ...(reports.contract === undefined ? {} : { contractReport: reports.contract }),\n  };\n}\n\n/**\n * An answer the previous record held that the new one does not carry.\n *\n * Dropping these is correct — see `buildServiceRecord` — but doing it silently\n * is not: a schema-1 record answers the WHOLE checklist, so the first\n * federated write turns a green record into a partial one, and an operator who\n * is not told which answers went missing reads the drop as loam losing data.\n */\nexport interface DiscardedAnswer {\n  id: string;\n  claim: string;\n  /** The service the record filed it under, when it said. Absent in schema-1 records. */\n  subject?: string;\n  /**\n   * `off-checklist` — the feature changed and nobody asks this question any\n   * more. `unattested` — the question still stands, but no service attestation\n   * binds the answer to a commit, so it cannot be carried into a federated\n   * record; the owning repository has to record it again.\n   */\n  reason: \"off-checklist\" | \"unattested\";\n}\n\n/** One service's attestation: whose word it is, when, and against which commit. */\nexport interface Attestation {\n  service: string;\n  recorded: string;\n  commit: string;\n  reports: ConsumedReports;\n  /** The docs-repo HEAD the checklist was derived from, when git could answer. */\n  docsCommit?: string;\n}\n\n/**\n * The record files a service's write replaces, as the authoritative read found\n * them: the one-file record, and this service's own `verification/<svc>.yaml`.\n * `filed` names every service that already has a file of its own — what\n * decides whether anything in the one-file record still counts.\n */\nexport interface PreviousFiles {\n  legacy: Verification | null;\n  own: Verification | null;\n  filed: ReadonlySet<string>;\n}\n\nexport interface ServiceBuild {\n  /** `verification/<svc>.yaml` as it will be written: this service's attestation and answers, nobody else's. */\n  record: Verification;\n  /**\n   * Whether the one-file record goes in the same commit, because nothing in it\n   * counts any more: an all-at-once record never counts once a service has a\n   * file (its answers carry no attestation — today's write used to overwrite it\n   * for the same reason), and a federated one stops counting once every\n   * service it names has a file of its own.\n   */\n  dropLegacy: boolean;\n  /** In record order — see {@link DiscardedAnswer}. */\n  discarded: DiscardedAnswer[];\n}\n\n/**\n * One service's attestation, as the file only that service ever writes.\n *\n * This used to be a merge: the new attestation spliced into the one shared\n * record, every other service's answers retained, pruned to the current\n * checklist and re-sorted — and that rewrite of everybody's bytes is exactly\n * what made two teams' docs PRs conflict. Now nothing else is touched. The\n * other services' files stand as they are, the union is added up at read time\n * (`read/union.ts`), and an answer of theirs the feature no longer asks is\n * simply not counted there rather than pruned here.\n *\n * The file is a whole schema-2 record with one attestation, so it is graded\n * with the same shape check as every record and reads without loam: its\n * `summary` counts the whole checklist, with the claims other services answer\n * honestly `unanswered` in it.\n */\nexport function buildServiceRecord(\n  checklist: Checklist,\n  attestation: Attestation,\n  answers: Answer[],\n  previous: PreviousFiles,\n): ServiceBuild {\n  const { service, recorded, commit, reports, docsCommit } = attestation;\n  const byId = new Map(answers.map((answer) => [answer.id, answer]));\n  const currentIds = new Set(checklist.claims.map((claim) => claim.id));\n  for (const answer of answers) {\n    // Same contract as `buildVerification`: an answer is built from the live\n    // checklist, so it always names a current claim. Off-checklist answers do\n    // NOT belong here — `discarded` means \"an answer the PREVIOUS record held\",\n    // and routing an incoming stray into it would change what the printed\n    // notice tells an operator. A caller that reaches this gets told which\n    // answer it was rather than an answer silently missing from the file.\n    if (!currentIds.has(answer.id)) {\n      throw new Error(`buildServiceRecord: answer ${answer.id} names no current claim`);\n    }\n  }\n  const claims = checklist.claims.flatMap((claim): RecordedClaim[] => {\n    const answer = byId.get(claim.id);\n    if (answer === undefined) return [];\n    return [\n      {\n        id: claim.id,\n        kind: claim.kind,\n        subject: claim.subject,\n        claim: claim.claim,\n        verdict: answer.verdict,\n        answered_by: answer.answered_by,\n        evidence: answer.evidence,\n        ...(answer.note === undefined ? {} : { note: answer.note }),\n        // The pins the evidence validation stamped onto this repository's\n        // answers ride into the file here; no other service's file is\n        // rewritten, so THEIR pins are never touched at all.\n        ...(answer.evidence_pins === undefined ? {} : { evidence_pins: answer.evidence_pins }),\n      },\n    ];\n  });\n  const confirmed = claims.filter((claim) => claim.verdict === \"confirmed\").length;\n  const record: Verification = {\n    schema: 2,\n    feature: checklist.feature,\n    recorded,\n    checklist: checklist.digest,\n    summary: {\n      claims: checklist.claims.length,\n      confirmed,\n      unconfirmed: claims.length - confirmed,\n      unanswered: checklist.claims.length - claims.length,\n    },\n    claims,\n    attestations: [\n      {\n        service,\n        commit,\n        recorded,\n        claims: checklist.claims.filter((c) => c.subject === service).map((c) => c.id),\n        // What THIS repository answered, and what it answered it against.\n        // `checklist` is what `verify.checklist-forked` and the union's\n        // one-version rule read; `docsCommit` pins the side the question came\n        // from.\n        checklist: checklist.digest,\n        ...(docsCommit === undefined ? {} : { docsCommit }),\n        // Each report is one repository's run, filed with that repository's\n        // attestation — the contract report under the same rule as the\n        // cucumber one.\n        ...(reports.results === undefined ? {} : { report: reports.results }),\n        ...(reports.contract === undefined ? {} : { contractReport: reports.contract }),\n      },\n    ],\n  };\n\n  const { legacy, own, filed } = previous;\n  const federatedLegacy = legacy?.schema === 2;\n  const dropLegacy =\n    legacy !== null &&\n    (!federatedLegacy || (legacy.attestations ?? []).every((a) => a.service === service || filed.has(a.service)));\n  // Everything this write takes off the disk that the new file does not carry:\n  // this service's own previous answers (from its file, or from its share of a\n  // one-file record no file of its own had superseded yet) and, when the\n  // one-file record is dropped, an all-at-once record's answers. Another\n  // service's answers are never in this list — their files are not touched.\n  const replaced = [\n    ...(own?.claims ?? []),\n    ...(legacy === null\n      ? []\n      : !federatedLegacy\n        ? legacy.claims\n        : own === null\n          ? legacy.claims.filter((claim) => claim.subject === service)\n          : []),\n  ];\n  const carried = new Set(claims.map((claim) => claim.id));\n  // Keyed by id: a service's own file and its share of the one-file record\n  // can both hold the same stale answer, and it is one answer.\n  const dropped = new Map(replaced.filter((claim) => !carried.has(claim.id)).map((claim) => [claim.id, claim]));\n  const discarded = [...dropped.values()]\n    .map((claim): DiscardedAnswer => ({\n      id: claim.id,\n      claim: claim.claim,\n      ...(claim.subject === undefined ? {} : { subject: claim.subject }),\n      reason: currentIds.has(claim.id) ? \"unattested\" : \"off-checklist\",\n    }));\n  return { record, dropLegacy, discarded };\n}\n"]}