mikser-io 9.20.0 → 9.21.1

package/docs/diagnostics.md

@@ -35,10 +35,29 @@ npx mikser --explain /documents/en/posts/hello.md
 ```
 
 It prints the entity's layout and **why that layout matched**, its
-destination, its `inputHash`, whether the file on disk still agrees with
-the catalog, every recorded render with its `refClosure`, and a verdict
-in plain words — `would be SKIPPED — input hash unchanged`, or `would
-re-render`, or `source file is gone`.
+destination, its `inputHash` and the components that went into it,
+whether the file on disk still agrees with the catalog, every recorded
+render with its `refClosure`, and a verdict in plain words.
+
+When an entity's inputs have moved since a render, the verdict names what
+moved rather than only that something did:
+
+```
+would re-render — meta.title changed since it was last rendered
+```
+
+and the render line carries the same detail per snapshot:
+
+```
+rendered    2026-08-22 21:07:52   → /page-a.html   [STALE: input hash moved since]
+  moved      content, meta.weight (added)
+```
+
+A snapshot written before per-input recording says so rather than
+guessing. Note that `--explain` compares the CATALOG's entity against the
+snapshot: if you have edited a file and not yet built, the verdict is
+`source differs from the catalog` — the edit has not been imported yet, so
+there is nothing to attribute. Build, then ask.
 
 Each `refClosure` edge shows the name that was asked for and the entity
 it bound to, and flags the ones that bound to nothing:
@@ -77,6 +96,27 @@ Four buckets, and the distinction between them is the point:
 `never-rendered`, `inputs-changed`, `ref-changed`, `query-matched`,
 `cache-disabled`, `postprocessor`, `force`, `no-manifest`.
 
+`inputs-changed` carries a `changed` array naming **which** input moved,
+so you do not have to go to the database to find out:
+
+```json
+{ "id": "/files/hero.jpg",     "reason": "inputs-changed", "changed": ["checksum"] }
+{ "id": "/documents/page.md",  "reason": "inputs-changed", "changed": ["meta.title"] }
+{ "id": "/documents/page.md",  "reason": "inputs-changed", "changed": ["content"] }
+{ "id": "/layouts/post.hbs",   "reason": "inputs-changed", "changed": ["inputs.shared"] }
+```
+
+`checksum` means the bytes on disk moved; `content` means the body did;
+`meta.<field>` names the front-matter field; `inputs.<key>` is a declared
+input such as a layout's sidecar digest. A field that appeared or vanished
+reads as `meta.weight (added)` / `(removed)`, which is the answer when a
+document gains or loses front-matter.
+
+The array is absent on a first render — there is no prior snapshot to
+compare against — and on `ref-changed`, because that is a dependency
+moving rather than the entity's own inputs. Conflating the two would make
+the attribution misleading.
+
 `unchanged` is the interesting one. It means invalidation was coarser
 than it needed to be — the render was scheduled, ran, and produced
 nothing new. A high count is not a bug, but it tells you where the

package/index.js

@@ -50,11 +50,11 @@ export { renderHbs }    from './src/plugins/render/hbs.js'
 export { renderPreset } from './src/plugins/render/preset.js'
 
 // Template helpers — these only install functions on `runtime` for templates
-// to call. They render nothing, which is what the old render* names hid: two
-// of the six factories in this folder are renderers and four are not, and
-// naming all six after the object they concern rather than the job they do
-// led someone to add renderPreset() expecting a helper and watch every page
-// render throw. Renamed in 10.0.0; there are no aliases.
