@chrisdudek/yg 5.3.0 → 5.4.1

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/bin.ts
-import { Command as Command2 } from "commander";
+import { Command as Command3 } from "commander";
 
 // src/cli/init.ts
 import chalk2 from "chalk";
@@ -17,6 +17,17 @@ var DEFAULT_CONFIG = `version: "5.1.0"
 quality:
   max_direct_relations: 10
 
+# Coverage \u2014 which files must belong to a node.
+# Fresh projects start in "require nothing" mode: every unmapped file surfaces as
+# a NON-blocking warning (not a blocking error), so your very first \`yg check\` is
+# green while you adopt incrementally. Add a path prefix to \`required\` (e.g.
+# "src/") to make that area blocking once you start mapping it. NOTE: an ABSENT
+# coverage block defaults to requiring the WHOLE repo \u2014 this explicit empty list
+# is what opts a fresh project into require-nothing.
+coverage:
+  required: []
+  excluded: []
+
 # Reviewer configuration added by: yg init
 # (see yg schemas read config + yg knowledge read configuration)
 
@@ -128,7 +139,7 @@ Verification runs per \`(aspect, unit)\` pair. A **unit** is the subject of one
 
 Verification is all-or-nothing and repo-wide: \`yg check --approve\` fills EVERY unverified pair (deterministic first, free; then LLM). The only scoping flag is \`--only-deterministic\` (the free, keyless CI gate); \`yg impact\` is the pre-edit cost predictor. Deterministic checks run first; a node with an enforced deterministic refusal has its LLM pairs skipped that run, so a known-broken node never bills the reviewer. Refusals are cached like approvals.
 
-Interrupting \`yg check --approve\` is safe: finished verdicts are already committed to the lock; only in-flight pairs are lost and the next run resumes them. Read the raw output \u2014 never pipe it through \`| grep\`, \`| head\`, or \`| tail\`: those silently drop lines and the count you act on stops matching the count the build enforces. The default \`yg check\` output is **grouped**: issues with the same rule are collapsed into one block (shared why+fix shown once, affected nodes listed beneath). When the output is still large, the SANCTIONED way to narrow it further is \`yg check --summary\` (per-node counts only) or \`yg check --top [N]\` (the N highest-priority GROUPS; bare \`--top\` shows just the single suggested-next group) \u2014 both always print the TRUE aggregate \`Errors (N)\`/\`Warnings (N)\` header and preserve the real exit code, so a narrowed view can never read as a clean build. To drill into one rule: \`yg check --aspect <id>\`. For the old ungrouped per-pair view: \`yg check --details\`. Orient with \`--summary\`/\`--top\`, then drill with \`--aspect\` or plain \`yg check\`. The reviewer already ran; the output is the return on that cost.
+Interrupting \`yg check --approve\` is safe: finished verdicts are already committed to the lock; only in-flight pairs are lost and the next run resumes them. Read the raw output \u2014 never pipe it through \`| grep\`, \`| head\`, or \`| tail\`: those silently drop lines and the count you act on stops matching the count the build enforces. The default \`yg check\` output is **grouped**: issues with the same rule are collapsed into one block (shared why+fix shown once, affected nodes listed beneath). When a rule's fix is NODE-SPECIFIC (the next command names the node \u2014 e.g. a per-node log entry, or declaring a dependency in one node's file), the block instead prints EACH affected node's own fix beneath its line, so following the block clears every node, not just the first. The triage and narrowing flags are READ-ONLY views over that same result and never combine with a fill flag (\`--approve\` / \`--only-deterministic\`). When the output is still large, the SANCTIONED way to narrow it further is \`yg check --summary\` (per-node counts only) or \`yg check --top [N]\` (the N highest-priority GROUPS; bare \`--top\` shows just the single suggested-next group) \u2014 both always print the TRUE aggregate \`Errors (N)\`/\`Warnings (N)\` header and preserve the real exit code, so a narrowed view can never read as a clean build. To drill into one rule: \`yg check --aspect <id>\`. For the old ungrouped per-pair view: \`yg check --details\`. Orient with \`--summary\`/\`--top\`, then drill with \`--aspect\` or plain \`yg check\`. The reviewer already ran; the output is the return on that cost.
 
 A draft aspect produces no expected pairs \u2014 nothing is verified, nothing recorded. Advisory refusals render as warnings (never block \`yg check\`); enforced refusals render as errors (block \`yg check\`). Verdicts survive status flips, including a \`draft\` round-trip: an entry for unchanged inputs stays valid when the aspect returns to enforced.
 
@@ -1440,7 +1451,7 @@ var PROVIDER_DEFAULTS = {
   "codex": { model: "o4-mini" },
   "gemini-cli": { model: "gemini-2.5-flash" }
 };
-async function parseConfig(filePath) {
+async function parseConfig(filePath, opts) {
   const filename = path4.basename(filePath);
   const content20 = await readFile4(filePath, "utf-8");
   const baseRaw = parseYaml3(content20);
@@ -1451,7 +1462,7 @@ async function parseConfig(filePath) {
       next: "restore the file from version control, or regenerate it via `yg init`"
     }, "config-invalid");
   }
-  const overlay = await loadConfigOverlay(path4.dirname(filePath));
+  const overlay = opts?.skipSecretsOverlay ? void 0 : await loadConfigOverlay(path4.dirname(filePath));
   const raw = overlay ? deepMerge(baseRaw, overlay) : baseRaw;
   const version = typeof raw.version === "string" ? raw.version.trim() : void 0;
   const qualityRaw = raw.quality;
@@ -2889,6 +2900,11 @@ async function parseArchitecture(filePath) {
   const nodeTypesObj = nodeTypesRaw ?? {};
   const nodeTypes = {};
   for (const [typeName, val] of Object.entries(nodeTypesObj)) {
+    if (typeName === "*") {
+      throw new Error(
+        `yg-architecture.yaml: node type name '*' is reserved \u2014 '*' is the any-target wildcard in relation lists and cannot be used as a node type name.`
+      );
+    }
     const entry = val;
     if (!entry || typeof entry !== "object" || typeof entry.description !== "string" || entry.description.trim() === "") {
       throw new Error(
@@ -2925,7 +2941,7 @@ async function parseArchitecture(filePath) {
       `yg-architecture.yaml: node_types.${typeName}.parents`,
       "parent type name"
     ) : void 0;
-    const relations = parseRelations2(entry.relations, typeName);
+    const { lists: relations, relationDefault } = parseRelations2(entry.relations, typeName);
     let logRequired;
     if (entry.log_required !== void 0) {
       if (typeof entry.log_required !== "boolean") {
@@ -2955,6 +2971,7 @@ async function parseArchitecture(filePath) {
       ...aspectStatus && { aspectStatus },
       parents: parents && parents.length > 0 ? parents : void 0,
       relations,
+      ...relationDefault !== void 0 && { relationDefault },
       ...logRequired !== void 0 && { log_required: logRequired },
       ...when !== void 0 && { when },
       ...enforce !== void 0 && { enforce }
@@ -2966,33 +2983,42 @@ async function parseArchitecture(filePath) {
 }
 function parseRelations2(relationsRaw, typeName) {
   if (relationsRaw === void 0) {
-    return void 0;
+    return { lists: void 0 };
   }
   if (typeof relationsRaw !== "object" || Array.isArray(relationsRaw)) {
     throw new Error(`yg-architecture.yaml: node_types.${typeName}.relations must be an object`);
   }
   const relations = {};
-  for (const [relType, targets] of Object.entries(relationsRaw)) {
-    if (!VALID_RELATION_TYPES.has(relType)) {
+  let relationDefault;
+  for (const [key, value] of Object.entries(relationsRaw)) {
+    if (key === "default") {
+      if (value !== "allow" && value !== "deny") {
+        throw new Error(
+          `yg-architecture.yaml: node_types.${typeName}.relations.default must be 'allow' or 'deny' (got: ${JSON.stringify(value)})`
+        );
+      }
+      relationDefault = value;
+      continue;
+    }
+    if (!VALID_RELATION_TYPES.has(key)) {
       throw new Error(
-        `yg-architecture.yaml: node_types.${typeName}.relations: unknown relation type '${relType}' (valid types: ${Array.from(VALID_RELATION_TYPES).join(", ")})`
+        `yg-architecture.yaml: node_types.${typeName}.relations: unknown relation type '${key}' (valid types: ${Array.from(VALID_RELATION_TYPES).join(", ")}; or 'default')`
       );
     }
-    if (!Array.isArray(targets)) {
+    if (!Array.isArray(value)) {
       throw new Error(
-        `yg-architecture.yaml: node_types.${typeName}.relations.${relType} must be an array`
+        `yg-architecture.yaml: node_types.${typeName}.relations.${key} must be an array`
       );
     }
     const targetStrings = assertStringArray(
-      targets,
-      `yg-architecture.yaml: node_types.${typeName}.relations.${relType}`,
+      value,
+      `yg-architecture.yaml: node_types.${typeName}.relations.${key}`,
       "target type name"
     );
-    if (targetStrings.length > 0) {
-      relations[relType] = targetStrings;
-    }
+    relations[key] = targetStrings;
   }
-  return Object.keys(relations).length > 0 ? relations : {};
+  const hasLists = Object.keys(relations).length > 0;
+  return { lists: hasLists ? relations : {}, relationDefault };
 }
 function assertStringArray(arr, fieldPath, itemLabel) {
   const offenders = arr.map((value, index) => ({ value, index })).filter((e) => typeof e.value !== "string");
@@ -3133,7 +3159,7 @@ async function loadGraph(projectRoot, options = {}) {
   let configErrorMessage;
   let config = FALLBACK_CONFIG;
   try {
-    config = await parseConfig(path9.join(yggRoot, "yg-config.yaml"));
+    config = await parseConfig(path9.join(yggRoot, "yg-config.yaml"), { skipSecretsOverlay: options.noSecrets });
   } catch (error) {
     if (error instanceof ConfigParseError) {
       configErrorMessage = error.messageData;
@@ -3322,7 +3348,8 @@ ${msg.next}`;
 }
 
 // src/io/lock-store.ts
-import { readFileSync, unlinkSync } from "fs";
+import { readFileSync, unlinkSync, existsSync as existsSync2 } from "fs";
+import { createHash } from "crypto";
 import path11 from "path";
 
 // src/model/lock.ts
@@ -3368,6 +3395,20 @@ function logsLockPath(yggRoot) {
 function detLockPath(yggRoot) {
   return path11.join(yggRoot, LOCK_DET_FILE_NAME);
 }
+function committedLockContentHash(yggRoot) {
+  const parts = [];
+  for (const file of [nondetLockPath(yggRoot), logsLockPath(yggRoot)]) {
+    if (!existsSync2(file)) continue;
+    try {
+      parts.push(readFileSync(file));
+    } catch {
+    }
+  }
+  if (parts.length === 0) return "";
+  const hash = createHash("sha256");
+  for (const p2 of parts) hash.update(p2);
+  return hash.digest("hex");
+}
 function recoveryNext(ctx) {
   if (ctx.committed) {
     return `restore the file from git (\`git checkout HEAD -- .yggdrasil/${ctx.fileName}\`), OR
@@ -3714,7 +3755,7 @@ import { rm as rm3, stat as stat3 } from "fs/promises";
 
 // src/migrations/split-lock.ts
 import path12 from "path";
-import { readdirSync, existsSync as existsSync2 } from "fs";
+import { readdirSync, existsSync as existsSync3 } from "fs";
 import { readFile as readFile10, writeFile as writeFile4, rm as rm2 } from "fs/promises";
 async function splitLock(yggRoot) {
   const legacy = readLegacyLock(yggRoot);
@@ -3732,7 +3773,7 @@ async function splitLock(yggRoot) {
 function scanDeterministicAspectIds(yggRoot) {
   const aspectsRoot = path12.join(yggRoot, "aspects");
   const ids = /* @__PURE__ */ new Set();
-  if (!existsSync2(aspectsRoot)) return ids;
+  if (!existsSync3(aspectsRoot)) return ids;
   const walk2 = (dir) => {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
       const full = path12.join(dir, entry.name);
@@ -3828,6 +3869,9 @@ async function ensureGitattributes(repoRoot) {
 var YGGDRASIL_GITIGNORE_LINES = [
   "yg-secrets.yaml",
   ".symbols-cache/",
+  // Content-addressed per-file AST fact cache: a local speed cache the relation pass rebuilds
+  // free on the next run; never committed.
+  ".ast-cache/",
   ".debug.log",
   // Deterministic-verdict lock: a local cache rebuilt for free by
   // `yg check --approve --only-deterministic`; never committed.
@@ -3857,6 +3901,13 @@ async function ensureYggdrasilGitignore(yggRoot) {
 }
 var API_PROVIDERS = ["anthropic", "openai", "google", "openai-compatible", "ollama"];
 var CLI_PROVIDERS = ["claude-code", "codex", "gemini-cli"];
+var ALL_PROVIDERS = [...CLI_PROVIDERS, ...API_PROVIDERS];
+var API_KEY_ENV = {
+  anthropic: "ANTHROPIC_API_KEY",
+  openai: "OPENAI_API_KEY",
+  google: "GOOGLE_API_KEY",
+  "openai-compatible": "OPENAI_API_KEY"
+};
 var CLAUDE_CODE_ALIASES = [
   { value: "haiku", label: "haiku" },
   { value: "sonnet", label: "sonnet" },
@@ -3951,15 +4002,16 @@ async function promptModelText(provider) {
 async function runReviewerConfigFlow() {
   const provider = await p.select({
     message: "Which provider should verify your code?",
+    initialValue: "claude-code",
     options: [
-      { value: "anthropic", label: "Anthropic", hint: "API \u2014 Claude models" },
-      { value: "openai", label: "OpenAI", hint: "API \u2014 GPT models" },
-      { value: "google", label: "Google", hint: "API \u2014 Gemini models" },
-      { value: "ollama", label: "Ollama", hint: "Local \u2014 no API costs" },
-      { value: "openai-compatible", label: "OpenAI-compatible", hint: "API \u2014 custom endpoint" },
-      { value: "claude-code", label: "Claude Code", hint: "CLI \u2014 uses installed claude" },
-      { value: "codex", label: "Codex", hint: "CLI \u2014 uses installed codex" },
-      { value: "gemini-cli", label: "Gemini CLI", hint: "CLI \u2014 uses installed gemini" }
+      { value: "claude-code", label: "Claude Code", hint: "CLI \u2014 free, no API key; uses installed claude" },
+      { value: "codex", label: "Codex", hint: "CLI \u2014 free, no API key; uses installed codex" },
+      { value: "gemini-cli", label: "Gemini CLI", hint: "CLI \u2014 free, no API key; uses installed gemini" },
+      { value: "ollama", label: "Ollama", hint: "Local \u2014 no API costs; needs a local install" },
+      { value: "anthropic", label: "Anthropic", hint: "API key \u2014 Claude models" },
+      { value: "openai", label: "OpenAI", hint: "API key \u2014 GPT models" },
+      { value: "google", label: "Google", hint: "API key \u2014 Gemini models" },
+      { value: "openai-compatible", label: "OpenAI-compatible", hint: "API key \u2014 custom endpoint" }
     ]
   });
   assertNotCancelled(provider);
@@ -4090,9 +4142,9 @@ async function freshInit(projectRoot) {
   const yggRoot = path14.join(projectRoot, ".yggdrasil");
   if (!isTTY()) {
     process.stderr.write(chalk2.red(`Error: ${buildIssueMessage({
-      what: "yg init requires an interactive terminal.",
-      why: "Setup requires interactive prompts to configure platform and reviewer.",
-      next: "Run yg init in an interactive terminal session."
+      what: "yg init requires an interactive terminal (no --provider given).",
+      why: "The interactive wizard needs prompts to configure platform and reviewer. Docker, devcontainer, and CI runs have no TTY.",
+      next: `Run yg init in an interactive terminal, OR bootstrap non-interactively: yg init --platform <name> --provider <name> [--model <m>] [--endpoint <url>]. Supported providers: ${ALL_PROVIDERS.join(", ")}.`
     })}
 `));
     process.exit(1);
@@ -4106,7 +4158,7 @@ async function freshInit(projectRoot) {
   const platform = await promptPlatform();
   p.log.step("Step 2: Reviewer provider");
   p.log.info(
-    "The reviewer checks your source code against aspect rules during yg check --approve.\n  API providers make HTTP calls. CLI providers delegate to an installed agent.\n  For local review without API costs, use Ollama."
+    "The reviewer checks your source code against aspect rules during yg check --approve.\n  If you already run an agent CLI (Claude Code, Codex, Gemini), pick it \u2014 the\n  reviewer then needs no API key and adds no separate API bill. Ollama runs\n  locally with no API cost. API providers (Anthropic, OpenAI, Google) need a key."
   );
   const reviewerConfig = await runReviewerConfigFlow();
   await createYggdrasilStructure(projectRoot, yggRoot, platform);
@@ -4126,6 +4178,54 @@ async function createYggdrasilStructure(projectRoot, yggRoot, platform) {
   await ensureYggdrasilGitignore(yggRoot);
   await installRulesForPlatform(projectRoot, platform);
 }
+async function freshInitNonInteractive(projectRoot, yggRoot, opts) {
+  const { platform, provider } = opts;
+  const model = opts.model?.trim();
+  if (!model) {
+    process.stderr.write(chalk2.red(`Error: ${buildIssueMessage({
+      what: "--model is required for non-interactive init.",
+      why: "Non-interactive init records the reviewer model verbatim and applies no default \u2014 the model must be named explicitly.",
+      next: `Re-run naming a model: yg init --platform ${platform} --provider ${provider} --model <name>.`
+    })}
+`));
+    process.exit(1);
+  }
+  let endpoint = opts.endpoint?.trim() || void 0;
+  if (needsEndpoint(provider) && !endpoint) {
+    if (provider === "ollama") {
+      endpoint = "http://localhost:11434";
+    } else {
+      process.stderr.write(chalk2.red(`Error: ${buildIssueMessage({
+        what: `--endpoint is required for provider '${provider}'.`,
+        why: "An OpenAI-compatible provider has no default base URL \u2014 the reviewer needs an endpoint to call.",
+        next: `Re-run naming an endpoint: yg init --platform ${platform} --provider ${provider} --model ${model} --endpoint <url>.`
+      })}
+`));
+      process.exit(1);
+    }
+  }
+  await createYggdrasilStructure(projectRoot, yggRoot, platform);
+  await writeReviewerConfig(yggRoot, { provider, model, endpoint });
+  if (needsApiKey(provider)) {
+    const envVar = API_KEY_ENV[provider];
+    const apiKey = (envVar ? process.env[envVar] : void 0)?.trim();
+    if (apiKey) {
+      await writeSecretsFile(yggRoot, apiKey);
+    } else {
+      process.stdout.write(chalk2.yellow(`${buildIssueMessage({
+        what: `No API key found${envVar ? ` in $${envVar}` : ""}; wrote the config without one.`,
+        why: "An API provider needs a key before the reviewer can run; init records the config anyway so setup is not blocked.",
+        next: `Set ${envVar ?? "the provider API key environment variable"} (or add the key to .yggdrasil/yg-secrets.yaml) before running yg check --approve.`
+      })}
+`));
+    }
+  }
+  await ensureGitattributes(projectRoot);
+  process.stdout.write(chalk2.green(
+    `Yggdrasil initialized (platform: ${platform}, provider: ${provider}, model: ${model}). Run yg check to get started.
+`
+  ));
+}
 async function runVersionUpgrade2(projectRoot, yggRoot, platform) {
   const { migrationActions, migrationWarnings, withheld } = await runVersionUpgrade({
     yggRoot,
@@ -4216,7 +4316,7 @@ async function existingInit(projectRoot) {
   }
 }
 function registerInitCommand(program2) {
-  program2.command("init").description("Initialize Yggdrasil graph in current project").option("--upgrade", "Non-interactive: refresh rules").option("--platform <name>", `Platform for rules file (${PLATFORMS.join(", ")})`).action(async (options) => {
+  program2.command("init").description("Initialize Yggdrasil graph in current project").option("--upgrade", "Non-interactive: refresh rules").option("--platform <name>", `Platform for rules file (${PLATFORMS.join(", ")})`).option("--provider <name>", `Non-interactive fresh init: reviewer provider (${ALL_PROVIDERS.join(", ")})`).option("--model <name>", "Non-interactive fresh init: reviewer model (required)").option("--endpoint <url>", "Non-interactive fresh init: reviewer endpoint (ollama / openai-compatible)").action(async (options) => {
     try {
       const projectRoot = process.cwd();
       const yggRoot = path14.join(projectRoot, ".yggdrasil");
@@ -4326,6 +4426,40 @@ function registerInitCommand(program2) {
       }
       if (exists) {
         await existingInit(projectRoot);
+      } else if (options.provider) {
+        if (!options.platform) {
+          process.stderr.write(chalk2.red(`Error: ${buildIssueMessage({
+            what: "--provider requires --platform for non-interactive init.",
+            why: "A fresh graph must install the rules file for a specific agent platform; there is no prompt to ask in non-interactive mode.",
+            next: `Pass --platform <name>. Supported: ${PLATFORMS.join(", ")}.`
+          })}
+`));
+          process.exit(1);
+        }
+        if (!PLATFORMS.includes(options.platform)) {
+          process.stderr.write(chalk2.red(`Error: ${buildIssueMessage({
+            what: `Unknown platform '${options.platform}'.`,
+            why: "The --platform value must match one of the supported agent platforms.",
+            next: `Use one of: ${PLATFORMS.join(", ")}`
+          })}
+`));
+          process.exit(1);
+        }
+        if (!ALL_PROVIDERS.includes(options.provider)) {
+          process.stderr.write(chalk2.red(`Error: ${buildIssueMessage({
+            what: `Unknown provider '${options.provider}'.`,
+            why: "The --provider value must match one of the supported reviewer providers.",
+            next: `Use one of: ${ALL_PROVIDERS.join(", ")}`
+          })}
+`));
+          process.exit(1);
+        }
+        await freshInitNonInteractive(projectRoot, yggRoot, {
+          platform: options.platform,
+          provider: options.provider,
+          model: options.model,
+          endpoint: options.endpoint
+        });
       } else {
         await freshInit(projectRoot);
       }
@@ -4658,6 +4792,15 @@ function attachmentMachineOrigin(att, node) {
       return `port:${att.port.name}@${att.port.target}`;
   }
 }
+function hasNonDraftEffectiveAspects(node, graph) {
+  const statuses = computeEffectiveAspectStatuses(node, graph);
+  for (const [aspectId, s] of statuses) {
+    if (s === "draft") continue;
+    if (isAggregateAspect(graph, aspectId)) continue;
+    return true;
+  }
+  return false;
+}
 function isAggregateAspect(graph, aspectId) {
   return graph.aspects.find((a) => a.id === aspectId)?.reviewer.type === "aggregate";
 }
@@ -4886,11 +5029,11 @@ function normPath(p2) {
 }
 function countDependents(graph, nodePath) {
   const paths = [];
-  for (const [path58, node] of graph.nodes) {
+  for (const [path62, node] of graph.nodes) {
     const hasRelation = (node.meta.relations ?? []).some(
       (r) => r.target === nodePath && (STRUCTURAL_RELATION_TYPES.has(r.type) || EVENT_RELATION_TYPES.has(r.type))
     );
-    if (hasRelation) paths.push(path58);
+    if (hasRelation) paths.push(path62);
   }
   return { count: paths.length, paths };
 }
@@ -5457,7 +5600,7 @@ function renderNode(node, indent, lines) {
 // src/io/hash.ts
 import { readFile as readFile14, readdir as readdir4, stat as stat6 } from "fs/promises";
 import path16 from "path";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { createRequire as createRequire2 } from "module";
 
 // src/io/repo-scanner.ts
@@ -5583,10 +5726,10 @@ function isIgnoredByStack2(candidatePath, stack) {
   return false;
 }
 function hashString(content20) {
-  return createHash("sha256").update(content20).digest("hex");
+  return createHash2("sha256").update(content20).digest("hex");
 }
 function hashBytes(bytes) {
-  return createHash("sha256").update(normalizeLineEndings(bytes)).digest("hex");
+  return createHash2("sha256").update(normalizeLineEndings(bytes)).digest("hex");
 }
 async function collectDirectoryFilePaths(directoryPath, rootDirectoryPath, options) {
   let stack = options.gitignoreStack ?? [];
@@ -5709,19 +5852,19 @@ function checkArchitectureParentCycles(graph) {
   const color = new Map(typeIds.map((id) => [id, WHITE]));
   const backEdges = /* @__PURE__ */ new Set();
   const recordedCycles = [];
-  function dfs(typeId, path58) {
+  function dfs(typeId, path62) {
     if (color.get(typeId) === GRAY) {
-      const cycleStart = path58.indexOf(typeId);
-      if (cycleStart !== -1) recordedCycles.push([...path58.slice(cycleStart), typeId]);
-      const from = path58[path58.length - 1];
+      const cycleStart = path62.indexOf(typeId);
+      if (cycleStart !== -1) recordedCycles.push([...path62.slice(cycleStart), typeId]);
+      const from = path62[path62.length - 1];
       if (from !== void 0) backEdges.add(`${from}->${typeId}`);
       return;
     }
     if (color.get(typeId) === BLACK) return;
     color.set(typeId, GRAY);
-    path58.push(typeId);
-    for (const parent of types[typeId]?.parents ?? []) dfs(parent, path58);
-    path58.pop();
+    path62.push(typeId);
+    for (const parent of types[typeId]?.parents ?? []) dfs(parent, path62);
+    path62.pop();
     color.set(typeId, BLACK);
   }
   for (const id of typeIds) {
@@ -5947,18 +6090,23 @@ function checkArchitectureRelations(graph) {
   const issues = [];
   for (const [nodePath, node] of graph.nodes) {
     const typeConfig = graph.architecture.node_types[node.meta.type];
-    if (!typeConfig?.relations || !node.meta.relations || node.meta.relations.length === 0) {
+    if (!typeConfig || !node.meta.relations || node.meta.relations.length === 0) {
+      continue;
+    }
+    const lists = typeConfig.relations;
+    const def = typeConfig.relationDefault ?? "allow";
+    if ((!lists || Object.keys(lists).length === 0) && def === "allow") {
       continue;
     }
     for (const rel of node.meta.relations) {
-      const allowedTypes = typeConfig.relations[rel.type];
-      if (!allowedTypes) continue;
+      const allowed = lists?.[rel.type];
       const target = graph.nodes.get(rel.target);
       if (!target) continue;
-      if (!allowedTypes.includes(target.meta.type)) {
+      if (allowed !== void 0) {
+        if (allowed.includes("*") || allowed.includes(target.meta.type)) continue;
         const msgData = {
           what: `Relation '${rel.type}' from '${nodePath}' to '${rel.target}' (type '${target.meta.type}') is not allowed by the architecture.`,
-          why: `Allowed targets for '${rel.type}' from type '${node.meta.type}': [${allowedTypes.join(", ")}]`,
+          why: `Allowed targets for '${rel.type}' from type '${node.meta.type}': [${allowed.join(", ")}]`,
           next: `Either change the relation type, change the target node's type, or update yg-architecture.yaml to allow this relation.`
         };
         issues.push({
@@ -5969,6 +6117,20 @@ function checkArchitectureRelations(graph) {
           ...issueMsg(msgData),
           messageData: msgData
         });
+      } else if (def === "deny") {
+        const msgData = {
+          what: `Relation '${rel.type}' from '${nodePath}' to '${rel.target}' (type '${target.meta.type}') is not allowed by the architecture.`,
+          why: `Type '${node.meta.type}' denies relation '${rel.type}' by default (relations.default: deny, and no allow-list entry permits this target).`,
+          next: `Open '${rel.type}' for type '${node.meta.type}' in yg-architecture.yaml (list target types, or ['*'] for any), change a node's type, or remove the relation.`
+        };
+        issues.push({
+          severity: "error",
+          code: "relation-target-forbidden",
+          rule: "invalid-relation-target",
+          nodePath,
+          ...issueMsg(msgData),
+          messageData: msgData
+        });
       }
     }
   }
@@ -7860,7 +8022,7 @@ async function computeSourceFingerprint(graph, nodePath) {
 }
 
