prismatica 0.2.0

package/dist/assurance/proofinputs.js

@@ -0,0 +1,425 @@
+/**
+ * What a change's own lifecycle OUTPUTS look like, and therefore what "the
+ * proof inputs are committed" and "that check is still current" actually mean.
+ *
+ * A check and a review both make a claim about a diff. The diff is
+ * `baseline..HEAD` and the patch-id deliberately EXCLUDES `.prismatica/`, so
+ * anything the claim quotes but does not seal — the contract's scope and
+ * acceptance terms, the approved intent, the pack, a Flow report, a Delta, a
+ * Flow/Rule proposal, a canonical Atlas record — can sit uncommitted and
+ * silently differ from what rides the pull request while `seal` compares two
+ * identical patch-ids and sees nothing. `review` already refused on that
+ * ground; `check` did not, so a green check could be recorded against terms
+ * nobody committed and then be cited by `review` as proof.
+ *
+ * The allowlist below is the whole mechanism, and it is an ALLOWLIST on
+ * purpose: exactly the four records this change's own check/review sequence
+ * writes, each matched by its exact shape. Everything else — every category
+ * named above — invalidates. There is no "under `.prismatica/` is fine" rule,
+ * because that was the hole: `.prismatica/evidence/<id>/` used to be tolerated
+ * by prefix, so ANY file dropped anywhere beneath it (a nested directory, a
+ * moved report, arbitrary bytes) passed as though `check` had written it. The
+ * ledger was the same hole one file over: tolerated by PATH, so an EDIT to an
+ * earlier line — a recorded failure rewritten to a pass — passed as `check`'s
+ * own output too. Only the evidence file's identity is fixed by its path; the
+ * rest are matched on CONTENT (`ledgerExtendsByAppend`,
+ * `readyLogExtendsByAppend`, `isReplaceableReview`, `isForwardStageOnly`).
+ *
+ * The Get Change Ready log joined the list when it was partitioned out of the
+ * ledger, on identical terms: `review` appends to it in the ordinary loop, so
+ * it must be tolerated as an APPEND — and it contributes no proof whatever,
+ * because nothing in the assurance path reads that file at all.
+ *
+ * Used in two places that must agree, which is why it is one module:
+ *   - the WORKING TREE test (`uncommittedProofInputs`) — `check` and `review`
+ *     refuse to run while a real input is uncommitted;
+ *   - the COMMIT RANGE test (`checkStillBinds`) — a recorded check stays
+ *     current across `checkedHead..HEAD` only while every path in that range is
+ *     one of these same outputs. Without the range test, `checkedHead === HEAD`
+ *     would deadlock: `check` writes its ledger line and evidence, committing
+ *     them moves HEAD, and the check it just recorded would read as stale
+ *     against the very commit that preserved it.
+ *
+ * The two lists are ALMOST the same and deliberately not identical. The range
+ * test additionally tolerates this contract's own signed owner decision
+ * (`isOwnersDecisionFor`), because `accept` writes one and the owner commits it
+ * like every other record here — committing it used to stale a perfectly good
+ * check and send the owner back to `check` over a record that proves the change
+ * is more finished, not less. The working-tree test does NOT tolerate it: a
+ * decision sitting uncommitted is a decision riding no pull request, which is
+ * exactly what that test exists to refuse.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import * as git from '../git.js';
+import { decisionMessage, verifySignature } from '../keys.js';
+import { configPath, ledgerPath, prismaticaDir, readyLogPath } from '../paths.js';
+import { contractPath, decisionPath, parseMarkdownRecord, reviewPath } from '../records/store.js';
+import { ConfigSchema, ContractSchema, DecisionSchema, LedgerEntrySchema, ReadyLedgerEventSchema, ReviewSchema, } from '../records/types.js';
+import { contractFieldsEqualExceptStage, stageIndex } from '../state.js';
+/** A path under `home`, spelled the way git's porcelain and diff output spell it. */
+export function laneRelative(home, target) {
+    return path.relative(home, target).split(path.sep).join('/');
+}
+/**
+ * The exact filename `evidence.ts`'s `writeCheckEvidence` produces:
+ * `<event>-<ISO timestamp with : and . replaced by ->.json`. Anchored, and
+ * with no path separator of its own, so only a DIRECT child of
+ * `evidence/<contractId>/` can match.