+// to call. They render nothing, and the names say so: two of the six
+// factories in this folder are renderers and four are not, so each is named
+// after the job it does rather than the object it concerns. Naming them all
+// `render*` invites adding renderPreset() expecting a helper and watching
+// every page render throw. There are no aliases for the older names.
 export { assetUrlHelper }    from './src/plugins/render/asset.js'
 export { hrefUrlHelpers }    from './src/plugins/render/href.js'
 export { resourceUrlHelper } from './src/plugins/render/resource.js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io",
-  "version": "9.20.0",
+  "version": "9.21.1",
   "description": "<p align=\"center\">   <img src=\"mikser-lockup-stacked.svg\" alt=\"mikser\" width=\"198\" /> </p>",
   "main": "index.js",
   "exports": {

package/src/catalog.js

@@ -360,8 +360,10 @@ onFinalize(async () => {
     }
 })
 
-// Snapshot the catalog as `{ version, entities: [...] }`. Same shape
-// the NDJSON test harness used to read off disk. O(N) — debug only.
+// Snapshot the catalog as `{ version, entities: [...] }` — the schema
+// version plus every entity body. O(N) in both time and memory, so it is
+// for debugging and inspection, never a hot path; `iterateEntities`
+// streams when the result set might be corpus-scale.
 function exportCatalog() {
     if (!db?.isOpen) return { version: null, entities: [] }
     const rows = stmtAllData.all()

package/src/config.js

@@ -56,11 +56,9 @@ onLoad(async () => {
         }
     }
 
-    // v8 used to walk `runtime.config.plugins` looking for matching
-    // `config/<plugin>.config.js` files to merge into `runtime.config`,
-    // because plugin entries were strings (names). v9 entries are factory
-    // call results (closures or descriptors), and plugin options arrive
-    // as factory args — see ADR-0010 — so per-plugin auxiliary config
-    // files have nothing to bind to. The loader was removed when the
-    // plugins list stopped carrying names.
+    // Nothing else is loaded. There is deliberately no `config/<plugin>
+    // .config.js` channel: plugin options arrive as factory arguments
+    // (ADR-0010), and an entry in `plugins` is a factory call result — a
+    // closure or a descriptor — carrying no name to bind an auxiliary file
+    // to. A plugin wanting file-based config reads it itself.
 })

package/src/engine.js

@@ -374,7 +374,7 @@ export async function setup(options) {
                     logger.debug('Manifest skip: %s → %s', entity.name || entity.id, entity.destination)
                     return
                 }
-                reportRendered(entity, decision.reason)
+                reportRendered(entity, decision.reason, decision.changed)
                 // Project reference-marker keys (`$author`, `$hero`, …)
                 // into their normalized form (`author`, `hero`) before
                 // the entity crosses into the renderer — applies whether

package/src/explain.js

@@ -8,7 +8,7 @@
 // needs knowledge a user of the tool should not need.
 //
 // Follows --verify's shape: report and exit, no build phases run.
-import { inputHashOf, lookupKeys, checksum as fileChecksum } from './utils.js'
+import { inputHashOf, inputPartsOf, diffInputParts, lookupKeys, checksum as fileChecksum } from './utils.js'
 import { findEntity } from './catalog.js'
 import runtime from './runtime.js'
 
@@ -28,6 +28,22 @@ async function resolve(reference) {
     return like ?? null
 }
 
+// The verdict line names what moved when it can. That line is the one
+// people read, so "the input hash differs" there is the answer stopping one
+// step short of useful.
+function renderVerdict(snapshots, currentHash, currentParts) {
+    const moved = new Set()
+    for (const snap of snapshots) {
+        if (snap.inputHash === currentHash || !snap.inputParts) continue
+        const d = diffInputParts(snap.inputParts, currentParts)
+        for (const key of [...d.changed, ...d.added, ...d.removed]) moved.add(key)
+    }
+    if (!moved.size) {
+        return 'would re-render — the entity\'s input hash differs from what it was last rendered at'
+    }
+    return `would re-render — ${[...moved].join(', ')} changed since it was last rendered`
+}
+
 export async function explain(reference) {
     const entity = await resolve(reference)
     if (!entity) {
@@ -43,6 +59,7 @@ export async function explain(reference) {
 
     const snapshots = runtime.manifest?.snapshotsFor(entity.id) ?? []
     const currentHash = inputHashOf(entity)
+    const currentParts = inputPartsOf(entity)
 
     // The catalog is as of the LAST BUILD. If the file has been edited since,
     // nothing here knows it yet — the hashes would all agree and the verdict
@@ -96,9 +113,11 @@ export async function explain(reference) {
         // current hash; each snapshot carries the hash it was rendered at, so
         // the two disagreeing IS the answer to "why did this change".