 // src/core/log/log-gate.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import path22 from "path";
 
 // src/core/parsing/log-parser.ts
@@ -7956,7 +8118,7 @@ function computeLogBaselineFromContent(content20) {
   const prefix = bytes.subarray(0, newest.offsetEnd);
   return {
     last_entry_datetime: newest.datetime,
-    prefix_hash: createHash2("sha256").update(prefix).digest("hex")
+    prefix_hash: createHash3("sha256").update(prefix).digest("hex")
   };
 }
 
@@ -8184,11 +8346,11 @@ function registerTreeCommand(program2) {
       initDebugLog(graph.rootPath, graph.config.debug ?? false, appendToDebugLog);
       let roots;
       if (options.root?.trim()) {
-        const path58 = options.root.trim().replace(/\/$/, "");
-        const node = graph.nodes.get(path58);
+        const path62 = options.root.trim().replace(/\/$/, "");
+        const node = graph.nodes.get(path62);
         if (!node) {
           process.stderr.write(chalk4.red(buildIssueMessage({
-            what: `Node '${path58}' not found.`,
+            what: `Node '${path62}' not found.`,
             why: `The --root path must be a valid node path in the graph.`,
             next: `Run yg tree (no --root) to list all nodes, then pick a valid path.`
           }) + "\n"));
@@ -8399,14 +8561,14 @@ function buildTransitiveChains(targetNode, direct, allDependents, reverse) {
   }
   const chains = [];
   for (const node of transitiveOnly) {
-    const path58 = [];
+    const path62 = [];
     let current = node;
     while (current) {
-      path58.unshift(current);
+      path62.unshift(current);
       current = parent.get(current);
     }
-    if (path58.length >= 3) {
-      chains.push(path58.slice(1).map((p2) => `<- ${p2}`).join(" "));
+    if (path62.length >= 3) {
+      chains.push(path62.slice(1).map((p2) => `<- ${p2}`).join(" "));
     }
   }
   return chains.sort();
@@ -8438,14 +8600,14 @@ function collectIndirectDependents(graph, directlyAffected) {
     }
     for (const [node] of parent) {
       if (directSet.has(node)) continue;
-      const path58 = [node];
+      const path62 = [node];
       let current = node;
       while (parent.has(current)) {
         current = parent.get(current);
-        path58.push(current);
+        path62.push(current);
       }
-      const chain = path58.map((p2) => `<- ${p2}`).join(" ");
-      const depth = path58.length;
+      const chain = path62.map((p2) => `<- ${p2}`).join(" ");
+      const depth = path62.length;
       const existing = bestChain.get(node);
       if (!existing || depth < existing.depth) {
         bestChain.set(node, { chain, depth });
@@ -8546,14 +8708,14 @@ import { register } from "module";
 import { pathToFileURL } from "url";
 import path24 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 var __filename = fileURLToPath2(import.meta.url);
 var __dirname = path24.dirname(__filename);
 var registered = false;
 function ensureLoaderRegistered() {
   if (registered) return;
   let implPath = path24.resolve(__dirname, "./loader-hook-impl.js");
-  if (!existsSync3(implPath)) {
+  if (!existsSync4(implPath)) {
     const pkgRoot = path24.resolve(__dirname, "../../");
     implPath = path24.resolve(pkgRoot, "dist/loader-hook-impl.js");
   }
@@ -8565,9 +8727,9 @@ function ensureLoaderRegistered() {
 import * as fs from "fs";
 import * as path25 from "path";
 var UndeclaredFsReadError = class extends Error {
-  constructor(path58) {
-    super(`structure-aspect-undeclared-fs-read: ${path58}`);
-    this.path = path58;
+  constructor(path62) {
+    super(`structure-aspect-undeclared-fs-read: ${path62}`);
+    this.path = path62;
     this.name = "UndeclaredFsReadError";
   }
   path;
@@ -8770,7 +8932,11 @@ function createCtxGraph(params) {
   }
   return {
     node(id) {
-      assertAllowed(id);
+      const self = graph.nodes.get(currentNodePath);
+      if (self) recordGraphNode(self);
+      if (!allowed.has(id)) {
+        assertAllowed(id);
+      }
       const m = graph.nodes.get(id);
       if (!m) {
         if (recorder) recorder.recordGraphNodeAbsent(id);
@@ -8851,8 +9017,9 @@ import { parse as parseTomlSmol } from "smol-toml";
 import { Parser, Language } from "web-tree-sitter";
 import path27 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
 import { createRequire as createRequire3 } from "module";
+import { createHash as createHash4 } from "crypto";
 var _require = createRequire3(import.meta.url);
 var __filename2 = fileURLToPath3(import.meta.url);
 var __dirname2 = path27.dirname(__filename2);
@@ -8863,6 +9030,19 @@ var GRAMMAR_DIRS = [
 var initPromise = null;
 var langCache = /* @__PURE__ */ new Map();
 var parserCache = /* @__PURE__ */ new Map();
+var wasmHashCache = /* @__PURE__ */ new Map();
+function grammarWasmHash(extension) {
+  const cached = wasmHashCache.get(extension);
+  if (cached !== void 0) return cached;
+  const info = getGrammarForExtension(extension);
+  if (!info) {
+    throw new Error(`no grammar for extension '${extension}'`);
+  }
+  const wasmPath = resolveWasm(info.wasmFile, info.wasmPackage);
+  const hash = createHash4("sha256").update(readFileSync4(wasmPath)).digest("hex");
+  wasmHashCache.set(extension, hash);
+  return hash;
+}
 function init() {
   if (initPromise === null) {
     initPromise = Parser.init();
@@ -8875,12 +9055,12 @@ function init() {
 function resolveWasm(filename, pkg2) {
   for (const dir of GRAMMAR_DIRS) {
     const p2 = path27.join(dir, filename);
-    if (existsSync5(p2)) return p2;
+    if (existsSync6(p2)) return p2;
   }
   try {
     const pkgDir = path27.dirname(_require.resolve(`${pkg2}/package.json`));
     for (const candidate of [path27.join(pkgDir, filename), path27.join(pkgDir, "bindings/node", filename)]) {
-      if (existsSync5(candidate)) return candidate;
+      if (existsSync6(candidate)) return candidate;
     }
   } catch {
   }
@@ -10505,10 +10685,10 @@ function registerFlowsCommand(program2) {
 import chalk8 from "chalk";
 
 // src/core/check.ts
-import path44 from "path";
+import path43 from "path";
 
 // src/core/log-integrity.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var DATETIME_STRICT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{1,3}Z$/;
 function validateAppendOnly(currentContent, storedDatetime, storedPrefixHash) {
   if (!DATETIME_STRICT.test(storedDatetime)) {
@@ -10521,7 +10701,7 @@ function validateAppendOnly(currentContent, storedDatetime, storedPrefixHash) {
   if (!boundary) return { ok: false, reason: "boundary_missing" };
   const bytes = Buffer.from(currentContent, "utf-8");
   const prefix = bytes.subarray(0, boundary.offsetEnd);
-  const computed = createHash3("sha256").update(prefix).digest("hex");
+  const computed = createHash5("sha256").update(prefix).digest("hex");
   if (computed !== storedPrefixHash) return { ok: false, reason: "prefix_modified" };
   return { ok: true };
 }
@@ -11544,8 +11724,6 @@ import path33 from "path";
 import { readFile as readFile15 } from "fs/promises";
 
 // src/relations/symbol-table.ts
-import path32 from "path";
-import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
 var SymbolTable = class {
   defs = /* @__PURE__ */ new Map();
   // `${language}\0${symbolKey}` → set of defining files
@@ -11586,30 +11764,6 @@ var SymbolTable = class {
     return s ? [...s] : [];
   }
 };
-var SYMBOL_INDEX_VERSION = 3;
-function indexPath(cacheDir, language) {
-  return path32.join(cacheDir, `symbols-${language}.json`);
-}
-function canonBuiltFrom(b) {
-  return JSON.stringify([...b].sort((x, y) => x[0] < y[0] ? -1 : x[0] > y[0] ? 1 : 0));
-}
-async function writeSymbolIndex(cacheDir, language, idx) {
-  await atomicWriteFile(indexPath(cacheDir, language), JSON.stringify({ ...idx, version: SYMBOL_INDEX_VERSION }));
-}
-function loadSymbolIndex(cacheDir, language, currentBuiltFrom) {
-  const p2 = indexPath(cacheDir, language);
-  if (!existsSync6(p2)) return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync6(p2, "utf-8"));
-  } catch {
-    return null;
-  }
-  if (!parsed || !Array.isArray(parsed.builtFrom) || !Array.isArray(parsed.symbols)) return null;
-  if (parsed.version !== SYMBOL_INDEX_VERSION) return null;
-  if (canonBuiltFrom(parsed.builtFrom) !== canonBuiltFrom(currentBuiltFrom)) return null;
-  return parsed;
-}
 
 // src/relations/resolver.ts
 function resolveCandidateGroup(candidates2, resolver, fromFile, language) {
@@ -11841,82 +11995,35 @@ function buildUsingScope(file) {
   });
   return { prefixes, globalPrefixes, aliases, globalAliases, staticTargets };
 }
-function collectGlobalUsings(file) {
-  return buildUsingScope(file).globalPrefixes;
-}
-function collectGlobalUsingAliases(file) {
-  return [...buildUsingScope(file).globalAliases.entries()];
-}
 function enclosingNamespaceChain(fileNs, node) {
   const segments = [fileNs, blockNamespace(node)].filter((p2) => p2 !== "").join(".").split(".").filter((s) => s !== "");
   const chain = [];
   for (let i = segments.length; i >= 1; i--) chain.push(segments.slice(0, i).join("."));
   return chain;
 }
-function uses(file, options = {}) {
-  const out = [];
+function extractCsharpRefs(file) {
   const scope = buildUsingScope(file);
   const fileNs = fileScopedNamespace(file.tree.rootNode);
-  for (const [name, fqn] of options.projectGlobalUsingAliases ?? []) {
-    if (!scope.aliases.has(name)) scope.aliases.set(name, fqn);
-  }
-  const usingPrefixes = [
-    .../* @__PURE__ */ new Set([
-      ...scope.prefixes,
-      ...scope.globalPrefixes,
-      ...options.projectGlobalUsings ?? []
-    ])
-  ].sort();
-  const dedupKeys = (keys) => {
-    const seen = /* @__PURE__ */ new Set();
-    const out2 = [];
-    for (const k of keys) {
-      if (k === void 0 || k === "") continue;
-      if (seen.has(k)) continue;
-      seen.add(k);
-      out2.push(k);
-    }
-    return out2;
-  };
+  const refs = [];
+  const emitted = /* @__PURE__ */ new Set();
   const pushRef = (ref, node, line, rooted = false) => {
-    if (rooted) {
-      out.push({ candidates: [{ kind: "symbol", symbolKey: ref }], kind: "import", line });
-      return;
-    }
-    const lead = ref.split(".")[0];
-    const multi = ref.includes(".");
-    const aliasTarget = scope.aliases.get(lead);
-    const enclosing = enclosingNamespaceChain(fileNs, node).map((ns) => `${ns}.${ref}`);
-    const usingMembers = usingPrefixes.map((p2) => ({
-      symbolKey: `${p2}.${ref}`,
-      nestedOnly: multi
-    }));
-    const candidates2 = [];
-    const pushed = /* @__PURE__ */ new Set();
-    const add = (hint) => {
-      if (hint.kind === "symbol") {
-        if (pushed.has(hint.symbolKey)) return;
-        pushed.add(hint.symbolKey);
-      }
-      candidates2.push(hint);
-    };
-    if (aliasTarget !== void 0) {
-      const tail = ref.slice(lead.length);
-      const aliasKey = `${aliasTarget}${tail}`;
-      const coDef = dedupKeys([aliasKey, ...enclosing, ref]).map((k) => ({
-        symbolKey: k
-      }));
-      add({ kind: "symbol", symbolKey: aliasKey, set: coDef });
-    }
-    for (const k of enclosing) add({ kind: "symbol", symbolKey: k });
-    for (const m of usingMembers) {
-      add({ kind: "symbol", symbolKey: m.symbolKey, nestedOnly: m.nestedOnly, set: usingMembers });
-    }
-    add({ kind: "symbol", symbolKey: ref });
-    if (candidates2.length === 0) return;
-    out.push({ candidates: candidates2, kind: "import", line });
+    refs.push({
+      kind: "plain",
+      ref,
+      line,
+      rooted,
+      enclosingNs: enclosingNamespaceChain(fileNs, node)
+    });
+  };
+  const pushAttribute = (written, suffixed, node, line) => {
+    refs.push({
+      kind: "attr",
+      written,
+      suffixed,
+      line,
+      enclosingNs: enclosingNamespaceChain(fileNs, node)
+    });
   };
-  const emitted = /* @__PURE__ */ new Set();
   const emitTypeNode = (typeNode) => {
     if (typeNode === null) return;
     switch (typeNode.type) {
@@ -11943,15 +12050,15 @@ function uses(file, options = {}) {
           return;
         }
         if (aliasField !== null) {
-          const aliasFqn = scope.aliases.get(aliasField.text);
-          if (aliasFqn !== void 0) {
-            if (emitted.has(typeNode.id)) return;
-            emitted.add(typeNode.id);
-            const nameField = typeNode.childForFieldName("name");
-            if (nameField !== null) {
-              const tail = stripGlobalQualifier(nameField.text);
-              pushRef(`${aliasFqn}.${tail}`, typeNode, typeNode.startPosition.row + 1, true);
-            }
+          const nameField = typeNode.childForFieldName("name");
+          if (nameField !== null) {
+            refs.push({
+              kind: "alias",
+              aliasName: aliasField.text,
+              tail: stripGlobalQualifier(nameField.text),
+              line: typeNode.startPosition.row + 1,
+              enclosingNs: enclosingNamespaceChain(fileNs, typeNode)
+            });
           }
         }
         return;
@@ -11988,11 +12095,7 @@ function uses(file, options = {}) {
     return null;
   }
   for (const target of scope.staticTargets) {
-    out.push({
-      candidates: [{ kind: "symbol", symbolKey: target.fqn }],
-      kind: "import",
-      line: target.line
-    });
+    refs.push({ kind: "static", fqn: target.fqn, line: target.line });
   }
   walk(file.tree.rootNode, (node) => {
     if (node.type !== "using_directive") return void 0;
@@ -12120,10 +12223,75 @@ function uses(file, options = {}) {
     }
     return void 0;
   });
-  function pushAttribute(written, suffixed, node, line) {
+  return { fileNs, scope, refs };
+}
+function assembleCsharpCandidates(extract, options = {}) {
+  const out = [];
+  const { scope, refs } = extract;
+  const aliases = new Map(scope.aliases);
+  for (const [name, fqn] of options.projectGlobalUsingAliases ?? []) {
+    if (!aliases.has(name)) aliases.set(name, fqn);
+  }
+  const usingPrefixes = [
+    .../* @__PURE__ */ new Set([
+      ...scope.prefixes,
+      ...scope.globalPrefixes,
+      ...options.projectGlobalUsings ?? []
+    ])
+  ].sort();
+  const dedupKeys = (keys) => {
+    const seen = /* @__PURE__ */ new Set();
+    const out2 = [];
+    for (const k of keys) {
+      if (k === void 0 || k === "") continue;
+      if (seen.has(k)) continue;
+      seen.add(k);
+      out2.push(k);
+    }
+    return out2;
+  };
+  const pushRef = (ref, enclosingNs, line, rooted) => {
+    if (rooted) {
+      out.push({ candidates: [{ kind: "symbol", symbolKey: ref }], kind: "import", line });
+      return;
+    }
+    const lead = ref.split(".")[0];
+    const multi = ref.includes(".");
+    const aliasTarget = aliases.get(lead);
+    const enclosing = enclosingNs.map((ns) => `${ns}.${ref}`);
+    const usingMembers = usingPrefixes.map((p2) => ({
+      symbolKey: `${p2}.${ref}`,
+      nestedOnly: multi
+    }));
+    const candidates2 = [];
+    const pushed = /* @__PURE__ */ new Set();
+    const add = (hint) => {
+      if (hint.kind === "symbol") {
+        if (pushed.has(hint.symbolKey)) return;
+        pushed.add(hint.symbolKey);
+      }
+      candidates2.push(hint);
+    };
+    if (aliasTarget !== void 0) {
+      const tail = ref.slice(lead.length);
+      const aliasKey = `${aliasTarget}${tail}`;
+      const coDef = dedupKeys([aliasKey, ...enclosing, ref]).map((k) => ({
+        symbolKey: k
+      }));
+      add({ kind: "symbol", symbolKey: aliasKey, set: coDef });
+    }
+    for (const k of enclosing) add({ kind: "symbol", symbolKey: k });
+    for (const m of usingMembers) {
+      add({ kind: "symbol", symbolKey: m.symbolKey, nestedOnly: m.nestedOnly, set: usingMembers });
+    }
+    add({ kind: "symbol", symbolKey: ref });
+    if (candidates2.length === 0) return;
+    out.push({ candidates: candidates2, kind: "import", line });
+  };
+  const pushAttribute = (written, suffixed, enclosingNs, line) => {
     const before = out.length;
-    pushRef(written, node, line);
-    if (suffixed !== void 0) pushRef(suffixed, node, line);
+    pushRef(written, enclosingNs, line, false);
+    if (suffixed !== void 0) pushRef(suffixed, enclosingNs, line, false);
     if (out.length > before + 1) {
       const merged = [];
       const seenK = /* @__PURE__ */ new Set();
@@ -12138,31 +12306,142 @@ function uses(file, options = {}) {
       }
       out.push({ candidates: merged, kind: "import", line });
     }
+  };
+  for (const r of refs) {
+    switch (r.kind) {
+      case "static":
+        out.push({ candidates: [{ kind: "symbol", symbolKey: r.fqn }], kind: "import", line: r.line });
+        break;
+      case "plain":
+        pushRef(r.ref, r.enclosingNs, r.line, r.rooted);
+        break;
+      case "alias": {
+        const aliasFqn = aliases.get(r.aliasName);
+        if (aliasFqn !== void 0) {
+          pushRef(`${aliasFqn}.${r.tail}`, r.enclosingNs, r.line, true);
+        }
+        break;
+      }
+      case "attr":
+        pushAttribute(r.written, r.suffixed, r.enclosingNs, r.line);
+        break;
+    }
   }
   return out;
 }
-function csharpUses(file, options) {
-  return uses(file, options);
+function uses(file, options = {}) {
+  return assembleCsharpCandidates(extractCsharpRefs(file), options);
 }
 var csharpExtractor = {
   languages: /* @__PURE__ */ new Set(["csharp"]),
+  rev: 2,
   declarations,
   uses
 };
 
-// src/relations/verifier.ts
-function verifyNodeDeps(nodeId, deps, g) {
-  const out = [];
-  const declared = g.declaredTargets(nodeId);
-  for (const d of deps) {
-    const m = d.ownerNode;
-    if (m === nodeId) continue;
-    if (g.isAncestorOf(m, nodeId) || g.isAncestorOf(nodeId, m)) continue;
-    if (declared.has(m)) continue;
-    if (g.parentChain(m).some((anc) => declared.has(anc))) continue;
-    out.push({ fromFile: d.fromFile, line: d.line, ownerNode: m });
+// src/relations/facts-cache.ts
+import path32 from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { createHash as createHash6 } from "crypto";
+var CACHE_SCHEMA_VERSION = 1;
+function serializeCsharp(c) {
+  return {
+    fileNs: c.fileNs,
+    scope: {
+      prefixes: c.scope.prefixes,
+      globalPrefixes: c.scope.globalPrefixes,
+      aliases: [...c.scope.aliases],
+      globalAliases: [...c.scope.globalAliases],
+      staticTargets: c.scope.staticTargets
+    },
+    refs: c.refs
+  };
+}
+function deserializeCsharp(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const s = raw;
+  if (typeof s.fileNs !== "string") return null;
+  if (!s.scope || typeof s.scope !== "object") return null;
+  const sc = s.scope;
+  if (!Array.isArray(sc.prefixes) || !Array.isArray(sc.globalPrefixes) || !Array.isArray(sc.aliases) || !Array.isArray(sc.globalAliases) || !Array.isArray(sc.staticTargets)) {
+    return null;
   }
-  return out;
+  if (!Array.isArray(s.refs)) return null;
+  return {
+    fileNs: s.fileNs,
+    scope: {
+      prefixes: sc.prefixes,
+      globalPrefixes: sc.globalPrefixes,
+      aliases: new Map(sc.aliases),
+      globalAliases: new Map(sc.globalAliases),
+      staticTargets: sc.staticTargets
+    },
+    refs: s.refs
+  };
+}
+function astCacheDir(graphRoot) {
+  return path32.join(graphRoot, ".ast-cache");
+}
+function factsKey(args) {
+  const payload = `${args.contentHash}\0${args.language}\0${args.grammarHash}\0${args.rev}`;
+  return createHash6("sha256").update(payload).digest("hex").slice(0, 32);
+}
+function shardPath(dir, language, key) {
+  return path32.join(dir, `v${CACHE_SCHEMA_VERSION}`, language, `${key}.json`);
+}
+async function loadFacts(dir, language, key) {
+  const p2 = shardPath(dir, language, key);
+  if (!existsSync7(p2)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync7(p2, "utf-8"));
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || parsed.v !== CACHE_SCHEMA_VERSION) return null;
+  if (typeof parsed.key !== "string") return null;
+  if (!Array.isArray(parsed.declarations)) return null;
+  if (!Array.isArray(parsed.uses)) return null;
+  if (parsed.key !== key) return null;
+  const facts = {
+    declarations: parsed.declarations,
+    uses: parsed.uses
+  };
+  if (parsed.csharp !== void 0) {
+    const csharp = deserializeCsharp(parsed.csharp);
+    if (csharp === null) return null;
+    facts.csharp = csharp;
+  }
+  return facts;
+}
+async function writeFacts(dir, language, key, facts) {
+  const p2 = shardPath(dir, language, key);
+  if (existsSync7(p2)) return;
+  const body = {
+    v: CACHE_SCHEMA_VERSION,
+    key,
+    declarations: facts.declarations,
+    uses: facts.uses,
+    // Flatten the C# extract's `Map`s to entry arrays BEFORE JSON.stringify — a bare `Map`
+    // stringifies to `"{}"` and would silently lose every alias entry (the false-green vector).
+    ...facts.csharp !== void 0 ? { csharp: serializeCsharp(facts.csharp) } : {}
+  };
+  await atomicWriteFile(p2, JSON.stringify(body));
+}
+
+// src/relations/verifier.ts
+function verifyNodeDeps(nodeId, deps, g) {
+  const out = [];
+  const declared = g.declaredTargets(nodeId);
+  for (const d of deps) {
+    const m = d.ownerNode;
+    if (m === nodeId) continue;
+    if (g.isAncestorOf(m, nodeId) || g.isAncestorOf(nodeId, m)) continue;
+    if (declared.has(m)) continue;
+    if (g.parentChain(m).some((anc) => declared.has(anc))) continue;
+    out.push({ fromFile: d.fromFile, line: d.line, ownerNode: m });
+  }
+  return out;
 }
 
