fix(openapi): the ejector refuses to clobber a file it does not own (#694) - #714

The bug

stitch-openapi --out <dir> overwrote the author's own files with exit 0 and no warning.

packages/openapi/src/cli.ts:146-147 (on the parent commit) was a bare loop:

for (const f of result.files)
    await io.writeFile(resolve(io.cwd, base, f.path), f.contents);

then wrote N file(s) on stderr and return 0. There was no guard to have missed: grepping all of
packages/openapi/src for force, existsSync or overwrit returned zero hits. The measured rule
was a file it emits it replaces whole; a file it does not emit it ignores — so --out <the directory you already own> is one flag away from the destructive thing.

#694 §1 documents the consequence: an owner's
hand-added drift(Order) output was erased by a regen, after which a response missing the required
currency field went from failing to passing silently.

An ownership manifest was already written (gen-openapi.ts:645-648) and never read back.

Separately, §3, one line: gen-openapi.ts:630 wrote the requested validator tier into that
manifest, while :414-418 warns that anything but types-only falls back. So --validator zod
durably recorded "validator": "zod" over a tree with zero validators in it.

What changed

• .stitch-gen.json gains a files list — every path the run wrote, relative to --out,
  including the manifest itself. The ownership graph it already carried is not quite an ownership
  list: it names operation and schema files but not client.ts, index.ts or itself, and a
  flat-layout private schema records <op>.ts (inlined), a marker rather than a path.
• The CLI reads the previous run's manifest before writing anything. A target that already
  exists and is not named there belongs to the author: the run names every such file, writes
  nothing at all, and exits 1. A target the manifest does claim is replaced exactly as before —
  the ordinary regen path is untouched.
• --force opts back into the old behaviour, spelled the way stitch init --force already is.
  --dry-run writes nothing and is unaffected.
• A manifest written before the files list is still honoured, derived from the graph plus the
  three always-emitted constants, so upgrading does not cost a blanket --force to re-adopt a tree
  this generator really did produce.
• §3: the manifest records the tier actually emitted, not the one requested.
• The existence probe is a new exists member on the CLI's IO seam, mirroring core's CliIO.

Files touched: packages/openapi/src/cli.ts, packages/openapi/src/gen-openapi.ts,
packages/openapi/test/cli.spec.ts (new), packages/openapi/test/gen-openapi.spec.ts,
packages/openapi/README.md, CHANGELOG.md.

Tested

New test/cli.spec.ts (in-memory IO, in the style of core's stitch init specs) plus two additions
to test/gen-openapi.spec.ts — 35 tests pass, 0 fail. Stashing only packages/openapi/src and
re-running the suite fails 5 of them, so they pin the fix rather than the status quo.

Covered:

• an unowned existing file blocks the write, exits non-zero, names the file and the way out, and
  leaves the directory byte-identical (not even the manifest is written);
• --force overwrites it;
• a manifest-owned file regenerates without --force, including after an owner edit;
• one unowned file blocks the run even when the rest of the tree is owned (and the owned files are
  not named in the error);
• a pre-files manifest still adopts the tree it generated;
• --dry-run never trips the guard;
• one end-to-end test against a real temp directory, so the default IO's existence probe is
  covered rather than only the fake standing in for it;
• the manifest lists every emitted path, itself included;
• a requested tier that falls back records types-only in the manifest.

Also smoke-tested through the built bin/stitch-openapi: run into a clean dir → exit 0; re-run
over its own tree → exit 0, regenerated; run into a dir holding a hand-written client.ts →
refusing to overwrite 1 file(s) … Nothing was written., exit 1, file intact; same with --force
→ exit 0; --validator zod → "validator": "types-only" in the manifest.

Gates

Scope

Refs #694 — deliberately not Fixes, so the issue stays open. Only §1 and §3 are addressed;
§2 (files orphaned by an operation dropped from the spec), §4 (dropped schema keywords) and §5 (the
declared error surface) are untouched.

🤖 Generated with Claude Code