         inputHash: currentHash,
-        inputHashOf: entity.checksum && entity.meta == null && entity.content == null
-            ? 'checksum'
-            : 'meta+content+inputs',
+        // The components that actually went into the hash for THIS entity,
+        // read off the parts rather than restated — a hardcoded label drifts
+        // the moment the payload changes, and this one had.
+        inputHashOf: [...new Set(Object.keys(currentParts).map(k => k.split('.')[0]))].join('+')
+            || 'nothing',
         inputs: entity.inputs ?? null,
         checksum: entity.checksum ?? null,
         source,
@@ -109,6 +128,15 @@ export async function explain(reference) {
             // The single most useful field: does this entity's current hash
             // match what it was last rendered at?
             stale: snap.inputHash !== currentHash,
+            // WHICH input moved, not merely that one did. This is the whole
+            // question behind "why did this re-render" — answering it from
+            // the recorded parts costs nothing, and not answering it sends
+            // the reader to a database query for something already here.
+            moved: snap.inputHash === currentHash
+                ? null
+                : snap.inputParts
+                    ? diffInputParts(snap.inputParts, currentParts)
+                    : 'unknown',
             outputHash: snap.outputHash ?? null,
             parent: snap.parent ?? null,
             refClosure: (snap.refClosure ?? []).map(entry =>
@@ -136,7 +164,7 @@ export async function explain(reference) {
                 : snapshots.length === 0
             ? 'never rendered — no manifest snapshot. Either it has no layout, or its layout produced no destination.'
             : snapshots.some(s => s.inputHash !== currentHash)
-                ? 'would re-render — the entity\'s input hash differs from what it was last rendered at'
+                ? renderVerdict(snapshots, currentHash, currentParts)
                 : 'would be SKIPPED — input hash unchanged. A dependency in refClosure changing is the only other thing that would re-render it.',
         lookupKeys: lookupKeys(entity),
     }

package/src/manifest.js

@@ -56,7 +56,7 @@ import { useLogger } from './engine.js'
 import { onLoaded, onFinalize } from './lifecycle.js'
 import { useJournal } from './journal.js'
 import { OPERATION } from './constants.js'
-import { extractRefs, inputHashOf } from './utils.js'
+import { extractRefs, inputHashOf, inputPartsOf, diffInputParts } from './utils.js'
 import { filterKey } from './track.js'
 import { findById } from './catalog.js'
 import { useDatabase, registerSchema } from './database/index.js'
@@ -74,6 +74,7 @@ export const SNAPSHOTS_SCHEMA = `
         id          TEXT NOT NULL,
         destination TEXT NOT NULL,
         inputHash   TEXT,
+        inputParts  TEXT,
         outputHash  TEXT,
         refClosure  TEXT,
         renderedAt  INTEGER,
@@ -97,6 +98,20 @@ function sha1(payload) {
 }
 
 // refClosure builder — same logic as before, no DB involvement.
+// Which input moved, as a flat list of part names ('content',
+// 'meta.title', 'checksum', 'inputs.shared'). Empty when the snapshot
+// predates part recording — the combined hash still says the entity
+// changed, and saying nothing is better than guessing which part.
+function describeInputChange(entity, snapshot) {
+    if (!snapshot?.inputParts) return []
+    const { changed, added, removed } = diffInputParts(snapshot.inputParts, inputPartsOf(entity))
+    return [
+        ...changed,
+        ...added.map(key => `${key} (added)`),
+        ...removed.map(key => `${key} (removed)`),
+    ]
+}
+
 function buildRefClosure(entity, deps) {
     const closure = []
     const seen = new Set()
@@ -155,6 +170,11 @@ function buildSnapshot(entity, deps, outputHash) {
         id: entity.id,
         destination: entity.destination,
         inputHash: inputHashOf(entity),
+        // Per-component hashes of the same payload the combined hash covers,
+        // so a later run can name WHICH input moved instead of only that one
+        // did. Without it `inputs-changed` sends the reader to a database
+        // query for something the tool already has in hand.