 // src/relations/pass.ts
@@ -12204,6 +12483,63 @@ async function runRelationPass(graph, projectRoot, deps) {
       return null;
     }
   }
+  async function extractFileFacts(record, extractor) {
+    const parsed = await parseSingle(record);
+    if (!parsed) return null;
+    try {
+      const declarations12 = extractor.declarations(parsed);
+      const isCsharp = record.language === "csharp";
+      const uses12 = isCsharp ? null : extractor.uses(parsed);
+      const csharp = isCsharp ? extractCsharpRefs(parsed) : null;
+      return { declarations: declarations12, uses: uses12, csharp };
+    } finally {
+      parsed.tree.delete();
+    }
+  }
+  const grammarHashByExt = /* @__PURE__ */ new Map();
+  const grammarHashForExt = (ext) => {
+    const hit = grammarHashByExt.get(ext);
+    if (hit !== void 0) return hit;
+    let h;
+    try {
+      h = grammarWasmHash(ext);
+    } catch {
+      h = null;
+    }
+    grammarHashByExt.set(ext, h);
+    return h;
+  };
+  async function loadOrExtractFacts(record, extractor) {
+    const language = record.language;
+    const isCsharp = language === "csharp";
+    const grammarHash = grammarHashForExt(path33.extname(record.path));
+    if (grammarHash === null) return extractFileFacts(record, extractor);
+    if (!deps.disableCache) {
+      const key = factsKey({
+        contentHash: record.hash,
+        language,
+        grammarHash,
+        rev: extractor.rev
+      });
+      const cached = await loadFacts(deps.symbolIndexDir, language, key);
+      if (cached && (!isCsharp || cached.csharp !== void 0)) {
+        return {
+          declarations: cached.declarations,
+          uses: isCsharp ? null : cached.uses,
+          csharp: isCsharp ? cached.csharp : null
+        };
+      }
+      const facts = await extractFileFacts(record, extractor);
+      if (!facts) return null;
+      await writeFacts(deps.symbolIndexDir, language, key, {
+        declarations: facts.declarations,
+        uses: facts.uses ?? [],
+        ...facts.csharp !== null ? { csharp: facts.csharp } : {}
+      });
+      return facts;
+    }
+    return extractFileFacts(record, extractor);
+  }
   const symbolTable = new SymbolTable();
   const recordsByLanguage = /* @__PURE__ */ new Map();
   for (const record of fileRecords) {
@@ -12216,42 +12552,31 @@ async function runRelationPass(graph, projectRoot, deps) {
     }
     list.push(record);
   }
+  const factsByPath = /* @__PURE__ */ new Map();
+  for (const record of fileRecords) {
+    if (!record.language) continue;
+    const extractor = deps.extractorFor(record.language);
+    if (!extractor) continue;
+    const facts = await loadOrExtractFacts(record, extractor);
+    if (facts) factsByPath.set(record.path, facts);
+  }
   for (const [language, records] of recordsByLanguage) {
-    const extractor = deps.extractorFor(language);
-    const builtFrom = records.map((r) => [r.path, r.hash]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
-    const cached = loadSymbolIndex(deps.symbolIndexDir, language, builtFrom);
-    if (cached) {
-      for (const [symbolKey, file] of cached.symbols) symbolTable.declare(language, symbolKey, file);
-      continue;
-    }
-    const symbols = [];
     for (const record of records) {
-      const parsed = await parseSingle(record);
-      if (!parsed) continue;
-      try {
-        for (const decl of extractor.declarations(parsed)) {
-          symbols.push([decl.symbolKey, record.path]);
-          symbolTable.declare(language, decl.symbolKey, record.path);
-        }
-      } finally {
-        parsed.tree.delete();
+      const facts = factsByPath.get(record.path);
+      if (!facts) continue;
+      for (const decl of facts.declarations) {
+        symbolTable.declare(language, decl.symbolKey, record.path);
       }
     }
-    const toPersist = { builtFrom, symbols };
-    await writeSymbolIndex(deps.symbolIndexDir, language, toPersist);
   }
   const csharpRecords = recordsByLanguage.get("csharp") ?? [];
   const projectGlobalUsings = /* @__PURE__ */ new Set();
   const projectGlobalUsingAliases = /* @__PURE__ */ new Map();
   for (const record of csharpRecords) {
-    const parsed = await parseSingle(record);
-    if (!parsed) continue;
-    try {
-      for (const prefix of collectGlobalUsings(parsed)) projectGlobalUsings.add(prefix);
-      for (const [name, fqn] of collectGlobalUsingAliases(parsed)) projectGlobalUsingAliases.set(name, fqn);
-    } finally {
-      parsed.tree.delete();
-    }
+    const facts = factsByPath.get(record.path);
+    if (!facts || facts.csharp === null) continue;
+    for (const prefix of facts.csharp.scope.globalPrefixes) projectGlobalUsings.add(prefix);
+    for (const [name, fqn] of facts.csharp.scope.globalAliases) projectGlobalUsingAliases.set(name, fqn);
   }
   const csharpGlobalUsings = [...projectGlobalUsings];
   const csharpGlobalUsingAliases = [...projectGlobalUsingAliases.entries()];
@@ -12278,6 +12603,15 @@ async function runRelationPass(graph, projectRoot, deps) {
     }
   };
   const violationsByNode = /* @__PURE__ */ new Map();
+  const detectedEdgesByNode = /* @__PURE__ */ new Map();
+  const resolveDetected = (record, detected, resolvedDeps) => {
+    for (const dep of detected) {
+      const ownerNode = resolveCandidateGroup(dep.candidates, resolver, record.path, record.language);
+      if (ownerNode !== void 0) {
+        resolvedDeps.push({ fromFile: record.path, line: dep.line, ownerNode });
+      }
+    }
+  };
   for (const [nodeId] of graph.nodes) {
     const records = fileRecords.filter((r) => r.nodeId === nodeId);
     if (records.length === 0) continue;
@@ -12286,23 +12620,28 @@ async function runRelationPass(graph, projectRoot, deps) {
       if (!record.language) continue;
       const extractor = deps.extractorFor(record.language);
       if (!extractor) continue;
-      const parsed = await parseSingle(record);
-      if (!parsed) continue;
-      try {
-        const detected = record.language === "csharp" ? csharpUses(parsed, {
+      if (record.language === "csharp") {
+        const facts2 = factsByPath.get(record.path);
+        if (!facts2 || facts2.csharp === null) continue;
+        const detected = assembleCsharpCandidates(facts2.csharp, {
           projectGlobalUsings: csharpGlobalUsings,
           projectGlobalUsingAliases: csharpGlobalUsingAliases
-        }) : extractor.uses(parsed);
-        for (const dep of detected) {
-          const ownerNode = resolveCandidateGroup(dep.candidates, resolver, record.path, record.language);
-          if (ownerNode !== void 0) {
-            resolvedDeps.push({ fromFile: record.path, line: dep.line, ownerNode });
-          }
-        }
-      } finally {
-        parsed.tree.delete();
+        });
+        resolveDetected(record, detected, resolvedDeps);
+        continue;
       }
+      const facts = factsByPath.get(record.path);
+      if (!facts || facts.uses === null) continue;
+      resolveDetected(record, facts.uses, resolvedDeps);
+    }
+    const edges = /* @__PURE__ */ new Set();
+    for (const d of resolvedDeps) {
+      const m = d.ownerNode;
+      if (m === nodeId) continue;
+      if (graphView.isAncestorOf(m, nodeId) || graphView.isAncestorOf(nodeId, m)) continue;
+      edges.add(m);
     }
+    if (edges.size > 0) detectedEdgesByNode.set(nodeId, edges);
     const violations = verifyNodeDeps(nodeId, resolvedDeps, graphView);
     if (violations.length) {
       const reason = violations.map((v) => `${v.fromFile}:${v.line} \u2192 undeclared dependency on ${v.ownerNode}`).join("\n");
@@ -12311,7 +12650,7 @@ async function runRelationPass(graph, projectRoot, deps) {
       violationsByNode.set(nodeId, { verdict: "approved", violations: [] });
     }
   }
-  return { violationsByNode };
+  return { violationsByNode, factsByPath, detectedEdgesByNode };
 }
 
 // src/relations/extractors/types.ts
@@ -12331,6 +12670,18 @@ function specifierFromStringNode(stringNode) {
 function specifierFromSource(node) {
   return specifierFromStringNode(node.childForFieldName("source"));
 }
+function specifierFromCallArg(arg) {
+  if (arg.type === "string") return specifierFromStringNode(arg);
+  if (arg.type !== "template_string") return void 0;
+  let fragment;
+  for (let i = 0; i < arg.namedChildCount; i++) {
+    const child = arg.namedChild(i);
+    if (child === null) continue;
+    if (child.type === "template_substitution") return void 0;
+    if (child.type === "string_fragment") fragment = child.text;
+  }
+  return fragment ?? "";
+}
 function isRelative(specifier) {
   return specifier.startsWith(".") || specifier.startsWith("/");
 }
@@ -12381,7 +12732,8 @@ function uses2(file) {
   const emit = (specifier, node) => {
     if (specifier === void 0 || specifier === "" || !isRelative(specifier)) return;
     const line = node.startPosition.row + 1;
-    const dedupKey = `${specifier}\0${line}`;
+    const dedupKey = `${specifier}
+${line}`;
     if (seen.has(dedupKey)) return;
     seen.add(dedupKey);
     out.push(single({ kind: "path", specifier }, "import", line));
@@ -12428,8 +12780,8 @@ function uses2(file) {
         const isRequire = fn.type === "identifier" && fn.text === "require";
         if (!isDynamicImport && !isRequire) break;
         const arg = firstArgument(node);
-        if (arg === null || arg.type !== "string") break;
-        emit(specifierFromStringNode(arg), node);
+        if (arg === null) break;
+        emit(specifierFromCallArg(arg), node);
         break;
       }
       default:
@@ -12470,6 +12822,7 @@ function declarations2(file) {
 }
 var typescriptExtractor = {
   languages: /* @__PURE__ */ new Set(["typescript", "tsx", "javascript"]),
+  rev: 1,
   declarations: declarations2,
   uses: uses2
 };
@@ -12575,6 +12928,7 @@ function declarations3(file) {
 }
 var pythonExtractor = {
   languages: /* @__PURE__ */ new Set(["python"]),
+  rev: 1,
   declarations: declarations3,
   uses: uses3
 };
@@ -12624,6 +12978,7 @@ function declarations4(file) {
 }
 var goExtractor = {
   languages: /* @__PURE__ */ new Set(["go"]),
+  rev: 1,
   declarations: declarations4,
   uses: uses4
 };
@@ -12795,6 +13150,7 @@ function declarations5(file) {
 }
 var javaExtractor = {
   languages: /* @__PURE__ */ new Set(["java"]),
+  rev: 3,
   declarations: declarations5,
   uses: uses5
 };
@@ -12923,6 +13279,7 @@ function declarations6(file) {
 }
 var phpExtractor = {
   languages: /* @__PURE__ */ new Set(["php"]),
+  rev: 1,
   declarations: declarations6,
   uses: uses6
 };
@@ -13047,6 +13404,7 @@ function declarations7(file) {
 }
 var kotlinExtractor = {
   languages: /* @__PURE__ */ new Set(["kotlin"]),
+  rev: 2,
   declarations: declarations7,
   uses: uses7
 };
@@ -13219,6 +13577,7 @@ function declarations8(file) {
 }
 var rustExtractor = {
   languages: /* @__PURE__ */ new Set(["rust"]),
+  rev: 1,
   declarations: declarations8,
   uses: uses8
 };
@@ -13312,6 +13671,7 @@ function functionName(def) {
 }
 var cExtractor = {
   languages: /* @__PURE__ */ new Set(["c"]),
+  rev: 1,
   declarations: declarations9,
   uses: uses9
 };
@@ -13356,6 +13716,7 @@ function functionName2(def) {
 }
 var cppExtractor = {
   languages: /* @__PURE__ */ new Set(["cpp"]),
+  rev: 1,
   declarations: declarations10,
   uses: uses10
 };
@@ -13526,6 +13887,7 @@ function declarations11(file) {
 }
 var rubyExtractor = {
   languages: /* @__PURE__ */ new Set(["ruby"]),
+  rev: 1,
   declarations: declarations11,
   uses: uses11
 };
@@ -13561,12 +13923,6 @@ function extractorForLanguage(language) {
   return byLanguage.get(language);
 }
 
-// src/relations/index-dir.ts
-import path34 from "path";
-function relationIndexDir(graphRootPath) {
-  return path34.join(graphRootPath, ".symbols-cache");
-}
-
 // src/relations/allowed-types.ts
 var RELATION_TYPES3 = [
   "uses",
@@ -13579,15 +13935,16 @@ var RELATION_TYPES3 = [
 function allowedRelationTypes(architecture, fromType, toType) {
   const fromConfig = architecture.node_types[fromType];
   if (!fromConfig) return [];
-  const relations = fromConfig.relations;
+  const lists = fromConfig.relations;
+  const def = fromConfig.relationDefault ?? "allow";
   const out = [];
   for (const rt of RELATION_TYPES3) {
-    const allowedTargets = relations?.[rt];
-    if (!allowedTargets) {
-      out.push(rt);
+    const allowedTargets = lists?.[rt];
+    if (allowedTargets === void 0) {
+      if (def === "allow") out.push(rt);
       continue;
     }
-    if (allowedTargets.includes(toType)) out.push(rt);
+    if (allowedTargets.includes("*") || allowedTargets.includes(toType)) out.push(rt);
   }
   return out;
 }
@@ -13631,15 +13988,15 @@ ${blocks.join("\n")}`
 }
 
 // src/relations/resolve-path.ts
-import path43 from "path";
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync3 } from "fs";
+import path42 from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
 
 // src/relations/extractors/typescript-resolve.ts
-import path35 from "path";
+import path34 from "path";
 function resolveTsPath(specifier, fromFile, exists) {
   if (!specifier.startsWith(".") && !specifier.startsWith("/")) return void 0;
-  const baseDir = path35.posix.dirname(toPosix3(fromFile));
-  const joined = path35.posix.normalize(path35.posix.join(baseDir, specifier));
+  const baseDir = path34.posix.dirname(toPosix3(fromFile));
+  const joined = path34.posix.normalize(path34.posix.join(baseDir, specifier));
   for (const cand of candidates(joined)) {
     if (exists(cand)) return cand;
   }
@@ -13647,7 +14004,7 @@ function resolveTsPath(specifier, fromFile, exists) {
 }
 function candidates(joined) {
   const out = [];
-  const ext = path35.posix.extname(joined);
+  const ext = path34.posix.extname(joined);
   const rewrites = {
     ".js": [".ts", ".tsx", ".js", ".jsx"],
     ".jsx": [".tsx", ".jsx"],
@@ -13662,7 +14019,7 @@ function candidates(joined) {
   } else {
     for (const e of [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]) out.push(joined + e);
   }
-  for (const e of [".ts", ".tsx", ".js", ".jsx"]) out.push(path35.posix.join(joined, "index" + e));
+  for (const e of [".ts", ".tsx", ".js", ".jsx"]) out.push(path34.posix.join(joined, "index" + e));
   return out;
 }
 function toPosix3(p2) {
@@ -13670,7 +14027,7 @@ function toPosix3(p2) {
 }
 
 // src/relations/extractors/python-resolve.ts
-import path36 from "path";
+import path35 from "path";
 function resolvePythonModule(specifier, fromFile, exists) {
   if (specifier.startsWith(".")) {
     return resolveRelative(specifier, fromFile, exists);
@@ -13683,7 +14040,7 @@ function resolveAbsolute(specifier, fromFile, exists) {
   const modulePath = segments.join("/");
   const parentPath = segments.slice(0, -1).join("/");
   const matches = /* @__PURE__ */ new Set();
-  for (const dir of ancestorDirs(path36.posix.dirname(toPosix4(fromFile)))) {
+  for (const dir of ancestorDirs(path35.posix.dirname(toPosix4(fromFile)))) {
     const candidates2 = [
       // module-as-file / package at this root
       joinUnder(dir, modulePath + ".py"),
@@ -13707,17 +14064,17 @@ function resolveRelative(specifier, fromFile, exists) {
   if (dotMatch === null) return void 0;
   const dots = dotMatch[0].length;
   const tail = specifier.slice(dots);
-  let base = path36.posix.dirname(toPosix4(fromFile));
+  let base = path35.posix.dirname(toPosix4(fromFile));
   for (let i = 0; i < dots - 1; i++) {
-    const parent = path36.posix.dirname(base);
+    const parent = path35.posix.dirname(base);
     if (parent === base) return void 0;
     base = parent;
   }
   const tailPath = tail.length > 0 ? tail.split(".").filter((s) => s.length > 0).join("/") : "";
-  const target = tailPath.length > 0 ? path36.posix.join(base, tailPath) : base;
-  const normalized = path36.posix.normalize(target);
+  const target = tailPath.length > 0 ? path35.posix.join(base, tailPath) : base;
+  const normalized = path35.posix.normalize(target);
   if (normalized.startsWith("..")) return void 0;
-  const candidates2 = tailPath.length > 0 ? [normalized + ".py", path36.posix.join(normalized, "__init__.py")] : [path36.posix.join(normalized, "__init__.py")];
+  const candidates2 = tailPath.length > 0 ? [normalized + ".py", path35.posix.join(normalized, "__init__.py")] : [path35.posix.join(normalized, "__init__.py")];
   for (const cand of candidates2) {
     if (exists(cand)) return cand;
   }
@@ -13729,20 +14086,20 @@ function ancestorDirs(dir) {
   for (; ; ) {
     out.push(cur);
     if (cur === "") break;
-    const parent = path36.posix.dirname(cur);
+    const parent = path35.posix.dirname(cur);
     cur = parent === "." ? "" : parent;
   }
   return out;
 }
 function joinUnder(dir, sub) {
-  return path36.posix.normalize(dir === "" ? sub : path36.posix.join(dir, sub));
+  return path35.posix.normalize(dir === "" ? sub : path35.posix.join(dir, sub));
 }
 function toPosix4(p2) {
   return p2.replace(/\\/g, "/");
 }
 
 // src/relations/extractors/go-resolve.ts
-import path37 from "path";
+import path36 from "path";
 function resolveGoImport(importPath, fromFile, deps) {
   const resolved = deps.modulePathFor(fromFile);
   if (resolved === void 0) return void 0;
@@ -13756,8 +14113,8 @@ function resolveGoImport(importPath, fromFile, deps) {
   } else {
     return void 0;
   }
-  const rel = remainder === "" ? moduleDir : moduleDir === "" ? remainder : path37.posix.join(moduleDir, remainder);
-  const repoRelDir = path37.posix.normalize(rel === "" ? "." : rel);
+  const rel = remainder === "" ? moduleDir : moduleDir === "" ? remainder : path36.posix.join(moduleDir, remainder);
+  const repoRelDir = path36.posix.normalize(rel === "" ? "." : rel);
   const cleanDir = repoRelDir === "." ? "" : repoRelDir;
   if (!deps.dirExists(cleanDir)) return void 0;
   const goFiles = deps.goFilesIn(cleanDir);
@@ -13785,7 +14142,7 @@ function resolveGoImport(importPath, fromFile, deps) {
 }
 
 // src/relations/extractors/java-resolve.ts
-import path38 from "path";
+import path37 from "path";
 function resolveJavaFqn(specifier, fromFile, deps) {
   const segments = specifier.split(".").filter((s) => s.length > 0);
   if (segments.length === 0) return void 0;
@@ -13795,7 +14152,7 @@ function resolveJavaPackageFiles(packageFqn2, fromFile, deps) {
   const segments = packageFqn2.split(".").filter((s) => s.length > 0);
   if (segments.length === 0) return [];
   const pkgDir = segments.join("/");
-  for (const dir of ancestorDirs2(path38.posix.dirname(toPosix5(fromFile)))) {
+  for (const dir of ancestorDirs2(path37.posix.dirname(toPosix5(fromFile)))) {
     const repoRelDir = joinUnder2(dir, pkgDir);
     const files = deps.javaFilesIn(repoRelDir);
     if (files.length > 0) return [...files].sort();
@@ -13805,7 +14162,7 @@ function resolveJavaPackageFiles(packageFqn2, fromFile, deps) {
 function resolveType(segments, fromFile, deps) {
   const typePath = segments.join("/") + ".java";
   const parentTypePath = segments.length >= 2 ? segments.slice(0, -1).join("/") + ".java" : void 0;
-  for (const dir of ancestorDirs2(path38.posix.dirname(toPosix5(fromFile)))) {
+  for (const dir of ancestorDirs2(path37.posix.dirname(toPosix5(fromFile)))) {
     const candidates2 = [joinUnder2(dir, typePath)];
     if (parentTypePath !== void 0) candidates2.push(joinUnder2(dir, parentTypePath));
     for (const cand of candidates2) {
@@ -13820,20 +14177,20 @@ function ancestorDirs2(dir) {
   for (; ; ) {
     out.push(cur);
     if (cur === "") break;
-    const parent = path38.posix.dirname(cur);
+    const parent = path37.posix.dirname(cur);
     cur = parent === "." ? "" : parent;
   }
   return out;
 }
 function joinUnder2(dir, sub) {
-  return path38.posix.normalize(dir === "" ? sub : path38.posix.join(dir, sub));
+  return path37.posix.normalize(dir === "" ? sub : path37.posix.join(dir, sub));
 }
 function toPosix5(p2) {
   return p2.replace(/\\/g, "/");
 }
 
 // src/relations/extractors/php-resolve.ts
-import path39 from "path";
+import path38 from "path";
 function resolvePhpFqn(specifier, fromFile, deps) {
   const fqn = specifier.startsWith("\\") ? specifier.slice(1) : specifier;
   if (fqn === "") return void 0;
@@ -13859,7 +14216,7 @@ function resolvePhpFqn(specifier, fromFile, deps) {
   return [...hits][0];
 }
 function joinUnder3(dir, sub) {
-  return path39.posix.normalize(dir === "" ? sub : path39.posix.join(dir, sub));
+  return path38.posix.normalize(dir === "" ? sub : path38.posix.join(dir, sub));
 }
 function parsePsr4(composerJsonText, composerDir) {
   const out = /* @__PURE__ */ new Map();
@@ -13897,19 +14254,19 @@ function parsePsr4(composerJsonText, composerDir) {
 function normalizeDir(value, composerDir) {
   const trimmed = value.replace(/\/+$/, "");
   if (trimmed === "" || trimmed === ".") return composerDir;
-  const joined = composerDir === "" ? trimmed : path39.posix.join(composerDir, trimmed);
-  const norm = path39.posix.normalize(joined);
+  const joined = composerDir === "" ? trimmed : path38.posix.join(composerDir, trimmed);
+  const norm = path38.posix.normalize(joined);
   return norm === "." ? "" : norm;
 }
 
 // src/relations/extractors/rust-resolve.ts
-import path40 from "path";
+import path39 from "path";
 function resolveRustPath(specifier, fromFile, exists, deps) {
   const segments = specifier.split("::").filter((s) => s.length > 0);
   if (segments.length === 0) return void 0;
   const root = segments[0];
   const rest = segments.slice(1);
-  const fromDir = path40.posix.dirname(toPosix6(fromFile));
+  const fromDir = path39.posix.dirname(toPosix6(fromFile));
   if (root === "super" || root === "self") {
     return resolveRelative2(root, segments, fromFile, exists, deps);
   }
@@ -13929,9 +14286,9 @@ function resolveRelative2(root, segments, fromFile, exists, deps) {
   if (crate === void 0) return void 0;
   const srcDir = crate.srcDir;
   const fromPosix = toPosix6(fromFile);
-  const fromDir = path40.posix.dirname(fromPosix);
-  const baseName = path40.posix.basename(fromPosix, ".rs");
-  let moduleDir = baseName === "mod" || baseName === "lib" || baseName === "main" ? fromDir : path40.posix.join(fromDir, baseName);
+  const fromDir = path39.posix.dirname(fromPosix);
+  const baseName = path39.posix.basename(fromPosix, ".rs");
+  let moduleDir = baseName === "mod" || baseName === "lib" || baseName === "main" ? fromDir : path39.posix.join(fromDir, baseName);
   let i = 0;
   for (; i < segments.length; i++) {
     const seg = segments[i];
@@ -13939,7 +14296,7 @@ function resolveRelative2(root, segments, fromFile, exists, deps) {
       continue;
     }
     if (seg === "super") {
-      const parent = path40.posix.dirname(moduleDir);
+      const parent = path39.posix.dirname(moduleDir);
       if (!withinSrc(parent, srcDir)) return void 0;
       moduleDir = parent;
       continue;
@@ -13971,13 +14328,13 @@ function resolveFromModuleDir(moduleDir, tail, exists) {
   return void 0;
 }
 function withinSrc(dir, srcDir) {
-  const d = path40.posix.normalize(dir);
-  const s = path40.posix.normalize(srcDir);
+  const d = path39.posix.normalize(dir);
+  const s = path39.posix.normalize(srcDir);
   if (s === "" || s === ".") return !d.startsWith("..");
   return d === s || d.startsWith(s + "/");
 }
 function joinUnder4(dir, sub) {
-  const joined = path40.posix.normalize(dir === "" ? sub : path40.posix.join(dir, sub));
+  const joined = path39.posix.normalize(dir === "" ? sub : path39.posix.join(dir, sub));
   if (joined.startsWith("..")) return void 0;
   return joined;
 }
@@ -13986,16 +14343,16 @@ function toPosix6(p2) {
 }
 
 // src/relations/extractors/include-resolve.ts
-import path41 from "path";
+import path40 from "path";
 function resolveIncludePath(headerPath, fromFile, exists) {
   if (headerPath === "") return void 0;
-  const fromDir = path41.posix.dirname(toPosix7(fromFile));
-  const relative3 = normalizeRepoRel(path41.posix.join(fromDir, headerPath));
+  const fromDir = path40.posix.dirname(toPosix7(fromFile));
+  const relative3 = normalizeRepoRel(path40.posix.join(fromDir, headerPath));
   if (relative3 !== void 0 && exists(relative3)) return relative3;
   return void 0;
 }
 function normalizeRepoRel(p2) {
-  const norm = path41.posix.normalize(p2);
+  const norm = path40.posix.normalize(p2);
   if (norm.startsWith("..")) return void 0;
   return norm;
 }
@@ -14004,13 +14361,13 @@ function toPosix7(p2) {
 }
 
 // src/relations/extractors/ruby-resolve.ts
-import path42 from "path";
+import path41 from "path";
 function resolveRubyRequireRelative(specifier, fromFile, exists) {
   if (specifier === "") return void 0;
-  const fromDir = path42.posix.dirname(toPosix8(fromFile));
+  const fromDir = path41.posix.dirname(toPosix8(fromFile));
   const withExt = /\.rb$/.test(specifier) ? specifier : `${specifier}.rb`;
-  const joined = path42.posix.join(fromDir, withExt);
-  const normalized = path42.posix.normalize(joined);
+  const joined = path41.posix.join(fromDir, withExt);
+  const normalized = path41.posix.normalize(joined);
   if (normalized.startsWith("..")) return void 0;
   return exists(normalized) ? normalized : void 0;
 }
@@ -14020,7 +14377,7 @@ function toPosix8(p2) {
 