+ */
+const EVIDENCE_FILE = /^(check_run|gate_run)-[0-9TZ-]+\.json$/;
+/**
+ * True when `relPath` is an evidence file of the exact shape `check` writes for
+ * THIS contract — the one lifecycle output whose identity really is fixed by
+ * its path alone.
+ *
+ * The review record and the contract are deliberately NOT here: both need
+ * their CONTENT inspected before they can be tolerated (see
+ * `isReplaceableReview` and `isForwardStageOnly`), and a path-only answer for
+ * either is what let a sealed verdict be overwritten and a contract's terms
+ * move unnoticed. The ledger has since joined them — see
+ * `ledgerExtendsByAppend`.
+ */
+export function isCheckEvidenceFile(home, contractId, relPath) {
+    const evidenceDir = laneRelative(home, path.join(prismaticaDir(home), 'evidence', contractId));
+    if (!relPath.startsWith(`${evidenceDir}/`)) {
+        return false;
+    }
+    return EVIDENCE_FILE.test(relPath.slice(evidenceDir.length + 1));
+}
+/** Physical log lines, spelled the way `ledger.ts` reads them. */
+function ledgerLines(text) {
+    return text.split('\n').filter((line) => line.trim() !== '');
+}
+function parses(schema, line) {
+    try {
+        schema.parse(JSON.parse(line));
+        return true;
+    }
+    catch {
+        return false; // unreadable — fail closed, never "probably fine"
+    }
+}
+/**
+ * Whether `currentText` is `baseText` plus zero or more APPENDED lines each
+ * `isValid` accepts — the only shape an append-only writer can produce.
+ *
+ * Both logs used to be tolerated by PATH alone, so an EDIT to an earlier line
+ * passed as though `check` had written it. Nothing else on this allowlist is
+ * trusted that way: a contract must be a forward stage bump and nothing else, a
+ * review must still be a draft. This restores the parallel — what is tolerated
+ * uncommitted is what this sequence's own command actually writes.
+ *
+ * It is a SHAPE test, not a truth test, and claims nothing more. A line
+ * fabricated by hand and APPENDED is byte-indistinguishable from one `check`
+ * wrote, and no test at this layer can tell them apart; the contract's threat
+ * model excludes an agent with unrestricted file access, and what actually
+ * stops a forged pass from merging is the gate re-running the engine itself.
+ */
+function extendsByAppend(baseText, currentText, isValid) {
+    const base = ledgerLines(baseText ?? '');
+    const current = ledgerLines(currentText);
+    if (current.length < base.length) {
+        return false;
+    }
+    if (base.some((line, index) => current[index] !== line)) {
+        return false;
+    }
+    return current.slice(base.length).every(isValid);
+}
+/**
+ * The assurance ledger's own rule: appended lines must be CHECK/GATE rows.
+ *
+ * `LedgerEntrySchema`, never the union — a Ready event appended here is the
+ * partition being undone, and it is exactly the shape that made a baseline
+ * reader call the file malformed after its latest check. The lifecycle log has
+ * its own test below.
+ */
+export function ledgerExtendsByAppend(baseText, currentText) {
+    return extendsByAppend(baseText, currentText, (line) => parses(LedgerEntrySchema, line));
+}
+/**
+ * The Get Change Ready log, tolerated on exactly the same terms and for exactly
+ * as little: it is lifecycle bookkeeping, so an appended, schema-valid event is
+ * this sequence's own output and nothing more. It never contributes proof —
+ * no reader in the assurance path opens this file — and a malformed, truncated
+ * or rewritten one fails closed here like any other uncommitted record.