+        inputParts: inputPartsOf(entity),
         refClosure: buildRefClosure(entity, deps),
         renderedAt: Date.now(),
     }
@@ -171,6 +191,7 @@ function rowToSnap(row) {
         id:          row.id,
         destination: row.destination,
         inputHash:   row.inputHash ?? undefined,
+        inputParts:  row.inputParts ? JSON.parse(row.inputParts) : undefined,
         outputHash:  row.outputHash ?? undefined,
         refClosure:  row.refClosure ? JSON.parse(row.refClosure) : undefined,
         renderedAt:  row.renderedAt ?? undefined,
@@ -183,6 +204,7 @@ function snapToRow(snap) {
         id:          snap.id,
         destination: snap.destination,
         inputHash:   snap.inputHash   ?? null,
+        inputParts:  snap.inputParts  ? JSON.stringify(snap.inputParts) : null,
         outputHash:  snap.outputHash  ?? null,
         refClosure:  snap.refClosure  ? JSON.stringify(snap.refClosure) : null,
         renderedAt:  snap.renderedAt  ?? null,
@@ -203,10 +225,11 @@ function snapToRow(snap) {
 // is the dominant shape. A page destination treated as a filesystem path
 // would otherwise be looked for at the root of the disk.
 //
-// Shared, because the two callers needing it drifted into two separate
-// bugs: verify() reported every asset missing while printing its real
-// path, and hashOutputFile silently recorded no outputHash for one, which
-// left 78% of a real project's snapshots presence-checked only.
+// One definition for both callers. verify() and hashOutputFile ask the same
+// question, and a private copy of the join in each is how one mistake
+// becomes two symptoms — one loud (every asset reported missing, at its
+// real and present path) and one silent (no outputHash recorded, leaving
+// most snapshots presence-checked only).
 export function resolveOutputPath(destination, outputFolder = runtime.options?.outputFolder) {
     if (!destination) return undefined
     const joined = path.join(outputFolder ?? '', destination)
@@ -230,18 +253,18 @@ export function createManifest(db) {
     if (!db) throw new Error('createManifest: db is required')
 
     const stmtLookupById = db.prepare(`
-        SELECT id, destination, inputHash, outputHash, refClosure, renderedAt, parent
+        SELECT id, destination, inputHash, inputParts, outputHash, refClosure, renderedAt, parent
         FROM mikser_snapshots WHERE id = ? ORDER BY destination
     `)
     const stmtLookup = db.prepare(`
-        SELECT id, destination, inputHash, outputHash, refClosure, renderedAt, parent
+        SELECT id, destination, inputHash, inputParts, outputHash, refClosure, renderedAt, parent
         FROM mikser_snapshots WHERE id = ? AND destination = ?
     `)
     const stmtUpsert = db.prepare(`
         INSERT OR REPLACE INTO mikser_snapshots
-            (id, destination, inputHash, outputHash, refClosure, renderedAt, parent)
+            (id, destination, inputHash, inputParts, outputHash, refClosure, renderedAt, parent)
         VALUES
-            (@id, @destination, @inputHash, @outputHash, @refClosure, @renderedAt, @parent)
+            (@id, @destination, @inputHash, @inputParts, @outputHash, @refClosure, @renderedAt, @parent)
     `)
     const stmtDeleteByPK = db.prepare(`
         DELETE FROM mikser_snapshots WHERE id = ? AND destination = ?
@@ -257,7 +280,7 @@ export function createManifest(db) {
         SELECT id, destination FROM mikser_snapshots WHERE parent = ?