 // src/relations/resolve-path.ts
 function makeResolvePathToFile(projectRoot, ownerOf) {
-  const exists = (repoRelPosix) => existsSync7(path43.resolve(projectRoot, repoRelPosix));
+  const exists = (repoRelPosix) => existsSync8(path42.resolve(projectRoot, repoRelPosix));
   const goDeps = makeGoResolveDeps(projectRoot, ownerOf);
   const javaDeps = makeJavaResolveDeps(projectRoot, exists);
   const phpDeps = makePhpResolveDeps(projectRoot, exists);
@@ -14068,10 +14425,10 @@ function makeResolvePathToFile(projectRoot, ownerOf) {
 function makeRustResolveDeps(projectRoot) {
   const byDir = /* @__PURE__ */ new Map();
   function readCrateName(repoRelDir) {
-    const abs = path43.join(projectRoot, repoRelDir, "Cargo.toml");
+    const abs = path42.join(projectRoot, repoRelDir, "Cargo.toml");
     let text2;
     try {
-      text2 = readFileSync7(abs, "utf-8");
+      text2 = readFileSync8(abs, "utf-8");
     } catch {
       return void 0;
     }
@@ -14089,14 +14446,14 @@ function makeRustResolveDeps(projectRoot) {
     return void 0;
   }
   function crateRootFor(fromFile) {
-    let dir = path43.posix.dirname(toPosix9(fromFile));
+    let dir = path42.posix.dirname(toPosix9(fromFile));
     if (dir === ".") dir = "";
     for (; ; ) {
       if (byDir.has(dir)) {
         const cached = byDir.get(dir);
         if (cached !== void 0) return cached;
-      } else if (existsSync7(path43.join(projectRoot, dir, "Cargo.toml"))) {
-        const srcDir = dir === "" ? "src" : path43.posix.join(dir, "src");
+      } else if (existsSync8(path42.join(projectRoot, dir, "Cargo.toml"))) {
+        const srcDir = dir === "" ? "src" : path42.posix.join(dir, "src");
         const entry = { srcDir, crateName: readCrateName(dir) };
         byDir.set(dir, entry);
         return entry;
@@ -14104,7 +14461,7 @@ function makeRustResolveDeps(projectRoot) {
         byDir.set(dir, void 0);
       }
       if (dir === "") return void 0;
-      const parent = path43.posix.dirname(dir);
+      const parent = path42.posix.dirname(dir);
       dir = parent === "." ? "" : parent;
     }
   }
@@ -14113,10 +14470,10 @@ function makeRustResolveDeps(projectRoot) {
 function makeGoResolveDeps(projectRoot, ownerOf) {
   const moduleByDir = /* @__PURE__ */ new Map();
   function readModulePath(repoRelDir) {
-    const abs = path43.join(projectRoot, repoRelDir, "go.mod");
+    const abs = path42.join(projectRoot, repoRelDir, "go.mod");
     let text2;
     try {
-      text2 = readFileSync7(abs, "utf-8");
+      text2 = readFileSync8(abs, "utf-8");
     } catch {
       return void 0;
     }
@@ -14129,24 +14486,24 @@ function makeGoResolveDeps(projectRoot, ownerOf) {
     return void 0;
   }
   function modulePathFor(fromFile) {
-    let dir = path43.posix.dirname(toPosix9(fromFile));
+    let dir = path42.posix.dirname(toPosix9(fromFile));
     if (dir === ".") dir = "";
     for (; ; ) {
       if (moduleByDir.has(dir)) {
         const cached = moduleByDir.get(dir);
         if (cached !== void 0) return { modulePath: cached, moduleDir: dir };
       } else {
-        const mod = existsSync7(path43.join(projectRoot, dir, "go.mod")) ? readModulePath(dir) : void 0;
+        const mod = existsSync8(path42.join(projectRoot, dir, "go.mod")) ? readModulePath(dir) : void 0;
         moduleByDir.set(dir, mod);
         if (mod !== void 0) return { modulePath: mod, moduleDir: dir };
       }
       if (dir === "") return void 0;
-      const parent = path43.posix.dirname(dir);
+      const parent = path42.posix.dirname(dir);
       dir = parent === "." ? "" : parent;
     }
   }
   function dirExists(repoRelDir) {
-    const abs = path43.resolve(projectRoot, repoRelDir);
+    const abs = path42.resolve(projectRoot, repoRelDir);
     try {
       return statSync3(abs).isDirectory();
     } catch {
@@ -14154,7 +14511,7 @@ function makeGoResolveDeps(projectRoot, ownerOf) {
     }
   }
   function goFilesIn(repoRelDir) {
-    const abs = path43.resolve(projectRoot, repoRelDir);
+    const abs = path42.resolve(projectRoot, repoRelDir);
     let entries;
     try {
       entries = readdirSync3(abs, { withFileTypes: true });
@@ -14164,7 +14521,7 @@ function makeGoResolveDeps(projectRoot, ownerOf) {
     const out = [];
     for (const e of entries) {
       if (e.isFile() && e.name.endsWith(".go")) {
-        out.push(repoRelDir === "" ? e.name : path43.posix.join(repoRelDir, e.name));
+        out.push(repoRelDir === "" ? e.name : path42.posix.join(repoRelDir, e.name));
       }
     }
     return out;
@@ -14173,7 +14530,7 @@ function makeGoResolveDeps(projectRoot, ownerOf) {
 }
 function makeJavaResolveDeps(projectRoot, exists) {
   function javaFilesIn(repoRelDir) {
-    const abs = path43.resolve(projectRoot, repoRelDir);
+    const abs = path42.resolve(projectRoot, repoRelDir);
     let entries;
     try {
       entries = readdirSync3(abs, { withFileTypes: true });
@@ -14183,7 +14540,7 @@ function makeJavaResolveDeps(projectRoot, exists) {
     const out = [];
     for (const e of entries) {
       if (e.isFile() && e.name.endsWith(".java")) {
-        out.push(repoRelDir === "" ? e.name : path43.posix.join(repoRelDir, e.name));
+        out.push(repoRelDir === "" ? e.name : path42.posix.join(repoRelDir, e.name));
       }
     }
     return out;
@@ -14193,23 +14550,23 @@ function makeJavaResolveDeps(projectRoot, exists) {
 function makePhpResolveDeps(projectRoot, exists) {
   const psr4ByDir = /* @__PURE__ */ new Map();
   function readPsr4(repoRelDir) {
-    const abs = path43.join(projectRoot, repoRelDir, "composer.json");
+    const abs = path42.join(projectRoot, repoRelDir, "composer.json");
     let text2;
     try {
-      text2 = readFileSync7(abs, "utf-8");
+      text2 = readFileSync8(abs, "utf-8");
     } catch {
       return /* @__PURE__ */ new Map();
     }
     return parsePsr4(text2, repoRelDir);
   }
   function psr4For(fromFile) {
-    let dir = path43.posix.dirname(toPosix9(fromFile));
+    let dir = path42.posix.dirname(toPosix9(fromFile));
     if (dir === ".") dir = "";
     for (; ; ) {
       if (psr4ByDir.has(dir)) {
         const cached = psr4ByDir.get(dir);
         if (cached !== void 0 && cached.size > 0) return cached;
-      } else if (existsSync7(path43.join(projectRoot, dir, "composer.json"))) {
+      } else if (existsSync8(path42.join(projectRoot, dir, "composer.json"))) {
         const map = readPsr4(dir);
         psr4ByDir.set(dir, map);
         if (map.size > 0) return map;
@@ -14217,7 +14574,7 @@ function makePhpResolveDeps(projectRoot, exists) {
         psr4ByDir.set(dir, /* @__PURE__ */ new Map());
       }
       if (dir === "") return /* @__PURE__ */ new Map();
-      const parent = path43.posix.dirname(dir);
+      const parent = path42.posix.dirname(dir);
       dir = parent === "." ? "" : parent;
     }
   }
@@ -14387,7 +14744,7 @@ function emitPairIssue(vp) {
 async function classifyLogStateFromLock(graph, projectRoot, lock, issues) {
   for (const [nodePath] of graph.nodes) {
     const logRel = `.yggdrasil/model/${nodePath}/log.md`;
-    const logAbs = path44.join(projectRoot, logRel);
+    const logAbs = path43.join(projectRoot, logRel);
     let logContent = null;
     try {
       logContent = await readTextFile(logAbs);
@@ -14472,8 +14829,8 @@ function scanUncoveredFiles(graph, gitTrackedFiles) {
     const paths = normalizeMappingPaths(node.meta.mapping);
     allMappings.push(...paths);
   }
-  const projectRoot = path44.dirname(graph.rootPath);
-  const yggPrefix = toPosixPath(path44.relative(projectRoot, graph.rootPath));
+  const projectRoot = path43.dirname(graph.rootPath);
+  const yggPrefix = toPosixPath(path43.relative(projectRoot, graph.rootPath));
   const uncovered = [];
   const tracked = excludeNestedGraphSubtrees(gitTrackedFiles);
   for (const file of tracked) {
@@ -14495,8 +14852,8 @@ async function scanGitignoredCoveredFiles(graph, gitTrackedFiles) {
       if (!isGlobPattern(raw)) directlyNamed.add(normalizeMappingPath(raw));
     }
   }
-  const projectRoot = path44.dirname(graph.rootPath);
-  const yggPrefix = toPosixPath(path44.relative(projectRoot, graph.rootPath));
+  const projectRoot = path43.dirname(graph.rootPath);
+  const yggPrefix = toPosixPath(path43.relative(projectRoot, graph.rootPath));
   let gitignoreStack;
   try {
     gitignoreStack = await loadRootGitignoreStack(projectRoot);
@@ -14514,7 +14871,7 @@ async function scanGitignoredCoveredFiles(graph, gitTrackedFiles) {
     if (directlyNamed.has(normalizeMappingPath(normalized))) continue;
     let ignored;
     try {
-      ignored = isIgnoredByStack(path44.join(projectRoot, normalized), gitignoreStack);
+      ignored = isIgnoredByStack(path43.join(projectRoot, normalized), gitignoreStack);
     } catch (err) {
       debugWrite(`[check] scanGitignoredCoveredFiles: isIgnoredByStack threw for ${normalized}: ${err.message}`);
       continue;
@@ -14537,7 +14894,7 @@ function buildGitignoredCoveredIssues(offending) {
   }));
 }
 async function runCheck(graph, gitTrackedFiles) {
-  const projectRoot = path44.dirname(graph.rootPath);
+  const projectRoot = path43.dirname(graph.rootPath);
   const validation = await validate(graph);
   const validationIssues = validation.issues.filter((vi) => vi.code).map((vi) => ({ ...vi, code: vi.code }));
   const lockIssues = [];
@@ -14560,7 +14917,9 @@ async function runCheck(graph, gitTrackedFiles) {
     const relResult = await runRelationPass(graph, projectRoot, {
       extractorFor: extractorForLanguage,
       resolvePathToFile: makeResolvePathToFile(projectRoot, buildOwnerIndex(graph.nodes).ownerOf),
-      symbolIndexDir: relationIndexDir(graph.rootPath)
+      // Repurposed field: now the content-addressed AST fact cache root (.ast-cache), the
+      // per-file parse cache that skips the tree-sitter re-parse of unchanged files.
+      symbolIndexDir: astCacheDir(graph.rootPath)
     });
     for (const [nodeId, nv] of relResult.violationsByNode) {
       if (nv.verdict !== "refused") continue;
@@ -14591,7 +14950,7 @@ async function runCheck(graph, gitTrackedFiles) {
   let coveredFiles = 0;
   let totalFiles = 0;
   if (gitTrackedFiles !== null) {
-    const yggPrefix = toPosixPath(path44.relative(projectRoot, graph.rootPath));
+    const yggPrefix = toPosixPath(path43.relative(projectRoot, graph.rootPath));
     const sourceFiles = excludeNestedGraphSubtrees(gitTrackedFiles).filter((f) => {
       const normalized = toPosixPath(f.trim());
       return !normalized.startsWith(yggPrefix + "/") && normalized !== yggPrefix;
@@ -14622,7 +14981,7 @@ async function runCheck(graph, gitTrackedFiles) {
   const advisoryWarnings = allIssues.filter((i) => i.code === "aspect-violation-advisory").length;
   const draftSkipped = countDraftAspectsAcrossGraph(graph);
   return {
-    projectName: path44.basename(projectRoot),
+    projectName: path43.basename(projectRoot),
     nodeCount: graph.nodes.size,
     nodeTypeCounts,
     aspectCount: graph.aspects.length,
@@ -14705,7 +15064,7 @@ function computeSuggestedNext(issues) {
 }
 
 // src/core/fill.ts
-import path47 from "path";
+import path46 from "path";
 
 // src/llm/api-utils.ts
 var ENV_VAR_MAP = {
@@ -15166,13 +15525,13 @@ var GeminiCliProvider = class extends CliAgentProvider {
 registerProvider("gemini-cli", (c) => new GeminiCliProvider({ model: c.model, timeout: c.timeout }));
 
 // src/core/fill-det.ts
-import path45 from "path";
+import path44 from "path";
 
 // src/core/fill-shared.ts
 async function readBytesOrEmpty(absPath) {
-  const { readFile: readFile20 } = await import("fs/promises");
+  const { readFile: readFile21 } = await import("fs/promises");
   try {
-    return await readFile20(absPath);
+    return await readFile21(absPath);
   } catch (e) {
     debugWrite(`[fill] readBytesOrEmpty failed for ${absPath}: ${e instanceof Error ? e.message : String(e)}`);
     return Buffer.alloc(0);
@@ -15181,7 +15540,7 @@ async function readBytesOrEmpty(absPath) {
 
 // src/core/fill-det.ts
 async function fillDetPair(graph, projectRoot, pair, aspect) {
-  const aspectDirAbs = path45.join(projectRoot, ".yggdrasil", "aspects", aspect.id);
+  const aspectDirAbs = path44.join(projectRoot, ".yggdrasil", "aspects", aspect.id);
   const fullMapping = await computeNodeMappedFiles(graph, pair.nodePath);
   const subjectScope = pair.subjectFiles.length < fullMapping.length ? pair.subjectFiles : void 0;
   const runOnce = async () => {
@@ -15222,7 +15581,7 @@ async function fillDetPair(graph, projectRoot, pair, aspect) {
   const observations = run.result.observations;
   const files = [];
   for (const rel of pair.subjectFiles) {
-    const abs = path45.resolve(projectRoot, rel);
+    const abs = path44.resolve(projectRoot, rel);
     const bytes = await readBytesOrEmpty(abs);
     files.push([rel, hashBytes(bytes)]);
   }
@@ -15254,7 +15613,7 @@ function detRuntimeNotice(aspectId, unitKey, reason) {
 }
 
 // src/core/fill-llm.ts
-import path46 from "path";
+import path45 from "path";
 
 // src/llm/aspect-verifier.ts
 async function verifyWithConsensus(provider, prompt, consensus) {
@@ -15283,14 +15642,14 @@ async function verifyWithConsensus(provider, prompt, consensus) {
 async function fillLlmPair(graph, projectRoot, pair, aspect, tier, tierName, mergedTier, provider, referencesCache) {
   const subjects = [];
   for (const rel of pair.subjectFiles) {
-    const bytes = await readBytesOrEmpty(path46.resolve(projectRoot, rel));
+    const bytes = await readBytesOrEmpty(path45.resolve(projectRoot, rel));
     subjects.push({ path: rel, bytes });
   }
   const refInputs = aspect.references ?? [];
   const referencesForHash = [];
   const referencesForPrompt = [];
   for (const ref of refInputs) {
-    const absRef = path46.resolve(projectRoot, ref.path);
+    const absRef = path45.resolve(projectRoot, ref.path);
     let bytes = referencesCache.get(absRef);
     if (bytes === void 0) {
       bytes = await readFileBytes(absRef);
@@ -15770,7 +16129,7 @@ async function runFill(graph, opts) {
   });
   const emitIssue = opts.emitIssue ?? (() => {
   });
-  const projectRoot = path47.dirname(graph.rootPath);
+  const projectRoot = path46.dirname(graph.rootPath);
   const onlyDeterministic = opts.onlyDeterministic ?? false;
   const dryRun = opts.dryRun ?? false;
   const isTTY2 = opts.isTTY ?? (process.stderr.isTTY ?? false);
@@ -16050,7 +16409,7 @@ async function runFill(graph, opts) {
 }
 
 // src/cli/check.ts
-import path48 from "path";
+import path47 from "path";
 
 // src/cli/group-issues.ts
 var CODE_ONLY_GROUP_CODES = /* @__PURE__ */ new Set(["unverified"]);
@@ -16112,6 +16471,8 @@ function groupIssues(issues) {
     const rep = sorted[0];
     const nodes = new Set(sorted.map((m) => m.nodePath ?? ""));
     const isCodeOnly = CODE_ONLY_GROUP_CODES.has(rep.code);
+    const distinctNext = new Set(sorted.map((m) => m.messageData.next ?? ""));
+    const distinctWhy = new Set(sorted.map((m) => m.messageData.why ?? ""));
     groups.push({
       code: rep.code,
       aspectId: isCodeOnly ? void 0 : rep.aspectId,
@@ -16122,6 +16483,8 @@ function groupIssues(issues) {
       sharedWhy: rep.messageData.why,
       sharedNext: rep.messageData.next,
       perMemberReason: FULL_WHAT_CODES.has(rep.code),
+      divergentNext: distinctNext.size > 1,
+      divergentWhy: distinctWhy.size > 1,
       members: sorted
     });
   }
@@ -16156,12 +16519,12 @@ function resolveApproveMode(opts, config) {
   return { approve: false, onlyDeterministic: false };
 }
 function registerCheckCommand(program2) {
-  program2.command("check").description("Unified graph gate \u2014 verification, coverage, completeness").option("--approve", "Fill every unverified pair (deterministic first, then LLM), then report").option("--no-approve", "Force read-only mode even when auto_approve is configured (overrides config)").option("--only-deterministic", "With --approve: fill ONLY deterministic pairs (keyless, free); committed locks stay untouched. For CI and pre-commit.").option("--dry-run", "With --approve: free cost preview \u2014 print the budget + per-node/per-aspect breakdown, then exit 0 WITHOUT writing anything or calling the reviewer.").option("--top [n]", "Read-only triage: print only the N highest-priority issue blocks (bare --top = just the single suggestedNext block). Header counts + exit code stay TRUE.").option("--summary", "Read-only triage: print per-node counts only (no per-issue blocks). Header counts + exit code stay TRUE.").option("--details", "Read-only: ungrouped, one block per issue (full per-pair detail). Opposite of the default grouped view.").option("--aspect <id>", "Read-only: drill into one rule \u2014 show only that aspect's issues, grouped, with the full per-node detail.").option("-q, --quiet", "Suppress --approve progress on stderr (only the final report + exit code). No-op with a plain read or --dry-run.").action(async (opts) => {
+  program2.command("check").description("Unified graph gate \u2014 verification, coverage, completeness").option("--approve", "Fill every unverified pair (deterministic first, then LLM), then report").option("--no-approve", "Force read-only mode even when auto_approve is configured (overrides config)").option("--only-deterministic", "With --approve: fill ONLY deterministic pairs (keyless, free); committed locks stay untouched. For CI and pre-commit.").option("--dry-run", "With --approve: free cost preview \u2014 print the budget + per-node/per-aspect breakdown, then exit 0 WITHOUT writing anything or calling the reviewer.").option("--top [n]", "Read-only triage: print only the N highest-priority issue blocks (bare --top = just the single suggestedNext block). Header counts + exit code stay TRUE.").option("--summary", "Read-only triage: print per-node counts only (no per-issue blocks). Header counts + exit code stay TRUE.").option("--details", "Read-only: ungrouped, one block per issue (full per-pair detail). Opposite of the default grouped view.").option("--aspect <id>", "Read-only: drill into one rule \u2014 show only that aspect's issues, grouped, with the full per-node detail.").option("-q, --quiet", "Suppress --approve progress on stderr (only the final report + exit code). No-op with a plain read; with --dry-run the budget preview still prints (--dry-run wins).").action(async (opts) => {
     try {
       const cwd = process.cwd();
       const graph = await loadGraphOrAbort(cwd, { tolerateInvalidConfig: true });
       initDebugLog(graph.rootPath, graph.config.debug ?? false, appendToDebugLog);
-      const projectRoot = path48.dirname(graph.rootPath);
+      const projectRoot = path47.dirname(graph.rootPath);
       const gitFiles = await walkRepoFiles(projectRoot);
       const wantsTop = opts.top !== void 0;
       if (wantsTop && opts.summary) {
@@ -16182,6 +16545,16 @@ function registerCheckCommand(program2) {
         await exitAfterFlush(1);
         return;
       }
+      if (opts.onlyDeterministic && (wantsTop || opts.summary || opts.details || opts.aspect !== void 0)) {
+        const viewFlag = wantsTop ? "--top" : opts.summary ? "--summary" : opts.details ? "--details" : "--aspect";
+        process.stderr.write(chalk8.red(`Error: ${buildIssueMessage({
+          what: `${viewFlag} cannot be combined with --only-deterministic.`,
+          why: `${viewFlag} is a READ-ONLY view of the plain \`yg check\` result (it narrows output and writes nothing). --only-deterministic is a FILL flag (it implies --approve, writing the deterministic verdict cache). Mixing a read-only view with the writer would silently drop the fill \u2014 the deterministic pairs would NOT be filled.`,
+          next: `Run: yg check ${viewFlag}${opts.aspect !== void 0 ? " <id>" : wantsTop ? " <n>" : ""} (read-only view), or yg check --approve --only-deterministic (deterministic fill).`
+        })}`) + "\n");
+        await exitAfterFlush(1);
+        return;
+      }
       if (opts.details && (wantsTop || opts.summary)) {
         process.stderr.write(chalk8.red(`Error: ${buildIssueMessage({
           what: "--details cannot be combined with --top or --summary.",
@@ -16229,6 +16602,18 @@ function registerCheckCommand(program2) {
           await exitAfterFlush(1);
           return;
         }
+        const knownAspectIds = (graph.aspects ?? []).map((a) => a.id);
+        if (!knownAspectIds.includes(opts.aspect)) {
+          const idList = knownAspectIds.slice().sort((a, b) => a.localeCompare(b, "en"));
+          const known = idList.length === 0 ? "The graph defines no aspects." : idList.length <= 30 ? `Known aspect ids: ${idList.join(", ")}.` : `The graph defines ${idList.length} aspects.`;
+          process.stderr.write(chalk8.red(`Error: ${buildIssueMessage({
+            what: `Unknown aspect '${opts.aspect}'.`,
+            why: `--aspect drills into ONE rule by its aspect id, but '${opts.aspect}' is not an aspect defined in this graph \u2014 so the filter would match nothing and render a misleading "0 of N errors" view. ${known}`,
+            next: "Run: yg aspects (list every aspect id), then yg check --aspect <id> with a real id; or yg check (full wall)."
+          })}`) + "\n");
+          await exitAfterFlush(1);
+          return;
+        }
       }
       let view = { kind: "full" };
       if (opts.aspect !== void 0) {
@@ -16274,9 +16659,9 @@ function registerCheckCommand(program2) {
             gitTrackedFiles: gitFiles,
             onlyDeterministic: mode.onlyDeterministic,
             dryRun: isDryRun,
-            write: isQuiet ? () => {
-            } : isDryRun ? (s) => {
+            write: isDryRun ? (s) => {
               process.stdout.write(s);
+            } : isQuiet ? () => {
             } : (s) => {
               process.stderr.write(s);
             },
@@ -16375,9 +16760,9 @@ function formatOutput(result, view = { kind: "full" }, autoFilled = false, emoji
       const nextCmd = firstFiltered.messageData.next.split("\n")[0];
       sections.push("");
       sections.push(`Next (this group): ${nextCmd}`);
+      sections.push("");
+      return sections.join("\n");
     }
-    sections.push("");
-    return sections.join("\n");
   } else if (view.kind === "details") {
     if (errors.length > 0) {
       sections.push("");
@@ -16618,12 +17003,23 @@ function glossLabel(label) {
 function renderGroup(group, lines, opts) {
   const aspectSeg = group.aspectId ? `  aspect '${group.aspectId}'` : "";
   lines.push(`  ${glossLabel(group.label)}  ${group.pairCount} pairs  ${group.nodeCount} nodes${aspectSeg}`);
-  if (group.sharedWhy) lines.push(`${BLOCK_INDENT}${group.sharedWhy}`);
-  if (group.sharedNext) {
+  if (group.sharedWhy && !group.divergentWhy) lines.push(`${BLOCK_INDENT}${group.sharedWhy}`);
+  if (group.sharedNext && !group.divergentNext) {
     const nextLines = group.sharedNext.split("\n");
     lines.push(`${BLOCK_INDENT}Fix: ${nextLines[0]}`);
     for (const extra of nextLines.slice(1)) lines.push(`${BLOCK_INDENT}${extra}`);
   }
+  const MEMBER_DETAIL_INDENT = `${BLOCK_INDENT}  `;
+  const emitDivergentDetail = (m) => {
+    if (group.divergentWhy && m.messageData.why) {
+      lines.push(`${MEMBER_DETAIL_INDENT}Why: ${m.messageData.why.split("\n")[0]}`);
+    }
+    if (group.divergentNext && m.messageData.next) {
+      const nextLines = m.messageData.next.split("\n");
+      lines.push(`${MEMBER_DETAIL_INDENT}Fix: ${nextLines[0]}`);
+      for (const extra of nextLines.slice(1)) lines.push(`${MEMBER_DETAIL_INDENT}${extra}`);
+    }
+  };
   const members = group.members;
   const truncate = opts.isTTY && members.length > CAP_NODES2;
   const shown = truncate ? members.slice(0, CAP_NODES2) : members;
@@ -16639,10 +17035,12 @@ function renderGroup(group, lines, opts) {
           lines.push(`${BLOCK_INDENT}  ${extra}`);
         }
       }
+      emitDivergentDetail(m);
     } else {
       const memberAspectSeg = group.aspectId === void 0 && m.aspectId !== void 0 ? `  aspect '${m.aspectId}'` : "";
       const whatSeg = !memberAspectSeg && m.messageData.what ? `  ${m.messageData.what.split("\n")[0]}` : "";
       lines.push(`${BLOCK_INDENT}- ${node}${memberAspectSeg || whatSeg}`);
+      emitDivergentDetail(m);
     }
   }
   if (truncate) {
@@ -16652,10 +17050,10 @@ function renderGroup(group, lines, opts) {
 }
 
 // src/cli/aspect-test.ts
-import path50 from "path";
+import path49 from "path";
 