+ */
+export function readyLogExtendsByAppend(baseText, currentText) {
+    return extendsByAppend(baseText, currentText, (line) => parses(ReadyLedgerEventSchema, line));
+}
+/**
+ * A working-tree log, tolerated only while it extends the COMMITTED one by
+ * appends. A file missing from the tree fails closed: an empty read cannot
+ * extend a non-empty base.
+ */
+async function isAppendedLog(home, file, relPath, extendsBase) {
+    const current = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+    return extendsBase(await git.showFile(home, 'HEAD', relPath), current);
+}
+/**
+ * Whether `after` differs from `before` by nothing but a FORWARD stage move.
+ * Every other field byte-identical is what makes tolerating it safe: a
+ * baseline, a scope, an acceptance check or a builder cannot move under this
+ * test.
+ */
+function isForwardStageOnly(after, before) {
+    return (contractFieldsEqualExceptStage(after, before) &&
+        stageIndex(after.stage) > stageIndex(before.stage));
+}
+function parseContract(text) {
+    if (text === null) {
+        return null;
+    }
+    try {
+        return parseMarkdownRecord(text, ContractSchema).data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A review record may be replaced by a fresh `review` run only while it is
+ * still a DRAFT — this command's own re-runnable output.
+ *
+ * A SEALED review is a recorded decision, and archive-over-delete applies to it
+ * (principle 5): a `request_changes` verdict that never reached Git history
+ * would be erased by the very rework it asked for, leaving no trace that the
+ * reviewer ever said no. Refusing here forces it into the history instead,
+ * which needs no new record shape, no `reviews/archive/` path that
+ * `records/store.ts` and `classifyMainPush` would not recognise, and no second
+ * writer of review records.
+ *
+ * A record MISSING from the working tree is refused for the same reason, and
+ * refused unconditionally: the verdict it held is exactly what a deletion
+ * destroys, and once the bytes are gone nothing here can tell a draft that was
+ * tidied away from a `request_changes` that was erased. Tolerating the absence
+ * was the whole guard's back door — `review` would write a fresh draft over a
+ * sealed rejection that had never been committed. Deleting a review is not a
+ * step in this lifecycle (every record is written in place), so the refusal
+ * costs nothing legitimate, and the fix it prints is the archive itself:
+ * `git add -A && git commit` puts the removal in Git history, after which the
+ * path is no longer dirty and the fresh review proceeds.
+ */
+function isReplaceableReview(home, contractId, relPath) {
+    if (relPath !== laneRelative(home, reviewPath(home, contractId))) {
+        return false;
+    }
+    const file = reviewPath(home, contractId);
+    if (!fs.existsSync(file)) {
+        return false;
+    }
+    try {
+        return parseMarkdownRecord(fs.readFileSync(file, 'utf8'), ReviewSchema).data.state === 'draft';
+    }
+    catch {
+        return false; // unreadable — fail closed, never "probably fine"
+    }
+}
+/**
+ * The owner's public key as COMMITTED at `ref`. Read from the commit rather
+ * than from disk for the same reason `assurance/mainpush.ts` reads its config
+ * that way: a key swapped in the working tree would otherwise decide whether a
+ * signature "verifies". Absent or unreadable config → no key → nothing
+ * verifies, which is the fail-closed direction.
+ */
+async function ownerPublicKeyAt(root, ref) {
+    const text = await git.showFile(root, ref, laneRelative(root, configPath(root)));
+    if (text === null) {
+        return null;
+    }
+    try {
+        return ConfigSchema.parse(JSON.parse(text)).owner.publicKey || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether `relPath` is THIS contract's own owner decision, genuinely signed by
+ * this repo's owner — the one lifecycle output the range test was missing.
+ *
+ * `accept` writes `decisions/<id>.json` and the owner commits it, exactly as
+ * they commit the ledger line and evidence `check` wrote. Every other output
+ * of this sequence was already tolerated, so committing the decision was the
+ * one normal step that made a passing check read as stale — and `next` then
+ * sent the owner back to `check` over a record that proves the change is MORE
+ * finished, not less.