     `)
     const stmtSelectAll = db.prepare(`
-        SELECT id, destination, inputHash, outputHash, refClosure, renderedAt, parent
+        SELECT id, destination, inputHash, inputParts, outputHash, refClosure, renderedAt, parent
         FROM mikser_snapshots
     `)
     const stmtCount = db.prepare(`SELECT COUNT(*) AS c FROM mikser_snapshots`)
@@ -352,7 +375,16 @@ export function createManifest(db) {
             if (entity?.meta?.cache === false) return { skip: false, reason: 'cache-disabled' }
             const snapshot = this.lookup(entity)
             if (!snapshot?.inputHash) return { skip: false, reason: 'never-rendered' }
-            if (inputHashOf(entity) !== snapshot.inputHash) return { skip: false, reason: 'inputs-changed' }
+            if (inputHashOf(entity) !== snapshot.inputHash) {
+                // Name the component that moved. "inputs-changed" alone is
+                // the answer to a question nobody asked — the reader wants to
+                // know WHICH input, and the recorded parts have it.
+                return {
+                    skip: false,
+                    reason: 'inputs-changed',
+                    changed: describeInputChange(entity, snapshot),
+                }
+            }
             if (!snapshot.refClosure?.length) return { skip: true, reason: 'unchanged' }
             const sourceLang = entity?.meta?.lang ?? null
             for (const entry of snapshot.refClosure) {

package/src/plugins/api.js

@@ -607,8 +607,9 @@ export function api(options = {}) {
             // credential declaring `api:delete` still cannot delete on an
             // endpoint whose `operations` omits it, and a bare token (which
             // declares nothing, capabilities === null) is bounded by the
-            // endpoint alone — which is exactly how every endpoint behaved
-            // before this existed.
+            // endpoint alone, which is what makes a plain token still a
+            // complete answer: it grants the endpoint's own ceiling and
+            // nothing more.
             const allow = (op) => (req, res, next) => {
                 if (!allowedOps.has(op)) {
                     return res.status(403).json({

package/src/plugins/render/preset.js

@@ -15,8 +15,8 @@ import path from 'node:path'
 //   assets()        runs presets and produces derivatives   (the work)
 //   renderPreset()  renders a preset-authored layout        (this file)
 //
-// The helpers were renamed for their role in 10.0.0 for exactly this reason;
-// renderPreset keeps its name because it really is a renderer.
+// The URL helpers carry `Helper` in their names for exactly this reason;
+// renderPreset keeps its bare name because it really is a renderer.
 export async function load({ entity, runtime }) {
     if (!entity?.preset?.uri) return
     const preset = await import(`${entity.preset.uri}?stamp=${Date.now()}`)

package/src/postprocess.js

@@ -253,10 +253,10 @@ export default async ({ entity, options, config, context, state, logger, port })
     }
 
     // Cleanup the renderer's origin (first stage's input) when it's
-    // a different path from the chain's final destination. The
-    // single-stage onComplete in layouts.js used to do this; under
-    // the chain contract the dispatcher owns it so onComplete can
-    // stay disk-write-agnostic for postprocess outputs.
+    // a different path from the chain's final destination. The chain
+    // contract puts this on the dispatcher rather than on layouts'
+    // onComplete, which is what lets onComplete stay agnostic about
+    // whether a postprocess output was written to disk at all.
     if (entity.origin && entity.origin !== entity.destination) {
         try { await unlink(path.join(options.outputFolder, entity.origin)) } catch {}
     }
@@ -264,7 +264,7 @@ export default async ({ entity, options, config, context, state, logger, port })
     // Return undefined so the engine's onPostprocess loop doesn't
     // try to thread `result` back through layouts' onComplete (which
     // would attempt a writeFile against a non-bytes value). The
-    // postprocess plugins wrote directly to disk; there's nothing
-    // for the engine to flush.