 // src/ast/runner.ts
-import path49 from "path";
+import path48 from "path";
 import { readFile as readFile16 } from "fs/promises";
 import { pathToFileURL as pathToFileURL3 } from "url";
 var AstRunnerError = class extends Error {
@@ -16672,7 +17070,7 @@ ${data.next}`);
 };
 async function runAstAspect(params) {
   ensureLoaderRegistered();
-  const checkPath = path49.resolve(params.projectRoot, params.aspectDir, "check.mjs");
+  const checkPath = path48.resolve(params.projectRoot, params.aspectDir, "check.mjs");
   let mod;
   try {
     mod = await import(pathToFileURL3(checkPath).href);
@@ -16704,8 +17102,8 @@ async function runAstAspect(params) {
         sourceFiles.push({ path: f.path, content: cached.content, ast: cached.ast });
         continue;
       }
-      const content20 = await readFile16(path49.resolve(params.projectRoot, f.path), "utf-8");
-      if (getLanguageForExtension(path49.extname(f.path).toLowerCase()) === null) {
+      const content20 = await readFile16(path48.resolve(params.projectRoot, f.path), "utf-8");
+      if (getLanguageForExtension(path48.extname(f.path).toLowerCase()) === null) {
         sourceFiles.push({ path: f.path, content: content20, ast: void 0 });
         continue;
       }
@@ -16891,7 +17289,7 @@ function registerAspectTestCommand(program2) {
         process.exit(1);
         return;
       }
-      const aspectDir = path50.join(".yggdrasil", "aspects", aspect.id);
+      const aspectDir = path49.join(".yggdrasil", "aspects", aspect.id);
       if (hasNode) {
         const nodePath = opts.node.trim().replace(/\/$/, "");
         const node = graph.nodes.get(nodePath);
@@ -16951,12 +17349,17 @@ function registerAspectTestCommand(program2) {
       await exitAfterFlush(1);
     } catch (e) {
       debugWrite(`[aspect-test] run failed: ${e instanceof Error ? e.message : String(e)}`);
+      if (e instanceof StructureRunnerError || e instanceof AstRunnerError) {
+        process.stderr.write(buildIssueMessage(e.messageData) + "\n");
+        await exitAfterFlush(1);
+        return;
+      }
       abortOnUnexpectedError(e, "running aspect-test");
     }
   });
 }
 async function resolveCompanionsForTest(graph, projectRoot, pair, aspect) {
-  const aspectDirAbs = path50.join(projectRoot, ".yggdrasil", "aspects", aspect.id);
+  const aspectDirAbs = path49.join(projectRoot, ".yggdrasil", "aspects", aspect.id);
   const fullMapping = await computeNodeMappedFiles(graph, pair.nodePath);
   const subjectScope = pair.subjectFiles.length < fullMapping.length ? pair.subjectFiles : void 0;
   const run = await runCompanionHook({
@@ -17032,7 +17435,7 @@ async function runLlmAspectTest(graph, projectRoot, aspect, nodePath, dryRun) {
   const refInputs = aspect.references ?? [];
   const referencesForPrompt = [];
   for (const ref of refInputs) {
-    const absRef = path50.resolve(projectRoot, ref.path);
+    const absRef = path49.resolve(projectRoot, ref.path);
     let content20;
     try {
       content20 = await readTextFile(absRef);
@@ -17078,7 +17481,7 @@ async function runLlmAspectTest(graph, projectRoot, aspect, nodePath, dryRun) {
       for (const rel of pair.subjectFiles) {
         let content20;
         try {
-          const bytes = await import("fs/promises").then((fs5) => fs5.readFile(path50.resolve(projectRoot, rel)));
+          const bytes = await import("fs/promises").then((fs5) => fs5.readFile(path49.resolve(projectRoot, rel)));
           content20 = bytes.toString("utf8");
         } catch (e) {
           debugWrite(`[aspect-test] subject file read failed for ${rel} on ${pair.unitKey}: ${e instanceof Error ? e.message : String(e)}`);
@@ -17134,7 +17537,7 @@ async function runLlmAspectTest(graph, projectRoot, aspect, nodePath, dryRun) {
       for (const rel of pair.subjectFiles) {
         let content20;
         try {
-          const bytes = await import("fs/promises").then((fs5) => fs5.readFile(path50.resolve(projectRoot, rel)));
+          const bytes = await import("fs/promises").then((fs5) => fs5.readFile(path49.resolve(projectRoot, rel)));
           content20 = bytes.toString("utf8");
         } catch (e) {
           debugWrite(`[aspect-test] subject file read failed for ${rel} on ${pair.unitKey}: ${e instanceof Error ? e.message : String(e)}`);
@@ -17250,10 +17653,10 @@ function printStructureViolations(violations) {
 // src/cli/log.ts
 import chalk9 from "chalk";
 import { readFile as readFile18, stat as stat7 } from "fs/promises";
-import path54 from "path";
+import path53 from "path";
 
 // src/core/log/log-add.ts
-import path51 from "path";
+import path50 from "path";
 
 // src/utils/node-path-validator.ts
 function validateNodePath(raw) {
@@ -17366,7 +17769,7 @@ async function logAdd(input) {
       }
     };
   }
-  const logPath2 = path51.join(graph.rootPath, "model", nodePath, "log.md");
+  const logPath2 = path50.join(graph.rootPath, "model", nodePath, "log.md");
   const stats = await statLogFile(logPath2);
   if (stats !== null) {
     if (stats.isSymbolicLink) {
@@ -17435,7 +17838,7 @@ function reasonHasLevel2HeaderOutsideFence(reason) {
 }
 
 // src/core/log/log-read.ts
-import path52 from "path";
+import path51 from "path";
 var DEFAULT_TOP = 10;
 async function logRead(input) {
   const { graph } = input;
@@ -17481,7 +17884,7 @@ async function logRead(input) {
       }
     };
   }
-  const logPath2 = path52.join(graph.rootPath, "model", nodePath, "log.md");
+  const logPath2 = path51.join(graph.rootPath, "model", nodePath, "log.md");
   const content20 = await readLogSafe(logPath2);
   if (content20 === "") {
     return { ok: true, entries: [] };
@@ -17504,8 +17907,8 @@ async function logRead(input) {
 }
 
 // src/core/log/log-merge-resolve.ts
-import { createHash as createHash4 } from "crypto";
-import path53 from "path";
+import { createHash as createHash7 } from "crypto";
+import path52 from "path";
 
 // src/utils/git-introspect.ts
 import { exec } from "child_process";
@@ -17585,7 +17988,7 @@ async function logMergeResolve(input) {
       }
     };
   }
-  const logPath2 = path53.join(yggRoot, "model", nodePath, "log.md");
+  const logPath2 = path52.join(yggRoot, "model", nodePath, "log.md");
   let currentLog;
   try {
     currentLog = await readTextFile(logPath2);
@@ -17633,7 +18036,7 @@ async function logMergeResolve(input) {
   const p2New = parseLog(parent2Log).slice(ancestorEntries.length);
   const currentEntries = parseLog(currentLog);
   const currentNew = currentEntries.slice(ancestorEntries.length);
-  const entryKey = (e) => createHash4("sha256").update(`${e.datetime}
+  const entryKey = (e) => createHash7("sha256").update(`${e.datetime}
 ${e.body}`).digest("hex");
   const parentNew = [...p1New, ...p2New];
   const parentNewKeys = new Set(parentNew.map(entryKey));
@@ -17792,7 +18195,7 @@ ${entry.body}`);
   log2.command("merge-resolve").description("Reconcile log.md after a git merge (HEAD must be a merge commit)").requiredOption("--node <path>", "Node path (relative to .yggdrasil/model/)").action(async (opts) => {
     try {
       const graph = await loadGraphOrAbort(process.cwd(), { tolerateInvalidConfig: true });
-      const repoRoot = path54.dirname(graph.rootPath);
+      const repoRoot = path53.dirname(graph.rootPath);
       const nodePath = toPosix(opts.node.trim()).replace(/\/$/, "");
       const result = await logMergeResolve({ graph, nodePath, repoRoot });
       if (!result.ok) {
@@ -17817,15 +18220,15 @@ import chalk10 from "chalk";
 
 // src/io/find-index.ts
 import { readFile as readFile19, lstat as lstat3 } from "fs/promises";
-import path55 from "path";
+import path54 from "path";
 import MiniSearch from "minisearch";
 var MAX_BODY_BYTES = 1048576;
 async function buildIndex(graph) {
-  const projectRoot = path55.dirname(graph.rootPath);
+  const projectRoot = path54.dirname(graph.rootPath);
   const docs = [];
   for (const [nodePath, node] of graph.nodes) {
     const displayPath = `model/${nodePath}/`;
-    const logPath2 = path55.join(graph.rootPath, "model", nodePath, "log.md");
+    const logPath2 = path54.join(graph.rootPath, "model", nodePath, "log.md");
     let body = "";
     try {
       const st = await lstat3(logPath2);
@@ -17842,7 +18245,7 @@ This does not affect append-only integrity. No action required.
         }
         body = truncated;
       } else if (st.isSymbolicLink()) {
-        process.stderr.write(`Warning: skipping symlinked log.md at ${path55.relative(projectRoot, logPath2)}
+        process.stderr.write(`Warning: skipping symlinked log.md at ${path54.relative(projectRoot, logPath2)}
 `);
       } else {
       }
@@ -18010,18 +18413,18 @@ function registerFindCommand(program2) {
 
 // src/cli/type-suggest.ts
 import chalk11 from "chalk";
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 import { resolve as resolve5 } from "path";
 
 // src/core/type-classifier.ts
-import path56 from "path";
+import path55 from "path";
 async function classifyFile(absPath, repoRelPath, graph, cache) {
   const matches = [];
   const partialScores = [];
   const ctx = {
     absPath,
     repoRelPath,
-    projectRoot: path56.dirname(graph.rootPath),
+    projectRoot: path55.dirname(graph.rootPath),
     cache
   };
   for (const [typeId, def] of Object.entries(graph.architecture.node_types)) {
@@ -18077,7 +18480,7 @@ Type matching does not apply here.
     return;
   }
   const gitignoreStack = await loadRootGitignoreStack(projectRoot);
-  if (existsSync8(absPath) && isIgnoredByStack(absPath, gitignoreStack)) {
+  if (existsSync9(absPath) && isIgnoredByStack(absPath, gitignoreStack)) {
     process.stderr.write(
       chalk11.yellow(
         `
@@ -18089,7 +18492,7 @@ file-mapping-gitignored. Proceeding with classification for context.
       )
     );
   }
-  if (!existsSync8(absPath)) {
+  if (!existsSync9(absPath)) {
     process.stdout.write(`
 (File does not exist \u2014 evaluating path predicates only)
 
@@ -18317,6 +18720,10 @@ Examples:
 Plain (non-glob) entries remain unchanged: an exact file path or a directory
 prefix (e.g. \`src/handlers\`) covers that file or all files beneath it.
 
+## Allowed relations and default policy
+
+A node type may also set \`relations.default: deny\` to forbid every relation type it does not explicitly list (a sink), open a single relation type to any target with \`['*']\`, or forbid one with an empty list \`[]\`. An omitted \`default\` means allow.
+
 ## log_required \u2014 when to enable the log gate
 
 Each node type may set \`log_required\` (default \`false\`). When \`true\`, a node of
@@ -20552,7 +20959,8 @@ to the \`.yggdrasil/\` directory):
 
 \`\`\`
 yg-secrets.yaml      # provider API keys
-.symbols-cache/      # the relation pass's per-language symbol-index cache
+.symbols-cache/      # the relation pass's legacy per-language symbol-index cache
+.ast-cache/          # the relation pass's content-addressed per-file AST fact cache
 .debug.log           # the opt-in command debug log
 \`\`\`
 
@@ -21231,9 +21639,7 @@ Event relations must be paired: if A emits to B, B must declare a
 
 ## Architecture controls allowed relations
 
-\`yg-architecture.yaml\`'s allowed-relations configuration per type controls
-which relation types may target which node types. The validator rejects
-relations not permitted by the architecture.
+Architecture controls which relation types are allowed between which node types. By default a relation type is unconstrained \u2014 it may target any node type. A type constrains a relation type by listing its allowed targets (e.g. \`uses: [domain, data-access]\`); the validator then rejects any target not in that list. Three more controls let you lock a type down: \`default: deny\` makes every unlisted relation type target nothing (a sink); an empty list \`uses: []\` forbids that one relation type entirely; and the wildcard \`uses: ['*']\` opens a relation type to any target (useful under \`default: deny\`). An omitted \`default\` means allow, so existing graphs are unaffected.
 
 When a needed relation is not allowed by the architecture:
 1. Use a different relation type that IS allowed
@@ -22243,8 +22649,23 @@ node_types:
 
     parents: [<type-id>, ...]                # optional \u2014 allowed parent node types in the hierarchy.
 
-    relations:                               # optional \u2014 allowed relation targets by relation type.
-      <relation-type>: [<type-id>, ...]      # calls | uses | extends | implements | emits | listens
+    relations:                               # optional \u2014 per-relation-type allow-list.
+      # A relation type is constrained by listing its allowed target node types.
+      #   uses: [domain, data-access]   \u2192 only those target types
+      #   uses: ['*']                   \u2192 any target type
+      #   uses: []                      \u2192 no target (relation type forbidden)
+      #   (relation type omitted)       \u2192 governed by \`default\` below
+      # default: allow | deny           \u2192 policy for relation types NOT listed.
+      #   omitted \u21D2 allow (every unlisted relation type may target any type).
+      #   deny    \u21D2 unlisted relation types target nothing (a sink).
+      # Note: '*' is reserved as the any-target wildcard in relation lists and
+      #   must not be used as a node-type name (the parser rejects it).
+      # Examples:
+      #   { default: deny }                       \u2192 pure sink
+      #   { default: deny, listens: ['*'] }       \u2192 sink that may listen to anything
+      #   { default: allow, uses: [] }            \u2192 everything open except \`uses\`
+      uses: [<target-type>, ...]
+      default: allow
 `;
 
 // src/templates/schemas/config.ts
@@ -22423,9 +22844,12 @@ function registerSchemasCommand(program2) {
 }
 
 // src/cli/suppressions.ts
-import chalk14 from "chalk";
-import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
 import path57 from "path";
+
+// src/portal/api/suppress-scan.ts
+import { readFileSync as readFileSync9, existsSync as existsSync10 } from "fs";
+import path56 from "path";
+import chalk14 from "chalk";
 function isBinaryContent(buf) {
   const checkLen = Math.min(buf.length, 8192);
   for (let i = 0; i < checkLen; i++) {
@@ -22448,7 +22872,7 @@ function isNoiseFile(relFile) {
   return false;
 }
 async function scanMarkersForFile(relFile, text2) {
-  const ext = path57.extname(relFile).toLowerCase();
+  const ext = path56.extname(relFile).toLowerCase();
   if (getLanguageForExtension(ext) === null) {
     return scanSuppressionMarkers(text2);
   }
@@ -22470,11 +22894,11 @@ async function runSuppressionsScan(projectRoot, gitTrackedFiles, knownAspectIds)
   const openDisables = /* @__PURE__ */ new Map();
   for (const relFile of gitTrackedFiles) {
     if (isNoiseFile(relFile)) continue;
-    const absFile = path57.join(projectRoot, relFile);
-    if (!existsSync9(absFile)) continue;
+    const absFile = path56.join(projectRoot, relFile);
+    if (!existsSync10(absFile)) continue;
     let buf;
     try {
-      buf = readFileSync8(absFile);
+      buf = readFileSync9(absFile);
     } catch (error) {
       debugWrite(`[suppressions] read fallback: ${relFile}: ${error instanceof Error ? error.message : String(error)}`);
       continue;
@@ -22569,6 +22993,53 @@ function formatSuppressionsOutput(report2) {
   }
   return lines.join("\n") + "\n";
 }
+function scanPortalSuppressions(report2, knownAspectIds, draftAspectIds) {
+  const unboundedByFile = /* @__PURE__ */ new Map();
+  for (const { file, markers } of report2.fileEntries) {
+    const disableStack = /* @__PURE__ */ new Map();
+    for (const m of markers) {
+      if (m.kind === "disable") {
+        const stack = disableStack.get(m.aspectId) ?? [];
+        stack.push(m.line);
+        disableStack.set(m.aspectId, stack);
+      } else if (m.kind === "enable") {
+        const stack = disableStack.get(m.aspectId);
+        if (stack && stack.length > 0) {
+          stack.pop();
+          if (stack.length === 0) disableStack.delete(m.aspectId);
+        }
+      }
+    }
+    const open = /* @__PURE__ */ new Set();
+    for (const lines of disableStack.values()) for (const l of lines) open.add(l);
+    if (open.size > 0) unboundedByFile.set(file, open);
+  }
+  const out = [];
+  for (const { file, markers } of report2.fileEntries) {
+    const open = unboundedByFile.get(file);
+    for (const m of markers) {
+      if (m.kind === "enable") continue;
+      const risk = resolveRisk(m, file, open, knownAspectIds, draftAspectIds);
+      out.push({
+        file,
+        line: m.line,
+        aspectId: m.aspectId,
+        reason: m.reason,
+        ...risk ? { risk } : {}
+      });
+    }
+  }
+  return out;
+}
+function resolveRisk(m, file, openLines, knownAspectIds, draftAspectIds) {
+  if (m.wildcard) return "wildcard";
+  if (!knownAspectIds.has(m.aspectId)) return "typo";
+  if (draftAspectIds.has(m.aspectId)) return "inert";
+  if (m.kind === "disable" && openLines?.has(m.line)) return "unbounded";
+  return void 0;
+}
+
+// src/cli/suppressions.ts
 function registerSuppressionsCommand(program2) {
   program2.command("suppressions").description("Inventory active yg-suppress waivers and warn about footguns").action(async () => {
     try {
@@ -22586,14 +23057,1130 @@ function registerSuppressionsCommand(program2) {
   });
 }
 