+ *
+ * It is deliberately narrow. Only this contract's exact path counts, so
+ * another contract's decision still invalidates (it says nothing about this
+ * diff). The signature must verify against the owner key committed beside it,
+ * so an unsigned or foreign-signed file dropped at that path invalidates too —
+ * without that, the exemption would be "any JSON at this filename", which is
+ * the shape of hole this module's header exists to describe.
+ *
+ * What it does NOT do is judge the decision. Whether the owner approved or
+ * rejected, and whether that verdict still covers the current diff, is
+ * `assurance/outcome.ts`'s `assessDecision` — asked separately, by the gate
+ * and by `next`. Currency and authentication stay two jobs: a genuine
+ * REJECTION is still this change's own lifecycle output and still leaves the
+ * check binding, and it is `assessDecision` that then stops the change.
+ */
+async function isOwnersDecisionFor(home, contract, relPath, ref) {
+    if (relPath !== laneRelative(home, decisionPath(home, contract.id))) {
+        return false;
+    }
+    const text = await git.showFile(home, ref, relPath);
+    if (text === null) {
+        return false;
+    }
+    let decision;
+    try {
+        decision = DecisionSchema.parse(JSON.parse(text));
+    }
+    catch {
+        return false; // unreadable — fail closed, never "probably fine"
+    }
+    // The filename alone is not identity: both embedded ids must agree with the
+    // contract in hand, the same test `assessDecision` applies before it will
+    // read a verdict.
+    if (decision.id !== contract.id || decision.contractId !== contract.id) {
+        return false;
+    }
+    const ownerKey = await ownerPublicKeyAt(home, ref);
+    if (!ownerKey || decision.publicKey.trim() !== ownerKey.trim()) {
+        return false;
+    }
+    return verifySignature(decisionMessage(decision.contractId, decision.patchId, decision.decision), decision.signature, decision.publicKey);
+}
+/**
+ * Every uncommitted path in `home` that is NOT one of this change's own
+ * lifecycle outputs — the list `check` and `review` refuse on.
+ *
+ * `dirtyEntries`, never `dirtyPaths`: plain porcelain collapses a brand-new
+ * untracked DIRECTORY to a single entry, so on a lane's first `check` the whole
+ * of `.prismatica/evidence/` arrives as one path and no per-file test can be
+ * applied to it.
+ *
+ * A `renamed` or `unmerged` entry is refused BEFORE any exemption is consulted.
+ * Neither is a shape this sequence can produce — every record here is written
+ * in place — and a staged rename is reported as ONE entry whose path is the
+ * DESTINATION, so testing the path alone would tolerate `git mv` of a committed
+ * report into `evidence/<id>/` while the record itself left the tree.
+ */
+export async function uncommittedProofInputs(home, contract) {
+    const refused = [];
+    const contractRel = laneRelative(home, contractPath(home, contract.id));
+    for (const entry of await git.dirtyEntries(home)) {
+        if (entry.change === 'renamed') {
+            refused.push(entry.renamedFrom ? `${entry.renamedFrom} → ${entry.path}` : entry.path);
+            continue;
+        }
+        if (entry.change === 'unmerged') {
+            refused.push(entry.path);
+            continue;
+        }
+        if (isCheckEvidenceFile(home, contract.id, entry.path)) {
+            continue;
+        }
+        if (entry.path === laneRelative(home, ledgerPath(home))) {
+            if (await isAppendedLog(home, ledgerPath(home), entry.path, ledgerExtendsByAppend)) {
+                continue;
+            }
+            refused.push(entry.path);
+            continue;
+        }
+        if (entry.path === laneRelative(home, readyLogPath(home))) {
+            // `review` appends a drafted-attempt event past its own cleanliness gate,
+            // so the very next `check` sees this file uncommitted in the ordinary
+            // loop. Tolerated on the ledger's terms and no others.
+            if (await isAppendedLog(home, readyLogPath(home), entry.path, readyLogExtendsByAppend)) {
+                continue;
+            }
+            refused.push(entry.path);
+            continue;
+        }
+        if (isReplaceableReview(home, contract.id, entry.path)) {
+            continue;
+        }
+        if (entry.path === contractRel) {
+            // Prismatica's own stage bump and nothing else. A contract with no
+            // committed version at HEAD fails closed: the terms this run is about
+            // are then on no pull request at all.