+    // postprocess plugins have written directly to disk by this point;
+    // there is nothing for the engine to flush.
     return undefined
 }

package/src/report.js

@@ -28,9 +28,16 @@ export function reportGated(count = 1) {
     store().gated += count
 }
 
-export function reportRendered(entity, reason) {
+export function reportRendered(entity, reason, changed) {
     if (!runtime.options?.json) return
-    store().rendered.push({ id: entity?.id, destination: entity?.destination ?? null, reason })
+    store().rendered.push({
+        id: entity?.id,
+        destination: entity?.destination ?? null,
+        reason,
+        // Which input moved, when the reason is inputs-changed. Omitted
+        // rather than empty so a consumer can test for its presence.
+        ...(changed?.length ? { changed } : {}),
+    })
 }
 
 // A render that RAN and produced bytes identical to what was already on

package/src/utils.js

@@ -15,9 +15,11 @@ import runtime from './runtime.js'
 // seeding. Excludes volatile fields like stamp/time/uri so re-discovery
 // on startup doesn't produce a different hash for an unchanged file.
 // Pure: synchronous, no I/O, no engine state.
-export function inputHashOf(entity) {
-    if (!entity) return ''
-    return crypto.createHash('sha1').update(JSON.stringify({
+// The payload both `inputHashOf` and `inputPartsOf` describe. One
+// definition, because a hash and an attribution of that hash that disagree
+// about what went into it is worse than having no attribution.
+function inputPayload(entity) {
+    return {
         meta: entity.meta ?? null,
         content: entity.content ?? null,
         // The bytes' fingerprint, for entities whose content is not in
@@ -46,7 +48,69 @@ export function inputHashOf(entity) {
         // an entity that HAS content is hashed on {meta, content} and its
         // checksum is ignored. This is the seam that was missing.
         inputs: entity.inputs ?? null,
-    })).digest('hex')
+    }
+}
+
+export function inputHashOf(entity) {
+    if (!entity) return ''
+    return crypto.createHash('sha1').update(JSON.stringify(inputPayload(entity))).digest('hex')
+}
+
+// Per-component hashes of the same payload, flat and one level deep:
+//
+//   { 'meta.title': 'ab12cd34', content: '…', 'inputs.shared': '…' }
+//
+// Recorded alongside the combined hash so a later run can say WHICH input
+// moved rather than only that one did. `inputs-changed` on its own sends
+// the reader to a database query to answer something already known here.
+//
+// Components that are null are omitted rather than hashed, so a component
+// appearing or disappearing reads as an added or removed key — which is
+// the answer in its own right when a document gains front-matter or a
+// layout gains a sidecar.
+//
+// Depth one: naming `meta.title` is the difference between a useful answer
+// and "something under meta". Deeper nesting would grow the snapshot for
+// diminishing returns — the key names the field to look at, and the field
+// is then in front of you.
+export function inputPartsOf(entity) {
+    if (!entity) return {}
+    const parts = {}
+    const short = (value) => crypto.createHash('sha1')
+        .update(JSON.stringify(value ?? null)).digest('hex').slice(0, 8)
+    const payload = inputPayload(entity)
+    for (const [component, value] of Object.entries(payload)) {
+        if (value == null) continue
+        if (component === 'meta' || component === 'inputs') {
+            if (typeof value !== 'object' || Array.isArray(value)) {
+                parts[component] = short(value)
+                continue
+            }
+            for (const [key, inner] of Object.entries(value)) {
+                parts[`${component}.${key}`] = short(inner)
+            }
+            continue
+        }
+        parts[component] = short(value)
+    }
+    return parts
+}
+
+// What moved between two part maps. Returns the keys, split by how they
+// differ, so a caller can say "content changed" or "meta.title added"
+// without re-deriving the comparison.
+export function diffInputParts(before, after) {
+    const from = before ?? {}
+    const to = after ?? {}
+    const changed = [], added = [], removed = []
+    for (const key of Object.keys(to)) {
+        if (!(key in from)) added.push(key)
+        else if (from[key] !== to[key]) changed.push(key)
+    }
+    for (const key of Object.keys(from)) {
+        if (!(key in to)) removed.push(key)
+    }
+    return { changed: changed.sort(), added: added.sort(), removed: removed.sort() }
 }
 
 // Canonical lookup variants for an entity — the same four forms the