-// src/bin.ts
-import { readFileSync as readFileSync9 } from "fs";
+// src/cli/portal.ts
+import { InvalidArgumentError as InvalidArgumentError2 } from "commander";
+import path61 from "path";
+
+// src/portal/engine-api.ts
+import { readFileSync as readFileSync10, existsSync as existsSync11 } from "fs";
+import path58 from "path";
+
+// src/portal/api/boundary.ts
+var STRUCTURAL_RELATIONS = ["calls", "uses", "extends", "implements"];
+function isAnyStructuralRelationAllowed(graph, sourceType, targetType) {
+  const typeConfig = graph.architecture?.node_types?.[sourceType];
+  if (!typeConfig) return true;
+  const lists = typeConfig.relations;
+  const def = typeConfig.relationDefault ?? "allow";
+  for (const relType of STRUCTURAL_RELATIONS) {
+    const allowed = lists?.[relType];
+    if (allowed !== void 0) {
+      if (allowed.includes("*") || allowed.includes(targetType)) return true;
+    } else if (def === "allow") {
+      return true;
+    }
+  }
+  return false;
+}
+function isLineage(a, b) {
+  return a === b || b.startsWith(a + "/") || a.startsWith(b + "/");
+}
+async function computePortalBoundary(graph, projectRoot) {
+  let pass;
+  try {
+    pass = await runRelationPass(graph, projectRoot, {
+      extractorFor: extractorForLanguage,
+      resolvePathToFile: makeResolvePathToFile(projectRoot, buildOwnerIndex(graph.nodes).ownerOf),
+      symbolIndexDir: astCacheDir(graph.rootPath)
+    });
+  } catch {
+    return null;
+  }
+  const phantom = [];
+  const declaredOnly = [];
+  const forbiddenType = [];
+  for (const [nodeId, nv] of pass.violationsByNode) {
+    if (nv.verdict !== "refused") continue;
+    const seen = /* @__PURE__ */ new Set();
+    for (const v of nv.violations) {
+      if (seen.has(v.ownerNode)) continue;
+      seen.add(v.ownerNode);
+      phantom.push({ source: nodeId, target: v.ownerNode });
+    }
+  }
+  const detected = pass.detectedEdgesByNode;
+  for (const [nodeId, node] of graph.nodes) {
+    const sourceType = node.meta.type;
+    const detectedTargets = detected.get(nodeId) ?? /* @__PURE__ */ new Set();
+    for (const rel of node.meta.relations ?? []) {
+      if (!STRUCTURAL_RELATIONS.includes(rel.type)) continue;
+      if (isLineage(nodeId, rel.target)) continue;
+      if (!graph.nodes.has(rel.target)) continue;
+      if (!detectedTargets.has(rel.target)) {
+        declaredOnly.push({ source: nodeId, target: rel.target });
+      }
+    }
+    for (const target of detectedTargets) {
+      const targetNode = graph.nodes.get(target);
+      if (!targetNode) continue;
+      if (!isAnyStructuralRelationAllowed(graph, sourceType, targetNode.meta.type)) {
+        forbiddenType.push({ source: nodeId, target });
+      }
+    }
+  }
+  return { phantom, declaredOnly, forbiddenType };
+}
+
+// src/portal/engine-api.ts
+var PORTAL_SCHEMA_SUPPORTED = CLI_SUPPORTED_SCHEMA;
+async function loadPortalGraph(projectRoot) {
+  return loadGraphOrAbort(projectRoot, {
+    tolerateInvalidConfig: true,
+    noSecrets: true
+  });
+}
+async function walkPortalFiles(projectRoot) {
+  return walkRepoFiles(projectRoot);
+}
+async function runPortalCheck(graph, gitFiles) {
+  return runCheck(graph, gitFiles);
+}
+function readAndVerifyLock(graph) {
+  const lock = readLock(graph.rootPath);
+  return { lock, verification: verifyLock(graph, lock) };
+}
+async function computePortalPairs(graph) {
+  return computeExpectedPairs(graph);
+}
+function scanPortalUncovered(graph, gitFiles) {
+  return scanUncoveredFiles(graph, gitFiles);
+}
+async function readNodeLog(projectRoot, nodePath) {
+  return readLogContent(projectRoot, nodePath);
+}
+function groupPortalIssues(issues) {
+  return groupIssues(issues);
+}
+async function computePortalBoundary2(graph, projectRoot) {
+  return computePortalBoundary(graph, projectRoot);
+}
+async function scanPortalSuppressions2(graph, projectRoot, gitFiles) {
+  const knownAspectIds = new Set(graph.aspects.map((a) => a.id));
+  const draftAspectIds = new Set(
+    graph.aspects.filter((a) => (a.status ?? "enforced") === "draft").map((a) => a.id)
+  );
+  const report2 = await runSuppressionsScan(projectRoot, gitFiles, knownAspectIds);
+  return scanPortalSuppressions(report2, knownAspectIds, draftAspectIds);
+}
+function computePortalLockHash(graph) {
+  return committedLockContentHash(graph.rootPath);
+}
+function readGitCommitRef(projectRoot) {
+  const gitDir = path58.join(projectRoot, ".git");
+  const headFile = path58.join(gitDir, "HEAD");
+  if (!existsSync11(headFile)) return null;
+  let head;
+  try {
+    head = readFileSync10(headFile, "utf-8").trim();
+  } catch {
+    return null;
+  }
+  if (/^[0-9a-f]{40}$/i.test(head)) return head;
+  const refMatch = head.match(/^ref:\s*(.+)$/);
+  if (!refMatch) return null;
+  const refName = refMatch[1].trim();
+  const looseRef = path58.join(gitDir, refName);
+  if (existsSync11(looseRef)) {
+    try {
+      const sha = readFileSync10(looseRef, "utf-8").trim();
+      if (/^[0-9a-f]{40}$/i.test(sha)) return sha;
+    } catch {
+    }
+  }
+  const packed = path58.join(gitDir, "packed-refs");
+  if (existsSync11(packed)) {
+    try {
+      const lines = readFileSync10(packed, "utf-8").split("\n");
+      for (const line of lines) {
+        const m = line.match(/^([0-9a-f]{40})\s+(.+)$/i);
+        if (m && m[2].trim() === refName) return m[1];
+      }
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+async function computePortalFreshness(graph, lock) {
+  const out = [];
+  for (const nodePath of graph.nodes.keys()) {
+    const stored = lock.nodes[nodePath]?.source;
+    if (stored === void 0) {
+      out.push({ nodePath, sourceChanged: false });
+      continue;
+    }
+    let fingerprint;
+    try {
+      fingerprint = await computeSourceFingerprint(graph, nodePath);
+    } catch {
+      out.push({ nodePath, sourceChanged: true });
+      continue;
+    }
+    if (fingerprint === void 0) {
+      out.push({ nodePath, sourceChanged: false });
+      continue;
+    }
+    out.push({ nodePath, sourceChanged: fingerprint !== stored });
+  }
+  return out;
+}
+
+// src/portal/derive-node-state.ts
+var PAIR_RANK = {
+  refused: 4,
+  unverified: 3,
+  warning: 2,
+  verified: 1,
+  "n/a": 0
+};
+function worstPairState(states) {
+  return states.reduce((worst, s) => PAIR_RANK[s] > PAIR_RANK[worst] ? s : worst, "verified");
+}
+var STATE_RANK = {
+  refused: 4,
+  unverified: 3,
+  warning: 2,
+  verified: 1,
+  "no-rule": 0
+};
+function computeOwnState(checked, effectiveAspects, nodeIssues, fresh) {
+  let worst = checked ? "verified" : "no-rule";
+  if (checked) {
+    for (const ea of effectiveAspects) {
+      if (ea.pairState === "refused" && STATE_RANK["refused"] > STATE_RANK[worst]) worst = "refused";
+      else if (ea.pairState === "unverified" && STATE_RANK["unverified"] > STATE_RANK[worst]) worst = "unverified";
+      else if (ea.pairState === "warning" && STATE_RANK["warning"] > STATE_RANK[worst]) worst = "warning";
+    }
+    const hasWarning = nodeIssues.some((i) => i.severity === "warning");
+    if (hasWarning && STATE_RANK["warning"] > STATE_RANK[worst]) worst = "warning";
+  }
+  if (fresh && STATE_RANK["unverified"] > STATE_RANK[worst]) worst = "unverified";
+  return worst;
+}
+function computeRollup(node, built) {
+  let worst = built.get(node.path).state;
+  for (const child of node.children) {
+    const childRollup = built.get(child.path)?.rollupState ?? "no-rule";
+    if (STATE_RANK[childRollup] > STATE_RANK[worst]) worst = childRollup;
+  }
+  return worst;
+}
+function collectNodeSuppressions(mapping, suppressions) {
+  const out = [];
+  const owned = new Set(mapping);
+  for (const file of owned) {
+    const hits = suppressions.byFile.get(file);
+    if (hits) out.push(...hits);
+  }
+  return out;
+}
+function computeNotApplicable(node, graph, effectiveIds) {
+  const attachedIds = /* @__PURE__ */ new Set();
+  for (const id of node.meta.aspects ?? []) attachedIds.add(id);
+  const typeDef = graph.architecture?.node_types?.[node.meta.type];
+  for (const id of typeDef?.aspects ?? []) attachedIds.add(id);
+  const out = [];
+  for (const id of [...attachedIds].sort()) {
+    if (effectiveIds.has(id)) continue;
+    out.push({ aspectId: id, why: "filtered out by a `when` predicate on this node" });
+  }
+  return out;
+}
+
+// src/portal/derive-nodes.ts
+function displayPairState(rawKind, status) {
+  if (rawKind === "verified") return "verified";
+  if (rawKind === "refused") return status === "advisory" ? "warning" : "refused";
+  return "unverified";
+}
+function buildPortalNodes(graph, _lock, verification, check, logContents, suppressions, freshByNode = /* @__PURE__ */ new Map()) {
+  const pairsByNode = indexPairsByNode(verification.pairs);
+  const issuesByNode = indexIssuesByNode(check.issues);
+  const relationsIn = invertRelations(graph);
+  const built = /* @__PURE__ */ new Map();
+  for (const [path62, node] of graph.nodes) {
+    built.set(
+      path62,
+      buildOne(
+        node,
+        graph,
+        pairsByNode,
+        issuesByNode,
+        relationsIn,
+        logContents,
+        suppressions,
+        freshByNode.get(path62) === true
+      )
+    );
+  }
+  for (const [path62, node] of graph.nodes) {
+    const portal = built.get(path62);
+    portal.rollupState = computeRollup(node, built);
+  }
+  return [...built.values()];
+}
+function indexPairsByNode(pairs) {
+  const out = /* @__PURE__ */ new Map();
+  for (const vp of pairs) {
+    const np = vp.pair.nodePath;
+    let byAspect = out.get(np);
+    if (!byAspect) {
+      byAspect = /* @__PURE__ */ new Map();
+      out.set(np, byAspect);
+    }
+    const list = byAspect.get(vp.pair.aspectId) ?? [];
+    list.push(toPairRecord(vp));
+    byAspect.set(vp.pair.aspectId, list);
+  }
+  return out;
+}
+function toPairRecord(vp) {
+  const subjectFiles = vp.pair.subjectFiles ?? [];
+  const state = displayPairState(vp.state.kind, vp.pair.status);
+  if (vp.state.kind === "refused") {
+    return { state, subjectFiles, reason: vp.state.reason };
+  }
+  return { state, subjectFiles };
+}
+function indexIssuesByNode(issues) {
+  const out = /* @__PURE__ */ new Map();
+  for (const i of issues) {
+    if (!i.nodePath) continue;
+    const list = out.get(i.nodePath) ?? [];
+    list.push(i);
+    out.set(i.nodePath, list);
+  }
+  return out;
+}
+function invertRelations(graph) {
+  const out = /* @__PURE__ */ new Map();
+  for (const [path62, node] of graph.nodes) {
+    for (const rel of node.meta.relations ?? []) {
+      const list = out.get(rel.target) ?? [];
+      list.push({ source: path62, type: rel.type });
+      out.set(rel.target, list);
+    }
+  }
+  return out;
+}
+function buildOne(node, graph, pairsByNode, issuesByNode, relationsIn, logContents, suppressions, fresh) {
+  const path62 = node.path;
+  const mapping = node.meta.mapping ?? [];
+  const effectiveIds = computeEffectiveAspects(node, graph);
+  const statuses = computeEffectiveAspectStatuses(node, graph);
+  const nodePairs = pairsByNode.get(path62);
+  const effectiveAspects = [];
+  for (const aspectId of [...effectiveIds].sort()) {
+    effectiveAspects.push(
+      buildEffectiveAspect(aspectId, node, graph, statuses, nodePairs)
+    );
+  }
+  const checked = effectiveAspects.some((ea) => ea.pairState !== "n/a");
+  const ownState = computeOwnState(
+    checked,
+    effectiveAspects,
+    issuesByNode.get(path62) ?? [],
+    fresh
+  );
+  const relationsOut = (node.meta.relations ?? []).map((r) => ({
+    target: r.target,
+    type: r.type,
+    ...r.consumes ? { consumes: r.consumes } : {}
+  }));
+  const log2 = parseLog(logContents.get(path62) ?? "").map((e) => ({
+    when: e.datetime,
+    body: e.body
+  }));
+  const nodeSuppressions = collectNodeSuppressions(mapping, suppressions);
+  const notApplicable = computeNotApplicable(node, graph, effectiveIds);
+  return {
+    path: path62,
+    name: node.meta.name,
+    type: node.meta.type,
+    ...node.meta.description ? { description: node.meta.description } : {},
+    parent: node.parent ? node.parent.path : null,
+    mapping,
+    sourceFileCount: mapping.length,
+    isTest: node.meta.type === "test-suite",
+    checked,
+    fresh,
+    state: ownState,
+    // Provisional — overwritten by the bottom-up roll-up pass; seeded to own state.
+    rollupState: ownState,
+    effectiveAspects,
+    notApplicable,
+    relationsOut,
+    relationsIn: relationsIn.get(path62) ?? [],
+    suppressions: nodeSuppressions,
+    log: log2
+  };
+}
+function buildEffectiveAspect(aspectId, node, graph, statuses, nodePairs) {
+  const def = graph.aspects.find((a) => a.id === aspectId);
+  const aggregate = isAggregateAspect(graph, aspectId);
+  const kind = aggregate ? "aggregate" : def?.reviewer.type === "deterministic" ? "deterministic" : "llm";
+  const sources = getAspectStatusSources(node, aspectId, graph);
+  const primary = sources.length > 0 ? sources.reduce((a, b) => a.channel <= b.channel ? a : b) : void 0;
+  const channel = primary?.channel ?? 7;
+  const origin = primary?.origin ?? impliedOrigin(graph, aspectId);
+  const status = statuses.get(aspectId) ?? "enforced";
+  let tier;
+  let consensus;
+  let cost = "free";
+  if (kind === "llm" && def) {
+    cost = "billed";
+    const reviewer = graph.config?.reviewer;
+    if (reviewer) {
+      const sel = selectTierForAspect(def, reviewer);
+      if (sel.ok) {
+        tier = sel.tierName;
+        consensus = sel.tier.consensus;
+      }
+    }
+  }
+  const records = nodePairs?.get(aspectId);
+  const pairState = aggregate || status === "draft" || !records || records.length === 0 ? "n/a" : worstPairState(records.map((r) => r.state));
+  let foldedInputs;
+  let reason;
+  if (!aggregate && status !== "draft" && records && records.length > 0) {
+    if (pairState === "verified") {
+      const files = /* @__PURE__ */ new Set();
+      for (const r of records) for (const f of r.subjectFiles) files.add(f);
+      const sorted = [...files].sort();
+      if (sorted.length > 0) foldedInputs = sorted;
+    } else if (pairState === "refused" || pairState === "warning") {
+      reason = records.find((r) => r.reason)?.reason;
+    }
+  }
+  return {
+    aspectId,
+    kind,
+    ...tier !== void 0 ? { tier } : {},
+    ...consensus !== void 0 ? { consensus } : {},
+    cost,
+    status,
+    channel,
+    origin,
+    pairState,
+    ...reason !== void 0 ? { reason } : {},
+    ...foldedInputs !== void 0 ? { foldedInputs } : {}
+  };
+}
+function impliedOrigin(graph, aspectId) {
+  for (const other of graph.aspects) {
+    if (other.implies?.includes(aspectId)) return `implied:${other.id}`;
+  }
+  return "unknown";
+}
+
+// src/portal/derive-catalogue.ts
+function buildAspects(graph, pairs) {
+  const byAspect = /* @__PURE__ */ new Map();
+  for (const vp of pairs) {
+    const list = byAspect.get(vp.pair.aspectId) ?? [];
+    list.push(collapsePairState(vp));
+    byAspect.set(vp.pair.aspectId, list);
+  }
+  return graph.aspects.map((def) => buildAspect(def, graph, byAspect.get(def.id) ?? [])).sort((a, b) => a.id.localeCompare(b.id, "en"));
+}
+function collapsePairState(vp) {
+  return displayPairState(vp.state.kind, vp.pair.status);
+}
+function buildAspect(def, graph, states) {
+  const kind = def.reviewer.type;
+  const status = def.status ?? "enforced";
+  const scope = def.scope?.per === "file" ? "file" : "node";
+  const ruleProse = def.artifacts.find((a) => a.filename === "content.md")?.content;
+  const checkSource = def.artifacts.find((a) => a.filename === "check.mjs")?.content;
+  return {
+    id: def.id,
+    name: def.name,
+    kind,
+    status,
+    scope,
+    hasWhen: def.when !== void 0,
+    implies: def.implies ?? [],
+    // Optional content fields assigned directly — an undefined value is omitted by the
+    // JSON.stringify embed, so no conditional spread is needed (and none is left half-covered).
+    description: def.description,
+    ruleProse,
+    checkSource,
+    tally: buildTally(def, graph, status, states)
+  };
+}
+function buildTally(def, graph, status, states) {
+  if (def.reviewer.type === "aggregate") {
+    return { render: "aggregate" };
+  }
+  if (states.length === 0) {
+    return { render: "vacuous", reason: vacuousReason(def, graph, status) };
+  }
+  let verified = 0;
+  let refused = 0;
+  let warning = 0;
+  let unverified = 0;
+  for (const s of states) {
+    if (s === "verified") verified += 1;
+    else if (s === "refused") refused += 1;
+    else if (s === "warning") warning += 1;
+    else unverified += 1;
+  }
+  return { render: "normal", verified, refused, warning, unverified, units: states.length };
+}
+function vacuousReason(def, graph, status) {
+  if ((status ?? "enforced") === "draft") {
+    return "draft \u2014 produces no expected pairs (parked, not yet enforced)";
+  }
+  const reachesANode = [...graph.nodes.values()].some(
+    (n) => computeEffectiveAspects(n, graph).has(def.id)
+  );
+  if (!reachesANode) {
+    return "not effective on any node \u2014 no attach channel reaches a node";
+  }
+  return "effective on a node but every subject set is empty (scope/when excludes all files, or no mapped source)";
+}
+function buildFlows(graph, nodeStateOf) {
+  return graph.flows.map((flow) => buildFlow(flow, graph, nodeStateOf)).sort((a, b) => a.name.localeCompare(b.name, "en"));
+}
+function buildFlow(flow, graph, nodeStateOf) {
+  const participants = expandParticipants(flow, graph);
+  const state = computeFlowState(participants, graph, nodeStateOf);
+  return {
+    name: flow.name,
+    ...flow.description ? { description: flow.description } : {},
+    participants,
+    aspects: flow.aspects ?? [],
+    state
+  };
+}
+function expandParticipants(flow, graph) {
+  const out = /* @__PURE__ */ new Set();
+  for (const path62 of flow.nodes) {
+    out.add(path62);
+    const node = graph.nodes.get(path62);
+    if (node) {
+      for (const d of collectDescendants(node)) out.add(d.path);
+    }
+  }
+  return [...out].sort((a, b) => a.localeCompare(b, "en"));
+}
+function computeFlowState(participants, graph, nodeStateOf) {
+  let anyChecked = false;
+  let anyAttention = false;
+  for (const path62 of participants) {
+    const node = graph.nodes.get(path62);
+    if (!node) continue;
+    if (!hasNonDraftEffectiveAspects(node, graph)) continue;
+    anyChecked = true;
+    const states = nodeStateOf(path62) ?? [];
+    if (states.some((s) => s === "refused" || s === "unverified")) anyAttention = true;
+  }
+  if (!anyChecked) return "nothing-checked";
+  return anyAttention ? "attention" : "verified";
+}
+function buildTypes(graph) {
+  const countByType = /* @__PURE__ */ new Map();
+  for (const node of graph.nodes.values()) {
+    countByType.set(node.meta.type, (countByType.get(node.meta.type) ?? 0) + 1);
+  }
+  const types = [];
+  for (const [id, def] of Object.entries(graph.architecture?.node_types ?? {})) {
+    const allowedRelations = {};
+    for (const [relType, targets] of Object.entries(def.relations ?? {})) {
+      allowedRelations[relType] = [...targets ?? []];
+    }
+    types.push({
+      id,
+      ...def.description ? { description: def.description } : {},
+      parents: def.parents ?? [],
+      allowedRelations,
+      defaultAspects: def.aspects ?? [],
+      strict: def.enforce === "strict",
+      logRequired: def.log_required === true,
+      nodeCount: countByType.get(id) ?? 0
+    });
+  }
+  return types.sort((a, b) => a.id.localeCompare(b.id, "en"));
+}
+
+// src/portal/derive-rest.ts
+function buildBoundary(input) {
+  if (input === null) {
+    return { phantom: [], declaredOnly: [], forbiddenType: [], unknown: true };
+  }
+  return {
+    phantom: dedupeEdges(input.phantom),
+    declaredOnly: dedupeEdges(input.declaredOnly),
+    forbiddenType: dedupeEdges(input.forbiddenType),
+    unknown: false
+  };
+}
+function dedupeEdges(edges) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const e of edges) {
+    const key = `${e.source}\0${e.target}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(e);
+  }
+  return out.sort((a, b) => a.source.localeCompare(b.source, "en") || a.target.localeCompare(b.target, "en"));
+}
+function buildSuppressions(markers) {
+  return markers.map((m) => ({
+    aspectId: m.aspectId,
+    file: m.file,
+    line: m.line,
+    reason: m.reason,
+    ...m.risk ? { risk: m.risk } : {}
+  })).sort((a, b) => a.file.localeCompare(b.file, "en") || a.line - b.line);
+}
+function buildHubs(nodes) {
+  const fanOut = [];
+  const fanIn = [];
+  for (const n of nodes) {
+    if (n.relationsOut.length > 0) fanOut.push({ path: n.path, count: n.relationsOut.length });
+    if (n.relationsIn.length > 0) fanIn.push({ path: n.path, count: n.relationsIn.length });
+  }
+  return { fanOut: rankHubs(fanOut), fanIn: rankHubs(fanIn) };
+}
+function rankHubs(entries) {
+  return entries.sort((a, b) => b.count - a.count || a.path.localeCompare(b.path, "en"));
+}
+function buildResidue(nodes, uncoveredFiles) {
+  const noRuleNodes = nodes.filter((n) => n.state === "no-rule" && n.mapping.length > 0).map((n) => n.path).sort((a, b) => a.localeCompare(b, "en"));
+  return {
+    noRuleNodes,
+    uncoveredFiles: [...uncoveredFiles].sort((a, b) => a.localeCompare(b, "en"))
+  };
+}
+function buildWorklist(check) {
+  const groups = groupPortalIssues(check.issues);
+  return groups.map((g) => ({
+    rule: g.label,
+    severity: g.severity,