+            const committed = parseContract(await git.showFile(home, 'HEAD', contractRel));
+            if (committed && isForwardStageOnly(contract, committed)) {
+                continue;
+            }
+        }
+        refused.push(entry.path);
+    }
+    return refused;
+}
+/**
+ * Whether a check recorded at `checkedHead` still binds `head` (the current
+ * HEAD by default).
+ *
+ * Current when the commit has not moved at all, or when every path committed
+ * since is one of this change's own lifecycle outputs — the normal loop, where
+ * the owner commits the ledger line, the evidence and the review the check
+ * itself led to, and finally the signed decision `accept` wrote. Any code,
+ * config, contract-term, intent, pack, Flow-report, Delta, proposal,
+ * canonical-record or ANOTHER contract's decision commit in that range
+ * invalidates it, because the check never saw it.
+ *
+ * `head` is a parameter because `check` and `review` genuinely mean "the commit
+ * I am standing on", while `assurance/passport.ts` means "the commit that
+ * merged" — the same question asked about a commit that is NOT this working
+ * tree's HEAD. Defaulting it there would have measured a lane check against all
+ * of main.
+ */
+export async function checkStillBinds(home, contract, checkedHead, head = 'HEAD') {
+    let target;
+    try {
+        target = await git.revParse(home, head);
+    }
+    catch {
+        return false; // the commit being bound is not resolvable here — fail closed
+    }
+    if (target === checkedHead) {
+        return true;
+    }
+    let changed;
+    try {
+        changed = await git.diffNames(home, checkedHead, target);
+    }
+    catch {
+        return false; // the recorded commit is not in this history — fail closed
+    }
+    const contractRel = laneRelative(home, contractPath(home, contract.id));
+    const reviewRel = laneRelative(home, reviewPath(home, contract.id));
+    for (const file of changed) {
+        if (isCheckEvidenceFile(home, contract.id, file)) {
+            continue;
+        }
+        if (file === laneRelative(home, ledgerPath(home))) {
+            // Path-based on purpose, unlike the working-tree test above. A lane that
+            // merges main receives ledger lines from other changes that INTERLEAVE
+            // rather than append, and refusing those would fail closed on a check
+            // that is genuinely current — the deadlock this module's header exists to
+            // avoid. A ledger rewrite that was COMMITTED is also in the PR diff,
+            // where a reviewer and the gate can see it; the uncommitted one the
+            // working-tree test now refuses was visible to nobody.
+            continue;
+        }
+        if (file === laneRelative(home, readyLogPath(home))) {
+            continue; // lifecycle bookkeeping, path-based for the same reason as above
+        }
+        if (file === reviewRel) {
+            continue; // a review of this same diff — the record `review` itself wrote
+        }
+        if (await isOwnersDecisionFor(home, contract, file, target)) {
+            continue; // this contract's own signed owner decision — `accept`'s output
+        }
+        if (file === contractRel) {
+            const before = parseContract(await git.showFile(home, checkedHead, contractRel));
+            const after = parseContract(await git.showFile(home, target, contractRel));
+            if (before && after && isForwardStageOnly(after, before)) {
+                continue;
+            }
+        }
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=proofinputs.js.map

package/dist/assurance/proofinputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proofinputs.js","sourceRoot":"","sources":["../../src/assurance/proofinputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,GAEb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzE,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,UAAkB,EAAE,OAAe;IACnF,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,MAAM,CAAC,MAA4C,EAAE,IAAY;IACxE,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,kDAAkD;IAClE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,eAAe,CACtB,QAAuB,EACvB,WAAmB,EACnB,OAAkC;IAElC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAuB,EAAE,WAAmB;IAChF,OAAO,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAuB,EAAE,WAAmB;IAClF,OAAO,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,IAAY,EACZ,OAAe,EACf,WAAsE;IAEtE,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAe,EAAE,MAAgB;IAC3D,OAAO,CACL,8BAA8B,CAAC,KAAK,EAAE,MAAM,CAAC;QAC7C,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAmB;IACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAE,UAAkB,EAAE,OAAe;IAC5E,IAAI,OAAO,KAAK,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,kDAAkD;IAClE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,GAAW;IACvD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAY,EACZ,QAAkB,EAClB,OAAe,EACf,GAAW;IAEX,IAAI,OAAO,KAAK,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,kDAAkD;IAClE,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,kBAAkB;IAClB,IAAI,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CACpB,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EACzE,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,SAAS,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,QAAkB;IAC3E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,KAAK,MAAM,KAAK,IAAI,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtF,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,MAAM,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,EAAE,CAAC;gBACnF,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1D,0EAA0E;YAC1E,sEAAsE;YACtE,uDAAuD;YACvD,IAAI,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,CAAC;gBACvF,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,mEAAmE;YACnE,sEAAsE;YACtE,sCAAsC;YACtC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAC/E,IAAI,SAAS,IAAI,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;gBACzD,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,QAAkB,EAClB,WAAmB,EACnB,IAAI,GAAG,MAAM;IAEb,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,8DAA8D;IAC9E,CAAC;IACD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,2DAA2D;IAC3E,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;YACjD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAClD,yEAAyE;YACzE,uEAAuE;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,qEAAqE;YACrE,oEAAoE;YACpE,uDAAuD;YACvD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACpD,SAAS,CAAC,iEAAiE;QAC7E,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,SAAS,CAAC,gEAAgE;QAC5E,CAAC;QACD,IAAI,MAAM,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAC5D,SAAS,CAAC,gEAAgE;QAC5E,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YACjF,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAC3E,IAAI,MAAM,IAAI,KAAK,IAAI,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBACzD,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/atlas/diff.js

@@ -0,0 +1,102 @@
+function stepKey(step) {
+    return JSON.stringify({
+        actor: step.actor,
+        action: step.action,
+        shows: step.shows ?? null,
+        changes: step.changes ?? null,
+        assumes: step.assumes,
+    });
+}
+/** LCS diff over step content. O(n·m); flows have at most a handful of steps. */
+export function diffSteps(current, proposed) {
+    const a = current.map(stepKey);
+    const b = proposed.map(stepKey);
+    const n = a.length;
+    const m = b.length;
+    const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+    for (let i = n - 1; i >= 0; i--) {
+        for (let j = m - 1; j >= 0; j--) {
+            dp[i][j] = a[i] === b[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
+        }
+    }
+    const entries = [];
+    let i = 0;
+    let j = 0;
+    while (i < n && j < m) {
+        if (a[i] === b[j]) {
+            entries.push({ kind: 'unchanged', step: proposed[j] });
+            i++;
+            j++;
+        }
+        else if (dp[i + 1][j] >= dp[i][j + 1]) {
+            entries.push({ kind: 'removed', step: current[i] });
+            i++;
+        }
+        else {
+            entries.push({ kind: 'added', step: proposed[j] });
+            j++;
+        }
+    }
+    while (i < n) {
+        entries.push({ kind: 'removed', step: current[i] });
+        i++;
+    }
+    while (j < m) {
+        entries.push({ kind: 'added', step: proposed[j] });
+        j++;
+    }
+    return entries;
+}
+/** Keyed by `name` — a variation's name is its natural, stable identity. */
+export function diffVariations(current, proposed) {
+    const byName = new Map(current.map((v) => [v.name, v]));
+    const seen = new Set();
+    const entries = [];
+    for (const after of proposed) {
+        const before = byName.get(after.name);
+        seen.add(after.name);
+        if (!before) {
+            entries.push({ kind: 'added', variation: after });
+        }
+        else if (before.differs === after.differs && before.status === after.status) {
+            entries.push({ kind: 'unchanged', variation: after });
+        }
+        else {