+    why: g.sharedWhy,
+    fix: g.sharedNext,
+    nodes: [...new Set(g.members.map((m) => m.nodePath ?? "").filter((p2) => p2.length > 0))].sort(
+      (a, b) => a.localeCompare(b, "en")
+    )
+  }));
+}
+
+// src/portal/extract.ts
+async function extractPortalData(projectRoot, opts) {
+  const graph = await loadPortalGraph(projectRoot);
+  const gitFiles = await walkPortalFiles(projectRoot);
+  const checkResult = await runPortalCheck(graph, gitFiles);
+  const { lock, verification: verificationPromise } = readAndVerifyLock(graph);
+  const verification = await verificationPromise;
+  const expected = await computePortalPairs(graph);
+  const counts = buildCounts(graph, checkResult, verification.pairs, expected.pairs);
+  const logContents = /* @__PURE__ */ new Map();
+  for (const nodePath of graph.nodes.keys()) {
+    logContents.set(nodePath, await readNodeLog(projectRoot, nodePath));
+  }
+  const suppressionMarkers = await scanPortalSuppressions2(graph, projectRoot, gitFiles);
+  const flatSuppressions = buildSuppressions(suppressionMarkers);
+  const suppressions = indexSuppressionsByFile(flatSuppressions);
+  const freshnessMarkers = await computePortalFreshness(graph, lock);
+  const freshByNode = /* @__PURE__ */ new Map();
+  for (const m of freshnessMarkers) freshByNode.set(m.nodePath, m.sourceChanged);
+  const nodes = buildPortalNodes(graph, lock, verification, checkResult, logContents, suppressions, freshByNode);
+  const pairStatesByNode = /* @__PURE__ */ new Map();
+  for (const vp of verification.pairs) {
+    const list = pairStatesByNode.get(vp.pair.nodePath) ?? [];
+    list.push(collapsePairState2(vp));
+    pairStatesByNode.set(vp.pair.nodePath, list);
+  }
+  const aspects = buildAspects(graph, verification.pairs);
+  const flows = buildFlows(graph, (path62) => pairStatesByNode.get(path62));
+  const types = buildTypes(graph);
+  const hubs = buildHubs(nodes);
+  const uncovered = scanPortalUncovered(graph, gitFiles);
+  const residue = buildResidue(nodes, uncovered);
+  const worklist = buildWorklist(checkResult);
+  counts.suppressed = flatSuppressions.length;
+  counts.noRule = residue.noRuleNodes.length;
+  counts.notApplicable = nodes.reduce((sum, n) => sum + n.notApplicable.length, 0);
+  const boundary = buildBoundary(await computePortalBoundary2(graph, projectRoot));
+  const lockHash = computePortalLockHash(graph);
+  const commitRef = readGitCommitRef(projectRoot);
+  const data = {
+    meta: {
+      projectName: checkResult.projectName,
+      generatedAt: "",
+      // stamped below, after generation
+      autoApprove: normalizeAutoApprove(graph.config.auto_approve),
+      writeEnabled: opts.writeEnabled,
+      schemaSupported: PORTAL_SCHEMA_SUPPORTED,
+      lockHash,
+      commitRef,
+      counts
+    },
+    nodes,
+    aspects,
+    flows,
+    types,
+    boundary,
+    suppressions: flatSuppressions,
+    hubs,
+    worklist,
+    residue
+  };
+  data.meta.generatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  return data;
+}
+function normalizeAutoApprove(value) {
+  if (value === "deterministic" || value === "full") return value;
+  return "false";
+}
+function collapsePairState2(vp) {
+  return displayPairState(vp.state.kind, vp.pair.status);
+}
+function indexSuppressionsByFile(flat) {
+  const byFile = /* @__PURE__ */ new Map();
+  for (const s of flat) {
+    const list = byFile.get(s.file) ?? [];
+    list.push(s);
+    byFile.set(s.file, list);
+  }
+  return { byFile };
+}
+function buildCounts(graph, check, pairs, expectedPairs) {
+  let verified = 0;
+  let refused = 0;
+  let unverified = 0;
+  let advisoryRefused = 0;
+  for (const vp of pairs) {
+    switch (displayPairState(vp.state.kind, vp.pair.status)) {
+      case "verified":
+        verified += 1;
+        break;
+      case "refused":
+        refused += 1;
+        break;
+      case "warning":
+        advisoryRefused += 1;
+        break;
+      default:
+        unverified += 1;
+        break;
+    }
+  }
+  let pairsLLM = 0;
+  let pairsDet = 0;
+  for (const p2 of expectedPairs) {
+    if (p2.kind === "llm") pairsLLM += 1;
+    else pairsDet += 1;
+  }
+  const errors = check.issues.filter((i) => i.severity === "error").length;
+  const warnings = check.issues.filter((i) => i.severity === "warning").length;
+  return {
+    nodes: graph.nodes.size,
+    aspects: graph.aspects.length,
+    flows: graph.flows.length,
+    pairsTotal: expectedPairs.length,
+    pairsLLM,
+    pairsDet,
+    verified,
+    refused,
+    unverified,
+    advisoryRefused,
+    // The residue-track counts (noRule / notApplicable / suppressed) are NOT part of the
+    // count-parity identity and cannot be computed here — each depends on data derived AFTER
+    // this seam (the built node array, the residue ledger, the suppression inventory). They
+    // are seeded 0 and OVERWRITTEN by the post-pass in extractPortalData once that data exists.
+    // (Never leave them 0: that prints "0 waived / 0 no rule / 0 not applicable" over a list.)
+    noRule: 0,
+    draft: check.draftSkipped,
+    notApplicable: 0,
+    suppressed: 0,
+    uncoveredFiles: check.totalFiles - check.coveredFiles,
+    coveredFiles: check.coveredFiles,
+    totalFiles: check.totalFiles,
+    errors,
+    warnings
+  };
+}
+
+// src/portal/serializer.ts
+import { readFile as readFile20 } from "fs/promises";
+import path59 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
+import { existsSync as existsSync12 } from "fs";
+var LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 400 400">
+  <defs>
+    <style>
+      .st0 {
+        fill: #f8d794;
+        fill-rule: evenodd;
+      }
+    </style>
+  </defs>
+  <path class="st0" d="M197.03,1.63c-6.22,3.3-11.49,8.23-13.84,12.96-.35.7-.67,1.32-.73,1.37-.05.06-.92-.42-1.92-1.05-2.2-1.39-6.63-3.27-6.93-2.95-.3.32-2.1,5.23-2.66,7.27-.26.93-.52,1.86-.59,2.07-.07.23-.57-.19-1.26-1.07-1.96-2.48-6.02-4.97-9.39-5.77l-.81-.19.15,3.32c.09,1.85.36,3.99.62,4.83.61,1.96.48,2.01-1.31.59-3.35-2.66-8.96-4.65-14-4.96-2.87-.17-8.36.34-8.65.81-.54.87,4.59,9.19,7.48,12.13l2.16,2.2-.95.59-.95.59-2.16-1c-7.44-3.45-16.8-2.91-25.31,1.45l-.97.5,2.4,2.66c1.32,1.46,3.18,3.34,4.13,4.18l1.73,1.52-2.03.52c-2.99.76-10.14,4.5-10.14,5.31,0,.12.52.69,1.16,1.27l1.16,1.04-1.93-.24c-6.1-.75-15.41,1.23-14.43,3.06.9,1.7,3.27,5.33,4.51,6.9,1.66,2.11,1.64,1.96.27,3.3-1.05,1.02-1.26,1.11-3.87,1.46-10.22,1.4-17.81,7.51-21.74,17.49l-.58,1.47,1.75,1.18c.96.65,2.5,1.75,3.41,2.45l1.66,1.27-.86.77c-.47.42-1.76,1.29-2.85,1.93-8.64,5.04-13.74,12.18-16.51,23.1-1.06,4.17-1.49,3.78,4.08,3.59,3.09-.1,4.79-.06,4.79.12,0,1.5-1.8,4.44-3.18,5.18-8.37,4.51-13.05,11.61-14.44,21.93-.5,3.74-.9,3.41,4.05,3.4,6.23-.02,9.25-.98,15.41-4.89.51-.32.85-.19,3.07,1.2,2.12,1.33,4.65,2.55,7.06,3.39.45.16.26.32-1.03.84-5.8,2.36-9.65,7.15-10.93,13.58-.18.91-.4,1.9-.48,2.19-.15.51-.03.53,2,.35,7.76-.66,13.37-5.48,15.94-13.7l.75-2.39,1.13.08c2.87.21,7.55-.86,11.88-2.7l2.36-1,.88.52c.48.29,2.13,1.18,3.66,1.98l2.78,1.46-2.05.35c-8.87,1.5-14.74,6.32-17.22,14.16-1.07,3.36-1.28,3.16,3.38,3.13,9.3-.07,15.85-4.12,20.15-12.47l1.34-2.6,2.16.17c1.19.09,5.01-.01,8.5-.22,3.49-.21,6.38-.35,6.44-.31.47.4-2.74,3.58-4.67,4.64-5.27,2.88-8.24,7.94-8.24,14,0,2.11.05,2.34.49,2.21.27-.08,1.06-.29,1.76-.47,6.44-1.65,10.98-7.78,10.98-14.82,0-1.87,1.14-3.79,3.1-5.2,1.77-1.29,18.19-1.51,21.69-.29,13.13,4.57,22.36,15.41,23.62,27.73.61,5.93-.8,26.41-2.36,34.39l-.71,3.6-3.73,3.99c-6.67,7.13-4.88,6.03-14.01,8.62-2.25.64-5.52,1.6-7.28,2.14-6.1,1.88-5.54,1.85-31.68,1.79l-23.61-.05-3.01,3c-2.89,2.88-3.05,2.99-3.87,2.75-.74-.21-2.74.16-3.05.57-1.15,1.53-1.32,2.87-.53,4.2,1.63,2.76,5.81,1.63,5.87-1.59.02-1.23.1-1.34,2.87-3.93l2.85-2.67h11.74l-9.57,9.58-9.57,9.58h-16.71l-.74-1.27c-2.6-4.43-9.45-2.67-9.45,2.42s7.31,6.94,9.42,2.26l.52-1.16,10.93.18,10.93.18,8.6-8.51c5.11-5.06,8.99-8.67,9.55-8.91.81-.34,4.71-.37,25.76-.22l24.8.17,10.01-9.8,10.01-9.8v-18.88c0-13.87-.09-19.13-.33-19.81-.29-.8-.26-1,.18-1.5,1.36-1.5,3.48.19,2.25,1.8-.35.47-.41,3.3-.41,19.72v19.18l-10.4,10.2-10.4,10.2h-37.46l-.84.71c-.81.68-.96.7-5.16.71-2.38,0-4.47.1-4.64.21-.18.11-5.48,5.31-11.78,11.54l-11.46,11.34h-15.46v13.48l-.63.2c-3.44,1.07-4.42,5.82-1.72,8.34,2.62,2.45,7.22,1.29,8.35-2.11.08-.25,1.99-.36,7.17-.43l7.06-.09-.14,1.25c-.28,2.47,1.16,1.58,8.12-5.04,5.59-5.31,4.28-4.83,13.63-4.96,6.62-.09,8.05-.18,8.96-.58.7-.31,5.48-4.8,13.71-12.88,15.22-14.94,13.17-13.63,21.47-13.75l6.13-.09v7.26l-2.46,2.37c-1.36,1.3-5.09,4.94-8.3,8.08l-5.83,5.71h-1.7c-1.1,0-1.7-.12-1.7-.33,0-.63-1.45-2.22-2.52-2.77-6.37-3.25-12.07,5.01-6.58,9.53,3.28,2.71,9.36.59,9.39-3.27,0-.59.13-.63,1.9-.64h1.9s7.75-7.59,7.75-7.59c4.26-4.17,7.84-7.59,7.96-7.6.12,0,.21,1.28.21,2.86v2.87l-8.8,8.89c-4.84,4.89-9.18,9.11-9.64,9.38-.78.46-2.27.49-20.2.49h-19.36l-5.93,5.66-5.93,5.66-2.1-2-2.11-2h-3.79c-5.14,0-5.35.16-5.4,4.12-.02,1.81-.15,2.8-.36,2.87-4.33,1.44-3.21,8.33,1.35,8.33,4.2,0,5.49-4.98,2.04-7.87-.95-.79-.95-.8-.79-2.71.21-2.55.12-2.48,3.27-2.48h2.76l1.94,1.71c1.38,1.22,2.01,1.99,2.18,2.68.4,1.59,3,1,3-.68,0-.59,10.18-10.37,11.21-10.77.77-.3,3.09-.32,8.03-.07l3.62.18-10.55,10.59c-13.01,13.06-11.47,10.52-11.47,18.91v6.93l-.96.46c-4.59,2.19-2.93,9.51,2.15,9.51s6.98-7.59,2.13-9.6l-.83-.34.09-5.07.09-5.07,11.11-10.94c8.65-8.52,11.33-11,12.11-11.22,1.1-.3,7.35-.32,13.05-.04l3.59.18-4.86,5.01-4.86,5h-4.45c-2.63,0-4.69-.13-5.02-.31-.51-.27-.54-.25-.26.26.17.31.3.94.3,1.39v.83l2.5-.14c1.38-.08,2.98-.05,3.56.06l1.06.2-1.47,1.49-1.47,1.49-2.63-.14c-2.72-.14-4.2.32-4.86,1.5-.12.21-2.28,2.47-4.79,5.01-4.55,4.6-5.02,5.29-4.08,5.99.44.33,1.08-.22,5.86-4.97l5.37-5.33h3.62l-2.95,2.96-2.95,2.96-.09,14.43-.09,14.43-1.24.76c-3.82,2.34-2.99,7.8,1.35,8.98,5.34,1.44,8.41-5.98,3.71-8.95l-1.25-.79v-11.14c0-14.88-1.29-12.04,10.36-22.92l9.5-8.88.09,5.42.09,5.42-3.68,3.52-3.68,3.52v12.53s0,12.53,0,12.53l-1.28.68c-4.77,2.53-2.65,9.77,2.7,9.25,4.91-.47,6.28-7.03,1.94-9.24l-1.1-.56v-12.04s0-12.03,0-12.03l3.66-3.47,3.66-3.47v-14.22l4.14-3.78c2.28-2.08,6.81-6.38,10.08-9.55s7.74-7.52,9.94-9.65l4.01-3.87v-31.96l6.36-6.37,6.36-6.37-.02-16.95c-.01-11.3-.12-17.13-.32-17.5-.6-1.11.78-2.32,1.93-1.7.78.42.96,1.13.47,1.88-.37.57-.43,2.92-.43,17.78v17.12l-6.51,6.47-6.51,6.48.14,20.98c.07,11.54.03,21.72-.09,22.63-.46,3.31-.69,3.59-14.22,17.09-6.91,6.89-13.07,13.15-13.67,13.9l-1.1,1.36v43.81l-1.32.68c-3.36,1.73-3.52,6.6-.27,8.44,3.77,2.13,8.17-1.01,7.37-5.25-.22-1.17-1.9-3.15-2.87-3.4l-.67-.17v-18.63c0-12.73.1-18.98.31-19.75.35-1.28-.59-.3,19.75-20.27,10.15-9.97,13.89-13.81,14.36-14.77.63-1.27.64-1.56.78-12.43l.14-11.13.76-1.55c.76-1.55,4.55-6.19,5.23-6.41.29-.1.35,3.48.28,18.71l-.08,18.83-.76,1.55c-.63,1.28-2.68,3.44-11.49,12.08-7.6,7.46-10.92,10.9-11.39,11.82-.44.87-2.33,2.9-5.76,6.18l-5.1,4.88v18.62l-.99.96c-2.41,2.34-.3,6.29,2.96,5.58,2.54-.56,3.44-3.74,1.57-5.55l-.96-.93-.2-8.73-.2-8.73,3.06-3c1.68-1.65,3.47-3.34,3.98-3.76l.92-.76v1.93c0,3.52.82,34.54,1,37.84.22,4.13-.11,3.63,7.44,10.94l6.21,6.01v8.57c0,7.08.07,8.57.39,8.57.21,0,.76.07,1.22.17l.83.17.19-9.89c.23-11.76.95-9.73-5.89-16.64-6.45-6.51-5.98-5.44-5.73-12.96.11-3.33.29-10.81.39-16.62.27-15.2.4-16.58,1.67-18.43.9-1.3,8.31-8.61,8.73-8.61.09,0,.17,6.37.17,14.17v14.17l-1.27.34c-7.59,2.03-6.33,13.91,1.55,14.63,8.86.8,11.56-12.07,3.06-14.62l-1.08-.32v-30.76l3.06-3.05,3.06-3.05.2,10.24c.47,24.38.21,22.87,4.71,27.18,1.76,1.68,3.67,3.52,4.25,4.08l1.06,1.02v6.03l-4.08,3.96-4.08,3.95v22.96l-.85.35c-4.98,2.06-3.29,9.58,2.15,9.58s6.84-6.61,2.32-9.46l-1.09-.69v-19.81l4.47-4.53c5.57-5.63,5.87-6.34,5.25-12.14l-.21-1.94-3.77-3.86c-2.08-2.12-3.79-4.09-3.81-4.38-.12-1.48.13-14.91.29-15.48.16-.62.97.09,8.96,7.93,10.8,10.58,10.32,9.84,10.46,16.32l.1,4.49-5.39,5.24-5.39,5.24.04,4.26.04,4.26-1.01,1.01c-2.55,2.55.32,6.74,3.46,5.06,2.12-1.13,2.54-4.19.73-5.37-.68-.45-.69-.52-.69-4.42v-3.96l4.07-4.1c2.24-2.25,4.13-4.03,4.2-3.96.07.07.22,4.38.33,9.57l.2,9.44-5.81,5.91-5.81,5.92v5.85s0,5.85,0,5.85l1.2-.18c.66-.1,1.23-.21,1.27-.24.04-.03.15-1.97.25-4.32l.19-4.27,6.08-5.82c8.21-7.85,7.3-4.98,7.8-24.62.27-10.53-.12-9.88,3.71-6.25l3.17,3.01v7.86s0,7.86,0,7.86l-1.1,1.01c-2.92,2.7-1.45,7.07,2.38,7.07s5.06-5.1,1.92-7.14l-.94-.61v-8.49s0-8.49,0-8.49l-4.42-4.36-4.42-4.36v-4.18c-.03-5.91.71-4.84-12.03-17.35-8.68-8.52-10.83-10.78-11.45-12.04l-.77-1.55-.04-27.25c-.02-14.99.06-27.25.18-27.25.82,0,5.48,5.94,5.86,7.46.16.63.36,8.37.46,17.71l.18,16.58,6.4,6.55,6.4,6.55-.1,5.03-.1,5.03,4.12,3.91,4.12,3.91-.18,1.2c-.47,3.11,2.97,5.03,5.32,2.96,2.35-2.06.69-5.92-2.38-5.54-.99.12-1.14,0-4.84-3.72l-3.82-3.84.11-4.93.11-4.93-6.46-6.48-6.46-6.49v-6.94l1.62,1.42c.89.78,4.79,4.52,8.66,8.29l7.04,6.87-.06,4.63-.06,4.63,7.74,7.73,7.74,7.73v1.42c0,1.68-3.85,5.93-5.98,6.61-2.82.89-2.36,4.52.57,4.52,1.44,0,2.36-.94,2.38-2.44.01-1.02,2.06-3.76,2.81-3.76.59,0,.25,23.05-.34,23.24-4.7,1.49-3.92,8.85,1.02,9.6,5.5.82,7.97-7.04,2.93-9.31l-1.19-.54.1-21.99c.1-21.58.09-22-.46-22.85-.31-.47-6.26-6.48-13.23-13.34-13.28-13.08-13.91-13.77-14.89-16.14-.6-1.46-.6-1.62-.6-23.64v-22.17l-6.41-6.43-6.41-6.43v-17.14c0-15.67-.04-17.19-.47-17.67-.58-.64-.22-2,.57-2.15,1.65-.32,2.64,1,1.76,2.34-.4.62-.45,2.5-.45,17.25v16.56l6.48,6.47,6.48,6.47v32.17l1.76,1.66c.97.91,5.43,5.22,9.93,9.58,4.49,4.36,9.97,9.62,12.18,11.69l4.01,3.77v14.18s3.8,3.59,3.8,3.59l3.8,3.59v23.98s-1.34.7-1.34.7c-3.95,2.08-3.24,7.86,1.11,9.03,5.96,1.6,8.7-6.43,3.23-9.45-.48-.27-.52-1.03-.58-12.79l-.06-12.5-3.73-3.55-3.73-3.55.09-5.44.09-5.44,3.93,3.61c11.08,10.18,14.41,13.42,15.09,14.68l.7,1.31.09,11.7.09,11.71-.98.47c-4.49,2.14-2.95,9.35,2,9.34,5.37-.01,7.19-7.38,2.32-9.4l-.85-.35v-28.97l-2.82-2.82c-3.33-3.33-3.24-3.07-1.07-3.07h1.74l5.03,5c4.76,4.72,5.06,4.97,5.44,4.45.68-.92.79-.77-5.83-7.55l-4.06-4.15h-6.19s-1.53-1.55-1.53-1.55l-1.53-1.55h4.43c3.05,0,4.61.11,5.01.35,1.04.64,1.63-.82.78-1.93-.15-.2-2.42-.38-6.22-.5l-5.99-.19-4.85-4.85-4.85-4.85,2.03-.17c5.1-.44,14.38-.27,15.27.27,1.48.91,21.89,21.25,22.29,22.21.26.63.38,2.27.38,5.41v4.51l-1.1.56c-4.47,2.28-2.62,9.31,2.45,9.31,4.97,0,6.69-7.06,2.27-9.31l-1.11-.57.04-6.9c.03-5.78-.03-7-.39-7.52-.24-.34-5.22-5.47-11.08-11.4l-10.65-10.78,5.49-.07c3.02-.04,5.82-.03,6.22.02.88.1,11.52,10.36,11.52,11.1,0,1.33,2.39,1.8,2.67.53.12-.55.92-1.48,2.43-2.82l2.25-2h2.2c2.85,0,3.13.27,3.13,3.03,0,1.9-.04,2.03-.85,2.61-2.61,1.86-2.2,6.06.72,7.35,5.05,2.24,8.08-5.24,3.16-7.81-.75-.39-.77-.47-.77-2.79s-.03-2.42-.96-3.44l-.96-1.05-3.13-.1c-3.58-.11-3.48-.15-6.33,2.51l-1.83,1.72-.78-.57c-.43-.31-3.06-2.86-5.85-5.66l-5.07-5.09h-19.01c-10.77,0-19.41-.11-19.92-.26-.65-.19-3.5-2.86-10.07-9.45l-9.16-9.19v-2.8c0-1.54.07-2.8.17-2.8s3.67,3.42,7.95,7.6l7.79,7.61h3.71l.33,1.11c1.93,6.43,11.68,4.6,11.25-2.12-.36-5.64-7.91-7.47-10.65-2.59-.59,1.04-.63,1.06-2.27,1.06h-1.68l-8.09-7.95c-4.45-4.37-8.17-8.05-8.26-8.18-.09-.13-.19-1.82-.23-3.77l-.06-3.53,6.29.1c8.59.13,6.53-1.19,21.35,13.61,15.01,14.98,12.43,13.46,23.24,13.68,4.49.09,8.2.19,8.25.21.04.03,1.96,1.87,4.25,4.09,4.27,4.14,8.13,7.3,8.57,7.03.14-.08.2-.64.14-1.25l-.11-1.09h14.17l.34.82c1.23,2.97,5.56,3.78,8,1.49,2.61-2.44,1.78-6.86-1.55-8.24l-.81-.33v-13.45h-15.34l-11.56-11.55-11.56-11.55h-4.76c-4.72,0-4.77,0-5.51-.72l-.75-.72-18.61.02-18.6.02-10.38-10.18-10.38-10.18-.15-23.27c-.08-12.8-.25-23.54-.37-23.87-.48-1.25,1.71-2.15,2.35-.96.23.42.19.77-.13,1.39-.38.73-.43,3.69-.43,23.34v22.51l10.16,9.94,10.16,9.94,25-.18,25-.18,1.24.84c.68.46,4.85,4.39,9.26,8.72l8.03,7.87h11.05s11.05.01,11.05.01l.38.92c1.6,3.83,6.96,3.96,8.85.21,2.84-5.62-5.06-10-8.61-4.77-.47.69-.94,1.01-1.69,1.16-1.31.25-14.32.29-15.51.05-.67-.13-3.12-2.39-10.39-9.57l-9.51-9.39h5.87s5.87-.02,5.87-.02l2.38,2.32c2.11,2.06,2.36,2.41,2.23,3.12-.48,2.47,2.29,4.36,4.62,3.15,3.21-1.66,1.77-5.95-1.93-5.73-1.15.07-1.26-.01-3.78-2.51l-2.6-2.58-24.64-.09-24.64-.09-2.96-.87c-3.88-1.14-13.44-3.94-15.8-4.62-2.01-.58-11.63-9.9-12.15-11.76-1.54-5.6-3.5-31.85-2.79-37.48,1.55-12.43,10.38-22.76,23.28-27.24,4.67-1.62,20.78-1.24,22.61.54,1.95,1.89,2.59,3.28,2.6,5.58,0,4.9,2.51,9.5,6.6,12.15,1.42.92,2.91,1.49,6.18,2.39.5.14.52-.02.39-2.77-.29-6.08-3.19-10.76-8.31-13.43-1.94-1.01-5.08-4.25-4.53-4.68.05-.04,1.74.03,3.76.15,2.01.12,5.78.24,8.37.25l4.71.03,1.19,2.17c4.79,8.76,11.2,12.76,20.57,12.84,4.24.04,4.13.11,3.53-2.39-1.83-7.64-10.52-14.9-17.83-14.9-1.73,0-1.52-.38.92-1.69,1.37-.73,3-1.62,3.62-1.98l1.14-.64,2.8,1.14c3.92,1.6,6.74,2.33,9.88,2.55l2.7.19.91,2.54c2.75,7.67,6.75,11.57,13.28,12.96,4.55.96,4.77.78,3.78-3.12-1.53-6.05-7.85-13.07-11.77-13.07-.21,0-.3-.13-.2-.28.1-.16.37-.28.61-.28.73,0,5.05-2.14,7.11-3.53l1.95-1.31,1.73,1.17c4.7,3.19,10.93,4.72,16.7,4.1l1.89-.2v-1.23c0-8.69-5.86-18.8-13.47-23.22-2.53-1.47-2.66-1.59-3.43-3.29-1.44-3.18-1.86-2.88,3.8-2.7l4.94.16-.18-.96c-2.09-11.08-7.41-19.51-15.88-25.1-1.78-1.18-3.59-2.52-4.03-2.97l-.79-.83,1.36-.98c.75-.54,2.16-1.52,3.13-2.17,2.34-1.57,2.33-1.51.53-5.18-4.61-9.4-10.72-13.86-20.89-15.23-2.77-.37-2.82-.4-3.87-1.57l-1.06-1.19,1.22-1.59c1.44-1.88,3.55-5.14,4.39-6.78l.59-1.17-1.77-.82c-3.6-1.68-8.83-2.31-13.32-1.61l-1.41.22,1.22-1.07c1.44-1.27,1.5-1.18-2.06-3.32-3.32-2-4.79-2.6-8.14-3.36-.81-.18-.77-.23,3.17-4.2,4.68-4.72,4.56-4.34,1.8-5.6-8.6-3.91-16.74-4.24-23.86-.94l-2.14.99-.99-.58-.99-.59,2.09-2.15c2.58-2.65,7.8-10.85,7.8-12.25,0-.36-5.98-.81-8.78-.66-5.93.31-10.16,1.89-15.35,5.7l-.61.45.58-1.78c.38-1.17.62-2.87.72-4.98l.14-3.2-.95.2c-2.99.63-7.56,3.33-9.3,5.5q-1.16,1.44-1.74-.79c-1.01-3.88-2.55-7.26-3.26-7.18-1.06.12-4.7,1.74-6.47,2.88l-1.67,1.08-1.42-2.32c-2.76-4.52-7.38-8.68-13.14-11.83-3.46-1.89-3.06-1.88-6.3-.16M201.93,51.02c2.01,4.18,2.37,5.58,2.37,9.19,0,4.3,1.4,10.35,3.51,15.15l.99,2.25-2.18,2.13c-2.61,2.56-2.1,3.09-4.74-5.01l-1.92-5.9-2.09,6.4c-1.15,3.52-2.19,6.37-2.3,6.32-.12-.04-1.16-.98-2.32-2.09l-2.11-2.01.81-1.65c2.19-4.46,3.57-10.14,3.9-16.02.17-3.16.38-4.58.8-5.63.98-2.43,3.12-6.9,3.3-6.9.1,0,.99,1.7,1.99,3.77M169.17,64.2c3.58,2.29,5.83,6.79,5.84,11.71,0,1.43.09,1.42-2.07.28-4.26-2.25-6.66-6.32-6.66-11.29v-1.94l.77.19c.43.11,1.38.58,2.12,1.05M233.77,64.07c.78,4.14-2,9.34-6.37,11.94-2.33,1.38-2.25,1.4-2.25-.39,0-5.05,2.2-9.34,5.93-11.53,2.23-1.31,2.44-1.31,2.69-.02M221.48,71.47c1.09,3.16,1.07,4.07-.3,20-.65,7.51-1.66,9.2-11.05,18.55l-5.2,5.17-.19-3.63c-1.13-22.16-1.07-22.42,7.29-31.09,3.39-3.51,5.67-6.5,7.61-9.95.88-1.57.98-1.52,1.83.94M180.97,71.57c1.41,2.8,2.38,4.05,6.3,8.09,4.74,4.89,5.88,6.35,7.29,9.28l1.15,2.39-.02,8.87c-.01,4.88-.12,10.24-.24,11.92l-.22,3.04-5.48-5.44c-10.11-10.03-10.35-10.51-11.25-22.06-.92-11.94-.86-13.71.58-17.12.55-1.31.77-1.19,1.89,1.02M158.37,71.92c1,.4,1.14.59,1.4,1.79,1.29,5.99,5.28,10.62,12.19,14.12l2.16,1.09.15,1.49c.09.82.23,2.37.32,3.46.09,1.08.24,2.21.33,2.51.15.51.1.51-.79-.08-.52-.34-2.28-1.33-3.91-2.19-9.03-4.81-11.86-9.03-13.09-19.54-.1-.85-.25-1.9-.33-2.32-.17-.9.03-.94,1.56-.33M243.04,73.61c-.96,10.28-4.25,15.63-12.3,20.04-1.76.96-3.74,2.08-4.41,2.49l-1.21.74.19-2.21c.1-1.21.27-2.96.37-3.89l.18-1.68,1.97-1.07c7.22-3.91,11.08-8.27,12.28-13.83.33-1.54.43-1.69,1.5-2.16,1.66-.74,1.65-.75,1.43,1.58M137.78,89.12c4.83,2.31,7.58,6.79,8.32,13.54.16,1.44.23,1.44-2.84.21-5.73-2.3-8.68-6.37-9.02-12.47l-.14-2.62.81.18c.45.1,1.74.62,2.87,1.17M265.7,90.03c0,6.43-3.37,10.82-10.3,13.43l-1.73.65.13-1.32c.77-7.69,6.15-14.58,11.69-14.97.12,0,.21.98.21,2.21M250.48,90.8c-.41,1.08-.46,3.37-.16,8.04.38,5.95-.66,7.23-9.54,11.75-5.11,2.6-5.02,2.57-4.64,1.57.16-.42.91-3.25,1.67-6.29,2.37-9.53,3.26-10.86,9.6-14.3,3.53-1.92,3.52-1.92,3.08-.76M153.1,91.82c5.83,3.26,6.78,4.7,9.11,13.82.84,3.28,1.61,6.26,1.71,6.63.11.37.08.62-.06.55-13.48-6.38-14.41-7.32-14.07-14.17.25-5.03.21-7-.14-7.92-.37-.99-.08-.9,3.45,1.08M171.49,100.15c4.64,3.5,15.53,15.39,17.21,18.79,1.38,2.8,2.71,12.81,1.71,12.81-.06,0-.59-.46-1.18-1.02-.59-.56-2.67-2.28-4.62-3.83-7.73-6.14-9.61-7.92-11.87-11.24-2.91-4.28-5.89-13.35-5.89-17.9v-.69l1.1.62c.6.34,2.2,1.45,3.55,2.46M232.62,101.42c-1.71,10.77-4.96,15.72-16.35,24.86-2.95,2.36-5.6,4.56-5.89,4.88-1,1.11-1.1.75-.92-3.43.32-7.69,1.63-9.94,12.22-21,4.28-4.47,7.15-6.99,10.09-8.85l1.13-.71.09.7c.05.38-.11,1.98-.36,3.55M148.9,109.41c6.34,4.45,16.25,12.03,16.25,12.43,0,.1-1.3.1-2.89-.01-1.59-.11-4-.12-5.36-.03-2.97.2-2.74.36-5.96-3.99-2.75-3.7-4.35-5.17-6.76-6.22l-1.8-.78.42-.81c.23-.44.49-1.42.58-2.18l.16-1.37,1.53.67c.84.37,2.57,1.4,3.84,2.3M256.42,107.31c0,.5.24,1.43.52,2.06l.52,1.14-1.86.96c-2.24,1.16-3.79,2.65-6.43,6.2-3.12,4.2-2.51,3.9-8.41,4.08-2.78.08-5.28.22-5.55.3-1.77.56,5.22-5.06,15.34-12.33,1.95-1.4,5.19-3.31,5.64-3.32.12,0,.21.41.22.91M281.43,109.13c1.11.19,1.08.75-.13,2.72-3.26,5.27-9.97,7.63-16.39,5.76l-1.23-.36,1.24-1.69c4.1-5.56,9.44-7.64,16.51-6.43M127.4,109.65c3.29,1.04,8.75,5.8,8.75,7.62,0,1.01-7.43,1.32-10.01.41-3.97-1.4-8.29-5.62-8.29-8.1,0-.91,6.61-.87,9.56.06M139.57,122.07c2.84,2.46,5.63,3.35,13.12,4.17,2.21.24,5.82.64,8.03.88,8.28.9,11.79,2.47,17.2,7.7,4.67,4.51,5.66,6.65,5.76,12.43l.08,4.65,8.44,8.31,8.44,8.31.19,34.45.18,34.45,3.22,3.01c1.77,1.66,3.55,3.1,3.94,3.21,1.28.35,1.62,1.72.64,2.61-.78.71-1.92.38-2.15-.63-.11-.47-1.55-2.16-3.65-4.29l-3.47-3.52-.14-8.87c-.08-4.88-.15-16.68-.15-26.23l-.02-17.35-6.48-6.12-6.48-6.12v-6.83l-5.14-5.14c-3.41-3.41-5.34-5.14-5.73-5.14-.88,0-1.63-.96-1.41-1.81.37-1.48,2.21-1.52,2.58-.05.09.36,2.63,3.11,5.64,6.1l5.47,5.45v6.77l1.66,1.56c.91.86,3.48,3.27,5.7,5.36l4.04,3.8.08-6.93.07-6.93-8.24-8.18c-11.45-11.36-10.86-10.93-19.51-14.16-15.71-5.86-34.99-16.39-43.33-23.67-.49-.43,6.61-2.46,8.73-2.5,1.01-.02,1.39.16,2.68,1.28M266.55,121.2c2.1.49,5.4,1.52,5.69,1.78.25.23-2.24,2.07-7.96,5.88-11.08,7.39-20.66,12.25-36.61,18.59-9.84,3.91-8.98,3.38-14.91,9.24l-5.21,5.15.17,9.1c.09,5.01.27,9.51.38,10.01.19.81.13.94-.54,1.25-1.09.5-1.73.02-1.6-1.21.