+            entries.push({ kind: 'edited', before, after });
+        }
+    }
+    for (const before of current) {
+        if (!seen.has(before.name)) {
+            entries.push({ kind: 'removed', variation: before });
+        }
+    }
+    return entries;
+}
+/** A plain set diff for unordered string-list truth fields (needs/rules/involves). */
+export function diffList(current, proposed) {
+    const currentSet = new Set(current);
+    const proposedSet = new Set(proposed);
+    return {
+        added: proposed.filter((item) => !currentSet.has(item)),
+        removed: current.filter((item) => !proposedSet.has(item)),
+        unchanged: current.filter((item) => proposedSet.has(item)),
+    };
+}
+function presentationValue(presentation, field) {
+    const value = presentation?.[field];
+    return value === undefined ? undefined : String(value);
+}
+/** Only the fields that actually differ; an empty array means "no display changes". */
+export function diffPresentation(current, proposed) {
+    const fields = ['title', 'journey', 'order'];
+    const entries = [];
+    for (const field of fields) {
+        const before = presentationValue(current, field);
+        const after = presentationValue(proposed, field);
+        if (before !== after) {
+            entries.push({ field, before, after });
+        }
+    }
+    return entries;
+}
+//# sourceMappingURL=diff.js.map

package/dist/atlas/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/atlas/diff.ts"],"names":[],"mappings":"AAuBA,SAAS,OAAO,CAAC,IAAc;IAC7B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,SAAS,CAAC,OAAmB,EAAE,QAAoB;IACjE,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,EAAE,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,KAAK,CAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;YACxD,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;YACrD,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;YACpD,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;QACrD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;QACpD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAC5B,OAAwB,EACxB,QAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,OAAiB,EAAE,QAAkB;IAC5D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzD,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC;AAkBD,SAAS,iBAAiB,CACxB,YAA0C,EAC1C,KAA4B;IAE5B,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,gBAAgB,CAC9B,OAAqC,EACrC,QAAsC;IAEtC,MAAM,MAAM,GAA4B,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/atlas/evidence.js

@@ -0,0 +1,31 @@
+/**
+ * Evidence-state derivation for Flow steps and Rules. Covers the three known
+ * methods, "unknown", and "stale" — a step whose evidence.commit predates a
+ * later change to its flow's touchpoints (computed by atlas/impact.ts's
+ * `staleSteps`, which needs git; callers with that access pass the result in
+ * as `isStale`, keeping this module itself pure).
+ */
+import { EVIDENCE_STATE_LABEL } from './labels.js';
+import { summarizeEvidence } from './presentation.js';
+export function deriveEvidenceState(evidence, isStale = false) {
+    if (isStale) {
+        return 'stale';
+    }
+    return evidence?.method ?? 'unknown';
+}
+export function evidenceStateLabel(evidence, isStale = false) {
+    return EVIDENCE_STATE_LABEL[deriveEvidenceState(evidence, isStale)];
+}
+/**
+ * One honest line for a flow: never implies one test proves the whole thing.
+ * `staleStepNumbers` (1-based, matching how steps are shown everywhere else)
+ * overrides whatever method a stale step's evidence claims — a stale "test
+ * verified" step is not currently verified, it's stale.
+ */
+export function summarizeStepEvidence(steps, staleStepNumbers = new Set()) {
+    // Delegates so this sentence exists in exactly ONE place. `review.ts` (outside
+    // the presentation layer) still calls this; the owner-facing surfaces read the
+    // richer EvidenceSummary directly.
+    return summarizeEvidence(steps, staleStepNumbers).detail;
+}
+//# sourceMappingURL=evidence.js.map

package/dist/atlas/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/atlas/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAKtD,MAAM,UAAU,mBAAmB,CAAC,QAAmB,EAAE,OAAO,GAAG,KAAK;IACtE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,QAAQ,EAAE,MAAM,IAAI,SAAS,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAmB,EAAE,OAAO,GAAG,KAAK;IACrE,OAAO,oBAAoB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAiB,EACjB,mBAAwC,IAAI,GAAG,EAAE;IAEjD,+EAA+E;IAC/E,+EAA+E;IAC/E,mCAAmC;IACnC,OAAO,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC;AAC3D,CAAC"}