05-.52.15-4.64.22-9.16l.12-8.21-3.39-3.23-3.39-3.23v-12.75l-.84-.44c-2.88-1.49-2.16-6.1,1.01-6.53,3.78-.51,5.39,5.39,1.79,6.53-.52.17-.55.47-.55,6.33v6.15l2.53,2.36,2.53,2.36,5.01-4.99,5.01-4.99.15-4.17c.17-4.71.31-5.14,2.83-8.56,1.55-2.1,5.69-6.19,7.58-7.49,4.1-2.81,6.07-3.28,19.15-4.62,9.34-.95,11.27-1.51,14.66-4.22,2-1.6,2.88-1.73,6.19-.97M127.7,130.06c3.48,1.17,7.63,4.02,15.5,10.61,2.41,2.02,4.98,4.13,5.72,4.7.74.57,1.28,1.03,1.2,1.03s-3.91.38-8.51.85c-4.6.47-8.38.82-8.4.77-3.14-8-8.34-11.85-16.02-11.86-3.89,0-3.91.02-2.53,2.96,2.5,5.33,8.2,9.11,13.99,9.28l1.15.03-1.41.27c-3.07.59-10.78.43-13.19-.27-4.65-1.35-6.04-2.26-11.48-7.59l-4.96-4.85,1.02-.16c3.21-.49,4.96-1.18,9.61-3.8,2.18-1.23,2.61-1.36,4.79-1.52,1.32-.1,3.41-.42,4.65-.73,2.85-.7,6.3-.59,8.88.28M281.9,129.92c.77.25,2.55.55,3.95.67,2.47.21,2.66.28,6.48,2.36,3.6,1.96,6.41,3.02,8.01,3.02.87,0,.91-.05-4.22,4.93-7.2,6.99-9.97,8.18-18.87,8.12-3.15-.02-5.79-.16-6.2-.33-.64-.27-.59-.3.56-.32,5.53-.1,10.86-3.49,13.38-8.52,1.86-3.72,1.78-3.87-1.97-3.87-7.01,0-12.25,3.38-15.3,9.85-.55,1.16-1.02,2.15-1.05,2.19-.05.07-16.1-1.58-16.53-1.71-.11-.03,1.09-1.1,2.67-2.38,1.59-1.27,4.02-3.28,5.42-4.46,10.93-9.26,16.95-11.69,23.66-9.55M198.97,139.81c-.7.89-.72,1.19-.15,2.01,1.14,1.63,3.83.04,2.9-1.72-.67-1.27-1.88-1.4-2.75-.3M307.84,242.86c1.01,1.54-.74,3.28-2.28,2.28-.86-.56-.92-1.64-.14-2.42.78-.78,1.85-.72,2.42.14M93.58,243.58c.56,1.01.23,2.17-.69,2.41-1.66.42-2.86-1.21-1.94-2.61.62-.94,2.06-.83,2.63.21M126.44,247.86c-1.11,1.66-19.41,19.24-20.39,19.58-2.48.86-2.63,3.72-.25,4.56,1.64.57,3.75-1.23,3.18-2.71-.14-.37,2.16-2.83,9.75-10.43l9.94-9.94h11.06c6.08,0,11.06.1,11.06.21,0,.23-6.18,6.97-7.75,8.45l-.97.92h-4.67c-2.83,0-4.9.12-5.24.31-.47.25-.71.18-1.32-.38-3.15-2.89-4.88-2.27-10.39,3.77-2.46,2.69-2.47,2.85-.45,5.04,3.56,3.84,4.99,3.32,11.41-4.14l2.25-2.62h3.07c1.69,0,3.07.09,3.07.21s-2.88,3.09-6.41,6.62l-6.4,6.41-5.35.03c-2.94.02-6.14.11-7.09.21l-1.74.18-5.66,5.56-5.66,5.56h-6.96s-6.96-.03-6.96-.03l-.58-1.18c-.42-.86-.94-1.38-1.9-1.89l-1.33-.7.07-5.49.07-5.49,7.04-.08,7.04-.07,11.56-11.54,11.55-11.54h5.77l-.42.63M290.68,258.77l11.45,11.54,7.02.08,7.02.07.13,5.39.13,5.39-1.3.76c-.9.53-1.48,1.14-1.9,2.01l-.61,1.25h-14.17l-5.61-5.64-5.61-5.64-7.11-.18-7.11-.18-6.23-6.36-6.23-6.36,3.06-.08,3.06-.09.7.93c1.39,1.85,6.59,6.97,7.55,7.43,1.96.93,5.24-.99,6.44-3.76.54-1.24.32-1.5-6.16-7.31-1.93-1.73-3.81-1.67-5.95.21-.83.73-1.1.83-1.56.58-.33-.17-2.42-.3-5.04-.3h-4.48l-3.5-3.59c-3.39-3.49-5.23-5.62-5-5.82.06-.05,4.92-.18,10.81-.29l10.7-.19,10,9.99c9.32,9.31,9.99,10.05,9.91,10.87-.28,2.72,3.41,3.74,4.58,1.27.75-1.58-.1-3.24-1.66-3.24-.37,0-4.06-3.49-10.57-9.99l-10-9.99,1.41-.1c.78-.05,2.08-.12,2.89-.15l1.48-.05,11.45,11.54M73.49,256.64c2.02,2.02-.82,5-3.07,3.23-1.55-1.22-.51-3.92,1.51-3.92.55,0,1.13.26,1.56.69M329.81,256.61c2.18,1.87-.78,5.13-3.01,3.32-1.41-1.14-.37-3.98,1.47-3.98.43,0,1.13.3,1.55.66M128.74,259.95q1.27,1.23-1.7,4.28c-3.09,3.18-3.79,3.36-5.24,1.33l-.58-.82,2.77-2.85c3.05-3.13,3.38-3.27,4.75-1.95M275.51,261.37c3.62,3.44,3.56,3.34,2.42,4.7-1.22,1.44-1.81,1.22-4.94-1.86q-3.14-3.08-1.78-4.28c1.39-1.22,1.56-1.16,4.31,1.45M107.42,269.2c.64.64.35,1.68-.46,1.68-1.24,0-1.95-1.15-1.18-1.92.49-.49.99-.42,1.64.23M294.58,269.49c.25.78-.36,1.44-1.24,1.34-.74-.09-1.06-.73-.76-1.51.25-.65,1.79-.52,2.01.17M253.71,273.96c2.17,1.43,2.11,4.35-.13,5.51-2.33,1.21-5.03-.53-4.7-3.03.33-2.44,2.89-3.76,4.82-2.48M150.08,274.31c1.82,1.43,1.78,3.66-.08,4.98-2.56,1.82-6.19-.97-4.82-3.71.93-1.85,3.36-2.48,4.9-1.27M84.2,284.81c.97.97.92,2.22-.13,3.27-1.02,1.02-2.06,1.06-2.99.13-1.46-1.46-.45-4.1,1.56-4.1.55,0,1.13.26,1.56.69M319.03,284.81c1.81,1.68-.2,4.97-2.31,3.79-1.01-.57-1.58-1.67-1.34-2.6.46-1.84,2.3-2.44,3.66-1.18M92.62,303.34c1.16,1.02,1.24,2.27.21,3.3-1.05,1.05-2.08,1.11-3.03.17-2.03-2.03.66-5.35,2.81-3.46M310.36,303.4c1.02,1.02.83,2.78-.41,3.74-1.26.97-3.24-.27-3.24-2.03,0-2.04,2.26-3.09,3.65-1.7M126.64,304.3c-.49.2-.44.77.15,1.5l.5.62.7-.59.7-.59-.66-.56c-.69-.59-.79-.61-1.38-.38M124.89,306.08c-.62.38-.04,1.81.77,1.93.92.13,1.07-.64.3-1.48-.47-.5-.78-.63-1.07-.45M273.75,306.63c-1,1.11.28,2.24,1.34,1.18.48-.48.54-.71.3-1.1-.44-.7-1.05-.74-1.64-.09M122.96,308.14c-.39.46.81,2.09,1.31,1.78.49-.3.4-1.15-.19-1.67-.62-.56-.74-.57-1.13-.1M275.46,308.29c-.57.63-.58.82-.06,1.34.46.46.58.33.85-.94.22-1.02-.09-1.18-.79-.4M276.99,309.45c-.68.68-.71.87-.2,1.56.31.43.42.45.61.12.13-.22.41-.66.61-.99.6-.94-.22-1.49-1.02-.69M121.36,309.46c-.2.32.21,1.17.79,1.65.77.64,1.14-.32.46-1.18-.62-.79-.97-.92-1.24-.47M245.06,322.5c.66.95.76,1.4.88,4.08l.13,3.01-6.59-6.43c-5.08-4.96-6.58-6.59-6.57-7.11.01-.37.04-1.76.07-3.09l.05-2.42,5.64,5.44c3.1,3,5.98,5.93,6.38,6.51M278.48,311.27c-.74.65-.77.73-.34,1.17.51.52,1.93-.1,1.93-.85,0-.87-.77-1.02-1.59-.31M119.99,311.07c-.34.34-.18,1.13.34,1.6.56.5,1.45.36,1.45-.23s-1.47-1.69-1.79-1.37M279.76,312.35c-.3.9.56,3.05.97,2.42.45-.68.68-1.66.42-1.81-.17-.1-.41-.01-.55.2-.18.29-.25.22-.25-.25,0-.49-.47-.93-.59-.56M117.97,313.15c-.22.35.93,1.67,1.45,1.67.62,0,.74-.56.27-1.28-.47-.71-1.39-.92-1.72-.39M281.54,313.97c-.76,1.22-.27,1.85.65.83.45-.5.47-.62.11-.98s-.45-.34-.76.15M116.3,315.03c-.13.34.05.7.57,1.15.98.85,1.48.45.97-.78-.39-.95-1.24-1.16-1.54-.37M282.25,315.12c-.6.35-.63.92-.08,1.37.48.4,1.82-.4,1.84-1.09,0-.29-.15-.26-.6.14q-.6.53-.27-.1c.37-.71,0-.85-.89-.33M114.81,316.27c-.49.5-.44.92.2,1.5.55.49,1.42.43,1.42-.11,0-.67-1.26-1.75-1.62-1.39M283.85,316.92c-.78,1.19.16,1.79,1.1.69.39-.46.43-.67.17-.98-.47-.57-.75-.5-1.27.29M115.61,321.12c-.36.43.71,2.47,1.22,2.33.64-.18.87-1.05.36-1.34-.33-.19-.45-.47-.33-.83.21-.66-.73-.77-1.25-.15M282.6,321.4c0,1.04.65,1.42,1.27.73.5-.55.5-.58-.03-.98-.8-.6-1.24-.51-1.24.24M113.93,322.64c-.36.67.31,1.75,1.09,1.75s1.01-.57.33-.75c-.31-.08-.51-.31-.44-.5.25-.65-.66-1.11-.98-.5M284.5,322.96c-.63.71-.68.87-.33,1.16.52.43,1.97-.89,1.71-1.56-.24-.62-.56-.53-1.39.4M109.18,328.9c2.13,1.67.06,5.04-2.34,3.8-1.54-.8-1.8-2.14-.66-3.49.86-1.03,1.95-1.14,3-.31M293.89,329.16c.92.92,1,1.39.42,2.52-.88,1.7-3.24,1.68-3.96-.05-.99-2.35,1.74-4.26,3.54-2.47M236.15,330.39c1.27.97,1.29,2.61.05,3.59-2.14,1.68-4.67-1.71-2.57-3.46.68-.57,1.88-.63,2.53-.13M234.21,331.4c-.68.43-.29,1.85.54,1.95.93.11,1.5-.56,1.27-1.49-.18-.73-1.04-.95-1.81-.46M241.3,342.73c.5.71.33,1.29-.42,1.53-1.05.33-1.82-1-1.03-1.79.5-.5.99-.41,1.46.26M191.47,348.45c4.65,2.73.94,10.5-4.03,8.43-4.06-1.69-4.17-7.02-.19-8.88,1.39-.65,2.57-.52,4.22.45M129.28,348.99c2.12,1.82-.59,5.04-2.89,3.43-1.22-.85-1.05-3.11.28-3.76.99-.48,1.8-.38,2.62.32M258.19,348.66c1.41.75,1.72,2.19.74,3.44-1.24,1.57-3.92.59-3.92-1.43,0-1.74,1.69-2.8,3.19-2M273.61,348.69c1.27.98,1.38,2.22.28,3.32-1.53,1.53-3.8.63-3.74-1.49.05-1.66,2.2-2.8,3.46-1.83M144.22,349.03c2.02,1.41-.11,4.83-2.34,3.76-2.19-1.05-1.53-4.18.88-4.18.48,0,1.14.19,1.46.42M163.46,352.56c1.08,1.08.43,2.54-1.14,2.54-.82,0-1.4-.63-1.4-1.53,0-.56.99-1.57,1.55-1.57.23,0,.68.25.98.56M154.66,365.97c1.6,1.76-.58,4.46-2.71,3.36-1.77-.91-1.72-3.2.09-3.98,1.07-.46,1.8-.29,2.63.62M248.48,365.4c1.5,1.05,1.28,3.24-.4,3.94-1.04.43-1.64.31-2.58-.54-1.89-1.7.89-4.87,2.98-3.4M214.6,374.65c1.72,1.72-.33,4.35-2.49,3.21-.84-.44-1.03-.79-1.03-1.86,0-1.9,2.15-2.73,3.53-1.35M212.04,375.39c-.31.49.12,1.63.67,1.8,1.14.36,2.15-.83,1.44-1.69-.39-.47-1.84-.55-2.11-.11M237.66,375.53c.71.71.57,2.28-.26,2.82-1.88,1.23-3.81-1.24-2.22-2.84.55-.55,1.92-.54,2.48.02M201.42,390.75c1.42,1.59.35,4.06-1.76,4.06-2.77,0-3.33-3.88-.7-4.88.73-.28,1.81.08,2.46.82"/>
+</svg>`;
+var LOGO_DATA_URI = `data:image/svg+xml;base64,${Buffer.from(LOGO_SVG, "utf8").toString("base64")}`;
+var __dirname3 = path59.dirname(fileURLToPath4(import.meta.url));
+function portalTemplateDir() {
+  const distDir = path59.resolve(__dirname3, "templates", "portal");
+  if (existsSync12(distDir)) return distDir;
+  const srcDir = path59.resolve(__dirname3, "..", "templates", "portal");
+  if (existsSync12(srcDir)) return srcDir;
+  return path59.resolve(__dirname3, "..", "dist", "templates", "portal");
+}
+var MODULE_ORDER = [
+  "js/namespace.js",
+  "js/state-model.js",
+  "js/glossary.js",
+  "js/router.js",
+  "js/palette.js",
+  "js/palette-overlay.js",
+  "js/consumer.js",
+  "js/export.js",
+  "js/tree.js",
+  "js/shell.js",
+  "js/dispatch.js",
+  // Per-surface view modules — registered onto Yg.views, consumed by the dispatcher. The
+  // matrix module precedes the relations view that calls Yg.matrix; the panel module is read
+  // by the bootstrap's panel slot. All before the bootstrap, which orchestrates the rest.
+  "js/views/overview-view.js",
+  "js/views/coverage-view.js",
+  "js/views/tree-view.js",
+  "js/views/relations-matrix.js",
+  "js/views/relations-view.js",
+  "js/views/rulebook-view.js",
+  "js/views/types-view.js",
+  "js/views/flows-view.js",
+  "js/views/suppressions-view.js",
+  "js/views/start-view.js",
+  "js/views/panel-aspect.js",
+  "js/views/panel-view.js",
+  "js/bootstrap.js"
+];
+var CSS_ORDER = [
+  "tokens.css",
+  "shell.css",
+  "app.css",
+  "views.css",
+  "views-audit.css",
+  "views-panel.css",
+  "views-relations.css",
+  "views-rulebook.css",
+  "views-flows.css",
+  "views-start.css"
+];
+async function readAssets() {
+  const dir = portalTemplateDir();
+  const read = (rel) => readFile20(path59.join(dir, rel), "utf-8");
+  const [shell, vendor] = await Promise.all([read("shell.html"), read("vendor/d3-hierarchy.js")]);
+  const cssSources = await Promise.all(CSS_ORDER.map((rel) => read(rel)));
+  const css = cssSources.join("\n");
+  const moduleSources = await Promise.all(MODULE_ORDER.map((rel) => read(rel)));
+  const modules = moduleSources.join("\n");
+  return { shell, css, vendor, modules };
+}
+function renderStaticHtml(data, assets) {
+  const json = safeJsonForScript(data);
+  return assets.shell.replace("__PORTAL_FAVICON_HREF__", () => LOGO_DATA_URI).replace("/* __PORTAL_CSS__ */", () => assets.css).replace("/* __PORTAL_DATA__ */", () => json).replace("/* __PORTAL_VENDOR__ */", () => assets.vendor).replace("/* __PORTAL_MODULES__ */", () => assets.modules);
+}
+var LINE_SEPARATORS = new RegExp(`[${String.fromCharCode(8232)}${String.fromCharCode(8233)}]`, "g");
+function safeJsonForScript(data) {
+  return JSON.stringify(data).replace(LINE_SEPARATORS, (ch) => "\\u" + ch.charCodeAt(0).toString(16).padStart(4, "0")).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026");
+}
+async function emitStatic(data, outPath) {
+  const assets = await readAssets();
+  const html = renderStaticHtml(data, assets);
+  await atomicWriteFile(outPath, html);
+}
+async function renderPortalPage(data) {
+  const assets = await readAssets();
+  return renderStaticHtml(data, assets);
+}
+function contentTypeFor(relPath) {
+  if (relPath.endsWith(".html")) return "text/html; charset=utf-8";
+  if (relPath.endsWith(".css")) return "text/css; charset=utf-8";
+  if (relPath.endsWith(".js")) return "text/javascript; charset=utf-8";
+  if (relPath.endsWith(".json")) return "application/json; charset=utf-8";
+  if (relPath.endsWith(".svg")) return "image/svg+xml";
+  return "application/octet-stream";
+}
+async function readPortalAsset(relPath) {
+  const root = portalTemplateDir();
+  const cleaned = relPath.replace(/^\/+/, "");
+  if (cleaned.length === 0) return null;
+  const resolved = path59.resolve(root, cleaned);
+  const rel = path59.relative(root, resolved);
+  if (rel.startsWith("..") || path59.isAbsolute(rel)) return null;
+  if (!existsSync12(resolved)) return null;
+  const content20 = await readFile20(resolved);
+  return { content: content20, contentType: contentTypeFor(cleaned) };
+}
+
+// src/portal/server/server.ts
+import { createServer } from "http";
+
+// src/portal/server/page.ts
+async function freshPortalData(projectRoot, writeEnabled) {
+  return extractPortalData(projectRoot, { writeEnabled });
+}
+async function renderLivePage(data) {
+  return renderPortalPage(data);
+}
+async function readStaticAsset(relPath) {
+  return readPortalAsset(relPath);
+}
+
+// src/portal/server/approve.ts
+import { spawn as spawn2 } from "child_process";
+import path60 from "path";
+import { existsSync as existsSync13 } from "fs";
+import { fileURLToPath as fileURLToPath5 } from "url";
+function resolveCliBin() {
+  const here = fileURLToPath5(import.meta.url);
+  if (path60.basename(here) === "bin.js") return here;
+  let dir = path60.dirname(here);
+  for (let i = 0; i < 6; i++) {
+    const candidate = path60.join(dir, "dist", "bin.js");
+    if (existsSync13(candidate)) return candidate;
+    dir = path60.dirname(dir);
+  }
+  return process.argv[1];
+}
+var CLI_BIN = resolveCliBin();
+function approveArgs(llm) {
+  return llm ? ["check", "--approve"] : ["check", "--approve", "--only-deterministic"];
+}
+function dryRunArgs(llm) {
+  return llm ? ["check", "--approve", "--dry-run"] : ["check", "--approve", "--only-deterministic", "--dry-run"];
+}
+function spawnCli(args, cwd) {
+  return new Promise((resolve6, reject) => {
+    const child = spawn2(process.execPath, [CLI_BIN, ...args], { cwd });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => stdout += chunk.toString("utf-8"));
+    child.stderr.on("data", (chunk) => stderr += chunk.toString("utf-8"));
+    child.on("error", (err) => reject(err));
+    child.on("close", (code) => resolve6({ exitCode: code ?? 1, stdout, stderr }));
+  });
+}
+async function runApproveViaCli(projectRoot, llm) {
+  return spawnCli(approveArgs(llm), projectRoot);
+}
+var BUDGET_RE = /Filling\s+(\d+)\s+unverified pairs across\s+\d+\s+nodes\s+—\s+(\d+)\s+deterministic\s+\(no cost\),\s+(\d+)\s+reviewer calls/;
+function parseDryRunBudget(output) {
+  const m = output.match(BUDGET_RE);
+  if (!m) {
+    throw new Error(
+      `Could not parse the dry-run cost preview from the CLI output. Raw output:
+${output.trim()}`
+    );
+  }
+  return {
+    pairs: Number.parseInt(m[1], 10),
+    deterministic: Number.parseInt(m[2], 10),
+    reviewerCalls: Number.parseInt(m[3], 10),
+    raw: m[0]
+  };
+}
+async function dryRunApproveViaCli(projectRoot, llm) {
+  const result = await spawnCli(dryRunArgs(llm), projectRoot);
+  return parseDryRunBudget(`${result.stdout}
+${result.stderr}`);
+}
+
+// src/portal/server/router.ts
+function sendJson(res, status, body) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+  res.end(payload);
+}
+function sendText(res, status, contentType, body) {
+  res.writeHead(status, { "content-type": contentType });
+  res.end(body);
+}
+async function readJsonBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  const text2 = Buffer.concat(chunks).toString("utf-8").trim();
+  if (text2.length === 0) return {};
+  try {
+    const parsed = JSON.parse(text2);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+async function handleRequest(req, res, config) {
+  const method = req.method ?? "GET";
+  const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  const pathname = url.pathname;
+  try {
+    if (method === "GET" && pathname === "/") {
+      const data = await freshPortalData(config.projectRoot, config.writeEnabled);
+      const html = await renderLivePage(data);
+      sendText(res, 200, "text/html; charset=utf-8", html);
+      return;
+    }
+    if (method === "GET" && pathname === "/data") {
+      const data = await freshPortalData(config.projectRoot, config.writeEnabled);
+      sendJson(res, 200, data);
+      return;
+    }
+    if (method === "GET" && pathname.startsWith("/static/")) {
+      const rel = pathname.slice("/static/".length);
+      const asset = await readStaticAsset(rel);
+      if (!asset) {
+        sendJson(res, 404, { error: "not-found", path: pathname });
+        return;
+      }
+      res.writeHead(200, { "content-type": asset.contentType });
+      res.end(asset.content);
+      return;
+    }
+    if (method === "GET" && pathname === "/approve/dry-run") {
+      const llm = url.searchParams.get("llm") !== "false";
+      const preview = await dryRunApproveViaCli(config.projectRoot, llm);
+      sendJson(res, 200, preview);
+      return;
+    }
+    if (method === "POST" && pathname === "/approve") {
+      if (!config.writeEnabled) {
+        sendJson(res, 409, {
+          error: "view-only",
+          message: "This portal runs in view-only mode (--no-write); the Approve write action is disabled."
+        });
+        return;
+      }
+      const body = await readJsonBody(req);
+      const llm = body.llm !== false;
+      const result = await runApproveViaCli(config.projectRoot, llm);
+      sendJson(res, 200, {
+        ok: result.exitCode === 0,
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr
+      });
+      return;
+    }
+    sendJson(res, 404, { error: "not-found", method, path: pathname });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    sendJson(res, 500, { error: "internal", message });
+  }
+}
+
+// src/portal/server/server.ts
+var LOOPBACK_HOST = "127.0.0.1";
+function startServer(opts) {
+  const config = { projectRoot: opts.projectRoot, writeEnabled: opts.writeEnabled };
+  const server = createServer((req, res) => {
+    void handleRequest(req, res, config);
+  });
+  return new Promise((resolve6, reject) => {
+    server.on("error", reject);
+    server.listen(opts.port, LOOPBACK_HOST, () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : opts.port;
+      resolve6({
+        url: `http://${LOOPBACK_HOST}:${port}`,
+        port,
+        close: () => new Promise((res, rej) => {
+          server.close((err) => err ? rej(err) : res());
+        })
+      });
+    });
+  });
+}
+
+// src/cli/portal.ts
+function registerPortalCommand(program2) {
+  program2.command("portal").description("Open a read-only local web portal onto the graph and its verification state").option("--static", "Emit a self-contained static page instead of serving").option("--out <path>", "Output path for the static page (with --static)").option("--port <n>", "Port for the local loopback server", (v) => {
+    const n = parseInt(v, 10);
+    if (Number.isNaN(n) || n < 0 || n > 65535) {
+      throw new InvalidArgumentError2("--port must be an integer between 0 and 65535.");
+    }
+    return n;
+  }).option("--open", "Open the page in the default browser").option("--no-write", "View-only mode \u2014 disable the Approve write action").action(async (options) => {
+    try {
+      await runPortal(options);
+    } catch (error) {
+      abortOnUnexpectedError(error, "opening the portal");
+    }
+  });
+}
+async function runPortal(options) {
+  const graph = await loadGraphOrAbort(process.cwd());
+  initDebugLog(graph.rootPath, graph.config.debug ?? false, appendToDebugLog);
+  const projectRoot = projectRootFromGraph(graph.rootPath);
+  if (options.static) {
+    const data = await extractPortalData(projectRoot, { writeEnabled: options.write });
+    const outPath = path61.resolve(projectRoot, options.out ?? "yg-portal.html");
+    await emitStatic(data, outPath);
+    process.stdout.write(`Portal page written to ${outPath}
+`);
+    if (options.open) {
+      await openInBrowser(outPath);
+    }
+    return;
+  }
+  await servePortal(projectRoot, options);
+}
+async function servePortal(projectRoot, options) {
+  const handle = await startServer({
+    projectRoot,
+    port: options.port ?? DEFAULT_PORT,
+    writeEnabled: options.write
+  });
+  const mode = options.write ? "" : " (view-only \u2014 Approve disabled)";
+  process.stdout.write(`Portal running at ${handle.url}${mode}
+`);
+  process.stdout.write("Press Ctrl+C to stop.\n");
+  const shutdown = () => {
+    void handle.close().finally(() => process.exit(0));
+  };
+  process.once("SIGINT", shutdown);
+  process.once("SIGTERM", shutdown);
+  if (options.open) {
+    await openInBrowser(handle.url);
+  }
+}
+var DEFAULT_PORT = 4317;
+async function openInBrowser(filePath) {
+  const { spawn: spawn3 } = await import("child_process");
+  const platform = process.platform;
+  const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", filePath] : [filePath];
+  try {
+    const child = spawn3(command, args, { stdio: "ignore", detached: true });
+    child.on("error", (error) => {
+      debugWrite(`[portal] openInBrowser spawn error: ${error instanceof Error ? error.message : String(error)}`);
+    });
+    child.unref();
+  } catch (error) {
+    debugWrite(`[portal] openInBrowser failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+// src/bin.ts
+import { readFileSync as readFileSync11 } from "fs";
+import { fileURLToPath as fileURLToPath6 } from "url";
 import { dirname as dirname2, join as join7 } from "path";
-var __filename3 = fileURLToPath4(import.meta.url);
-var __dirname3 = dirname2(__filename3);
-var pkg = JSON.parse(readFileSync9(join7(__dirname3, "..", "package.json"), "utf-8"));
-var program = new Command2();
+var __filename3 = fileURLToPath6(import.meta.url);
+var __dirname4 = dirname2(__filename3);
+var pkg = JSON.parse(readFileSync11(join7(__dirname4, "..", "package.json"), "utf-8"));
+var program = new Command3();
 program.name("yg").description("Yggdrasil \u2014 architectural knowledge infrastructure for AI agents").version(pkg.version);
 registerInitCommand(program);
 registerBuildCommand(program);
@@ -22610,6 +24197,7 @@ registerTypeSuggestCommand(program);
 registerKnowledgeCommand(program);
 registerSchemasCommand(program);
 registerSuppressionsCommand(program);
+registerPortalCommand(program);
 process.on("unhandledRejection", (reason) => {
   const msg = reason instanceof Error ? reason.message : String(reason);
   process.stderr.write(`Error: ${msg}